joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55b3a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
cmp eax, 2
push edi
jne 0x55b459
mov edi, dword [ebp + 8]
mov edx, dword [0x8149e0]
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov cl, byte [edi]
mov esi, ecx
mov ecx, dword [ebp + 0x14]
shl edx, 8
mov ebx, ecx
add ebx, edx
mov dl, byte [esi + ebx + 0x14]
mov bl, byte [edi + 1]
xor dl, bl
mov ebx, ecx
mov byte [eax + 1], dl
mov esi, dword [0x8149e0]
inc esi
xor edx, edx
mov dword [0x8149e0], esi
mov dl, byte [eax + 1]
shl esi, 8
add ebx, esi
mov dl, byte [edx + ebx + 0x14]
mov bl, byte [edi]
xor dl, bl
mov edi, ecx
mov byte [eax], dl
mov esi, dword [0x8149e0]
inc esi
xor edx, edx
mov dword [0x8149e0], esi
mov dl, byte [eax]
mov bl, byte [eax + 1]
shl esi, 8
add edi, esi
mov dl, byte [edx + edi + 0x14]
pop edi
xor bl, dl
xor edx, edx
mov byte [eax + 1], bl
mov esi, dword [0x8149e0]
inc esi
mov dword [0x8149e0], esi
mov dl, byte [eax + 1]
shl esi, 8
add ecx, esi
pop esi
pop ebx
mov cl, byte [edx + ecx + 0x14]
mov dl, byte [eax]
xor dl, cl
mov byte [eax], dl
mov eax, dword [0x8149e0]
inc eax
mov dword [0x8149e0], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0x14]
cdq
sub eax, edx
push ebx
mov esi, eax
mov eax, dword [ebp + 8]
sar esi, 1
lea edx, [ebp - 8]
push esi
push edx
push eax
call fcn.0055b3a0
mov edi, dword [ebp + 0xc]
add esp, 0x10
xor ecx, ecx
test esi, esi
jle 0x55b498
mov edx, dword [ebp + 8]
lea eax, [esi + edi]
sub edx, edi
mov bl, byte [edx + eax]
xor bl, byte [ebp + ecx - 8]
inc ecx
mov byte [eax], bl
inc eax
cmp ecx, esi
jl 0x55b486
mov ebx, dword [ebp + 0x14]
push ebx
lea ecx, [ebp - 8]
lea eax, [esi + edi]
push esi
push ecx
push eax
call fcn.0055b3a0
add esp, 0x10
xor ecx, ecx
test esi, esi
jle 0x55b4e5
mov edx, dword [ebp + 8]
lea eax, [ebp - 8]
sub edx, eax
mov eax, edi
lea ebx, [ebp - 8]
mov dword [ebp + 8], edx
sub eax, ebx
mov dword [ebp + 0xc], eax
jmp 0x55b4ca
mov edx, dword [ebp + 8]
mov bl, byte [ebp + ecx - 8]
lea eax, [ebp + ecx - 8]
mov dl, byte [edx + eax]
xor dl, bl
mov ebx, dword [ebp + 0xc]
inc ecx
cmp ecx, esi
mov byte [ebx + eax], dl
jl 0x55b4c7
mov ebx, dword [ebp + 0x14]
push ebx
lea eax, [ebp - 8]
push esi
push eax
push edi
call fcn.0055b3a0
add esp, 0x10
xor eax, eax
test esi, esi
jle 0x55b509
mov dl, byte [ebp + eax - 8]
lea ecx, [esi + edi]
xor byte [ecx + eax], dl
inc eax
cmp eax, esi
jl 0x55b4fa
push ebx
lea eax, [ebp - 8]
push esi
push eax
lea eax, [esi + edi]
push eax
call fcn.0055b3a0
add esp, 0x10
test esi, esi
jle 0x55b533
lea ecx, [ebp - 8]
mov eax, edi
sub ecx, edi
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x55b526
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55b540
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
jle 0x55b569
mov ecx, dword [ebp + 8]
mov edx, esi
xor eax, eax
mov byte [ecx + eax], al
inc eax
cmp eax, 0x100
jl 0x55b555
add ecx, 0x100
dec edx
jne 0x55b553
mov eax, dword [ebp + 0x10]
xor edx, edx
test esi, esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], edx
jle 0x55b632
xor esi, esi
push ebx
push edi
mov dword [ebp - 0xc], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], 0
add esi, ecx
mov dword [ebp - 0x14], 8
mov eax, dword [ebp - 8]
xor ecx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0x800000ff
jns 0x55b5af
dec eax
or eax, 0xffffff00
inc eax
mov edi, dword [ebp - 0xc]
xor ebx, ebx
add eax, edi
mov edi, dword [ebp + 8]
mov bl, byte [eax + edi]
mov edi, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + edi]
mov edi, dword [ebp - 0x10]
add edi, ebx
add edi, eax
and edi, 0x800000ff
jns 0x55b5db
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [esi + edi]
mov al, byte [esi + ecx]
mov byte [esi + ecx], bl
mov byte [esi + edi], al
lea eax, [edx + 1]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 4]
cdq
idiv dword [ebp + 0x10]
inc ecx
inc edi
cmp ecx, 0x100
mov dword [ebp - 4], edi
jl 0x55b59e
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
add edi, eax
dec ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], ecx
jne 0x55b596
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
inc eax
add esi, 0x100
cmp eax, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], esi
jl 0x55b583
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x568020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x568041
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x44], edx
mov eax, dword [eax + 0x58]
add eax, 4
push 1
push eax
call fcn.007154a8
mov ecx, dword [eax + 0x10]
push eax
call dword [ecx + 0x28]
add esp, 4
push 1
call fcn.00715395
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x568a70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
inc word [esi + 0x2e]
mov ax, word [esi + 0x2e]
cmp ax, 0xc8
jb 0x568a99
jne 0x568b8f
push 0x7792e8
push esi
call fcn.00567f80
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.00568530
add esp, 8
test eax, eax
jne 0x568ab3
push esi
call fcn.0057b6c0
add esp, 4
mov cl, byte [esi + 0x30]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
test cl, 2
mov edi, eax
mov dword [ebp + 8], ebx
je 0x568b15
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
sub eax, edx
push 1
push esi
mov dword [ebp + 0xc], eax
call fcn.00568330
mov eax, dword [esi + 0x14]
add esp, 0xc
test byte [eax + 8], 1
jne 0x568b0d
mov ecx, dword [eax + 0x14]
test ecx, ecx
lea edx, [ecx - 1]
mov dword [eax + 0x14], edx
je 0x568b0d
push 0xffffffffffffffff
push 4
push esi
call fcn.00568330
mov eax, dword [esi + 0x14]
add esp, 0xc
mov ecx, dword [eax + 0x14]
test ecx, ecx
lea edx, [ecx - 1]
mov dword [eax + 0x14], edx
jne 0x568af0
mov edi, dword [esi + 0x1c]
mov eax, dword [ebp + 0xc]
add edi, eax
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0xc]
add edx, 0xffffffe8
sub eax, 0x10
mov ecx, edx
mov dword [esi + 0x14], edx
test ebx, ebx
mov ecx, dword [ecx]
mov dword [esi + 0xc], ecx
je 0x568b57
cmp edi, dword [esi + 8]
jae 0x568b57
mov ecx, edi
mov edx, eax
add edi, 0x10
add eax, 0x10
mov ebx, dword [ecx]
mov dword [edx], ebx
mov ebx, dword [ecx + 8]
mov dword [edx + 8], ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ecx + 0xc]
dec ebx
mov dword [edx + 0xc], ecx
mov dword [ebp + 8], ebx
jne 0x568b2f
mov edx, ebx
dec ebx
test edx, edx
jle 0x568b6d
lea ecx, [ebx + 1]
mov dword [eax], 0
add eax, 0x10
dec ecx
jne 0x568b61
dec word [esi + 0x2e]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x10]
pop edi
pop ebx
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
cmp ecx, edx
jb 0x568b8c
push esi
call fcn.0056a2d0
add esp, 4
pop esi
pop ebp
ret
cmp ax, 0xe1
jb 0x568a99
mov eax, dword [esi + 0x58]
test eax, eax
je 0x568bb5
mov dword [eax + 0x44], 5
mov eax, dword [esi + 0x58]
add eax, 4
push 1
push eax
call fcn.007154a8
mov ecx, dword [esi + 0x10]
push esi
call dword [ecx + 0x28]
add esp, 4
push 1
call fcn.00715395
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x575e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov eax, esi
mov edi, esi
shr eax, 5
inc eax
mov dword [ebp - 4], edi
cmp esi, eax
mov ecx, esi
jb 0x575e6d
mov ebx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ebx + ecx - 1]
mov ebx, edi
shl ebx, 5
add edx, ebx
mov ebx, edi
shr ebx, 2
add edx, ebx
sub ecx, eax
xor edi, edx
cmp ecx, eax
jae 0x575e4b
mov dword [ebp - 4], edi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, edi
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x575ea5
cmp dword [eax + 0xc], esi
jne 0x575e9f
mov ecx, esi
mov esi, dword [ebp + 0xc]
lea edi, [eax + 0x10]
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x575f29
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x575e82
lea ecx, [esi + 0x11]
push ecx
push 0
push 0
push edx
call fcn.0056ef10
mov ebx, eax
mov ecx, esi
mov edx, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc], esi
mov esi, dword [ebp + 0xc]
mov dword [ebx + 8], edi
lea edi, [ebx + 0x10]
shr ecx, 2
mov byte [ebx + 5], 0
mov byte [ebx + 4], 4
mov byte [ebx + 6], 0
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov byte [ebx + eax + 0x10], 0
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 8]
dec ecx
and ecx, esi
mov esi, dword [eax]
mov esi, dword [esi + ecx*4]
mov dword [ebx], esi
mov esi, dword [eax]
mov dword [esi + ecx*4], ebx
mov edi, dword [eax + 4]
inc edi
mov dword [eax + 4], edi
mov eax, dword [eax + 8]
mov ecx, edi
cmp ecx, eax
jle 0x575f27
cmp eax, 0x3ffffffe
jg 0x575f27
lea ecx, [eax + eax]
push ecx
push edx
call fcn.00575d90
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57d410
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, 0xf
cmp ecx, eax
je 0x57d429
xor al, al
pop esi
pop ebp
ret 4
push ebx
xor ebx, ebx
push 0x77a204
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x57d4c3
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x77a1f8
push eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
push 0x77a1ec
push eax
call edi
mov ecx, dword [esi + 8]
push 0x77a1e0
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 8]
push 0x77a1d0
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
call dword [esi + 0xc]
cmp eax, ebx
mov dword [esi], eax
pop edi
je 0x57d4b0
push 0x77a19c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov bl, 1
mov al, bl
pop ebx
pop esi
pop ebp
ret 4
push 0x77a170
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, bl
pop ebx
pop esi
pop ebp
ret 4
push 0x77a140
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, bl
pop ebx
pop esi
pop ebp
ret 4

Function at 0x57f2e0
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
push esi
lea eax, [ebp - 0x100]
push edi
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x77a53c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x100]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x76b340
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [ebp + 0xc]
and ecx, 3
lea edx, [ebp - 0x100]
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x100]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.007125fe
add esp, 8
test eax, eax
jne 0x57f3a2
lea ecx, [ebp - 0x100]
lea edx, [ebp - 0x200]
push ecx
push 0x77a52c
push edx
call fcn.00711e28
lea eax, [ebp - 0x200]
push eax
call fcn.00531ef0
add esp, 0x10
push 0
call fcn.00715395
mov ecx, dword [0x835ea0]
test ecx, ecx
je 0x57f3c4
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x100]
push edx
push ebx
push eax
call fcn.0057ea80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a5060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [0x770b48]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x210]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x210]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x78cc2c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x210]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x76a664
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x83e158]
test edi, edi
jne 0x5a5104
mov edi, 0x73a7f4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x210]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 1
lea ecx, [ebp - 0x210]
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call esi
test eax, eax
jne 0x5a51a9
mov edx, dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
lea eax, [ebp - 4]
lea ecx, [ebp - 0x210]
push eax
push 0xf003f
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call esi
test eax, eax
jne 0x5a51a9
mov eax, 4
lea edx, [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebx + 0x424]
push edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push eax
push ecx
push 0
push 0x78cc28
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
push eax
call edi
mov eax, dword [ebx + 0x424]
test eax, eax
je 0x5a51c2
cmp eax, 1
je 0x5a51c2
mov dword [ebx + 0x424], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b7fa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x733cee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov al, byte [ebx]
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov byte [esi], al
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov ecx, dword [0x73a7f0]
push ecx
push edi
push ebx
mov ecx, esi
call fcn.0041fed0
mov dl, byte [ebx + 0x10]
lea eax, [ebx + 0x10]
lea ecx, [esi + 0x10]
mov dword [ebp - 4], edi
mov byte [ecx], dl
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov edx, dword [0x73a7f0]
push edx
push edi
push eax
call fcn.0041fed0
mov dl, byte [ebx + 0x20]
lea eax, [ebx + 0x20]
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
mov byte [ecx], dl
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov edx, dword [0x73a7f0]
push edx
push edi
push eax
call fcn.0041fed0
mov dl, byte [ebx + 0x30]
lea eax, [ebx + 0x30]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov byte [ecx], dl
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov edx, dword [0x73a7f0]
push edx
push edi
push eax
call fcn.0041fed0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x618bd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x814260
call fcn.00533580
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 0xb4]
push ecx
mov ecx, eax
call fcn.00529760
mov edi, eax
mov eax, dword [edi + 0x5c]
cmp eax, 2
je 0x618c08
cmp eax, 7
jne 0x618c1e
mov al, byte [edi + 0x89]
test al, al
je 0x618c71
mov edx, dword [edi]
xor ebx, ebx
push ebx
mov ecx, edi
call dword [edx + 0x28]
jmp 0x618c20
xor ebx, ebx
cmp edi, ebx
je 0x618cc0
cmp dword [esi + 8], ebx
jne 0x618c7c
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x618c3c
mov ebx, dword [0x83e260]
jmp 0x618c47
cmp eax, 1
jne 0x618cc0
mov ebx, dword [0x83e2fc]
test ebx, ebx
je 0x618cbe
test eax, eax
jne 0x618cbe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp ebx, 0x1d
mov dword [esi + 8], eax
jne 0x618c71
mov eax, dword [edi]
push 0
push 4
push 0x38
mov ecx, edi
call dword [eax + 0x1c]
mov dword [esi + 0xc], 0xbb8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
sub eax, edx
cmp eax, ecx
jbe 0x618cc0
mov edx, dword [edi]
push ebx
mov ecx, edi
call dword [edx + 0x28]
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x618cab
mov dword [0x83e260], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
jmp 0x618cc0
cmp eax, 1
jne 0x618cb6
mov dword [0x83e2fc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
jmp 0x618cc0
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esi + 0x14]
mov ecx, eax
sub ecx, edi
cmp ecx, 0x8c
jb 0x618c71
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x618c71
push 0x78f530
push eax
call fcn.0055eef0
mov edx, dword [esi + 4]
push 0xffffd8ef
push edx
call fcn.0055f0e0
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
fild qword [ebp - 8]
add esp, 8
fstp qword [esp]
push ecx
call fcn.0055ee70
mov edx, dword [esi + 4]
push ebx
push ebx
push 1
push edx
call fcn.0055f860
add esp, 0x1c
test eax, eax
je 0x618c71
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call fcn.0055e990
push eax
lea ecx, [ebp - 0x408]
push 0x771b1c
push ecx
call fcn.00711e28
lea edx, [ebp - 0x408]
push edx
call fcn.00405d90
add esp, 0x18
lea eax, [ebp - 0x408]
push ebx
push 0x78f518
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x618d7e
push eax
call fcn.00575c60
add esp, 4
mov dword [esi + 4], ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6203f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x736504
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov al, byte [edi]
mov dword [ebp - 0x10], esi
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [0x73a7f0]
push ecx
push ebx
push edi
mov ecx, esi
call fcn.0041fed0
mov dl, byte [edi + 0x10]
lea ecx, [esi + 0x10]
push ebx
mov dword [ebp - 4], ebx
mov byte [ecx], dl
call fcn.00420200
mov eax, dword [0x73a7f0]
lea ecx, [esi + 0x10]
push eax
lea eax, [edi + 0x10]
push ebx
push eax
call fcn.0041fed0
mov dl, byte [edi + 0x20]
lea eax, [edi + 0x20]
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov edx, dword [0x73a7f0]
push edx
push ebx
push eax
call fcn.0041fed0
mov al, byte [edi + 0x30]
lea ecx, [esi + 0x30]
push ebx
mov byte [ebp - 4], 2
mov byte [ecx], al
call fcn.00420200
mov ecx, dword [0x73a7f0]
lea eax, [edi + 0x30]
push ecx
push ebx
push eax
lea ecx, [esi + 0x30]
call fcn.0041fed0
mov dl, byte [edi + 0x40]
lea eax, [edi + 0x40]
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 3
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov edx, dword [0x73a7f0]
push edx
push ebx
push eax
call fcn.0041fed0
mov al, byte [edi + 0x50]
lea ecx, [esi + 0x50]
push ebx
mov byte [ebp - 4], 4
mov byte [ecx], al
call fcn.00420200
mov ecx, dword [0x73a7f0]
lea eax, [edi + 0x50]
push ecx
push ebx
push eax
lea ecx, [esi + 0x50]
call fcn.0041fed0
mov dl, byte [edi + 0x60]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x60], dl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x6219d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7366a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov cl, byte [eax]
push edi
mov edi, dword [ebp + 0x10]
mov byte [esi], cl
xor ebx, ebx
add esi, 4
mov dl, byte [edi]
push ebx
mov ecx, esi
mov dword [ebp - 0x10], ebx
mov dword [ebp + 0xc], esi
mov byte [esi], dl
call fcn.00420200
mov eax, dword [0x73a7f0]
mov ecx, esi
push eax
push ebx
push edi
call fcn.0041fed0
mov cl, byte [edi + 0x10]
mov dword [ebp - 4], ebx
lea ebx, [esi + 0x10]
push 0
mov byte [ebx], cl
mov ecx, ebx
call fcn.00420200
mov edx, dword [0x73a7f0]
lea eax, [edi + 0x10]
push edx
push 0
push eax
mov ecx, ebx
call fcn.0041fed0
mov al, byte [edi + 0x20]
lea ebx, [esi + 0x20]
push 0
mov ecx, ebx
mov byte [ebp - 4], 1
mov byte [ebx], al
call fcn.00420200
mov ecx, dword [0x73a7f0]
lea eax, [edi + 0x20]
push ecx
push 0
push eax
mov ecx, ebx
call fcn.0041fed0
mov dl, byte [edi + 0x30]
lea ebx, [esi + 0x30]
push 0
mov ecx, ebx
mov byte [ebp - 4], 2
mov byte [ebx], dl
call fcn.00420200
mov eax, dword [0x73a7f0]
mov ecx, ebx
push eax
lea eax, [edi + 0x30]
push 0
push eax
call fcn.0041fed0
mov dl, byte [edi + 0x40]
lea eax, [edi + 0x40]
lea ecx, [esi + 0x40]
xor ebx, ebx
mov byte [ebp - 4], 3
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov edx, dword [0x73a7f0]
push edx
push ebx
push eax
call fcn.0041fed0
mov dl, byte [edi + 0x50]
lea eax, [edi + 0x50]
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov edx, dword [0x73a7f0]
push edx
push ebx
push eax
call fcn.0041fed0
mov al, byte [edi + 0x60]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x60], al
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x6b38c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], 0
mov eax, dword [ebx + 0x1ac]
test eax, eax
jle 0x6b3a26
lea eax, [ebx + 0x688]
push esi
push edi
mov dword [ebp - 4], eax
jmp 0x6b38ee
mov eax, dword [ebp - 4]
mov ecx, dword [ebx + 4]
lea edi, [eax + 0x40]
mov dword [eax - 8], ecx
mov edx, dword [ebx + 8]
mov dword [eax - 4], edx
mov ecx, dword [ebx + 0xc]
mov dword [eax], ecx
mov edx, dword [ebx + 0x380]
mov dword [eax + 4], edx
mov ecx, dword [ebx + 0x384]
mov dword [eax + 8], ecx
mov edx, dword [ebx + 0x388]
mov dword [eax + 0xc], edx
mov ecx, dword [ebx + 0x38c]
mov dword [eax + 0x10], ecx
mov edx, dword [ebx + 0x390]
mov dword [eax + 0x14], edx
mov ecx, dword [ebx + 0x394]
mov dword [eax + 0x18], ecx
mov edx, dword [ebx + 0x398]
mov dword [eax + 0x1c], edx
mov ecx, dword [ebx + 0x39c]
mov dword [eax + 0x20], ecx
mov edx, dword [ebx + 0x3a0]
mov dword [eax + 0x24], edx
mov ecx, dword [ebx + 0x3a4]
mov dword [eax + 0x28], ecx
mov edx, dword [ebx + 0x3a8]
mov dword [eax + 0x2c], edx
mov ecx, dword [ebx + 0x3ac]
mov dword [eax + 0x30], ecx
mov edx, dword [ebx + 0x310]
mov dword [eax + 0x34], edx
mov ecx, dword [ebx + 0x2e0]
mov dword [eax + 0x38], ecx
mov edx, dword [ebx + 0x2d4]
mov ecx, 0xc
lea esi, [ebx + 0x11c]
mov dword [eax + 0x3c], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x2ec]
mov dword [eax + 0x7c], ecx
mov edx, dword [ebx + 0x1f4]
mov dword [eax + 0x70], edx
mov ecx, dword [ebx + 0x1f8]
mov dword [eax + 0x74], ecx
mov edx, dword [ebx + 0x1fc]
mov dword [eax + 0x78], edx
fld dword [ebx + 0x2ec]
call fcn.007123f0
mov ecx, dword [ebx + 0x1f4]
mov edx, dword [ebx + 0x1f8]
and eax, 0xff
and ecx, 0xff
shl eax, 8
add eax, ecx
mov ecx, dword [ebx + 0x1fc]
shl eax, 8
and edx, 0xff
and ecx, 0xff
add eax, edx
shl eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x80], eax
mov eax, dword [ebp - 8]
add ecx, 0x8c
inc eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebx + 0x1ac]
cmp eax, ecx
mov dword [ebp - 8], eax
jl 0x6b38eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret