joyce8/EMBER2024-capa huggingface dataset:
Function at 0x603d48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x603d79
dec al
je 0x603db4
dec al
je 0x603df8
dec al
je 0x603e6a
jmp 0x603f05
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x603f05
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x603d89
jmp 0x603f05
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x603f05
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x603dc4
jmp 0x603f05
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x603f05
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x603e2b
xor edx, edx
mov dword [esp + 4], edx
jmp 0x603e40
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x603e58
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x603e08
jmp 0x603f05
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x603f05
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x603ed1
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.00600cd4
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x603e86
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x60ced4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x60cf88
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040c8a8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x60cf70
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040ca34
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040c8a8
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x60cf70
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x60cf98
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x60cf70
cmp dword [ebp - 0xc], 0x34
jne 0x60cf70
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60cf8f
lea eax, [ebp - 4]
call fcn.0040b9a4
pop eax
jmp eax
Function at 0x60ddf8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x60e094
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.006108d0
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x6bcc94], eax
mov eax, dword [ebp - 0xc]
mov dword [0x6bcc98], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6bcc9c], eax
call fcn.004324ec
cmp eax, 2
sete byte [0x6bc46d]
push 0x60e0a0
call sub.kernel32.dll_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.0060cea4
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x6bc46d], 0
jne 0x60de87
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0060ced4
test al, al
je 0x60de87
mov eax, dword [ebp - 0x4c]
mov dword [0x6c8a68], eax
jmp 0x60de8e
xor eax, eax
mov dword [0x6c8a68], eax
call fcn.0060d0f0
and eax, 0x7f
cmp eax, 0x1e
ja case.0x60de9f.0
jmp dword [eax*4 + 0x60dea6]
mov byte [0x6bc468], 1
jmp case.0x60de9f.0
mov byte [0x6bc469], 1
jmp case.0x60de9f.0
mov byte [0x6bc46a], 1
jmp case.0x60de9f.0
mov byte [0x6bc46b], 1
jmp case.0x60de9f.0
mov byte [0x6bc46c], 1
jmp case.0x60de9f.0
mov byte [0x6bc46e], 1
mov byte [0x6bc46f], 1
jmp case.0x60de9f.0
mov byte [0x6bc46e], 1
mov byte [0x6bc470], 1
jmp case.0x60de9f.0
mov byte [0x6bc46e], 1
mov byte [0x6bc470], 1
mov byte [0x6bc471], 1
jmp case.0x60de9f.0
mov byte [0x6bc472], 1
jmp case.0x60de9f.0
mov byte [0x6bc473], 1
jmp case.0x60de9f.0
mov byte [0x6bc474], 1
jmp case.0x60de9f.0
mov byte [0x6bc475], 1
jmp case.0x60de9f.0
mov byte [0x6bc476], 1
jmp case.0x60de9f.0
mov byte [0x6bc477], 1
jmp case.0x60de9f.0
mov byte [0x6bc478], 1
jmp case.0x60de9f.0
mov byte [0x6bc479], 1
jmp case.0x60de9f.0
mov byte [0x6bc47a], 1
jmp case.0x60de9f.0
mov byte [0x6bc47b], 1
jmp case.0x60de9f.0
mov byte [0x6bc47c], 1
jmp case.0x60de9f.0
mov byte [0x6bc47d], 1
jmp case.0x60de9f.0
mov byte [0x6bc47e], 1
jmp case.0x60de9f.0
mov byte [0x6bc47f], 1
jmp case.0x60de9f.0
mov byte [0x6bc480], 1
jmp case.0x60de9f.0
mov byte [0x6bc481], 1
jmp case.0x60de9f.0
mov byte [0x6bc482], 1
jmp case.0x60de9f.0
mov byte [0x6bc483], 1
jmp case.0x60de9f.0
mov byte [0x6bc484], 1
jmp case.0x60de9f.0
mov byte [0x6bc485], 1
jmp case.0x60de9f.0
mov byte [0x6bc486], 1
jmp case.0x60de9f.0
mov byte [0x6bc487], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60e09b
lea eax, [ebp - 4]
call fcn.0040b9a4
pop eax
jmp eax

Function at 0x60f114
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x60f17a
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040c95c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0042a328
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60f181
lea eax, [ebp - 0x14]
call fcn.0040b9a4
pop eax
jmp eax
Function at 0x60ff20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x60ffb8
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004324ec
cmp eax, 2
jne 0x60ff60
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x60ff98
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040c5cc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040c194
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040c3f4
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60ffbf
lea eax, [ebp - 8]
call fcn.0040b9ec
lea eax, [ebp - 4]
call fcn.0040b9c8
pop eax
jmp eax

Function at 0x610360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040c8a8
mov edx, eax
mov eax, ebx
call fcn.0060fd84
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0060fe64
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x6103d2
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040c8a8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x610d1c
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff98
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
cmp dword [0x749aa0], 0
je 0x610dfd
lea eax, [esp + 0x40]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp + 0x54]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
call dword [0x749aa0]
test eax, eax
je 0x610dfd
call fcn.0042d310
fstp qword [esp + 0x28]
wait
lea eax, [esp + 8]
call fcn.00610938
fstp qword [esp + 0x20]
wait
fldz
fld qword [ebx]
fucompp
wait
fnstsw ax
sahf
jp 0x610d8d
je 0x610de3
fld qword [esp + 0x20]
fsub qword [ebx]
fstp qword [esp + 0x30]
wait
fld qword [esp + 0x28]
fsub qword [esi]
fstp qword [esp + 0x38]
wait
fld qword [esp + 0x30]
fmul dword [0x610e08]
fdiv qword [esp + 0x38]
mov dword [esp + 0x64], edi
fild dword [esp + 0x64]
fdivp st(1)
fsubr dword [0x610e08]
fstp qword [esp]
wait
fld qword [esp]
fld dword [0x610e08]
fucompp
wait
fnstsw ax
sahf
jae 0x610de3
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], 0x40590000
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 4], eax
fld qword [esp]
add esp, 0x68
pop edi
pop esi
pop ebx
ret

Function at 0x611e78
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x44], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x611f6f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.00408424
mov dword [ebp - 0x40], 0x40
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea edx, [ebp - 0x44]
mov eax, ebx
call fcn.00611c74
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x38]
call fcn.0040bd94
mov eax, dword [ebp - 0x38]
mov dword [ebx + 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x40]
mov edx, dword [ebx + 0x44]
test edx, edx
jge 0x611eeb
neg eax
adc edx, 0
neg edx
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], edx
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], edx
mov eax, dword [ebx + 0x48]
mov edx, dword [ebx + 0x4c]
test edx, edx
jge 0x611f0d
neg eax
adc edx, 0
neg edx
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
sbb edx, dword [ebp - 0x2c]
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
sbb edx, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
sub edx, 0x80000000
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fadd qword [0x611f7c]
fdiv dword [0x611f84]
call fcn.00407e7c
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x611f76
lea eax, [ebp - 0x44]
call fcn.0040b9a4
pop eax
jmp eax
Function at 0x612674
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf0
mov ebx, edx
mov eax, ebx
call fcn.0040b9a4
push esp
push 0
call fcn.004b0d2c
mov eax, dword [eax + 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [esp], 0
je 0x6126be
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x6126be
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040c95c
add esp, 0x210
pop ebx
ret
Function at 0x612ab0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x40
call fcn.00408424
mov dword [ebp - 0x48], 0x40
xor eax, eax
push ebp
push 0x612b00
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
call fcn.00433b14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x44]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x612b11
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x61a09c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x61a18c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x61a16a
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040bddc
lea eax, [ebp - 0x4c]
push eax
call sub.kernel32.dll_GetStartupInfoW
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_WTSGetActiveConsoleSessionId
push eax
call sub.wtsapi32.dll_WTSQueryUserToken
test eax, eax
je 0x61a160
test esi, esi
je 0x61a123
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
mov eax, esi
call fcn.0040c8a8
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x61a151
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040c8a8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x61a160
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61a174
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a193
lea eax, [ebp - 4]
call fcn.0040b9a4
pop eax
jmp eax

Function at 0x61a208
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov ebx, edx
xor edx, edx
push ebp
push 0x61a253
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x20a]
push edx
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040c95c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61a25d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61b8b0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x61b8d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x749ae1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61b8e0
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x61b92a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x749ae4], 0
jne 0x61b920
push 0
mov eax, dword [0x6c463c]
push eax
mov eax, 0x61b810
push eax
push 0xe
call sub.user32.dll_SetWindowsHookExW
mov dword [0x749ae4], eax
cmp dword [0x749ae4], 0
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61b934
xor eax, eax
push ebp
push 0x61b96b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x749ae8], 0
jne 0x61b961
push 0
push 0
mov eax, 0x61b78c
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExW
mov dword [0x749ae8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61b975
mov byte [0x749ae0], 1
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x61ca24
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf0
mov ebx, edx
mov eax, dword [0x6bfb74]
cmp dword [eax], 0
je 0x61ca48
mov eax, ebx
mov edx, dword [0x6bfb74]
mov edx, dword [edx]
call fcn.0040bd94
jmp 0x61ca8e
mov eax, ebx
call fcn.0040b9a4
push esp
push 0
mov eax, dword [0x6bfd20]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [esp], 0
je 0x61ca8e
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x61ca8e
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040c95c
add esp, 0x210
pop ebx
ret

Function at 0x61d0c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x61d160
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
lea eax, [ebp - 4]
call fcn.0040b9c8
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x61d0f8
bt esi, eax
jae 0x61d12f
mov edx, ebx
add dx, 0x61
mov eax, edx
mov ecx, edx
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x61d113
mov eax, edx
and ax, 0xffdf
mov edi, eax
lea eax, [ebp - 0xc]
mov edx, edi
mov ecx, 0
call fcn.0040c0bc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0040c1d0
inc ebx
cmp ebx, 0x1a
jne 0x61d0ee
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040be38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d167
lea eax, [ebp - 0xc]
call fcn.0040b9c8
lea eax, [ebp - 4]
call fcn.0040b9c8
pop eax
jmp eax
Function at 0x61fc20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x61fd97
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x61fd70
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x61fdac
call fcn.0040be30
call sub.kernel32.dll_GetCurrentProcess
mov ebx, eax
mov esi, 4
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00408424
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 8]
mov edx, 0x61fdd4
call fcn.0040be30
mov eax, dword [ebp - 8]
call fcn.0040c628
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x10]
push eax
push 2
push ebx
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x61fd66
xor eax, eax
push ebp
push 0x61fd5f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 1
push 2
push 0
push 0x2000000
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x61fd46
xor eax, eax
push ebp
push 0x61fd3f
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
lea eax, [ebp - 0xc]
push eax
push 0xc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_SetTokenInformation
test eax, eax
je 0x61fd26
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040c628
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61fd46
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61fd66
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61fd7a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61fd9e
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ba74
pop eax
jmp eax
Function at 0x6211d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ba98
mov eax, dword [ebp - 8]
call fcn.0040ba98
xor eax, eax
push ebp
push 0x6212e4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408424
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x140
call sub.user32.dll_GetActiveWindow
mov dword [ebp - 0x3c], eax
mov eax, 0x6212f4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
call fcn.0040c8a8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.0040c8a8
mov dword [ebp - 0x34], eax
cmp bl, 1
jne 0x621254
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x62125b
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x62126d
mov esi, dword [ebp - 0xc]
jmp 0x62128d
or ebx, 0xffffffff
jmp 0x6212c7
push 4
push 0x1f4
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
inc edi
cmp edi, 0x11940
jg 0x62129c
push 0x32
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x621272
xor eax, eax
push ebp
push 0x6212ba
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6212c4
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6212eb
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ba04
pop eax
jmp eax