joyce8/EMBER2024-capa huggingface dataset:
Function at 0x656810e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ecx, 5
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x258]
mov esi, str._a_Oa
push ebx
xor ebx, ebx
sub esp, 0x25c
rep movsd dword es:[edi], dword [esi]
mov esi, 7
mov eax, dword [0x656a9084]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0x7a7bf209
or eax, 0xaf4b5c21
mov dword [0x656a9084], eax
call edi
sub esi, dword [ebp + ebx*4 - 0x258]
inc ebx
imul eax, dword [0x656a9084], 0xea6d4fa
mov dword [0x656a9084], eax
cmp ebx, 5
jne 0x6568110d
and eax, 0x4dd82cac
xor ebx, ebx
sub eax, 0x4d804d4a
mov dword [0x656a9084], eax
mov dword [esp + 4], eax
mov dword [esp], str.Maximum_Segment_Descriptors_Exceeded
call fcn.656920d0
mov dword [esp + 4], ebx
mov dword [esp], 2
mov eax, dword [0x65695064]
call dword [eax + 0x34]
add esi, eax
push edx
mov ebx, eax
push edx
jne 0x656811e8
mov edx, 0x656a9580
mov ecx, 0x120
movzx eax, byte [edx]
inc edx
test al, al
je 0x656811cd
add ecx, eax
cmp ecx, 0x939
jbe 0x6568118b
call fcn.6568f90c
imul eax, dword [0x656a9084], 0xa5f7f6e1
mov dword [0x656a9084], eax
mov dword [esp + 0xc], str.Maximum_Segment_Descriptors_Exceeded
mov dword [esp + 8], eax
mov dword [esp + 4], str.The_maximum_named_pipe_instance_count_has_been_reached.
mov dword [esp], eax
call fcn.656939c0
mov eax, dword [0x656a9084]
or eax, 0xab3049c5
sub eax, 0x36c9deef
mov dword [0x656a9084], eax
xor eax, eax
jmp 0x6568132c
mov dword [ebp - 0x244], 0x22c
lea esi, [ebp - 0x244]
mov dword [esp + 4], esi
mov dword [esp], eax
mov eax, dword [0x65695064]
call dword [eax + 0x38]
push ecx
push ecx
test eax, eax
jne 0x656812ac
mov eax, dword [0x656a9084]
mov dword [esp + 0xc], str.Maximum_Segment_Descriptors_Exceeded
mov dword [esp + 4], str.Maximum_Segment_Descriptors_Exceeded
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.656939c0
mov eax, dword [0x656a9084]
lea esi, [eax - 0x7f0d7e4e]
call fcn.65693958
and esi, 0xf67f3736
add esi, 0x7eb61c9b
mov dword [0x656a9084], esi
mov dword [esp + 4], str.Floating_point_overflow.
mov dword [esp], str.Floating_point_overflow.
call fcn.65691940
mov eax, dword [0x656a9084]
and eax, 0x6823736e
imul eax, eax, 0xf71c810f
or eax, 0xaaf153fb
mov dword [0x656a9084], eax
call dword [sym.imp.USER32.dll_AnyPopup]
add eax, 0x7f613dfd
mov dword [0x656a9084], eax
jmp 0x6568131f
mov dword [esp + 4], esi
mov dword [esp], ebx
mov eax, dword [0x65695064]
call dword [eax + 0x3c]
push edx
push edx
test eax, eax
je 0x6568131f
mov eax, dword [0x656a9084]
add eax, 0x7799d82e
and eax, 0xc4880573
imul eax, eax, 0x4fa7f78f
and eax, 0x908726fe
sub eax, 0x2777b149
xor eax, 0xdd488a64
mov dword [0x656a9084], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.6568ed04
test eax, eax
jne 0x65681297
call edi
mov eax, dword [0x656a9084]
or eax, 0x5af1ac9e
imul eax, eax, 0xd94ab07c
or eax, 0x5af1ac9e
imul eax, eax, 0xd94ab07c
mov dword [0x656a9084], eax
mov dword [esp], ebx
call fcn.65681065
mov eax, 1
jmp 0x6568132c
mov dword [esp], ebx
call fcn.65681065
jmp 0x656811e1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x65686258
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x656a8df0]
mov dword [esp], str.Disconnecting_the_console_session_is_not_supported.
add eax, 0x2f8464ed
imul eax, eax, 0xa0cdae77
mov dword [0x656a8df0], eax
call fcn.65693f48
add dword [0x656a8df0], 0x76364173
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 1
leave
sete al
movzx eax, al
ret

Function at 0x6568667c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x28]
mov esi, 0x65695024
push ebx
sub esp, 0x4c
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 3
xor eax, eax
cmp byte [eax + 0x656a9144], 0
je 0x656866bf
inc eax
cmp eax, 0x1b56
jne 0x6568669d
mov eax, dword [0x656a8dac]
and eax, 0x8aface94
mov dword [0x656a8f68], eax
jmp 0x656866c6
cmp eax, 0x2d3
jle 0x656866cb
call fcn.65692374
imul eax, dword [0x656a8dac], 0x2a592a0
mov ebx, dword [ebp + esi*4 - 0x28]
inc esi
add ebx, edi
mov dword [0x656a8f68], eax
or eax, 0x2d368212
mov edi, ebx
mov dword [0x656a8dac], eax
cmp esi, 4
jne 0x6568669b
cmp byte [0x656a9144], 0
je 0x65686724
mov dword [esp + 4], str.KeepActivationContextsAlive
mov dword [esp], str.The_specified_interrupt_vector_was_already_connected.
call fcn.65691940
mov eax, dword [0x656a8f68]
and eax, 0xac168e0c
mov dword [0x656a8dac], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov eax, dword [0x656a8ca4]
mov edx, eax
and eax, 0x140424c8
and edx, 0x54a764ee
mov dword [0x656a8f68], eax
mov dword [0x656a8dac], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esp + 4], str.The_requested_print_file_has_been_canceled.
mov dword [esp], str.AslFileMappingGetImageTypeEx_failed___x_
call fcn.65691940
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x38]
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov dword [esp + 4], 7
mov dword [esp], 0xffffffff
call fcn.65681083
mov ebx, eax
test eax, eax
jne 0x65686817
mov dword [ebp - 0x34], 0x1b
xor esi, esi
mov edi, 0x36
mov dword [ebp - 0x30], 0x3a
mov dword [ebp - 0x2c], 0xffffff75
xor eax, eax
cmp byte [eax + str.The_specified_pack_already_has_a_quorum_of_healthy_disks.], 0
je 0x656867ca
inc eax
cmp eax, 0xffb
jne 0x656867af
sub dword [0x656a8ca4], 0x460eb65e
mov eax, dword [0x656a8ca4]
mov dword [esp + 4], str.The_remote_user_session_has_been_deleted.
mov dword [esp], str.ThreadPool:_attempt_to_terminate_a_worker_thread_via_handle__p
add eax, 0x485b805a
mov dword [0x656a8ca4], eax
and eax, 0x8a1f20f
mov dword [0x656a8f68], eax
call fcn.65691940
add edi, dword [ebp + esi*4 - 0x34]
inc esi
cmp esi, 3
jne 0x656867ad
cmp edi, dword [ebp - 0x38]
je 0x65686819
sub dword [0x656a8dac], 0x1e0cdcca
mov ebx, 1
jmp 0x65686819
xor ebx, ebx
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6568ddf8
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x200
mov ebx, dword [ebp + 0x10]
mov eax, ecx
mov byte [ebp + ecx - 0x10c], cl
cdq
idiv dword [ebp + 0x14]
mov al, byte [ebx + edx]
mov byte [ebp + ecx - 0x20c], al
inc ecx
cmp ecx, 0x100
jne 0x6568de09
xor ebx, ebx
xor edx, edx
mov esi, 0x100
movzx eax, byte [ebp + ebx - 0x10c]
mov ecx, eax
add eax, edx
movzx edx, byte [ebp + ebx - 0x20c]
add eax, edx
cdq
idiv esi
mov al, byte [ebp + edx - 0x10c]
mov byte [ebp + edx - 0x10c], cl
mov byte [ebp + ebx - 0x10c], al
inc ebx
cmp ebx, 0x100
jne 0x6568de32
xor esi, esi
xor ebx, ebx
xor ecx, ecx
mov edi, 0x100
cmp esi, dword [ebp + 0xc]
jge 0x6568decc
lea eax, [ebx + 1]
cdq
idiv edi
movzx eax, byte [ebp + edx - 0x10c]
mov ebx, edx
add eax, ecx
cdq
idiv edi
mov al, byte [ebp + edx - 0x10c]
mov ecx, edx
mov dl, byte [ebp + ebx - 0x10c]
mov byte [ebp + ecx - 0x10c], dl
mov edx, dword [ebp + 8]
mov byte [ebp + ebx - 0x10c], al
add al, byte [ebp + ecx - 0x10c]
movzx eax, al
mov al, byte [ebp + eax - 0x10c]
xor al, byte [edx + esi]
mov edx, dword [ebp + 0x18]
mov byte [edx + esi], al
inc esi
jmp 0x6568de74
add esp, 0x200
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6568eec0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str.Mongolian_Baiti
mov ecx, 0x415
mov ebp, esp
sub esp, 0x18
movsx eax, byte [edx]
inc edx
test al, al
je 0x6568eee2
add ecx, eax
cmp ecx, 0x1815
jbe 0x6568eed0
mov eax, str.The_display_adapter_is_not_linked_to_any_other_adapters.
mov cl, byte [eax]
lea edx, [ecx - 0x30]
cmp dl, 9
ja 0x6568eef4
inc eax
jmp 0x6568eee7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, str.Breakpoint
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x6568ef0b
inc edx
jmp 0x6568eeff
mov eax, dword [ebp + 8]
or eax, 0x4208b51f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
leave
ret
Function at 0x6568fc0c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov ecx, 0x1bf8
imul eax, eax, 0xeb052611
mov edx, ebx
mov dword [0x656a8ff0], eax
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x6568fc54
add ecx, eax
cmp ecx, 0x205f
jbe 0x6568fc30
mov eax, dword [0x656a8ce4]
and eax, 0xe6b60a5f
mov dword [0x656a8ff0], eax
imul ecx, dword [0x656a8c90], 0xcdda6bd2
mov eax, dword [0x656a8ce4]
mov esi, ebx
lea edx, [eax + 0x1fee253d]
mov dword [0x656a8cec], edx
mov dword [0x656a8c90], ecx
mov dx, word [esi]
test dx, dx
je 0x6568fc9b
sub edx, 0x30
cmp dx, 9
jbe 0x6568fc96
or ecx, 0x4132c748
mov dword [0x656a8c90], ecx
jmp 0x6568fc9b
add esi, 2
jmp 0x6568fc77
sub eax, 0x7162aa97
mov dword [0x656a8ce4], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov eax, dword [0x656a8c90]
and eax, 0x550a5a5d
mov dword [0x656a8ce4], eax
xor eax, eax
cmp word [ebx + eax*2], 0
je 0x6568fcda
inc eax
cmp eax, 0xe2d
jne 0x6568fcbc
imul eax, dword [0x656a8ff0], 0xee1ab53
mov dword [0x656a8ce4], eax
mov eax, dword [0x656a8ce4]
mov edx, dword [0x656a8cec]
and eax, 0x78586692
lea ecx, [eax - 0x6f0f4b44]
mov dword [0x656a8ff0], ecx
xor ecx, ecx
cmp word [ebx + ecx*2], 0
je 0x6568fd12
inc ecx
cmp ecx, 0xc8c
jne 0x6568fcf8
sub eax, 0x500ea938
mov dword [0x656a8ff0], eax
mov eax, edx
mov ecx, ebx
mov esi, 0x133d
or eax, 0xd1f1e53d
mov dword [0x656a8c90], eax
movzx eax, word [ecx]
add ecx, 2
test ax, ax
je 0x6568fd49
add esi, eax
cmp esi, 0x1ee0
jbe 0x6568fd25
mov eax, dword [0x656a8ff0]
or eax, 0x7b38d883
mov dword [0x656a8c90], eax
add edx, 0x5a568120
mov esi, ebx
mov dword [0x656a8ce4], edx
mov dword [esp], 0x1201
call dword [sym.imp.USER32.dll_IsIconic]
push eax
mov eax, dword [0x656a8cec]
mov edx, dword [0x656a8ff0]
and eax, 0x185a3064
mov di, word [esi]
lea ecx, [edi - 0x30]
cmp cx, 9
ja 0x6568fd86
add esi, 2
jmp 0x6568fd75
or eax, 0xab31352
or edx, 0x9042a7fd
mov esi, ebx
mov edi, 0x7db
movzx ecx, word [esi]
add esi, 2
test cx, cx
je 0x6568fdad
add edi, ecx
cmp edi, 0x17f1
jbe 0x6568fd98
sub eax, 0x3127eff1
mov edi, 0x72
xor eax, 0xe9296992
mov dword [0x656a8c90], eax
lea eax, [edx - 0x39285d5a]
mov dword [0x656a8ce4], eax
imul esi, eax, 0x19d107a8
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
je 0x6568fdf2
add edi, ecx
cmp edi, 0x76b
jbe 0x6568fdd2
imul eax, eax, 0xb6d3b420
mov dword [0x656a8ce4], eax
mov eax, dword [0x656a8ce4]
sub esi, 0x1f5b13f9
sub edx, 0x438f9441
mov dword [0x656a8cec], esi
add eax, 0x760b7236
mov dword [0x656a8ff0], edx
mov dword [0x656a8ce4], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x65690654
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov edx, 0x656af1c0
mov ecx, 0x715
movsx eax, byte [edx]
inc edx
test al, al
je 0x6569067d
add ecx, eax
cmp ecx, 0x22fb
jbe 0x6569066b
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call ebx
mov eax, dword [ebp + 8]
pop edx
pop ebx
pop ebp
add eax, 0x19b4d688
ret
Function at 0x65690b18
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov edx, str.This_object_is_not_allowed_to_be_opened_in_a_transaction.
mov ecx, 0xe45
or dword [0x656a8c78], 0xe6afb73d
and eax, 0xdfa3
mov dword [0x656a8d30], eax
movsx eax, byte [edx]
inc edx
test al, al
je 0x65690b66
add ecx, eax
cmp ecx, 0x14fb
jbe 0x65690b45
mov eax, dword [0x656a8fdc]
and eax, 0xf75fe475
mov dword [0x656a8d30], eax
mov eax, dword [0x656a8d30]
mov bl, byte [str.Monitor_descriptor_could_not_be_obtained.]
xor edx, edx
cmp word [edx + str.windows_vista], 0
je 0x65690b9a
add edx, 2
cmp edx, 0x4710
jne 0x65690b73
lea edx, [eax - 0x756e5442]
imul edx, edx, 0x5f48f5f6
mov dword [0x656a8c78], edx
lea ecx, [eax - 0x15a161c9]
mov esi, str.Monitor_descriptor_could_not_be_obtained.
mov dl, byte [esi]
test dl, dl
je 0x65690bc4
sub edx, 0x30
cmp dl, 9
jbe 0x65690bc1
lea edx, [eax - 0x64bd9e6d]
mov dword [0x656a8c78], edx
jmp 0x65690bc4
inc esi
jmp 0x65690ba5
xor edx, edx
cmp byte [edx + str.The_process_cannot_switch_to_the_startup_current_directory__hs.], 0
je 0x65690be4
inc edx
cmp edx, 0x3c7
jne 0x65690bc6
imul edx, eax, 0x4298c03f
mov dword [0x656a8c78], edx
mov esi, str.windows_vista
mov edi, 0x2096
movzx edx, word [esi]
add esi, 2
test dx, dx
je 0x65690c03
add edi, edx
cmp edi, 0x2698
jbe 0x65690bee
mov edx, eax
imul eax, eax, 0x389954ff
or edx, 0xf924187b
mov dword [0x656a8fdc], edx
test bl, bl
je 0x65690c27
add edx, 0xbaf3b2c
mov dword [0x656a8d30], edx
xor ecx, 0x7ff70018
sub eax, 0x1ff5a0b7
mov dword [0x656a8c04], ecx
mov dword [0x656a8f80], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
imul eax, eax, 0xd334a44c
mov dword [0x656a8c04], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x656a8f80]
mov edx, str.save_initclip
mov ecx, 0xaa1
and eax, 0xaec3e5db
mov dword [0x656a8c78], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x65690c7f
add ecx, eax
cmp ecx, 0x169b
jbe 0x65690c6d
imul eax, dword [0x656a8c04], 0xf4b8043d
mov dword [0x656a8d30], eax
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x65690e1c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x65690e32
call dword [sym.imp.USER32.dll_AnyPopup]
mov edx, ebx
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x65690e40
inc edx
jmp 0x65690e34
mov edx, ebx
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x65690e4e
inc edx
jmp 0x65690e42
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov al, byte [ebx]
sub eax, 0x30
cmp al, 9
ja 0x65690e60
inc ebx
jmp 0x65690e54
imul eax, dword [ebp + 0x10], 0x2327ccec
pop edx
pop ebx
pop ebp
ret
Function at 0x656917e8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str.The_provided_event_log_buffer_was_already_marked_as_freed.
mov ebp, esp
push ebx
push ecx
mov ecx, 0x7c4
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x6569180c
add ecx, eax
cmp ecx, 0x246c
jbe 0x656917f7
mov edx, dword [0x656a9070]
mov ecx, str.BinaryHash
mov ebx, 0x1fa
imul eax, edx, 0xa7ddaeb0
mov dword [0x656a8c70], eax
movzx eax, byte [ecx]
inc ecx
test al, al
je 0x6569184b
add ebx, eax
cmp ebx, 0x1c71
jbe 0x65691827
add edx, 0x6e3f1ec0
mov dword [0x656a8f8c], edx
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
mov eax, dword [0x656a9070]
sub eax, 0x1d71b1a9
mov dword [0x656a8c70], eax
mov edx, eax
or eax, 0xe7692517
xor edx, 0xec477fe5
xor eax, 0xff658c18
mov dword [0x656a8f8c], edx
mov dword [0x656a9070], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, str.The_entry_is_invalid.
mov ecx, 0xf36
movzx eax, byte [edx]
inc edx
test al, al
je 0x656918a3
add ecx, eax
cmp ecx, 0x75a
jbe 0x65691887
sub dword [0x656a8c70], 0x5d0fab56
mov edx, dword [0x656a9070]
sub dword [0x656a8c70], 0x2c486df0
mov eax, edx
xor eax, 0xfa0bcaf2
mov dword [0x656a8f8c], eax
xor eax, eax
cmp word [eax + str.The_device_has_indicated_that_cleaning_is_necessary.], 0
je 0x656918f1
add eax, 2
cmp eax, 0x431a
jne 0x656918c1
xor edx, 0xf264aa99
mov dword [0x656a8c70], edx
call dword [sym.imp.USER32.dll_GetMessageTime]
or eax, 0x75067442
mov dword [0x656a8c70], eax
mov eax, dword [0x656a8c70]
or dword [0x656a8f8c], 0xd46b004a
xor eax, 0xf442fc60
mov dword [0x656a9070], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x656a8c70]
lea edx, [eax + 0x36b6c543]
lea ecx, [eax - 0x50f08051]
and eax, 0xd8994c63
mov dword [0x656a8c70], eax
mov eax, edx
mov dword [0x656a9070], edx
mov dword [0x656a8f8c], ecx
pop edx
pop ebx
pop ebp
ret
Function at 0x656920d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edx
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
je 0x656920e3
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, ebx
mov al, byte [edx]
test al, al
je 0x656920fd
sub eax, 0x30
cmp al, 9
jbe 0x656920fa
call dword [sym.imp.USER32.dll_AnyPopup]
jmp 0x656920fd
inc edx
jmp 0x656920e5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, ebx
mov ecx, 0x11c3
movzx eax, byte [edx]
inc edx
test al, al
je 0x6569211c
add ecx, eax
cmp ecx, 0x1b9e
jbe 0x6569210a
mov al, byte [ebx]
sub eax, 0x30
cmp al, 9
ja 0x65692128
inc ebx
jmp 0x6569211c
call dword [sym.imp.USER32.dll_AnyPopup]
pop eax
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]

Function at 0x65692b4c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str.111019184142Z
mov ecx, 0x2258
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
movsx eax, byte [edx]
inc edx
test al, al
je 0x65692b81
add ecx, eax
cmp ecx, 0x256c
jbe 0x65692b5f
or dword [0x656a8d88], 0xe25592e5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x656a8f90]
mov ecx, str.The_user_data_passed_for_the_reparse_point_is_invalid.
mov ebx, 0x399
or eax, 0x7f9966be
lea edx, [eax + 0x51ea570b]
mov dword [0x656a8d7c], eax
imul edx, edx, 0x658b3659
mov dword [0x656a8d88], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x65692bcc
add ebx, edx
cmp ebx, 0xa8e
jbe 0x65692bac
imul eax, eax, 0x9f3b77f9
mov dword [0x656a8f04], eax
imul eax, dword [0x656a8f04], 0xdc82b440
mov ebx, 0xd87
mov dword [0x656a8f90], eax
sub eax, 0x26176bfc
mov dword [0x656a8edc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x656a8edc]
mov ecx, 0x656aa200
mov esi, dword [0x656a8f90]
mov edx, eax
or eax, 0x7be66101
and edx, 0xe00f1e44
lea edi, [eax + 0x6582a8cf]
mov dword [0x656a8f04], edx
mov edx, esi
and edx, 0xc8382f9c
mov dword [0x656a8edc], edx
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x65692c44
add ebx, edx
cmp ebx, 0xdaa
jbe 0x65692c27
imul eax, eax, 0x87524650
mov dword [0x656a8edc], eax
imul edx, edi, 0xbce6e7e9
mov eax, esi
xor eax, 0x72df54ae
mov dword [0x656a8d7c], eax
mov dword [0x656a8d88], edx
call dword [sym.imp.USER32.dll_AnyPopup]
mov eax, dword [0x656a8d7c]
or dword [0x656a8f90], 0x799dbd1c
mov edx, eax
xor eax, 0x9b3bfab8
or edx, 0xc8449ae3
and eax, 0x4a8cbf09
mov dword [0x656a8edc], eax
mov eax, edx
xor eax, 0x837c744a
mov dword [0x656a8f04], edx
mov dword [0x656a8d88], eax
add esp, 0xc
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x65692ca4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x656a9044]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [0x656a8f28]
sub eax, 0x629c19eb
and eax, 0xbb4f87d3
mov dword [0x656a8f28], eax
imul eax, dword [0x656a9044], 0x25012bcf
mov edx, eax
and eax, 0x81000c
and edx, 0xd3964d
mov dword [0x656a9044], eax
mov dword [0x656a8e8c], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x656a8e8c]
mov ecx, str.Xbox_One_S
mov edx, eax
or eax, 0xebe9b5e9
or edx, 0xe981a0e9
mov dword [0x656a8e8c], edx
mov dl, byte [ecx]
test dl, dl
je 0x65692d31
sub edx, 0x30
cmp dl, 9
jbe 0x65692d2e
imul edx, eax, 0xb0bfcded
mov dword [0x656a8e8c], edx
jmp 0x65692d31
inc ecx
jmp 0x65692d12
add eax, 0x15255e7b
cmp byte [str.Xbox_One_S], 0
mov dword [0x656a8f28], eax
je 0x65692d4e
sub dword [0x656a8e8c], 0x36852506
or eax, 0x8c856869
mov dword [0x656a9044], eax
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov eax, dword [0x656a8f28]
leave
ret

Function at 0x65693460
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [0x656a8ed4]
mov ebx, dword [ebp + 8]
lea edx, [eax + 0x46ea5dd4]
mov ecx, ebx
mov dword [0x656a8ee8], edx
lea edx, [eax - 0x5b295d1e]
mov dword [0x656a8de4], edx
mov dx, word [ecx]
test dx, dx
je 0x656934b2
sub edx, 0x30
cmp dx, 9
jbe 0x656934ad
add eax, 0x6928618a
mov dword [0x656a8ed4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jmp 0x656934b2
add ecx, 2
jmp 0x6569348a
mov eax, dword [0x656a8ed4]
mov ecx, ebx
mov esi, 0x76d
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x656934d3
add esi, edx
cmp esi, 0x15d4
jbe 0x656934be
and eax, 0x44614a18
mov ecx, ebx
mov esi, 0x730
or eax, 0x40604810
sub eax, 0x23c5feaf
or eax, 0xe87aed78
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x65693503
add esi, edx
cmp esi, 0xd5a
jbe 0x656934ee
xor eax, 0xc5d1f6af
lea edx, [eax + 0x777fbae9]
and eax, 0x8ec66ec
mov dword [0x656a8de4], edx
mov dword [0x656a8ed4], eax
mov ax, word [ebx]
test ax, ax
je 0x65693540
sub eax, 0x30
cmp ax, 9
jbe 0x6569353b
mov dword [0x656a8ed4], 0x8aaf4bf4
jmp 0x65693540
add ebx, 2
jmp 0x6569351e
imul eax, dword [0x656a8ed4], 0x38775fbe
mov dword [0x656a8ee8], eax
mov dword [esp], 0x25
call dword [sym.imp.USER32.dll_IsIconic]
imul eax, eax, 0x7bfa77fe
push edx
mov dword [0x656a8ed4], eax
mov eax, dword [0x656a8de4]
mov edx, eax
or eax, 0xd2d4c270
and edx, 0xc196e258
mov dword [0x656a8de4], eax
mov dword [0x656a8ee8], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x656a8ee8]
or eax, 0x79222fbf
mov dword [0x656a8de4], eax
mov eax, dword [0x656a8ed4]
sub eax, 0x5a303f47
mov dword [0x656a8ee8], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x404537
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x42733c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
inc ebx
cmp edi, 0xffffffff
je 0x40461a
test esi, esi
je 0x40461a
cmp dword [esi + 8], 0
jne 0x404573
push esi
call fcn.00404d1f
push 0x26c
lea eax, [ebp - 0x270]
push eax
push esi
call fcn.00405a47
lea ecx, [ebp - 0x270]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40458e
push 0
lea eax, [ebp - 0x274]
push eax
sub ecx, edx
push ecx
lea eax, [ebp - 0x270]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x68]
call fcn.00413530
jmp 0x404612
lea eax, [ebp - 0x274]
push eax
push ebx
push esi
push edi
call fcn.00405904
push 0x4013c8
lea eax, [ebp - 0x270]
push 0x26c
push eax
call fcn.0041a2bf
lea ecx, [ebp - 0x270]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4045ea
push 0
lea eax, [ebp - 0x274]
push eax
sub ecx, edx
push ecx
lea eax, [ebp - 0x270]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
inc ebx
call fcn.0041357f
mov esi, eax
test esi, esi
jne 0x4045b9
jmp 0x40461d
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419fba
leave
ret 8
Function at 0x405904
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x42733c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
push 0x104
lea ecx, [ebp - 0x310]
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 0x318], eax
push eax
call fcn.0040582e
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405947
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push edi
sub ecx, edx
push ecx
lea eax, [ebp - 0x310]
push eax
push esi
call ebx
push 0x401330
push 0x401338
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.0041a2bf
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40598b
push 0
push edi
sub ecx, edx
push ecx
lea eax, [ebp - 0x20c]
push eax
push esi
call ebx
push dword [ebp - 0x318]
call fcn.0040ce0f
mov edx, eax
lea ecx, [edx + 1]
mov dword [ebp - 0x314], ecx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4059b8
sub edx, dword [ebp - 0x314]
push 0
push edi
push edx
push eax
push esi
call ebx
push 0x401330
push 0x401350
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.0041a2bf
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4059f4
push 0
push edi
sub ecx, edx
push ecx
lea eax, [ebp - 0x20c]
push eax
push esi
call ebx
push dword [ebp - 0x318]
call fcn.0040cd82
mov edx, eax
lea ecx, [edx + 1]
mov dword [ebp - 0x314], ecx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x405a21
sub edx, dword [ebp - 0x314]
push 0
push edi
push edx
push eax
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419fba
leave
ret 0x10