joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
mov esi, dword [ebp + 0xc]
or ecx, esi
push edi
or ecx, eax
xor edi, edi
test cl, 3
jne 0x492176
shr eax, 2
mov dword [ebp + 0x10], eax
test eax, eax
je 0x49221e
cmp eax, 0x10
jb 0x492152
lea ecx, [esi - 4]
lea ecx, [ecx + eax*4]
lea edx, [ebx - 4]
lea edx, [edx + eax*4]
cmp ebx, ecx
ja 0x4920dc
cmp edx, esi
jae 0x492152
mov ecx, eax
lea edx, [esi + 0x30]
and ecx, 0xfffffff0
mov eax, esi
sub eax, ebx
mov dword [ebp - 4], ecx
mov dword [ebp + 8], eax
lea ecx, [ebx + 0x10]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
add edi, 0x10
lea ecx, [ecx + 0x40]
lea edx, [edx + 0x40]
movups xmm1, xmmword [edx - 0x70]
pxor xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [esi + ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [edx - 0x50]
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm0, xmmword [ecx - 0x20]
movups xmm1, xmmword [edx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp edi, dword [ebp - 4]
jb 0x492100
mov esi, dword [ebp + 0xc]
cmp edi, eax
jae 0x49221e
sub esi, ebx
lea edx, [ebx + edi*4]
sub eax, edi
mov ecx, dword [esi + edx]
lea edx, [edx + 4]
xor dword [edx - 4], ecx
sub eax, 1
jne 0x492161
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x49221e
cmp eax, 0x40
jb 0x492200
lea ecx, [eax - 1]
xor edi, edi
lea edx, [eax - 1]
add ecx, esi
add edx, ebx
cmp ebx, ecx
ja 0x49219b
cmp edx, esi
jae 0x492200
mov edx, eax
mov ecx, ebx
mov eax, esi
and edx, 0xffffffc0
sub eax, ebx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
nop
movups xmm0, xmmword [ecx]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [ebx + ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [esi + edi + 0x10]
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm0, xmmword [ecx - 0x20]
movups xmm1, xmmword [esi + edi + 0x20]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
movups xmm0, xmmword [ecx - 0x10]
movups xmm1, xmmword [esi + edi + 0x30]
add edi, 0x40
pxor xmm1, xmm0
movups xmmword [ecx - 0x10], xmm1
cmp edi, edx
jb 0x4921b0
mov ebx, dword [ebp + 8]
cmp edi, eax
jae 0x49221e
sub esi, ebx
lea edx, [edi + ebx]
sub eax, edi
nop dword [eax + eax]
mov cl, byte [esi + edx]
lea edx, [edx + 1]
xor byte [edx - 1], cl
sub eax, 1
jne 0x492210
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492bd0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x5428f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x84], eax
movzx ecx, byte [edx + 0x528410]
dec ecx
mov eax, ecx
and ecx, 7
sar eax, 3
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x528488], al
movzx ecx, byte [edx + 0x528411]
setne al
dec ecx
mov byte [ebp + edx - 0x7c], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x528488], al
movzx ecx, byte [edx + 0x528412]
setne al
dec ecx
mov byte [ebp + edx - 0x7b], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x528488], al
movzx ecx, byte [edx + 0x528413]
setne al
dec ecx
mov byte [ebp + edx - 0x7a], al
mov eax, ecx
sar eax, 3
and ecx, 7
movzx eax, byte [eax + esi]
test byte [ecx*4 + 0x528488], al
setne al
mov byte [ebp + edx - 0x79], al
add edx, 4
cmp edx, 0x38
jl 0x492bf3
push ebx
xor ebx, ebx
mov dword [ebp - 0x80], ebx
nop dword [eax]
movzx esi, byte [ebx + 0x528448]
xorps xmm0, xmm0
movq qword [ebp - 0xc], xmm0
xor edx, edx
mov ebx, 0x1c
lea edi, [esi - 0x1c]
nop dword [eax]
cmp edx, ebx
mov ecx, 0x38
mov eax, esi
cmovl ecx, ebx
cmp esi, ecx
cmovge eax, edi
inc esi
inc edi
mov al, byte [ebp + eax - 0x7c]
mov byte [ebp + edx - 0x44], al
inc edx
cmp edx, 0x38
jl 0x492cb0
mov ebx, dword [ebp - 0x80]
xor ecx, ecx
nop word [eax + eax]
movzx eax, byte [ecx + 0x528458]
cmp byte [ebp + eax - 0x45], 0
je 0x492d12
mov eax, 0xaaaaaaab
lea esi, [ebp - 0xc]
mul ecx
mov eax, ecx
shr edx, 2
add esi, edx
lea edx, [edx + edx*2]
add edx, edx
sub eax, edx
mov eax, dword [eax*4 + 0x528488]
sar eax, 2
or byte [esi], al
inc ecx
cmp ecx, 0x30
jl 0x492ce0
movzx ecx, byte [ebp - 0xc]
movzx eax, byte [ebp - 0xa]
mov edi, dword [ebp - 0x84]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 9]
mov dword [edi + ebx*8], ecx
movzx ecx, byte [ebp - 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 5]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*8 + 4], ecx
inc ebx
mov dword [ebp - 0x80], ebx
cmp ebx, 0x10
jl 0x492c90
cmp dword [ebp + 0xc], 1
pop ebx
jne 0x492da5
xor esi, esi
lea edx, [edi + 0x7c]
nop dword [eax]
mov eax, dword [edx - 4]
lea edx, [edx - 8]
mov ecx, dword [edi + esi*4]
mov dword [edi + esi*4], eax
mov dword [edx + 4], ecx
mov ecx, dword [edi + esi*4 + 4]
mov eax, dword [edx + 8]
mov dword [edi + esi*4 + 4], eax
add esi, 2
mov dword [edx + 8], ecx
cmp esi, 0x10
jl 0x492d80
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0049bafa
mov esp, ebp
pop ebp
ret
Function at 0x4933d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x49348a
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x49348a
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x49348a
movzx ecx, byte [edi + 1]
movzx edx, byte [edi]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], edx
test ecx, ecx
je 0x49347a
push esi
lea esi, [edi + 2]
sub eax, ebx
mov dword [ebp - 0xc], esi
mov dword [ebp + 0xc], eax
nop dword [eax]
mov edi, dword [ebp - 0xc]
lea ebx, [ebx + 1]
mov eax, dword [ebp - 4]
dec ecx
mov dword [ebp + 0x14], ecx
mov dl, byte [edi + edx]
movzx esi, dl
add eax, esi
movzx eax, al
mov dword [ebp - 4], eax
mov cl, byte [edi + eax]
mov eax, dword [ebp - 8]
mov byte [edi + eax], cl
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov byte [eax + edi], dl
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
inc eax
movzx edx, al
movzx eax, cl
mov ecx, dword [ebp - 0xc]
add eax, esi
movzx eax, al
mov dword [ebp - 8], edx
mov al, byte [eax + ecx]
xor al, byte [ebx - 1]
mov ecx, dword [ebp + 0x14]
mov byte [edi + ebx - 1], al
test ecx, ecx
jne 0x493420
mov edi, dword [ebp + 8]
pop esi
mov eax, dword [ebp - 4]
mov byte [edi + 1], al
xor eax, eax
mov byte [edi], dl
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff53
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
mov esi, dword [ebp + 0xc]
or ecx, esi
push edi
or ecx, eax
xor edi, edi
test cl, 3
jne 0x494166
shr eax, 2
mov dword [ebp + 0x10], eax
test eax, eax
je 0x49420e
cmp eax, 0x10
jb 0x494142
lea ecx, [esi - 4]
lea ecx, [ecx + eax*4]
lea edx, [ebx - 4]
lea edx, [edx + eax*4]
cmp ebx, ecx
ja 0x4940cc
cmp edx, esi
jae 0x494142
mov ecx, eax
lea edx, [esi + 0x30]
and ecx, 0xfffffff0
mov eax, esi
sub eax, ebx
mov dword [ebp - 4], ecx
mov dword [ebp + 8], eax
lea ecx, [ebx + 0x10]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
add edi, 0x10
lea ecx, [ecx + 0x40]
lea edx, [edx + 0x40]
movups xmm1, xmmword [edx - 0x70]
pxor xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [esi + ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [edx - 0x50]
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm0, xmmword [ecx - 0x20]
movups xmm1, xmmword [edx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp edi, dword [ebp - 4]
jb 0x4940f0
mov esi, dword [ebp + 0xc]
cmp edi, eax
jae 0x49420e
sub esi, ebx
lea edx, [ebx + edi*4]
sub eax, edi
mov ecx, dword [esi + edx]
lea edx, [edx + 4]
xor dword [edx - 4], ecx
sub eax, 1
jne 0x494151
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x49420e
cmp eax, 0x40
jb 0x4941f0
lea ecx, [eax - 1]
xor edi, edi
lea edx, [eax - 1]
add ecx, esi
add edx, ebx
cmp ebx, ecx
ja 0x49418b
cmp edx, esi
jae 0x4941f0
mov edx, eax
mov ecx, ebx
mov eax, esi
and edx, 0xffffffc0
sub eax, ebx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
nop
movups xmm0, xmmword [ecx]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [ebx + ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [esi + edi + 0x10]
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm0, xmmword [ecx - 0x20]
movups xmm1, xmmword [esi + edi + 0x20]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
movups xmm0, xmmword [ecx - 0x10]
movups xmm1, xmmword [esi + edi + 0x30]
add edi, 0x40
pxor xmm1, xmm0
movups xmmword [ecx - 0x10], xmm1
cmp edi, edx
jb 0x4941a0
mov ebx, dword [ebp + 8]
cmp edi, eax
jae 0x49420e
sub esi, ebx
lea edx, [edi + ebx]
sub eax, edi
nop dword [eax + eax]
mov cl, byte [esi + edx]
lea edx, [edx + 1]
xor byte [edx - 1], cl
sub eax, 1
jne 0x494200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49a220
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov edx, esi
push edi
xor edi, edi
lea ecx, [esi + 0x3f]
shr ecx, 6
sub edx, ecx
inc edx
lea ecx, [edx + edx*2]
mov edx, dword [ebp + 0x14]
shr ecx, 2
cmp ecx, dword [edx]
jbe 0x49a250
pop edi
mov eax, 0xffffff53
pop esi
mov esp, ebp
pop ebp
ret
push ebx
cmp esi, 3
jbe 0x49a391
mov edx, dword [ebp + 8]
nop dword [eax]
mov cl, byte [eax + edx]
mov ch, byte [eax + edx + 1]
mov bl, byte [eax + edx + 2]
mov bh, byte [eax + edx + 3]
add eax, 4
mov byte [ebp - 1], ch
mov byte [ebp - 2], bl
test cl, cl
je 0x49a391
cmp cl, 0x2b
jb 0x49a39f
cmp ch, 0x2b
jb 0x49a39f
cmp bl, 0x2b
jb 0x49a39f
cmp bh, 0x2b
jb 0x49a39f
cmp cl, 0x7a
ja 0x49a39f
cmp ch, 0x7a
ja 0x49a39f
cmp bl, 0x7a
ja 0x49a39f
cmp bh, 0x7a
ja 0x49a39f
movzx ecx, cl
mov cl, byte [ecx + 0x528cdd]
mov byte [ebp + 0xf], cl
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + 0x528cdd]
mov byte [ebp - 1], cl
cmp bl, 0x3d
jne 0x49a2ea
xor bl, bl
jmp 0x49a2f3
movzx ecx, bl
mov bl, byte [ecx + 0x528cdd]
cmp bh, 0x3d
jne 0x49a2fc
xor cl, cl
jmp 0x49a305
movzx ecx, bh
mov cl, byte [ecx + 0x528cdd]
mov edx, dword [ebp + 0x10]
mov ch, bl
shl byte [ebp + 0xf], 2
shl ch, 6
or ch, cl
mov cl, byte [ebp - 1]
shr cl, 4
or cl, byte [ebp + 0xf]
mov byte [edi + edx], cl
inc edi
cmp byte [ebp - 2], 0x3d
mov edx, dword [ebp + 8]
je 0x49a33e
mov cl, byte [ebp - 1]
mov edx, dword [ebp + 0x10]
shr bl, 2
shl cl, 4
or bl, cl
mov byte [edi + edx], bl
inc edi
mov edx, dword [ebp + 8]
cmp bh, 0x3d
je 0x49a391
mov ebx, dword [ebp + 0x10]
mov byte [edi + ebx], ch
inc edi
sub esi, 4
je 0x49a388
mov cl, byte [eax + edx]
cmp cl, 0x20
je 0x49a361
cmp cl, 0xd
je 0x49a361
cmp cl, 0xa
jne 0x49a388
inc eax
sub esi, 1
je 0x49a375
cmp cl, 0x20
jne 0x49a375
mov cl, byte [eax + edx]
inc eax
sub esi, 1
jne 0x49a367
cmp cl, 0xd
jne 0x49a383
test esi, esi
je 0x49a39f
mov cl, byte [eax + edx]
inc eax
dec esi
cmp cl, 0xa
jne 0x49a39f
cmp esi, 3
ja 0x49a260
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 0xffffff66
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x500622
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00500227

Function at 0x50062d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005003a8

Function at 0x504e89
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0050466d

Function at 0x504e94
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005048a8

Function at 0x505ba4
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00505998
Function at 0x1002d96a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push edi
push ecx
xor edi, edi
lea ecx, [ebp - 0x30]
push str.CLSID2206CDB0_19C1_11D1_89E0_00C04FD7A829
push SysReAllocString
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call fcn.100271aa
test eax, eax
jne 0x1002da56
push ebx
push 4
pop ebx
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x10004788
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10041b5a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x100047c4
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10041b67
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push 0x10004768
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10041b74
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x20], ebx
push eax
lea eax, [ebp - 0x24]
push eax
push edi
push 0x10004738
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop ebx
test eax, eax
je 0x10041b81
test byte [0x100a4750], 2
jne 0x10041b90
mov byte [0x100a4760], 1
lea ecx, [ebp - 0x30]
call fcn.100271eb
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [0x100a47c8], eax
jmp 0x1002d9c6
mov eax, dword [ebp - 4]
mov dword [0x100a2d78], eax
jmp 0x1002d9ef
mov eax, dword [ebp - 4]
mov dword [0x100a30c0], eax
jmp 0x1002da18
cmp dword [ebp - 4], edi
setne byte [0x100a30bc]
jmp 0x1002da42
cmp dword [0x100aa47c], edi
je 0x1002da4f
movzx eax, byte [0x100a30bc]
push eax
push dword [0x100a30c0]
push dword [0x100a2d78]
push dword [0x100a47c8]
push dword [0x100aa47c]
push 0x33c00
push dword [0x100aa12c]
call fcn.10056748
add esp, 0x1c
jmp 0x1002da4f
Function at 0x1007e662
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
push eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x208
push eax
xor edi, edi
push edi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007e712
xor ecx, ecx
cmp dword [ebp - 8], 2
mov word [esi + 0x206], cx
jne 0x1007e707
mov ecx, esi
mov dword [ebp - 8], 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1007e6b4
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + 1]
lea eax, [ebx + ebx]
call fcn.10038910
mov edi, esp
test edi, edi
jne 0x1007e6d9
push 8
pop eax
jmp 0x1007e712
push esi
mov edx, ebx
mov ecx, edi
call fcn.1002706a
mov ebx, 0x104
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
jle 0x1007e6f8
push 0x6f
pop eax
test eax, eax
jne 0x1007e707
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1007e707
inc eax
cmp dword [ebp - 8], 1
je 0x1007e712
mov eax, 0x65d
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037870
mov esp, ebp
pop ebp
ret