joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cf61c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff48
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x3a]
xor ecx, ecx
mov edx, 0x7e
call fcn.004074c0
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x5cf7b1
mov edi, 1
xor esi, esi
jmp 0x5cf6e8
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3a], dx
mov edx, eax
shl edx, 4
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3c], ax
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
movzx eax, byte [esp + edi + 0xd]
shr eax, 6
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3e], ax
movzx edx, byte [esp + edi + 0xd]
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x40], ax
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x5cf668
cmp edi, dword [esp + 8]
jg 0x5cf795
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3a], dx
cmp edi, dword [esp + 8]
jne 0x5cf747
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3c], ax
mov word [esp + esi*2 + 0x3e], 0x3d
jmp 0x5cf78b
mov edx, eax
shl edx, 4
and dl, 0x30
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3c], ax
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
and dl, 0x3c
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3e], ax
mov word [esp + esi*2 + 0x40], 0x3d
add esi, 4
mov ecx, esi
add ecx, ecx
lea edx, [esp + 0x3a]
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x5cf63c
add esp, 0xb8
pop edi
pop esi
pop ebx
ret
Function at 0x5d330c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
mov ebx, eax
push 0x20a
lea eax, [ebp - 0x214]
push eax
mov eax, dword [0x776c50]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
push 0xa
lea eax, [ebp - 0xa]
push eax
push 3
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x214]
push eax
call sub.kernel32.dll_lstrlenW_1
mov ebx, eax
add ebx, ebx
lea eax, [ebp - 0x214]
add ebx, eax
jmp 0x5d335b
sub ebx, 2
cmp word [ebx], 0x2e
je 0x5d336b
lea eax, [ebp - 0x214]
cmp ebx, eax
jne 0x5d3358
xor eax, eax
xor esi, esi
lea edx, [ebp - 0x214]
cmp ebx, edx
je 0x5d33c1
add ebx, 2
cmp word [ebp - 0xa], 0
je 0x5d33c1
lea eax, [ebp - 0xa]
push eax
push ebx
call sub.kernel32.dll_lstrcpyW
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call sub.kernel32.dll_LoadLibraryExW_1
test eax, eax
jne 0x5d33c1
mov word [ebp - 6], 0
lea eax, [ebp - 0xa]
push eax
push ebx
call sub.kernel32.dll_lstrcpyW
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call sub.kernel32.dll_LoadLibraryExW_1
test eax, eax
je 0x5d33cc
call fcn.005d32c0
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d8bec
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d8c94
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409e3c
mov eax, ebx
mov edx, 0x104
call fcn.0040ae48
mov eax, dword [ebx]
xor ecx, ecx
mov edx, 0x208
call fcn.004074c0
push 0
push 0x26
mov eax, dword [ebx]
call fcn.0040acb4
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x5d8c60
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.00425440
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0042db44
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, 0x5d8cac
call fcn.0040af20
cmp dword [ebx], 0
jne 0x5d8c79
mov ecx, 0xa5
mov edx, 0x5d8cdc
mov eax, 0x5d8d80
call fcn.00409c88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d8c9b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409e9c
ret

Function at 0x5d8dfc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409e84
xor edx, edx
push ebp
push 0x5d8e72
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, 0x80000000
sete al
test al, al
je 0x5d8e68
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x5d8e5f
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040aae4
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d8e7c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e6e30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x158
call fcn.004074c0
cmp dword [ebp - 4], 0
je 0x5e6ee4
mov eax, dword [ebp - 4]
mov dword [ebx + 0x154], eax
movzx eax, word [ebp + 8]
mov edx, dword [ebp - 4]
movzx edx, word [edx + 8]
mov word [ebp - 6], dx
cmp ax, word [ebp - 6]
jbe 0x5e6ea0
movzx eax, ax
push eax
lea edx, [ebp - 0x46]
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.005e6d84
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
movzx ecx, ax
lea edx, [ebx + 0xd4]
lea eax, [ebp - 0x46]
call fcn.004066d8
jmp 0x5e6eb0
movzx ecx, ax
lea edx, [ebx + 0xd4]
mov eax, esi
call fcn.004066d8
movzx edx, word [ebp - 6]
dec edx
test dx, dx
jb 0x5e6eca
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x36
inc eax
dec dx
jne 0x5e6ec1
mov eax, ebx
mov esi, dword [ebp - 4]
call dword [esi + 0xc]
movzx ecx, word [ebp - 6]
lea edx, [ebx + 0xd4]
mov eax, ebx
mov ebx, dword [ebp - 4]
call dword [ebx + 0x14]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5e6efc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x154]
test eax, eax
je 0x5e6f7e
movzx edx, word [eax + 8]
mov word [esp + 4], dx
mov esi, eax
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x10]
movzx edx, word [esp + 4]
dec edx
test edx, edx
jl 0x5e6f3b
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x6a
inc eax
dec edx
jne 0x5e6f34
mov esi, dword [ebx + 0x154]
mov eax, ebx
call dword [esi + 0xc]
mov esi, dword [ebx + 0x154]
movzx ecx, word [esp + 4]
lea edx, [ebx + 0xd4]
mov eax, ebx
call dword [esi + 0x14]
mov eax, dword [ebx + 0x154]
mov esi, eax
movzx ecx, word [eax + 0xa]
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x14]
mov esi, dword [ebx + 0x154]
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x10]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5e6f98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5e6fbe
mov dword [ebp - 0x10], 1
jmp 0x5e710e
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
test ax, ax
jne 0x5e6fd6
mov dword [ebp - 0x10], 2
jmp 0x5e710e
xor edx, edx
mov dword [ebp - 0x10], edx
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 4
call fcn.004074c0
movzx eax, word [ebp + 8]
dec eax
movzx edx, word [ebp - 0x14]
mov ecx, edx
cdq
idiv ecx
inc eax
test ax, ax
jbe 0x5e710e
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x20]
call fcn.005e6f84
lea eax, [ebp - 0xa8]
xor ecx, ecx
mov edx, 0x40
call fcn.004074c0
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x5e70d4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 1
movzx eax, word [ebp - 0xa]
push eax
lea eax, [ebp - 0x200]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.005e6e30
cmp dword [ebp - 0x18], 1
jne 0x5e7088
movzx ecx, word [ebp + 0x14]
lea eax, [ebp - 0x200]
mov edx, dword [ebp + 0x18]
call fcn.005e6eec
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x200]
mov ecx, 4
call fcn.005e6eec
jmp 0x5e709a
movzx ecx, word [ebp - 0x14]
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x200]
call fcn.005e6eec
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x200]
call fcn.005e6efc
movzx ecx, word [ebp - 0x14]
dec ecx
test cx, cx
jb 0x5e70c8
inc ecx
lea eax, [ebp - 0x68]
lea edx, [ebp - 0xa8]
movzx ebx, byte [eax]
xor byte [edx], bl
inc edx
inc eax
dec cx
jne 0x5e70bc
inc dword [ebp - 0x18]
dec dword [ebp - 0x28]
jne 0x5e7045
movzx ecx, word [ebp - 0x14]
dec ecx
test cx, cx
jb 0x5e7104
inc ecx
lea eax, [ebp - 0xa8]
movzx edx, word [ebp - 0x12]
cmp dx, word [ebp + 8]
jae 0x5e70fe
movzx edx, byte [eax]
mov ebx, dword [ebp - 0x1c]
mov byte [ebx], dl
inc word [ebp - 0x12]
inc dword [ebp - 0x1c]
inc eax
dec cx
jne 0x5e70e5
dec word [ebp - 0x22]
jne 0x5e7016
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x5e7144
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [ebx], eax
add ebx, 4
add edx, 4
dec ecx
jne 0x5e714c
mov ecx, 0x40
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
rol eax, 1
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x5e7165
pop ebx
ret
Function at 0x5f5e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x24]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x38]
call fcn.004066d8
add dword [ebp - 8], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x4c]
shl eax, 2
sub eax, 5
test eax, eax
jl 0x5f5f5f
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x76c700]
mov edx, 8
call fcn.005f1ff0
mov ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
xor ebx, dword [eax*4 + 0x76c700]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x76c700]
mov edx, 0x10
call fcn.005f1ff0
xor ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x18
mov eax, dword [eax*4 + 0x76c700]
mov edx, 0x18
call fcn.005f1ff0
xor ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
add dword [ebp - 8], 4
inc dword [ebp - 4]
dec dword [ebp - 0xc]
jne 0x5f5ee2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x600c10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x600c89
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040ad1c
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040ad1c
mov eax, dword [ebp - 0x14]
call fcn.0040acb4
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040acb4
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0x15]
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x600c90
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409e9c
ret

Function at 0x600c98
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CopyFileW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x601a5c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x601ac0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004270e4
mov eax, dword [ebp - 4]
call fcn.006019ac
test al, al
je 0x601a95
mov byte [ebp - 5], 1
jmp 0x601aaa
mov eax, dword [ebp - 0xc]
call fcn.0040acb4
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x601ac7
lea eax, [ebp - 0xc]
call fcn.00409e3c
ret

Function at 0x601db8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x601e12
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x76d7fc]
mov edx, dword [ebp - 0x10]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x601de0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x601fc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x602021
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.00601f14
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.00601e7c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x601fe6
mov esp, ebp
pop ebp
ret
Function at 0x60207c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x6020d4
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jl 0x602104
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.0040a8ec
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.00601e7c
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x6020e7
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00601f14
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.00601e7c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x602109
mov esp, ebp
pop ebp
ret
Function at 0x60fc94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21e]
mov edx, 0x60fd20
call fcn.004277cc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x54], 0
je 0x60fccf
lea eax, [ebp - 0x208]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x54]
call fcn.004277cc
jmp 0x60fce0
lea eax, [ebp - 0x208]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x428]
push eax
push 0
lea eax, [ebp - 0x21e]
push eax
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x428]
mov ecx, 0x105
call fcn.0040ad70
mov esp, ebp
pop ebp
ret

Function at 0x62c950
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x62ca78
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0062c83c
mov eax, dword [esi]
call fcn.0040c1b0
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41edbc]
call fcn.0040c3cc
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004066d8
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004066d8
add ebx, 0x1c
mov eax, dword [esi]
call fcn.0040c1b0
mov dword [ebp - 0xc], eax
mov eax, dword [0x7733c0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.0061b9b4
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.004074c0
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.0040c1b0
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.0061b990
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.0061b748
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.0061b9ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62ca7f
lea eax, [ebp - 4]
mov edx, dword [0x41edbc]
call fcn.0040c4f0
ret
Function at 0x696548
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6966ea
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov ecx, esi
mov eax, dword [ebp - 0xc]
call fcn.00696970
test al, al
je 0x6966c7
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040a264
mov eax, dword [ebp - 4]
call fcn.006957c4
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x6965b5
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b0d8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.004efebc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x69668a
xor eax, eax
push ebp
push 0x696683
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004eee70
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004ef470
test al, al
je 0x696661
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00409fc4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x696661
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040acb4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x69665b
mov eax, dword [ebp - 8]
call fcn.0040acb4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040ad1c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00696548
dec ebx
cmp ebx, 0xffffffff
jne 0x696614
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69668a
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004eee70
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ebx, dword [0x77073c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, dword [0x770738]
jbe 0x6966a4
mov ebx, dword [0x770738]
push 0
push ebx
mov eax, dword [ebp - 4]
call fcn.0040acb4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004eee5c
push eax
call fcn.006957dc
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6966f1
lea eax, [ebp - 0x3c]
call fcn.00409e3c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409e9c
ret
Function at 0x6967dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, esi
dec eax
sub eax, 2
jb 0x696806
mov ecx, 0x741
mov edx, 0x696854
mov eax, 0x696904
call fcn.00409c88
mov eax, dword [ebp + 8]
test eax, eax
je 0x696814
sub eax, 4
mov eax, dword [eax]
shr eax, 1
inc eax
mov edi, eax
add edi, edi
push edi
mov eax, dword [ebp + 8]
call fcn.0040ab20
push eax
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040ab20
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x69a094
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x69a0ac
add esp, 0xfffffff0
call fcn.004086b4
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x69a1c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00406464
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x69a1b0
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00505a38
xor eax, eax
push ebp
push 0x69a19d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00505a38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.0040adac
jmp 0x69a16e
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0040b0d8
mov eax, dword [ebx + 4]
call fcn.0040a334
dec eax
jle 0x69a182
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x69a15c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69a1a4
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69a1cd
lea eax, [ebp - 4]
call fcn.00409e84
ret