joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e3c42
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x4b0]
call fcn.005dae1b
mov edi, dword [ebp + 8]
test eax, eax
jle 0x5e3c9a
push ebx
lea ecx, [esi + 0x4b0]
mov byte [ebp + 0xb], 0
call fcn.005da9d7
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
mov ecx, eax
jne 0x5e3cfe
lea ecx, [esi + 0x4b0]
inc ebx
call fcn.005dae1b
cmp ebx, eax
jl 0x5e3c61
sub edi, 0x100
je 0x5e3d73
sub edi, 4
je 0x5e3d0a
dec edi
sub edi, 1
jne 0x5e3e2d
push dword [ebp + 0xc]
and dword [ebp + 8], edi
call fcn.006dc1e5
pop ecx
mov ecx, dword [esi + 0x104]
lea edx, [ebp + 8]
push reloc.WS2_32.dll_select
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x5e5418
call dword [eax + 0x134]
mov esi, eax
test esi, esi
je 0x5e3e2d
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x128]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
jmp 0x5e3d03
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov al, 1
jmp 0x5e3e2f
cmp dword [esi + 0x108], 0
je 0x5e3e2d
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x11c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x120]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.005e098d
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x140]
jmp 0x5e3e2d
cmp dword [ebp + 0xc], 9
jne 0x5e3e2d
mov ecx, dword [esi + 0x108]
test ecx, ecx
je 0x5e3dd0
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x5e3dd0
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 0x10c]
test al, al
je 0x5e3dd0
mov ecx, dword [esi + 0x108]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.006cd03d
pop ecx
pop ecx
test eax, eax
je 0x5e3dd0
mov ecx, dword [esi + 0x108]
call fcn.005f19d5
test al, al
jne 0x5e3e2d
mov ecx, dword [esi + 0x108]
test ecx, ecx
je 0x5e3e14
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x5e3e14
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 0x10c]
test al, al
je 0x5e3e14
mov ecx, dword [esi + 0x108]
push str.WkeWebkitUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.006cd03d
pop ecx
pop ecx
test eax, eax
jne 0x5e3e2d
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.005e4e03
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x5e4a77
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0xa8]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x5e4aa3
cmp esi, dword [edi + 0x108]
je 0x5e4aa3
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x108]
cmp esi, eax
je 0x5e4b89
test eax, eax
je 0x5e4b0a
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x17
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x140]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0x108]
call fcn.005e46cb
and dword [edi + 0x108], 0
test esi, esi
je 0x5e4b89
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x5e4b89
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x100]
test al, al
je 0x5e4b89
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
test al, al
je 0x5e4b89
xorps xmm0, xmm0
mov dword [edi + 0x108], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x140]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0x108]
call fcn.005e46cb
pop edi
pop esi
leave
ret 4
Function at 0x5f039f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
push dword [ebx + 4]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x5f044e
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x5f0452
cmp dword [ebp - 0x1c], 0x10
jne 0x5f041d
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 4]
jne 0x5f041d
mov eax, dword [ebp - 0x18]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call fcn.005e51fb
pop ecx
test al, al
jne 0x5f043f
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x5f0452
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x5f03ea
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x5f0470
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x5f0475
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5f04a7
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x603089
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x6030b7
cmp eax, edi
jge 0x6030ab
push esi
call fcn.005fe6fb
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x6030da
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x6030c0
mov dword [esi + 8], edx
jmp 0x6030ef
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x6030e5
xor dl, dl
jmp 0x6030ea
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x6030da
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x603127
push str.zlib_corrupt
call fcn.005fe620
pop ecx
jmp 0x603167
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x603137
push str.read_past_buffer
jmp 0x60311f
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x603151
push edi
push ecx
push esi
call fcn.0060635a
add esp, 0xc
test eax, eax
je 0x603167
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.006cdf50
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x60d301
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x114]
mov edi, dword [ebp + 8]
test al, al
jne 0x60d342
mov eax, dword [edi]
sub eax, 9
cmp eax, 0xc
ja 0x60d342
mov ecx, dword [esi + 0x560]
push edi
test ecx, ecx
je 0x60d336
mov eax, dword [ecx]
call dword [eax + 0x18]
jmp 0x60d4cd
mov ecx, esi
call fcn.0060cfe5
jmp 0x60d4cd
mov ecx, dword [esi + 0x560]
push ebx
test ecx, ecx
je 0x60d3a1
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [eax + 0x5e4], 0
je 0x60d3a1
cmp dword [edi], 0xf
jne 0x60d3a1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
test al, al
je 0x60d4cc
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
mov ebx, 0x8000
test bx, ax
jne 0x60d38f
push 0x10
call edi
test bx, ax
je 0x60d3f9
mov ecx, dword [esi + 0x560]
test ecx, ecx
je 0x60d4cc
push 0
jmp 0x60d41a
cmp dword [edi], 0xd
jne 0x60d42a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
test al, al
je 0x60d4cc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
xor edi, edi
test al, al
je 0x60d3da
mov ecx, dword [esi + 0x44]
push edi
push edi
push edi
push 0x86c6e4
push esi
call fcn.005e46cb
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0x8000
test bx, ax
jne 0x60d40b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
jne 0x60d40b
lea ecx, [esi + 0x550]
mov eax, dword [ecx]
push 1
call dword [eax + 0x14]
jmp 0x60d4cc
mov ecx, dword [esi + 0x560]
test ecx, ecx
je 0x60d4cc
push edi
mov eax, dword [ecx]
push dword [esi + 0x554]
call dword [eax + 0x10]
jmp 0x60d4cc
cmp dword [edi], 0xe
jne 0x60d44d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
test al, al
je 0x60d4cc
xor edi, edi
push edi
push edi
push edi
push str.itemclick
jmp 0x60d4b9
cmp dword [edi], 0xb
jne 0x60d485
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
test al, al
je 0x60d4cc
or dword [esi + 0x55c], 8
mov ecx, esi
call fcn.005ef2c5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
test al, al
je 0x60d4cc
xor edi, edi
push edi
push edi
push edi
push str.mouseenter
jmp 0x60d4b9
cmp dword [edi], 0xa
jne 0x60d4c4
mov eax, dword [esi + 0x55c]
test al, 8
je 0x60d4cc
and eax, 0xfffffff7
mov ecx, esi
mov dword [esi + 0x55c], eax
call fcn.005ef2c5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
test al, al
je 0x60d4cc
xor edi, edi
push edi
push edi
push edi
push str.mouseleave
mov ecx, dword [esi + 0x44]
push esi
call fcn.005e46cb
jmp 0x60d4cc
push edi
mov ecx, esi
call fcn.0060cfe5
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x615685
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x61570d
cmp dword [esi + 0x10], 0
je 0x61570d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.005c3560
mov ebx, esp
test ebx, ebx
je 0x61570d
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1cc
call fcn.005da97a
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.005e46cb
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.005e086f
test al, al
je 0x61570d
mov ecx, dword [esi + 0x10]
call fcn.005dc4c8
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c22ca
leave
ret 0x10

Function at 0x618566
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x294]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x618604
push esi
mov esi, 0xff
push esi
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.006ce4d0
add esp, 0xc
lea eax, [ebp - 0x104]
push esi
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostbyname
pop esi
test eax, eax
je 0x618604
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 0x298]
push eax
call fcn.006cdf50
mov ecx, dword [ebp - 0x298]
add esp, 0xc
movzx eax, cl
shl eax, 8
movzx ecx, ch
add eax, ecx
movzx ecx, byte [ebp - 0x296]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x295]
shl eax, 8
add eax, ecx
jmp 0x618606
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c22ca
leave
ret
Function at 0x61b396
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
push edi
and dword [ebx + 0x77c], 0
mov edi, dword [ebp + 0x18]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 0x778], ecx
mov dword [ebx + 0x780], eax
test ecx, ecx
jne 0x61b401
call fcn.0061b0f4
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
test esi, esi
je 0x61b401
call fcn.0061b0f4
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.0061b0f4
mov edx, ebx
lea ecx, [ebx + 0x10]
neg edx
mov esi, dword [eax]
sbb edx, edx
and edx, ecx
mov ecx, eax
push edx
call dword [esi]
mov ecx, dword [ebx + 0x778]
test ecx, ecx
je 0x61b429
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov edi, eax
mov ecx, edi
call fcn.004a50f2
lea ecx, [ebp - 0x14]
mov ebx, eax
call fcn.005da7bc
push 0
sub esp, 0x10
mov esi, eax
mov edi, esp
push 0x88
movsd dword es:[edi], dword [esi]
push SysReAllocStringLen
push 0
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.005f019b
mov edi, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
jmp 0x61b46e
push edi
call ebx
mov edi, eax
push edi
call ebx
test eax, eax
jne 0x61b469
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005c22ca
leave
ret 0x1c

Function at 0x620eb6
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0x210], ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, dword [ebp + 0xc]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edi, eax
cmp esi, 0x21
jb 0x620f04
cmp esi, 0x28
jbe 0x620efe
lea eax, [esi - 0x2d]
cmp eax, 1
ja 0x620f04
or edi, 0x100
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.006ce4d0
add esp, 0xc
shl edi, 0x10
lea eax, [ebp - 0x20c]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.005da7f1
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005c22ca
leave
ret 0xc

Function at 0x6252c9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x6252d7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x6252e6
Capabilities:
Copy file
Delete file

Disassembly:
push 0x3c
mov eax, 0x836141
call fcn.005c3253
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x6253a1
cmp dword [esi + 0x10], 0x104
ja 0x6253a1
push esi
call fcn.006252c9
pop ecx
test al, al
jne 0x62531e
inc al
jmp 0x6253a3
xor edi, edi
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.004046b0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push edi
add eax, 2
mov dword [ebp - 4], edi
push eax
call fcn.00426430
push 0x1e
lea eax, [ebp - 0x48]
push edi
push eax
call fcn.006ce4d0
mov eax, dword [ebp - 0x38]
add esp, 0xc
and eax, 0xffbf
mov dword [ebp - 0x32], edi
or eax, 0x414
mov dword [ebp - 0x48], edi
cmp dword [ebp - 0x14], 8
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x2e], edi
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, eax
lea ecx, [ebp - 0x28]
neg ebx
sbb bl, bl
inc bl
call fcn.00406e40
mov al, bl
jmp 0x6253a3
xor al, al
call fcn.005c31fd
ret

Function at 0x62b3fd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x1816a9b], 0
jne 0x62b4ac
push esi
push 0x875bb8
call fcn.0063590f
mov dword [esp], 0x875a34
call fcn.0063590f
mov dword [esp], 0x875cb0
call fcn.0063590f
mov dword [esp], 0x875cd4
call fcn.0063590f
mov dword [esp], 0x875bdc
call fcn.0063590f
mov esi, 0x875a98
push esi
call fcn.0063faa7
push esi
call fcn.0063faa7
push 0x875ab8
call fcn.0063faa7
push 0x875ad8
call fcn.0063faa7
push 0x875c00
call fcn.0063faa7
push 0x875a58
call fcn.0063faa7
push 0x875a78
call fcn.0063faa7
push 0x875c58
call fcn.0063faa7
push 0x875c78
call fcn.0063faa7
add esp, 0x28
mov byte [0x1816a9b], 1
pop esi
jmp 0x647df7
ret
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x647dff
mov dword [edx*4 + 0x181d180], ecx
inc edx
cmp edx, 0x100
jb 0x647dfa
mov esi, 0x800
jmp 0x647e47
mov ecx, dword [edx*4 + 0x181cd80]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x181d180]
mov dword [edx*4 + 0x181d180], ecx
inc edx
cmp edx, esi
jb 0x647e2b
mov eax, 0x81fb90
mov esi, 0x81fab0
mov dword [0x181d17c], eax
mov dword [0x181d174], eax
mov dword [0x181d178], esi
call fcn.0065f805
mov ecx, dword [0x181d174]
test eax, eax
cmove ecx, esi
mov dword [0x181d174], ecx
pop esi
ret
Function at 0x66a0a1
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 8]
cmp dword [eax], esi
jne 0x66a0b9
push eax
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66a0cb
lea eax, [edi + 0xc]
cmp dword [eax], esi
jne 0x66a0c9
push eax
call fcn.0065f42c
pop ecx
mov esi, eax
mov eax, esi
pop edi
pop esi
ret

Function at 0x66a4a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi], ax
cmp byte [edi + 1], al
je 0x66a520
mov bl, byte [edi + 2]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.006255da
movzx eax, byte [edi + 4]
mov ecx, esi
push eax
push 0x800
call fcn.0066a585
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x66a529
mov ecx, esi
call fcn.00656000
mov bl, al
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x38]
mov dword [esi + 0x48], ecx
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
mov dword [esi + 0x40], 0x3f
mov byte [esi + 5], cl
test bl, bl
jne 0x66a554
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0x14], 1
cmp byte [eax + 0x24], cl
jne 0x66a557
mov byte [ebp + 0x14], cl
push dword [ebp + 0x14]
mov ecx, esi
push 1
call fcn.0066a585
test bl, bl
je 0x66a580
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x66d25c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x66d26f
xor eax, eax
jmp 0x66d2f9
lea eax, [esi + 0x30]
push edi
push eax
call fcn.0065f440
pop ecx
test eax, eax
jne 0x66d2f5
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d2f5
lea eax, [esi + 0x18]
push eax
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d2f5
lea eax, [esi + 0x1c]
push eax
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d2f5
push dword [ebp + 0x14]
lea eax, [esi + 0x20]
push dword [ebp + 0x14]
push eax
call fcn.0065f549
add esp, 0xc
test eax, eax
jne 0x66d2f5
push dword [ebp + 0x14]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.0065f549
add esp, 0xc
test eax, eax
jne 0x66d2f5
push dword [ebp + 0x10]
lea eax, [esi + 0x10]
mov dword [esi + 4], edi
push dword [ebp + 0xc]
push eax
call fcn.0065f5a8
add esp, 0xc
test eax, eax
jne 0x66d2f5
mov dword [esi], edi
jmp 0x66d2f8
push 0xc
pop eax
pop edi
pop esi
pop ebp
ret
Function at 0x66d4a7
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x66d4be
push ebx
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d500
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x66d4d2
push edi
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d4ff
push ebx
call fcn.0065f4b4
push edi
call fcn.0065f4b4
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x66d4f0
xor eax, eax
jmp 0x66d4ff
push esi
push 0x66d469
push eax
call fcn.0065f5a8
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x672eaa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.006256e8
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.005c22ca
leave
ret

Function at 0x672f37
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x67358e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
pop ebp
ret