joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6dd47d00
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
mov ecx, 0xf
mov edi, esi
push 0x8000
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x6dd324c8
mov dword [ebp - 4], eax
call edi
push 0x6dd324b8
mov ebx, eax
call edi
test ebx, ebx
mov edi, eax
mov dword [ebp + 8], edi
je 0x6dd47e4f
test edi, edi
je 0x6dd47e4f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6dd324a8
push ebx
call edi
push 0x6dd32498
push ebx
mov dword [esi + 0x18], eax
call edi
push 0x6dd32480
push ebx
mov dword [esi + 0x10], eax
call edi
push 0x6dd3245c
push ebx
mov dword [esi + 0x14], eax
call edi
push 0x6dd32438
push ebx
mov dword [esi + 0x20], eax
call edi
push 0x6dd3241c
push ebx
mov dword [esi + 0x1c], eax
call edi
push 0x6dd32400
push ebx
mov dword [esi + 0x24], eax
call edi
push 0x6dd323dc
push ebx
mov dword [esi + 0x28], eax
call edi
push 0x6dd323bc
push ebx
mov dword [esi + 0x2c], eax
call edi
push 0x6dd323a0
push ebx
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 8]
push 0x6dd32390
push eax
call edi
mov ecx, dword [esi + 0x18]
test ecx, ecx
mov dword [esi + 0x38], eax
je 0x6dd47e4c
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x6dd47e4c
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x6dd47e4c
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x6dd47e4c
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x6dd47e4c
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x6dd47e4c
mov edx, dword [esi + 0x28]
test edx, edx
je 0x6dd47e4c
mov edx, dword [esi + 0x2c]
test edx, edx
je 0x6dd47e4c
mov edx, dword [esi + 0x30]
test edx, edx
je 0x6dd47e4c
mov edx, dword [esi + 0x34]
test edx, edx
je 0x6dd47e4c
test eax, eax
je 0x6dd47e4c
push 0
push 0
lea edx, [esi + 0xc]
push edx
call ecx
test eax, eax
je 0x6dd47e4c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push ecx
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x6dd47e60
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call ebx
push edi
call ebx
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6dd47f40
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
add edx, 0x128
push esi
mov eax, edx
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push edi
mov edi, dword [ebp + 0xc]
je 0x6dd47fb7
mov cl, byte [eax]
test cl, cl
je 0x6dd47fb7
cmp cl, 0x5c
jne 0x6dd47f6e
mov esi, eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x6dd47f67
cmp esi, ebx
je 0x6dd47fb7
mov bl, byte [esi]
mov eax, edx
xor edx, edx
test eax, eax
mov byte [esi], cl
je 0x6dd47fb3
mov cl, byte [eax]
test cl, cl
je 0x6dd47fb3
lea esp, [esp]
cmp cl, 0x5c
jne 0x6dd47f97
mov edx, eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x6dd47f90
test edx, edx
je 0x6dd47fb3
push 0x200
lea eax, [esi + 1]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [esi], bl
xor ebx, ebx
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push 1
push ebx
add edx, 0x13a
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6dd48014
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push edi
lea ecx, [ebp - 8]
push ecx
push ebx
push 0x6dd324dc
push edx
mov dword [ebp + 8], 0x200
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6dd4800a
push 0x6dd324d4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push edi
mov dword [edi + 0x404], ebx
mov dword [edi + 0x400], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x6dd48082
push eax
call fcn.6dd47440
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x6dd48082
mov ecx, dword [ebp - 4]
push esi
push ecx
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x6dd48079
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
push 0x6dd313dc
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x6dd48079
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov dword [edi + 0x404], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0x400], edx
push esi
call fcn.6dd47460
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6dd48630
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x6de41080]
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x102
sub ecx, eax
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x6dd48674
pop edi
mov ecx, dword [ebp - 4]
call fcn.6dd58dd9
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x6dd313dc
lea eax, [ebp - 0x108]
push eax
call esi
push edi
lea ecx, [ebp - 0x108]
push ecx
call esi
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.msvcrt.dll__strlwr]
lea eax, [ebp - 0x108]
push eax
call fcn.6dd48240
mov ecx, dword [ebp - 4]
add esp, 8
pop esi
pop edi
call fcn.6dd58dd9
mov esp, ebp
pop ebp
ret
Function at 0x6dd49640
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push eax
push ecx
push edx
call fcn.6dd49440
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x6dd49675
push 0x6dd32650
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x80004005
pop esi
pop ebp
ret 0x10
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x6dd496bc
mov eax, dword [esi + 0x24]
test eax, eax
je 0x6dd4968a
mov eax, dword [eax + 8]
inc eax
jmp 0x6dd4968c
xor eax, eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [edi], eax
jne 0x6dd496af
push 0x6dd32650
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x6dd496bc
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x6dd496bc
push eax
call fcn.6dd51500
mov edi, dword [esi + 0x18]
mov ecx, esi
call fcn.6dd494f0
push esi
call fcn.6dd45c40
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x6dd496e0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push 0
push eax
push ecx
call fcn.6dd49440
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x6dd4970e
push 0x6dd32650
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
pop ebp
ret
push edi
mov edi, dword [esi + 0x18]
xor edx, edx
test edi, edi
setge dl
mov ecx, esi
mov edi, edx
call fcn.6dd494f0
push esi
call fcn.6dd45c40
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x6dd4bab0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.msvcrt.dll__snprintf]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, 0x80
push esi
call fcn.6dd45c10
mov edi, eax
add esp, 4
test edi, edi
je 0x6dd4bb3e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x6dd4bb0e
mov eax, dword [eax + 0x18]
test eax, eax
je 0x6dd4baf9
mov eax, dword [eax]
push eax
push ecx
push 0x6dd33a34
push esi
push edi
call ebx
add esp, 0x14
jmp 0x6dd4bb1e
mov eax, 1
push eax
push ecx
push 0x6dd33a34
push esi
push edi
call ebx
add esp, 0x14
jmp 0x6dd4bb1e
mov eax, dword [eax + 0x20]
push eax
push 0x6dd33a24
push esi
push edi
call ebx
add esp, 0x10
test eax, eax
jge 0x6dd4bb52
push edi
call fcn.6dd45c40
add esi, esi
add esp, 4
cmp esi, 0x10000
jb 0x6dd4bac7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x6dd32650
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6dd4bce0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x6de3b4db
push eax
mov dword fs:[0], esp
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x10]
lea edi, [ebx + 0x10]
mov dword [ebx + 0xc], eax
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edi
mov edi, edi
mov esi, dword [ebx]
test esi, esi
je 0x6dd4bd75
lea edx, [esi + esi*4]
lea eax, [edx*4 + 4]
push eax
call fcn.6dd45c10
add esp, 4
mov dword [ebp + 0x10], eax
test eax, eax
mov dword [ebp - 4], 0
je 0x6dd4bd66
push fcn.6dd4bb80
push fcn.6dd4bb60
push esi
lea edi, [eax + 4]
push 0x14
push edi
mov dword [eax], esi
call fcn.6dd58b11
mov eax, edi
mov edi, dword [ebp + 0xc]
jmp 0x6dd4bd68
xor eax, eax
test eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
je 0x6dd4bdab
mov ecx, dword [ebx]
xor eax, eax
test ecx, ecx
jbe 0x6dd4bd93
xor ecx, ecx
nop
mov edx, dword [edi]
mov esi, dword [ebp + 0x14]
mov dword [edx + ecx + 0x10], esi
mov edx, dword [ebx]
inc eax
add ecx, 0x14
cmp eax, edx
jb 0x6dd4bd80
mov eax, dword [ebp + 8]
inc eax
add edi, 4
cmp eax, 4
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edi
jb 0x6dd4bd20
jmp 0x6dd4bdbc
push 0x6dd33a40
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebx], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x6dd4be30
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6de3b4fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
push 0x10
mov dword [esi], 0x6dd33a98
mov dword [esi + 0x18], 0x80004005
mov dword [esi + 4], edi
call fcn.6dd45c10
add esp, 4
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], edi
je 0x6dd4be85
mov ecx, dword [ebp + 0x10]
and ecx, 1
push ecx
mov ecx, eax
call fcn.6dd513b0
jmp 0x6dd4be87
xor eax, eax
cmp eax, edi
mov dword [esi + 0x24], eax
jne 0x6dd4bead
push 0x6dd33a6c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
cmp eax, edi
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x2c], edx
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x14], eax
je 0x6dd4bed9
mov ecx, dword [eax]
add eax, 4
mov dword [esi + 8], ecx
mov dword [esi + 0x14], eax
jmp 0x6dd4bedc
mov dword [esi + 8], edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 4], 1
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6dd4c010
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
push edi
mov edi, 0x80
mov dword [ebp - 4], edi
je 0x6dd4c148
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0xc], esi
call fcn.6dd45c10
add esp, 4
cmp eax, esi
mov dword [ebp - 8], eax
je 0x6dd4c112
mov ebx, eax
mov eax, dword [ebp + 0xc]
test eax, eax
jl 0x6dd4c08f
cmp eax, 1
jg 0x6dd4c08f
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x6dd4c08f
call fcn.6dd4bab0
test eax, eax
mov dword [ebp - 0xc], eax
je 0x6dd4c08c
mov edi, dword [ebp - 4]
push eax
lea ecx, [edi - 1]
push ecx
mov edx, ebx
push edx
call dword [sym.imp.msvcrt.dll__snprintf]
mov esi, eax
add esp, 0xc
test esi, esi
jl 0x6dd4c0ed
mov eax, ebx
sub edi, esi
lea ebx, [esi + eax]
mov eax, dword [ebp + 0xc]
cmp eax, 3
ja case.default.0x6dd4c094
jmp dword [eax*4 + 0x6dd4c150]
push 0x6dd33b00
jmp 0x6dd4c0bd
push 0x6dd33ae4
lea edx, [edi - 1]
push edx
jmp 0x6dd4c0c1
push 0x6dd33acc
lea eax, [edi - 1]
push eax
jmp 0x6dd4c0c1
push 0x6dd33aac
lea ecx, [edi - 1]
push ecx
push ebx
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0xc
mov esi, eax
test esi, esi
jl 0x6dd4c0ed
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x18]
push edx
push eax
sub edi, esi
dec edi
push edi
add ebx, esi
push ebx
call dword [sym.imp.msvcrt.dll__vsnprintf]
add esp, 0x10
test eax, eax
jge 0x6dd4c124
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.6dd45c40
mov edx, dword [ebp - 8]
push edx
call fcn.6dd45c40
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
add esp, 8
mov dword [ebp - 4], ecx
mov edi, ecx
jmp 0x6dd4c031
push 0x6dd32650
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov eax, dword [edx + 0x24]
push esi
push eax
call fcn.6dd51410
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.6dd45c40
push esi
call fcn.6dd45c40
add esp, 0x10
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x6dd51410
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x404
call fcn.6dd45c10
mov esi, eax
add esp, 4
test esi, esi
jne 0x6dd51437
push 0x6dd32650
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.msvcrt.dll__snprintf]
push 0x6dd32a29
push 0x3ff
push esi
call edi
mov ecx, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push ecx
push esi
call ebx
mov edx, 0x3fe
sub edx, eax
push edx
push esi
call ebx
add eax, esi
push eax
call dword [sym.imp.msvcrt.dll__vsnprintf]
push esi
push 0x6dd37994
push 0x3fe
push esi
call edi
mov edi, esi
add esp, 0x20
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x6dd51488
mov ax, word [0x6dd37990]
mov word [edi], ax
mov eax, dword [ebp + 8]
mov byte [esi + 0x3ff], 0
mov ecx, dword [eax + 0xc]
test ecx, ecx
pop edi
pop ebx
je 0x6dd514e4
cmp dword [eax], 0
jne 0x6dd514b3
mov dword [eax], esi
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x6dd514c0
mov dword [ecx + 0x400], esi
mov dword [eax + 4], esi
mov dword [esi + 0x400], 0
lea edx, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x6dd514d0
mov ecx, dword [eax + 8]
sub esi, edx
add ecx, esi
mov dword [eax + 8], ecx
pop esi
pop ebp
ret
push esi
call fcn.6dd45c40
add esp, 4
pop esi
pop ebp
ret

Function at 0x6dd51860
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x6de41080]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x88]
push eax
push 0x6dd37a0c
push 0x80000002
mov dword [ebp - 0x88], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x6dd5194f
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x90]
push ecx
mov ecx, dword [ebp - 0x88]
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x8c]
push eax
push 0
push 0x6dd379f8
push ecx
mov dword [ebp - 0x90], 4
call esi
test eax, eax
jne 0x6dd518eb
cmp dword [ebp - 0x8c], 4
jne 0x6dd518eb
mov edx, dword [ebp - 0x94]
mov dword [0x6de44314], edx
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x8c]
push edx
push 0
push 0x6dd379e4
push eax
mov dword [ebp - 0x90], 0x80
call esi
test eax, eax
pop esi
jne 0x6dd51942
cmp dword [ebp - 0x8c], 1
jne 0x6dd51942
push 0x6de44318
lea ecx, [ebp - 0x84]
push 0x6dd379e0
push ecx
call dword [sym.imp.msvcrt.dll_sscanf]
add esp, 0xc
mov edx, dword [ebp - 0x88]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
call fcn.6dd58dd9
mov esp, ebp
pop ebp
ret
Function at 0x6dd526f0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x6de41080]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push ecx
push eax
push 0x6dd37a6c
lea ecx, [ebp - 0x404]
push 0x400
push ecx
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x18
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
call fcn.6dd58dd9
mov esp, ebp
pop ebp
ret

Function at 0x6dd52750
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x6de41080]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x404]
push 0x400
push edx
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov ecx, dword [0x6de4597c]
mov edx, dword [0x6de41038]
lea eax, [ebp - 0x404]
push eax
push ecx
push edx
push 0x6dd37a6c
lea eax, [ebp - 0x804]
push 0x400
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x28
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
call fcn.6dd58dd9
mov esp, ebp
pop ebp
ret

Function at 0x6dd52aa0
Capabilities:
Connect pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov al, byte [esi + 0x38]
test al, al
je 0x6dd52b12
mov eax, dword [esi]
push edi
push 1
call dword [eax + 8]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push 0
push 0
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 3
call edi
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [esi + 4]
push 0
push 0
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 2
call edi
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6dd582d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x6dd31614
xor esi, esi
push 0x80000002
mov dword [0x6de45838], 7
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x6dd58364
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push esi
push 0x6dd37f5c
mov edi, 4
push ecx
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6dd5835a
cmp dword [ebp - 0xc], edi
jne 0x6dd5835a
mov eax, dword [ebp - 0x10]
cmp eax, esi
jbe 0x6dd5835a
cmp eax, 7
mov dword [0x6de45838], eax
jle 0x6dd5834b
mov dword [0x6de45838], 7
jmp 0x6dd5835a
cmp eax, 6
jge 0x6dd5835a
mov dword [0x6de45838], 6
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [eax], 0x6dd57b70
mov dword [eax + 4], 0x6dd581e0
mov dword [eax + 8], esi
mov dword [eax + 0xc], 0x6dd58250
mov dword [eax + 0x54], 0x6dd56b60
mov dword [eax + 0x5c], 0x6dd54af0
mov dword [eax + 0x58], 0x6dd54a50
mov dword [eax + 0x60], 0x6dd54ec0
mov ecx, dword [0x6de45838]
dec ecx
cmp ecx, 6
ja case.default.0x6dd583ac
jmp dword [ecx*4 + 0x6dd58458]
mov dword [eax + 0x4c], 0x6dd51590
mov dword [eax + 0x50], 0x6dd57e30
mov dword [eax + 0x44], 0x6dd51560
mov dword [eax + 0x48], 0x6dd57060
mov dword [eax + 0x40], esi
mov dword [eax + 0x34], esi
mov dword [eax + 0x38], esi
mov dword [eax + 0x3c], esi
mov dword [eax + 0x30], esi
mov dword [eax + 0x2c], 0x6dd569c0
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], 0x6dd56a80
mov dword [eax + 0x1c], 0x6dd57cd0
mov dword [eax + 0x20], esi
mov dword [eax + 0x24], 0x6dd56b10
mov eax, dword [0x6de45838]
push eax
push esi
call fcn.6dd51b80
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.6dd54f10
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [0x6de45838]
push eax
call fcn.6dd51960
add esp, 0x10
call fcn.6dd51860
mov edi, dword [ebp + 8]
mov ecx, 0x35
mov esi, 0x6de44248
rep movsd dword es:[edi], dword [esi]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6dd5aa00
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6dd38610
push 0x6dd58d62
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x1c]
push eax
push 0x6dd31614
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x6dd5aaa1
mov esi, 4
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x24]
push eax
push edi
push 0x6dd38604
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6dd5aa97
cmp dword [ebp - 0x24], esi
jne 0x6dd5aa97
cmp dword [ebp - 0x28], edi
je 0x6dd5aa97
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x6de41094], edi
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x6de41094], edi
jge 0x6dd5aafe
mov dword [0x6de41094], edi
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x4c], di
jne 0x6dd5aafe
cmp word [ebp - 0x2c], 5
jb 0x6dd5aafe
mov dword [ebp - 4], edi
call fcn.6dd5a9d0
test eax, eax
je 0x6dd5aaf7
emms
mov dword [0x6de41094], 1
jmp 0x6dd5aaf7
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x6de41094]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret