joyce8/EMBER2024-capa huggingface dataset:
Function at 0x645b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x695498
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x74f330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.TEXTFILE
mov dword [ebp - 0x10], 0
mov eax, dword [esi + 0x28]
push str.THEMES_INI
push eax
call dword [0x69b4b0]
test eax, eax
jne 0x645b88
mov esi, dword [ebp + 8]
push 0x69c5b8
mov ecx, esi
call fcn.00401b65
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x28]
push eax
push ecx
call dword [0x69b338]
test eax, eax
je 0x645b65
push eax
call dword [0x69b334]
push str._File.
push eax
call fcn.00676395
mov esi, eax
add esp, 8
test esi, esi
je 0x645b65
push 0x5d
push esi
call fcn.0067636e
sub eax, esi
sar eax, 1
sub eax, 6
push eax
add esi, 0xc
lea edx, [ebp - 0x10]
push esi
push edx
call fcn.00645700
mov esi, dword [ebp + 8]
push str._ini
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 4], 0
call fcn.00405bb5
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x645c11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x648640
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov dword [esi + 0x5c], ecx
lea ecx, [esi + 0xc]
push 0x32
push ecx
mov dword [esi], vtable.CXTPSkinManagerApiFunction.0
mov dword [esi + 8], 0
mov dword [esi + 0x60], edx
call fcn.005be1e2
mov edx, dword [ebp + 0x10]
push edx
lea eax, [esi + 0x3e]
push 0x1e
push eax
call fcn.005be1e2
add esp, 0x18
cmp dword [0x76c5d4], 0
jne 0x64869c
call fcn.004c05f5
mov dword [0x76c5d4], eax
mov ecx, dword [0x76c5d0]
test ecx, ecx
jne 0x6486b9
lea ecx, [ebp - 0x24]
push ecx
call dword [0x69b538]
mov ecx, dword [ebp - 0x18]
mov dword [0x76c5d0], ecx
mov eax, dword [esi + 0x5c]
cmp eax, ecx
jbe 0x6486cb
cmp byte [eax], 0x68
jne 0x6486cb
mov edx, dword [eax + 1]
mov dword [esi + 0x5c], edx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x657920
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
push eax
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0
call dword [0x69b564]
lea ecx, [ebp - 4]
push ecx
push 4
push esi
push 0x6578a0
push 0
push 0
call dword [0x69b4cc]
mov dword [esi + 0xc], eax
test eax, eax
je 0x65796f
push 0xffffffffffffffff
push eax
call dword [0x69b4d8]
mov edx, dword [esi + 0xc]
push edx
call dword [0x69b468]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x657980
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0xc], edi
je 0x657a06
mov eax, dword [esi + 0x14]
push ebx
push eax
mov dword [esi + 0x10], 1
call dword [0x69b568]
mov edx, dword [esi + 0xc]
mov ebx, dword [0x69b4d4]
lea ecx, [ebp - 4]
push ecx
push edx
mov dword [ebp - 4], edi
call ebx
test eax, eax
je 0x6579f4
jmp 0x6579c0
cmp dword [ebp - 4], 0x103
jne 0x6579f4
mov eax, dword [esi + 0xc]
inc edi
cmp edi, 0xa
ja 0x6579eb
push 0x64
push eax
call dword [0x69b570]
mov edx, dword [esi + 0xc]
lea ecx, [ebp - 4]
push ecx
push edx
call ebx
test eax, eax
jne 0x6579c0
jmp 0x6579f4
push 0
push eax
call dword [0x69b4d0]
mov ecx, dword [esi + 0xc]
push ecx
call dword [0x69b31c]
mov dword [esi + 0xc], 0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x65a1b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
cmp dword [ebx + 0x104], 0
push esi
push edi
je 0x65a1c9
call fcn.00659c50
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
mov dword [ebp - 4], ecx
push edx
mov ecx, ebx
mov dword [ebp - 8], eax
call fcn.006581e0
xor esi, esi
lea edi, [ebx + 0x114]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push eax
push ecx
push edi
mov ecx, ebx
call fcn.00668460
test eax, eax
jne 0x65a22c
inc esi
add edi, 0x60
cmp esi, 2
jl 0x65a1e8
mov eax, dword [ebp + 8]
cmp eax, 9
je 0x65a223
cmp eax, 8
je 0x65a223
cmp eax, 0x14
je 0x65a223
cmp eax, 0x15
je 0x65a223
mov ecx, ebx
call fcn.004bf260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x10
call dword [0x69b8d0]
mov ecx, dword [ebp - 8]
xor edx, edx
test ax, ax
mov eax, dword [ebp - 4]
sets dl
push edx
push edi
push eax
push ecx
mov ecx, ebx
call fcn.00668f70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x666060
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x74f330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x214]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
test bl, bl
js 0x666151
push edi
mov edi, ebx
and edi, 2
call fcn.006446f0
mov edx, dword [esi + 0x20]
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x419
push edx
mov dword [ebp - 0x20], eax
call dword [0x69ba48]
mov esi, edi
neg esi
sbb esi, esi
and esi, 3
add esi, 3
test bl, 8
jne 0x6660dd
test edi, edi
jne 0x6660d0
and ebx, 4
or ebx, 0x10
shr ebx, 2
mov esi, ebx
jmp 0x6660dd
and bl, 4
movzx esi, bl
neg esi
sbb esi, esi
add esi, 8
mov ebx, dword [ebp - 0x18]
cmp dword [ebx + 0x218], 0
mov edi, 1
je 0x6660f3
mov edi, 2
call dword [0x69b7c4]
cmp eax, dword [ebx + 0x20]
jne 0x666105
mov edi, 3
jmp 0x66612e
mov ebx, dword [ebx + 0x20]
call dword [0x69b988]
cmp eax, ebx
jne 0x66612b
push 0
push 0
push 0x129
push ebx
call dword [0x69ba48]
test al, 1
jne 0x66612b
mov edi, 4
mov ebx, dword [ebp - 0x18]
mov ecx, ebx
call fcn.004bbdec
test eax, eax
jne 0x66613e
mov edi, 5
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.006416d0
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005b851f
mov esp, ebp
pop ebp
ret 4

Function at 0x6665f0
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x74f330]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
push eax
push 0
mov esi, ecx
mov ecx, dword [esi + 0x20]
push 0x419
push ecx
call dword [0x69ba48]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x14]
push ecx
call dword [0x69b8e0]
cmp eax, dword [esi + 0x218]
je 0x666674
mov edx, dword [esi + 0x20]
push 0
push 0
push edx
mov dword [esi + 0x218], eax
call dword [0x69b9ec]
cmp dword [esi + 0x218], 0
je 0x666674
mov eax, dword [esi + 0x20]
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x10
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xffffffff
call dword [0x69b0ac]
mov ecx, esi
call fcn.004bf260
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005b851f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x668c10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 0x110]
test esi, esi
je 0x668c9d
mov eax, dword [ebp + 8]
shr eax, 8
push edi
mov edi, dword [esi + 0x44]
cmp al, 2
jne 0x668c9c
test edi, edi
je 0x668c9c
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
lea eax, [esi + 8]
push eax
call dword [0x69b8e0]
test eax, eax
jne 0x668c4e
mov eax, dword [edi + 0x2c]
jmp 0x668c6f
cmp dword [esi + 4], 0
mov ecx, dword [ebp + 0x10]
jne 0x668c5a
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add eax, ecx
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jl 0x668c6d
add ecx, dword [edi + 0x38]
cmp eax, ecx
jl 0x668c6f
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00668b70
cmp dword [ebp + 8], 0x202
mov dword [esi], 1
je 0x668c93
push 1
call dword [0x69b8d0]
test ax, ax
js 0x668c9c
push 0
mov ecx, ebx
call fcn.00668ae0
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x66ac40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x696a88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x74f330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0066c840
add esp, 8
test eax, eax
je 0x66ac9c
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.0066f840
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push edi
push esi
call dword [0x69b4b0]
mov ebx, eax
test ebx, ebx
je 0x66ad5f
push ebx
push esi
call dword [0x69b338]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x66ad5f
push eax
call dword [0x69b334]
mov edi, eax
test edi, edi
je 0x66ad5f
movzx eax, word [edi + 0xe]
mov edx, dword [ebp + 0x10]
mov esi, eax
imul esi, dword [edi + 4]
add esi, 0x1f
sar esi, 3
and esi, 0xfffffffc
imul esi, dword [edi + 8]
xor ecx, ecx
cmp eax, 0x20
mov eax, dword [ebp + 8]
sete cl
push ebx
push eax
mov dword [ebp - 0x10], 0
mov dword [edx], ecx
call dword [0x69b330]
lea ecx, [esi + 0x28]
cmp eax, ecx
jb 0x66adfc
lea ecx, [ebp - 0x2c]
call fcn.004baa88
push 0
mov dword [ebp - 4], 0
call dword [0x69b238]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004bb05a
cmp word [edi + 0xe], 0x18
jb 0x66adcd
push 0x34
call fcn.005b7f13
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x66ad73
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004bb0db
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x28
push edi
push 0x28
push ebx
call fcn.005b7fe1
add esp, 0x10
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
mov dword [ebx + 0x14], esi
mov eax, dword [ebp - 0x28]
push ebx
push eax
mov dword [ebp - 0x14], 0
call dword [0x69b294]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x66adc2
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x66adc2
push esi
add edi, 0x28
push edi
push eax
call fcn.00655420
mov ecx, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x10], ecx
push ebx
call fcn.005b7fa7
add esp, 4
jmp 0x66aded
push edi
call fcn.0066a3c0
mov esi, eax
push esi
push edi
call fcn.0066a470
add esp, 0xc
mov dword [ebp - 0x10], eax
test esi, esi
je 0x66aded
push esi
call dword [0x69b248]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004bb0db
mov edx, dword [ebp - 0x1c]
push edx
call dword [0x69b4b4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x66b8f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call dword [0x69b860]
mov esi, eax
test esi, esi
jns 0x66b910
push 0x80070057
call fcn.004012e4
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, esi
or ecx, edx
jge 0x66b92e
push esi
mov ecx, edi
call fcn.0040162e
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x66b906
mov dword [eax - 0xc], esi
mov ecx, dword [edi]
mov byte [esi + ecx], 0
inc esi
push esi
push eax
push ebx
call dword [0x69b900]
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x66b95f
push ecx
push eax
call fcn.005b8b3a
add esp, 8
test eax, eax
js 0x66b906
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x66b906
mov dword [ecx - 0xc], eax
mov edx, dword [edi]
pop edi
pop esi
mov byte [eax + edx], 0
pop ebx
pop ebp
ret

Function at 0x66c6c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x74f330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [0x69b314]
mov esi, eax
cmp esi, 0xffffffff
jne 0x66c705
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b851f
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [0x69b320]
push 0
lea eax, [ebp - 0x40]
push eax
push 0xe
lea ecx, [ebp - 0x14]
push ecx
push esi
call edi
test eax, eax
je 0x66c763
cmp dword [ebp - 0x40], 0xe
jne 0x66c763
push 0
lea edx, [ebp - 0x40]
push edx
push 0x28
lea eax, [ebp - 0x3c]
push eax
push esi
call edi
test eax, eax
je 0x66c763
cmp dword [ebp - 0x40], 0x28
jne 0x66c763
xor ecx, ecx
cmp word [ebp - 0x2e], 0x20
push esi
sete cl
mov edi, ecx
call dword [0x69b31c]
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b851f
mov esp, ebp
pop ebp
ret
push esi
call dword [0x69b31c]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.005b851f
mov esp, ebp
pop ebp
ret

Function at 0x66c780
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [0x69b314]
mov edi, eax
cmp edi, 0xffffffff
je 0x66c837
push 0
lea ecx, [ebp - 0xc]
push ecx
push 4
lea edx, [ebp - 8]
push edx
push edi
mov dword [ebp - 4], 0x474e5089
call dword [0x69b320]
test eax, eax
je 0x66c830
cmp dword [ebp - 0xc], 4
jne 0x66c830
mov eax, dword [ebp - 8]
push esi
cmp eax, dword [ebp - 4]
je 0x66c800
movzx esi, al
sub esi, 0x89
jne 0x66c816
movzx esi, ah
sub esi, 0x50
jne 0x66c816
movzx esi, byte [ebp - 6]
sub esi, 0x4e
jne 0x66c816
movzx esi, byte [ebp - 5]
sub esi, 0x47
jne 0x66c816
push edi
xor esi, esi
call dword [0x69b31c]
xor eax, eax
test esi, esi
pop esi
sete al
pop edi
mov esp, ebp
pop ebp
ret
sar esi, 0x1f
push edi
or esi, 1
call dword [0x69b31c]
xor eax, eax
test esi, esi
pop esi
sete al
pop edi
mov esp, ebp
pop ebp
ret
push edi
call dword [0x69b31c]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x66c8f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 2
push eax
push esi
call dword [0x69b4b0]
test eax, eax
jne 0x66c90d
xor eax, eax
pop esi
pop ebp
ret
push eax
push esi
call dword [0x69b338]
mov esi, eax
test esi, esi
je 0x66c908
push esi
call dword [0x69b334]
test eax, eax
je 0x66c908
xor ecx, ecx
cmp word [eax + 0xe], 0x20
push edi
sete cl
push esi
mov edi, ecx
call dword [0x69b4b4]
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x66cf40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x696a88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x74f330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 2
push eax
push esi
call dword [0x69b4b0]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x66d01a
push eax
push esi
call dword [0x69b338]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x66d01a
push ebx
call dword [0x69b334]
mov edi, eax
test edi, edi
je 0x66d01a
mov esi, dword [edi + 8]
imul esi, dword [edi + 4]
add esi, esi
add esi, esi
cmp word [edi + 0xe], 0x20
mov dword [ebp - 0x14], 0
jne 0x66d098
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [0x69b330]
lea ecx, [esi + 0x28]
cmp eax, ecx
jb 0x66d098
lea ecx, [ebp - 0x2c]
call fcn.004baa88
push 0
mov dword [ebp - 4], 0
call dword [0x69b238]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004bb05a
push 0x34
call fcn.005b7f13
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x66d02e
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004bb0db
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x28
push edi
push 0x28
push ebx
call fcn.005b7fe1
add esp, 0x10
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov dword [ebx + 0x14], esi
mov eax, dword [ebp - 0x28]
push ebx
push eax
mov dword [ebp - 0x10], 0
call dword [0x69b294]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x66d07d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x66d07d
push esi
add edi, 0x28
push edi
push eax
call fcn.00655420
mov ecx, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x14], ecx
push ebx
call fcn.005b7fa7
add esp, 4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004bb0db
mov ebx, dword [ebp - 0x1c]
push ebx
call dword [0x69b4b4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x670680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
call fcn.00670240
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x6706a7
push 5
push edi
lea eax, [ebp - 4]
push eax
call fcn.00670470
test eax, eax
jne 0x6706c8
call fcn.004c66d7
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
test eax, eax
je 0x6706db
push 5
push edi
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
call fcn.00670470
test eax, eax
je 0x6706db
mov edx, dword [ebp - 4]
push eax
push edx
call dword [0x69b338]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x670a70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x670a7f
xor eax, eax
pop ebp
ret 8
push ebx
push esi
push edi
call fcn.00670240
movzx ebx, word [ebp + 0xc]
push 0x17
mov edi, eax
push ebx
push edi
call dword [0x69b4b0]
mov esi, eax
test esi, esi
jne 0x670ab9
call fcn.004c66d7
mov edi, dword [eax + 0xc]
test edi, edi
je 0x670af1
push 0x17
push ebx
push edi
call dword [0x69b4b0]
mov esi, eax
test esi, esi
je 0x670af1
push esi
push edi
call dword [0x69b338]
mov ebx, eax
test ebx, ebx
je 0x670af1
push esi
push edi
call dword [0x69b330]
push ebx
mov edi, eax
call dword [0x69b334]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x670af1
mov ecx, dword [ebp + 8]
lea ebx, [edi + 1]
push ebx
call fcn.00401777
mov esi, eax
test esi, esi
jne 0x670afa
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push ebx
push 0
push esi
call fcn.005b8ac0
mov eax, dword [ebp + 0xc]
push edi
push eax
push esi
call fcn.005b7aa0
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
add esp, 0x18
test eax, eax
je 0x670b2b
push ecx
push eax
call fcn.005b8b3a
add esp, 8
test eax, eax
js 0x670b49
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x670b49
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
mov byte [eax + ecx], 0
xor eax, eax
test edi, edi
pop edi
pop esi
setg al
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.004012e4
int3
Function at 0x670b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
push edi
call fcn.00401563
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, ebx
shr eax, 4
inc eax
movzx ecx, ax
push 6
push ecx
push esi
call dword [0x69b4b0]
mov edi, eax
test edi, edi
jne 0x670b9c
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
push esi
call dword [0x69b338]
test eax, eax
je 0x670b91
push eax
call dword [0x69b334]
mov esi, eax
test esi, esi
je 0x670b91
mov edx, dword [ebp + 8]
push edi
push edx
call dword [0x69b330]
add eax, esi
and ebx, 0xf
jbe 0x670bd5
cmp esi, eax
jae 0x670b91
dec ebx
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x670bc7
cmp esi, eax
jae 0x670b91
movzx eax, word [esi]
mov dword [ebp + 8], eax
test eax, eax
je 0x670b91
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x670bf2
mov ebx, dword [ecx + 4]
jmp 0x670bf4
xor ebx, ebx
push 0
push 0
push 0
push 0
push eax
lea edi, [esi + 2]
push edi
push 0
push ebx
call dword [0x69b340]
mov ecx, dword [ebp + 0x10]
mov esi, eax
push esi
call fcn.00446434
push 0
push 0
push esi
push eax
mov eax, dword [ebp + 8]
push eax
push edi
push 0
push ebx
call dword [0x69b340]
mov ecx, dword [ebp + 0x10]
push esi
call fcn.00405474
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x672d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, edx
jb 0x672d79
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.005b7aa0
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x672d50
sub eax, ebx
jmp 0x672d52
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x672d41
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x672d6f
sub eax, ebx
jmp 0x672d71
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x672d60
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x672dd3
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, esi
add edx, dword [edi + 0x38]
mov esi, eax
push edx
call fcn.00672a90
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x672dbf
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx eax, byte [esi]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x672dd3
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x672d05
pop esi
pop ebx
ret
Function at 0x10003182
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp byte [edi + 4], bl
jne 0x1000319c
mov ebx, edi
call fcn.1000325c
xor ebx, ebx
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10003252
push 0x10220
call fcn.1002da26
mov esi, eax
pop ecx
cmp esi, ebx
je 0x100031d2
mov dword [esi + 0x1021c], ebx
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
jmp 0x100031d4
xor esi, esi
push dword [ebp + 0xc]
lea eax, [esi + 0x10014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
push 0x42000000
push 3
push ebx
push 7
push 1
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x1021c], eax
cmp eax, 0xffffffff
je 0x1000323a
push ebx
push ebx
push dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
je 0x1000323a
push ebx
push esi
push ebx
push dword [edi + 0x24]
lea eax, [esi + 0x14]
push 1
push 0x10000
push eax
push dword [esi + 0x1021c]
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
test eax, eax
je 0x1000323a
mov al, 1
jmp 0x10003254
mov eax, dword [esi + 0x1021c]
cmp eax, ebx
je 0x1000324b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.1002d932
pop ecx
xor al, al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x10004c0e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.100389f0
mov eax, dword [0x10057060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str._DlpBackupMonitor
push 0x236
push str.._backup.cpp
push str._s._d:_s
lea eax, [ebp - 0x1008]
push 0x800
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
xor esi, esi
lea eax, [ebp - 0x100c]
push eax
push esi
push esi
push 0x100048ed
push esi
push esi
mov dword [ebp - 0x100c], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x10004c8e
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 0x100c]
push str.thread__d_created:__s
call fcn.10016d40
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002cf2d
leave
ret