joyce8/EMBER2024-capa huggingface dataset:
Function at 0x622a48
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x622c29
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040be84
lea eax, [ebp - 0x18]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040c404
mov eax, dword [ebp - 0x18]
mov edx, 0x622c44
call fcn.0040c374
jne 0x622bff
call fcn.00608038
test al, al
jne 0x622aa9
push 0
call fcn.00607ff8
call fcn.00608038
test al, al
jne 0x622ab9
push 0
call fcn.00607ff8
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, 7
mov eax, dword [ebp - 4]
call fcn.0040c404
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, 8
mov eax, dword [ebp - 4]
call fcn.0040c404
lea eax, [ebp - 0x10]
push eax
mov ecx, 1
mov edx, 9
mov eax, dword [ebp - 4]
call fcn.0040c404
mov eax, dword [ebp - 8]
mov edx, 0x622c58
call fcn.0040c374
je 0x622b19
mov eax, dword [ebp - 8]
mov edx, 0x622c68
call fcn.0040c374
jne 0x622b8b
push 0x90
call sub.user32.dll_GetKeyState
movsx eax, ax
lea edx, [ebp - 0x1c]
call fcn.0042a094
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov ecx, 0
call fcn.0040c54c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040c374
je 0x622b8b
mov eax, dword [0x6bf9fc]
mov eax, dword [eax]
mov edx, 0x622c78
call fcn.0040cc44
je 0x622b8b
mov eax, dword [0x6bfe34]
mov edx, dword [ebp - 0x14]
call fcn.0040be38
push 0
push 1
push 0
push 0x90
call sub.user32.dll_keybd_event
push 0
push 3
push 0
push 0x90
call sub.user32.dll_keybd_event
mov eax, dword [ebp - 0xc]
mov edx, 0x622c58
call fcn.0040c374
je 0x622ba9
mov eax, dword [ebp - 0xc]
mov edx, 0x622c68
call fcn.0040c374
jne 0x622bff
push 0x14
call sub.user32.dll_GetKeyState
movsx eax, ax
lea edx, [ebp - 0x20]
call fcn.0042a094
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov ecx, 0
call fcn.0040c54c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.0040c374
je 0x622bff
mov eax, dword [0x6bffec]
mov edx, dword [ebp - 0x14]
call fcn.0040be38
push 0
push 1
push 0
push 0x14
call sub.user32.dll_keybd_event
push 0
push 3
push 0
push 0x14
call sub.user32.dll_keybd_event
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622c30
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0040ba04
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040ba3c
pop eax
jmp eax
Function at 0x62a3e8
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
call fcn.004324ec
cmp eax, 2
jne 0x62a450
lea eax, [esp + 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0xc]
push eax
push 0x62a460
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
xor eax, eax
mov dword [esp], eax
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
pop ebx
ret
Function at 0x6311ac
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6311da
mov eax, ebx
call fcn.00631c68
cmp dword [ebx + 0x40], 0
je 0x6311d3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x63124b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x63123d
cmp dword [ebx + 8], 0
je 0x6311fc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x63120e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x63123d
cmp dword [ebx + 8], 0
je 0x6311ef
cmp eax, 3
je 0x631221
dec eax
jne 0x6311ef
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6311ef
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6311ef
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x631269
cmp dword [ebx + 0x14], 0xcc
je 0x631269
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00631274
pop ebx
ret
Function at 0x6455b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6456c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040be84
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040be84
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x6456e0
call fcn.00619eec
mov ebx, eax
test ebx, ebx
jle 0x64569b
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040c404
lea eax, [ebp - 8]
push eax
lea edx, [ebx + 0xf]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 8]
call fcn.0040c404
xor edx, edx
push ebp
push 0x645684
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040c978
mov eax, dword [ebp - 0x10]
call fcn.0040c8a8
push eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040c978
mov eax, dword [ebp - 0x14]
call fcn.0040c8a8
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x64567a
mov edx, 0x6456fc
mov eax, dword [ebp - 0xc]
call fcn.00643354
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64569b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6456cc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040ba04
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ba3c
pop eax
jmp eax

Function at 0x64ba8c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
mov edi, edx
mov ebx, eax
push 0x40
push 0x1000
push 0x20
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, edi
call fcn.0064bae8
mov edi, eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, ebp
call fcn.0064bae8
mov ebp, eax
push ebp
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.0064bb14
test al, al
jne 0x64bae1
push 0x8000
push 0x20
push esi
call sub.kernel32.dll_VirtualFree
xor esi, esi
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x65d3c8
Capabilities:
Write file on windows

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
cmp dword [ebx + 0x14], 0xffffffff
je 0x65d408
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
push 0
lea eax, [esp + 4]
push eax
push 8
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_WriteFile
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebx + 0x19], 0
add esp, 0x10
pop ebx
ret
Function at 0x65f534
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x65f561
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65f570
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x65fd20
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffc0
mov eax, esp
xor ecx, ecx
mov edx, 0x40
call fcn.00408424
mov dword [esp], 0x40
push esp
call sub.kernel32.dll_GlobalMemoryStatusEx
mov eax, dword [esp + 8]
mov dword [0xf49bc8], eax
mov eax, dword [esp + 0xc]
mov dword [0xf49bcc], eax
mov eax, dword [0xf49bc8]
mov edx, dword [0xf49bcc]
test edx, edx
jge 0x65fd69
neg eax
adc edx, 0
neg edx
mov dword [0xf49bc8], eax
mov dword [0xf49bcc], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [0xf49bd0], eax
mov dword [0xf49bd4], edx
mov eax, dword [0xf49bd0]
mov edx, dword [0xf49bd4]
test edx, edx
jge 0x65fd9e
neg eax
adc edx, 0
neg edx
mov dword [0xf49bd0], eax
mov dword [0xf49bd4], edx
mov byte [0xf49bb4], 0
cmp dword [0xf49bd4], 0
jne 0x65fdc5
cmp dword [0xf49bd0], 0x4b
jae 0x65fdf2
jmp 0x65fdc7
jge 0x65fdf2
mov eax, dword [0xf49bc8]
mov edx, dword [0xf49bcc]
sub eax, dword [esp + 0x10]
sbb edx, dword [esp + 0x14]
cmp edx, 0
jne 0x65fde9
cmp eax, 0x1dcd6500
jbe 0x65fdf2
jmp 0x65fdeb
jle 0x65fdf2
mov byte [0xf49bb4], 1
add esp, 0x40
ret
Function at 0x66340c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ba98
xor eax, eax
push ebp
push 0x6635a6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edi, eax
xor edx, edx
mov eax, 2
call fcn.0060ce44
mov esi, eax
mov dword [ebp - 0x234], 0x22c
lea edx, [ebp - 0x234]
mov eax, esi
call fcn.0060ce64
mov ebx, eax
jmp 0x663570
cmp edi, dword [ebp - 0x22c]
je 0x663561
lea eax, [ebp - 0x240]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040c95c
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.0042ad5c
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.004292e0
mov eax, dword [ebp - 0x238]
push eax
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 4]
call fcn.004292e0
mov edx, dword [ebp - 0x244]
pop eax
call fcn.0040cc44
je 0x663546
lea eax, [ebp - 0x24c]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040c95c
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x248]
call fcn.004292e0
mov eax, dword [ebp - 0x248]
push eax
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 4]
call fcn.004292e0
mov edx, dword [ebp - 0x250]
pop eax
call fcn.0040cc44
jne 0x663561
push 0
mov eax, dword [ebp - 0x22c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 8], eax
lea edx, [ebp - 0x234]
mov eax, esi
call fcn.0060ce84
mov ebx, eax
test ebx, ebx
jne 0x663495
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6635ad
lea eax, [ebp - 0x250]
mov edx, 7
call fcn.0040ba04
lea eax, [ebp - 4]
call fcn.0040b9a4
pop eax
jmp eax
Function at 0x6635f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x663713
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040bddc
lea eax, [ebp - 8]
mov edx, ebx
mov ecx, 0
call fcn.0040c54c
xor ebx, ebx
xor eax, eax
push ebp
push 0x663668
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0x663724
push 0x663724
mov eax, dword [ebp - 4]
call fcn.0040c8a8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x663674
xor eax, eax
push ebp
push 0x6636ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0x663724
push 0x663724
mov eax, dword [ebp - 4]
call fcn.0040c8a8
push eax
push 0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6636ba
xor eax, eax
push ebp
push 0x6636e2
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp - 8]
call fcn.0040c3f4
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6636ee
mov eax, dword [ebp - 0xc]
mov byte [eax], bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66371a
lea eax, [ebp - 8]
call fcn.0040b9c8
lea eax, [ebp - 4]
call fcn.0040b9a4
pop eax
jmp eax

Function at 0x663728
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6637c3
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
lea eax, [ebp - 4]
call fcn.0040b9a4
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x663760
bt esi, eax
jae 0x663792
mov edx, ebx
add dx, 0x61
mov eax, edx
mov ecx, edx
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x66377b
mov eax, edx
and ax, 0xffdf
mov edi, eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.0040c8c8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0040cab4
inc ebx
cmp ebx, 0x1a
jne 0x663756
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040bd94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6637ca
lea eax, [ebp - 0xc]
call fcn.0040b9a4
lea eax, [ebp - 4]
call fcn.0040b9a4
pop eax
jmp eax
Function at 0x6637d4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6638fc
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x663805
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040bddc
jmp 0x663814
lea edx, [ebp - 4]
mov eax, dword [0x6bfd20]
mov eax, dword [eax]
call fcn.005a680c
mov eax, dword [ebp - 4]
test eax, eax
je 0x663820
sub eax, 4
mov eax, dword [eax]
inc eax
call fcn.0042b490
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042b1a8
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.0040b9a4
test esi, esi
jle 0x6638dd
lea eax, [esi + 1]
call fcn.0042b490
mov edi, eax
push edi
push esi
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x6638d6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x66390c
push edi
call sub.version.dll_VerQueryValueW
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [esi + 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 0x1c]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, word [esi + 0xc]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x66391c
call fcn.0042b64c
mov eax, edi
call fcn.0042b4d0
mov eax, ebx
call fcn.0042b4d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x663903
lea eax, [ebp - 4]
call fcn.0040b9a4
pop eax
jmp eax
Function at 0x665974
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ba98
mov eax, dword [ebp - 8]
call fcn.0040ba98
xor eax, eax
push ebp
push 0x665a82
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408424
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x4140
call sub.user32.dll_GetActiveWindow
mov dword [ebp - 0x3c], eax
mov eax, 0x665a94
mov dword [ebp - 0x38], eax
cmp dword [ebp - 8], 0
je 0x6659e3
mov eax, dword [ebp - 8]
call fcn.0040c8a8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.0040c8a8
mov dword [ebp - 0x34], eax
cmp bl, 1
jne 0x6659fa
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x665a01
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x665a13
mov esi, dword [ebp - 0xc]
jmp 0x665a2b
or ebx, 0xffffffff
jmp 0x665a65
push 0x3e8
call sub.kernel32.dll_Sleep
inc edi
cmp edi, 0x11940
jg 0x665a3a
push 0x32
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x665a18
xor eax, eax
push ebp
push 0x665a58
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x665a62
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x665a89
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ba04
pop eax
jmp eax

Function at 0x6664e8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c95c
add esp, 0x20c
pop ebx
ret
Function at 0x6778f8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x677925
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x677934
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x677940
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x677a68
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x677971
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040bddc
jmp 0x677980
lea edx, [ebp - 4]
mov eax, dword [0x6bfd20]
mov eax, dword [eax]
call fcn.005a680c
mov eax, dword [ebp - 4]
test eax, eax
je 0x67798c
sub eax, 4
mov eax, dword [eax]
inc eax
call fcn.0042b490
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042b1a8
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.0040b9a4
test esi, esi
jle 0x677a49
lea eax, [esi + 1]
call fcn.0042b490
mov edi, eax
push edi
push esi
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x677a42
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x677a78
push edi
call sub.version.dll_VerQueryValueW
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [esi + 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 0x1c]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, word [esi + 0xc]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x677a88
call fcn.0042b64c
mov eax, edi
call fcn.0042b4d0
mov eax, ebx
call fcn.0042b4d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x677a6f
lea eax, [ebp - 4]
call fcn.0040b9a4
pop eax
jmp eax
Function at 0x685300
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6853d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
call sub.kernel32.dll_GetEnvironmentStringsW
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0040b9a4
jmp 0x685395
test di, di
je 0x685355
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.0040c8c8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.0040cab4
jmp 0x685394
cmp dword [ebp - 4], 0
je 0x6853a6
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x6853ec
call fcn.0040cdd8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
je 0x68538c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004296c4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 4]
call fcn.0040b9a4
inc ebx
movzx edi, word [esi + ebx*2]
test di, di
jne 0x685339
cmp word [esi + ebx*2 - 2], 0
jne 0x685339
push esi
call sub.kernel32.dll_FreeEnvironmentStringsW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6853d8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040ba04
lea eax, [ebp - 4]
call fcn.0040b9a4
pop eax
jmp eax

Function at 0x6853f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x685483
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x104
mov eax, esi
call fcn.0042b490
mov ebx, eax
push esi
push ebx
call sub.kernel32.dll_GetWindowsDirectoryW
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040c908
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, 0x6854a0
call fcn.0040cb0c
push esi
push ebx
call sub.kernel32.dll_GetSystemDirectoryW
push dword [edi]
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040c908
push dword [ebp - 8]
push 0x6854a0
mov eax, edi
mov edx, 3
call fcn.0040cb94
mov eax, ebx
call fcn.0042b4d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68548a
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ba04
pop eax
jmp eax
Function at 0x6854a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x685540
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b9a4
mov eax, 0x104
call fcn.0042b490
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x6854ff
mov eax, esi
mov edx, ebx
call fcn.0040c908
mov eax, ebx
call fcn.0042b4d0
lea eax, [ebp - 4]
call fcn.00410b10
push eax
call sub.shell32.dll_SHGetMalloc
test eax, 0x80000000
jne 0x685528
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x685547
lea eax, [ebp - 4]
call fcn.00410b10
pop eax
jmp eax

Function at 0x685bc4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
mov ebx, eax
test ebx, ebx
jne 0x685bda
mov byte [ebp - 1], 0
jmp 0x685c53
mov eax, dword [0x6bfe24]
cmp dword [eax], 0
je 0x685bf1
lea eax, [ebp - 8]
push eax
mov eax, dword [0x6bfe24]
mov eax, dword [eax]
call eax
xor eax, eax
push ebp
push 0x685c4c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x400
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push 0
mov eax, ebx
call fcn.0040c8a8
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x685c53
mov eax, dword [0x6bf550]
cmp dword [eax], 0
je 0x685c49
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x6bf550]
mov eax, dword [eax]
call eax
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret