joyce8/EMBER2024-capa huggingface dataset:
Function at 0x657216
Capabilities:
Delete file
Get file size
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
mov eax, dword [ebp - 0x28]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x65724e
xor al, al
jmp 0x65736d
mov word [ebp - 0x10], 0
mov word [ebp - 8], 0
push 2
push 0
push 0xfffffffffffffffc
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x1c]
push edx
push 2
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [ebp - 0x1c]
push edx
push 2
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x10]
and edx, 0xffff
test edx, edx
jne 0x6572b4
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x65736d
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.0067cb4a
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.006570c3
mov word [ebp - 4], ax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0067cb73
add esp, 4
mov edx, dword [ebp - 8]
and edx, 0xffff
mov eax, dword [ebp - 4]
and eax, 0xffff
cmp edx, eax
jne 0x65734c
mov al, 1
jmp 0x65736d
push 0x80
mov ecx, dword [ebp - 0x28]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebp - 0x28]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x657371
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0064273e
add esp, 4
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x6574e2
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp - 0x34]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x6573e4
xor al, al
jmp 0x6574ee
mov byte [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
jmp 0x6573fa
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x800
jge 0x65742b
call fcn.0064274b
cdq
mov ecx, 0xff
idiv ecx
mov byte [ebp - 0x10], dl
push 0
lea edx, [ebp - 0x28]
push edx
push 1
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x6573f1
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.0067cb4a
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
push 0
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x34]
call fcn.006570c3
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0067cb73
add esp, 4
push 2
push 0
push 0xfffffffffffffffc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
push eax
push 2
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov word [ebp - 0x18], 0
push 0
lea eax, [ebp - 8]
push eax
push 2
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x6574f2
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0064273e
add esp, 4
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x657539
xor al, al
jmp 0x65769f
mov word [ebp - 4], 0
push 2
push 0
push 0xfffffffffffffffe
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0xc]
push edx
push 2
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, 0xdc
mov ecx, dword [ebp - 4]
and ecx, 0xffff
imul ecx, ecx, 0x2c
cmp eax, ecx
jae 0x657693
push 2
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
jmp 0x6575b3
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x800
jge 0x6575e4
call fcn.0064274b
cdq
mov ecx, 0xff
idiv ecx
mov dword [ebp - 0x18], edx
push 0
lea edx, [ebp - 0x28]
push edx
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x6575aa
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0067cb4a
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
push 0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x34]
call fcn.006570c3
mov word [ebp - 0x14], ax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.0067cb73
add esp, 4
push 2
push 0
push 0xfffffffffffffffc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x10]
push edx
push 2
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x10]
push edx
push 2
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x659590
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x699f48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov ebp, ecx
mov eax, dword [0x6e0edc]
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], eax
mov byte [esp + 0x20], 1
mov edi, 0x43
push edi
lea ecx, [esp + 0x10]
push 0x6af03c
push ecx
call fcn.00675703
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x659638
push edi
lea eax, [esp + 0x10]
push 0x6af038
push eax
call fcn.00675703
add esp, 8
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.0067cb84
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov byte [esp + 0x2c], 2
call fcn.0067cb84
mov ecx, ebp
mov byte [esp + 0x28], 1
call fcn.00659690
mov esi, eax
test esi, esi
jne 0x659645
jmp 0x65963a
xor esi, esi
inc edi
lea ecx, [edi - 0x41]
cmp ecx, 0x1a
jl 0x6595c8
jmp 0x659651
lea edx, [esp + 0xc]
mov ecx, ebp
push edx
call fcn.0067cf48
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.0067ce0f
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0067ce0f
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x18
ret 4

Function at 0x65a050
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
xor edx, edx
mov ecx, 8
shl eax, 1
mov edi, eax
mov ebx, eax
sar edi, 4
and edi, 0x800
and ebx, 0x800
xor edi, ebx
sar edi, 0xb
or eax, edi
dec ecx
jne 0x65a062
mov byte [edx + esi], al
inc edx
cmp edx, 0x800
jl 0x65a05d
pop edi
pop esi
pop ebx
ret 8
Function at 0x65a100
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
stosb byte es:[edi], al
call fcn.006635d0
add esp, 4
cmp eax, 9
jle 0x65a14a
mov edi, 1
mov eax, 0x6e2b78
jmp 0x65a151
xor edi, edi
mov eax, 0x6e2b54
mov esi, edi
lea ecx, [esp + 0x10]
neg esi
sbb esi, esi
push ecx
push 0x20019
add esi, reloc.OLEAUT32.dll_SysReAllocString
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push ebx
push eax
push ebx
push 0x6e2b44
push ecx
call ebp
test eax, eax
jne 0x65a1bb
lea edx, [esp + 0x18]
lea eax, [esp + 0x30]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push ebx
push 0x6e2b44
push edx
call ebp
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
jmp 0x65a258
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [esp + 0x26]
mov edx, dword [esp + 0x22]
mov ecx, dword [esp + 0x20]
and eax, 0xffff
and edx, 0xffff
and ecx, 0xffff
add eax, edx
add eax, ecx
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x28]
and eax, 0xffff
lea eax, [eax + edx*4]
mov edx, dword [esp + 0x2a]
and edx, 0xffff
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*4]
mov ecx, dword [esp + 0x2c]
and ecx, 0xffff
cmp edi, ebx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*4]
mov eax, 0x6e2b78
mov dword [esp + 0x14], edx
jne 0x65a231
mov eax, 0x6e2b54
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 4
push edx
push 4
push ebx
push 0x6e2b44
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret
Function at 0x65a280
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x41c
push edi
xor edx, edx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31d]
mov byte [esp + 0x31c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x219]
mov byte [esp + 0x218], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push 0x104
push eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10]
push 3
lea edx, [esp + 0x118]
push ecx
push edx
call fcn.006436e0
add esp, 0xc
lea eax, [esp + 0x218]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push 0x104
push eax
push ecx
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x330]
push 0x104
lea edx, [esp + 0x12c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [esp + 4]
pop edi
add esp, 0x41c
ret

Function at 0x65a370
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x65a3d8
mov ecx, dword [esp + 4]
cmp ecx, 5
jae 0x65a3a5
mov eax, 0xd3
add esp, 0x94
ret
mov eax, dword [esp + 8]
test eax, eax
jne 0x65a3b9
mov eax, 0xd4
add esp, 0x94
ret
cmp eax, 1
jne 0x65a3ca
mov eax, 0xd5
add esp, 0x94
ret
lea ecx, [ecx + ecx*4 + 0x32]
lea eax, [eax + ecx*2]
add esp, 0x94
ret
mov eax, dword [esp + 4]
cmp eax, 4
jne 0x65a421
mov eax, dword [esp + 8]
test eax, eax
je 0x65a415
cmp eax, 0xa
je 0x65a409
cmp eax, 0x5a
je 0x65a3fd
add eax, 0x28
add esp, 0x94
ret
mov eax, 0xcb
add esp, 0x94
ret
mov eax, 0xca
add esp, 0x94
ret
mov eax, 0xc9
add esp, 0x94
ret
lea edx, [eax + eax*4]
mov eax, dword [esp + 8]
lea eax, [eax + edx*2]
add esp, 0x94
ret
Function at 0x65b4ef
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 0xc]
shr eax, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
jmp 0x65b525
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jae 0x65b695
mov ecx, dword [ebp + 0x18]
push ecx
push 0x10
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [0x6e973c]
call fcn.006591c5
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x54]
jne 0x65b5de
push 0x80
call fcn.0067cb4a
add esp, 4
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], edx
push 0x80
push 0
mov eax, dword [ebp - 0x14]
push eax
call fcn.00642ec0
add esp, 0xc
push 0x80
mov ecx, dword [ebp + 0x18]
add ecx, 0x400
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.00642a60
add esp, 0xc
mov eax, dword [0x6e9764]
push eax
push 0x80
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00656140
add esp, 0xc
push 0x28
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x34]
add eax, 0x2c
push eax
call fcn.00642a60
add esp, 0xc
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
call fcn.0067cb73
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x14]
sub eax, 0xf
cmp dword [ebp - 8], eax
jne 0x65b687
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp + 0xc]
add ecx, 1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x34]
mov dword [eax + edx*4 + 0x90], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x34]
mov dword [edx + ecx*4 + 0x68], eax
mov byte [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov word [ebp - 0x1b], ax
mov byte [ebp - 0x19], al
push 8
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov dx, word [ecx + 0x14]
mov eax, dword [ebp + 0x18]
lea ecx, [eax + edx + 0x7800]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00642a60
add esp, 0xc
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov cx, word [eax + 0x12]
mov edx, dword [ebp - 0x34]
xor eax, eax
mov ax, word [edx + 0x10]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
push ecx
push 8
lea edx, [ebp - 0x28]
push edx
call fcn.00656140
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x34]
call fcn.0065b783
mov edx, dword [ebp - 8]
add edx, 0x10
mov dword [ebp - 8], edx
jmp 0x65b51c
mov eax, 1
mov esp, ebp
pop ebp
ret 0x14
Function at 0x65cd8e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 0xc]
shr eax, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
jmp 0x65cdc4
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jae 0x65ce99
mov ecx, dword [ebp + 0x18]
push ecx
push 0x10
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [0x6e973c]
call fcn.006591c5
mov eax, dword [ebp + 0x14]
sub eax, 0xf
cmp dword [ebp - 8], eax
jne 0x65ce8b
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp + 0xc]
add ecx, 1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
mov dword [eax + edx*4 + 0x68], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x28]
mov dword [edx + ecx*4 + 0x40], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
push 8
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov dx, word [ecx + 0x14]
mov eax, dword [ebp + 0x18]
lea ecx, [eax + edx + 0x7800]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00642a60
add esp, 0xc
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov cx, word [eax + 0x12]
mov edx, dword [ebp - 0x28]
xor eax, eax
mov ax, word [edx + 0x10]
add ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
push ecx
push 8
lea edx, [ebp - 0x24]
push edx
call fcn.00656140
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.0065cf87
mov edx, dword [ebp - 8]
add edx, 0x10
mov dword [ebp - 8], edx
jmp 0x65cdbb
mov eax, 1
mov esp, ebp
pop ebp
ret 0x14
Function at 0x6604dd
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push esi
push edi
mov dword [ebp - 0x324], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x21c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x320], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x31f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x118], 0x104
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x324]
push eax
push 0x20019
push 0
push 0x6e2c90
push reloc.OLEAUT32.dll_SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x66070c
mov dword [ebp - 0x328], 0
jmp 0x660599
mov ecx, dword [ebp - 0x328]
add ecx, 1
mov dword [ebp - 0x328], ecx
cmp dword [ebp - 0x114], 0
jne 0x6606ff
mov dword [ebp - 0x118], 0x104
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x328]
push edx
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x6606fa
lea ecx, [ebp - 0x110]
push ecx
push 0x6e2ca4
lea edx, [ebp - 0x21c]
push edx
call fcn.00642944
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x21c]
push ecx
push reloc.OLEAUT32.dll_SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6606fa
mov dword [ebp - 0x118], 0x104
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x320]
push eax
push 0
push 0
push 0x6e2cbc
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6606f0
push 0x6e2cc8
call fcn.00642f60
add esp, 4
push eax
push 0x6e2cd0
lea edx, [ebp - 0x320]
push edx
call fcn.00652046
add esp, 0xc
test eax, eax
jne 0x6606f0
movsx esi, byte [ebp + 0xc]
lea eax, [ebp - 0x320]
push eax
call fcn.00660714
add esp, 4
movsx ecx, al
cmp esi, ecx
jne 0x6606f0
push 0x6e2cd8
lea edx, [ebp - 0x320]
push edx
call fcn.0064b110
add esp, 8
test eax, eax
jne 0x6606f0
push 0x6e2ce0
lea eax, [ebp - 0x320]
push eax
call fcn.0064b110
add esp, 8
test eax, eax
jne 0x6606f0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x66070e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x66058a
mov ecx, dword [ebp - 0x324]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x660714
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push edi
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0x104
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
push 0x6e2ce8
lea ecx, [ebp - 0x208]
push ecx
call fcn.00642944
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x208]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6607ea
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0
push 0
push 0x6e2cf0
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6607dd
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x104]
jmp 0x6607ec
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 0x30
pop edi
mov esp, ebp
pop ebp
ret