joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61e9b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x61eafc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x61ead2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov ecx, 0x61eb1c
mov edx, dword [ebp - 4]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
mov esi, eax
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Classes_TStringList_]
call sub.rtl120.bpl__Classes_TStringList__bctr_qqrv
mov dword [ebp - 0xc], eax
mov edx, 0x61eb3c
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Classes_TStrings_SetLineBreak_qqrx20System_UnicodeString
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x61eb4c
mov edx, dword [ebp - 4]
mov eax, ebx
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test esi, esi
jne 0x61ea82
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
je 0x61eab8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x61eb68
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.0060bf88
jmp 0x61eabc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x61eab8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x18]
lea eax, [ebp - 0x18]
mov edx, 0x61ebd4
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0060bf88
jmp 0x61eabc
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ead9
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System_TObject_Free_qqrv
ret
Function at 0x61fd18
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x61fe49
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x61fe1c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [sym.imp.rtl120.bpl__Sysutils_Win32MajorVersion]
cmp dword [eax], 6
jl 0x61fd70
mov eax, 0x61fe64
call fcn.0061fbc8
mov ebx, eax
jmp 0x61fd7c
mov eax, 0x61fe8c
call fcn.0061fbc8
mov ebx, eax
mov eax, 0x61fe8c
call fcn.0061fbc8
mov esi, eax
lea eax, [ebp - 0x50]
mov edx, 0x44
call fcn.004024a4
mov dword [ebp - 0x50], 0x44
mov eax, 0x61fea8
mov dword [ebp - 0x48], eax
mov word [ebp - 0x20], 0
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0xc]
push eax
call sub.userenv.dll_CreateEnvironmentBlock
cmp eax, 1
sbb eax, eax
inc eax
test al, al
test ebx, ebx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x400
push 0
push 0
push 0
push 0x61fed4
push dword [ebp - 4]
push 0x61fee4
push dword [ebp - 8]
lea eax, [ebp - 0x64]
mov edx, 4
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x64]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
push ebx
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
mov eax, dword [ebp - 0xc]
push eax
call sub.userenv.dll_DestroyEnvironmentBlock
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61fe26
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61fe50
lea eax, [ebp - 0x64]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x624684
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00624740
test bl, bl
je 0x6246ac
push 0
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, esi
call sub.rtl120.bpl__System_TObject_Free_qqrv
pop esi
pop ebx
ret
mov byte [esi + 0x68], 1
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_SetEvent
pop esi
pop ebx
ret

Function at 0x624740
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, esi
call sub.rtl120.bpl__Classes_TThread_Terminate_qqrv
test bl, bl
je 0x624766
push 0
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, esi
call sub.rtl120.bpl__System_TObject_Free_qqrv
pop esi
pop ebx
ret
mov byte [esi + 0x44], 1
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_SetEvent
pop esi
pop ebx
ret
Function at 0x62a7c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x62a8db
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x62a89d
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0062a2fc
test al, al
je 0x62a824
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x62a8ec
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x62a841
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x62a893
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x62a8ec
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x62a893
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.0062a5dc
mov eax, dword [ebp - 0x10]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62a8c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62a8e2
lea eax, [ebp - 0x10]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x62cab8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004024a4
ret
Function at 0x62cbe4
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x62cd32
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.0062cab8
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x62cd11
xor eax, eax
push ebp
push 0x62cd0a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x62ccf3
xor eax, eax
push ebp
push 0x62ccec
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x62ccd5
xor eax, eax
push ebp
push 0x62ccce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.0062caec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62ccd5
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62ccf3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62cd11
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.0062cb70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62cd39
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x62ce94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x62cf08
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x7a2004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62cf0f
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x644d7c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
xor eax, eax
push ebp
push 0x644e38
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov esi, 8
mov ebx, 0x78cabc
mov edx, dword [ebx]
mov eax, edi
call sub.rtl120.bpl__Strutils_AnsiContainsStr_qqrx20System_UnicodeStringt1
test al, al
jne 0x644e1d
add ebx, 4
dec esi
jne 0x644da6
lea edx, [ebp - 8]
mov eax, edi
call sub.rtl120.bpl__Sysutils_ExtractFileDrive_qqrx20System_UnicodeString
cmp dword [ebp - 8], 0
je 0x644e1d
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, eax
inc edx
mov ecx, 0x7fffffff
mov eax, edi
call sub.rtl120.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
mov edx, 0x644e58
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Strutils_AnsiContainsStr_qqrx20System_UnicodeStringt1
test al, al
jne 0x644e1d
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
jne 0x644e1d
mov eax, edi
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.shlwapi.dll_PathIsNetworkPathW
test eax, eax
jne 0x644e1d
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644e3f
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x667b88
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push str.bad_pack_level
cmp esi, 1
jl 0x667ba6
cmp esi, 8
jle 0x667baa
xor eax, eax
jmp 0x667baf
mov eax, 1
push eax
push ebx
call fcn.0066650a
add esp, 0xc
xor edx, edx
mov dword [ebx + 0x6af78], edx
cmp dword [ebx + 0x6af70], 0
jne 0x667bde
mov dword [ebx + 0x6af78], 1
mov dword [ebx + 0x6af70], 0x10000
xor ecx, ecx
mov dword [ebx + 0x6af6c], ecx
push 0x1fffc
push 0
lea eax, [ebx + 0x4af70]
push eax
call fcn.0066ae64
add esp, 0xc
movzx edx, word [esi*8 + 0x78cc7a]
mov dword [ebx + 0x6af98], edx
movzx ecx, word [esi*8 + 0x78cc78]
mov dword [ebx + 0x6af9c], ecx
movzx eax, word [esi*8 + 0x78cc7c]
mov dword [ebx + 0x6afa0], eax
movzx edx, word [esi*8 + 0x78cc7e]
mov dword [ebx + 0x6af94], edx
cmp esi, 2
jg 0x667c3f
or word [edi], 4
jmp 0x667c48
cmp esi, 8
jl 0x667c48
or word [edi], 2
xor ecx, ecx
mov dword [ebx + 0x6af84], ecx
xor eax, eax
mov dword [ebx + 0x6af74], eax
mov esi, 0x8000
add esi, esi
push esi
lea eax, [ebx + 0x1af70]
push eax
push ebx
call dword [ebx + 0xc]
add esp, 0xc
mov dword [ebx + 0x6af90], eax
cmp dword [ebx + 0x6af90], 0
je 0x667c86
cmp dword [ebx + 0x6af90], 0xffffffff
jne 0x667c9a
mov dword [ebx + 0x6af8c], 1
xor edx, edx
mov dword [ebx + 0x6af90], edx
jmp 0x667ce4
xor ecx, ecx
mov dword [ebx + 0x6af8c], ecx
cmp dword [ebx + 0x6af90], 0x106
jae 0x667cb5
push ebx
call fcn.00667ebf
pop ecx
xor eax, eax
mov dword [ebx + 0x6af7c], eax
xor esi, esi
mov eax, dword [ebx + 0x6af7c]
shl eax, 5
xor edx, edx
mov dl, byte [ebx + esi + 0x1af70]
xor eax, edx
and eax, 0x7fff
mov dword [ebx + 0x6af7c], eax
inc esi
cmp esi, 2
jb 0x667cbf
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x669083
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x78cd4c
test edx, edx
jne 0x6690a1
xor eax, eax
jmp 0x669189
xor eax, 0xffffffff
cmp ebx, 8
jb 0x669169
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ebx, 8
cmp ebx, 8
jae 0x6690ad
test ebx, ebx
je 0x669186
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ebx
jne 0x66916d
xor eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret

Function at 0x66918d
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movsx edx, byte [ebp + 0xc]
xor edx, dword [eax]
and edx, 0xff
mov ecx, dword [edx*4 + 0x78cd4c]
mov edx, dword [eax]
shr edx, 8
xor ecx, edx
mov dword [eax], ecx
mov ecx, dword [eax]
and ecx, 0xff
add dword [eax + 4], ecx
imul edx, dword [eax + 4], 0x8088405
inc edx
mov dword [eax + 4], edx
mov ecx, dword [eax + 4]
shr ecx, 0x18
xor ecx, dword [eax + 8]
and ecx, 0xff
mov edx, dword [ecx*4 + 0x78cd4c]
mov ecx, dword [eax + 8]
shr ecx, 8
xor edx, ecx
mov dword [eax + 8], edx
pop ebp
ret
Function at 0x6693e9
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
push esi
call sub.kernel32.dll_GetFileInformationByHandle
test eax, eax
jne 0x66940d
mov eax, 0x200
jmp 0x669597
mov eax, dword [ebp - 0x48]
xor ebx, ebx
test al, 1
je 0x669419
or ebx, 1
test al, 2
je 0x669420
or ebx, 2
test al, 4
je 0x669427
or ebx, 4
test al, 0x10
je 0x66942e
or ebx, 0x10
test al, 0x20
je 0x669435
or ebx, 0x20
test al, 0x10
je 0x669441
or ebx, 0x40000000
jmp 0x669447
or ebx, 0x80000000
or ebx, 0x1000000
test al, 1
je 0x669453
jmp 0x669459
or ebx, 0x800000
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov edi, eax
cmp edi, 0x28
jbe 0x669507
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 2
lea edx, [ebp - 6]
push edx
push esi
call sub.kernel32.dll_ReadFile
push 0
push 0
push 0x24
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea ecx, [ebp - 4]
push ecx
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_ReadFile
movzx edx, word [ebp - 6]
cmp edx, 0x54ad
jne 0x669507
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
cmp edi, ecx
jbe 0x669507
push 0
push 0
push dword [ebp - 0xc]
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 4
lea edx, [ebp - 0x10]
push edx
push esi
call sub.kernel32.dll_ReadFile
cmp dword [ebp - 0x10], 0x5a4d
je 0x669501
cmp dword [ebp - 0x10], 0x454e
je 0x669501
cmp dword [ebp - 0x10], 0x454c
je 0x669501
cmp dword [ebp - 0x10], 0x4550
jne 0x669507
or ebx, 0x400000
cmp dword [ebp + 0xc], 0
je 0x669512
mov ecx, dword [ebp + 0xc]
mov dword [ecx], ebx
cmp dword [ebp + 0x10], 0
je 0x66951d
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
cmp dword [ebp + 0x14], 0
je 0x669567
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.00669340
add esp, 8
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.00669340
add esp, 8
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call fcn.00669340
add esp, 8
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
cmp dword [ebp + 0x18], 0
je 0x669595
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x12]
push edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.00669373
add esp, 0x10
movzx edx, word [ebp - 0x14]
movzx ecx, word [ebp - 0x12]
shl ecx, 0x10
or edx, ecx
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x66973f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, esi
cmp byte [ebx + 0x2d], 0
je 0x6697bb
cmp dword [ebx + 0x3c], 0
je 0x669770
cmp edi, dword [ebx + 0x40]
jbe 0x669770
push dword [ebx + 0x3c]
call fcn.0066b1b4
pop ecx
xor edx, edx
mov dword [ebx + 0x3c], edx
cmp dword [ebx + 0x3c], 0
jne 0x669787
mov ecx, edi
add ecx, ecx
push ecx
call fcn.0066b1dc
pop ecx
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], edi
push edi
push esi
push dword [ebx + 0x3c]
call fcn.0066ae40
add esp, 0xc
xor esi, esi
cmp edi, esi
jbe 0x6697b8
mov eax, dword [ebx + 0x3c]
mov dl, byte [eax + esi]
push edx
lea ecx, [ebx + 0x30]
push ecx
call fcn.0066920b
add esp, 8
mov edx, dword [ebx + 0x3c]
mov byte [edx + esi], al
inc esi
cmp edi, esi
ja 0x66979a
mov eax, dword [ebx + 0x3c]
cmp dword [ebx + 0x20], 0
je 0x6697f0
mov ecx, dword [ebx + 0x24]
add ecx, edi
cmp ecx, dword [ebx + 0x28]
jb 0x6697d6
mov dword [ebx + 0x14], 0x30000
xor eax, eax
jmp 0x669814
push edi
push eax
mov edx, dword [ebx + 0x20]
add edx, dword [ebx + 0x24]
push edx
call fcn.0066ae40
add esp, 0xc
add dword [ebx + 0x24], edi
mov eax, edi
jmp 0x669814
cmp dword [ebx + 4], 0
je 0x66980b
push 0
lea edx, [ebp - 4]
push edx
push edi
push eax
push dword [ebx + 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 4]
jmp 0x669814
mov dword [ebx + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x669c89
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x84], 0
je 0x669d04
mov edx, dword [ebx + 0x8c]
cmp edx, dword [ebx + 0x88]
jb 0x669cb7
xor eax, eax
jmp 0x669d4d
mov esi, dword [ebx + 0x88]
sub esi, dword [ebx + 0x8c]
cmp esi, eax
jbe 0x669cc9
mov esi, eax
push esi
mov eax, dword [ebx + 0x84]
add eax, dword [ebx + 0x8c]
push eax
push edi
call fcn.0066ae40
add esp, 0xc
add dword [ebx + 0x8c], esi
mov edx, dword [ebx + 0x74]
add edx, esi
mov dword [ebx + 0x74], edx
push esi
push edi
push dword [ebx + 0x78]
call fcn.00669083
add esp, 0xc
mov dword [ebx + 0x78], eax
mov eax, esi
jmp 0x669d4d
cmp dword [ebx + 0x7c], 0
je 0x669d44
push 0
lea edx, [ebp - 4]
push edx
push eax
push edi
push dword [ebx + 0x7c]
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x669d22
xor eax, eax
jmp 0x669d4d
mov edx, dword [ebx + 0x74]
add edx, dword [ebp - 4]
mov dword [ebx + 0x74], edx
push dword [ebp - 4]
push edi
push dword [ebx + 0x78]
call fcn.00669083
add esp, 0xc
mov dword [ebx + 0x78], eax
mov eax, dword [ebp - 4]
jmp 0x669d4d
mov dword [ebx + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x66f94c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x66fe2c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x78ef14], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x66ff06
cmp dword [0x78ef10], 0
jne 0x66ff06
cmp dword [0x78ef8c], 0
je 0x66fec0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00670770
add esp, 8
mov ebx, eax
test eax, eax
jne 0x66fea6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00670770
add esp, 8
mov ebx, eax
test eax, eax
jne 0x66fea6
lea ebx, [ebp - 0x84]
jmp 0x66fea7
inc ebx
call fcn.0066fde4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.user32.dll_MessageBoxA
jmp 0x66ff41
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x78ef18
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0066b654
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x78ef1b
push ebx
call sub.kernel32.dll_WriteFile
jmp 0x66ff41
cmp dword [0x78ef10], 0
je 0x66ff20
cmp dword [0x78ef10], 0xffffffff
je 0x66ff41
push esi
call dword [0x78ef10]
pop ecx
mov eax, dword [0x78ef14]
test eax, eax
je 0x66ff41
cmp dword [0x78ef14], 0xffffffff
je 0x66ff41
cmp byte [eax], 0
je 0x66ff41
push esi
push eax
call fcn.00670818
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x670818
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
test eax, eax
jne 0x670845
jmp 0x67087c
call fcn.006707c8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0066b654
pop ecx
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0066b654
pop ecx
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile
push ebx
call sub.kernel32.dll_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret