joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6163c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c]
mov ebp, ecx
mov ebx, dword [edi + 4]
lea esi, [edi + 4]
mov eax, dword [edi]
add esi, 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], ebx
mov ecx, dword [esi]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp]
test ecx, ecx
je 0x6163f7
mov edx, dword [ecx]
push 1
call dword [edx]
push 0x24
call fcn.0076d5a7
add esp, 4
test eax, eax
je 0x616416
mov ecx, dword [esp + 0x3c]
push 1
push ebx
push ecx
mov ecx, eax
call fcn.004aa060
jmp 0x616418
xor eax, eax
mov dword [ebp], eax
mov edx, dword [eax]
push 0
mov ecx, eax
call dword [edx + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], 0
test ebx, ebx
lea ecx, [edi + eax*2 + 0xc]
mov dword [esp + 0x14], ecx
jle 0x616501
mov eax, dword [esp + 0x3c]
xor edi, edi
test eax, eax
jle 0x6164f0
mov ecx, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x20], edi
mov dl, byte [ecx]
inc ecx
mov dword [esp + 0x14], ecx
mov cl, byte [0x83b2cc]
mov ax, word [esi + edx*2 + 4]
and eax, 0xffff
mov esi, eax
mov edx, eax
shr esi, 4
and esi, 0xf0
and edx, 0xf0
shr esi, cl
mov ecx, dword [0x83b2c8]
and eax, 0xf
shl eax, 4
shl esi, cl
mov cl, byte [0x83b2dc]
shr edx, cl
mov ecx, dword [0x83b2d8]
shl edx, cl
mov ecx, dword [0x83b2d4]
sar eax, cl
mov ecx, dword [0x83b2d0]
or esi, edx
lea edx, [esp + 0x28]
push edx
shl eax, cl
mov ecx, dword [ebp]
or esi, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov ebx, dword [ecx]
call dword [ebx + 0x78]
mov ecx, dword [ebp]
push eax
lea eax, [esp + 0x24]
push esi
push eax
call dword [ebx + 0x88]
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x18]
inc edi
cmp edi, eax
jl 0x61644e
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, ebx
mov dword [esp + 0x10], eax
jl 0x616440
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x62fbe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
xor eax, eax
push ebx
mov dword [esp + 0xc], ecx
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0x67
push ebp
add ecx, 0xc
push esi
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0xfa
jmp 0x62fc0c
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
mov esi, eax
inc eax
xor ebx, ebx
mov dword [esp + 0x20], eax
mov edx, dword [ebx + 0x7d8234]
mov eax, esi
xor edx, esi
add ebx, 4
mov esi, edx
sar edx, 0x10
and esi, 0xffff
mov edi, edx
imul edx, edi
imul edi, esi
mov ecx, esi
imul ecx, esi
not edx
add edx, ecx
mov ecx, edx
sar ecx, 0x10
shl edx, 0x10
or ecx, edx
mov edx, dword [ebx + 0x7d8280]
xor ecx, edx
add ecx, edi
xor ecx, ebp
cmp ebx, 0x10
mov esi, ecx
mov ebp, eax
jl 0x62fc19
mov eax, dword [esp + 0x10]
mov dword [eax], esi
add eax, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x62fc08
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov byte [eax], 0
pop ebx
add esp, 0x14
ret 4

Function at 0x62fdc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
lea edx, [eax + 1]
push edi
mov edi, dword [ecx]
mov dword [ecx + 4], edx
xor esi, esi
mov ecx, dword [esi + 0x7d8234]
mov ebx, eax
xor ecx, eax
add esi, 4
mov edx, ecx
sar ecx, 0x10
and edx, 0xffff
mov eax, ecx
imul eax, ecx
imul ecx, edx
mov ebp, edx
imul ebp, edx
not eax
add eax, ebp
mov ebp, eax
sar ebp, 0x10
shl eax, 0x10
or ebp, eax
mov eax, dword [esi + 0x7d8280]
xor ebp, eax
add ebp, ecx
xor ebp, edi
cmp esi, 0x10
mov eax, ebp
mov edi, ebx
jl 0x62fdd1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x6301e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov eax, dword [esi]
call dword [eax + 0x18]
test al, al
jne 0x630217
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 0x1c]
test eax, eax
jne 0x63020f
pop esi
pop ebx
add esp, 8
ret 8
mov dword [esp + 0xc], 1
mov eax, dword [esi + 0xc]
push edi
cmp eax, 0xffffffff
je 0x63023b
mov eax, dword [esi]
push 1
push ebx
mov ecx, esi
call dword [eax + 0x28]
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x1c]
sub ecx, eax
cmp edi, ecx
jl 0x63023f
mov edi, ecx
jmp 0x63023f
mov edi, dword [esp + 0x1c]
cmp edi, ebx
jle 0x6302a7
push ebp
mov ebp, dword [esp + 0x1c]
mov edx, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push 0
push ecx
push edi
push ebp
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x630298
add ebp, eax
sub edi, eax
add ebx, eax
mov al, byte [0xa9e164]
test al, al
mov dword [esp + 0x20], ebx
jne 0x6302a6
mov eax, dword [esi + 0x14]
mov ebx, dword [esi]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [ebx + 0x40]
mov ebx, dword [esp + 0x20]
jmp 0x6302a2
add ebp, eax
sub edi, eax
add ebx, eax
test eax, eax
je 0x6302a6
test edi, edi
jg 0x630248
pop ebp
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
test eax, eax
mov byte [0xa9e164], 0
pop edi
je 0x6302c2
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x34]
mov eax, dword [esp + 8]
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x6302d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esi]
call dword [eax + 0x18]
test al, al
jne 0x63030b
mov edx, dword [esi]
push 2
mov ecx, esi
call dword [edx + 0x1c]
test eax, eax
jne 0x630303
pop esi
add esp, 8
ret 8
mov dword [esp + 4], 1
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push edi
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [esi + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x630342
mov ecx, dword [esi + 0x14]
mov edi, dword [esi]
push ecx
push 0
call ebx
push eax
mov ecx, esi
call dword [edi + 0x40]
cmp dword [esi + 0xc], 0xffffffff
je 0x6303e4
mov edx, dword [esi]
push ebp
mov ecx, esi
call dword [edx + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
test al, al
jne 0x63036f
mov ecx, dword [esi + 0x14]
mov eax, dword [esi]
push ecx
push 0
push 9
mov ecx, esi
call dword [eax + 0x40]
jmp 0x630390
mov edx, dword [esi + 0x10]
push 1
push 0
push 0
push edx
call edi
cmp eax, 0xffffffff
jne 0x630392
mov eax, dword [esi + 0x14]
mov ebp, dword [esi]
push eax
push 0
call ebx
push eax
mov ecx, esi
call dword [ebp + 0x40]
xor eax, eax
mov ecx, dword [esi + 8]
mov ebp, dword [esi + 0xc]
add ecx, ebp
pop ebp
cmp eax, ecx
jle 0x6303e4
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
test al, al
jne 0x6303bb
mov ecx, dword [esi + 0x14]
mov eax, dword [esi]
push ecx
push 0
push 9
mov ecx, esi
call dword [eax + 0x40]
jmp 0x6303dc
mov edx, dword [esi + 0x10]
push 1
push 0
push 0
push edx
call edi
cmp eax, 0xffffffff
jne 0x6303de
mov eax, dword [esi + 0x14]
mov edi, dword [esi]
push eax
push 0
call ebx
push eax
mov ecx, esi
call dword [edi + 0x40]
xor eax, eax
sub eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0xc]
pop edi
test eax, eax
pop ebx
je 0x6303f5
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x34]
mov eax, dword [esp + 8]
pop esi
add esp, 8
ret 8

Function at 0x6305d0
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0xc]
cmp eax, 0xffffffff
jne 0x630643
mov eax, dword [esi]
call dword [eax + 0x18]
test al, al
je 0x63061c
mov ecx, dword [esi + 0x10]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x630639
mov edx, dword [esi + 0x14]
push ebx
mov ebx, dword [esi]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [ebx + 0x40]
mov ecx, dword [esi + 8]
mov eax, edi
sub eax, ecx
pop ebx
mov dword [esi + 0xc], eax
pop edi
pop esi
ret
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x1c]
test eax, eax
je 0x630639
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x2c]
mov edi, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
mov ecx, dword [esi + 8]
mov eax, edi
sub eax, ecx
mov dword [esi + 0xc], eax
pop edi
pop esi
ret
Function at 0x630690
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x34]
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x6306b0
mov edx, dword [esi]
push 0
push 0
push 2
mov ecx, esi
call dword [edx + 0x40]
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x14]
test al, al
jne 0x6306c1
xor eax, eax
pop esi
ret
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x6306e8
mov edx, dword [esi + 0x14]
push edi
mov edi, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [edi + 0x40]
pop edi
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x633450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
lea eax, [esp + 0x48]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
call fcn.00633640
mov edx, dword [esi + 4]
mov esi, dword [esi + 8]
lea eax, [esp + 0x58]
mov ecx, 4
mov edi, dword [eax]
mov ebp, dword [eax + 4]
add edi, edx
add ebp, esi
mov dword [eax], edi
mov dword [eax + 4], ebp
add eax, 8
dec ecx
jne 0x633472
xor eax, eax
lea ebx, [esp + 0x58]
mov ecx, dword [0x81ba18]
lea edi, [eax + 1]
mov edx, edi
push 0x632ae0
mov esi, dword [ecx]
and edx, reloc.WSOCK32.dll_closesocket
jns 0x6334ab
dec edx
or edx, 0xfffffffc
inc edx
lea eax, [esp + edx*8 + 0x5c]
lea edx, [esp + 0x3c]
push eax
push ebx
push edx
call dword [esi + 0x78]
mov ecx, dword [0x81ba18]
push eax
call dword [esi + 0x44]
mov eax, edi
add ebx, 8
cmp eax, 4
jl 0x63348c
xor eax, eax
lea edi, [esp + 0x58]
mov ecx, dword [0x81ba18]
lea esi, [eax + 1]
lea edx, [esp + 0x38]
mov eax, dword [ecx]
push edx
call dword [eax + 0x78]
push eax
mov eax, esi
and eax, reloc.WSOCK32.dll_closesocket
jns 0x6334f5
dec eax
or eax, 0xfffffffc
inc eax
lea edx, [esp + eax*8 + 0x5c]
mov ecx, edi
call fcn.00760bc0
mov eax, esi
add edi, 8
cmp eax, 4
jl 0x6334d3
mov ecx, dword [0x81bcac]
mov eax, 1
cmp ecx, eax
jne 0x633632
cmp dword [0x81bca8], eax
jne 0x633632
mov ebp, dword [0x81ba14]
mov esi, dword [0x81ba10]
lea edi, [esp + 0x5c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 4
mov eax, dword [0x81bc98]
mov ecx, dword [0x81bc9c]
mov ebx, dword [edi - 4]
mov edx, dword [edi]
add eax, ebx
add ecx, edx
test esi, esi
jle 0x6335ca
test ebp, ebp
jle 0x6335ca
mov edx, dword [0x81ba08]
mov edi, dword [0x81ba0c]
cmp edx, eax
mov dword [esp + 0x30], esi
mov ebx, ebp
jle 0x633585
sub edx, eax
add esi, edx
mov edx, eax
mov dword [esp + 0x30], esi
cmp edi, ecx
jle 0x63358f
sub edi, ecx
add ebx, edi
mov edi, ecx
add esi, edx
lea ebp, [eax + 1]
cmp esi, ebp
jge 0x63359f
sub eax, edx
add eax, 2
jmp 0x6335a3
mov eax, dword [esp + 0x30]
lea esi, [ebx + edi]
lea ebp, [ecx + 1]
cmp esi, ebp
jge 0x6335b4
sub ecx, edi
add ecx, 2
mov ebx, ecx
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
jmp 0x6335e3
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x44]
mov eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
push 0
push 0
push 0x81bc98
lea edx, [esp + 0x24]
lea ecx, [esp + 0x54]
call fcn.0041fdf0
mov edx, dword [eax]
add edi, 8
mov dword [0x81ba08], edx
mov dword [esp + 0x10], edi
mov ecx, dword [eax + 4]
mov dword [0x81ba0c], ecx
mov esi, dword [eax + 8]
mov dword [0x81ba10], esi
mov ebp, dword [eax + 0xc]
mov eax, dword [esp + 0x14]
dec eax
mov dword [0x81ba14], ebp
mov dword [esp + 0x14], eax
jne 0x633549
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
Function at 0x634630
Capabilities:
Encrypt data using rc4 prga
Hash data using sha1

Disassembly:
sub esp, 0x88
push edi
mov edi, ecx
mov ecx, dword [edi + 0xc]
mov eax, ecx
cdq
and edx, 7
add eax, edx
mov dl, byte [esp + 0x90]
sar eax, 3
and eax, 0xff
test dl, 1
lea eax, [eax + edi + 0x14]
je 0x634665
and ecx, 7
mov dl, 1
shl dl, cl
xor byte [eax], dl
mov ecx, dword [edi + 0xc]
inc ecx
mov eax, ecx
mov dword [edi + 0xc], ecx
cmp eax, 0x800
jne 0x634701
push ebx
xor eax, eax
lea ebx, [edi + 0x14]
push esi
mov byte [esp + 0x20], al
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x38], 0x67452301
mov dword [esp + 0x3c], 0xefcdab89
mov dword [esp + 0x40], 0x98badcfe
mov dword [esp + 0x44], 0x10325476
mov dword [esp + 0x48], 0xc3d2e1f0
xor esi, esi
mov edi, ebx
push 0x100
push ebx
lea ecx, [esp + 0x28]
call fcn.0066a4c0
lea eax, [esp + 0xc]
lea ecx, [esp + 0x20]
push eax
call fcn.0066a540
mov eax, 0x100
sub eax, esi
cmp eax, 0x14
jbe 0x6346e6
mov eax, 0x14
lea ecx, [esp + 0xc]
push eax
push ecx
push edi
call fcn.0076e820
add esp, 0xc
inc esi
inc edi
cmp esi, 0x100
jb 0x6346b8
pop esi
pop ebx
pop edi
add esp, 0x88
ret 4

Function at 0x634710
Capabilities:
Encrypt data using rc4 prga
Hash data using sha1

Disassembly:
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], 8
mov ecx, dword [ebx + 0xc]
mov eax, ecx
cdq
and edx, 7
add eax, edx
mov dl, byte [esp + 0xa0]
sar eax, 3
and eax, 0xff
test dl, 1
lea eax, [eax + ebx + 0x14]
je 0x634750
and ecx, 7
mov dl, 1
shl dl, cl
xor byte [eax], dl
mov ecx, dword [ebx + 0xc]
inc ecx
mov eax, ecx
mov dword [ebx + 0xc], ecx
cmp eax, 0x800
jne 0x6347e7
xor esi, esi
lea edi, [ebx + 0x14]
mov byte [esp + 0x28], 0
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x40], 0x67452301
mov dword [esp + 0x44], 0xefcdab89
mov dword [esp + 0x48], 0x98badcfe
mov dword [esp + 0x4c], 0x10325476
mov dword [esp + 0x50], 0xc3d2e1f0
mov ebp, edi
push 0x100
push edi
lea ecx, [esp + 0x30]
call fcn.0066a4c0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
call fcn.0066a540
mov eax, 0x100
sub eax, esi
cmp eax, 0x14
jbe 0x6347ce
mov eax, 0x14
lea ecx, [esp + 0x14]
push eax
push ecx
push ebp
call fcn.0076e820
add esp, 0xc
inc esi
inc ebp
cmp esi, 0x100
jb 0x6347a0
mov cl, byte [esp + 0xa0]
mov eax, dword [esp + 0x10]
sar cl, 1
dec eax
mov byte [esp + 0xa0], cl
mov dword [esp + 0x10], eax
jne 0x634724
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 4
Function at 0x636d40
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ecx + 0x1c]
push esi
lea esi, [ecx + 0x1c]
push eax
push str.Wait_For_Router_Shutdown___hRouterProcess___d_n
call fcn.004068f0
mov eax, dword [esi]
add esp, 8
test eax, eax
je 0x636dd3
mov ecx, dword [esp + 8]
push ecx
push 0
push esi
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x636dc0
push edi
push str.Router_process_still_running___shutting_it_down_n
call fcn.004068f0
mov edx, dword [esi]
add esp, 4
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
test edi, edi
jne 0x636db0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_shut_down_router___error_code__d____s_n
call fcn.004068f0
add esp, 0xc
test edi, edi
pop edi
pop esi
setne al
ret 4
test edi, edi
mov dword [esi], 0
pop edi
setne al
pop esi
ret 4
push str.Router_not_running_n
call fcn.004068f0
add esp, 4
mov dword [esi], 0
mov al, 1
pop esi
ret 4

Function at 0x649660
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, 0x821b10
jmp fcn.0046bdc0

Function at 0x649670
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, 0x821ac0
jmp fcn.0046bdc0
Function at 0x6645f0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov eax, dword [esi]
push 0x657
push eax
call edi
mov ecx, dword [esi]
push 0x65f
push ecx
mov ebx, eax
call edi
test ebx, ebx
mov ebp, eax
je 0x664773
test ebp, ebp
je 0x664773
push 0
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
lea edi, [esi + 8]
push edi
push 0x40
push 0x4b5
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
call ebp
mov ecx, edi
mov byte [esi + 0x47], 0
call fcn.006e4080
push edi
call fcn.00781764
push 0x7dccd4
push edi
call fcn.0076d4b0
add esp, 0xc
test eax, eax
je case.0x6646e8.49
push 0x7dccd0
push edi
call fcn.0076d4b0
add esp, 8
test eax, eax
jne 0x66468e
mov eax, 1
jmp 0x66475d
push 0x7dcccc
push edi
call fcn.0076d4b0
add esp, 8
test eax, eax
jne 0x6646aa
mov eax, 2
jmp 0x66475d
push 0x7dccc8
push edi
call fcn.0076d4b0
add esp, 8
test eax, eax
jne 0x6646c6
mov eax, 3
jmp 0x66475d
push 3
push 0x7dccc4
push edi
call fcn.0076eda0
add esp, 0xc
test eax, eax
jne 0x6646fb
mov al, byte [esi + 0xb]
movsx ecx, al
add ecx, 0xffffffcf
cmp ecx, 3
ja case.default.0x6646e8
jmp dword [ecx*4 + 0x66477c]
cmp al, 0x39
jg 0x664710
cmp al, 0x30
jle 0x664710
mov byte [esi + 0xc], 0
push edi
push 4
push 0x657
mov ecx, esi
call fcn.00664800
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 0x440
push str.C:RA2SerialEd.cpp
xor edx, edx
mov ecx, str.TXT_OK
mov dword [esp + 0x24], 0x7c1614
call fcn.006eea10
push eax
push 0x440
push str.C:RA2SerialEd.cpp
xor edx, edx
mov ecx, str.TXT_INVALID_PORT_ADDRESS
call fcn.006eea10
push eax
lea ecx, [esp + 0x24]
call fcn.005b1140
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
push eax
or edx, 0xffffffff
mov ecx, ebx
call fcn.0072b870
push 0
push eax
push 0x14e
push ebx
call ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x66a690
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x160
lea edx, [esp + 0x20]
push ebx
push ebp
push esi
push edi
sub edx, ecx
mov esi, 0x10
mov eax, dword [ecx]
add ecx, 4
mov edi, eax
mov dword [esp + 0x10], eax
shl edi, 0x10
and eax, 0xff00
or edi, eax
xor eax, eax
mov al, byte [esp + 0x13]
shl edi, 8
or edi, eax
xor eax, eax
mov ah, byte [esp + 0x12]
or edi, eax
dec esi
mov dword [edx + ecx - 4], edi
jne 0x66a6a9
lea ecx, [esp + 0x38]
mov edx, 0x40
mov eax, dword [ecx + 0x2c]
mov edi, dword [ecx + 0x18]
mov esi, dword [ecx - 8]
mov ebp, dword [ecx]
xor eax, edi
add ecx, 4
xor eax, esi
xor eax, ebp
mov esi, eax
add eax, eax
shr esi, 0x1f
or esi, eax
dec edx
mov dword [ecx + 0x34], esi
jne 0x66a6e1
mov esi, dword [esp + 0x178]
mov ecx, 5
lea edi, [esp + 0x1c]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ecx
cmp ebx, 0x14
jge 0x66a741
mov ecx, edi
xor ecx, esi
and ecx, edx
jmp 0x66a75d
cmp ebx, 0x28
jl 0x66a759
cmp ebx, 0x3c
jge 0x66a759
mov ecx, edx
mov eax, edx
or ecx, edi
and eax, edi
and ecx, esi
or ecx, eax
jmp 0x66a75f
mov ecx, edx
xor ecx, edi
xor ecx, esi
cmp ebx, 0x14
jge 0x66a76e
mov dword [esp + 0x14], 0x5a827999
jmp 0x66a794
cmp ebx, 0x28
jge 0x66a77d
mov dword [esp + 0x14], 0x6ed9eba1
jmp 0x66a794
xor eax, eax
cmp ebx, 0x3c
setge al
dec eax
and eax, 0xc4b8fb06
add eax, 0xca62c1d6
mov dword [esp + 0x14], eax
mov eax, ebp
mov ebx, ebp
shr eax, 0x1b
shl ebx, 5
or eax, ebx
mov ebx, dword [esp + 0x10]
add eax, dword [ebx]
mov ebx, dword [esp + 0x14]
add eax, ebx
mov ebx, dword [esp + 0x2c]
add eax, ecx
mov ecx, edx
shl ecx, 0x1e
shr edx, 2
mov dword [esp + 0x2c], esi
or ecx, edx
add eax, ebx
mov ebx, dword [esp + 0x18]
mov esi, edi
mov edi, ecx
mov ecx, dword [esp + 0x10]
inc ebx
add ecx, 4
mov edx, ebp
cmp ebx, 0x50
mov ebp, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ecx
jb 0x66a734
mov ecx, dword [esp + 0x178]
mov ebp, dword [ecx + 4]
mov ebx, dword [ecx]
add ebp, edx
mov edx, dword [ecx + 0xc]
add ebx, eax
mov eax, dword [ecx + 0x10]
mov dword [ecx], ebx
mov ebx, dword [ecx + 8]
add edx, esi
add ebx, edi
mov dword [ecx + 0xc], edx
mov edx, dword [esp + 0x2c]
pop edi
mov dword [ecx + 4], ebp
add eax, edx
pop esi
mov dword [ecx + 8], ebx
pop ebp
mov dword [ecx + 0x10], eax
pop ebx
add esp, 0x160
ret 8
Function at 0x6808d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x90
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov edi, str.SOFTWAREWestwoodRed_Alert_2_
mov ecx, dword [ebp]
xor eax, eax
and ecx, 0xfffffff8
xor ebx, ebx
mov dword [ebp], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x18], 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x680975
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
push ebx
push str.EscapeMovies
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x68096a
cmp dword [esp + 0x1c], 4
jne 0x68096a
mov bl, byte [esp + 0x10]
and bl, 1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp]
and ebx, 1
or ebx, 0x1010
and edx, 0xfff88087
shl ebx, 3
or ebx, edx
pop edi
mov dword [ebp], ebx
pop esi
pop ebp
pop ebx
add esp, 0x90
ret
Function at 0x683160
Capabilities:
Set registry value

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push ebx
push esi
push ecx
mov esi, edx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
je 0x683198
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push 0x7b78d4
push ecx
call edi
lea edx, [esp + 0x10]
push esi
push edx
call edi
pop edi
lea eax, [esp + 8]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
lea ecx, [esp + 0x24]
push 0
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x6831f7
mov esi, dword [esp + 0x114]
test esi, esi
je 0x6831ea
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov edx, dword [esp + 8]
push eax
push esi
push 1
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x6831ec
mov bl, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop esi
pop ebx
add esp, 0x108
ret 4