joyce8/EMBER2024-capa huggingface dataset:
Function at 0x612418
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe08
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11f4], ebx
mov dword [ebp - 0x11f8], ebx
mov dword [ebp - 0x11ec], ebx
mov dword [ebp - 0x11f0], ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 0x1004], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11de]
xor eax, eax
push ebp
push 0x61265f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [ebp - 0x11d0]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 0x1004]
mov eax, dword [ebp - 0x11cc]
call fcn.0060f098
cmp dword [ebp - 0x1084], 0x418
jle 0x6124d8
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 0x1004]
mov al, 0xd6
call fcn.005aaf4c
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, dword [0x41991c]
call fcn.004265c4
call fcn.00407e08
lea eax, [ebp - 0x11f0]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
push 0
call fcn.00408edc
mov edx, dword [ebp - 0x11f0]
lea ecx, [ebp - 0x11ec]
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
call fcn.00611d34
mov edx, dword [ebp - 0x11ec]
mov eax, dword [ebp - 0x11d0]
add eax, 0x14
call fcn.00408aec
lea eax, [ebp - 0x11f8]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
push 0
call fcn.00408edc
mov edx, dword [ebp - 0x11f8]
lea ecx, [ebp - 0x11f4]
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
call fcn.00611d34
mov edx, dword [ebp - 0x11f4]
mov eax, dword [ebp - 0x11d0]
add eax, 0x18
call fcn.00408aec
lea eax, [ebp - 0x1078]
movzx eax, byte [eax]
mov edx, dword [ebp - 0x11d0]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x612620
push ebp
mov eax, esi
mov edx, 0xa
call fcn.006123a0
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
movzx edx, word [esi]
call fcn.0060f838
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x6125bd
push ebp
call fcn.006121f8
pop ecx
xor eax, eax
push ebp
push 0x6125ee
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
call fcn.006123a0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x612608
mov edx, dword [ebp - 0x11e4]
mov eax, dword [ebp - 0x11d0]
call fcn.0060f874
dec ebx
jne 0x612582
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x612666
lea eax, [ebp - 0x11f8]
call fcn.00408730
lea eax, [ebp - 0x11f4]
call fcn.0040870c
lea eax, [ebp - 0x11f0]
call fcn.00408730
lea eax, [ebp - 0x11ec]
mov edx, 2
call fcn.0040876c
ret
Function at 0x613ee4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, esi
test ebx, ebx
je 0x613efd
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004097c0
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x613f31
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
xor eax, eax
call fcn.00613db4
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x615da4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x615ed5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [0x653540]
movzx eax, byte [eax]
mov ecx, dword [eax*4 + 0x652fb0]
mov edx, 0x80000002
xor eax, eax
call fcn.005a3f04
test eax, eax
jne 0x615e39
mov esi, edi
test esi, esi
je 0x615dfc
sub esi, 4
mov esi, dword [esi]
inc esi
mov eax, esi
add eax, eax
push eax
mov eax, edi
call fcn.004097c0
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x615e2e
mov eax, 0x615ef0
call fcn.005f3590
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x615e43
mov eax, 0x615f54
call fcn.005f3590
test bl, bl
je 0x615eba
mov eax, edi
call fcn.004097c0
push eax
call sub.gdi32.dll_AddFontResourceW
test eax, eax
je 0x615e6a
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
jmp 0x615eba
lea ecx, [ebp - 0x10]
mov edx, 0x615fa8
mov al, 0x3d
call fcn.005aaf4c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.005a47ec
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x65376c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x65376c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x65376c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
pop eax
call fcn.00613390
test al, al
je 0x615e47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x615edc
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040876c
ret
Function at 0x61915c
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x61921d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x619202
test bl, 0x10
je 0x619202
lea ecx, [ebp - 4]
mov edx, 0x619238
mov eax, esi
call fcn.005a25e4
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x61925c
mov eax, 0x619278
call fcn.005a2dbc
mov edx, 0x6192a4
mov eax, dword [ebp - 8]
call fcn.0041faec
test eax, eax
jne 0x619202
mov eax, dword [ebp - 4]
call fcn.004210cc
lea ecx, [ebp - 0xc]
mov edx, 0x619300
mov eax, esi
call fcn.005a25e4
mov eax, dword [ebp - 0xc]
call fcn.004210cc
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.004097c0
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesW
push edi
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x619224
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040876c
ret

Function at 0x61a250
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x61a32a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.005ea7fc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x61a348
call fcn.005f3814
mov eax, dword [0x65333c]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
call fcn.0045a3a8
mov esi, eax
mov eax, dword [esi]
mov ebx, eax
test ebx, ebx
je 0x61a2c3
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
push eax
mov eax, ebx
mov ecx, 0x14
cdq
idiv ecx
push eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.00612c90
test al, al
jne 0x61a314
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x61a2f9
mov eax, 0x61a398
call fcn.005f3590
jmp 0x61a314
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x61a438
call fcn.005f3814
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a331
lea eax, [ebp - 0x1c]
call fcn.0040870c
ret
Function at 0x61c7fc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61c986
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea edx, [ebp - 0x258]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005a2474
lea eax, [ebp - 0x258]
mov edx, 0x61c9a0
call fcn.004099bc
mov eax, dword [ebp - 0x258]
call fcn.004097c0
push eax
call sub.kernel32.dll_FindFirstFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x61c960
lea eax, [ebp - 4]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00409864
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x61c88f
sub ebx, 4
mov ebx, dword [ebx]
cmp ebx, 9
jl 0x61c8d4
lea eax, [ebp - 0x25c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00409be4
mov eax, dword [ebp - 0x25c]
mov edx, 0x61c9c4
call fcn.0041faec
test eax, eax
jne 0x61c8d4
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x61c8d6
xor eax, eax
test al, al
je 0x61c8ed
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xc]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x61c8ef
xor eax, eax
test al, al
je 0x61c906
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xe]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x61c908
xor eax, eax
test al, al
je 0x61c945
mov eax, dword [ebp - 4]
cmp word [eax + 0x10], 0x2e
jne 0x61c945
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00409be4
mov eax, dword [ebp - 0x260]
call fcn.00420b20
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x254]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x61c870
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c98d
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.0040876c
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x61eca4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
call fcn.0061eb78
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4a
mov eax, dword [0x65ad4c]
push eax
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx], ecx
call fcn.004069c8
cmp ebx, 0x6c840001
jne 0x61ed04
call fcn.004265b8
mov eax, 0xffff0000
and eax, ebx
cmp eax, 0x6c830000
je 0x61ed28
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x61eddc
call fcn.005ea5f4
mov word [ebp - 0xa], bx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 8]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x61ed7e
mov ebx, eax
mov edx, 1
movzx eax, word [ebp - 0xa]
call fcn.0061ebf8
mov esi, eax
mov eax, esi
sub ax, 2
je 0x61ed7e
dec eax
sub ax, 2
jb 0x61ed92
movzx eax, si
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x61ee3c
call fcn.005ea5f4
push 0x4ff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x61ed33
mov edx, 2
movzx eax, word [ebp - 0xa]
call fcn.0061ebf8
movzx ebx, ax
mov edx, 3
movzx eax, word [ebp - 0xa]
call fcn.0061ebf8
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6210d4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
mov eax, ebx
call fcn.00621158
call fcn.00405490
mov esi, eax
push esp
push 0x40
mov eax, ebx
call fcn.00621158
push eax
push esi
call sub.kernel32.dll_VirtualProtect
mov edx, esi
mov eax, ebx
call fcn.00621108
mov eax, esi
pop edx
pop esi
pop ebx
ret
Function at 0x622b7c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x622d4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.00408894
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x652fdc]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004097c0
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.005a3f04
test eax, eax
jne 0x622d33
xor eax, eax
push ebp
push 0x622d28
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.005bf9b8
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x622c0d
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x622c3a
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00408cb8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x622c5c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00408cb8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x622cd2
sub eax, 0xe9
je 0x622c76
sub eax, 0x19
je 0x622d11
jmp 0x622ccb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x622c8d
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x622ca0
call fcn.00407efc
jmp 0x622d33
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x622cb7
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408894
jmp 0x622c01
call fcn.00407efc
jmp 0x622d33
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.005bf9b8
lea eax, [ebp - 4]
call fcn.00408cb8
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.00408894
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.005d102c
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.005bdb58
inc ebx
jmp 0x622c01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622d2f
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622d55
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040876c
ret
Function at 0x628d38
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x628dbc
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x628da4
mov ebx, esi
test ebx, ebx
je 0x628d6a
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004097c0
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x628dd8
call fcn.00409a14
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x628da6
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x628dc3
lea eax, [ebp - 8]
call fcn.0040870c
ret

Function at 0x62ef84
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x62ef8e
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x62f044
push 0x62f078
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00412174
mov ebx, eax
test ebx, ebx
je 0x62f02d
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x62f02d
test al, 0x10
je 0x62efde
mov ebp, 0x2000000
jmp 0x62efe0
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x62f02d
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle
test ebx, ebx
jle 0x62f02d
cmp ebx, 0xff0
jge 0x62f02d
mov edx, edi
mov eax, esp
call fcn.0062ee9c
jmp 0x62f036
mov eax, edi
mov edx, esi
call fcn.00408aec
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x62f094
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x62f125
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
test ebx, ebx
jle 0x62f0fb
cmp ebx, 0x104
jge 0x62f0fb
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00409864
mov eax, dword [ebp - 0x20c]
mov edx, esi
call fcn.0062ef84
jmp 0x62f10c
mov eax, 0x62f140
call fcn.005ea7a4
mov eax, esi
call fcn.0040870c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62f12c
lea eax, [ebp - 0x20c]
call fcn.0040870c
ret
Function at 0x62f168
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x62f2b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0062ef84
lea eax, [ebp - 8]
call fcn.0062f094
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00405ce4
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x62f2c4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.004097c0
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.004097c0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.004097c0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x62f213
call sub.kernel32.dll_GetLastError
cmp eax, 0x4c7
jne 0x62f209
call fcn.00426598
mov eax, 0x62f2dc
call fcn.005ea6f0
cmp dword [ebp - 0x10], 0
jne 0x62f223
mov eax, 0x62f308
call fcn.005ea59c
xor edx, edx
push ebp
push 0x62f295
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0062ec90
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x62f231
cmp eax, 0xffffffff
jne 0x62f25e
mov eax, 0x62f35c
call fcn.005ea6f0
call fcn.0062ec90
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x62f27e
mov eax, 0x62f39c
call fcn.005ea6f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62f29c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret

Function at 0x62f3c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x62f493
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x62ea64]
call fcn.0062f4bc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x62f46c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x62f4ac
call fcn.00421ba4
mov edx, dword [ebp - 8]
mov eax, dword [0x653758]
mov eax, dword [eax]
call fcn.00595d5c
call fcn.0062ec90
call sub.user32.dll_GetFocus
mov edx, dword [0x653758]
mov edx, dword [edx]
cmp eax, dword [edx + 0x188]
jne 0x62f44f
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x62f456
call sub.user32.dll_WaitMessage
jmp 0x62f429
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62f473
mov eax, dword [ebp - 4]
call fcn.004069c8
ret
Function at 0x63569c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6356a4
push ecx
push ebx
xor eax, eax
push ebp
push 0x6357ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005ead90
mov edx, dword [ebp - 0x10]
mov eax, 0x65ae14
call fcn.00408aec
lea eax, [ebp - 0x14]
mov ecx, dword [0x65ae14]
mov edx, 0x635808
call fcn.00409a14
mov eax, dword [ebp - 0x14]
call fcn.005f3590
mov eax, dword [0x65385c]
cmp byte [eax], 0
je 0x6356ff
mov eax, dword [0x65ae14]
call fcn.005f2c9c
lea edx, [ebp - 0x18]
mov eax, dword [0x65ae14]
call fcn.005a2474
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x635850
call fcn.00409a14
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x635795
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x39
call fcn.005aaf4c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.004207b0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.005a4a6c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x6e
call fcn.005aaf1c
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41991c]
call fcn.004265c4
call fcn.00407e08
lea eax, [ebp - 8]
call fcn.0060c3f0
cmp dword [ebp - 8], 0
je 0x6357c6
lea eax, [ebp - 0xc]
mov ecx, 0x63586c
mov edx, dword [ebp - 4]
call fcn.00409a14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00635644
mov eax, dword [ebp - 0xc]
call fcn.0060c448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6357f5
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040876c
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.0040876c
ret

Function at 0x638184
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x65b0fd], 1
call fcn.005ecbc0
test al, al
jne 0x6381d6
push 5
mov eax, dword [0x653758]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x653758]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x65376c]
mov eax, dword [eax + 0x130]
mov cl, 2
xor edx, edx
call fcn.00637f24
ret

Function at 0x63ba34
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x63ba59
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret