joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6de94320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
movzx edi, word [ebx + 0xb72]
mov esi, dword [ebx + 0xbb0]
test byte [0x6dea0114], 8
jne 0x6de94258
cmp dword [ebp + 0xc], 0x20
ja case.0x6de941bf.0
mov eax, dword [ebp + 0xc]
jmp dword [eax*4 + 0x6dea60f0]
mov eax, 0x9a
mov word [ebp - 0x1e], ax
mov eax, dword [ebx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], sym._unload_effect_object_8
mov dword [esp], ebx
call dword [eax + 0x5c]
mov dword [ebx + 0x930], 3
sub esp, 0x10
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x954]
mov dword [ebp - 0x1c], 1
mov dword [esp + 8], eax
movzx eax, byte [ebx + 0xcc8]
mov dword [esp], 1
mov dword [esp + 4], eax
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
je 0x6de94290
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.iface__p__command__lx._n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.hid_joystick_send_force_feedback_command
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6de941b6
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x954]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0xcd0]
mov dword [esp + 4], 0xf
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._HidP_SetUsages_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de9424a
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x93c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6de94389
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x6de94318
cmp dword [ebp + 0xc], 1
je 0x6de94370
xor eax, eax
jmp 0x6de9424a
mov eax, 0x99
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9b
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9c
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov ecx, 0x97
mov word [ebp - 0x1e], cx
jmp case.0x6de941bf.0
mov edx, 0x98
mov word [ebp - 0x1e], dx
jmp case.0x6de941bf.0
mov eax, dword [ebx + 0x92c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._hid_joystick_send_device_gain
xor eax, eax
jmp 0x6de9424a
mov eax, 0x8007001e
jmp 0x6de9424a
Function at 0x6de94330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
movzx edi, word [ebx + 0xb72]
mov esi, dword [ebx + 0xbb0]
test byte [0x6dea0114], 8
jne 0x6de94258
cmp dword [ebp + 0xc], 0x20
ja case.0x6de941bf.0
mov eax, dword [ebp + 0xc]
jmp dword [eax*4 + 0x6dea60f0]
mov eax, 0x9a
mov word [ebp - 0x1e], ax
mov eax, dword [ebx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], sym._unload_effect_object_8
mov dword [esp], ebx
call dword [eax + 0x5c]
mov dword [ebx + 0x930], 3
sub esp, 0x10
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x954]
mov dword [ebp - 0x1c], 1
mov dword [esp + 8], eax
movzx eax, byte [ebx + 0xcc8]
mov dword [esp], 1
mov dword [esp + 4], eax
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
je 0x6de94290
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.iface__p__command__lx._n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.hid_joystick_send_force_feedback_command
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6de941b6
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x954]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0xcd0]
mov dword [esp + 4], 0xf
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._HidP_SetUsages_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de9424a
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x93c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6de94389
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x6de94318
cmp dword [ebp + 0xc], 1
je 0x6de94370
xor eax, eax
jmp 0x6de9424a
mov eax, 0x99
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9b
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9c
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov ecx, 0x97
mov word [ebp - 0x1e], cx
jmp case.0x6de941bf.0
mov edx, 0x98
mov word [ebp - 0x1e], dx
jmp case.0x6de941bf.0
mov eax, dword [ebx + 0x92c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._hid_joystick_send_device_gain
xor eax, eax
jmp 0x6de9424a
mov eax, 0x8007001e
jmp 0x6de9424a
Function at 0x6de94340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
movzx edi, word [ebx + 0xb72]
mov esi, dword [ebx + 0xbb0]
test byte [0x6dea0114], 8
jne 0x6de94258
cmp dword [ebp + 0xc], 0x20
ja case.0x6de941bf.0
mov eax, dword [ebp + 0xc]
jmp dword [eax*4 + 0x6dea60f0]
mov eax, 0x9a
mov word [ebp - 0x1e], ax
mov eax, dword [ebx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], sym._unload_effect_object_8
mov dword [esp], ebx
call dword [eax + 0x5c]
mov dword [ebx + 0x930], 3
sub esp, 0x10
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x954]
mov dword [ebp - 0x1c], 1
mov dword [esp + 8], eax
movzx eax, byte [ebx + 0xcc8]
mov dword [esp], 1
mov dword [esp + 4], eax
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
je 0x6de94290
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.iface__p__command__lx._n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.hid_joystick_send_force_feedback_command
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6de941b6
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x954]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0xcd0]
mov dword [esp + 4], 0xf
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._HidP_SetUsages_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de9424a
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x93c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6de94389
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x6de94318
cmp dword [ebp + 0xc], 1
je 0x6de94370
xor eax, eax
jmp 0x6de9424a
mov eax, 0x99
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9b
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9c
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov ecx, 0x97
mov word [ebp - 0x1e], cx
jmp case.0x6de941bf.0
mov edx, 0x98
mov word [ebp - 0x1e], dx
jmp case.0x6de941bf.0
mov eax, dword [ebx + 0x92c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._hid_joystick_send_device_gain
xor eax, eax
jmp 0x6de9424a
mov eax, 0x8007001e
jmp 0x6de9424a
Function at 0x6de94350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
movzx edi, word [ebx + 0xb72]
mov esi, dword [ebx + 0xbb0]
test byte [0x6dea0114], 8
jne 0x6de94258
cmp dword [ebp + 0xc], 0x20
ja case.0x6de941bf.0
mov eax, dword [ebp + 0xc]
jmp dword [eax*4 + 0x6dea60f0]
mov eax, 0x9a
mov word [ebp - 0x1e], ax
mov eax, dword [ebx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], sym._unload_effect_object_8
mov dword [esp], ebx
call dword [eax + 0x5c]
mov dword [ebx + 0x930], 3
sub esp, 0x10
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x954]
mov dword [ebp - 0x1c], 1
mov dword [esp + 8], eax
movzx eax, byte [ebx + 0xcc8]
mov dword [esp], 1
mov dword [esp + 4], eax
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
je 0x6de94290
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.iface__p__command__lx._n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.hid_joystick_send_force_feedback_command
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6de941b6
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x954]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0xcd0]
mov dword [esp + 4], 0xf
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._HidP_SetUsages_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de9424a
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x93c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6de94389
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x6de94318
cmp dword [ebp + 0xc], 1
je 0x6de94370
xor eax, eax
jmp 0x6de9424a
mov eax, 0x99
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9b
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9c
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov ecx, 0x97
mov word [ebp - 0x1e], cx
jmp case.0x6de941bf.0
mov edx, 0x98
mov word [ebp - 0x1e], dx
jmp case.0x6de941bf.0
mov eax, dword [ebx + 0x92c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._hid_joystick_send_device_gain
xor eax, eax
jmp 0x6de9424a
mov eax, 0x8007001e
jmp 0x6de9424a
Function at 0x6de94360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
movzx edi, word [ebx + 0xb72]
mov esi, dword [ebx + 0xbb0]
test byte [0x6dea0114], 8
jne 0x6de94258
cmp dword [ebp + 0xc], 0x20
ja case.0x6de941bf.0
mov eax, dword [ebp + 0xc]
jmp dword [eax*4 + 0x6dea60f0]
mov eax, 0x9a
mov word [ebp - 0x1e], ax
mov eax, dword [ebx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], sym._unload_effect_object_8
mov dword [esp], ebx
call dword [eax + 0x5c]
mov dword [ebx + 0x930], 3
sub esp, 0x10
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x954]
mov dword [ebp - 0x1c], 1
mov dword [esp + 8], eax
movzx eax, byte [ebx + 0xcc8]
mov dword [esp], 1
mov dword [esp + 4], eax
call sym._HidP_InitializeReportForID_20
sub esp, 0x14
cmp eax, 0x110000
je 0x6de94290
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.iface__p__command__lx._n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.hid_joystick_send_force_feedback_command
mov dword [esp + 4], 0x6dea0114
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_4
jmp 0x6de941b6
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x954]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1e]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0xcd0]
mov dword [esp + 4], 0xf
mov dword [esp + 8], eax
mov dword [esp], 1
call sym._HidP_SetUsages_32
sub esp, 0x20
cmp eax, 0x110000
jne 0x6de9424a
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x93c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6de94389
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x6de94318
cmp dword [ebp + 0xc], 1
je 0x6de94370
xor eax, eax
jmp 0x6de9424a
mov eax, 0x99
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9b
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov eax, 0x9c
mov word [ebp - 0x1e], ax
jmp case.0x6de941bf.0
mov ecx, 0x97
mov word [ebp - 0x1e], cx
jmp case.0x6de941bf.0
mov edx, 0x98
mov word [ebp - 0x1e], dx
jmp case.0x6de941bf.0
mov eax, dword [ebx + 0x92c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._hid_joystick_send_device_gain
xor eax, eax
jmp 0x6de9424a
mov eax, 0x8007001e
jmp 0x6de9424a
Function at 0x6de9bde0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
sub esp, 0x14
test eax, eax
jne 0x6de9bdf6
cmp dword [ebp + 8], 0x7ff
jbe 0x6de9be10
cmp ebx, 0xa
je 0x6de9be29
mov edx, eax
or edx, 0xffffff80
test ah, 1
je 0x6de9be48
mov ebx, dword [ebp - 4]
mov eax, edx
leave
ret
mov dword [esp + 4], 0
mov dword [esp], edx
call dword [sym.imp.user32.dll_MapVirtualKeyW]
sub esp, 8
cmp ebx, 0xa
jne case.0x6de9be3b.14
cmp eax, 0x2b
ja 0x6de9be58
cmp eax, 0xc
jbe 0x6de9be48
lea edx, [eax - 0xd]
cmp edx, 0x1e
ja case.0x6de9be3b.14
jmp dword [edx*4 + 0x6dea7bc0]
mov edx, eax
mov ebx, dword [ebp - 4]
leave
mov eax, edx
ret
mov edx, 0x2b
cmp eax, 0x73
jne case.0x6de9be3b.14
mov ebx, dword [ebp - 4]
mov eax, edx
leave
ret
mov edx, 0x1b
jmp 0x6de9be05
mov edx, 0x1a
jmp 0x6de9be05
mov edx, 0xffffff92
jmp 0x6de9be05
mov edx, 0xffffff94
jmp 0x6de9be05
mov edx, 0xffffff90
jmp 0x6de9be05
mov edx, 0xffffff91
jmp 0x6de9be05

Function at 0x6de9bef0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x90
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x258]
push ebx
xor ebx, ebx
sub esp, 0x27c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x25c], 0
rep stosd dword es:[edi], eax
mov eax, dword [0x6dea52b4]
lea edi, [ebp - 0x238]
mov dword [ebp - 0x258], 0x240
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x254], eax
mov eax, dword [0x6dea52b8]
mov dword [ebp - 0x240], 0x104
mov dword [ebp - 0x250], eax
mov eax, dword [0x6dea52bc]
mov dword [ebp - 0x24c], eax
mov eax, dword [0x6dea52c0]
mov dword [ebp - 0x248], eax
movzx eax, byte [esi + 0x6d]
mov dword [ebp - 0x264], eax
jmp 0x6de9bfa1
test ecx, ecx
je 0x6de9c03d
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x25c], eax
inc ebx
cmp ebx, 0x200
je 0x6de9c090
mov eax, ebx
mov dword [esp + 8], 0x104
shl eax, 0x10
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetKeyNameTextW]
sub esp, 0xc
test eax, eax
je 0x6de9bf94
mov eax, dword [esi + 0x38]
mov ecx, dword [ebp - 0x264]
xor edx, edx
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
mov eax, ebx
call sym._map_dik_code
movzx eax, al
test eax, eax
je 0x6de9bf94
mov ecx, dword [ebp - 0x25c]
mov edx, eax
mov dword [ebp - 0x244], eax
shl edx, 8
inc ecx
or edx, 4
mov dword [ebp - 0x260], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x240], edx
test ecx, ecx
je 0x6de9c017
mov ecx, dword [ebp + 0x10]
and ecx, edx
and ecx, 4
je 0x6de9bf88
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 0xc]
cmp ecx, 1
je 0x6de9c080
cmp ecx, 2
jne 0x6de9bf80
mov eax, dword [ebp + 0xc]
xor edx, dword [eax + 8]
and edx, 0xffffff
jne 0x6de9bf88
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], 0
mov dword [esp], esi
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x258]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x25c]
mov dword [esp + 4], eax
call dword [ebp + 0x14]
cmp eax, 1
je 0x6de9bf88
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0xc]
cmp eax, dword [edx + 8]
jne 0x6de9bf88
jmp 0x6de9c03d
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6de9d140
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetCursorPos]
sub esp, 4
test byte [ebx + 0x50c], 1
je 0x6de9d220
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x525], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x529], eax
mov esi, dword [sym.imp.user32.dll_GetKeyState]
mov dword [ebx + 0x52d], 0
mov dword [esp], 1
call esi
sub esp, 4
and eax, 0xffffff80
mov byte [ebx + 0x531], al
mov dword [esp], 2
call esi
sub esp, 4
and eax, 0xffffff80
mov byte [ebx + 0x532], al
mov dword [esp], 4
call esi
and eax, 0xffffff80
sub esp, 4
mov byte [ebx + 0x533], al
test byte [ebx + 0x4c0], 1
jne 0x6de9d250
cmp dword [ebx + 0x94c], 2
je 0x6de9d1f8
mov eax, dword [ebx + 0x940]
test eax, eax
jne 0x6de9d278
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov edx, dword [ebx + 0x4c4]
test edx, edx
je 0x6de9d2a0
mov eax, ebx
mov edx, 1
call sym._warp_check
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [ebx + 0x525], 0
mov dword [ebx + 0x529], 0
mov dword [ebx + 0x938], eax
mov dword [ebx + 0x93c], edx
jmp 0x6de9d179
mov dword [esp], 0
call dword [sym.imp.user32.dll_ShowCursor]
mov eax, ebx
mov edx, 1
sub esp, 4
call sym._warp_check
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov dword [esp], 0
call dword [sym.imp.user32.dll_ClipCursor]
xor eax, eax
mov dword [ebx + 0x940], 0
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
call dword [sym.imp.user32.dll_GetDesktopWindow]
mov dword [ebx + 0x4c4], eax
jmp 0x6de9d206
Function at 0x6de9e1e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6de9e23b
cmp byte [esi + ebx - 1], 0xa
je 0x6de9e20f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6deb60e4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6de9ecc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x6deb6100]
test eax, eax
je 0x6de9ed78
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x6de9ed00
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x6de9ecec
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x6de9edad
mov dword [esp + 4], 0x6deaeb9c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6deb6100], eax
sub esp, 8
test eax, eax
jne 0x6de9ecdd
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x6de9ecee
Function at 0x6de9edc0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
sub esp, 8
test ebx, ebx
je 0x6de9ef58
mov eax, dword [esi]
test eax, eax
je 0x6de9ef40
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x28], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [esp + 4], 0
mov edi, eax
mov dword [ebp - 0x20], eax
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x6de9ef68
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x6de9ef30
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
not eax
pop ebx
shr eax, 0x1f
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x6de9eef6
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x6de9ee30
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x6de9ef5a
Function at 0x9145b8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x9145c2
pushal
call 0x9145c8
pop ebp
sub ebp, 0x10
sub ebp, 0x5145b8
jmp 0x9145de
mov eax, 0x5145b8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ed
mov edx, 0xf6b90fcc
xor byte [eax], dl
inc eax
dec ecx
jne 0x9145f5
jmp 0x914608
inc edi
add dword [edi + 0x45], eax
invalid