joyce8/EMBER2024-capa huggingface dataset:
Function at 0x623a00
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 4], ecx
mov ecx, dword [eax + 0xc]
movzx eax, byte [eax + 6]
mov dword [esp], ecx
lea ecx, [edx + 2]
imul ecx, eax
push ebp
push esi
mov esi, dword [esp + 0x24]
lea esi, [esi + ecx*2]
add ecx, esi
mov ebp, ecx
mov ecx, dword [esp + 0x30]
cmp edx, ecx
jge 0x623ace
sub ecx, edx
push ebx
mov dword [esp + 0x30], ecx
push edi
xor edi, edi
test eax, eax
jle 0x623ac2
mov esi, dword [esp + 0x3c]
xor ebx, ebx
add esi, 8
mov edx, dword [esp + 0x10]
movzx eax, byte [edi + edx]
mov ecx, eax
and ecx, 0x1f
mov edx, 1
shl edx, cl
mov ecx, dword [esp + 0x40]
sar eax, 5
test dword [ecx + eax*4], edx
je 0x623aac
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
lea edx, [esp + 0x18]
add ecx, ebx
push edx
push ecx
mov ecx, ebp
call fcn.006235f0
fld dword [esp + 0x18]
fadd dword [esi - 8]
fstp dword [esi - 8]
fld dword [esp + 0x1c]
fadd dword [esi - 4]
fstp dword [esi - 4]
fld dword [esp + 0x20]
fadd dword [esi]
fstp dword [esi]
fld dword [esp + 0x24]
fadd dword [esi + 4]
fstp dword [esi + 4]
mov edx, dword [esp + 0x30]
movzx eax, byte [edx + 6]
add ebp, 3
inc edi
add ebx, 0x20
add esi, 0x10
cmp edi, eax
jl 0x623a50
dec dword [esp + 0x34]
jne 0x623a41
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x18
ret 0x18

Function at 0x623ae0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0xc]
push ebp
push esi
movzx esi, byte [edx + 6]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 8], eax
lea eax, [ecx + 2]
imul eax, esi
mov esi, dword [esp + 0x24]
lea esi, [esi + eax*2]
lea ebp, [eax + esi - 3]
lea eax, [ecx - 1]
mov ecx, dword [esp + 0x30]
cmp eax, ecx
jl 0x623bbc
sub eax, ecx
inc eax
push ebx
mov dword [esp + 0x30], eax
push edi
movzx edi, byte [edx + 6]
dec edi
js 0x623bb0
mov edx, dword [esp + 0x3c]
mov ebx, edi
mov ecx, edi
shl ebx, 5
shl ecx, 4
lea esi, [ecx + edx + 8]
mov eax, dword [esp + 0x10]
movzx eax, byte [edi + eax]
mov ecx, eax
and ecx, 0x1f
mov edx, 1
shl edx, cl
mov ecx, dword [esp + 0x40]
sar eax, 5
test dword [ecx + eax*4], edx
je 0x623b9e
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
lea edx, [esp + 0x18]
add ecx, ebx
push edx
push ecx
mov ecx, ebp
call fcn.006235f0
fld dword [esi - 8]
fsub dword [esp + 0x18]
fstp dword [esi - 8]
fld dword [esi - 4]
fsub dword [esp + 0x1c]
fstp dword [esi - 4]
fld dword [esi]
fsub dword [esp + 0x20]
fstp dword [esi]
fld dword [esi + 4]
fsub dword [esp + 0x24]
fstp dword [esi + 4]
sub ebp, 3
dec edi
sub ebx, 0x20
sub esi, 0x10
test edi, edi
jge 0x623b42
mov edx, dword [esp + 0x30]
dec dword [esp + 0x34]
jne 0x623b25
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x18
ret 0x18
Function at 0x62e490
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov eax, 0x4010
call fcn.00666410
mov eax, dword [esp + 0x4018]
push ebx
push ebp
push esi
push edi
push 1
xor edi, edi
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x402c]
push edi
push ecx
push 0x2000
mov ebx, eax
mov eax, dword [esp + 0x4030]
lea edx, [esp + 0x2c]
push edx
push ebx
push eax
mov dword [esp + 0x28], ebx
call fcn.0062dcc0
add esp, 0x18
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x402c]
mov esi, edi
push 0
push ecx
mov ecx, dword [esp + 0x402c]
xor esi, 1
mov edx, esi
shl edx, 0xd
push 0x2000
lea eax, [esp + edx + 0x2c]
push eax
add ebx, 0x2000
push ebx
push ecx
call fcn.0062dcc0
mov dword [esp + esi*4 + 0x2c], eax
mov ebx, dword [esp + edi*4 + 0x2c]
push ebx
call fcn.0062d330
push ebx
call fcn.0062d1c0
mov ecx, dword [esp + 0x4048]
add esp, 0x20
push 0
mov ebx, eax
lea eax, [esp + 0x20]
push eax
mov edx, edi
shl edx, 0xd
push ebx
lea ebp, [esp + edx + 0x2c]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x62e58d
mov edi, dword [esp + 0x4030]
xor edx, edx
mov dx, word [edi]
push edx
push ebx
push ebp
call fcn.00635c00
mov ecx, dword [esp + 0x1c]
add ecx, ebx
add esp, 0xc
cmp ebx, 0x2000
mov word [edi], ax
mov dword [esp + 0x10], ecx
mov edi, esi
jne 0x62e5d0
mov al, byte [0x706c74]
test al, al
jne 0x62e5d0
mov ebx, ecx
jmp 0x62e4e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x10], 0xffffffff
xor edi, 1
mov edi, dword [esp + edi*4 + 0x14]
push edi
call fcn.0062d330
add esp, 4
cmp eax, 1
je 0x62e5f1
mov ecx, dword [str.A_fatal_error_has_occurred_in_the_installer.__Try_deleting_the_file_cache.dat_in_the_Game_Install_Directory_and_run_the_game_again._n]
push ecx
call fcn.00635a10
add esp, 4
push edi
call fcn.0062d1c0
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4010
ret
Function at 0x630530
Capabilities:
Get disk information

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 0x250
push esi
mov esi, dword [esp + 0x258]
push edi
mov edi, dword [esp + 0x260]
lea eax, [esp + 0xc]
push eax
push edi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x6305b2
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x630561
sub eax, edx
inc eax
cmp eax, 0x104
jae 0x630597
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x630577
sub eax, edx
inc eax
push eax
push esi
push edi
call fcn.00632770
add esp, 0xc
pop edi
xor eax, eax
pop esi
add esp, 0x250
ret
mov eax, 0x104
push eax
push esi
push edi
call fcn.00632770
add esp, 0xc
pop edi
xor eax, eax
pop esi
add esp, 0x250
ret
lea edx, [esp + 0x14]
push edx
push edi
call fcn.00630450
add esp, 8
push 0
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x6305a7
test byte [esp + 8], 2
jne 0x6305f1
push edi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [esp + 8], 4
jne 0x63062a
lea eax, [esp + 0x118]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x63062a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x144]
mov edi, edi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x630620
pop edi
mov eax, 1
pop esi
add esp, 0x250
ret
Function at 0x630a90
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [0x706ccc]
test eax, eax
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
not esi
je 0x630c14
test esi, esi
jl 0x630c14
cmp esi, dword [0x706cc8]
jge 0x630c14
lea esi, [esi + esi*8]
shl esi, 2
cmp byte [esi + eax], 0
je 0x630c14
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x706ccc]
mov ecx, dword [esi + eax + 0x1c]
cmp dword [esi + eax + 0x18], ecx
jle 0x630aec
mov dword [esi + eax + 0x18], ecx
mov ecx, dword [esi + eax + 0x20]
test ecx, ecx
push ebx
push edi
mov edi, dword [esp + 0x1c]
je 0x630b11
mov edx, dword [esi + eax + 0x18]
mov ecx, dword [esi + eax + 0x1c]
lea ebx, [edx + edi]
cmp ebx, ecx
jle 0x630b11
sub ecx, edx
mov dword [esp + 0x1c], ecx
mov edi, ecx
test edi, edi
mov ebx, dword [esi + eax + 0xc]
mov byte [esi + eax + 2], 1
je 0x630c06
push ebp
mov ebp, dword [esp + 0x1c]
jmp 0x630b30
mov cl, byte [esi + eax + 2]
test cl, cl
je 0x630c05
cmp ebx, edi
jbe 0x630b42
mov ebx, edi
mov ecx, dword [esi + eax + 0x14]
test ecx, ecx
je 0x630b68
mov eax, dword [esi + eax + 0x18]
push ebx
add eax, ecx
push eax
push ebp
call fcn.00632770
push 0
mov dword [esp + 0x28], ebx
call fcn.00631b80
add esp, 0x10
jmp 0x630b80
mov edx, dword [esi + eax + 4]
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x630bc5
mov eax, dword [0x706ccc]
mov ecx, dword [esp + 0x18]
mov edi, dword [esi + eax + 0x18]
mov edx, dword [esp + 0x10]
add edi, ecx
mov dword [esi + eax + 0x18], edi
mov ecx, dword [esp + 0x18]
add edx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [esi + eax + 0x1c]
add ebp, ecx
cmp edi, edx
jle 0x630bb3
mov dword [esi + eax + 0x18], edx
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
jb 0x630c05
mov edx, dword [esp + 0x20]
sub edx, ecx
mov dword [esp + 0x20], edx
mov edi, edx
jmp 0x630be1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x630bf8
push 1
call fcn.00631b80
mov eax, dword [0x706ccc]
add esp, 4
test edi, edi
jne 0x630b30
pop ebp
pop edi
mov byte [esi + eax + 2], 0
mov eax, dword [esp + 8]
pop ebx
pop esi
pop ecx
ret
mov eax, dword [0x706ccc]
mov dword [esp + 0x10], 0
pop ebp
pop edi
mov byte [esi + eax + 2], 0
mov eax, dword [esp + 8]
pop ebx
pop esi
pop ecx
ret
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ecx
ret
Function at 0x630c30
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [0x706ccc]
test ecx, ecx
mov eax, dword [esp + 8]
push esi
mov dword [esp + 4], 0
not eax
je 0x630d88
test eax, eax
jl 0x630d88
cmp eax, dword [0x706cc8]
jge 0x630d88
lea esi, [eax + eax*8]
shl esi, 2
cmp byte [esi + ecx], 0
je 0x630d88
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x706ccc]
mov ecx, dword [esi + eax + 0x1c]
cmp dword [esi + eax + 0x18], ecx
jle 0x630c8d
mov dword [esi + eax + 0x18], ecx
mov ecx, dword [esi + eax + 0x14]
test ecx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [esi + eax + 0xc]
je 0x630cb7
mov edx, dword [esi + eax + 0x18]
mov ecx, dword [esi + eax + 0x1c]
lea ebx, [edx + ebp]
cmp ebx, ecx
jle 0x630cb7
sub ecx, edx
mov ebp, ecx
mov dword [esp + 0x20], ebp
test ebp, ebp
je 0x630d7e
mov ebx, dword [esp + 0x1c]
cmp edi, ebp
jbe 0x630cc9
mov edi, ebp
mov ecx, dword [esi + eax + 0x14]
test ecx, ecx
je 0x630cef
mov eax, dword [esi + eax + 0x18]
push edi
add eax, ecx
push ebx
push eax
call fcn.00632770
push 0
mov dword [esp + 0x28], edi
call fcn.00631b80
add esp, 0x10
jmp 0x630d07
mov edx, dword [esi + eax + 4]
push 0
lea ecx, [esp + 0x1c]
push ecx
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x630d48
mov eax, dword [0x706ccc]
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + eax + 0x18]
mov ebp, dword [esp + 0x10]
add edx, ecx
mov dword [esi + eax + 0x18], edx
mov ecx, dword [esp + 0x18]
add ebp, ecx
add ebx, ecx
cmp ecx, edi
mov dword [esp + 0x10], ebp
jae 0x630d32
xor ebp, ebp
jmp 0x630d38
mov ebp, dword [esp + 0x20]
sub ebp, ecx
cmp edx, dword [esi + eax + 0x1c]
mov dword [esp + 0x20], ebp
jle 0x630d64
mov dword [esi + eax + 0x1c], edx
jmp 0x630d64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x630d76
push 1
call fcn.00631b80
mov eax, dword [0x706ccc]
add esp, 4
test ebp, ebp
jne 0x630cc3
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ecx
ret

Function at 0x631b40
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0xffffffff
push esi
jne 0x631b54
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
jmp 0x631b57
mov esi, dword [eax + 4]
test esi, esi
je 0x631b64
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x631e70
Capabilities:
Resume thread

Disassembly:
sub esp, 0x10
push ebx
push esi
push 1
xor bl, bl
call dword [0x6da930]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
lea ecx, [esi + 8]
push ecx
push 4
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
push 0x631a90
push eax
push 0
mov dword [esp + 0x2c], 0
call fcn.00668067
add esp, 0x1c
test eax, eax
mov dword [esp + 8], eax
je 0x631ef3
mov ecx, dword [esp + 0x2c]
push ecx
push esi
mov bl, 1
mov dword [esi + 4], eax
call fcn.00631cb0
mov edx, dword [esi + 4]
add esp, 8
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 8]
test eax, eax
je 0x631ef3
mov esi, dword [sym.imp.KERNEL32.dll_SleepEx]
push 1
push 1
call esi
mov eax, dword [esp + 8]
test eax, eax
jne 0x631ee5
push 0
call dword [0x6da930]
add esp, 4
pop esi
mov al, bl
pop ebx
add esp, 0x10
ret

Function at 0x631f10
Capabilities:
Resume thread

Disassembly:
sub esp, 0x10
push ebx
push esi
push 1
xor bl, bl
call dword [0x6da930]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
lea edx, [esi + 8]
push edx
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
push 0x631a90
push ecx
push 0
mov dword [esp + 0x28], 0
call fcn.00668067
add esp, 0x1c
test eax, eax
mov dword [esp + 8], eax
je 0x631f9e
mov edx, dword [esp + 0x30]
push edx
push esi
mov bl, 1
mov dword [esi + 4], eax
call fcn.00631cb0
mov eax, dword [esi + 4]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 8]
test eax, eax
je 0x631f9e
mov esi, dword [sym.imp.KERNEL32.dll_SleepEx]
lea ecx, [ecx]
push 1
push 1
call esi
mov eax, dword [esp + 8]
test eax, eax
jne 0x631f90
push 0
call dword [0x6da930]
add esp, 4
pop esi
mov al, bl
pop ebx
add esp, 0x10
ret

Function at 0x632060
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ecx, dword [0x706d58]
mov eax, dword [0x706d54]
add eax, ecx
mov ecx, dword [0x706d48]
mov edx, eax
sar eax, 0x10
add ecx, eax
mov eax, dword [0x706d34]
and edx, 0xffff
test eax, eax
mov dword [0x706d58], edx
mov dword [0x706d48], ecx
je 0x6320fe
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, eax
mov eax, dword [0x706d48]
sub eax, ecx
dec eax
cmp eax, 1
jge 0x6320c7
cmp eax, 0xfffffc18
jge 0x6320c2
call esi
inc eax
mov dword [0x706d48], eax
inc dword [0x706d68]
mov eax, 1
mov edx, dword [0x706d38]
push 0
push 0
push fcn.00632060
push edx
push eax
call dword [sym.imp.WINMM.dll_timeSetEvent]
test eax, eax
mov dword [0x706d4c], eax
pop esi
jne 0x6320fe
mov dword [0x707660], eax
mov dword [0x706d34], eax
mov eax, dword [0x706d38]
push eax
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov eax, dword [0x706d50]
test eax, eax
je 0x63211d
mov eax, dword [0x706d64]
test eax, eax
jne 0x63211d
push 0x706d5c
call fcn.00635050
add esp, 4
call fcn.006367f0
ret 0x14
Function at 0x6321e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xc
mov eax, dword [0x706d6c]
push ebx
push ebp
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [esp + 0x10], 5
mov esi, 1
jne 0x632213
mov ecx, 8
xor eax, eax
mov edi, 0x707640
mov dword [0x706d6c], esi
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 0x20]
lea ecx, [ecx]
call fcn.00632150
cmp edi, ebx
je 0x632243
cmp edi, esi
jl 0x632235
cmp edi, 0x2710
jle 0x632248
push edi
push str.TIMER_init___BAD_TIMER_FREQUENCY_SPECIFIED__d_n
call fcn.00635a10
add esp, 8
mov edi, 0x64
mov eax, 0x3e80000
cdq
idiv edi
push 8
mov dword [0x706d58], ebx
mov dword [0x707664], ebx
mov dword [0x706d54], eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x63238a
cmp dword [0x706d54], 0x10000
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [0x706d38], esi
jl 0x6323ad
push 0xc
push 0x706d3c
call fcn.006327d0
push 2
push ebx
push ebx
push 0x631fc0
push 0x706d3c
call fcn.00631e70
add esp, 0x1c
test al, al
je 0x6323d0
mov ecx, dword [0x706d38]
push ecx
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov esi, eax
cmp esi, ebx
jne 0x6323f3
push fcn.00632150
call fcn.00635b30
add esp, 4
cmp edi, ebx
mov dword [0x707660], edi
mov dword [0x706d34], edi
je 0x632321
cmp dword [0x706d4c], ebx
jne 0x632321
mov esi, dword [0x706d64]
mov dword [0x706d64], 1
call ebp
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [0x706d48], eax
call fcn.00632060
mov dword [0x706d64], esi
call fcn.00633250
mov ebx, eax
call ebp
mov esi, eax
mov eax, dword [0x707660]
lea edx, [eax + eax*4]
add esi, edx
call ebp
cmp eax, esi
jge 0x632359
lea esp, [esp]
call fcn.00633250
cmp ebx, eax
jne 0x632359
push 1
call fcn.00631b80
add esp, 4
call ebp
cmp eax, esi
jl 0x632340
call fcn.00633250
cmp ebx, eax
jne 0x632367
call fcn.00632150
mov eax, dword [0x707660]
test eax, eax
jne 0x632431
dec dword [esp + 0x10]
je 0x632424
xor ebx, ebx
mov esi, 1
jmp 0x632220
push str.TIMER_init___MULTIMEDIA_TIMER_NOT_FOUND._n
call fcn.00635a10
add esp, 4
pop edi
pop esi
pop ebp
mov dword [0x707660], ebx
mov dword [0x706d34], ebx
xor eax, eax
pop ebx
add esp, 0xc
ret
push str.TIMER_init___MULTIMEDIA_TIMER_CANNOT_SUPPORT_THIS_FREQUENCY._n
call fcn.00635a10
add esp, 4
pop edi
pop esi
pop ebp
mov dword [0x707660], ebx
mov dword [0x706d34], ebx
xor eax, eax
pop ebx
add esp, 0xc
ret
push str.TIMER_init___FAILED_TO_CREATE_TIMER_THREAD._n
call fcn.00635a10
add esp, 4
pop edi
pop esi
pop ebp
mov dword [0x707660], ebx
mov dword [0x706d34], ebx
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x706d5c
mov dword [0x707660], ebx
mov dword [0x706d34], ebx
call fcn.00635050
push esi
push str.TIMER_init___FAILED_TO_INITIALIZE_MULTIMEDIA_TIMER_:_0x_x._n
call fcn.00635a10
mov eax, dword [0x707660]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push str.TIMER_init___FAILED_TO_INITIALIZE_WINDOWS_MULTIMEDIA_TIMER__TRY_RE_RUNNING._n
call fcn.00635a10
add esp, 4
mov eax, dword [0x707660]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x632860
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
add al, 0x50
adc dword [0xc1e98220], 0x83fffffe
sub esp, 0x10
lea eax, [esp + 4]
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.WS2_32.dll_bind
mov dword [esp + 0xc], 0
or al, 0
add byte [eax], al
add bh, al
inc esp
and al, 0x18
sbb byte [eax + eax], al
add byte [eax], al
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x6328c0
invalid
lea ecx, [esp + 8]

Function at 0x632900
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], eax
push edi
lea eax, [esp + 0x10]
push eax
mov ebp, 0xf4240
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea ecx, [ecx]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x10]
cmp eax, esi
mov ecx, dword [esp + 0x14]
jne 0x632969
cmp ecx, edi
jne 0x632969
mov edx, dword [esp + 0x1c]
add ebp, 0xffffffff
adc edx, 0xffffffff
mov dword [esp + 0x1c], edx
mov edx, ebp
or edx, dword [esp + 0x1c]
je 0x632979
sub eax, esi
sbb ecx, edi
cmp ecx, ebx
jb 0x632930
ja 0x632979
cmp eax, dword [esp + 0x24]
jb 0x632930
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x6329b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 8
push ebx
push ebp
push edi
lea eax, [esp + 0xc]
push eax
xor ebp, ebp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
xor edi, edi
push edi
push 5
push ecx
push edx
call fcn.00668100
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
push esi
Function at 0x635c00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
movzx eax, word [esp + 0x14]
xor edx, edx
xor esi, esi
dec ecx
jns 0x635c20
jmp 0x635c34
xor eax, esi
mov dl, byte [ebx]
xor dl, al
inc ebx
shr eax, 8
dec ecx
mov esi, dword [edx*4 + 0x6da330]
jns 0x635c20
xor eax, esi
pop esi
pop ebx
ret

Function at 0x637120
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push esi
xor esi, esi
sub eax, esi
mov ebp, 2
je 0x637154
dec eax
je 0x637141
dec eax
jne 0x637194
mov al, 0x91
mov byte [esp + 0x10], 0x46
jmp 0x63715b
mov al, 0x90
mov byte [esp + 0x10], 0x45
mov esi, 1
mov ebp, 3
jmp 0x63715b
mov al, 0x14
mov byte [esp + 0x10], 0x3a
mov byte [esp + 8], al
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 0x14]
and eax, 1
cmp eax, ecx
je 0x637194
push ebx
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push edi
mov edi, dword [esp + 0x10]
push 0
push esi
mov esi, dword [esp + 0x20]
push esi
push edi
call ebx
push 0
push ebp
push esi
push edi
call ebx
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x6480e0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov word [0x70b850], 0x100
call fcn.00641ab0
movzx ecx, byte [0x70b5fc]
xor edi, edi
xor eax, eax
cmp ecx, edi
jle 0x648134
nop
mov dl, byte [eax*2 + 0x70b5fe]
and dl, 0x11
cmp dl, 0x11
je 0x64811c
inc eax
cmp eax, ecx
mov dword [0x70b854], edi
jl 0x648100
jmp 0x648134
movzx eax, word [0x70b850]
shl eax, 3
push eax
call fcn.00644560
add esp, 4
mov dword [0x70b854], eax
movsx ecx, word [0x70b728]
imul ecx, ecx, 0x110
push ecx
call fcn.00644560
movsx edx, word [0x70b728]
imul edx, edx, 0x110
push edx
push eax
mov dword [0x70b84c], eax
call fcn.00648260
mov al, byte [0x70b834]
add esp, 0xc
test al, al
je 0x6481a8
mov esi, 0x70b844
push 0x2020
call fcn.00644560
mov dword [esi - 8], eax
add eax, 8
add esp, 4
test al, 0xf
mov dword [esi], eax
je 0x64819d
lea ebx, [ebx]
mov ecx, dword [esi]
add ecx, 4
mov al, cl
test al, 0xf
mov dword [esi], ecx
jne 0x648190
add esi, 4
cmp esi, 0x70b84c
jl 0x648171
call fcn.00641ad0
mov al, byte [0x70b5e8]
cmp al, 0xff
je 0x6481da
cmp al, 1
je 0x6481cc
cmp al, 2
jne 0x6481ec
fld dword [0x6dc870]
fadd dword [0x6bdb8c]
jmp 0x6481e6
fld dword [0x6dc870]
fadd dword [0x6bdd94]
jmp 0x6481e6
fld dword [0x6dc870]
fsub dword [0x6bdcfc]
fstp dword [0x6dc870]
mov al, byte [0x70b832]
test al, al
jne 0x648209
push 0x64c270
call fcn.0066459d
add esp, 4
mov byte [0x70b832], 1
call fcn.006478d0
mov esi, eax
cmp esi, edi
jl 0x648251
push 0x70d908
push edi
push edi
push 0x648020
push edi
push edi
mov dword [0x70b8a0], edi
mov word [0x6dc878], di
mov byte [0x70b830], 1
mov byte [0x70b831], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xf
push eax
mov dword [0x70d904], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
mov eax, esi
pop esi
ret
Function at 0x64b0e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ax, word [edi + 2]
mov word [ecx + 2], ax
movsx esi, word [edi + 2]
mov edx, dword [0x70b84c]
imul esi, esi, 0x110
add esi, edx
xor eax, eax
mov dword [esi + 0xe4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
movsx ebp, word [edi + 2]
mov edx, dword [edi + 0x10]
movzx eax, byte [edi + 4]
add ecx, 4
push ecx
movzx ecx, byte [edi + 6]
push ecx
mov ecx, dword [edi + 0xc]
lea ebx, [esi + 0xe4]
push ebp
push edx
mov edx, dword [edi + 8]
push eax
movzx eax, byte [edi + 5]
push ecx
mov ecx, dword [edi + 0x14]
push edx
push eax
push ecx
call fcn.0064f370
mov dword [esi + 0x18], eax
mov word [eax + 0x18], 5
mov edx, dword [esi + 0x18]
push edx
push ebx
call fcn.0064ad70
push 0x1c
call fcn.00644560
push eax
mov dword [esi + 0x1c], eax
call fcn.0064ea10
mov eax, dword [esi + 0x1c]
mov word [eax + 0x18], 1
mov ecx, dword [esi + 0x1c]
push ecx
push ebx
call fcn.0064ad70
mov eax, dword [edi + 0x18]
add esp, 0x3c
test eax, eax
je 0x64b1c8
mov eax, dword [edi + 0x10]
test eax, eax
je 0x64b19a
or ebp, 0xffffffff
push 0x1828
call fcn.00644560
mov dword [esi + 0x20], eax
mov edx, dword [edi + 0x18]
push ebp
push edx
push eax
call fcn.0064e920
mov eax, dword [esi + 0x20]
mov word [eax + 0x18], 4
mov ecx, dword [esi + 0x20]
push ecx
push ebx
call fcn.0064ad70
add esp, 0x18
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret