joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x4019c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
sub esp, 0x40
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
add esp, 0x40
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
loop 0x4019da
push esp
mov eax, 0x400000
mov dword [0x403160], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0x401719
mov dword [ebp - 4], str.risiliency
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x403160]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.ebsement
push str.risiliency
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403168], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a78
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a5f
pop ebp
ret 0x10
Function at 0x405b29
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x405b38
pop dword [ebp - 0x50]
mov eax, 0x405b38
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xa1f1ac87
add dword [ebp - 0x60], 0xac6098c4
mov dword [ebp - 0x5c], 0x3c9b2087
sub dword [ebp - 0x5c], 0xa67d442
mov dword [ebp - 0x58], 0x62d08650
add dword [ebp - 0x58], 0xe97bbdde
mov dword [ebp - 0x54], 0x57f09bf8
add dword [ebp - 0x54], 0xa80f6408
lea eax, [ebp - 0x60]
push eax
mov eax, 0xa149b61e
add eax, 0x5ef87a56
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xb9e84784
add dword [ebp - 0x60], 0xba8a21d2
mov dword [ebp - 0x5c], 0x71c91ef8
add dword [ebp - 0x5c], 0xcfa3427d
mov dword [ebp - 0x58], 0xb16ddc80
add dword [ebp - 0x58], 0xb2018fec
mov dword [ebp - 0x54], 0x178ace27
add dword [ebp - 0x54], 0xe87531d9
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x40a7a
push 0
call eax
mov ecx, 0x5004
mov esi, eax
mov edx, 0x434400
add edx, dword [ebp - 0x50]
mov edi, 0x1631c88f
add dword [ebp - 0xc], esi
mov ebx, dword [edx]
sub dword [ebp - 0x40], edx
xor ebx, edi
xor dword [ebp - 0x44], 0x22eda2f8
mov dword [esi], ebx
xor dword [ebp - 0x40], ebx
add esi, 4
add edx, 0xd3ce393c
add edx, 0x2c31c6c8
loop 0x405c3e
add eax, 0x132e3
mov ebx, eax
add eax, 0x6913a18d
sub eax, 0x6913a188
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x531bd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8a000]
push edi
jmp 0x531bea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x531bf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x531be0
mov eax, 1
add ebx, ebx
jne 0x531c03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x531c14
jne 0x531c33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x531c33
dec eax
add ebx, ebx
jne 0x531c20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x531bf8
add ebx, ebx
jne 0x531c2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x531c85
xor ecx, ecx
sub eax, 3
jb 0x531c4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x531cba
sar eax, 1
mov ebp, eax
jmp 0x531c56
add ebx, ebx
jne 0x531c56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x531c24
inc ecx
add ebx, ebx
jne 0x531c64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x531c24
add ebx, ebx
jne 0x531c71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x531c66
jne 0x531c82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x531c66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x531ca4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x531c96
jmp 0x531be6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x531ca4
add edi, ecx
jmp 0x531be6
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x531cc2
cmp byte [edi], 0x11
jne 0x531cc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x531cc7
lea edi, [esi + 0x12a000]
mov eax, dword [edi]
or eax, eax
je 0x531d3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x142074]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x142218]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x531cf4
mov ecx, edi
jns 0x531d23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x142220]
or eax, eax
je 0x531d39
mov dword [ebx], eax
add ebx, 4
jmp 0x531d11
call dword [esi + 0x14221c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x531d70
cmp al, 0xef
ja 0x531d63
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x531d45
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x531d52
mov ebp, dword [esi + 0x142224]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x531da4
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x611414
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x60d5a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x611432
push eax
call dword [fcn.0060d020]
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx eax, word [ebx + 0x14]
push dword [ebx + 0x88]
lea eax, [eax + ebx + 0x18]
push ebx
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], eax
call fcn.0060e9f5
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
je 0x6114f6
movzx eax, word [ebx + 6]
and dword [ebp - 0x14], 0
test eax, eax
push esi
push edi
jle 0x6114a1
mov edi, dword [ebp - 0x10]
push 2
pop ecx
lea esi, [ebp - 0xc]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x6114a1
add dword [ebp - 0x10], 0x28
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x611486
cmp dword [ebp - 0x14], eax
je 0x6114f4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebx + 0x34]
add edx, dword [eax + 0xc]
push 4
pop ecx
mov edi, 0x60eef8
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x6114f4
push 4
pop ecx
mov edi, 0x60eef8
lea esi, [edx + 0x140]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x6114f4
cmp dword [edx + 0x124], eax
je 0x6114e2
push 0x611294
jmp 0x6114e7
push 0x6113fc
push ebx
push dword [ebp - 0x18]
push edx
call fcn.0061106b
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.006124ba
leave
ret
Function at 0x65b0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov dx, word [eax]
shr dx, 1
push esi
movzx esi, dx
xor ecx, ecx
test si, si
push edi
mov word [esp + 8], 0x5c
mov word [esp + 0xa], 0x2f
mov word [esp + 0xc], 0x3a
mov word [esp + 0xe], 0x2a
mov word [esp + 0x10], 0x3f
mov word [esp + 0x12], 0x22
mov word [esp + 0x14], 0x3c
mov word [esp + 0x16], 0x3e
mov word [esp + 0x18], 0x7c
jbe 0x65b137
mov edi, dword [eax + 4]
movzx edx, cx
movzx edx, word [edi + edx*2]
xor eax, eax
cmp dx, word [esp + eax*2 + 8]
je 0x65b142
add eax, 1
cmp eax, 9
jb 0x65b120
add ecx, 1
cmp cx, si
jb 0x65b117
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x6db280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
xor eax, eax
test esi, esi
mov dword [esp], eax
je 0x6db2f9
mov ecx, dword [esi + 0x3c]
push ebx
push edi
mov edi, dword [ecx + esi + 0x78]
add edi, esi
xor ebx, ebx
cmp dword [edi + 0x18], eax
jbe 0x6db2f7
push ebp
mov ebp, dword [edi + 0x20]
add ebp, esi
mov eax, dword [ebp]
mov ecx, dword [esp + 0x14]
add eax, esi
test eax, 0xffff0000
je 0x6db2c1
test ecx, 0xffff0000
je 0x6db2c1
call fcn.006db230
jmp 0x6db2ca
xor edx, edx
cmp eax, ecx
sete dl
mov eax, edx
test eax, eax
je 0x6db2e7
mov eax, dword [edi + 0x24]
lea ecx, [eax + ebx*2]
movzx edx, word [ecx + esi]
mov eax, dword [edi + 0x1c]
lea ecx, [eax + edx*4]
mov eax, dword [ecx + esi]
add eax, esi
mov dword [esp + 0xc], eax
add ebx, 1
add ebp, 4
cmp ebx, dword [edi + 0x18]
jb 0x6db2a2
mov eax, dword [esp + 0xc]
pop ebp
pop edi
pop ebx
pop ecx
ret
Function at 0x6e63a0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
push esi
push edi
mov dword [ebx], 0x100da8e8
lea edi, [ebx + 4]
xor esi, esi
mov eax, 0x100
xor ecx, ecx
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], 0xff
call fcn.006eb3c0
mov dword [edi + 4], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [edi], eax
push 0x100d6cfc
lea esi, [esp + 0xc]
mov byte [eax], 0
mov dword [esp + 0x1c], 0x10000
mov dword [esp + 0x20], 0x100e1180
mov dword [esp + 0x24], 0x20000
mov dword [esp + 0x28], 0x100e1188
mov dword [esp + 0x2c], 0x100000
mov dword [esp + 0x30], 0x100e1198
mov dword [esp + 0x34], 0x40000
mov dword [esp + 0x38], 0x100e11a4
mov dword [esp + 0x3c], 0x80000
mov dword [esp + 0x40], 0x100e11b0
mov dword [esp + 0x44], 0x80000000
mov dword [esp + 0x48], 0x100e11bc
mov dword [esp + 0x4c], 0x40000000
mov dword [esp + 0x50], 0x100e11cc
mov dword [esp + 0x54], 0x20000000
mov dword [esp + 0x58], 0x100e11dc
mov dword [esp + 0x5c], 0x10000000
mov dword [esp + 0x60], 0x100e11ec
mov dword [esp + 0x64], 1
mov dword [esp + 0x68], 0x100e12bc
mov dword [esp + 0x6c], 2
mov dword [esp + 0x70], 0x100e12cc
mov dword [esp + 0x74], 4
mov dword [esp + 0x78], 0x100e12dc
mov dword [esp + 0x7c], 8
mov dword [esp + 0x80], 0x100e12f0
mov dword [esp + 0x84], 0x20
mov dword [esp + 0x88], 0x100e1308
mov dword [esp + 0x8c], 0x10
mov dword [esp + 0x90], 0x100e1318
mov dword [esp + 0x94], 0x200
mov dword [esp + 0x98], 0x100e1324
mov dword [esp + 0x9c], 0x100
mov dword [esp + 0xa0], 0x100e1334
call fcn.00625c60
mov eax, dword [esp + 8]
push eax
mov esi, edi
call fcn.00625c60
mov eax, dword [esp + 8]
test eax, eax
je 0x6e6537
call fcn.00622510
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov eax, dword [esp + ecx*8 + 0x18]
test dword [ebp + 8], eax
je 0x6e6571
not eax
and dword [ebp + 8], eax
cmp dword [ebx + 8], 0
je 0x6e6561
push 0x100e12b0
mov esi, edi
call fcn.006df5f0
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*8 + 0x1c]
push ecx
mov esi, edi
call fcn.006df5f0
mov ecx, dword [esp + 0x14]
add ecx, 1
cmp ecx, 0x11
mov dword [esp + 0x14], ecx
jb 0x6e653d
xor esi, esi
cmp dword [ebx + 8], esi
jne 0x6e65f7
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
push 0x100e12b4
lea esi, [esp + 0xc]
call fcn.00625c60
mov edx, dword [esp + 8]
push edx
mov esi, edi
call fcn.00625c60
mov esi, dword [esp + 8]
test esi, esi
je 0x6e662f
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x11c]
call fcn.006e2c00
mov eax, dword [0x100ef808]
push esi
push 1
push eax
call dword [0x100cf260]
cmp byte [esp + 0x134], 0
je 0x6e662f
mov esi, dword [esp + 0x130]
call fcn.006c54d0
mov eax, ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x6e662f
push eax
lea ecx, [esp + 0x1c]
push 0x100d46fc
push ecx
call dword [0x100cf2ec]
add esp, 0xc
cmp dword [ebx + 8], esi
je 0x6e6623
push 0x100e12b0
mov esi, edi
call fcn.006df5f0
lea edx, [esp + 0x18]
push edx
mov esi, edi
call fcn.006df5f0
pop edi
mov eax, ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x6e6950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
push esi
push edi
mov dword [ebx], 0x100da8e8
lea edi, [ebx + 4]
xor esi, esi
mov eax, 0x100
xor ecx, ecx
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], 0xff
call fcn.006eb3c0
mov dword [edi + 4], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [edi], eax
push 0x100d6cfc
lea esi, [esp + 0xc]
mov byte [eax], 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x100e13d8
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x28], 0x100e13ec
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], 0x100e1404
mov dword [esp + 0x34], 4
mov dword [esp + 0x38], 0x100e1418
mov dword [esp + 0x3c], 0x800
mov dword [esp + 0x40], 0x100e1430
mov dword [esp + 0x44], 8
mov dword [esp + 0x48], 0x100e1444
mov dword [esp + 0x4c], 0x10
mov dword [esp + 0x50], 0x100e1464
mov dword [esp + 0x54], 0x20
mov dword [esp + 0x58], 0x100e1480
mov dword [esp + 0x5c], 0x80
mov dword [esp + 0x60], 0x100e14a0
mov dword [esp + 0x64], 0x100
mov dword [esp + 0x68], 0x100e14bc
mov dword [esp + 0x6c], 0x200
mov dword [esp + 0x70], 0x100e14d8
mov dword [esp + 0x74], 0x1000
mov dword [esp + 0x78], 0x100e14f0
mov dword [esp + 0x7c], 0x2000
mov dword [esp + 0x80], 0x100e1508
mov dword [esp + 0x84], 0x4000
mov dword [esp + 0x88], 0x100e1520
call fcn.00625c60
mov eax, dword [esp + 8]
push eax
mov esi, edi
call fcn.00625c60
mov eax, dword [esp + 8]
test eax, eax
je 0x6e6aa5
call fcn.00622510
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov eax, dword [esp + ecx*8 + 0x18]
test dword [ebp + 8], eax
je 0x6e6adf
not eax
and dword [ebp + 8], eax
cmp dword [ebx + 8], 0
je 0x6e6acf
push 0x100e12b0
mov esi, edi
call fcn.006df5f0
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*8 + 0x1c]
push ecx
mov esi, edi
call fcn.006df5f0
mov ecx, dword [esp + 0x14]
add ecx, 1
cmp ecx, 0xe
mov dword [esp + 0x14], ecx
jb 0x6e6aab
xor esi, esi
cmp dword [ebx + 8], esi
jne 0x6e6b69
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
push 0x100e12b4
lea esi, [esp + 0xc]
call fcn.00625c60
mov edx, dword [esp + 8]
push edx
mov esi, edi
call fcn.00625c60
mov esi, dword [esp + 8]
test esi, esi
je 0x6e6ba7
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x8c]
call fcn.006e2c00
mov eax, dword [0x100ef808]
push esi
push 1
push eax
call dword [0x100cf260]
cmp byte [esp + 0xa4], 0
je 0x6e6ba7
mov esi, dword [esp + 0xa0]
call fcn.006c54d0
mov eax, ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x6e6ba7
push eax
lea ecx, [esp + 0xac]
push 0x100d46fc
push ecx
call dword [0x100cf2ec]
add esp, 0xc
cmp dword [ebx + 8], esi
je 0x6e6b98
push 0x100e12b0
mov esi, edi
call fcn.006df5f0
lea edx, [esp + 0xa8]
push edx
mov esi, edi
call fcn.006df5f0
pop edi
mov eax, ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x6e6bc0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 0x100da8e8
add edi, 4
xor esi, esi
mov eax, 0x100
xor ecx, ecx
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], 0xff
call fcn.006eb3c0
mov dword [edi + 4], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [edi], eax
push 0x100d6cfc
lea esi, [esp + 0x10]
mov byte [eax], 0
mov dword [esp + 0x1c], 0x10000
mov dword [esp + 0x20], 0x100e1180
mov dword [esp + 0x24], 0x20000
mov dword [esp + 0x28], 0x100e1188
mov dword [esp + 0x2c], 0x100000
mov dword [esp + 0x30], 0x100e1198
mov dword [esp + 0x34], 0x40000
mov dword [esp + 0x38], 0x100e11a4
mov dword [esp + 0x3c], 0x80000
mov dword [esp + 0x40], 0x100e11b0
mov dword [esp + 0x44], 0x80000000
mov dword [esp + 0x48], 0x100e11bc
mov dword [esp + 0x4c], 0x40000000
mov dword [esp + 0x50], 0x100e11cc
mov dword [esp + 0x54], 0x20000000
mov dword [esp + 0x58], 0x100e11dc
mov dword [esp + 0x5c], 0x10000000
mov dword [esp + 0x60], 0x100e11ec
mov dword [esp + 0x64], 0x10
mov dword [esp + 0x68], 0x100e153c
mov dword [esp + 0x6c], 8
mov dword [esp + 0x70], 0x100e1550
mov dword [esp + 0x74], 4
mov dword [esp + 0x78], 0x100e1564
mov dword [esp + 0x7c], 2
mov dword [esp + 0x80], 0x100e1578
mov dword [esp + 0x84], 1
mov dword [esp + 0x88], 0x100e158c
call fcn.00625c60
mov ebx, dword [esp + 0xc]
push ebx
mov esi, edi
call fcn.00625c60
test ebx, ebx
je 0x6e6d17
mov eax, ebx
call fcn.00622510
xor ebx, ebx
lea esp, [esp]
mov eax, dword [esp + ebx*8 + 0x18]
test dword [ebp + 0xc], eax
je 0x6e6d4f
not eax
and dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x6e6d43
push 0x100e12b0
mov esi, edi
call fcn.006df5f0
mov ecx, dword [esp + ebx*8 + 0x1c]
push ecx
mov esi, edi
call fcn.006df5f0
add ebx, 1
cmp ebx, 0xe
jb 0x6e6d20
mov ebx, dword [ebp + 8]
xor esi, esi
cmp dword [ebx + 8], esi
jne 0x6e6dd3
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
push 0x100e12b4
lea esi, [esp + 0x10]
call fcn.00625c60
mov ebx, dword [esp + 0xc]
push ebx
mov esi, edi
call fcn.00625c60
test ebx, ebx
je 0x6e6dc7
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x8c]
call fcn.006e2c00
mov edx, dword [0x100ef808]
push ebx
push 1
push edx
call dword [0x100cf260]
cmp byte [esp + 0xa4], 0
je 0x6e6dc7
mov esi, dword [esp + 0xa0]
call fcn.006c54d0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x6e6e11
push eax
lea eax, [esp + 0xac]
push 0x100d46fc
push eax
call dword [0x100cf2ec]
add esp, 0xc
cmp dword [ebx + 8], esi
je 0x6e6e02
push 0x100e12b0
mov esi, edi
call fcn.006df5f0
lea ecx, [esp + 0xa8]
push ecx
mov esi, edi
call fcn.006df5f0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6efe90
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [edx + 0x14]
push ebx
push esi
movzx esi, word [edx + 6]
xor ecx, ecx
test si, si
lea eax, [eax + edx + 0x18]
jbe 0x6efec0
mov edx, dword [eax + 0xc]
cmp edx, edi
ja 0x6efeb5
mov ebx, dword [eax + 8]
add ebx, edx
cmp ebx, edi
ja 0x6efec2
add ecx, 1
add eax, 0x28
cmp cx, si
jb 0x6efea5
xor eax, eax
pop esi
pop ebx
ret

Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c004]
jne 0x401010
repz ret
jmp fcn.0040161b

Function at 0x407cd6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404e6b
and dword [ebp - 4], 0
cmp dword [0x41e184], 0
mov ebx, eax
jne 0x407d87
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407e38
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407e38
push eax
call fcn.00404df9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41e184], eax
call esi
push eax
call fcn.00404df9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41e188], eax
call esi
push eax
call fcn.00404df9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41e18c], eax
call esi
push eax
call fcn.00404df9
pop ecx
mov dword [0x41e194], eax
test eax, eax
je 0x407d87
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404df9
pop ecx
mov dword [0x41e190], eax
mov eax, dword [0x41e190]
cmp eax, ebx
je 0x407ddf
cmp dword [0x41e194], ebx
je 0x407ddf
push eax
call fcn.00404e74
push dword [0x41e194]
mov esi, eax
call fcn.00404e74
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407ddf
test edi, edi
je 0x407ddf
call esi
test eax, eax
je 0x407dd6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407dd6
test byte [ebp - 0xc], 1
jne 0x407ddf
or dword [ebp + 0x10], 0x200000
jmp 0x407e18
mov eax, dword [0x41e188]
cmp eax, ebx
je 0x407e18
push eax
call fcn.00404e74
pop ecx
test eax, eax
je 0x407e18
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407e18
mov eax, dword [0x41e18c]
cmp eax, ebx
je 0x407e18
push eax
call fcn.00404e74
pop ecx
test eax, eax
je 0x407e18
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41e184]
call fcn.00404e74
pop ecx
test eax, eax
je 0x407e38
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407e3a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret