joyce8/EMBER2024-capa huggingface dataset:
Function at 0x600cb4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x600cd5
test edi, 0x40000
je 0x600cef
test bl, bl
jne 0x600d70
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x600d70
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x600d22
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x600d37
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x600d46
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x600d57
cmp byte [esp + 2], 0
je 0x600d70
cmp byte [esp + 2], 0
je 0x600d68
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x600d70
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x601014
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x60103a
mov eax, esp
push eax
push 0x600fdc
call sub.user32.dll_EnumWindows
jmp 0x60104d
mov eax, esp
push eax
push 0x600fbc
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x601110
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
mov si, ax
test bl, 4
je 0x601122
or si, 1
test bl, 8
je 0x60112b
or si, 4
test bl, 1
je 0x601134
or si, 8
test bl, 2
je 0x60113d
or si, 0x10
test bl, 0x10
je 0x601146
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x601156
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x60115c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
xor eax, eax
mov bx, ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x601175
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x601185
or bx, 4
test esi, 0x20000000
je 0x601191
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x60ab58
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x60ab6a
add esp, 0xfffffff0
call fcn.00408754
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0047ebec
mov eax, dword [0x62fd90]
mov dword [eax + 4], ebx
mov dword [eax], 0x60b02c
mov eax, dword [0x62fda0]
mov dword [eax + 4], ebx
mov dword [eax], 0x60b038
mov eax, ebx
call fcn.0060b044
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x440cd4]
call fcn.004080fc
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x440cd4]
call fcn.004080fc
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x440cd4]
call fcn.004080fc
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x440cd4]
call fcn.004080fc
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x440cd4]
call fcn.004080fc
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x605098
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x5202e0]
call fcn.00526dc0
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x5202e0]
call fcn.00526dc0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x5202e0]
call fcn.00526dc0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x5202e0]
call fcn.00526dc0
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x5202e0]
call fcn.00526dc0
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.0060b620
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x60b450
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x60b450
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x60b450
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x60b450
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x60b450
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x60acea
call fcn.004087ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x60b1f0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x60b39c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x60b37d
mov dl, 1
mov eax, dword [0x44474c]
call fcn.0046ead8
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409f00
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x60b36c
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0055d01c
test al, al
je 0x60b35f
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x60b3ac
lea eax, [ebp - 0x394]
call fcn.00425c00
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x60b35f
xor eax, eax
push ebp
push 0x60b358
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x60b41c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x60b341
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aac4
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x60b341
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aac4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b35f
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x60b261
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.0046ea00
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b3a3
lea eax, [ebp - 0x3a0]
call fcn.00409f00
ret

Function at 0x60bfac
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x637c00]
cmp byte [eax + 0xc5], 0
jne 0x60c01e
cmp dword [0x637c24], 0
jne 0x60bfde
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x62fb40]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x637c24], eax
cmp dword [0x637c20], 0
jne 0x60bff9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x637c20], eax
cmp dword [0x637c28], 0
jne 0x60c01e
push esp
push 0
push 0
mov eax, dword [0x62fb3c]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x637c28], eax
pop edx
ret
Function at 0x60c440
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x60c457
add esp, 0xfffffff0
call fcn.00408754
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0047ebec
mov eax, dword [0x62fc48]
cmp byte [eax], 0
jne 0x60c484
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x62ff98]
cmp word [eax + 2], 0
jne 0x60c49e
mov eax, dword [0x62ff98]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0060e820
mov eax, dword [0x6300d8]
cmp word [eax + 2], 0
jne 0x60c4b8
mov eax, dword [0x6300d8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0060ea24
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x5202e0]
call fcn.00526dc0
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x60efa8
mov dl, 1
mov eax, dword [0x440cd4]
call fcn.004080fc
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x440cd4]
call fcn.004080fc
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x52544c]
call fcn.00531230
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x60c6a8
mov eax, dword [0x62fe44]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0053174c
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x60f290
mov dl, 1
mov eax, dword [0x440cd4]
call fcn.004080fc
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x62fe44]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425a00
test eax, eax
je 0x60c5d2
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00425858
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004259e4
test eax, eax
je 0x60c5ea
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040aac4
push ebx
push 0x60e200
call fcn.006010f4
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x62fc48]
cmp byte [eax], 0
jne 0x60c63b
mov eax, ebx
call fcn.0060c870
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.0060f4c8
mov eax, ebx
call fcn.00610174
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x60c69f
call fcn.004087ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60cb9c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x60cc3e
cmp dword [ebx + 0xac], 0
jne 0x60cc38
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x60cadc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x60cc38
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x60cbfe
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x60cc38
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.00469930
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x60cc0d
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x60cee4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x637c00]
cmp dword [eax + 0x188], 0
je 0x60d04d
test bl, bl
jne 0x60cfa0
cmp dword [esi + 0xb4], 0
jne 0x60cf95
mov eax, esi
call fcn.0060ffc4
push eax
push 0x60cde4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x60cf66
mov eax, dword [0x637c00]
cmp byte [eax + 0xeb], 0
je 0x60cf66
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x60cf47
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x60cf66
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x60cf4f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x60cf95
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.00469930
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x60cf75
inc dword [esi + 0xb4]
jmp 0x60d04d
cmp dword [esi + 0xb4], 0
jle 0x60d04d
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x60d04d
cmp dword [esi + 0x58], 0
je 0x60d002
mov eax, dword [0x637c00]
cmp byte [eax + 0xeb], 0
je 0x60d002
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x60cfe3
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x60d002
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x60cfeb
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x60d031
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.00469930
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x60d011
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5fd6bc]
call fcn.0040cbb8
pop edi
pop esi
pop ebx
ret
Function at 0x60de0c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x60de69
cmp byte [ebx + 0xeb], 0
jne 0x60de69
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a088
mov eax, dword [esi]
test eax, eax
je 0x60de56
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x60de76
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a2e0
jmp 0x60de76
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a2e0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x60f6dc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x60f74d
mov eax, esi
call fcn.00556714
test al, al
je 0x60f74d
mov eax, dword [ebx + 0x98]
call fcn.00556340
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x60f74d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x60f73e
push 0
mov eax, dword [ebx + 0x98]
call fcn.00556340
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0054c71c
jmp 0x60f74d
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.0060f4e8
pop esi
pop ebx
ret
Function at 0x61e32c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61e405
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5c]
lea eax, [ebp - 8]
mov edx, 0x61e41c
call fcn.0040a6d0
mov eax, dword [ebp - 8]
call fcn.0040a7d4
push eax
call sub.kernel32.dll_CreateFileA
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0xffffffff
jne 0x61e3e2
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x61e3b6
lea eax, [ebp - 0xc]
mov edx, dword [0x62fb8c]
call fcn.0040aae0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x61d7d8]
call fcn.0042a8d4
call fcn.004095fc
jmp 0x61e3e2
call sub.kernel32.dll_GetLastError
cmp eax, 5
jne 0x61e3e2
lea eax, [ebp - 0x10]
mov edx, dword [0x62fb90]
call fcn.0040aae0
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x61d7d8]
call fcn.0042a8d4
call fcn.004095fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61e40c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00409f60
lea eax, [ebp - 8]
call fcn.00409f24
ret

Function at 0x61ed48
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61ee2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x61ed98
lea eax, [ebp - 0x1c]
mov edx, dword [0x62fb9c]
call fcn.0040aae0
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x61d7d8]
call fcn.0042a8d4
call fcn.004095fc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, eax
call fcn.0061ece8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x61eddd
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x61eddd
xor eax, eax
jmp 0x61eddf
mov al, 1
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x61ee0a
lea eax, [ebp - 0x20]
mov edx, dword [0x62fb94]
call fcn.0040aae0
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x61d7d8]
call fcn.0042a8d4
call fcn.004095fc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ee32
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00409f60
ret
Function at 0x61ef7c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61f055
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x61efcc
lea eax, [ebp - 0x1c]
mov edx, dword [0x62fb9c]
call fcn.0040aae0
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x61d7d8]
call fcn.0042a8d4
call fcn.004095fc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov byte [eax + 0x14], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x61f007
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x61f007
xor eax, eax
jmp 0x61f009
mov al, 1
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x61f034
lea eax, [ebp - 0x20]
mov edx, dword [0x62fb98]
call fcn.0040aae0
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x61d7d8]
call fcn.0042a8d4
call fcn.004095fc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f05c
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00409f60
ret
Function at 0x61fa40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61fbee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x61fbfc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x61faad
lea eax, [ebp - 0x2c]
mov edx, dword [0x62fbc4]
call fcn.0040aae0
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x61d7d8]
call fcn.0042a8d4
call fcn.004095fc
mov dl, 1
mov eax, dword [0x44474c]
call fcn.0046ead8
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x61fbbf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], pe_nt_image_headers32
mov dword [ebp - 0x20], pe_nt_image_headers32
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
call fcn.0040a7e8
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, dword [ebp - 0x20]
call fcn.0040a7e8
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
call fcn.0040a7d4
push eax
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040a7d4
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumValueA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x61fb55
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, dword [ebp - 0x20]
call fcn.0040a7e8
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x18]
call fcn.0040aae0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc dword [ebp - 0x10]
jmp 0x61fb80
cmp dword [ebp - 0xc], 0x103
je 0x61fb80
lea eax, [ebp - 0x34]
mov edx, dword [0x62fbc4]
call fcn.0040aae0
mov ecx, dword [ebp - 0x34]
mov dl, 1
mov eax, dword [0x61d7d8]
call fcn.0042a8d4
call fcn.004095fc
cmp dword [ebp - 0xc], 0
je 0x61facf
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
call dword [edx + 0xa4]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61fbc6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x28]
call fcn.0040812c
ret
Function at 0x402e84
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040450c
test esi, esi
jne 0x402ebb
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.VL4hrqNmR___bs__K_GetModuleFileNameA_1
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004045fc
jmp 0x402edc
call sub.VL4hrqNmR___bs__K_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d20
mov dword [esp], eax
test esi, esi
je 0x402edc
cmp dword [ebx], 0
je 0x402edc
dec esi
jmp 0x402ec3
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4035cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4a2020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403664
push 0x80000002
call sub._bs__K_RegOpenKeyExA_1
test eax, eax
jne 0x403644
xor eax, eax
push ebp
push 0x40363d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403680
mov eax, dword [ebp - 4]
push eax
call sub._bs__K_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403644
mov eax, dword [ebp - 4]
push eax
call sub._bs__K_RegCloseKey_1
ret
mov ax, word [0x4a2020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4a2020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404368
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4a704c], 0
je 0x4043c9
cmp word [0x4a7220], 0xd7b2
jne 0x404391
cmp dword [0x4a7228], 0
jbe 0x404391
mov eax, 0x4a721c
call dword [0x4a7238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4a206c
push 0xfffffffffffffff5
call sub.VL4hrqNmR___bs__K_GetStdHandle_1
push eax
call sub.VL4hrqNmR___bs__K_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4043f0
push 0xfffffffffffffff5
call sub.VL4hrqNmR___bs__K_GetStdHandle_1
push eax
call sub.VL4hrqNmR___bs__K_WriteFile_1
pop edx
ret
cmp byte [0x4a2030], 0
jne 0x4043e5
push 0
push 0x4a2064
push 0x4a206c
push 0
call fcn.004012c4
pop edx
ret