joyce8/EMBER2024-capa huggingface dataset:
Function at 0x617fff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 8]
push esi
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 8]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x61804d
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x61804d
xor al, al
jmp 0x618078
mov eax, dword [esi + 4]
test eax, eax
je 0x618076
cmp dword [eax + 0xc], 1
je 0x618076
mov ecx, dword [esi + 0x4c]
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi + 0x9c], 0
mov byte [esi + 0xa6], 0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x618f55
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.00618a40
test al, al
je 0x618f6c
push 0
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
Function at 0x61a487
Capabilities:
Check for unmoving mouse cursor
Hide graphical window

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
cmp byte [esi + 0x71], 0
je 0x61a49c
cmp byte [esi + 0x70], 0
je 0x61a49c
mov byte [esi + 0x70], 0
jmp 0x61a4a7
push 0
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00617fd1
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x61a60d
mov eax, dword [0x7d997c]
inc eax
and eax, reloc.WS2_32.dll_accept
jns 0x61a4cb
dec eax
or eax, 0xfffffffe
inc eax
mov dword [0x7d997c], eax
je 0x61a4ea
cmp byte [ecx + 9], 0
jne 0x61a4ea
call fcn.0061795e
mov ecx, dword [esi + 0x4c]
push 0x6ac
call fcn.0061aaff
mov eax, dword [esi + 4]
cmp dword [eax + 0xc], 1
je 0x61a60d
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 0x14]
push edi
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 4]
call ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x4c]
lea ecx, [esp + 0x10]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
push ecx
push dword [eax + 4]
call ebx
mov edi, dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x61a54c
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
push eax
call edi
test eax, eax
jne 0x61a60a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 0x34]
call ebp
mov eax, dword [esi + 0x4c]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x61a598
mov eax, dword [esi + 0x4c]
lea ecx, [esp + 0x10]
push ecx
push dword [eax + 0x34]
call ebx
test eax, eax
je 0x61a598
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
push eax
call edi
test eax, eax
jne 0x61a60a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x18]
push eax
push dword [esi + 0x14]
call ebp
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0xc]
push eax
call ebx
test eax, eax
je 0x61a5f3
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
push eax
call edi
test eax, eax
je 0x61a5f3
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x61a603
sub eax, 1
mov dword [esi + 0x9c], eax
jne 0x61a603
push 0
mov ecx, esi
call fcn.0061af63
jmp 0x61a603
push 0
mov ecx, esi
call fcn.0061af63
and dword [esi + 0x9c], 0
mov ecx, esi
call fcn.00618347
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x18
ret 4
Function at 0x61af63
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x61afcf
cmp dword [eax + 0xc], 1
je 0x61afcf
push ebx
mov bl, byte [ebp + 8]
cmp byte [esi + 0xa6], bl
je 0x61afce
movzx eax, bl
neg eax
sbb eax, eax
and eax, 4
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [esi + 0xa6], bl
mov ecx, dword [esi + 0x4c]
push 0
call fcn.0061ad82
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x61c767
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x40
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x48]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileInformationByHandle]
test eax, eax
jne 0x61c789
mov eax, 0x200
jmp 0x61c90a
mov ecx, dword [esp + 0x10]
mov edx, ecx
and edx, 1
push esi
mov esi, edx
test cl, 2
je 0x61c79d
or esi, 2
test cl, 4
je 0x61c7a5
or esi, 4
mov eax, ecx
and eax, 0x10
je 0x61c7af
or esi, 0x10
test cl, 0x20
je 0x61c7b7
or esi, 0x20
neg eax
sbb eax, eax
and eax, 0xc0000000
add eax, 0x81000000
or esi, eax
test edx, edx
jne 0x61c7d1
or esi, 0x800000
push ebx
push ebp
xor ebp, ebp
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
cmp ebx, 0x28
jbe 0x61c881
push ebp
push ebp
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push edi
call ebp
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x60]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0
push 0
push 0x24
push edi
call ebp
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, 0x54ad
cmp word [esp + 0x54], ax
jne 0x61c881
mov ecx, dword [esp + 0x14]
lea eax, [ecx + 0x34]
cmp ebx, eax
jbe 0x61c881
push 0
push 0
push ecx
push edi
call ebp
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 0x18]
cmp eax, 0x5a4d
je 0x61c87b
cmp eax, 0x454e
je 0x61c87b
cmp eax, 0x454c
je 0x61c87b
cmp eax, 0x4550
jne 0x61c881
or esi, 0x400000
mov eax, dword [esp + 0x58]
test eax, eax
je 0x61c88b
mov dword [eax], esi
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x61c895
mov dword [eax], ebx
mov esi, dword [esp + 0x60]
pop ebp
pop ebx
test esi, esi
je 0x61c8d7
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.0061da48
push dword [esp + 0x2c]
mov dword [esi], eax
push dword [esp + 0x2c]
mov dword [esi + 4], edx
call fcn.0061da48
push dword [esp + 0x1c]
mov dword [esi + 8], eax
push dword [esp + 0x1c]
mov dword [esi + 0xc], edx
call fcn.0061da48
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x61c907
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.0061d9eb
movzx ecx, word [esp + 0x4c]
movzx eax, word [esp + 0x50]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
xor eax, eax
pop esi
pop edi
add esp, 0x40
ret 0x14
Function at 0x61d00d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x61d01c
xor eax, eax
jmp 0x61d0fe
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
not ecx
cmp esi, 8
jb 0x61d0dd
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x727b48]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x727b48]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x727b48]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x727b48]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x727b48]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x727b48]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x727b48]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x727b48]
sub edi, 1
jne 0x61d036
pop edi
test esi, esi
je 0x61d0f9
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x727b48]
inc edx
sub esi, 1
jne 0x61d0e1
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x61d7ce
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
mov ebp, edi
mov ebx, edi
mov dword [esi + 0x6af80], 2
jmp 0x61d9b4
cmp dword [esi + 0x6af90], 3
jb 0x61d83d
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
mov eax, 0x7fff
and ecx, eax
and edx, eax
mov dword [esi + 0x6af7c], ecx
mov ebp, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebp
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebp, ebp
je 0x61d879
mov eax, dword [esi + 0x6af84]
sub eax, ebp
cmp eax, 0x7efa
ja 0x61d879
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x61d864
mov dword [esi + 0x6afa0], eax
push ebp
push esi
call fcn.0061e32c
mov ebx, eax
mov eax, dword [esi + 0x6af90]
cmp ebx, eax
jbe 0x61d879
mov ebx, eax
cmp ebx, 3
jb 0x61d949
lea eax, [ebx - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub eax, dword [esi + 0x6af88]
push eax
push esi
call fcn.0061d34c
sub dword [esi + 0x6af90], ebx
mov dword [esp + 0x14], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x61d90f
cmp dword [esi + 0x6af90], 3
jb 0x61d90f
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
xor ecx, eax
mov eax, 0x7fff
and ecx, eax
and edx, eax
mov dword [esi + 0x6af7c], ecx
mov ebp, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebp
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub ebx, 1
jne 0x61d8b5
mov eax, dword [esp + 0x14]
jmp 0x61d965
add dword [esi + 0x6af84], ebx
mov ebx, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [esp + 0x14]
jmp 0x61d96b
mov eax, dword [esi + 0x6af84]
movzx eax, byte [eax + esi + 0x1af70]
push eax
push edi
push esi
call fcn.0061d34c
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x61d9a2
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x61d983
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x61d985
mov edx, edi
mov eax, dword [esi + 0x6af84]
push edi
sub eax, ecx
push eax
push edx
push esi
call fcn.0061db98
mov eax, dword [esi + 0x6af84]
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x61d9b4
push esi
call fcn.0061da6c
cmp dword [esi + 0x6af90], edi
jne 0x61d7eb
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x61d9d2
lea edi, [esi + 0x1af70]
add edi, ecx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push eax
push edi
push esi
call fcn.0061db98
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x61e1ff
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push 7
pop ecx
lea eax, [ebx - 1]
cmp ecx, eax
push str.bad_pack_level
sbb al, al
inc al
push eax
push esi
call fcn.0061c4be
xor ebp, ebp
xor edi, edi
inc ebp
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x61e246
mov dword [esi + 0x6af78], ebp
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.00651ed0
movzx eax, word [ebx*8 + 0x727ae2]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x727ae0]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x727ae4]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x727ae6]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x61e2aa
mov eax, dword [esp + 0x1c]
or word [eax], 4
jmp 0x61e2b6
cmp ebx, 8
jl 0x61e2b6
mov eax, dword [esp + 0x1c]
or word [eax], cx
push 0x10000
lea ebx, [esi + 0x1af70]
mov dword [esi + 0x6af84], edi
push ebx
push esi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x61e319
cmp eax, 0xffffffff
je 0x61e319
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x61e2f4
push esi
call fcn.0061da6c
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x61e2fc
jmp 0x61e325
mov dword [esi + 0x6af8c], ebp
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x61f106
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x61f15d
mov eax, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
cmp eax, esi
jae 0x61f188
sub esi, eax
cmp esi, dword [ebp + 0xc]
jbe 0x61f132
mov esi, dword [ebp + 0xc]
push esi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0064fe80
add esp, 0xc
add dword [edi + 0x8c], esi
add dword [edi + 0x74], esi
push esi
push dword [ebp + 8]
push dword [edi + 0x78]
call fcn.0061d00d
mov dword [edi + 0x78], eax
mov eax, esi
jmp 0x61f18a
cmp dword [edi + 0x7c], 0
je 0x61f181
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x61f188
mov esi, dword [ebp - 4]
jmp 0x61f147
mov dword [edi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x61f630
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
movsx eax, byte [esp + 8]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x727b48]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x727b48]
mov dword [edx + 8], ecx
ret 8

Function at 0x61f679
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
cmp byte [esi + 0x2d], 0
je 0x61f6ee
cmp dword [esi + 0x3c], 0
je 0x61f6aa
cmp dword [esi + 0x40], edi
jae 0x61f6a4
push dword [esi + 0x3c]
call fcn.006375d6
and dword [esi + 0x3c], 0
pop ecx
cmp dword [esi + 0x3c], 0
jne 0x61f6ba
lea eax, [edi + edi]
push eax
call fcn.00637905
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push dword [esi + 0x3c]
call fcn.0064fe80
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x61f6eb
push ebp
lea ebp, [esi + 0x30]
mov eax, dword [esi + 0x3c]
movzx eax, byte [ebx + eax]
push eax
push ebp
call fcn.0061f749
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jb 0x61f6d1
pop ebp
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x61f71d
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x61f709
mov dword [esi + 0x14], 0x30000
jmp 0x61f741
push edi
add ecx, edx
push ebx
push ecx
call fcn.0064fe80
add esp, 0xc
mov eax, edi
add dword [esi + 0x24], edi
jmp 0x61f743
mov eax, dword [esi + 4]
test eax, eax
je 0x61f73a
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 0x10]
jmp 0x61f743
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x61f81f
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
push edi
mov edi, ecx
push 0x6a1
push dword [edi + 4]
call ebx
push 1
xor esi, esi
push esi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ebp, dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [edi + 0x70], esi
jne 0x61f965
push 2
push 0x172
push 0x122
push esi
push esi
push esi
push dword [edi + 4]
call ebp
mov esi, dword [edi + 4]
push 0xa7
call fcn.00588778
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
call esi
push 0x6a1
push dword [edi + 4]
call ebx
push 0x42
push 0x172
push 0x122
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
call ebp
cmp byte [edi + 0x50], 0
push 0x6a0
push dword [edi + 4]
jne 0x61f8b5
call ebx
push 0x40
push 0xf
push 0xc3
jmp 0x61f8c0
call ebx
push 0x40
push 0xf
push 0x109
push 0x13b
push 0xa
push 0
push eax
call ebp
push 0x6a2
push dword [edi + 4]
call ebx
push 0x41
xor ecx, ecx
push ecx
push ecx
push 0x136
push 0xd0
push ecx
push eax
call ebp
cmp byte [edi + 0x50], 0
jne 0x61f8f7
push 0xc0
jmp 0x61f8fc
push 0xc1
call fcn.00588778
push 0x6a0
push dword [edi + 4]
mov dword [esp + 0x18], eax
call ebx
push dword [esp + 0x10]
push eax
call esi
push 0x6a2
push dword [edi + 4]
call ebx
push 0xa9
mov esi, eax
call fcn.00588778
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x6a2
push dword [edi + 4]
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
cmp byte [edi + 0x50], cl
setne cl
dec ecx
and ecx, 5
push ecx
push eax
call esi
push 0x6b3
push dword [edi + 4]
call ebx
push 0
push eax
call esi
xor esi, esi
cmp dword [edi + 0x70], 1
jne 0x61fa53
push 2
push 0x64
push 0x136
push esi
push esi
push esi
push dword [edi + 4]
call ebp
mov esi, dword [edi + 4]
push 0xa8
call fcn.00588778
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x6a0
push dword [edi + 4]
call ebx
xor esi, esi
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x6a1
push dword [edi + 4]
call ebx
push 0x42
push 0x64
push 0x136
push esi
push esi
push esi
push eax
call ebp
push 0x6a2
push dword [edi + 4]
call ebx
push 0x41
push esi
push esi
push 0x28
push 0x98
push esi
push eax
call ebp
push 0x6a2
push dword [edi + 4]
call ebx
push 0xab
mov esi, eax
call fcn.00588778
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, 0x6b3
push esi
push dword [edi + 4]
call ebx
push 0x41
xor ecx, ecx
push ecx
push ecx
push 0x28
push 0xe4
push ecx
push eax
call ebp
push esi
push dword [edi + 4]
call ebx
push 0xaa
mov esi, eax
call fcn.00588778
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x6a2
push dword [edi + 4]
call ebx
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call ebp
push 0x6b3
push dword [edi + 4]
call ebx
push 5
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6206df
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
lea eax, [ebp - 0x220]
push esi
xor esi, esi
push esi
push 0x25
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x620719
mov ecx, esi
movzx eax, word [ecx + 0x728418]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x222], ax
test ax, ax
jne 0x620702
push 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0046f348
test al, al
jne 0x620748
mov ecx, esi
movzx eax, word [ecx + 0x728418]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x222], ax
test ax, ax
jne 0x620731
mov ecx, 0x105
lea eax, [ebp - 0x42c]
push ecx
push eax
push esi
push esi
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
neg eax
pop esi
sbb eax, eax
and eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x63a428
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x67146d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00671130

Function at 0x671478
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006712b1

Function at 0x67890b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00678279

Function at 0x678916
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006784b4
Function at 0x686c28
Capabilities:
Get common file path
Get disk information

Disassembly:
mov eax, 0x6b00a9
call fcn.006375a8
sub esp, 0x678
and dword [ebp - 4], 0
xor eax, eax
and dword [ebp - 0x28], 0
push ebx
push esi
push edi
push 8
pop ecx
lea esi, [ebp - 0x20]
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edi, [ebp - 0x3c]
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
xor ecx, ecx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
xor eax, eax
inc eax
cpuid
mov dword [esi], eax
lea eax, [ebp - 0x26c]
mov dword [esi + 4], ebx
xor ebx, ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov byte [ebp - 0x19], bl
movsd dword es:[edi], dword [esi]
push ebx
push 0x25
push eax
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov edi, 0x105
test eax, eax
je 0x686cee
push 0xa
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNameW]
test eax, eax
je 0x686cee
push edi
lea eax, [ebp - 0x478]
push eax
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x24]
push eax
call esi
test eax, eax
je 0x686cee
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
jmp 0x686cf1
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x686d2e
push 0x728418
lea eax, [ebp - 0x24]
push 0xa
push eax
call fcn.0066c6bf
add esp, 0xc
lea eax, [ebp - 0x478]
push edi
push eax
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x24]
push eax
call esi
test eax, eax
je 0x686d2e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
push str.cid2_
call fcn.0040d4cf
push 0x20
lea eax, [ebp - 0x48]
mov dword [ebp - 4], ebx
push eax
xor esi, esi
lea eax, [ebp - 0x60]
inc esi
push eax
mov dword [ebp - 0x28], esi
call fcn.00686c09
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
push eax
mov dword [ebp - 4], esi
call fcn.0040d5a9
push ebx
push esi
lea ecx, [ebp - 0x60]
call fcn.0040daff
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x68bdf4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x68be08
test al, 0x10
jne 0x68be19
xor ebx, ebx
push ebx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x68be1c
xor ebx, ebx
inc ebx
mov al, bl
pop ebx
ret 4