joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66d5e2
Capabilities:
Read file on windows

Disassembly:
push 0x78
mov eax, 0x7b0cd9
call fcn.00645f96
mov esi, ecx
cmp dword [ebp + 0xc], 0
mov edi, dword [ebp + 8]
je 0x66d69d
test edi, edi
je 0x66d69d
call fcn.00669cd4
test al, al
je 0x66d69d
push dword [ebp + 0xc]
push edi
push dword [esi]
call fcn.007859ed
add esp, 0xc
mov edi, eax
cdq
mov ecx, esi
push edx
push eax
call fcn.0066cec7
test al, al
je 0x66d699
push str.cant_read_from_file_descriptor__d
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x50]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x84]
push eax
call fcn.0066154b
lea ecx, [ebp - 0x84]
call fcn.00661721
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
or eax, 0xffffffff
jmp 0x66d69f
mov eax, edi
jmp 0x66d69f
xor eax, eax
call fcn.00645f45
ret 8
Function at 0x66f0de
Capabilities:
Get common file path

Disassembly:
push 0x74
mov eax, 0x7b07c7
call fcn.00645f96
mov esi, dword [ebp + 8]
xor ebx, ebx
push str.TMPDIR
mov dword [ebp - 4], ebx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x74], ebx
call fcn.00670cef
pop ecx
push eax
lea ecx, [ebp - 0x70]
call fcn.00408c6d
lea eax, [ebp - 0x70]
xor edi, edi
push eax
inc edi
push esi
mov dword [ebp - 4], edi
call fcn.0066e42c
pop ecx
pop ecx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x74], edi
mov byte [ebp - 4], bl
call fcn.00408e36
mov ecx, esi
call fcn.00663864
test al, al
je 0x66f1d8
push 0x7d8af8
call fcn.00670cef
pop ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.00408c6d
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0066e42c
pop ecx
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00408ed9
lea ecx, [ebp - 0x30]
call fcn.00408e36
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], bl
call fcn.00408e36
mov ecx, esi
call fcn.00663864
test al, al
je 0x66f1d8
push str.TEMP
call fcn.00670cef
pop ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.00408c6d
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0066e42c
pop ecx
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00408ed9
lea ecx, [ebp - 0x30]
call fcn.00408e36
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], bl
call fcn.00408e36
mov ecx, esi
call fcn.00663864
test al, al
je 0x66f20c
push 0x105
push esi
lea ecx, [ebp - 0x7c]
call fcn.006616b6
mov ecx, eax
call fcn.0066191a
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x7c]
call fcn.006616dd
mov ecx, esi
call fcn.00663864
test al, al
jne 0x66f269
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.0066ed0e
pop ecx
pop ecx
push dword [0x7d7a80]
mov ecx, esi
push eax
call fcn.00670566
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.00408e36
mov eax, dword [0x7d7a80]
cmp edi, eax
jne 0x66f25b
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.00669c0e
pop ecx
pop ecx
mov ecx, esi
push dword [eax]
call fcn.0066ddf2
jmp 0x66f275
push eax
lea eax, [edi + 1]
mov ecx, esi
push eax
call fcn.0066caf7
jmp 0x66f275
push 0x7d7a84
mov ecx, esi
call fcn.00661777
mov eax, esi
call fcn.00645f45
ret

Function at 0x66fd78
Capabilities:
Set current directory

Disassembly:
push 0x78
mov eax, 0x7b0cd9
call fcn.00645f96
mov ecx, dword [ebp + 8]
call fcn.00669d63
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x66a4f5
push str.Could_not_set_current_working_directory
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x50]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x84]
push eax
call fcn.0066154b
lea ecx, [ebp - 0x84]
call fcn.00661721
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
mov al, bl
call fcn.00645f45
ret
push ebp
mov ebp, esp
pop ebp
jmp 0x66a46d
Function at 0x670b80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x28
mov eax, 0x7ae05d
call fcn.00645f96
mov ebx, dword [ebp + 0xc]
mov cl, bl
mov eax, dword [ebp + 8]
and cl, 1
mov byte [ebp - 0x31], cl
lea ecx, [ebp - 0x30]
push eax
shr ebx, 1
call fcn.00408c50
and dword [ebp - 4], 0
and bl, 1
je 0x670bb8
lea eax, [ebp - 0x30]
push eax
call fcn.0066fd08
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00669d63
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x670bd0
xor ebx, ebx
jmp 0x670bd7
test al, 0x10
jne 0x670bd7
mov bl, byte [ebp - 0x31]
lea ecx, [ebp - 0x30]
call fcn.00408e36
mov al, bl
call fcn.00645f45
ret

Function at 0x671b0d
Capabilities:
Create thread

Disassembly:
push 0x78
mov eax, 0x7b0cd9
call fcn.00645f96
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push 4
push ecx
push 0x67217d
push edx
push 0
call fcn.00786bd4
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
jne 0x671ba7
push str.Cant_create_thread
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x50]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x84]
push eax
call fcn.0066154b
lea ecx, [ebp - 0x84]
call fcn.00661721
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
xor al, al
jmp 0x671bb9
cmp dword [esi + 0xc], 0x32
je 0x671bb7
push dword [esi + 0xc]
mov ecx, esi
call fcn.00672081
mov al, 1
call fcn.00645f45
ret 8

Function at 0x671bf4
Capabilities:
Set thread local storage value

Disassembly:
push 0x8c
mov eax, 0x7b0c38
call fcn.00646002
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push esi
push fcn.00671bc1
push eax
call fcn.00728538
add esp, 0xc
and dword [ebp - 4], 0
or dword [ebp - 0x78], 0xffffffff
push esi
push dword [0x9da024]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x671cac
push str.Cannot_start_thread:_error_writing_TLS.
lea ecx, [ebp - 0x34]
call fcn.00408c6d
lea ecx, [ebp - 0x54]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x74]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 4
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x98]
push eax
call fcn.0066154b
lea ecx, [ebp - 0x98]
call fcn.00661721
lea ecx, [ebp - 0x74]
call fcn.00408e36
lea ecx, [ebp - 0x54]
call fcn.00408e36
lea ecx, [ebp - 0x34]
call fcn.00408e36
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.0070e1ce
or eax, 0xffffffff
jmp 0x671ce7
mov ecx, esi
call fcn.00671ace
push eax
call fcn.006cd5f0
pop ecx
mov esi, eax
jmp 0x671cd6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.0070e1ce
mov eax, esi
call fcn.00645f54
ret
Function at 0x671f81
Capabilities:
Resume thread

Disassembly:
push 0x78
mov eax, 0x7b0cd9
call fcn.00645f96
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x672005
push str.Cannot_resume_thread__lx
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x50]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x84]
push eax
call fcn.0066154b
lea ecx, [ebp - 0x84]
call fcn.00661721
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
xor al, al
jmp 0x672014
cmp dword [esi + 8], 4
je 0x672012
mov dword [esi + 8], 1
mov al, 1
call fcn.00645f45
ret

Function at 0x672418
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.00669d63
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
jne 0x67243c
xor al, al
jmp 0x67244e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
mov byte [esi], al
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x672e42
Capabilities:
Get geographical location

Disassembly:
push 0x288
mov eax, 0x7b0e30
call fcn.00645f96
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x230]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x294], ebx
call fcn.00408cc0
xor eax, eax
mov dword [ebp - 4], ebx
mov word [ebp - 0x210], ax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x672fb0
cmp eax, 1
je 0x672f94
jle 0x672fdb
cmp eax, 3
jle 0x672ea3
cmp eax, 4
je 0x672efb
cmp eax, 5
jne 0x672fdb
push 0x100
lea ecx, [ebp - 0x210]
push ecx
push eax
call fcn.0067300e
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x672fdb
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x290]
call fcn.0042aa63
lea eax, [ebp - 0x290]
mov byte [ebp - 4], 1
push eax
push edi
call fcn.00673293
pop ecx
pop ecx
lea ecx, [ebp - 0x290]
call fcn.00408e36
jmp 0x672fe9
push 3
push 2
lea eax, [ebp - 0x250]
push esi
push eax
call fcn.00672e42
add esp, 0x10
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 2
call fcn.00663864
test al, al
je 0x672f35
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], bl
call fcn.00408e36
jmp 0x672fdb
push 3
push 5
lea eax, [ebp - 0x270]
push esi
push eax
call fcn.00672e42
add esp, 0x10
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 3
call fcn.00663864
test al, al
je 0x672f69
lea ecx, [ebp - 0x270]
call fcn.00408e36
jmp 0x672f22
lea eax, [ebp - 0x270]
push eax
push 0x20
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x230]
call fcn.0066935a
mov ecx, eax
call fcn.00672bb5
mov ecx, eax
call fcn.0066935a
jmp 0x672f5c
cmp dword [ebp + 0x14], 2
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0xe
pop eax
push 0x16
pop ecx
cmove eax, ecx
push eax
jmp 0x672fbe
push 0x100
lea eax, [ebp - 0x210]
push eax
push 0xf
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x672fdb
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x230]
call fcn.006617cc
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00408c50
lea ecx, [ebp - 0x230]
call fcn.00408e36
mov eax, edi
call fcn.00645f45
ret

Function at 0x6730f7
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call fcn.00672d22
mov ecx, dword [0x9dbb68]
xor esi, esi
call fcn.00725e0b
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ebx, dword [0x9dbb68]
mov ecx, 0x1400
movzx eax, ax
cmp ax, cx
je 0x673166
mov ecx, eax
shr eax, 0xa
and ecx, 0x3ff
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
je 0x673176
push esi
mov ecx, ebx
call fcn.00705ab8
mov ecx, dword [ebp - 4]
cmp dword [eax + 0x24], ecx
jne 0x673161
push esi
mov ecx, ebx
call fcn.00705ab8
mov ecx, dword [ebp - 8]
cmp dword [eax + 0x28], ecx
je 0x673166
inc esi
cmp esi, edi
jb 0x673141
cmp esi, edi
jae 0x673176
push esi
mov ecx, ebx
call fcn.00705ab8
mov eax, dword [eax]
jmp 0x673179
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x675b51
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xf4
mov eax, 0x7b1324
call fcn.00645f96
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd8], ecx
test eax, eax
je 0x675c46
test ebx, ebx
je 0x675c46
push edx
call fcn.00669d63
push eax
push esi
call fcn.00674e13
mov edi, eax
add esp, 0xc
test edi, edi
je 0x675c46
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x675c4e
push str.Failed_to_load_resource___s_.
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x70]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0xec]
push eax
call fcn.0066154b
sub esp, 0x20
mov byte [ebp - 4], 3
mov ecx, esp
push dword [ebp - 0xd8]
call fcn.00408c50
lea eax, [ebp - 0xec]
push eax
call fcn.00672ad8
add esp, 0x24
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.00661721
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x90]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
xor al, al
call fcn.00645f45
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx], eax
test eax, eax
jne 0x675cff
push str.Failed_to_lock_resource___s_.
lea ecx, [ebp - 0x50]
call fcn.00408c6d
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 4
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0xd0]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 6
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x100]
push eax
call fcn.0066154b
sub esp, 0x20
mov byte [ebp - 4], 7
mov ecx, esp
push dword [ebp - 0xd8]
call fcn.00408c50
lea eax, [ebp - 0x100]
push eax
call fcn.00672ad8
add esp, 0x24
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x100]
call fcn.00661721
lea ecx, [ebp - 0xd0]
call fcn.00408e36
lea ecx, [ebp - 0xb0]
call fcn.00408e36
lea ecx, [ebp - 0x50]
jmp 0x675c41
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx], eax
mov al, 1
jmp 0x675c48
Function at 0x684cdd
Capabilities:
Read file on windows

Disassembly:
push 0x7c
mov eax, 0x7b02e1
call fcn.00645f96
mov edi, ecx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
je 0x684db4
test ebx, ebx
je 0x684db4
call fcn.006b61ae
test al, al
je 0x684db4
push dword [edi]
push esi
push 1
push ebx
call fcn.0078863f
mov ebx, eax
add esp, 0x10
cmp ebx, esi
jae 0x684db0
mov ecx, edi
call fcn.00684ae1
test al, al
je 0x684db0
push str.Read_error_on_file__s
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x70]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x88]
push eax
call fcn.0066154b
sub esp, 0xc
lea ecx, [edi + 4]
push esp
call fcn.004474bf
lea eax, [ebp - 0x88]
push eax
call fcn.00690d81
add esp, 0x10
lea ecx, [ebp - 0x88]
call fcn.00661721
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
mov eax, ebx
jmp 0x684db6
xor eax, eax
call fcn.00645f45
ret 8

Function at 0x684dbe
Capabilities:
Read file on windows

Disassembly:
push 0xa4
mov eax, 0x7b2f2d
call fcn.00645f96
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x9c], eax
test esi, esi
je 0x684f57
call fcn.006b61ae
test al, al
je 0x684f57
mov ecx, edi
call fcn.00684bb7
xor ebx, ebx
cmp edx, ebx
jl 0x684f57
jg 0x684e0b
cmp eax, ebx
jb 0x684f57
mov ecx, edi
call fcn.00684bb7
push edx
push eax
call fcn.006cd5f0
pop ecx
pop ecx
mov ecx, edi
mov dword [ebp - 0x94], eax
call fcn.00684bb7
cmp dword [ebp - 0x94], eax
jne 0x684f57
cmp ebx, edx
jne 0x684f57
push dword [edi]
call fcn.00788384
pop ecx
push dword [ebp - 0x94]
lea ecx, [ebp - 0x98]
call fcn.00661536
push dword [edi]
lea ecx, [ebp - 0x98]
mov dword [ebp - 4], ebx
push dword [ebp - 0x94]
push 1
call fcn.0066385d
push eax
call fcn.0078863f
add esp, 0x10
mov dword [ebp - 0x94], eax
mov ecx, edi
call fcn.00684ae1
test al, al
je 0x684f05
push str.Read_error_on_file__s
lea ecx, [ebp - 0x50]
call fcn.00408c6d
lea ecx, [ebp - 0x70]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x90]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 3
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0xb0]
push eax
call fcn.0066154b
sub esp, 0xc
lea ecx, [edi + 4]
push esp
call fcn.004474bf
lea eax, [ebp - 0xb0]
push eax
call fcn.00690d81
add esp, 0x10
lea ecx, [ebp - 0xb0]
call fcn.00661721
lea ecx, [ebp - 0x90]
call fcn.00408e36
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x50]
jmp 0x684f3f
push dword [ebp - 0x94]
lea ecx, [ebp - 0x98]
call fcn.0066614c
push dword [ebp - 0x9c]
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x30]
call fcn.006849a3
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 4
push eax
mov ecx, esi
call fcn.00663b40
mov bl, 1
lea ecx, [ebp - 0x30]
call fcn.00408e36
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.0066171c
mov al, bl
jmp 0x684f59
xor al, al
call fcn.00645f45
ret 8
Function at 0x685117
Capabilities:
Write file on windows

Disassembly:
push 0x7c
mov eax, 0x7b02e1
call fcn.00645f96
mov edi, ecx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
je 0x6851df
test ebx, ebx
je 0x6851df
call fcn.006b61ae
test al, al
je 0x6851df
push dword [edi]
push esi
push 1
push ebx
call fcn.00787b0e
mov ebx, eax
add esp, 0x10
cmp ebx, esi
jae 0x6851db
push str.Write_error_on_file__s
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x70]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x88]
push eax
call fcn.0066154b
sub esp, 0xc
lea ecx, [edi + 4]
push esp
call fcn.004474bf
lea eax, [ebp - 0x88]
push eax
call fcn.00690d81
add esp, 0x10
lea ecx, [ebp - 0x88]
call fcn.00661721
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
mov eax, ebx
jmp 0x6851e1
xor eax, eax
call fcn.00645f45
ret 8
Function at 0x6974f8
Capabilities:
Delete registry value

Disassembly:
push 0xa0
mov eax, 0x7b4fe5
call fcn.00645f96
mov edi, ecx
mov ebx, dword [ebp + 8]
push 1
call fcn.00697f20
test al, al
jne 0x69751e
xor al, al
jmp 0x697608
push ebx
call fcn.00698944
pop ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x697606
cmp eax, 2
je 0x697606
push str.Cant_delete_value__s_from_key__s
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x90]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0xac]
push eax
call fcn.0066154b
push 1
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00697877
mov ecx, eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x94], esp
push eax
call fcn.004474bf
sub esp, 0x20
mov byte [ebp - 4], 5
mov ecx, esp
push ebx
call fcn.00408c50
lea eax, [ebp - 0xac]
push eax
push dword [edi + 0x30]
mov byte [ebp - 4], 4
call fcn.00696811
add esp, 0x34
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 2
call fcn.00661721
lea ecx, [ebp - 0x90]
call fcn.00408e36
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
jmp 0x697517
mov al, 1
call fcn.00645f45
ret 4

Function at 0x6978ef
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x2a8
mov eax, 0x7b50d7
call fcn.00645f96
mov edi, ecx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, dword [esi]
cmp ecx, 0xffffffff
jne 0x697914
xor al, al
jmp 0x697a17
lea eax, [ecx + 1]
mov dword [esi], eax
lea eax, [ebp - 0x21c]
push 0x105
push eax
push ecx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x697a07
cmp eax, 0x103
jne 0x697949
and dword [edi + 0x30], 0
or dword [esi], 0xffffffff
jmp 0x69790d
push str.Cant_enumerate_subkeys_of_key__s
lea ecx, [ebp - 0x23c]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x29c]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x27c]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x2b4]
push eax
call fcn.0066154b
push 1
lea eax, [ebp - 0x25c]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00697877
sub esp, 0xc
mov ecx, eax
push esp
call fcn.004474bf
lea eax, [ebp - 0x2b4]
push eax
push dword [edi + 0x30]
call fcn.00689bdf
add esp, 0x14
lea ecx, [ebp - 0x25c]
call fcn.00408e36
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 2
call fcn.00661721
lea ecx, [ebp - 0x27c]
call fcn.00408e36
lea ecx, [ebp - 0x29c]
call fcn.00408e36
lea ecx, [ebp - 0x23c]
call fcn.00408e36
jmp 0x69790d
lea eax, [ebp - 0x21c]
mov ecx, ebx
push eax
call fcn.006617cc
mov al, 1
call fcn.00645f45
ret 8
Function at 0x697a1f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x8a0
mov eax, 0x7b512b
call fcn.00645f96
mov edi, ecx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, dword [esi]
cmp ecx, 0xffffffff
jne 0x697a44
xor al, al
jmp 0x697b59
lea eax, [ecx + 1]
mov dword [ebp - 0x894], 0x400
mov dword [esi], eax
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x894]
push eax
lea eax, [ebp - 0x810]
push eax
push ecx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x697b49
cmp eax, 0x103
jne 0x697a8b
and dword [edi + 0x30], 0
or dword [esi], 0xffffffff
jmp 0x697a3d
push str.Cant_enumerate_values_of_key__s
lea ecx, [ebp - 0x830]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x890]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x870]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x830]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x8ac]
push eax
call fcn.0066154b
push 1
lea eax, [ebp - 0x850]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00697877
sub esp, 0xc
mov ecx, eax
push esp
call fcn.004474bf
lea eax, [ebp - 0x8ac]
push eax
push dword [edi + 0x30]
call fcn.00689bdf
add esp, 0x14
lea ecx, [ebp - 0x850]
call fcn.00408e36
lea ecx, [ebp - 0x8ac]
mov byte [ebp - 4], 2
call fcn.00661721
lea ecx, [ebp - 0x870]
call fcn.00408e36
lea ecx, [ebp - 0x890]
call fcn.00408e36
lea ecx, [ebp - 0x830]
call fcn.00408e36
jmp 0x697a3d
lea eax, [ebp - 0x810]
mov ecx, ebx
push eax
call fcn.006617cc
mov al, 1
call fcn.00645f45
ret 8

Function at 0x697cd4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xa0
mov eax, 0x7b51dd
call fcn.00645f96
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
call fcn.00697f20
test al, al
jne 0x697cfb
xor eax, eax
jmp 0x697dce
push ebx
push ebx
lea eax, [ebp - 0x94]
push eax
push ebx
push esi
call fcn.00698944
pop ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x697dc8
push str.Cant_read_value_of_key__s
lea ecx, [ebp - 0x30]
call fcn.00408c6d
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], ebx
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x90]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0xac]
push eax
call fcn.0066154b
push 1
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00697877
sub esp, 0xc
mov ecx, eax
push esp
call fcn.004474bf
lea eax, [ebp - 0xac]
push eax
push dword [edi + 0x30]
call fcn.00689bdf
add esp, 0x14
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 2
call fcn.00661721
lea ecx, [ebp - 0x90]
call fcn.00408e36
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
jmp 0x697cf4
mov eax, dword [ebp - 0x94]
call fcn.00645f45
ret 4