joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cab60
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x68be3e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push esi
push edi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], 0x6941a0
mov dword [esi + 8], 0
mov eax, dword [0x9c1588]
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x2c], 0
call fcn.005ca270
lea ecx, [esi + 0x18]
mov byte [esp + 0x2c], 1
call fcn.005ca270
mov byte [esi + 0x20], 0
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x30], 2
mov dword [esi], 0x6941a0
call fcn.005c6270
lea ecx, [esp + 0x14]
push ecx
mov edi, eax
mov byte [esp + 0x30], 3
call fcn.005ca8f0
add esp, 4
push eax
lea ecx, [esi + 8]
mov byte [esp + 0x30], 4
call fcn.00592a60
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 3
call fcn.005935f0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 2
call fcn.005935f0
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x20
ret 4

Function at 0x5cbdd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x68c148
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x694304
cmp dword [esi + 0x18], 0
mov dword [esp + 0x30], 0
je 0x5cbea0
cmp dword [esi + 0x24], 0
jle 0x5cbe7f
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 8]
sub eax, dword [edx + 4]
push 0
mov ecx, eax
sar ecx, 0x18
mov byte [esp + 0xc], cl
mov ecx, eax
sar ecx, 0x10
mov byte [esp + 0xd], cl
mov ecx, eax
sar ecx, 8
mov byte [esp + 0xe], cl
mov ecx, dword [esi + 0x10]
mov byte [esp + 0xf], al
mov edx, dword [edx + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
push 0
sub edx, 4
push edx
call eax
push 4
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x10]
call fcn.00591600
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [esi + 0x1c]
mov edx, dword [edx + 0x10]
push 0
push 0
push eax
call edx
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 8]
mov dword [esi + 0x20], ecx
mov edx, dword [eax]
push eax
mov dword [esi + 0x18], edx
call fcn.006590fa
add esp, 4
cmp dword [esi + 0x18], 0
jne 0x5cbe12
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.00592200
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x5d8060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x68cfb9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], 3
call fcn.005bafb0
lea ecx, [esi + 0x18]
mov byte [esp + 0x18], 2
call fcn.005bafb0
mov edi, dword [esi + 0x14]
mov byte [esp + 0x18], 1
mov dword [esi + 0x14], 0
test edi, edi
je 0x5d80d0
lea eax, [edi + 4]
push eax
call fcn.0058e4a0
add esp, 4
test eax, eax
jne 0x5d80d0
mov ecx, edi
call fcn.005c1030
lea ecx, [esi + 8]
mov byte [esp + 0x18], 0
call fcn.005935f0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.005c0fb0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x5db120
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x68d3a7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov al, byte [esp + 0x28]
push 1
push 0x5014
lea edi, [esi + 0xc]
xor ebx, ebx
lea ecx, [esi + 0x10]
push edi
mov dword [esi], 0x694b6c
mov byte [esi + 4], al
mov dword [esi + 8], ebx
call fcn.005c1060
push 4
push 0x5014
lea ebp, [esi + 0x18]
lea ecx, [esi + 0x1c]
push ebp
mov dword [esp + 0x2c], ebx
call fcn.005c1060
push 4
lea eax, [esi + 0x24]
push 0x5014
lea ecx, [esi + 0x28]
push eax
mov byte [esp + 0x2c], 1
call fcn.005c1060
lea ecx, [esi + 0x48]
push 0x6913d8
mov byte [esp + 0x24], 2
mov word [esi + 0x30], bx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], bl
call fcn.005ba4f0
lea ecx, [esi + 0x60]
push 0x6913d8
mov byte [esp + 0x24], 3
call fcn.005ba4f0
push 0x694bc0
lea ecx, [esi + 0x78]
mov byte [esp + 0x24], 4
call fcn.005ba4f0
push 0x400
lea ecx, [esi + 0xf0]
push ebx
push ecx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov byte [esi + 0xa8], bl
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
call fcn.0065b340
push 0x800
lea edx, [esi + 0x4f0]
push ebx
push edx
call fcn.0065b340
mov eax, dword [edi]
mov byte [eax], bl
mov ecx, dword [esi + 0x24]
mov dword [ecx], ebx
mov edx, dword [ebp]
mov dword [edx], ebx
add esp, 0x18
mov dword [esi + 8], 1
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x5db290
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x68d3f9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi], 0x690af4
mov dword [esi + 4], eax
mov dword [esi], 0x694c80
mov dword [esi + 8], eax
mov ecx, dword [0x9c1588]
mov dword [esp + 0x14], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x18]
push 0x694c6c
mov byte [esp + 0x18], 2
call fcn.005ba4f0
push 0x694bc0
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 3
call fcn.005ba4f0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5db340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x68d451
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi], 0x690af4
mov dword [esi + 4], ebx
mov dword [esi], 0x694c80
mov dword [esi + 8], ebx
mov eax, dword [0x9c1588]
mov dword [esp + 0x18], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
push 0x694c6c
mov byte [esp + 0x1c], 2
call fcn.005ba4f0
lea ecx, [esi + 0x30]
push 0x694bc0
mov byte [esp + 0x1c], 3
call fcn.005ba4f0
push 0x692688
lea ecx, [esi + 0x50]
mov dword [esp + 0x1c], 4
mov dword [esi], 0x694c84
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
call fcn.005ba4f0
mov byte [esi + 0x68], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x5df430
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x68df87
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], edi
xor esi, esi
mov dword [edi], 0x690af4
mov dword [edi + 4], esi
mov dword [edi], 0x69538c
mov dword [edi + 8], esi
mov eax, dword [0x9c1588]
mov dword [esp + 0x2c], esi
mov dword [edi + 0xc], eax
lea ecx, [edi + 0x10]
push 0x6912d8
mov byte [esp + 0x30], 1
call fcn.005bb010
lea ecx, [edi + 0x2c]
push 0x695390
mov byte [esp + 0x30], 2
call fcn.005ba9b0
mov dword [edi + 0x3c], esi
mov eax, dword [0x9c1588]
mov dword [edi + 0x40], eax
lea ecx, [edi + 0x44]
push 0x6953a4
mov byte [esp + 0x30], 4
call fcn.005bb010
mov eax, dword [esp + 0x34]
mov dword [edi + 0x60], esi
lea esi, [esp + 0x14]
lea ebx, [esp + 0x1c]
mov byte [esp + 0x2c], 5
call fcn.005de550
push eax
lea ecx, [edi + 8]
mov byte [esp + 0x30], 6
call fcn.00592a60
mov ecx, ebx
mov byte [esp + 0x2c], 5
call fcn.005935f0
push 1
lea eax, [edi + 0x10]
push eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.005deb40
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x5e12e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x68e2c0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x9c48d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push 0
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], esp
mov edi, esp
test eax, eax
je 0x5e1337
add eax, 4
push eax
call fcn.0058e490
mov eax, dword [esp + 0x30]
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.005e1020
mov ecx, esi
mov byte [esp + 0x18], 1
mov dword [esi], 0x6954d0
call fcn.005e1190
mov edi, dword [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x20], 0
test edi, edi
je 0x5e1381
lea ecx, [edi + 4]
push ecx
call fcn.0058e4a0
add esp, 4
test eax, eax
jne 0x5e1381
mov ecx, edi
call fcn.005c1030
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x5e29d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68e439
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x9c48d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x3c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.00659e93
add esp, 4
cmp eax, ebx
je 0x5e2a5c
mov dword [eax], 0x690af4
mov dword [eax + 4], ebx
mov dword [eax], 0x695568
mov dword [eax + 8], ebx
mov ecx, dword [0x9c1588]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ebx
mov ecx, dword [0x9c1588]
mov dword [eax + 0x14], ecx
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
jmp 0x5e2a5e
xor eax, eax
push eax
mov ecx, esi
mov dword [esi], ebx
call fcn.005c1230
mov eax, dword [esi]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x2c], ebx
mov eax, dword [esi]
mov dword [eax + 0x30], edx
mov eax, dword [esi]
mov edx, dword [ebp + 0x10]
mov ecx, 1
mov dword [eax + 0x34], edx
mov eax, dword [esi]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov ecx, edi
mov dword [eax + 0x38], edx
call fcn.005bb390
push eax
lea ecx, [ebp - 0x1c]
call fcn.005c5ad0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov byte [ebp - 4], 2
call fcn.00591170
add esp, 8
mov ecx, dword [esi]
push eax
add ecx, 8
mov byte [ebp - 4], 3
call fcn.00592370
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.005935f0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.005935f0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
cmp ecx, ebx
je 0x5e2ae9
mov ecx, dword [ecx + 0xc]
jmp 0x5e2aef
mov ecx, dword [0x9c1588]
mov dword [eax + 0x2c], ecx
mov eax, dword [edi + 0xc]
mov ecx, dword [esi]
mov dword [ecx + 0x30], eax
mov eax, dword [edi + 8]
mov ecx, dword [esi]
mov dword [ecx + 0x34], eax
mov eax, dword [edi + 0x10]
mov ecx, dword [esi]
mov dword [ecx + 0x38], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e76b0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
cmp dword [ebp + 4], 0
push edi
jg 0x5e76c3
push 7
call fcn.005e7610
mov ebx, dword [esp + 0x14]
mov al, byte [ebx]
mov ecx, ebx
mov edi, 0x1013
test al, al
je 0x5e76ea
mov edx, edi
shl edi, 6
shr edx, 0x1a
movsx eax, al
or edi, edx
inc ecx
xor edi, eax
mov al, byte [ecx]
test al, al
jne 0x5e76d4
xor edx, edx
mov eax, edi
div dword [ebp + 4]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + edx*4]
mov dword [esp + 0xc], edx
test eax, eax
je 0x5e773d
nop
mov edx, dword [eax + 8]
mov ecx, ebx
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x5e7725
test bl, bl
je 0x5e7721
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x5e7725
add ecx, 2
add edx, 2
test bl, bl
jne 0x5e7705
xor ecx, ecx
jmp 0x5e772a
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x5e77b0
mov eax, dword [eax + 4]
mov ebx, dword [esp + 0x14]
test eax, eax
jne 0x5e7700
cmp byte [esp + 0x18], 0
je 0x5e77b0
inc dword [ebp]
push esi
push 0xc
call fcn.00659e93
mov esi, eax
mov dword [esi], edi
mov edx, dword [ebp + 8]
mov edi, dword [esp + 0x14]
mov eax, dword [edx + edi*4]
mov dword [esi + 4], eax
mov eax, ebx
add esp, 4
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x5e7768
sub eax, ecx
inc eax
push eax
call fcn.00659e93
add esp, 4
mov dword [esi + 8], eax
mov ecx, ebx
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x5e7782
mov ecx, dword [ebp + 8]
mov dword [ecx + edi*4], esi
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
lea edx, [eax + eax*2]
add ecx, ecx
cmp ecx, edx
jle 0x5e77ad
lea edx, [eax + eax - 1]
push edx
mov ecx, ebp
call fcn.005e7610
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x5f1250
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [eax], 0
mov eax, dword [ecx]
cmp eax, 8
jae 0x5f126b
mov eax, 7
ret
mov edx, dword [esp + 4]
push ebx
push esi
mov esi, dword [edx]
cmp dword [esi], 0x58385056
push edi
jne 0x5f135c
movzx ecx, byte [esi + 7]
movzx edx, byte [esi + 6]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 5]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 4]
shl ecx, 8
or ecx, edx
cmp ecx, 0xa
jne 0x5f12fe
cmp eax, 0x12
jae 0x5f12b0
pop edi
pop esi
lea eax, [ecx - 3]
pop ebx
ret
movzx edi, byte [esi + 0xe]
movzx eax, byte [esi + 0xd]
movzx ebx, byte [esi + 0x11]
movzx edx, byte [esi + 0x10]
movzx ecx, byte [esi + 0xc]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 0xf]
shl ebx, 8
or ebx, edx
shl ebx, 8
or ebx, eax
inc ebx
shl edi, 8
or edi, ecx
mov eax, ebx
cdq
push ebp
mov ecx, eax
inc edi
mov ebp, edx
mov eax, edi
cdq
push edx
push eax
push ebp
push ecx
call fcn.0065e690
pop ebp
cmp edx, 1
jb 0x5f1307
ja 0x5f12fe
test eax, eax
jb 0x5f1307
pop edi
pop esi
mov eax, 3
pop ebx
ret
mov eax, dword [esp + 0x24]
test eax, eax
je 0x5f1330
movzx edx, byte [esi + 0xb]
movzx ecx, byte [esi + 0xa]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 9]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 8]
shl edx, 8
or edx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5f133a
mov dword [eax], edi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5f1344
mov dword [eax], ebx
mov eax, dword [esp + 0x10]
add dword [eax], 0x12
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add dword [eax], 0xffffffee
mov dword [edx], 1
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x605ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov dword [esi], 0
jmp 0x605ed0
mov eax, dword [esi]
mov edx, dword [ebx + 0x14]
mov ecx, edi
sub ecx, eax
push ecx
add eax, ebp
push eax
push edx
call fcn.0066cf4b
add esp, 0xc
test eax, eax
jle 0x605ef0
add dword [esi], eax
cmp dword [esi], edi
jb 0x605ed0
pop ebp
test eax, eax
jns 0x605f12
call fcn.0065a209
mov eax, dword [eax]
push eax
call fcn.0065b783
push eax
push 0xffffffffffffffff
push ebx
call fcn.00606660
add esp, 0x10
or eax, 0xffffffff
ret
jne 0x605f1b
mov dword [ebx + 0x40], 1
xor eax, eax
ret
Function at 0x656690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push ebp
xor ebp, ebp
and eax, 7
cmp ecx, 5
jae 0x6566ab
xor eax, eax
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
lea ecx, [ecx]
mov ecx, dword [esp + 0x18]
lea edi, [ecx + ebp]
cmp edi, edx
jae 0x6566ef
jmp 0x6566e0
mov bl, byte [edi]
and bl, 0xfe
cmp bl, 0xe8
je 0x6566ef
inc edi
cmp edi, edx
jb 0x6566e0
mov ebp, edi
sub ebp, ecx
mov ecx, ebp
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x656804
cmp ecx, 3
jbe 0x656723
xor eax, eax
mov cl, byte [edi + 4]
mov dword [esp + 0x1c], ebp
test cl, cl
je 0x65675d
cmp cl, 0xff
je 0x65675d
and eax, 3
add eax, eax
or eax, 1
inc ebp
jmp 0x6566d0
dec ecx
shl eax, cl
and eax, 7
je 0x656708
movzx ecx, byte [eax + 0x6b186c]
mov ebx, edi
sub ebx, ecx
cmp byte [eax + 0x6b1864], 0
mov cl, byte [ebx + 4]
je 0x65674b
test cl, cl
je 0x65674b
cmp cl, 0xff
jne 0x656708
and eax, 3
add eax, eax
mov dword [esp + 0x1c], ebp
or eax, 1
inc ebp
jmp 0x6566d0
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
jmp 0x656780
cmp dword [esp + 0x28], 0
je 0x65678e
lea ebx, [edx + ebp]
add ebx, esi
jmp 0x656794
sub edx, ebp
sub edx, esi
mov ebx, edx
test eax, eax
je 0x6567d6
movzx esi, byte [eax + 0x6b186c]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
mov cl, dl
test cl, cl
je 0x6567bb
cmp cl, 0xff
jne 0x6567d2
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x656780
mov esi, dword [esp + 0x20]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, ebx
shr edx, 0x10
mov ecx, ebx
shr ecx, 8
mov byte [edi + 3], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add ebp, 5
jmp 0x6566d0
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x656819
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [edx], eax
mov eax, ebp
pop ebp
pop ecx
ret
mov edx, dword [esp + 0x18]
dec ecx
shl eax, cl
and eax, 7
mov dword [edx], eax
mov eax, ebp
pop ebp
pop ecx
ret

Function at 0x65865c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x9c48d0]
jne 0x658666
repz ret
jmp fcn.00662d9f
Function at 0x6638fe
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x663925
call fcn.0065a21c
mov dword [eax], esi
call fcn.0065a209
push 0x16
pop esi
mov dword [eax], esi
call fcn.006631e2
mov eax, esi
jmp 0x66397a
test dword [ebp + 0xc], 0xfffffff9
jne 0x66390b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x663952
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0065a22f
pop ecx
call fcn.0065a209
mov eax, dword [eax]
jmp 0x66397a
test al, 0x10
jne 0x663978
test al, 1
je 0x663978
test byte [ebp + 0xc], 2
je 0x663978
call fcn.0065a21c
mov dword [eax], 5
call fcn.0065a209
mov dword [eax], 0xd
jmp 0x663949
xor eax, eax
pop esi
pop ebp
ret

Function at 0x67688e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x9c48d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00663cdf
and dword [ebp - 0x14], 0
cmp dword [0x9eee08], 0
mov dword [ebp - 0x18], eax
jne 0x676941
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x6769e9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6b877c
push ebx
call edi
test eax, eax
je 0x6769e9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x9eee08], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x9eee0c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x9eee10], eax
call edi
push eax
call esi
mov dword [0x9eee18], eax
test eax, eax
je 0x676941
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x9eee14], eax
mov eax, dword [0x9eee14]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x67699a
cmp dword [0x9eee18], ecx
je 0x67699a
push eax
call esi
push dword [0x9eee18]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x67699a
test ebx, ebx
je 0x67699a
call edi
test eax, eax
je 0x676991
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x676991
test byte [ebp - 8], 1
jne 0x67699a
or dword [ebp + 0x10], 0x200000
jmp 0x6769cd
mov eax, dword [0x9eee0c]
cmp eax, dword [ebp - 0x18]
je 0x6769cd
push eax
call esi
test eax, eax
je 0x6769cd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x6769cd
mov eax, dword [0x9eee10]
cmp eax, dword [ebp - 0x18]
je 0x6769cd
push eax
call esi
test eax, eax
je 0x6769cd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x9eee08]
call esi
test eax, eax
je 0x6769e9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x6769eb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0065865c
leave
ret