joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67f1a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x67f2da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004146b8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 2
jne 0x67f21c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x67f21c
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409d58
mov edx, dword [ebp - 0x14]
mov ebx, dword [0x7300b4]
mov ebx, dword [ebx]
mov eax, 0x67f2f0
call ebx
dec eax
jne 0x67f21c
mov ebx, 1
jmp 0x67f21e
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
sub eax, ebx
jl 0x67f2bf
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.0067ed38
test al, al
jne 0x67f2b3
mov eax, dword [ebp - 4]
call fcn.0067f194
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.00403f18
xor edx, edx
push ebp
push 0x67f2a1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30]
test al, al
je 0x67f297
mov edx, eax
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.0067f5f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67f2b3
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x67f236
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67f2e1
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00403ee8
ret
Function at 0x68326c
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x683308
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x72c044]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
push dword [edx + 0x72c044]
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
push dword [edx + 0x72c044]
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x72c044]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x68328b
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x68331e
dec edx
je 0x683353
jmp 0x6833a4
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x72c044]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x72c044]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x6833a4
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x72c044]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x72c044]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x72c044]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x683404
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x683424
add edx, 3
sar edx, 2
test edx, edx
jle 0x683537
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x68345a
je 0x68349a
sub ecx, 0x2b
je 0x683490
sub ecx, 4
je 0x683495
dec ecx
sub ecx, 0xa
jb 0x683483
jmp 0x68349d
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x68346c
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x683476
jmp 0x68349d
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x68349d
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x68349d
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x68349d
mov byte [eax], 0x3e
jmp 0x68349d
mov byte [eax], 0x3f
jmp 0x68349d
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x68343c
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
setne cl
cmp byte [esp + 7], 0xff
sete bl
and cl, bl
je 0x6834f4
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x68352c
cmp dl, 0xff
je 0x68352c
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x683433
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x683e20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x683e40
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x683e2e
pop edi
pop esi
pop ebx
ret

Function at 0x68f688
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00407f2c
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x68f6d9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x68f6c0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x68f6b0
jmp 0x68f6d9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x68f6c1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x69cb58
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00413fa4
mov esi, eax
xor eax, eax
push ebp
push 0x69cbd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x69cbb6
mov edx, ebx
mov eax, esi
call fcn.00413be4
test byte [eax + 0x48], 1
je 0x69cbb0
push 0
mov edx, ebx
mov eax, esi
call fcn.00413be4
mov eax, dword [eax + 4]
push eax
call fcn.004080ac
mov edx, ebx
mov eax, esi
call fcn.00413ad4
dec ebx
cmp ebx, 0xffffffff
jne 0x69cb84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69cbd9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00414008
ret

Function at 0x6abb6c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x6abcec
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 8]
call fcn.00404144
mov dword [ebp - 0x10], eax
call fcn.00433874
call fcn.004331d8
xor eax, eax
push ebp
push 0x6abce5
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040862c
mov esi, dword [ebp - 0x10]
inc esi
push esi
push 0x2002
call fcn.00407f9c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6abc25
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407fb4
mov ebx, eax
xor eax, eax
push ebp
push 0x6abc1e
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x6abc07
mov eax, dword [ebp - 8]
call fcn.00404308
mov ecx, esi
mov edx, ebx
call fcn.0040296c
mov eax, dword [ebp - 0xc]
push eax
push 1
call fcn.00408a2c
test eax, eax
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6abc25
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407fdc
ret
cmp byte [ebp - 0x11], 0
jne 0x6abcb1
mov esi, dword [ebp - 0x10]
inc esi
mov eax, esi
inc eax
push eax
push 0x2002
call fcn.00407f9c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407fb4
mov ebx, eax
xor eax, eax
push ebp
push 0x6abcaa
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x6abc93
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x2d9]
mov byte [ebx], al
inc ebx
mov eax, dword [ebp - 8]
call fcn.00404308
mov ecx, esi
mov edx, ebx
call fcn.0040296c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x7363f4]
push eax
call fcn.00408a2c
test eax, eax
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6abcb1
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407fdc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6abcec
call fcn.00433874
call fcn.004331ac
cmp byte [ebp - 0x11], 0
je 0x6abce4
mov ecx, 0x6abcfc
mov dl, 1
mov eax, dword [0x6a9f6c]
call fcn.0040dc70
call fcn.004038bc
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6cbc7c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x6cbc84
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x6cbe76
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x6cbe8c
mov eax, esi
call fcn.006c9868
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00403f18
lea ecx, [ebp - 0x10]
mov edx, 0x6cbea0
mov eax, esi
call fcn.006c9868
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00403f18
lea ecx, [ebp - 0x14]
mov edx, 0x6cbeb8
mov eax, esi
call fcn.006c9868
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00403f18
lea ecx, [ebp - 0x18]
mov edx, 0x6cbed4
mov eax, esi
call fcn.006c9868
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00403f18
lea ecx, [ebp - 0x1c]
mov edx, 0x6cbef0
mov eax, esi
call fcn.006c9868
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00403f18
lea ecx, [ebp - 0x24]
mov edx, 0x6cbf08
mov eax, esi
call fcn.006c9868
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040a00c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040a538
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x6cbf20
mov eax, esi
call fcn.006c9868
mov eax, dword [ebp - 0x28]
call fcn.00461f4c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x6cbf30
mov eax, esi
call fcn.006c9868
mov eax, dword [ebp - 0x2c]
call fcn.00461f4c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x6cbf48
mov eax, esi
call fcn.006c9868
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040a538
inc eax
je 0x6cbe19
lea ecx, [ebp - 0x34]
mov edx, 0x6cbf48
mov eax, esi
call fcn.006c9868
mov eax, dword [ebp - 0x34]
call fcn.0040a4b8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b890
fstp qword [ebp - 0x3c]
wait
call fcn.0040bd40
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x6cbe34
lea ecx, [ebp - 0x40]
mov edx, 0x6cbf48
mov eax, esi
call fcn.006c9868
mov eax, dword [ebp - 0x40]
call fcn.00461f4c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x6cbf58
mov eax, esi
call fcn.006c9868
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00403f18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cbe7d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00403ee8
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00403ee8
ret

Function at 0x6d9088
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404308
push eax
call fcn.00407ebc
cmp eax, 0xffffffff
setne al
pop ebx
ret
Function at 0x6fabb8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6fad86
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x6c8], 0
sete al
mov esi, dword [ebx + 0x624]
cmp esi, 6
sete dl
or al, dl
cmp esi, 7
sete dl
or al, dl
je 0x6fac22
push 0x40
mov eax, dword [0x736984]
mov eax, dword [eax + 0x7ac]
call fcn.00404308
mov edx, eax
mov ecx, 0x6fad94
mov eax, dword [0x730ea4]
mov eax, dword [eax]
call fcn.00458890
jmp 0x6fad6b
mov eax, ebx
call fcn.006f002c
test al, al
je 0x6fad6b
mov dword [ebx + 0x680], 1
mov dword [ebx + 0x684], 1
lea eax, [ebp - 0xc]
mov ecx, 0x6fada8
mov edx, dword [0x73698c]
call fcn.00404190
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.006f1998
mov edx, dword [ebx + 0x6c8]
mov eax, ebx
call fcn.006efaf0
mov byte [ebx + 0x668], 1
push dword [ebx + 0x6d8]
push dword [ebx + 0x69c]
push 0x6fadb8
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404204
push 0x6fadc4
push 0x6fadd8
mov eax, dword [ebx + 0x6c8]
push eax
push 0x6fadf8
push 0x6fae0c
push 0
lea eax, [ebp - 0x10]
mov ecx, 0x6fada8
mov edx, dword [0x73698c]
call fcn.00404190
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.006f350c
lea eax, [ebp - 0x14]
mov ecx, 0x6fada8
mov edx, dword [0x73698c]
call fcn.00404190
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebx + 0x6c8]
mov eax, ebx
call fcn.006f2980
mov byte [ebx + 0x668], 0
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x6ec]
call fcn.00403f5c
mov al, byte [0x6fae18]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6fae24
mov edx, 0x6fadb8
mov eax, dword [ebp - 4]
call fcn.0040ee4c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.00403f5c
push 3
push 0
push 0
push 0x6fae30
push dword [ebp - 4]
push 0x6fae44
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404204
mov eax, dword [ebp - 0x1c]
call fcn.00404308
push eax
push 0x6fae50
mov eax, ebx
call fcn.0043f298
push eax
call fcn.004626c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6fad8d
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403ee8
ret
Function at 0x6fba4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6fbbff
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x6c8], 0
sete al
mov esi, dword [ebx + 0x624]
cmp esi, 6
setne dl
cmp esi, 7
setne cl
and dl, cl
or al, dl
je 0x6fbab5
push 0x40
mov eax, dword [0x736984]
mov eax, dword [eax + 0x7ac]
call fcn.00404308
mov edx, eax
mov ecx, 0x6fbc0c
mov eax, dword [0x730ea4]
mov eax, dword [eax]
call fcn.00458890
jmp 0x6fbbe4
mov eax, ebx
call fcn.006f01d8
test al, al
je 0x6fbbe4
mov edx, dword [ebx + 0x6c8]
mov eax, ebx
call fcn.006f9244
test al, al
je 0x6fbafa
push 0x40
mov eax, dword [ebx + 0x798]
call fcn.00404308
mov edx, eax
mov ecx, 0x6fbc0c
mov eax, dword [0x730ea4]
mov eax, dword [eax]
call fcn.00458890
jmp 0x6fbbe4
lea eax, [ebp - 0xc]
mov ecx, 0x6fbc20
mov edx, dword [0x73698c]
call fcn.00404190
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.006f1998
mov byte [ebx + 0x668], 1
push dword [ebx + 0x6dc]
push dword [ebx + 0x6bc]
push 0x6fbc30
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404204
push 0x6fbc3c
push 0x6fbc50
mov eax, dword [ebx + 0x6c8]
push eax
lea eax, [ebp - 0x10]
mov ecx, 0x6fbc20
mov edx, dword [0x73698c]
call fcn.00404190
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.006f3104
mov byte [ebx + 0x668], 0
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x6ec]
call fcn.00403f5c
mov al, byte [0x6fbc68]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x6fbc74
mov edx, 0x6fbc30
mov eax, dword [ebp - 4]
call fcn.0040ee4c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00403f5c
push 3
push 0
push 0
push 0x6fbc80
push dword [ebp - 4]
push 0x6fbc94
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404204
mov eax, dword [ebp - 0x18]
call fcn.00404308
push eax
push 0x6fbca0
mov eax, ebx
call fcn.0043f298
push eax
call fcn.004626c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6fbc06
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403ee8
ret

Function at 0x6fe810
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push ecx
xor ebx, ebx
mov dword [esp], 7
push 0
lea eax, [esp + 4]
push eax
call fcn.00462748
neg eax
sbb eax, eax
neg eax
cmp al, 1
jne 0x6fe833
mov bl, 1
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x12d48
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor edi, edi
push edi
push 1
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoGetRelatedDeviceObject]
cmp dword [ebp + 0x14], edi
mov dword [ebp - 4], eax
jne 0x14fcc
xor esi, esi
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
push edi
push edi
push edi
push dword [ebp - 4]
push 3
call dword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
mov ebx, eax
cmp ebx, edi
je 0x16239
mov eax, dword [ebx + 0x60]
mov cl, byte [ebp + 0x1c]
mov dword [ebx + 4], esi
mov esi, dword [ebp + 0xc]
mov byte [eax - 0x23], cl
mov ecx, dword [ebp + 8]
mov dword [eax - 0xc], ecx
mov ecx, dword [ebp + 0x10]
sub eax, 0x24
lea edi, [eax + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x60]
mov ecx, dword [ebp - 4]
sub eax, 0x24
xor edi, edi
mov edx, ebx
mov dword [eax + 0x1c], 0x106b7
mov dword [eax + 0x20], edi
mov byte [eax + 3], 0xe0
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov esi, eax
cmp esi, 0x103
je 0x13961
mov eax, 0xc0000000
mov ecx, esi
and ecx, eax
cmp ecx, eax
je 0x12e16
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeReadStateEvent]
test eax, eax
je 0x1624e
cmp esi, edi
jl 0x12e1d
mov esi, dword [ebp - 0xc]
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret 0x18
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov esi, eax
jmp 0x12e16
push edi
push edi
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call dword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov esi, eax
cmp esi, edi
je 0x1622f
push esi
call dword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
jmp 0x12d78
mov eax, 0xc000009a
jmp 0x12e20
cmp esi, edi
je 0x16244
push esi
call dword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, 0xc000009a
jmp 0x12e1f
push 0x1627a
call sub.ntoskrnl.exe_DbgPrint
push ebx
push 0x162b2
call sub.ntoskrnl.exe_DbgPrint
push 0x1630e
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x10
call sub.ntoskrnl.exe_DbgBreakPoint
jmp 0x12e16
Function at 0x152ce
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
push 0x80
push 0x125a0
push 1
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
je 0x15fcc
mov eax, dword [ebp + 0x10]
leave
ret 0xc
cmp dword [0x125ac], 4
jne 0x15308
mov eax, dword [0x125a8]
lea eax, [eax + 0x125a0]
push 4
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jl 0x15308
cmp eax, dword [ebp + 0x10]
je 0x1530b
cmp byte [0x12580], 0
mov ecx, 0x16038
jne 0x1601b
mov ecx, 0x16044
push dword [ebp + 0x10]
push ecx
push eax
push dword [ebp + 0xc]
push 0x1604c
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [ebp - 4]
add esp, 0x14
jmp 0x1530b

Function at 0x1763e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
inc edi
push edi
push dword [0x127fc]
call dword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov eax, dword [0x12660]
xor esi, esi
cmp eax, esi
je 0x176c4
push edi
push esi
push esi
push esi
push 4
push 0x12728
push edi
push 0x12650
push esi
push eax
call dword [sym.imp.ntoskrnl.exe_ZwNotifyChangeKey]
cmp eax, esi
jl 0x176a3
lea edi, [esi + 0x124d4]
mov eax, dword [edi]
push dword [eax]
push dword [esi + 0x124d0]
push dword [0x12660]
call fcn.000152ce
mov ecx, dword [edi]
add esi, 8
cmp esi, 0x28
mov dword [ecx], eax
jb 0x1767a
jmp 0x176d6
push eax
push 0x176e8
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
push dword [0x12660]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [0x12660], esi
jmp 0x176d6
push esi
push edi
push 0x17464
push dword [0x127a0]
call sub.ntoskrnl.exe_IoQueueWorkItem
mov ecx, dword [0x127fc]
call dword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
pop edi
pop esi
ret 4
Function at 0x17741
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1253c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0xc], eax
push 1
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x24], 0x400
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0x200
mov dword [ebp - 0x18], 0x300
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x10], 4
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x10]
push edi
push edi
push edi
add eax, 0x1c
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x10]
push 0x128004
call dword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
mov ebx, eax
cmp ebx, edi
jne 0x177c4
mov eax, 0xc000009a
jmp 0x17831
mov ecx, dword [esi + 0xc]
mov eax, dword [ebx + 0x60]
mov dword [eax - 0xc], ecx
mov ecx, dword [esi + 0x10]
mov edx, ebx
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x177ef
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
jmp 0x1782f
mov ecx, 0xc0000000
and eax, ecx
cmp eax, ecx
je 0x1782f
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntoskrnl.exe_KeReadStateEvent]
test eax, eax
jne 0x1782f
push 0x17840
call sub.ntoskrnl.exe_DbgPrint
push ebx
push 0x17878
call sub.ntoskrnl.exe_DbgPrint
push 0x178d4
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x10
call sub.ntoskrnl.exe_DbgBreakPoint
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00010703
leave
ret 8