joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6639a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.006633d8
test byte [ebx + 0x2dd], 4
jne 0x663a35
mov edx, esp
mov eax, ebx
call fcn.00522e2c
push esp
mov eax, ebx
call fcn.0052ca88
push eax
push 0
mov eax, ebx
test eax, eax
je 0x6639d5
sub eax, 0xfffffcdc
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x2b8]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x2cc], 0
jne 0x663a06
mov ecx, dword [0x6dc8c8]
mov dl, 1
mov eax, dword [0x508c04]
call fcn.0042a150
call fcn.00408f7c
mov eax, ebx
call fcn.00663fbc
cmp byte [ebx + 0x69], 0
jne 0x663a3c
mov eax, ebx
call fcn.0052cdb8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x663a3c
push 0
mov eax, ebx
call fcn.0052cdb8
push eax
call sub.user32.dll_ShowWindow
jmp 0x663a3c
mov eax, ebx
call fcn.00528504
add esp, 0x10
pop ebx
ret

Function at 0x67f2d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004099a0
xor eax, eax
push ebp
push 0x67f42a
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x6dc334]
call fcn.0067f280
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
xor eax, eax
push ebp
push 0x67f406
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffe82af9
push 0
push 0x17d507
call fcn.0067d81c
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, 0x10
call fcn.00414c10
push 0
push 0x122cee
push 0
push 0x122cee
call fcn.0067d81c
mov ecx, eax
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.00414c10
mov dword [ebp - 0x5c], 0x44
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.00409e74
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x67f3a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67f414
push 0xffffffffffffffff
push 0xffea2919
push 0
push 0x16e857
call fcn.0067d81c
push eax
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x67f3e6
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
jmp 0x67f3ea
mov byte [ebp - 9], 0
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67f414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67f431
lea eax, [ebp - 4]
call fcn.004098bc
ret
Function at 0x680bf8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x680c00
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x680dc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x6dc334]
call fcn.00680ba8
mov dword [ebp - 0xc], eax
mov al, byte [0x6dc335]
call fcn.00680ba8
add dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x680c6d
mov eax, dword [ebp - 0xc]
cdq
mov dword [0x6dc340], eax
mov dword [0x6dc344], edx
mov eax, dword [ebp - 0xc]
cdq
add eax, dword [0x6dc340]
adc edx, dword [0x6dc344]
mov dword [0x6dc340], eax
mov dword [0x6dc344], edx
jmp 0x680da3
cmp dword [0x6dc330], 0
je 0x680c89
mov eax, dword [ebp - 4]
mov edx, dword [0x6dc330]
call fcn.00409c9c
jmp 0x680da3
xor eax, eax
push ebp
push 0x680cfc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffe35bd1
push 0
push 0x1cac2f
call fcn.0067d81c
call fcn.004251c0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0x109b6a
push 0
push 0x10936a
call fcn.0067d81c
push eax
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a4dc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dl, 1
call fcn.004246ec
test al, al
jne 0x680cf2
mov eax, dword [ebp - 4]
call fcn.004e9bec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x680d0e
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0042b424
push dword [ebp - 0x20]
mov al, byte [0x680dd4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0x1b9d39
lea edx, [ebp - 0x28]
mov eax, 0x680de4
call fcn.0067d9b4
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
call fcn.0067f984
lea eax, [ebp - 0x10]
xor ecx, ecx
pop edx
call fcn.0042dcf8
push dword [ebp - 0x24]
mov eax, 0x4dc87c
call fcn.00407350
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x2c]
call fcn.0042e934
push dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040a768
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0042b424
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00409c9c
mov eax, 0x6dc330
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call fcn.00409c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x680dcd
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.0040991c
lea eax, [ebp - 0x10]
call fcn.004098bc
ret
Function at 0x680ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004099a0
xor eax, eax
push ebp
push 0x681039
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6dc338]
add eax, eax
add eax, 0x3f778e
mov dword [ebp - 0x1c], eax
mov edx, 0x681054
mov eax, dword [ebp - 0x1c]
call fcn.00680dfc
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x680f55
jmp 0x681015
mov eax, dword [ebp - 8]
call fcn.004098bc
call fcn.0042fd60
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.0042f4d4
push 0xffffffffffffffff
push 0xffefad66
push 0
push 0x1052ab
call fcn.0067d81c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
call fcn.0040c754
test eax, eax
jl 0x680fae
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov cl, byte [ebp - 0x10]
xor byte [eax + edx], cl
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x680f9a
push 0
push 0x1b7159
push 0
push 0x1b715a
call fcn.0067d81c
mov ecx, eax
mov dl, 1
mov eax, dword [0x602214]
call fcn.00603274
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x681003
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
call fcn.0040c760
mov ecx, eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00602e50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x68100d
mov eax, dword [ebp - 0xc]
call fcn.00407ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x681040
lea eax, [ebp - 0x18]
mov edx, dword [0x404b8c]
call fcn.0040cc48
lea eax, [ebp - 4]
call fcn.004098bc
ret
Function at 0x687f8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6880bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x6dc39c]
mov byte [ebp - 9], al
jmp 0x687ff6
mov al, byte [ebp - 9]
xor al, 1
mov byte [ebp - 9], al
lea eax, [ebp - 0x10]
call fcn.004098bc
cmp byte [0x6dc39c], 0
je 0x687fe9
cmp byte [0x6dc39d], 0
je 0x687fe9
lea eax, [ebp - 0x10]
mov edx, 0x6880d8
call fcn.00409ce4
jmp 0x687ff6
lea eax, [ebp - 0x10]
mov edx, 0x688108
call fcn.0040a688
cmp byte [ebp - 9], 0
jne 0x687fb8
mov eax, dword [ebp - 4]
call fcn.004098bc
xor eax, eax
push ebp
push 0x688077
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x14caa0
push 0
push 0x14c2a0
call fcn.0067d81c
call fcn.004251c0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
push 0xffe58b2d
push 0
push 0x1a7cd3
call fcn.0067d81c
push eax
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a4dc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dl, 1
call fcn.004246ec
test al, al
jne 0x68806d
mov eax, dword [ebp - 4]
call fcn.004e9bec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x688089
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0042b424
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00409c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6880c3
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040991c
ret
Function at 0x689960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x689a4f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0040e574
push eax
call sub.shell32.dll_SHGetMalloc
lea eax, [ebp - 8]
push eax
push 2
push 0
push 0xf6b90
push 0
push 0xf6b90
call fcn.0067d81c
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, 0x104
call fcn.00406f00
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.0040a4dc
mov eax, dword [ebp - 0xc]
call fcn.00406f1c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 0
push 0x13f920
push 0
push 0x13f920
call fcn.0067d81c
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409dac
cdq
cmp edx, dword [esp + 4]
jne 0x689a15
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x689a31
jmp 0x689a19
pop edx
pop eax
jle 0x689a31
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0042b424
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00409c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x689a56
lea eax, [ebp - 0x18]
call fcn.004098bc
lea eax, [ebp - 0x10]
call fcn.0040e574
ret
Function at 0x68c2e0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x68c484
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, 0x68c49c
call fcn.00409ce4
mov dword [ebp - 0x18], 0x672454
mov byte [ebp - 0x19], 1
cmp dword [0x6dc3a4], 0xffffffff
jne 0x68c331
cmp dword [0x6dc3a0], 0xff9a3b2b
jae 0x68c33a
jmp 0x68c333
jge 0x68c33a
mov byte [0x6dc39c], 0
mov byte [ebp - 0x19], 1
cmp byte [0x6dc39d], 0
je 0x68c34f
mov eax, dword [0x6dc3a8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x68c380
cmp byte [ebp - 0x19], 0
je 0x68c380
cmp byte [0x6dc39c], 0
je 0x68c380
mov dword [ebp - 0x18], 0x41f52b
jmp 0x68c45e
mov eax, dword [ebp - 0x14]
mov edx, 0x68c4b8
call fcn.0040a818
je 0x68c3ac
cmp dword [0x6dc3a4], 0xffffffff
jne 0x68c3a3
cmp dword [0x6dc3a0], 0xffffffff
jae 0x68c3ac
jmp 0x68c3a5
jge 0x68c3ac
mov byte [0x6dc39d], 0
lea eax, [ebp - 0xc]
call fcn.0040e574
push eax
call sub.shell32.dll_SHGetMalloc
lea eax, [ebp - 0x10]
push eax
push 0x26
push 0
push 0x194dc4
push 0
push 0x194dc4
call fcn.0067d81c
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, 0x104
call fcn.00406f00
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a4dc
mov eax, dword [ebp - 8]
call fcn.00406f1c
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 0
push 0x14dcda
push 0
push 0x14dcda
call fcn.0067d81c
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409dac
cdq
cmp edx, dword [esp + 4]
jne 0x68c442
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x68c45e
jmp 0x68c446
pop edx
pop eax
jle 0x68c45e
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0042b424
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00409c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68c48b
lea eax, [ebp - 0x20]
call fcn.004098bc
lea eax, [ebp - 0x14]
call fcn.004098bc
lea eax, [ebp - 0xc]
call fcn.0040e574
ret
Function at 0x68f9c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x68fba2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004098bc
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
call fcn.00409ce4
cmp dword [ebp - 0x1c], 0
jne 0x68fa58
push 0
push 0x100f5f
push 0
push 0x100f5e
call fcn.0067d81c
add eax, 0x104
adc edx, 0
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.0040a608
push 0xffffffffffffffff
push 0xffe69b98
push 0
push 0x196469
call fcn.0067d81c
add eax, 0x104
push eax
mov eax, dword [ebp - 0x1c]
call fcn.0040a478
push eax
mov eax, dword [0x6e0634]
push eax
call sub.kernel32.dll_GetModuleFileNameW
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.0040a608
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.0040a478
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push 0xffef87a1
push 0
push 0x10785f
call fcn.0067d81c
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x68fa9a
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x68fb8c
jmp 0x68faa2
pop edx
pop eax
jle 0x68fb8c
mov eax, dword [ebp - 0x14]
call fcn.00406f00
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x68fb45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0xffffffffffffffff
push 0xffeb98c1
push 0
push 0x14673f
call fcn.0067d81c
push eax
mov eax, dword [ebp - 0x1c]
call fcn.0040a478
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x68fbb0
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
call fcn.00414c0c
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x28]
mov ax, word [eax + 8]
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xc]
call fcn.00414c0c
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x28]
mov ax, word [eax + 0xc]
mov word [ebp - 0x1e], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68fb4c
mov eax, dword [ebp - 0x18]
call fcn.00406f1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68fba9
lea eax, [ebp - 0x1c]
call fcn.004098bc
ret
Function at 0x68fc74
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004099a0
xor eax, eax
push ebp
push 0x68fd13
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1acd4d
lea edx, [ebp - 8]
mov eax, 0x68fd2c
call fcn.0067d9b4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0068cb00
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00409ce4
cmp dword [ebp - 4], 0
je 0x68fcf0
push 5
push 0x68fd48
push 0x68fd48
mov eax, dword [ebp - 4]
call fcn.0040a478
push eax
mov eax, dword [ebp - 8]
call fcn.0040a478
push eax
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68fd1a
lea eax, [ebp - 0x10]
call fcn.004098bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040991c
ret
Function at 0x6a0a10
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x6a0a18
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6a0bd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x6dc40c]
mov byte [ebp - 0x15], al
mov al, byte [0x6dc40d]
xor al, 1
mov byte [ebp - 0x15], al
jmp 0x6a0a98
mov al, byte [ebp - 0x15]
xor al, 1
mov byte [ebp - 0x15], al
lea eax, [ebp - 0x1c]
call fcn.004098bc
cmp byte [0x6dc40c], 0
jne 0x6a0a6a
cmp byte [0x6dc40d], 0
je 0x6a0a98
cmp byte [0x6dc40c], 0
je 0x6a0a8b
cmp byte [0x6dc40d], 0
je 0x6a0a8b
lea eax, [ebp - 0x1c]
mov edx, 0x6a0bf0
call fcn.00409ce4
jmp 0x6a0a98
lea eax, [ebp - 0x1c]
mov edx, 0x6a0c14
call fcn.0040a688
cmp byte [ebp - 0x15], 0
jne 0x6a0a48
push 0
push 0x12153c
push 0
push 0x12153c
call fcn.0067d81c
push edx
push eax
mov eax, dword [ebp - 4]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x6a0ac7
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x6a0ae8
jmp 0x6a0acb
pop edx
pop eax
jle 0x6a0ae8
push 0xffffffffffffffff
push 0xffe7620b
push 0
push 0x189df5
call fcn.0067d81c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
push 0
push 0x16d5c4
push 0
push 0x16d5c4
call fcn.0067d81c
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x6a0b15
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x6a0baf
jmp 0x6a0b1d
pop edx
pop eax
jle 0x6a0baf
push 0
push 0x12b51c
lea edx, [ebp - 0x20]
mov eax, 0x6a0c48
call fcn.0067d9b4
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.0042e8b0
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
pop edx
call fcn.0040a6e0
push 0
push 0x187fad
lea edx, [ebp - 0xc]
mov eax, 0x6a0c78
call fcn.0067d9b4
push 0
push 0x109190
lea edx, [ebp - 0x10]
mov eax, 0x6a0c98
call fcn.0067d9b4
push 0
push 0x6a0cb4
mov eax, dword [ebp - 0x14]
call fcn.0040a478
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040a478
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a478
push eax
push 0
push 0x17a968
push 0
push 0x17a968
call fcn.0067d81c
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0bde
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040991c
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040991c
ret
Function at 0x6a1348
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x6a1350
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6a1575
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x85c2ab
mov dword [ebp - 0x10], 0x431d03
mov eax, dword [ebp - 0x10]
neg eax
sub eax, 0x7e6fe8
cdq
cmp edx, dword [0x6dc41c]
jne 0x6a139a
cmp eax, dword [0x6dc418]
jbe 0x6a13ae
jmp 0x6a139c
jle 0x6a13ae
mov eax, dword [ebp - 0x14]
sub eax, 0x183481
cmp eax, dword [ebp - 0x10]
setne byte [0x6dc40c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0x5bf590
mov byte [ebp - 0x15], 0
cmp byte [0x6dc40d], 0
jne 0x6a13d0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jle 0x6a13da
cmp byte [ebp - 0x15], 0
je 0x6a13da
cmp dword [ebp - 0x14], 0
xor eax, eax
push ebp
push 0x6a1458
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1cbde6
push 0
push 0x1cb5e6
call fcn.0067d81c
call fcn.004251c0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
push 0xfff07737
push 0
push 0xf90c9
call fcn.0067d81c
push eax
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.0040a4dc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dl, 1
call fcn.004246ec
test al, al
jne 0x6a144e
lea eax, [ebp - 0x24]
call fcn.004e9bec
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00409c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6a1475
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0042b424
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00409c9c
mov eax, dword [ebp - 8]
call fcn.004098bc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dl, 1
call fcn.004246ec
test al, al
jne 0x6a1507
mov al, byte [0x6a1584]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push 0x1767ee
lea edx, [ebp - 0x34]
mov eax, 0x6a1594
call fcn.0067d9b4
mov eax, dword [ebp - 0x34]
push eax
push 0
push 0x108175
lea edx, [ebp - 0x38]
mov eax, 0x6a15c8
call fcn.0067d9b4
mov eax, dword [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
call fcn.004e9b54
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x1c]
call fcn.0042b424
lea eax, [ebp - 0x1c]
pop edx
pop ecx
call fcn.0042dcf8
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.00409c9c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dl, 1
call fcn.004246ec
test al, al
je 0x6a1547
push 0
push 0x13317b
lea edx, [ebp - 0x40]
mov eax, 0x6a15f8
call fcn.0067d9b4
mov eax, dword [ebp - 0x40]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0042e504
lea eax, [ebp - 0x20]
pop edx
call fcn.0042d6a8
test al, al
je 0x6a155a
lea eax, [ebp - 0x44]
call fcn.00691a54
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
call fcn.00409c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a157c
lea eax, [ebp - 0x44]
mov edx, 0xb
call fcn.0040991c
ret
Function at 0x106b01b8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106b0308
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x106b01de
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106b01ca
add dl, dl
jne 0x106b01e9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106b023c
xor eax, eax
add dl, dl
jne 0x106b01f6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106b02dd
add dl, dl
jne 0x106b0205
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106b0210
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106b021b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106b0226
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106b0232
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x106b01d5
mov eax, 1
add dl, dl
jne 0x106b024a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106b0255
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106b0241
sub eax, ebx
mov ebx, 1
jne 0x106b0288
mov ecx, 1
add dl, dl
jne 0x106b026e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106b0279
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106b0265
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106b01d5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x106b029f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106b02aa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106b0296
cmp eax, 0x7d00
jae 0x106b02cd
cmp eax, 0x500
jb 0x106b02c8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106b01d5
cmp eax, 0x7f
ja 0x106b02d0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106b01d5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x106b02fe
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x106b01d5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10