joyce8/EMBER2024-capa huggingface dataset:
Function at 0x693790
Capabilities:
Create service
Delete service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
cmp dword [ebp + 0x18], 0
je 0x6937ad
push 8
push 0
mov eax, dword [ebp + 0x18]
push eax
call fcn.006d6da0
add esp, 0xc
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00693b30
add esp, 8
mov dword [ebp - 8], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 4], 0
je 0x693954
mov dword [ebp - 0x10], 3
cmp dword [ebp + 0x14], 0
je 0x6937f9
mov dword [ebp - 0x10], 1
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
push 1
mov eax, dword [ebp - 0x10]
push eax
push 1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.advapi32.dll_CreateServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x69385f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x431
je 0x693849
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x430
jne 0x69385f
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x693931
mov dword [ebp - 0x2c], 0
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.advapi32.dll_StartServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6938d1
lea ecx, [ebp - 0x2c]
push ecx
push 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.00693980
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x6938cf
cmp dword [ebp + 0x18], 0
je 0x6938c9
mov eax, dword [ebp + 0x18]
mov dword [eax], 4
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx + 4], eax
xor edx, edx
test edx, edx
jne 0x6938ae
jmp 0x69390b
call dword [sym.imp.kernel32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x420
sete cl
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x69390b
cmp dword [ebp + 0x18], 0
je 0x693905
mov edx, dword [ebp + 0x18]
mov dword [edx], 3
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx + 4], eax
xor edx, edx
test edx, edx
jne 0x6938ea
cmp dword [ebp - 8], 0
jne 0x69392f
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.advapi32.dll_DeleteService]
cmp dword [ebp - 0xc], 0
je 0x69392b
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x693978
jmp 0x693952
cmp dword [ebp + 0x18], 0
je 0x69394c
mov edx, dword [ebp + 0x18]
mov dword [edx], 2
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx + 4], eax
xor edx, edx
test edx, edx
jne 0x693931
jmp 0x693975
cmp dword [ebp + 0x18], 0
je 0x69396f
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx + 4], eax
xor edx, edx
test edx, edx
jne 0x693954
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x693980
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x693a00
mov eax, 1
test eax, eax
je 0x693a00
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.advapi32.dll_QueryServiceStatus]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6939b5
jmp 0x693a00
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x6939c2
jmp 0x693a00
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x18]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3e8
jae 0x6939e4
mov dword [ebp - 8], 0x3e8
cmp dword [ebp - 8], 0x2710
jbe 0x6939f4
mov dword [ebp - 8], 0x2710
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x693993
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x693a10
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0xf003f
push 0
push 0
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x693a35
xor eax, eax
jmp 0x693b1d
push 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x693a5f
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x693b1d
lea eax, [ebp - 0xc]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.advapi32.dll_QueryServiceConfigA]
test eax, eax
jne 0x693adb
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x693ac3
mov edx, dword [ebp - 0xc]
push edx
call fcn.006d7138
add esp, 4
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.advapi32.dll_QueryServiceConfigA]
test eax, eax
jne 0x693ac1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x693b1d
jmp 0x693adb
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x693b1d
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0
je 0x693af6
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 1
je 0x693af6
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 2
jne 0x693aff
mov dword [ebp - 4], 1
jmp 0x693b06
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x693b30
Capabilities:
Delete file
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x693b56
push 8
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.006d6da0
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.advapi32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 4], 0
je 0x693cf4
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.advapi32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x693bbd
cmp dword [ebp + 0xc], 0
je 0x693bb0
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
xor edx, edx
test edx, edx
jne 0x693b95
xor eax, eax
jmp 0x693d17
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.advapi32.dll_QueryServiceStatus]
test eax, eax
jne 0x693bf7
cmp dword [ebp + 0xc], 0
je 0x693bea
mov edx, dword [ebp + 0xc]
mov dword [edx], 5
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
xor edx, edx
test edx, edx
jne 0x693bcf
xor eax, eax
jmp 0x693d17
cmp dword [ebp - 0x24], 1
je 0x693c75
lea eax, [ebp - 0x28]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.advapi32.dll_ControlService]
test eax, eax
jne 0x693c39
cmp dword [ebp + 0xc], 0
je 0x693c2c
mov edx, dword [ebp + 0xc]
mov dword [edx], 6
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
xor edx, edx
test edx, edx
jne 0x693c11
xor eax, eax
jmp 0x693d17
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.advapi32.dll_QueryServiceStatus]
cmp dword [ebp - 0x24], 1
je 0x693c75
cmp dword [ebp + 0xc], 0
je 0x693c68
mov edx, dword [ebp + 0xc]
mov dword [edx], 7
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
xor edx, edx
test edx, edx
jne 0x693c4d
xor eax, eax
jmp 0x693d17
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.advapi32.dll_DeleteService]
test eax, eax
jne 0x693ca8
cmp dword [ebp + 0xc], 0
je 0x693c9e
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 8
call dword [sym.imp.kernel32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
mov dword [edx + 4], eax
xor eax, eax
test eax, eax
jne 0x693c83
xor eax, eax
jmp 0x693d17
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov eax, dword [ebp + 8]
push eax
call fcn.00693ff0
add esp, 4
push 0x100
lea ecx, [ebp - 0x128]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.006940a0
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, 1
jmp 0x693d17
cmp dword [ebp + 0xc], 0
je 0x693d0f
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 1
call dword [sym.imp.kernel32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
mov dword [edx + 4], eax
xor eax, eax
test eax, eax
jne 0x693cf4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x693d20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x7ad258
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x693d3f
xor eax, eax
jmp 0x693ddc
push 0x7ad268
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push 0x7ad280
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
push 0x7ad2a0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
push 0x7ad2b8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
push 0x7ad2dc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x693dd3
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x693dd3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x693dd3
mov edx, dword [ebp + 8]
cmp dword [edx + 0xc], 0
je 0x693dd3
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x693dd7
xor eax, eax
jmp 0x693ddc
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x6940a0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov dword [ebp - 0x104], 0
push 0x7ad2f8
lea eax, [ebp - 0x100]
push eax
call fcn.006d6e00
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.006d6e10
add esp, 8
lea eax, [ebp - 0x104]
push eax
push 1
push 0
lea ecx, [ebp - 0x100]
push ecx
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x104], 0
je 0x6941a3
lea edx, [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push 0x7ad31c
mov ecx, dword [ebp - 0x104]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x694190
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.006d6f50
add esp, 4
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx + eax - 1]
cmp eax, 0x5c
je 0x69415e
push 0x7ad328
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.006d6e10
add esp, 8
push 0x7ad32c
mov edx, dword [ebp + 0xc]
push edx
call fcn.006d6e10
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.006d6e10
add esp, 8
push 0x7ad338
mov edx, dword [ebp + 0xc]
push edx
call fcn.006d6e10
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00694040
add esp, 4
mov eax, 1
jmp 0x6941a5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x695940
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.006d6fe0
add esp, 8
test eax, eax
jne 0x6959f3
push 0x100
lea ecx, [ebp - 0x348]
push ecx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x348]
push edx
call fcn.006d6f50
add esp, 4
movsx eax, byte [ebp + eax - 0x349]
cmp eax, 0x5c
jne 0x6959a4
lea ecx, [ebp - 0x348]
push ecx
call fcn.006d6f50
add esp, 4
mov byte [ebp + eax - 0x349], 0
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x6959d2
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x348]
push ecx
push 0x7ad358
lea edx, [ebp - 0x248]
push edx
call fcn.006d6ef0
add esp, 0x10
jmp 0x6959f1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x348]
push ecx
push 0x7ad368
lea edx, [ebp - 0x248]
push edx
call fcn.006d6ef0
add esp, 0x10
jmp 0x695a06
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.006d6e00
add esp, 8
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x148], 0xffffffff
je 0x695a44
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x695a50
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7c4438
push 0x6d8c08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x695aee
jmp 0x695c24
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x695b10
jmp 0x695c24
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x695b30
jmp 0x695c24
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov dx, word [ecx]
cmp edx, 0x5a4d
je 0x695b53
push 0xb
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x695c24
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0x454c
je 0x695b77
push 0xb
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x695c24
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0xbc], 0
jne 0x695ba2
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
push 0x714
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x695c24
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0xb8]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 8]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0xc
mov dword [ebp - 0x44], ecx
cmp dword [ebp + 0x10], 0
je 0x695bd3
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
cmp eax, dword [ebp - 0x2c]
jae 0x695be5
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x2c]
mov dword [ecx], edx
push 0x7a
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x695c24
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.006d6da0
add esp, 0xc
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.006d6a60
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00695c32
jmp 0x695c76
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x696630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2414
call fcn.006d70a0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
push 0x7ad508
lea ecx, [ebp - 0x1c14]
call fcn.00686b30
mov ecx, eax
call fcn.00686b60
push eax
lea ecx, [ebp - 0x808]
push ecx
call fcn.006d6ef0
add esp, 0xc
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x808]
push eax
push 0x80000006
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x696781
mov dword [ebp - 0x80c], 0x1000
lea ecx, [ebp - 0x80c]
push ecx
lea edx, [ebp - 0x180c]
push edx
push 0
push 0
push 0x7ad528
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x696777
lea ecx, [ebp - 0x180c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.006d6e00
add esp, 8
mov dword [ebp - 0x1810], 4
lea eax, [ebp - 0x1810]
push eax
lea ecx, [ebp - 0x1814]
push ecx
push 0
push 0
push 0x7ad534
lea ecx, [ebp - 0x2014]
call fcn.00686b30
mov ecx, eax
call fcn.00686b60
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x696777
cmp dword [ebp + 0xc], 0
je 0x69674c
cmp dword [ebp - 0x1814], 0
je 0x69674c
mov eax, dword [ebp - 0x1814]
push eax
push 0x7ad540
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.006d6ef0
add esp, 0xc
jmp 0x696770
push 0x7ad544
lea ecx, [ebp - 0x2414]
call fcn.00686b30
mov ecx, eax
call fcn.00686b60
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.006d6e00
add esp, 8
mov dword [ebp - 4], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x696e40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18f4
call fcn.006d70a0
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
push 0x7ad680
lea ecx, [ebp - 0x18f4]
call fcn.00686b30
mov ecx, eax
call fcn.00686b60
push eax
push 0x80000006
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
je 0x696e8f
xor eax, eax
jmp 0x696f6b
mov dword [ebp - 0xc], 0
mov ecx, 1
test ecx, ecx
je 0x696f5e
mov dword [ebp - 0x14f4], 0xff
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x14f4]
push edx
lea eax, [ebp - 0x14f0]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegEnumKeyExA]
test eax, eax
je 0x696eda
jmp 0x696f5e
lea eax, [ebp - 0x13f0]
push eax
lea ecx, [ebp - 0x14f0]
push ecx
call fcn.00696860
add esp, 8
test eax, eax
je 0x696f50
movsx edx, byte [ebp - 0x1270]
push edx
call fcn.006d89be
add esp, 4
mov esi, eax
movsx eax, byte [ebp + 8]
push eax
call fcn.006d89be
add esp, 4
cmp esi, eax
jne 0x696f50
cmp dword [ebp + 0xc], 0
je 0x696f30
lea ecx, [ebp - 0x14f0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.006d6e00
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x696f47
mov edi, dword [ebp + 0x10]
lea esi, [ebp - 0x13f0]
mov ecx, 0x4f7
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], 1
jmp 0x696f5e
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x696e96
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x698c00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
jmp 0x698c34
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 8]
jae 0x698ca7
cmp dword [ebp + 0x10], 0
je 0x698c71
cmp dword [ebp - 0x14], 1
jbe 0x698c71
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x14]
xor eax, eax
mov al, byte [edx - 2]
cmp eax, 0xff
jne 0x698c71
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx - 1]
cmp edx, 0x15
jne 0x698c71
mov dword [ebp - 0x10], 4
cmp dword [ebp - 0x10], 0
ja 0x698c9c
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
xor edx, dword [ebp - 0xc]
and edx, 0xff
xor eax, dword [edx*4 + 0x7ad8d0]
mov dword [ebp - 0xc], eax
jmp 0x698ca5
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
jmp 0x698c2b
mov ecx, dword [ebp - 0xc]
xor ecx, 0xffffffff
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x698cf0
Capabilities:
Get disk information

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
movsx eax, byte [esi]
push eax
call fcn.006d88c1
add esp, 4
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
mov byte [esp + 0xd], 0x3a
push ecx
mov byte [esp + 0x12], 0x5c
mov byte [esp + 0x13], 0
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
cmp eax, 5
je 0x698d31
pop esi
pop ebp
mov eax, 0x80000800
pop ebx
pop ecx
ret
movsx esi, byte [esi]
xor ebp, ebp
xor edx, edx
mov ecx, 0x7d4620
mov al, byte [ecx]
and eax, 0xff
cmp eax, esi
je 0x698d54
add ecx, 0x7c
inc edx
cmp ecx, 0x7d52b8
jl 0x698d3d
cmp edx, 0x1a
jne 0x698d63
pop esi
pop ebp
mov eax, 0x80000801
pop ebx
pop ecx
ret
mov eax, edx
shl eax, 5
sub eax, edx
lea ebx, [eax*4 + 0x7d4610]
push ebx
call fcn.006991c0
add esp, 4
cmp eax, ebp
jne 0x698e5e
push edi
mov edi, dword [esp + 0x1c]
cmp edi, ebp
je 0x698e30
cmp byte [edi], 0x4d
jne 0x698e30
cmp byte [edi + 1], 0x51
jne 0x698e30
cmp byte [edi + 2], 0x43
jne 0x698e30
cmp byte [edi + 3], 0x44
jne 0x698e30
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x20]
push ebp
push edi
push 0x51272
push ebx
call fcn.006992c0
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x698e56
push 0x12c
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 5
mov dword [esp + 0x18], eax
jl 0x698dba
test esi, esi
jge 0x698e56
mov dword [esp + 0x18], 0
push ebp
push edi
push 0x57a73
push ebx
call fcn.006992c0
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x698e56
push 0x12c
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 5
mov dword [esp + 0x18], eax
jl 0x698df9
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x20]
push ecx
push edi
push ebx
call fcn.00699010
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x698e56
push 0x12c
call dword [sym.imp.kernel32.dll_Sleep]
inc ebp
cmp ebp, 1
jl 0x698e30
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp eax, 0xffffffff
jne 0x698e6d
pop esi
pop ebp
mov eax, 0x80000802
pop ebx
pop ecx
ret
xor edx, edx
cmp eax, 0xfffffffd
setne dl
add edx, 0x80000803
pop esi
pop ebp
mov eax, edx
pop ebx
pop ecx
ret

Function at 0x69a5f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
test edx, edx
je 0x69a627
push ebx
push esi
lea esi, [edx]
mov bl, byte [ecx]
mov edx, eax
xor bl, al
and edx, 0x1ff
mov byte [ecx], bl
xor ebx, ebx
mov bl, ah
mov ax, word [edx*2 + 0x7e1660]
inc ecx
or ax, bx
dec esi
jne 0x69a604
pop esi
pop ebx
ret

Function at 0x69a780
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, 0x7e0c80
add eax, 0xc
push esi
push edi
sub ecx, eax
mov edx, 0x249
mov esi, dword [ecx + eax]
mov edi, dword [eax]
xor edi, esi
mov dword [eax], edi
add eax, 4
dec edx
jne 0x69a795
pop edi
pop esi
ret