joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6399a0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00407284
ret

Function at 0x63a4b8
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x63a4c0
push ebx
push esi
xor eax, eax
push ebp
push 0x63a692
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x689f18], 0
jne 0x63a655
call fcn.0063a3a4
test al, al
jne 0x63a655
mov byte [0x689f18], 1
call fcn.00424be0
fstp qword [ebp - 0x10]
wait
call fcn.00424be0
fstp qword [0x689f10]
wait
lea edx, [ebp - 4]
mov eax, 3
call fcn.0064a7f4
mov eax, dword [ebp - 4]
test eax, eax
je 0x63a526
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x63a56b
mov esi, 1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
call fcn.0040a600
lea eax, [ebp - 0x14]
mov edx, 0x63a6ac
call fcn.0040a7ec
mov eax, dword [ebp - 0x14]
call fcn.0040a5d8
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov cl, 1
mov dl, 1
xor eax, eax
call fcn.0064a5f0
inc esi
dec ebx
jne 0x63a531
mov eax, dword [ebp - 4]
test eax, eax
je 0x63a577
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x63a5bc
mov esi, 1
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
call fcn.0040a600
lea eax, [ebp - 0x18]
mov edx, 0x63a6c0
call fcn.0040a7ec
mov eax, dword [ebp - 0x18]
call fcn.0040a5d8
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov cl, 1
xor edx, edx
xor eax, eax
call fcn.0064a5f0
inc esi
dec ebx
jne 0x63a582
lea edx, [ebp - 0x1c]
mov eax, 0x63a6d4
call fcn.006464a4
push dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
mov eax, dword [0x68aab0]
mov eax, dword [eax]
call fcn.00420950
push dword [ebp - 0x20]
lea eax, [ebp - 0x24]
push eax
push 0
push 0x3e8
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00424be0
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00645a84
call fcn.0040b578
mov edx, eax
xor ecx, ecx
mov eax, 0x63a744
call fcn.0063ccfc
push dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040a8cc
push 0
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
call fcn.0063c6a0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x63a754
call fcn.0040a844
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00639fe0
call fcn.0064b7e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63a699
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00409848
lea eax, [ebp - 0x28]
call fcn.0040980c
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00409848
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret
Function at 0x63bdfc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004098cc
xor eax, eax
push ebp
push 0x63c00a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
jne 0x63be3a
mov eax, dword [ebp - 0xc]
call fcn.0064f014
mov eax, dword [ebp - 4]
call fcn.0064b974
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x63be59
cmp dword [ebp - 0x20], 6
jae 0x63be5f
jmp 0x63bfe4
jl 0x63bfe4
mov eax, dword [ebp - 4]
call fcn.00646ec0
mov esi, eax
cmp esi, 1
je 0x63be73
cmp esi, 2
jne 0x63be9a
movzx eax, byte [ebp + 0xc]
push eax
push 1
lea ecx, [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00646fc8
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0063bd84
jmp 0x63bfe4
mov dword [ebp - 0x14], 0x600000
mov eax, dword [ebp - 0x14]
add eax, eax
cdq
cmp edx, dword [ebp - 0x1c]
jne 0x63beb3
cmp eax, dword [ebp - 0x20]
jb 0x63becd
jmp 0x63beb5
jl 0x63becd
push 0
push 2
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.0040b658
add eax, dword [ebp - 0x20]
add eax, 8
mov dword [ebp - 0x14], eax
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040a5d8
push eax
call sub.kernel32.dll_CreateFileW_1
mov edi, eax
cmp edi, 0xffffffff
je 0x63bfe4
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x14]
add edx, 0x400
lea eax, [ebp - 8]
xor ecx, ecx
call fcn.0040a2f4
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x63bfd6
cmp dword [ebp - 0x28], 1
jb 0x63bfd6
mov esi, 0x400
push 0
lea eax, [ebp - 0x2c]
push eax
push 1
lea eax, [ebp - 0x21]
push eax
push edi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x63bf87
cmp dword [ebp - 0x2c], 1
jb 0x63bf87
inc dword [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.00409da8
mov edx, dword [ebp - 0x28]
movzx ecx, byte [ebp - 0x21]
mov byte [eax + edx - 1], cl
movzx ebx, byte [ebp - 0x21]
cmp bl, 0x27
jb 0x63bf87
cmp bl, 0x7a
ja 0x63bf87
dec esi
jne 0x63bf44
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 0x28]
call fcn.0040a2f4
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x63bfab
mov eax, dword [ebp - 0x3c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 6
jl 0x63bfc6
movzx eax, byte [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0063bb7c
mov eax, dword [ebp - 0x28]
xor edx, edx
add dword [ebp - 0x38], eax
adc dword [ebp - 0x34], edx
jmp 0x63bf06
lea eax, [ebp - 8]
call fcn.0040980c
push edi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63c011
lea eax, [ebp - 0x40]
call fcn.004097e8
lea eax, [ebp - 8]
call fcn.0040980c
lea eax, [ebp - 4]
call fcn.004097e8
ret
Function at 0x63ceb8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004098cc
mov eax, dword [ebp - 8]
call fcn.004098cc
xor eax, eax
push ebp
push 0x63cf55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x63cef2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x63cf11
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x63cf11
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a9fc
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x63cf1d
sub ebx, 4
mov ebx, dword [ebx]
push ebx
mov eax, dword [ebp - 8]
call fcn.0040a5d8
push eax
push 1
mov eax, dword [ebp - 4]
call fcn.0040a5d8
push eax
push esi
call sub.advapi32.dll_RegSetValueW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63cf5c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret

Function at 0x63d024
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004098cc
mov eax, dword [ebp - 8]
call fcn.004098cc
xor eax, eax
push ebp
push 0x63d0b8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x20019
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0063cf64
test eax, eax
jne 0x63d09d
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040a5d8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x63d094
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63d0bf
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret
Function at 0x63d1bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.004098cc
mov eax, dword [ebp - 8]
call fcn.004098cc
xor eax, eax
push ebp
push 0x63d316
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebx], eax
xor eax, eax
mov dword [esi], eax
push 0x20019
lea eax, [ebp - 0x10]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0063cf64
test eax, eax
jne 0x63d2f3
xor eax, eax
push ebp
push 0x63d2ec
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0
push ebx
push 0
mov eax, dword [ebp - 8]
call fcn.0040a5d8
mov edi, eax
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x63d2d5
mov eax, dword [ebx]
cmp eax, 0xf
ja 0x63d25d
bt word [ebp + 0x18], ax
jb 0x63d26e
mov ecx, dword [ebx]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0063d0c8
jmp 0x63d2d5
mov eax, dword [esi]
cmp eax, dword [ebp + 0x14]
jbe 0x63d2bc
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [esi]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x34]
mov ecx, 3
mov eax, 0x63d338
call fcn.00421cec
mov eax, dword [ebp - 0x14]
call fcn.006450e8
jmp 0x63d2d5
push esi
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63d2f3
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63d31d
lea eax, [ebp - 0x14]
call fcn.004097e8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret
Function at 0x63d3dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004098cc
mov eax, dword [ebp - 8]
call fcn.004098cc
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x63d406
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x63d537
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x20019
lea eax, [ebp - 0x10]
push eax
movzx eax, byte [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0063cf64
test eax, eax
jne 0x63d51c
xor edx, edx
push ebp
push 0x63d515
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040a5d8
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x63d4fe
movzx eax, word [0x63d54c]
cmp byte [ebp + 0x10], 0
je 0x63d48e
movzx eax, word [0x63d550]
mov edx, dword [ebp - 0x14]
cmp edx, 0xf
ja 0x63d499
bt eax, edx
jb 0x63d4b9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0063d0c8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
call fcn.00408f98
jmp 0x63d51c
mov edx, dword [ebp - 0x18]
shr edx, 1
inc edx
mov eax, dword [ebp + 0xc]
call fcn.0040a76c
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x63d4f6
mov edx, dword [ebp - 0x18]
shr edx, 1
mov eax, dword [ebp + 0xc]
call fcn.0040a76c
mov byte [ebp - 9], 1
jmp 0x63d4fe
mov eax, dword [ebp + 0xc]
call fcn.004097e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63d51c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63d53e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret

Function at 0x63d5c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004098cc
mov eax, dword [ebp - 8]
call fcn.004098cc
xor eax, eax
push ebp
push 0x63d656
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x20019
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0063cf64
test eax, eax
jne 0x63d63b
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040a5d8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63d65d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret
Function at 0x63d7e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004098cc
mov eax, dword [ebp - 8]
call fcn.004098cc
xor eax, eax
push ebp
push 0x63d87d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [esi], eax
push 0x20019
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0063cf64
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x63d862
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 8]
call fcn.0040a5d8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63d884
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret

Function at 0x63daa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.004098cc
mov eax, dword [ebp - 8]
call fcn.004098cc
xor eax, eax
push ebp
push 0x63dbf9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0063d554
test al, al
jne 0x63daf7
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0063ceb8
push 0x20006
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0063cf64
test eax, eax
je 0x63db3c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x63dc18
call fcn.00421cec
mov eax, dword [ebp - 0x10]
call fcn.006450e8
jmp 0x63dbce
xor eax, eax
push ebp
push 0x63dbc7
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x63db53
xor eax, eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
push eax
push esi
movzx eax, bl
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040a5d8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x63dbb0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
movzx eax, bl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x63dc84
call fcn.00421cec
mov eax, dword [ebp - 0x1c]
call fcn.006450e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63dbce
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63dc00
lea eax, [ebp - 0x1c]
call fcn.004097e8
lea eax, [ebp - 0x10]
call fcn.004097e8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret
Function at 0x63de6c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63dede
push dword fs:[eax]
mov dword fs:[eax], esp
inc ecx
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a76c
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a5d8
push eax
push esi
push ebx
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040a5d8
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.0040a640
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63dee5
lea eax, [ebp - 4]
call fcn.004097e8
ret

Function at 0x63e168
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004098cc
mov eax, dword [ebp - 8]
call fcn.004098cc
xor eax, eax
push ebp
push 0x63e1eb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 2
lea eax, [ebp - 0xc]
push eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0063cf64
test eax, eax
jne 0x63e1d0
mov eax, dword [ebp - 8]
call fcn.0040a5d8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63e1f2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret

Function at 0x63e638
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004098cc
xor eax, eax
push ebp
push 0x63e71e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004097e8
cmp dword [ebp - 4], 0
je 0x63e689
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x63e689
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a9fc
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040a5d8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x63e708
mov eax, ebx
mov edx, 0x400
call fcn.0040a76c
mov eax, dword [ebx]
test eax, eax
je 0x63e6be
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.0040a5d8
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x63e6f8
mov eax, dword [ebx]
call fcn.0040a5d8
mov edx, eax
mov eax, ebx
call fcn.0040a640
jmp 0x63e6ff
mov eax, ebx
call fcn.004097e8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63e725
lea eax, [ebp - 4]
call fcn.004097e8
ret
Function at 0x644cf4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
mov esi, edx
imul ebx, dword [eax], 0x8088405
inc ebx
mov dword [eax], ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, esi
xor edx, edx
call fcn.0040b554
mov eax, edx
xor edx, edx
pop esi
pop ebx
ret

Function at 0x64533c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6453bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.0040a76c
mov esi, dword [ebx]
test esi, esi
je 0x64536c
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebx]
call fcn.0040a5d8
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, dword [ebx]
call fcn.0040a5d8
mov edx, eax
lea eax, [ebp - 8]
call fcn.0040a640
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00428e88
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6453c2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret

Function at 0x6453c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x645447
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.0040a76c
mov esi, dword [ebx]
test esi, esi
je 0x6453f8
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.0040a5d8
push eax
push esi
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebx]
call fcn.0040a5d8
mov edx, eax
lea eax, [ebp - 8]
call fcn.0040a640
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00428e88
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64544e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409848
ret

Function at 0x64619c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004098dc
xor eax, eax
push ebp
push 0x646226
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 1
jl 0x646210
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.006460c0
mov ebx, esi
dec ebx
test ebx, ebx
jl 0x6461e6
inc ebx
lea eax, [ebp - 0x18]
call fcn.0063e624
dec ebx
jne 0x6461db
mov ebx, esi
dec ebx
test ebx, ebx
jl 0x646210
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
movzx edi, byte [eax + esi]
lea eax, [ebp - 0x18]
call fcn.0063e624
movzx eax, al
xor edi, eax
mov eax, edi
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
dec ebx
jne 0x6461f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64622d
lea eax, [ebp - 4]
call fcn.0040980c
ret
Function at 0x646efc
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
je 0x646f92
mov eax, esp
xor ecx, ecx
mov edx, 3
call fcn.00407284
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [esp + 8]
push eax
push 3
lea eax, [esp + 0xc]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
cmp byte [esp], 0xff
jne 0x646f50
cmp byte [esp + 1], 0xfe
jne 0x646f50
mov esi, 1
jmp 0x646f7d
cmp byte [esp], 0xfe
jne 0x646f64
cmp byte [esp + 1], 0xff
jne 0x646f64
mov esi, 2
jmp 0x646f7d
cmp byte [esp], 0xef
jne 0x646f7d
cmp byte [esp + 1], 0xbb
jne 0x646f7d
cmp byte [esp + 2], 0xbf
jne 0x646f7d
mov esi, 3
mov edx, esi
mov eax, ebx
call fcn.00646f9c
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, esi
pop ecx
pop edx
pop esi
pop ebx
ret