joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6623c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x662479
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x104
mov eax, dword [ebp - 8]
add eax, eax
push eax
call fcn.0041009c
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x662455
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.USERENV.DLL_GetAllUsersProfileDirectoryW
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040b294
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0042dddc
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, 0x662494
call fcn.0040b498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66245c
mov eax, dword [ebp - 4]
call fcn.00406f34
pop eax
jmp eax
Function at 0x669eac
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00669b24
mov dword [ebx + 0xc], 0x67452301
mov dword [ebx + 0x10], 0xefcdab89
mov dword [ebx + 0x14], 0x98badcfe
mov dword [ebx + 0x18], 0x10325476
mov dword [ebx + 0x1c], 0xc3d2e1f0
pop ebx
ret

Function at 0x66a100
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
push 0
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x10], 0x11
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x66a348
call fcn.00689358
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 0x14
call fcn.00407ed8
xor edx, edx
push ebp
push 0x66a2ba
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x8000080
push 3
push 0
push 7
push 0x80000000
mov eax, ebx
call fcn.0040b230
push eax
call sub.KERNEL32.DLL_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x66a271
xor eax, eax
push ebp
push 0x66a26a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CreateFileMappingW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x66a251
xor eax, eax
push ebp
push 0x66a24a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov ebx, eax
test ebx, ebx
je 0x66a231
xor eax, eax
push ebp
push 0x66a1fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ecx, eax
mov edx, ebx
mov eax, esi
call fcn.0066a0d8
push ebx
call sub.KERNEL32.DLL_UnmapViewOfFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x66a231
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a251
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a2b0
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CloseHandle
pop eax
jmp eax
xor edx, edx
push ebp
push 0x66a28e
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0042ec2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x66a2b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x66a2dc
push 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 1]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 3]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x3c]
mov ecx, 4
mov eax, 0x66a420
call fcn.00689358
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x686e40
Capabilities:
Create process on windows
Create process suspended
Impersonate user

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
call fcn.00687ab8
test al, al
je 0x686f0c
mov eax, dword [ebx + 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x686e9b
lea eax, [ebp - 8]
push eax
push 0
push 2
mov eax, ebx
mov edx, 2
call fcn.0066a8bc
push eax
mov eax, ebx
mov edx, 1
call fcn.0066a8bc
push eax
mov eax, ebx
xor edx, edx
call fcn.0066a8bc
push eax
call sub.advapi32.dll_LogonUserW
cmp dword [ebp - 8], 0
je 0x686f06
xor eax, eax
push ebp
push 0x686eff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
call fcn.0066a880
push eax
mov eax, dword [ebp + 0x14]
push eax
push edi
push 0
push 0
push 0
mov eax, esi
call fcn.0066a880
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x686f73
lea eax, [ebp - 8]
call fcn.0068739c
pop eax
jmp eax
mov byte [ebp - 1], 0
jmp 0x686f73
mov eax, sub.advapi32.dll_CreateProcessWithLogonW
test eax, eax
je 0x686f6a
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
call fcn.0066a880
push eax
mov eax, dword [ebp + 0x14]
push eax
push edi
mov eax, esi
call fcn.0066a880
push eax
push 0
mov eax, ebx
call fcn.0066a894
push eax
mov eax, ebx
mov edx, 2
call fcn.0066a8bc
push eax
mov eax, ebx
mov edx, 1
call fcn.0066a8bc
push eax
mov eax, ebx
xor edx, edx
call fcn.0066a8bc
push eax
call sub.advapi32.dll_CreateProcessWithLogonW
test eax, eax
jne 0x686f6e
xor eax, eax
jmp 0x686f70
mov al, 1
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x10

Function at 0x686f80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x687011
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x20a
call fcn.00406ee4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x686ff2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathW
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040b294
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.0042dddc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x686ff9
mov eax, dword [ebp - 4]
call fcn.00406f34
pop eax
jmp eax
Function at 0x687140
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [ebp + 8]
add eax, 0xffffffec
push eax
lea eax, [ebp - 4]
push eax
push 0x400
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x687191
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3e5
jne 0x687191
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
sete bl
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x687418
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp], 0xc
mov dword [esp + 8], 0xffffffff
push 0
lea eax, [esp + 4]
push eax
lea eax, [esi + 4]
push eax
push esi
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
je 0x687492
push 0
lea eax, [esp + 4]
push eax
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 8]
push eax
call sub.KERNEL32.DLL_CreatePipe
test eax, eax
je 0x687492
push 0
push 1
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_SetHandleInformation
test eax, eax
je 0x687492
push 0
push 1
mov eax, dword [esi + 0xc]
push eax
call sub.KERNEL32.DLL_SetHandleInformation
test eax, eax
jne 0x687496
xor ebx, ebx
jmp 0x687498
mov bl, 1
test bl, bl
jne 0x6874a3
mov eax, esi
call fcn.006873e8
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x687810
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040a7ac
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 4]
call fcn.0040ac80
mov dword [ebp - 0x10], eax
jmp 0x6878b2
mov eax, dword [ebp - 0x10]
add eax, eax
call fcn.00406f18
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6878ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b230
push eax
call sub.KERNEL32.DLL_QueryDosDeviceW
test eax, eax
jbe 0x68787b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040b294
mov byte [ebp - 0x11], 1
jmp 0x687893
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x7a
jne 0x68788f
mov eax, dword [ebp - 0x10]
add eax, eax
mov dword [ebp - 0x10], eax
jmp 0x687893
mov byte [ebp - 0x11], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6878b2
mov eax, dword [ebp - 0xc]
call fcn.00406f34
pop eax
jmp eax
cmp byte [ebp - 0x11], 0
je 0x687835
mov esp, ebp
pop ebp
ret

Function at 0x6879c0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 8]
add eax, eax
call fcn.00406ee4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x687a1a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040b294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x687a21
mov eax, dword [ebp - 4]
call fcn.00406f34
pop eax
jmp eax

Function at 0x687a28
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a7ac
mov dword [ebp - 8], 0x40
mov eax, dword [ebp - 8]
add eax, eax
call fcn.00406ee4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x687aad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x687a7e
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.0040b294
call fcn.00409f98
jmp 0x687ab4
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x7a
jne 0x687a8e
add dword [ebp - 8], 0x40
jmp 0x687a95
call fcn.00409f98
jmp 0x687ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x687a40
mov eax, dword [ebp - 0xc]
call fcn.00406f34
pop eax
jmp eax
mov esp, ebp
pop ebp
ret
Function at 0x687b20
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a7ac
mov dword [ebp - 8], 0x40
mov eax, dword [ebp - 8]
add eax, eax
call fcn.00406ee4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x687ba9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0xc
call sub.secur32.dll_GetUserNameExW
test eax, eax
je 0x687b78
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.0040b294
call fcn.00409f98
jmp 0x687bb0
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xea
jne 0x687b8a
add dword [ebp - 8], 0x40
jmp 0x687b91
call fcn.00409f98
jmp 0x687bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x687b38
mov eax, dword [ebp - 0xc]
call fcn.00406f34
pop eax
jmp eax
mov esp, ebp
pop ebp
ret
Function at 0x689cc8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0040a7ac
lea eax, [ebp - 0x20a]
xor ecx, ecx
mov edx, 0x105
call fcn.00407ed8
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryW
mov ebx, eax
test ebx, ebx
jbe 0x689d26
mov eax, esi
mov edx, ebx
call fcn.0040b3c0
mov eax, esi
call fcn.0040ad48
mov edx, eax
mov ecx, ebx
add ecx, ecx
lea eax, [ebp - 0x20a]
call fcn.004070dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6bd340
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040a7ac
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x6bd371
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040a934
add esp, 0x24
pop ebx
ret
Function at 0x6c0984
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
xor edx, edx
push ebp
push 0x6c0a78
push dword fs:[edx]
mov dword fs:[edx], esp
movzx ebx, al
add ebx, 0x41
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040b254
lea eax, [ebp - 4]
mov edx, 0x6c0a90
call fcn.0040b440
mov eax, dword [ebp - 4]
call fcn.0040b230
push eax
call sub.KERNEL32.DLL_GetDriveTypeW
cmp eax, 6
ja case.default.0x6c09cf
jmp dword [eax*4 + 0x6c09d6]
mov eax, esi
mov edx, 0x6c0aa4
call fcn.0040ab8c
jmp 0x6c0a60
mov eax, esi
mov edx, 0x6c0ab4
call fcn.0040ab8c
jmp 0x6c0a60
mov eax, esi
mov edx, 0x6c0aec
call fcn.0040ab8c
jmp 0x6c0a60
mov eax, esi
mov edx, 0x6c0b0c
call fcn.0040ab8c
jmp 0x6c0a60
mov eax, esi
mov edx, 0x6c0b24
call fcn.0040ab8c
jmp 0x6c0a60
mov eax, esi
mov edx, 0x6c0b40
call fcn.0040ab8c
jmp 0x6c0a60
mov eax, esi
mov edx, 0x6c0b5c
call fcn.0040ab8c
jmp 0x6c0a60
mov eax, esi
mov edx, 0x6c0b78
call fcn.0040ab8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c0a7f
lea eax, [ebp - 4]
call fcn.0040a7ac
pop eax
jmp eax
Function at 0x6c0c18
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a890
lea edi, [ebp - 0x420]
xor eax, eax
push ebp
push 0x6c0e28
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, edi
lea edi, [ebp - 0x216]
xor eax, eax
mov ecx, 0x82
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, edx
mov edx, edi
xor eax, eax
mov ecx, 0x82
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, edx
mov eax, dword [ebp - 0xc]
call fcn.0040a7ac
push 0x105
push edi
call sub.KERNEL32.DLL_FindFirstVolumeW
mov esi, eax
cmp esi, 0xffffffff
je 0x6c0dfb
lea eax, [ebp - 0x424]
mov edx, edi
mov ecx, 0x105
call fcn.0040b2e8
mov eax, dword [ebp - 0x424]
call fcn.0040ac80
mov ebx, eax
dec ebx
test ebx, ebx
je 0x6c0df5
lea eax, [ebp - 0x428]
mov edx, edi
mov ecx, 0x105
call fcn.0040b2e8
mov edx, dword [ebp - 0x428]
mov ecx, 1
mov eax, 0x6c0e44
call fcn.0040b764
dec eax
jne 0x6c0df5
cmp word [edi + ebx*2], 0x5c
jne 0x6c0df5
mov word [edi + ebx*2], 0
push 0x105
lea eax, [ebp - 0x216]
push eax
lea eax, [edi + 8]
push eax
call sub.KERNEL32.DLL_QueryDosDeviceW
test eax, eax
je 0x6c0df5
lea eax, [ebp - 0x216]
call fcn.00425490
cmp eax, 1
jbe 0x6c0df5
lea eax, [ebp - 0x216]
call fcn.00425490
mov word [ebp + eax*2 - 0x216], 0x5c
lea eax, [ebp - 0x42c]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.0040b2e8
mov eax, dword [ebp - 0x42c]
mov ecx, 1
mov edx, dword [ebp - 4]
call fcn.0040b764
test eax, eax
jle 0x6c0de1
mov word [edi + ebx*2], 0x5c
lea edx, [ebp - 0x430]
mov eax, edi
call fcn.006c0b88
mov eax, dword [ebp - 0x430]
lea edx, [ebp - 8]
call fcn.0042dddc
cmp dword [ebp - 8], 0
je 0x6c0df5
movzx eax, byte [0x6c0e50]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x434]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.0040b2e8
mov edx, dword [ebp - 0x434]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0042e228
jmp 0x6c0df5
push 0x105
push edi
push esi
call sub.KERNEL32.DLL_FindNextVolumeW
test eax, eax
jne 0x6c0cab
push esi
call sub.KERNEL32.DLL_FindVolumeClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c0e2f
lea eax, [ebp - 0x434]
mov edx, 5
call fcn.0040a80c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a80c
pop eax
jmp eax
Function at 0x6c27e4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a890
xor eax, eax
push ebp
push 0x6c28ab
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0x6c28c8
call fcn.00689418
xor eax, eax
push ebp
push 0x6c2862
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040b230
push eax
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x6c2856
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
push esi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x6c2858
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6c286e
push 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov dword [ebp - 0xc], ebx
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6c2920
call fcn.00689358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c28b2
lea eax, [ebp - 4]
call fcn.0040a7ac
pop eax
jmp eax
Function at 0x6cc2ec
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6cc31a
mov eax, ebx
call fcn.006ccda8
cmp dword [ebx + 0x40], 0
je 0x6cc313
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x6cc38b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x6cc37d
cmp dword [ebx + 8], 0
je 0x6cc33c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x6cc34e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x6cc37d
cmp dword [ebx + 8], 0
je 0x6cc32f
cmp eax, 3
je 0x6cc361
dec eax
jne 0x6cc32f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6cc32f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6cc32f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x6cc3a9
cmp dword [ebx + 0x14], 0xcc
je 0x6cc3a9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.006cc3b4
pop ebx
ret

Function at 0x6e4954
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, eax
push 0
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0x11
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x6e4a98
call fcn.00689358
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov dl, 1
mov eax, ebx
call fcn.00426b14
test al, al
je 0x6e4a65
xor edx, edx
push ebp
push 0x6e4a5e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x8000000
push 3
push 0
push 0
push 0x80000000
mov eax, ebx
call fcn.0040b230
push eax
call sub.KERNEL32.DLL_CreateFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x6e4a3f
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 4
jbe 0x6e4a3f
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 0xc], 4
jne 0x6e4a3f
movzx eax, word [ebp - 8]
mov edx, dword [ebp - 8]
sub edx, 0xe0ffd8ff
je 0x6e4a29
sub edx, 0x57467048
je 0x6e4a17
sub edx, 0xf080742
je 0x6e4a20
jmp 0x6e4a32
mov dword [ebp - 4], 3
jmp 0x6e4a3f
mov dword [ebp - 4], 2
jmp 0x6e4a3f
mov dword [ebp - 4], 1
jmp 0x6e4a3f
cmp ax, 0x4d42
jne 0x6e4a3f
mov dword [ebp - 4], 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e4a65
cmp dword [ebp - 0x10], 0xffffffff
je 0x6e4a5b
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
pop eax
jmp eax
push 0
mov eax, dword [ebp - 4]
movsx eax, al
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x6e4adc
call fcn.00689358
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x703654
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x703702
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x7036e0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0040ac80
mov edx, eax
add edx, 2
lea eax, [ebp - 4]
call fcn.0040b3c0
mov eax, dword [ebp - 4]
call fcn.0040ac80
push eax
lea eax, [ebp - 4]
call fcn.0040ad48
push eax
push ebx
call sub.user32.dll_GetWindowTextW
cmp eax, 1
jle 0x7036d6
mov edx, eax
dec edx
lea eax, [ebp - 4]
call fcn.0040b3c0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
call fcn.0040b5d0
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7036ea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x703709
lea eax, [ebp - 4]
call fcn.0040a7ac
pop eax
jmp eax