joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61b300
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x61b323
xor eax, eax
jne 0x61b323
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp esi, esp
call fcn.00673bc2
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 4

Function at 0x61b810
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x338]
mov ecx, 0xce
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
push 0
lea ecx, [ebp - 0x20]
call fcn.0061afe0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0061b620
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x61b88b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x334], eax
lea ecx, [ebp - 0x20]
call fcn.0061b030
mov eax, dword [ebp - 0x334]
jmp 0x61b922
mov dword [ebp - 0x48], 0x100
mov esi, esp
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x250]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp esi, esp
call fcn.00673bc2
test eax, eax
jne 0x61b8fa
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x20]
call fcn.0061b810
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x61b8f1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x328], eax
lea ecx, [ebp - 0x20]
call fcn.0061b030
mov eax, dword [ebp - 0x328]
jmp 0x61b922
mov dword [ebp - 0x48], 0x100
jmp 0x61b892
lea ecx, [ebp - 0x20]
call fcn.0061b360
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.0061b120
mov dword [ebp - 0x31c], eax
lea ecx, [ebp - 0x20]
call fcn.0061b030
mov eax, dword [ebp - 0x31c]
push edx
mov ecx, ebp
push eax
lea edx, [0x61b954]
call fcn.00673be5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x338
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 4
Function at 0x61c010
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x61c033
xor eax, eax
jne 0x61c033
mov esi, esp
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.00673bc2
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 8

Function at 0x61c080
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x61c0a3
xor eax, eax
jne 0x61c0a3
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x61c0c4
mov eax, 0xd
jmp 0x61c103
xor eax, eax
jne 0x61c0ab
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00673bc2
lea ecx, [eax + eax + 2]
mov esi, esp
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.00673bc2
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 0xc

Function at 0x61c120
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x61c143
xor eax, eax
jne 0x61c143
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x61c164
mov eax, 0xd
jmp 0x61c1d1
xor eax, eax
jne 0x61c14b
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00673bc2
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x2c], 1
jne 0x61c175
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.00673bc2
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 8
Function at 0x624fc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6903f3
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1cc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x1dc]
mov ecx, 0x73
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
call fcn.00606520
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x58]
call fcn.00627f90
mov dword [ebp - 4], 0
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, esp
call fcn.00673bc2
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov esi, esp
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0xf0]
call fcn.00627f90
mov byte [ebp - 4], 1
cmp dword [ebp - 0x64], 0
jle 0x625139
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x64]
add eax, 1
push eax
lea ecx, [ebp - 0xf0]
call fcn.00627550
jmp 0x625094
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xf0]
call fcn.00612bb0
test eax, eax
jne 0x6250dd
mov dword [ebp - 0x1d4], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf0]
call fcn.006271d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00626b00
mov eax, dword [ebp - 0x1d4]
jmp 0x6251b5
mov eax, dword [ebp - 0x64]
add eax, 1
mov esi, esp
push eax
lea ecx, [ebp - 0xf0]
call fcn.00612bb0
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, esp
call fcn.00673bc2
test eax, eax
jne 0x625139
mov dword [ebp - 0x1c8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf0]
call fcn.006271d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00626b00
mov eax, dword [ebp - 0x1c8]
jmp 0x6251b5
lea ecx, [ebp - 0xf0]
call fcn.00612bb0
push eax
call fcn.00651f00
add esp, 4
mov esi, esp
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp esi, esp
call fcn.00673bc2
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 0x64], 0
jne 0x625174
mov dword [ebp - 0x1dc], 0
jmp 0x625185
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax], 0
setne cl
mov dword [ebp - 0x1dc], ecx
mov edx, dword [ebp - 0x1dc]
mov dword [ebp - 0x1bc], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf0]
call fcn.006271d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00626b00
mov eax, dword [ebp - 0x1bc]
push edx
mov ecx, ebp
push eax
lea edx, [0x6251f4]
call fcn.00673be5
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x1dc
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 4
Function at 0x632480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
lea edi, [ebp - 0x12c]
mov ecx, 0x4b
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
call fcn.006256f0
call fcn.0065f220
mov dword [ebp - 8], eax
push 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00632940
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x632643
push 0xf0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00632940
add esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], 0
cmp dword [ebp - 0x20], 0
je 0x63252e
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x2c], eax
xor eax, eax
jne 0x632510
xor eax, eax
jne 0x632510
mov esi, esp
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x632618
mov esi, esp
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x632604
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.00632660
add esp, 8
mov dword [ebp - 0x68], eax
mov esi, esp
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00632990
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x6325d7
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x5c]
je 0x632602
mov esi, esp
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
cmp esi, esp
call fcn.00673bc2
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, esp
call fcn.00673bc2
jmp 0x632616
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x44], eax
jmp 0x63262a
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x632643
mov esi, esp
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, esp
call fcn.00673bc2
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0x12c
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret
Function at 0x634a80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
push ebx
push esi
push edi
lea edi, [ebp - 0x37c]
mov ecx, 0xdf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [0x6ac2f0], eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.00651f00
add esp, 4
push eax
lea ecx, [ebp - 0x234]
call fcn.00640670
push str.vqFc7e65pYxexuGmjZJs3fq7kKNU0L4
push 0x6621
call fcn.00655c40
add esp, 8
push eax
push 0
mov ecx, 0x6ac2f8
call fcn.006709e0
push 1
mov ecx, 0x6ac2f8
call fcn.006708a0
mov dword [ebp - 0x240], eax
push 0x626a
push 0x156f
push str.uKB64fyhppJhuG8l6o
push 0x1be5
call fcn.00655c40
add esp, 0x10
mov esi, esp
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
cmp esi, esp
call fcn.00673bc2
mov dword [0x6ac2f4], eax
cmp dword [ebp - 0x240], 0
je 0x634bde
push 0x6cab
push 0x6452
push str.i6hH_fa7mLs
push 0x4768
call fcn.00655c40
add esp, 0x10
push eax
call fcn.00640a10
add esp, 4
movzx eax, al
test eax, eax
je 0x634bde
lea ecx, [ebp - 0x264]
call fcn.00603500
lea eax, [ebp - 0x264]
push eax
push str.retrynav
call fcn.00640840
add esp, 8
mov dword [ebp - 0x270], 0
mov esi, esp
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00673bc2
mov eax, dword [ebp - 0x270]
add eax, 1
mov dword [ebp - 0x270], eax
push 1
mov ecx, 0x6ac2f8
call fcn.006708a0
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x634bd3
cmp dword [ebp - 0x270], 0xa
jl 0x634b8c
lea ecx, [ebp - 0x264]
call fcn.006038c0
cmp dword [ebp - 0x240], 0
je 0x634c25
mov esi, esp
push 0
push 0
mov eax, dword [0x6ac2f4]
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x354], 3
lea ecx, [ebp - 0x234]
call fcn.006407d0
mov eax, dword [ebp - 0x354]
jmp 0x634d1b
push 0x6b79
push 0x2898
push str.3Jl2wt_wpaxe5uO6nuNH9_s
push 0x6553
call fcn.00655c40
add esp, 0x10
push eax
call fcn.00654180
add esp, 4
push 1
lea eax, [ebp - 0x378]
push eax
call fcn.00640ae0
add esp, 8
mov ecx, eax
call fcn.00603950
push eax
call fcn.006543b0
add esp, 4
lea ecx, [ebp - 0x378]
call fcn.006038c0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, 0x6ac308
call fcn.00634dd0
mov dword [ebp - 0x27c], eax
push 0
mov ecx, 0x6ac300
call fcn.00634d80
mov eax, dword [eax]
mov dword [0x6ac2fc], eax
mov ecx, dword [0x6ac2fc]
mov dword [0x6ac2f8], ecx
mov eax, dword [ebp - 0x27c]
push eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.00673bc2
push eax
push 0x4e60
push 0x41da
push str.tKxa4ahkb9W7uv13KkT6uGxnKkTquvf
push 0x6762
call fcn.00655b80
add esp, 0x10
push eax
call fcn.00654400
add esp, 0xc
call fcn.006545c0
mov esi, esp
mov eax, dword [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edx
mov ecx, ebp
push eax
lea edx, [0x634d4c]
call fcn.00673be5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x37c
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x636ce0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov esi, esp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp esi, esp
call fcn.00673bc2
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x30], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x30], 0
jne 0x636d2d
xor eax, eax
jmp 0x636d71
mov esi, esp
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x637710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x636d6e
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00673bc2
mov eax, dword [ebp - 0x20]
push edx
mov ecx, ebp
push eax
lea edx, [0x636d98]
call fcn.00673be5
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret

Function at 0x640670
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x690e9b
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xfc]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x6aac14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00603500
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [0x6ac36c], eax
mov esi, esp
push 0x104
mov eax, dword [ebp - 0x14]
add eax, 0x24
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.00673bc2
cmp dword [ebp + 8], 0
jne 0x640701
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.006035a0
mov byte [ebp - 0xf5], 0x20
lea eax, [ebp - 0xf5]
push eax
push 0x640610
lea ecx, [ebp - 0xec]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00640cf0
mov edx, dword [eax]
push edx
lea eax, [ebp - 0xe0]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00640c90
mov ecx, dword [eax]
push ecx
call fcn.00640d50
add esp, 0x10
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.0065b790
movzx eax, al
test eax, eax
jne 0x64079f
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00603950
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, esp
call fcn.00673bc2
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 4
Function at 0x654400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4158
call fcn.00673e40
push ebx
push esi
push edi
lea edi, [ebp - 0x4158]
mov ecx, 0x1056
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x6ac550]
test eax, eax
je 0x654442
movzx eax, byte [0x6ac551]
test eax, eax
jne 0x654447
jmp 0x65453b
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x3fff
lea edx, [ebp - 0x4014]
push edx
call fcn.00654620
add esp, 0x10
mov dword [ebp - 0x4020], eax
cmp dword [ebp - 0x4020], 0
jle 0x65453b
cmp dword [0x6ac554], 0
je 0x65451f
lea eax, [ebp - 0x4030]
push eax
call fcn.00649000
add esp, 4
lea eax, [ebp - 0x4030]
push eax
call fcn.00626890
add esp, 4
mov dword [ebp - 0x403c], eax
mov eax, dword [ebp - 0x403c]
push eax
push str._Y__m__d__H:_M:_S
push 0x50
lea ecx, [ebp - 0x4094]
push ecx
call fcn.00678772
add esp, 0x10
mov eax, dword [0x6ac554]
push eax
lea ecx, [ebp - 0x4094]
push ecx
call fcn.00674370
add esp, 4
push eax
push 1
lea edx, [ebp - 0x4094]
push edx
call fcn.006741c6
add esp, 0x10
mov eax, dword [0x6ac554]
push eax
mov ecx, dword [ebp - 0x4020]
push ecx
push 1
lea edx, [ebp - 0x4014]
push edx
call fcn.006741c6
add esp, 0x10
mov eax, dword [0x6ac554]
push eax
call fcn.00677cdd
add esp, 4
jmp 0x65453b
mov esi, esp
lea eax, [ebp - 0x4014]
push eax
push 0x1f
call fcn.0066fb20
add esp, 4
call eax
cmp esi, esp
call fcn.00673bc2
push edx
mov ecx, ebp
push eax
lea edx, [0x65456c]
call fcn.00673be5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x4158
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret
Function at 0x65440f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4158
call fcn.00673e40
push ebx
push esi
push edi
lea edi, [ebp - 0x4158]
mov ecx, 0x1056
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x6ac550]
test eax, eax
je 0x654442
movzx eax, byte [0x6ac551]
test eax, eax
jne 0x654447
jmp 0x65453b
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x3fff
lea edx, [ebp - 0x4014]
push edx
call fcn.00654620
add esp, 0x10
mov dword [ebp - 0x4020], eax
cmp dword [ebp - 0x4020], 0
jle 0x65453b
cmp dword [0x6ac554], 0
je 0x65451f
lea eax, [ebp - 0x4030]
push eax
call fcn.00649000
add esp, 4
lea eax, [ebp - 0x4030]
push eax
call fcn.00626890
add esp, 4
mov dword [ebp - 0x403c], eax
mov eax, dword [ebp - 0x403c]
push eax
push str._Y__m__d__H:_M:_S
push 0x50
lea ecx, [ebp - 0x4094]
push ecx
call fcn.00678772
add esp, 0x10
mov eax, dword [0x6ac554]
push eax
lea ecx, [ebp - 0x4094]
push ecx
call fcn.00674370
add esp, 4
push eax
push 1
lea edx, [ebp - 0x4094]
push edx
call fcn.006741c6
add esp, 0x10
mov eax, dword [0x6ac554]
push eax
mov ecx, dword [ebp - 0x4020]
push ecx
push 1
lea edx, [ebp - 0x4014]
push edx
call fcn.006741c6
add esp, 0x10
mov eax, dword [0x6ac554]
push eax
call fcn.00677cdd
add esp, 4
jmp 0x65453b
mov esi, esp
lea eax, [ebp - 0x4014]
push eax
push 0x1f
call fcn.0066fb20
add esp, 4
call eax
cmp esi, esp
call fcn.00673bc2
push edx
mov ecx, ebp
push eax
lea edx, [0x65456c]
call fcn.00673be5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x4158
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret
Function at 0x6546c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf4]
mov ecx, 0x3d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x68]
test ecx, ecx
je 0x6546f3
jmp 0x6547ec
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
shr ecx, 3
and ecx, 0x3f
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 0xc]
shl eax, 3
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
add edx, eax
mov dword [ebp - 0xf4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xf4]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp + 0xc]
shl edx, 3
cmp dword [ebp - 0xf4], edx
jae 0x65473f
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], ecx
mov eax, dword [ebp + 0xc]
shr eax, 0x1d
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x14]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, 0x40
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jb 0x6547c4
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x18]
push ecx
call fcn.00674400
add esp, 0xc
mov eax, dword [ebp - 8]
add eax, 0x18
push eax
mov ecx, dword [ebp - 8]
call fcn.006549b0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
jmp 0x65479f
mov eax, dword [ebp - 0x14]
add eax, 0x40
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 0x3f
cmp eax, dword [ebp + 0xc]
jae 0x6547bb
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
call fcn.006549b0
jmp 0x654796
mov dword [ebp - 0x20], 0
jmp 0x6547cb
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x18]
push ecx
call fcn.00674400
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0xf4
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 8

Function at 0x654940
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov byte [eax + 0x68], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0x10325476
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret