joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6660ac
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x6660c3
add esp, 0xfffffff0
call fcn.00408518
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004e8564
mov eax, dword [0x717dcc]
cmp byte [eax], 0
jne 0x6660f0
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x184], al
mov eax, dword [0x71820c]
cmp word [eax + 2], 0
jne 0x66610a
mov eax, dword [0x71820c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00668294
mov eax, dword [0x7183ac]
cmp word [eax + 2], 0
jne 0x666124
mov eax, dword [0x7183ac]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00668498
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x570450]
call fcn.00576450
mov esi, eax
mov dword [ebx + 0x40], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x668a10
mov dl, 1
mov eax, dword [0x4afb3c]
call fcn.00407eec
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x4afb3c]
call fcn.00407eec
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0x64], eax
xor eax, eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x60], 0xff000018
mov dword [ebx + 0x7c], 0x1f4
mov byte [ebx + 0x80], 1
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x78], 0x9c4
mov byte [ebx + 0x8c], 0
mov byte [ebx + 0xa9], 1
mov byte [ebx + 0xc0], 1
mov dl, 1
mov eax, dword [0x574d30]
call fcn.0057fa90
mov esi, eax
mov dword [ebx + 0xa4], esi
push 0x666308
mov eax, dword [0x718060]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0057ff20
mov eax, dword [ebx + 0xa4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x668cf8
mov dl, 1
mov eax, dword [0x4afb3c]
call fcn.00407eec
mov dword [ebx + 0x9c], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x718060]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00452ba8
test eax, eax
je 0x666238
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.004529e4
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00452b8c
test eax, eax
je 0x666250
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x90]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040ac78
push ebx
push 0x667c70
call fcn.0065bc00
mov dword [ebx + 0x180], eax
mov byte [ebx + 0xd4], 0
mov eax, dword [0x717dcc]
cmp byte [eax], 0
jne 0x6662a1
mov eax, ebx
call fcn.006664c8
mov byte [ebx + 0x5d], 1
mov byte [ebx + 0x5e], 1
mov byte [ebx + 0x5f], 1
mov byte [ebx + 0xaa], 1
mov byte [ebx + 0xd5], 0
mov byte [ebx + 0xe0], 0
xor eax, eax
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xd7], 0
xor eax, eax
mov dword [ebx + 0xac], eax
mov eax, ebx
call fcn.00668f40
mov eax, ebx
call fcn.00669b6c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x6662fe
call fcn.00408570
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x666800
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x6668ac
cmp dword [ebx + 0x98], 0
jne 0x6668a6
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x666738
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x6668a6
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x66686c
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x6668a6
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.004d1758
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x66687b
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x666acc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x71f658]
cmp dword [eax + 0x178], 0
je 0x666c31
test bl, bl
jne 0x666b7f
cmp dword [esi + 0xa0], 0
jne 0x666b74
mov eax, esi
call fcn.006699bc
push eax
push 0x6669d8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x666b45
mov eax, dword [0x71f658]
cmp byte [eax + 0xd7], 0
je 0x666b45
mov eax, dword [esi + 0xdc]
call fcn.0040be60
mov edi, eax
cmp edi, 0
jl 0x666b45
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x666b2e
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x666b74
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.004d1758
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x666b54
inc dword [esi + 0xa0]
jmp 0x666c31
cmp dword [esi + 0xa0], 0
jle 0x666c31
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x666c31
cmp dword [esi + 0x48], 0
je 0x666bdc
mov eax, dword [0x71f658]
cmp byte [eax + 0xd7], 0
je 0x666bdc
mov eax, dword [esi + 0xdc]
call fcn.0040be60
mov edi, eax
cmp edi, 0
jl 0x666bdc
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x666bc5
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x666c0b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.004d1758
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x666beb
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x658500]
call fcn.0040c074
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x66788c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x6678e9
cmp byte [ebx + 0xd7], 0
jne 0x6678e9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409de8
mov eax, dword [esi]
test eax, eax
je 0x6678d6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x6678f6
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.0040a040
jmp 0x6678f6
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.0040a040
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x669128
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x669196
mov eax, esi
call fcn.005a5c70
test al, al
je 0x669196
mov eax, dword [ebx + 0x88]
call fcn.005a58bc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x669196
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x110]
test al, al
je 0x66918a
push 0
mov eax, dword [ebx + 0x88]
call fcn.005a58bc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.0059c5a8
jmp 0x669196
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.00668f60
pop esi
pop ebx
ret
Function at 0x672f98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409d44
xor eax, eax
push ebp
push 0x673056
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x673038
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040d97c
mov eax, dword [ebp - 8]
test eax, eax
je 0x672fe0
sub eax, 4
mov eax, dword [eax]
mov esi, eax
lea eax, [esi + 4]
mov dword [edi], eax
mov eax, dword [edi]
push eax
call fcn.0040d824
pop ecx
mov dword [ebx], eax
mov ebx, dword [ebx]
mov eax, edi
mov edx, ebx
mov ecx, 4
call fcn.004066ec
add ebx, 4
lea eax, [ebp - 8]
call fcn.0040a220
mov ecx, esi
mov edx, ebx
call fcn.004066ec
mov ecx, esi
dec ecx
test ecx, ecx
jl 0x673038
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + 0x715e47]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x673020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67305d
lea eax, [ebp - 8]
call fcn.00409c84
lea eax, [ebp - 4]
call fcn.00409c60
ret
Function at 0x6760ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x6760c5
add esp, 0xfffffff0
call fcn.00408518
mov dword [ebp - 4], ecx
mov byte [ebp - 9], dl
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00409d44
xor eax, eax
push ebp
push 0x67622f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x24], eax
mov byte [ebx + 0x21], 0
mov byte [ebx + 0x20], 0
mov dword [ebx + 0x1c], 0xffffffff
lea eax, [ebx + 0x18]
call fcn.00409c60
mov byte [ebx + 0x22], 0
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.005675c4
lea eax, [ebx + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [ebx + 0x14], eax
call fcn.00407f1c
mov dl, 1
mov eax, dword [0x674004]
call fcn.004d5e04
mov esi, eax
mov dword [ebx + 0x14], esi
lea eax, [ebx + 0xc]
sub eax, 4
mov dword [eax], esi
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 4]
call fcn.0040a040
cmp dword [ebx + 0x10], 0
je 0x6761fe
mov edx, dword [ebx + 0x10]
mov eax, ebx
call fcn.00675c78
mov eax, dword [ebx + 0x10]
mov dl, 1
call fcn.00451eb0
test al, al
jne 0x6761f4
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x10]
call fcn.004526b4
mov eax, dword [ebp - 4]
test eax, eax
je 0x67617f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x67618b
mov eax, dword [ebp - 4]
call fcn.00675e20
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
mov eax, dword [ebx + 0x10]
call fcn.0040abbc
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x6761f4
cmp dword [ebp + 8], 0
je 0x6761ee
mov eax, dword [ebp + 8]
mov dword [ebx + 0xc], eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
call fcn.0040be58
test eax, eax
jle 0x6761ee
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040be58
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call sub.kernel32.dll_WriteFile
push esi
call sub.kernel32.dll_CloseHandle
cmp dword [ebx + 0x24], 0
je 0x6761fe
mov byte [ebx + 0x21], 1
mov eax, dword [ebx + 0x14]
mov dword [eax + 0x44], ebx
mov dword [eax + 0x40], 0x675f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x676236
lea eax, [ebp - 8]
mov edx, dword [0x44a358]
call fcn.0040c198
lea eax, [ebp - 4]
call fcn.00409c60
ret
Function at 0x68406c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
dec ecx
test ecx, ecx
jl 0x6840db
inc ecx
xor ebx, ebx
mov eax, dword [ebp - 0x10]
and eax, 0xff
movzx edx, byte [esi + ebx]
xor eax, edx
mov edx, dword [eax*8 + 0x716424]
mov eax, dword [eax*8 + 0x716420]
push edx
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
shrd eax, edx, 8
shr edx, 8
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
inc ebx
dec ecx
jne 0x684090
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x6840ec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
dec ecx
test ecx, ecx
jl 0x684114
inc ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
xor esi, eax
and esi, 0xff
mov esi, dword [esi*4 + 0x71601c]
shr eax, 8
xor esi, eax
mov eax, esi
inc ebx
dec ecx
jne 0x6840f6
pop esi
pop ebx
ret
Function at 0x685414
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x68541d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x68563e
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00684f48
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x685616
cmp esi, 3
jl 0x685616
lea eax, [ebx + 0x14]
mov edx, dword [ebx + 4]
mov ecx, 0xfde9
call fcn.0040a3a8
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x685483
sub eax, 4
mov eax, dword [eax]
mov edx, esi
sub edx, eax
dec edx
lea eax, [ebx + 0x18]
mov ecx, 0xfde9
call fcn.0040a7e4
cmp dword [ebx + 0x18], 0
je 0x6854ca
lea eax, [ebx + 0x18]
call fcn.0040a220
mov esi, eax
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6854b1
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x6854bd
sub edx, 4
mov edx, dword [edx]
mov ecx, edx
add eax, dword [ebx + 4]
inc eax
mov edx, esi
call fcn.004066ec
cmp dword [ebx + 0xc], 0
je 0x685516
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x14]
call fcn.0040ac94
lea eax, [ebp - 8]
mov edx, 0x685660
call fcn.0040a088
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x6854f4
mov al, 1
jmp 0x685518
cmp dword [ebp - 4], 0
je 0x685500
cmp dword [ebp - 8], 0
jne 0x685504
xor eax, eax
jmp 0x685518
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00450978
test eax, eax
sete al
jmp 0x685518
xor eax, eax
test al, al
je 0x685616
cmp dword [ebx + 0x18], 0
je 0x685616
mov dl, 1
mov eax, dword [0x679d0c]
call fcn.004d5e04
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x68560f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov edx, dword [ebx + 0x18]
call fcn.0040ac94
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea ecx, [ebp - 0x20]
mov edx, 0x685678
mov eax, dword [ebp - 0x18]
call fcn.004d450c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebx + 0xc]
movzx edx, byte [edx + 0x144]
call fcn.00451708
mov edx, dword [ebx + 0xc]
mov byte [edx + 0x144], al
lea ecx, [ebp - 0x24]
mov edx, 0x6856a4
mov eax, dword [ebp - 0x18]
call fcn.004d450c
mov eax, dword [ebp - 0x24]
mov edx, dword [ebx + 0xc]
movzx edx, byte [edx + 0x160]
call fcn.00451708
test eax, eax
setne al
mov edx, dword [ebx + 0xc]
mov byte [edx + 0x160], al
lea ecx, [ebp - 0x28]
mov edx, 0x6856c4
mov eax, dword [ebp - 0x18]
call fcn.004d450c
mov eax, dword [ebp - 0x28]
mov edx, dword [ebx + 0xc]
movzx edx, byte [edx + 0x145]
call fcn.00451708
mov esi, dword [ebx + 0xc]
mov byte [esi + 0x145], al
mov eax, dword [ebx + 0xc]
movzx eax, byte [eax + 0x145]
cmp eax, 2
jbe 0x6855f9
mov byte [esi + 0x145], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x685616
mov eax, dword [ebp - 0x18]
call fcn.00407f1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x685645
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00409cc0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409cc0
ret
Function at 0x6887a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6887d1
dec al
je 0x68880c
dec al
je 0x688851
dec al
je 0x6888ba
jmp 0x688944
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x688944
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6887e1
jmp 0x688944
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x688944
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x68881c
jmp 0x688944
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x688944
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x688880
xor ebp, ebp
jmp 0x688890
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x688899
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x688861
jmp 0x688944
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x688944
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x688913
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00684118
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6888ce
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x69799c
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x697b3e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [esi + 5], eax
mov byte [esi], 0
xor ecx, ecx
mov edx, 6
mov eax, ebx
call fcn.006978c4
test al, al
je 0x697a08
mov eax, dword [0x718208]
cmp byte [eax], 0
je 0x6979f9
mov ecx, 0x407b
mov edx, 0x697b58
mov eax, 0x697c00
call fcn.00409aac
push 0x697c44
call sub.kernel32.dll_OutputDebugStringW
jmp 0x697b23
mov eax, ebx
call fcn.006974dc
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 5
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x697b23
mov byte [ebp - 0xd], 0xe9
sub edi, ebx
sub edi, 5
mov dword [ebp - 0xc], edi
movzx eax, byte [esi]
cmp al, byte [ebp - 0xd]
jne 0x697ad8
push 0x697c6c
call sub.kernel32.dll_OutputDebugStringW
movzx eax, byte [esi]
mov byte [ebp - 0xd], al
mov byte [esi], 0
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0xd], 0xe9
jne 0x697a82
mov edi, ebx
add edi, 5
add edi, dword [esi + 1]
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push edi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_ReadProcessMemory
lea eax, [ebp - 0x1c]
push eax
movzx eax, byte [ebp - 0xd]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x697ca8
call fcn.00452ec0
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x697ce0
call fcn.0040ae28
mov eax, dword [ebp - 0x18]
mov ecx, 0x40a2
mov edx, 0x697b58
call fcn.00409aac
jmp 0x697b23
mov dword [esi + 5], ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
lea eax, [ebp - 4]
push eax
push 5
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
test esi, esi
je 0x697b23
push 5
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x697b45
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00409cc0
ret
Function at 0x697d1c
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
cmp byte [esi], 0
je 0x697dc8
test ebx, ebx
je 0x697dc8
xor ecx, ecx
mov edx, 6
mov eax, ebx
call fcn.006978c4
test al, al
je 0x697d73
mov eax, dword [0x718208]
cmp byte [eax], 0
je 0x697d67
mov ecx, 0x40c1
mov edx, 0x697ddc
mov eax, 0x697e84
call fcn.00409aac
push 0x697ec8
call sub.kernel32.dll_OutputDebugStringW
jmp 0x697dc8
mov eax, ebx
call fcn.006974dc
mov ebx, eax
test ebx, ebx
je 0x697dc8
lea eax, [esp + 4]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
push esp
push 5
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
mov edi, eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
test edi, edi
je 0x697dc5
push 5
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
mov byte [esi], 0
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x69d848
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x69d8b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x69d8d0
call fcn.00452ec0
mov eax, dword [ebp - 4]
call fcn.0040abbc
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69d8be
lea eax, [ebp - 4]
call fcn.00409c60
ret

Function at 0x69da2c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x69da89
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x69daa0
call fcn.00452ec0
mov eax, dword [ebp - 4]
call fcn.0040abbc
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69da90
lea eax, [ebp - 4]
call fcn.00409c60
ret