joyce8/EMBER2024-capa huggingface dataset:
Function at 0x663da8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
mov edx, 0xffffffec
mov eax, esi
call fcn.0041f8c8
mov edi, eax
test bl, bl
je 0x663dcd
test edi, 0x40000
je 0x663de7
test bl, bl
jne 0x663e70
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x663e70
push esi
call fcn.006c4ec0
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call fcn.006c4ed8
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x663e1a
push 0
push esi
call fcn.006c5064
test bl, bl
je 0x663e33
mov ecx, 0x40000
or ecx, edi
mov edx, 0xffffffec
mov eax, esi
call fcn.0041f904
jmp 0x663e46
mov ecx, 0xfffbffff
and ecx, edi
mov edx, 0xffffffec
mov eax, esi
call fcn.0041f904
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x663e57
cmp byte [esp + 2], 0
je 0x663e70
cmp byte [esp + 2], 0
je 0x663e68
push 6
push esi
call fcn.006c5064
jmp 0x663e70
push 5
push esi
call fcn.006c5064
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x664118
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call fcn.006c4d40
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x66413e
mov eax, esp
push eax
push 0x6640e0
call fcn.006c4d22
jmp 0x664151
mov eax, esp
push eax
push 0x6640c0
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call fcn.006c4d1c
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x664214
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
mov si, ax
test bl, 4
je 0x664226
or si, 1
test bl, 8
je 0x66422f
or si, 4
test bl, 1
je 0x664238
or si, 8
test bl, 2
je 0x664241
or si, 0x10
test bl, 0x10
je 0x66424a
or si, 0x20
push 0x12
call fcn.006c4db8
test ax, ax
jge 0x66425a
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x664260
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
xor eax, eax
mov bx, ax
push 0x10
call fcn.006c4db8
test ax, ax
jge 0x664279
or bx, 1
push 0x11
call fcn.006c4db8
test ax, ax
jge 0x664289
or bx, 4
test esi, 0x20000000
je 0x664295
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x6642e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call fcn.006c4dd0
mov eax, esp
call fcn.0066429c
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x66e4f8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x66e50a
add esp, 0xfffffff0
call fcn.00413024
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004cfee8
mov eax, dword [0x6d5e08]
mov dword [eax + 4], ebx
mov dword [eax], 0x66e8ec
mov eax, dword [0x6d5e0c]
mov dword [eax + 4], ebx
mov dword [eax], 0x66e8f8
mov eax, ebx
call fcn.0066e904
push 0
call fcn.006c4dbe
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x490470]
call fcn.00412a08
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x490470]
call fcn.00412a08
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x490470]
call fcn.00412a08
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x490470]
call fcn.00412a08
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x490470]
call fcn.00412a08
mov dword [ebx + 0x84], eax
push 0
call fcn.006c4d76
mov esi, eax
push 0x5a
push esi
call fcn.006c4a5a
mov dword [ebx + 0x50], eax
push esi
push 0
call fcn.006c4f92
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x6686b8
push eax
push 0
push 0
call fcn.006c4d16
mov dl, 1
mov eax, dword [0x5455f8]
call fcn.0054c168
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x5455f8]
call fcn.0054c168
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x5455f8]
call fcn.0054c168
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x5455f8]
call fcn.0054c168
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x5455f8]
call fcn.0054c168
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.0066eecc
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x66ed14
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x66ed14
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x66ed14
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x66ed14
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x66ed14
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x66e68a
call fcn.0041307c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x66eab0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x66ec60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x66ec3f
mov dl, 1
mov eax, dword [0x4941bc]
call fcn.004bf084
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.0041470c
lea eax, [ebp - 0x114]
push eax
push 0x40
call fcn.006c4dc4
dec eax
test eax, eax
jl 0x66ec2e
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0057bcc8
test al, al
je 0x66ec21
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x66ec70
lea eax, [ebp - 0x394]
call fcn.0042f9a4
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
jne 0x66ec21
xor eax, eax
push ebp
push 0x66ec1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x66ece0
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x66ec01
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.00415444
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x66ec01
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.00415444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66ec21
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
pop eax
jmp eax
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x66eb21
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004befac
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66ec67
lea eax, [ebp - 0x3a0]
call fcn.0041470c
pop eax
jmp eax

Function at 0x66f850
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x6ddb28]
cmp byte [eax + 0xc5], 0
jne 0x66f8c2
cmp dword [0x6ddb50], 0
jne 0x66f882
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x6d0e38]
push eax
push 3
call fcn.006c504c
mov dword [0x6ddb50], eax
cmp dword [0x6ddb4c], 0
jne 0x66f89d
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [0x6ddb4c], eax
cmp dword [0x6ddb54], 0
jne 0x66f8c2
push esp
push 0
push 0
mov eax, dword [0x6d0f48]
push eax
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x6ddb54], eax
pop edx
ret
Function at 0x66fe0c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x66fe23
add esp, 0xfffffff0
call fcn.00413024
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004cfee8
mov eax, dword [0x6d5d54]
cmp byte [eax], 0
jne 0x66fe4d
push 0
call fcn.006c5104
call fcn.0044a31c
mov byte [ebx + 0x19c], al
mov eax, dword [0x6d5e10]
cmp word [eax + 2], 0
jne 0x66fe67
mov eax, dword [0x6d5e10]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0067225c
mov eax, dword [0x6d5dc4]
cmp word [eax + 2], 0
jne 0x66fe81
mov eax, dword [0x6d5dc4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00672674
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x5455f8]
call fcn.0054c168
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x672c1c
mov dl, 1
mov eax, dword [0x490470]
call fcn.00412a08
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x490470]
call fcn.00412a08
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x54a768]
call fcn.005566a0
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x670070
mov eax, dword [0x6d5da0]
mov eax, dword [eax]
push eax
call fcn.006c4ef6
mov edx, eax
mov eax, esi
call fcn.00556bbc
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x672f08
mov dl, 1
mov eax, dword [0x490470]
call fcn.00412a08
mov dword [ebx + 0xb0], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x6d5da0]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004376b8
test eax, eax
je 0x66ff94
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0042f5fc
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004376c0
test eax, eax
je 0x66ffac
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call fcn.006c4c20
push eax
call fcn.006c4c1a
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.00415444
push ebx
push 0x671c30
call fcn.006641f8
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x6d5d54]
cmp byte [eax], 0
jne 0x66fffd
mov eax, ebx
call fcn.0067020c
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.006732b0
mov eax, ebx
call fcn.00673dcc
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x670068
call fcn.0041307c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x67051c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x6705c6
cmp dword [ebx + 0xac], 0
jne 0x6705c0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x670464
call fcn.006c4d22
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x6705c0
push 3
mov eax, dword [esp + 4]
push eax
call fcn.006c4e66
mov esi, eax
mov dword [esp], esi
mov edx, 0xffffffec
mov eax, esi
call fcn.0041f8c8
test al, 8
je 0x670586
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x6705c0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004b9e8c
push eax
call fcn.006c503a
dec esi
cmp esi, 0xffffffff
jne 0x670595
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x6708fc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x6ddb28]
cmp dword [eax + 0x190], 0
je 0x670a57
test bl, bl
jne 0x6709af
cmp dword [esi + 0xb4], 0
jne 0x6709a4
mov eax, esi
call fcn.00673c1c
push eax
push 0x670808
call fcn.006c4d22
cmp dword [esi + 0x58], 0
je 0x670975
mov eax, dword [0x6ddb28]
cmp byte [eax + 0xeb], 0
je 0x670975
mov eax, dword [esi + 0xf0]
call fcn.00417268
mov edi, eax
cmp edi, 0
jl 0x670975
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call fcn.006c5064
dec edi
cmp edi, 0xffffffff
jne 0x67095e
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x6709a4
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004b9e8c
push eax
call fcn.006c5058
dec edi
cmp edi, 0xffffffff
jne 0x670984
inc dword [esi + 0xb4]
jmp 0x670a57
cmp dword [esi + 0xb4], 0
jle 0x670a57
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x670a57
cmp dword [esi + 0x58], 0
je 0x670a0c
mov eax, dword [0x6ddb28]
cmp byte [eax + 0xeb], 0
je 0x670a0c
mov eax, dword [esi + 0xf0]
call fcn.00417268
mov edi, eax
cmp edi, 0
jl 0x670a0c
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call fcn.006c5064
dec edi
cmp edi, 0xffffffff
jne 0x6709f5
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x670a3b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004b9e8c
push eax
call fcn.006c5058
dec edi
cmp edi, 0xffffffff
jne 0x670a1b
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x65e838]
call fcn.00417758
pop edi
pop esi
pop ebx
ret
Function at 0x67184c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x6718a5
cmp byte [ebx + 0xeb], 0
jne 0x6718a5
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call fcn.006c4e8a
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004148a4
mov eax, dword [esi]
call fcn.00414be4
test eax, eax
jne 0x6718b2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00414afc
jmp 0x6718b2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00414afc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x6734a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x673511
mov eax, esi
call fcn.005758b8
test al, al
je 0x673511
mov eax, dword [ebx + 0x98]
call fcn.0057544c
push eax
call fcn.006c4ed8
test eax, eax
je 0x673511
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x673502
push 0
mov eax, dword [ebx + 0x98]
call fcn.0057544c
push eax
call fcn.006c5064
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0056b790
jmp 0x673511
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.006732d0
pop esi
pop ebx
ret
Function at 0x67bb58
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x67bbde
mov eax, dword [ebx + 8]
call fcn.0057544c
mov ecx, eax
mov dl, 1
mov eax, dword [0x58a100]
call fcn.0056efd8
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.0059acb0
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x67b428
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0057544c
push eax
call fcn.006c503a
push 0
mov eax, dword [ebx + 0x94]
call fcn.0057544c
push eax
call fcn.006c5064
cmp dword [ebx + 0xa4], 0
jne 0x67bc60
mov eax, dword [ebx + 8]
call fcn.0057544c
mov ecx, eax
mov dl, 1
mov eax, dword [0x58a100]
call fcn.0056efd8
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.0059acb0
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x67b474
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0057544c
push eax
call fcn.006c503a
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0057544c
push eax
call fcn.006c5064
cmp dword [ebx + 0x9c], 0
jne 0x67bcde
mov eax, dword [ebx + 8]
call fcn.0057544c
mov ecx, eax
mov dl, 1
mov eax, dword [0x58b9bc]
call fcn.0056efd8
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0057544c
push eax
call fcn.006c503a
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0057544c
push eax
call fcn.006c5064
pop esi
pop ebx
ret
Function at 0x68b494
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov byte [ebp - 5], al
mov al, byte [edx]
mov bl, al
xor bl, byte [ebp + 0xc]
lock cmpxchg byte [edx], bl
jne 0x68b4a9
mov byte [ebp + 0xc], al
mov al, byte [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
movzx eax, al
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x68ba24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ax, word [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov word [ebp - 6], ax
mov ax, word [edx]
mov bx, ax
xor bx, word [ebp + 0xc]
lock cmpxchg word [edx], bx
jne 0x68ba3c
mov word [ebp + 0xc], ax
mov ax, word [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov word [ebp - 0xe], ax
mov ax, word [ebp - 0xe]
movzx eax, ax
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x68bf84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [edx]
mov ebx, eax
xor ebx, dword [ebp + 0xc]
lock cmpxchg dword [edx], ebx
jne 0x68bf99
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x68d244
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
mov edi, dword [ebp - 0x1c]
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov ecx, edx
mov ebx, eax
xor ebx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x14]
lock cmpxchg8b qword [edi]
jne 0x68d26d
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x68d4a8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
test edi, edi
je 0x68d5da
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x68d5da
cmp dword [esp + 0x28], 0
je 0x68d5da
mov dword [esp], str.borlndmm
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov esi, eax
test esi, esi
je 0x68d5da
mov ebp, dword [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysGetMem_qqri
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [edi], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysFreeMem_qqrpv
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebx], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysReallocMem_qqrpvi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysAllocMem_qqri
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebp], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysRegisterExpectedMemoryLeak_qqrpi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [esp], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 4], str._Borlndmm_SysUnregisterExpectedMemoryLeak_qqrpi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [esi], eax
mov eax, dword [edi]
mov dword [0x6de154], eax
cmp dword [ebp], 0
jne 0x68d58e
mov dword [ebp], 0x68d478
mov eax, dword [esp + 0x30]
cmp dword [eax], 0
jne 0x68d59d
mov dword [eax], 0x68d468
mov ecx, dword [esi]
test ecx, ecx
je 0x68d5ca
cmp dword [edi], 0
je 0x68d5da
cmp dword [ebx], 0
je 0x68d5da
mov esi, dword [esp + 0x28]
cmp dword [esi], 0
je 0x68d5da
cmp dword [ebp], 0
je 0x68d5da
cmp dword [eax], 0
je 0x68d5da
xor eax, eax
test ecx, ecx
setne al
jmp 0x68d5dc
mov dword [esi], 0x68d468
mov ecx, 0x68d468
cmp dword [edi], 0
jne 0x68d5a8
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x68ea24
Capabilities:
Check if file exists

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
call fcn.0068fd5c
test bh, 0xc0
jne 0x68ea47
mov eax, dword [0x6d3314]
mov ecx, 0xc000
and ecx, dword [eax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
mov ecx, eax
shr ecx, 8
mov esi, 3
cmp ecx, 6
ja 0x68ea6b
sar eax, 6
mov esi, dword [eax + 0x6d2d54]
mov edi, dword [esp + 0x40]
test bh, 1
je 0x68ea94
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
mov al, byte [0x6d2d90]
and al, byte [esp + 0x48]
mov eax, 0x80
mov ecx, 1
cmovs ecx, eax
jmp 0x68eaa7
mov dword [esp], edi
call sub.KERNEL32.DLL_GetFileAttributesA
sub esp, 4
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ebx
and al, 3
je 0x68eac0
cmp al, 2
je 0x68eac7
cmp al, 1
jne 0x68ebbf
mov eax, 0x40000000
jmp 0x68eacc
mov eax, 0x80000000
jmp 0x68eacc
mov eax, 0xc0000000
mov edx, ebx
and edx, 0x70
add edx, 0xfffffff0
shr edx, 4
cmp edx, 3
mov ebp, 3
cmovb ebp, edx
xor edx, edx
cmp eax, 0x80000000
sete dl
test bl, 4
cmove edx, ebp
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], 0
mov ebp, ebx
shr ebp, 7
not ebp
and ebp, 1
mov dword [esp + 0x28], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 0x18], 0
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
cmp esi, 0xffffffff
je 0x68eb9c
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov dword [esp], esi
call fcn.0068e97c
mov ecx, edi
or ecx, 0x2000
test eax, eax
cmove ecx, edi
and ecx, 0xfffff8ff
mov dword [esp], esi
mov dword [esp + 4], ecx
call fcn.0068ff1c
mov edi, eax
cmp edi, 0xffffffff
jne 0x68ebcd
mov dword [esp], 4
call fcn.006902f8
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov edi, 0xffffffff
jmp 0x68ebcd
call sub.KERNEL32.DLL_GetLastError
movzx eax, ax
test bh, 1
mov ecx, 0x50
mov edx, 2
cmovne edx, ecx
cmp eax, 0x6e
cmovne edx, eax
mov dword [esp], edx
jmp 0x68ebc6
mov dword [esp], 1
call fcn.006902f8
mov edi, eax
call fcn.0068fdac
mov eax, edi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x68f300
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x6d3244], eax
jbe 0x68f33d
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x6de268]
call sub.KERNEL32.DLL_ReadFile
add esp, 0xc
cmp eax, 1
jne 0x68f344
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
jmp 0x68f35a
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
jne 0x68f356
add esp, 0xc
ret
sub esp, 0xc
push ecx
call fcn.006902f8
add esp, 0x10
add esp, 0xc
ret