joyce8/EMBER2024-capa huggingface dataset:
Function at 0x609020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x20]
mov esi, edx
push eax
call fcn.0060f3a0
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x609058
xor bl, bl
jmp 0x609061
shr eax, 4
mov bl, 1
and al, 1
mov byte [esi], al
dec dword [0x674754]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x20], 0x669c14
cmp edx, 8
jb 0x6090a4
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x60909a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6090b6
push edx
push ecx
call fcn.006317bc
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00631776
mov esp, ebp
pop ebp
ret
call fcn.006375a6
int3

Function at 0x6090c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x659a71
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x48], 0
test ebx, ebx
je 0x6091cd
cmp dword [ebp + 8], 0
jle 0x6091cd
lea eax, [ebp - 0x44]
push eax
call fcn.0060f3a0
mov dword [ebp - 4], 1
lea edx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x48], 1
call fcn.0060ede0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x669954
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0063af6f
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov esi, eax
cmp edx, 0x10
jb 0x609185
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x60917b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6091ed
push edx
push ecx
call fcn.006317bc
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
test esi, esi
jne 0x6091aa
lea ecx, [ebp - 0x44]
or esi, 0xffffffff
call fcn.0060ed70
mov eax, esi
jmp 0x6091d2
push esi
push 1
push dword [ebp + 8]
push ebx
call fcn.0063baa2
push esi
call fcn.0063b1e3
add esp, 0x14
lea ecx, [ebp - 0x44]
xor esi, esi
call fcn.0060ed70
mov eax, esi
jmp 0x6091d2
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret
call fcn.006375a6
int3
Function at 0x60a5f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x659b78
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x60a729
cmp byte [ebx + 0x3d], 0
je 0x60a729
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x60a644
xor al, al
jmp 0x60a72b
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00609220
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
nop dword [eax]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
cmovae esi, eax
cmovae edi, eax
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x60a69f
sub eax, 1
je 0x60a6a3
mov edx, dword [ebp - 0x14]
sub eax, 2
mov eax, dword [ebp - 0x28]
je 0x60a6f9
xor bl, bl
jmp 0x60a6fb
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae ecx, eax
sub esi, ecx
je 0x60a6db
push dword [ebx + 0x4c]
cmp edx, 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, eax
push 1
push ecx
call fcn.0063baa2
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
mov eax, dword [ebp - 0x28]
jne 0x60a69b
cmp byte [ebx + 0x3d], 0
je 0x60a6f9
test esi, esi
jne 0x60a660
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00603400
jmp 0x60a657
mov bl, 1
cmp edx, 0x10
jb 0x60a725
inc edx
mov ecx, eax
cmp edx, 0x1000
jb 0x60a71b
mov eax, dword [eax - 4]
add edx, 0x23
sub ecx, eax
add ecx, 0xfffffffc
cmp ecx, 0x1f
ja 0x60a747
push edx
push eax
call fcn.006317bc
add esp, 8
mov al, bl
jmp 0x60a72b
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret
call fcn.006375a6
int3
Function at 0x60a9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x659bd0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x67206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], 0x669974
call fcn.0063178c
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0062f5b0
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov ecx, edi
mov eax, dword [edi + 0x20]
push 0
push 0
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], 0x6699b4
call fcn.0060a750
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x60d120
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65a183
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x68], edi
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0xf
mov dword [ebp - 0x6c], edi
mov byte [edi + 0xc], 0
mov dword [ebp - 4], 0
cmp dword [0x6729e8], 0x75bcd0d
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
mov byte [edi + 8], 0
je 0x60d252
cmp dword [0x6729e8], 0x75bcd0e
je 0x60d252
xor eax, eax
mov dword [ebp - 0x2c], 0x669c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 0x12
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
inc dword [0x674754]
push 0x669b5c
call fcn.00611370
push 0x20a
mov byte [ebp - 4], 2
call fcn.006317ca
add esp, 4
mov esi, eax
xor eax, eax
push 0x104
push esi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push esi
lea ecx, [ebp - 0x64]
call fcn.0060e970
push esi
call fcn.00631787
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x48]
call fcn.00610be0
add esp, 8
lea ecx, [ebp - 0x64]
call fcn.0060ed70
lea ecx, [ebp - 0x2c]
call fcn.0060ed70
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
lea ecx, [ebp - 0x48]
neg eax
sbb eax, eax
add eax, 0x75bcd0e
mov dword [0x6729e8], eax
call fcn.0060ed70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret
Function at 0x60d2d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6749c8], 0
push ebx
push edi
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x124], edi
jne 0x60d4dd
cmp byte [0x6749cd], 0
push esi
jne 0x60d37b
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00633cb0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
push eax
call esi
test eax, eax
jne 0x60d350
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0x60d374
cmp dword [ebp - 0x118], 2
jb 0x60d374
movzx eax, byte [0x6749cc]
mov ecx, 1
cmp dword [ebp - 0x11c], 6
cmovae eax, ecx
mov byte [0x6749cc], al
mov byte [0x6749cd], 1
cmp byte [0x6749cc], 0
je 0x60d4dc
lea eax, [ebp - 0x128]
mov dword [0x6749c8], 0
push eax
push 0x669b9c
mov dword [ebp - 0x130], 0
xor esi, esi
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x12c], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x60d4a6
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x60d4b7
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x60d4a6
lea eax, [ebp - 0x12c]
push eax
push 0x669b84
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x60d4a6
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x60d4a6
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x60d4a6
push dword [ebp - 0x12c]
mov edi, dword [sym.imp.ADVAPI32.dll_GetLengthSid]
call edi
push dword [ebp - 0x128]
mov esi, eax
call edi
lea edi, [eax + 0x18]
add edi, esi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x60d4a0
push 2
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x60d4a0
push dword [ebp - 0x128]
mov edi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
push 0x10000000
push 2
push esi
call edi
test eax, eax
je 0x60d4a0
push dword [ebp - 0x12c]
push 0x10000000
push 2
push esi
call edi
mov edi, dword [ebp - 0x124]
test eax, eax
je 0x60d4a6
mov dword [0x6749c8], esi
mov dword [ebp - 0x130], 1
jmp 0x60d4a6
mov edi, dword [ebp - 0x124]
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x60d4b7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x60d4c8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x60d4dc
cmp dword [ebp - 0x130], 0
jne 0x60d4dc
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push dword [0x6749c8]
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov ecx, dword [ebp - 4]
mov dword [edi + 4], ebx
xor ecx, ebp
mov dword [edi], 0xc
mov dword [edi + 8], 0
pop edi
pop ebx
call fcn.00631776
mov esp, ebp
pop ebp
ret
Function at 0x60de50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65a2cc
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 4], 0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
je 0x60dfeb
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 0x834], 1
push 0
push eax
call fcn.00633cb0
lea eax, [esi + 4]
mov dword [ebp - 0x830], 0x800
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x60decb
mov eax, dword [eax]
lea ecx, [ebp - 0x830]
push ecx
lea ecx, [ebp - 0x810]
push ecx
lea ecx, [ebp - 0x834]
push ecx
push 0
push eax
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
lea edi, [ebx + 4]
xor eax, eax
mov dword [ebp - 0x82c], 0x669c14
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
test esi, esi
jne 0x60df94
lea ecx, [ebp - 0x810]
mov dword [ebp - 4], esi
inc dword [0x674754]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x60df36
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x828]
call fcn.00611370
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 1
cmp edi, eax
je 0x60df85
cmp dword [ebp - 0x814], 8
mov ecx, edi
push dword [ebp - 0x818]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00611370
lea ecx, [ebp - 0x82c]
call fcn.0060ed70
mov al, 1
jmp 0x60dfed
push 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x828]
inc dword [0x674754]
push 0x6695b4
call fcn.00611370
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 3
cmp edi, eax
je 0x60dfe0
cmp dword [ebp - 0x814], 8
mov ecx, edi
push dword [ebp - 0x818]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00611370
lea ecx, [ebp - 0x82c]
call fcn.0060ed70
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret 8
Function at 0x60f3a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65a5c7
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x830]
push eax
mov dword [ebp - 0x834], esi
call fcn.00610230
push 0x802
lea eax, [ebp - 0x814]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00633cb0
add esp, 0xc
lea ecx, [ebp - 0x814]
cmp dword [ebp - 0x818], 8
lea eax, [ebp - 0x82c]
cmovae eax, dword [ebp - 0x82c]
push 0x400
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esi], 0x669c14
lea edx, [esi + 4]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
test eax, eax
je 0x60f478
xor eax, eax
mov word [edx], ax
lea ecx, [ebp - 0x814]
mov byte [ebp - 4], 1
inc dword [0x674754]
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x60f460
sub ecx, edi
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
jmp 0x60f4a5
xor eax, eax
mov word [edx], ax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x82c]
inc dword [0x674754]
cmp edx, eax
je 0x60f4ad
cmp dword [ebp - 0x818], 8
push dword [ebp - 0x81c]
cmovae eax, dword [ebp - 0x82c]
push eax
mov ecx, edx
call fcn.00611370
lea ecx, [ebp - 0x830]
call fcn.0060ed70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret 4
Function at 0x6138f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
mov eax, dword [0x67206c]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
mov esi, dword [ebp + 0xc]
mov eax, edx
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 8]
push edi
mov edx, dword [eax]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi]
mov dword [esi], 0
mov dword [eax], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [edi], 0
cmp ecx, 5
jae 0x61395f
mov eax, 6
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.00631776
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
movzx ecx, byte [edx + 4]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, 0x1000
cmp ecx, eax
cmovb ecx, eax
mov al, byte [edx]
mov dword [esp + 0x2c], ecx
cmp al, 0xe1
jae 0x613aa2
xor edx, edx
movzx eax, al
mov ecx, 9
div ecx
mov ecx, 5
mov dword [esp + 0x20], edx
xor edx, edx
movzx eax, al
div ecx
push ecx
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x24]
mov dword [esp + 0x2c], eax
call fcn.00613890
add esp, 4
test eax, eax
jne 0x613aa7
mov ecx, dword [esp + 0x10]
mov edx, ecx
movups xmm0, xmmword [esp + 0x20]
mov eax, dword [esp + 0xc]
push edi
push ecx
push esi
push dword [esp + 0x24]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x48]
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x94], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x98], 1
mov dword [esi], eax
call fcn.006135f0
mov ecx, dword [esp + 0x6c]
mov esi, eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov dword [eax], ecx
test esi, esi
jne 0x613a7a
cmp dword [edi], 3
mov eax, 6
cmove esi, eax
push dword [esp + 0x48]
push 0x672acc
call dword [fcn.00672ad0]
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.00631776
mov esp, ebp
pop ebp
ret
mov eax, 4
mov ecx, dword [esp + 0xac]
pop edi
pop esi
xor ecx, esp
call fcn.00631776
mov esp, ebp
pop ebp
ret
Function at 0x6143b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x659910
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x67206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x65e104
call fcn.0063178c
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0062f5b0
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x624970
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x22c
lea eax, [ebp - 0x230]
mov dword [ebp - 0x234], ecx
push 0
push eax
call fcn.00633cb0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x23c], ebx
cmp ebx, 0xffffffff
je 0x624c01
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x624c01
push esi
push edi
nop dword [eax]
mov cx, word [ebp - 0x20c]
mov bx, word [ebp - 0x202]
mov di, word [ebp - 0x204]
mov si, word [ebp - 0x206]
mov dx, word [ebp - 0x208]
mov ax, word [ebp - 0x20a]
cmp cx, 0x69
jne 0x624a23
cmp ax, 0x64
jne 0x624be3
cmp dx, 0x61
jmp 0x624b93
cmp cx, 0x77
jne 0x624a50
cmp ax, 0x69
jne 0x624be3
cmp dx, 0x6e
jne 0x624be3
cmp si, 0x64
jne 0x624be3
cmp di, 0x62
jmp 0x624b93
cmp cx, 0x4f
jne 0x624a7c
cmp ax, 0x6c
jne 0x624be3
cmp dx, ax
jne 0x624be3
cmp si, 0x79
jne 0x624be3
cmp di, 0x44
jmp 0x624b93
cmp cx, 0x57
jne 0x624aa9
cmp ax, 0x69
jne 0x624be3
cmp dx, 0x72
jne 0x624be3
cmp si, 0x65
jne 0x624be3
cmp di, 0x73
jmp 0x624b93
cmp cx, 0x53
jne 0x624af9
cmp ax, 0x6e
jne 0x624ac8
cmp dx, 0x69
jne 0x624be3
cmp si, 0x66
jmp 0x624b93
cmp ax, 0x75
jne 0x624be3
cmp dx, 0x70
jne 0x624be3
cmp si, 0x65
jne 0x624be3
cmp di, 0x72
jne 0x624be3
cmp bx, 0x4b
jmp 0x624b93
cmp cx, 0x56
jne 0x624b08
cmp ax, 0x4d
jmp 0x624b93
cmp cx, 0x76
jne 0x624b14
cmp ax, 0x6d
jmp 0x624b93
cmp cx, 0x50
jne 0x624b71
cmp ax, 0x72
jne 0x624b43
cmp dx, 0x6f
jne 0x624be3
cmp si, 0x63
jne 0x624be3
cmp di, 0x6d
jne 0x624be3
cmp bx, dx
jmp 0x624b93
cmp ax, 0x43
jne 0x624be3
cmp dx, 0x48
jne 0x624be3
cmp si, 0x75
jne 0x624be3
cmp di, 0x6e
jne 0x624be3
cmp bx, 0x74
jmp 0x624b93
cmp cx, 0x70
jne 0x624baa
cmp ax, 0x72
jne 0x624be3
cmp dx, 0x6f
jne 0x624be3
cmp si, 0x63
jne 0x624be3
cmp di, 0x65
jne 0x624be3
cmp bx, 0x78
jne 0x624be3
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x234]
mov byte [eax], 1
mov eax, dword [ebp - 0x238]
cmp cx, 0x51
jne 0x624bb5
cmp ax, cx
jmp 0x624bd7
cmp cx, 0x54
jne 0x624be3
cmp ax, 0x58
jne 0x624be3
cmp dx, 0x50
jne 0x624be3
cmp si, 0x6c
jne 0x624be3
cmp di, 0x61
jne 0x624be3
cmp bx, 0x74
jne 0x624be3
mov eax, dword [ebp - 0x234]
mov byte [eax + 1], 1
mov ebx, dword [ebp - 0x23c]
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x6249e0
pop edi
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00631776
mov esp, ebp
pop ebp
ret
Function at 0x6259f0
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x158
mov ecx, dword [ebp + 8]
mov dword [esp + 0x14], edx
push esi
push edi
test ecx, ecx
je 0x625bbb
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x625bbb
cmp esi, 0x40
jb 0x625bbb
movups xmm0, xmmword [ecx + 0x10]
mov edx, 0x5a4d
movups xmm1, xmmword [ecx]
movups xmmword [esp + 0x30], xmm0
movups xmm0, xmmword [ecx + 0x20]
movd eax, xmm1
movups xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x20], xmm1
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [esp + 0x50], xmm0
cmp ax, dx
jne 0x625bbb
mov edx, dword [esp + 0x5c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x625bbb
lea eax, [edx + ecx]
mov ecx, 0x3e
mov esi, eax
mov dword [esp + 0x18], eax
lea edi, [esp + 0x68]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x68], 0x4550
jne 0x625bbb
mov eax, 0xe0
cmp word [esp + 0x7c], ax
jne 0x625bbb
mov eax, dword [esp + 0x6c]
shr eax, 0x10
lea ecx, [eax + eax*4]
shl ecx, 3
lea eax, [edx + 0xf8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x625bbb
push ecx
call fcn.00643709
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x625bbb
movzx edi, word [esp + 0x6e]
mov dword [esp + 0x14], edi
lea esi, [edi + edi*4]
shl esi, 3
push esi
push 0
push eax
call fcn.00633cb0
mov eax, dword [esp + 0x24]
add esp, 0xc
add eax, 0xf8
push esi
push eax
push dword [esp + 0x18]
call fcn.006331b0
mov esi, dword [esp + 0xc8]
xor edx, edx
mov ecx, dword [esp + 0xac]
mov eax, esi
div ecx
add esp, 0xc
test edx, edx
je 0x625b1d
lea esi, [eax + 1]
imul esi, ecx
test edi, edi
je 0x625b52
mov edi, dword [esp + 0x10]
add edi, 8
mov ecx, dword [edi]
test ecx, ecx
je 0x625b48
xor edx, edx
mov eax, ecx
div dword [esp + 0xa0]
test edx, edx
je 0x625b46
sub ecx, edx
add ecx, dword [esp + 0xa0]
add esi, ecx
add edi, 0x28
sub dword [esp + 0x14], 1
jne 0x625b28
push 0x40
push 0x1000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x625b71
lea eax, [edi + 0xb]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x68]
push edi
push dword [esp + 0x14]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00625480
add esp, 0x10
test eax, eax
jne 0x625b99
mov eax, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x6c]
push esi
push edi
push ecx
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00625640
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret