joyce8/EMBER2024-capa huggingface dataset:
Function at 0x605470
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x605483
xor eax, eax
pop esi
add esp, 8
ret
push esi
call fcn.0060b990
add esp, 4
test eax, eax
jne 0x605495
pop esi
add esp, 8
ret
mov eax, dword [esi]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x60550c
mov eax, dword [esp + 0x1c]
mov edi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x60553e
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x6054f8
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x6054c8
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x60553e
mov eax, dword [esp + 0x1c]
mov esi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x60553e
lea edi, [esp + 0x2c]
lea ebx, [eax - 1]
mov eax, dword [edi]
mov edx, dword [esi]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, esi
call dword [edx + 0x24]
add edi, 0xc
dec ebx
jne 0x605527
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret

Function at 0x6055b0
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x6055be
or eax, 0xffffffff
pop esi
ret
push esi
call fcn.0060b990
add esp, 4
test eax, eax
jne 0x6055d0
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
or eax, 0xffffffff
cmp ecx, 1
jne 0x6055eb
mov esi, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
pop esi
ret
cmp ecx, 2
jne 0x6055f8
mov ecx, dword [esi + 4]
call fcn.0060b980
pop esi
ret
Function at 0x605600
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x605613
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.0060b990
add esp, 4
test eax, eax
jne 0x605625
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x24]
test edi, edi
jg 0x605634
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x60568b
mov ebx, dword [ebx + 4]
push edi
call fcn.0061d01f
add esp, 4
mov ebp, eax
lea eax, [esp + 0x18]
push esi
push eax
push edi
push ebp
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x60566e
push ebp
call fcn.0061d048
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.0060a740
push ebp
mov esi, eax
call fcn.0061d048
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x6056cd
mov ebx, dword [ebx + 4]
lea edx, [edi + 8]
push edx
call fcn.00600fe0
mov esi, eax
add esp, 4
lea ecx, [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], edi
mov eax, dword [ebx]
push edi
push ecx
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
jne 0x6056ca
push esi
call fcn.00601070
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x6056f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x605703
xor eax, eax
pop esi
add esp, 0x10
ret
push esi
call fcn.0060b990
add esp, 4
test eax, eax
jne 0x605715
pop esi
add esp, 0x10
ret
mov eax, dword [esi]
mov ecx, 1
push ebx
push ebp
cmp eax, ecx
push edi
mov dword [esp + 0x10], 0
jne 0x6057d6
mov eax, dword [esi + 4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x14], ecx
jle 0x605853
lea ebx, [esp + 0x34]
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, reloc.wsock32.dll_connect
jne 0x60575e
mov esi, dword [ebx]
jmp 0x605772
push ebx
call fcn.0060b9c0
mov esi, eax
add esp, 4
test esi, esi
je 0x6057b6
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x60579d
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ecx
push esi
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x60579d
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x6057aa
push esi
call fcn.0060f1bb
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x605853
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x60574e
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp eax, 2
jne 0x605853
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 4]
cmp eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
jle 0x605853
dec eax
lea ebx, [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, reloc.wsock32.dll_connect
jne 0x605807
mov esi, dword [ebx]
jmp 0x60581b
push ebx
call fcn.0060b9c0
mov esi, eax
add esp, 4
test esi, esi
je 0x605845
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x605838
mov eax, dword [esp + 0x18]
push ecx
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
test ebp, ebp
je 0x605845
push esi
call fcn.0060f1bb
add esp, 4
mov eax, dword [esp + 0x24]
add ebx, 0xc
dec eax
mov dword [esp + 0x24], eax
jne 0x6057f7
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x605860
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x605876
mov eax, 1
pop esi
add esp, 0xc
ret
push esi
call fcn.0060b990
add esp, 4
test eax, eax
jne 0x60588d
mov eax, 1
pop esi
add esp, 0xc
ret
mov eax, dword [esi]
push ebx
push ebp
cmp eax, 1
push edi
mov dword [esp + 0x10], 1
jne 0x60593d
mov esi, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ebp, dword [sym.imp.kernel32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
mov ebx, eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x6059a5
cmp edi, ebx
jae 0x6059a5
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x6059a5
mov eax, dword [esp + 0x30]
test eax, eax
je 0x6059a5
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x2c]
push 1
push edx
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
push 0
push 0
push edi
push esi
mov ebx, eax
call ebp
test ebx, ebx
je 0x6059a5
mov al, byte [esp + 0x24]
test al, al
je 0x60599d
cmp al, 0x1a
jne 0x6059a5
pop edi
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
cmp eax, 2
jne 0x6059a5
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.0060b980
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov edi, eax
cmp edi, ebx
jae 0x6059a5
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x6059a5
mov eax, dword [esp + 0x30]
test eax, eax
je 0x6059a5
mov edx, dword [esi]
lea eax, [esp + 0x24]
push 1
push eax
mov ecx, esi
call dword [edx + 0x20]
mov edx, dword [esi]
push 0
push edi
mov ecx, esi
mov ebp, eax
call dword [edx + 0x18]
test ebp, ebp
je 0x6059a5
mov al, byte [esp + 0x24]
test al, al
je 0x60599d
cmp al, 0x1a
jne 0x6059a5
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x6059c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
push edi
jne 0x6059d9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push esi
call fcn.0060b990
add esp, 4
test eax, eax
jne 0x6059ee
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi]
xor edi, edi
cmp eax, 1
jne 0x605b2e
mov edi, dword [esi + 4]
mov esi, dword [sym.imp.kernel32.dll_SetFilePointer]
push eax
push 0
push 0
push edi
mov dword [esp + 0x24], edi
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x605a2c
push 2
push 0
push 0
push edi
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push 0x1000
xor ebp, ebp
call fcn.0060f2a4
add esp, 4
mov ebx, eax
lea eax, [esp + 0x20]
mov esi, ebx
push ebp
push eax
push 0x1000
push ebx
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x605b0e
mov edx, dword [esp + 0x20]
xor ecx, ecx
test edx, edx
jbe 0x605a74
mov al, byte [esi]
cmp al, 0xd
je 0x605ab6
cmp al, 0xa
je 0x605ab6
inc ecx
inc esi
cmp ecx, edx
jb 0x605a64
add ebp, edx
cmp edx, 0x1000
jb 0x605ab8
push 0x1000
push ebx
call fcn.0060f907
mov ebx, eax
mov eax, dword [esp + 0x28]
add esp, 8
cmp eax, 0x1000
jne 0x605ab8
lea ecx, [esp + 0x20]
push 0
lea esi, [ebx + ebp]
push ecx
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x605b0e
jmp 0x605a5a
add ebp, ecx
lea edx, [ebp + 1]
push edx
call fcn.00600fe0
mov ecx, dword [esp + 0x14]
mov edi, eax
mov al, byte [esi]
add esp, 4
add ecx, ebp
cmp al, 0xd
je 0x605ad6
cmp al, 0xa
jne 0x605adf
mov al, byte [esi + 1]
inc ecx
cmp al, 0xa
jne 0x605adf
inc ecx
mov eax, dword [esp + 0x14]
push 0
push 0
push ecx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
push ebp
push ebx
push edi
call fcn.0060ee40
push ebx
mov byte [edi + ebp], 0
call fcn.0060f1bb
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 2
push 0
push 0
push edi
call dword [sym.imp.kernel32.dll_SetFilePointer]
push ebx
call fcn.0060f1bb
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x605bbc
mov esi, dword [esi + 4]
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi]
push edx
push 0xffffffffffffffff
push 0
mov ecx, esi
call dword [eax + 0x30]
mov ebp, dword [esp + 0x20]
xor ebx, ebx
test eax, eax
jbe 0x605b77
mov cl, byte [ebp]
cmp cl, 0xd
je 0x605b77
cmp cl, 0xa
je 0x605b77
inc ebx
inc ebp
cmp ebx, eax
jb 0x605b64
lea eax, [ebx + 1]
push eax
call fcn.00600fe0
mov ecx, dword [esp + 0x18]
mov edi, eax
mov al, byte [ebp]
add esp, 4
add ecx, ebx
cmp al, 0xd
je 0x605b96
cmp al, 0xa
jne 0x605b9f
mov al, byte [ebp + 1]
inc ecx
cmp al, 0xa
jne 0x605b9f
inc ecx
mov edx, dword [esi]
push 0
push ecx
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
call fcn.0060ee40
add esp, 0xc
mov byte [ebx + edi], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x605ea0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
xor esi, esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x605ee3
push edi
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
call fcn.0060a630
add esp, 8
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x605ef0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x14c]
push ebp
mov ebp, dword [esp + 0x15c]
push esi
push edi
mov esi, dword [ebp]
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x605f7b
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x605f7b
test esi, esi
je 0x605f35
cmp esi, 0xffffffff
je 0x605f35
push esi
call dword [sym.imp.kernel32.dll_FindClose]
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp], esi
je 0x605fc1
mov eax, dword [esp + 0x160]
test eax, eax
je 0x605f64
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
je 0x605f7b
jmp 0x605f73
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x14]
test edx, eax
je 0x605f7b
mov dword [esp + 0x10], 1
test esi, esi
je 0x605fc1
cmp esi, 0xffffffff
je 0x605fc1
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x605ff8
mov eax, dword [esp + 0x160]
mov edi, dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x14]
push eax
push esi
je 0x605fce
call edi
test eax, eax
je 0x605fc1
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
jne 0x605ff8
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
jne 0x605fa9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
call edi
test eax, eax
je 0x605fc1
mov ebx, dword [esp + 0x15c]
test dword [esp + 0x14], ebx
jne 0x605ff8
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
jne 0x605fdb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00600fe0
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret

Function at 0x6061a0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0
push 0x20
push 3
push 0
push 3
push bind
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x6061c8
pop edi
or eax, eax
pop esi
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esp + 0x10], 0xffffffff
jne 0x6061ea
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x606230
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x60624e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x606243
pop esi
ret

Function at 0x606590
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
test ebx, ebx
push edi
jne 0x6065a9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push ebx
call fcn.0060b990
add esp, 4
test eax, eax
jne 0x6065be
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x34]
test edi, edi
je 0x6065d8
mov eax, dword [esp + 0x2c]
test eax, eax
jg 0x6065d8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x6066c0
mov ebp, dword [ebx + 4]
mov edi, dword [sym.imp.kernel32.dll_SetFilePointer]
push eax
push esi
push esi
push ebp
call edi
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
jne 0x606610
push 2
push esi
push esi
push ebp
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x606627
push 0
push ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov esi, eax
sub esi, ebx
jmp 0x60662b
mov esi, dword [esp + 0x2c]
push esi
call fcn.0061d01f
add esp, 4
mov ebx, eax
lea eax, [esp + 0x10]
push 0
push eax
push esi
push ebx
push ebp
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x606664
push 2
push eax
push eax
push ebp
call edi
push ebx
call fcn.0061d048
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
xor edi, edi
test edx, edx
mov ecx, ebx
jbe 0x606680
mov al, byte [ecx]
test al, al
je 0x606680
cmp al, 0x1a
je 0x606680
inc edi
inc ecx
cmp edi, edx
jb 0x606670
lea ecx, [edi + 1]
push ecx
call fcn.00600fe0
mov edx, dword [esp + 0x18]
add esp, 4
mov esi, eax
push 0
lea eax, [edi + edx]
push 0
push eax
push ebp
call dword [sym.imp.kernel32.dll_SetFilePointer]
push edi
push ebx
push esi
call fcn.0060ee40
push ebx
mov byte [edi + esi], 0
call fcn.0061d048
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x60673b
mov ebx, dword [ebx + 4]
mov ecx, ebx
mov edx, dword [ebx]
call dword [edx + 0x14]
test edi, edi
mov ebp, eax
jne 0x6066da
or eax, 0xffffffff
jmp 0x6066de
mov eax, dword [esp + 0x2c]
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
mov ecx, ebx
call dword [edx + 0x30]
mov edx, dword [esp + 0x10]
xor edi, edi
test eax, eax
jbe 0x60670d
mov cl, byte [edx]
test cl, cl
je 0x60670d
cmp cl, 0x1a
je 0x60670d
inc edi
inc edx
cmp edi, eax
jb 0x6066fc
lea edx, [edi + 1]
push edx
call fcn.00600fe0
add esp, 4
lea ecx, [edi + ebp]
mov esi, eax
mov eax, dword [ebx]
push 0
push ecx
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [esp + 0x10]
push edi
push edx
push esi
call fcn.0060ee40
add esp, 0xc
mov byte [edi + esi], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x606980
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x6078e0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
ret

Function at 0x607900
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x607941.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x607941.2
jmp dword [eax*4 + 0x6079cc]
mov word [esp + 0x48], di
jmp 0x60797a
mov word [esp + 0x48], 2
jmp 0x60797a
mov word [esp + 0x48], 3
jmp 0x60797a
mov word [esp + 0x48], 4
jmp 0x60797a
mov word [esp + 0x48], 7
jmp 0x60797a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.kernel32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x6079c4
cmp dword [esp + 0x70], edi
je 0x6079b0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x607a10
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push bind
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x607a79
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00600fe0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.kernel32.dll_ReadFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x607a80
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x607b12
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x607b04
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x607afc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x607ac5
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x607b20
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x607b70
push esi
push 1
call dword [sym.imp.user32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x607b65
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.0060a630
add esp, 8
mov edi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
call dword [sym.imp.user32.dll_CloseClipboard]
mov eax, edi
pop esi
pop edi
ret
mov eax, edi
pop edi
ret

Function at 0x607b80
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
test esi, esi
je 0x607c03
push ebp
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x607c03
push ebx
push edi
call dword [sym.imp.user32.dll_EmptyClipboard]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x42
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x607bf6
push ebx
call dword [sym.imp.kernel32.dll_GlobalLock]
mov edx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.user32.dll_SetClipboardData]
mov ebp, 1
call dword [sym.imp.user32.dll_CloseClipboard]
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
ret
mov eax, ebp
pop esi
pop ebp
ret
Function at 0x608030
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [esp + 0x11c]
push ebp
push esi
push edi
push eax
call fcn.0060a6c0
mov esi, dword [esp + 0x138]
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], edx
test ebp, ebp
je 0x60811e
test ecx, ecx
je 0x60811e
inc ecx
push ebx
push ecx
call fcn.0061d01f
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0060ee10
mov esi, eax
add esp, 0xc
test esi, esi
je 0x6080b2
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x608106
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push esi
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x6080f3
cmp eax, 0xea
jne 0x6080fb
mov dword [esp + 0x14], 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ebx
call fcn.0061d048
mov eax, dword [esp + 0x18]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x114
ret
pop edi
pop esi
mov eax, edx
pop ebp
add esp, 0x114
ret