joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40816e
Capabilities:
Create directory

Disassembly:
push 0xf4
mov eax, 0x420ad8
call fcn.0040b3d5
mov edi, edx
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40818b
mov eax, dword [esi]
push dword [esi + 0x10]
push eax
call fcn.00407df7
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40819e
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408307
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 3
jne 0x4081e0
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.004083ec
and dword [ebp - 4], 0
mov edx, edi
mov ecx, eax
call fcn.0040816e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004046d5
jmp 0x408181
dec ecx
sub ecx, 1
je 0x4082bf
sub ecx, 0x52
je 0x40827a
sub ecx, 0x60
jne 0x40830d
mov ecx, esi
call fcn.0040908c
test al, al
je 0x408307
push esi
mov edx, str.Cannot_create_the_directory__it_already_exists_as_a_file:__
lea ecx, [ebp - 0x40]
call fcn.00403b7c
mov dword [ebp - 4], 1
mov edx, eax
push 0x42235c
lea ecx, [ebp - 0x28]
call fcn.00403a95
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x100]
push ecx
mov ecx, eax
call fcn.00405dda
push str.WT::System::IO::CDirectory::Create
push 0x3e
push str.WtSystemIoDirectory.cpp
push dword [eax + 4]
lea ecx, [ebp - 0x9c]
push dword [eax]
call fcn.00409b63
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.00401440
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.00401440
jmp 0x408354
push esi
mov edx, str.Create_Failed.__Invalid_Parameter_:
lea ecx, [ebp - 0x40]
call fcn.00403b7c
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x100]
push ecx
mov ecx, eax
call fcn.00405dda
push str.WT::System::IO::CDirectory::Create
push 0x44
push str.WtSystemIoDirectory.cpp
push dword [eax + 4]
lea ecx, [ebp - 0x9c]
push dword [eax]
call fcn.00409b63
mov byte [ebp - 4], 0xb
jmp 0x40826d
push esi
mov edx, str.Create_Failed.__Access_Denied_:
lea ecx, [ebp - 0x40]
call fcn.00403b7c
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x100]
push ecx
mov ecx, eax
call fcn.00405dda
push str.WT::System::IO::CDirectory::Create
push 0x42
push str.WtSystemIoDirectory.cpp
push dword [eax + 4]
lea ecx, [ebp - 0x9c]
push dword [eax]
call fcn.00409b63
mov byte [ebp - 4], 8
jmp 0x40826d
call fcn.0040b37f
ret
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.00408a16
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x100]
push ecx
mov ecx, eax
call fcn.0040814d
push str.WT::System::IO::CDirectory::Create
push 0x47
push str.WtSystemIoDirectory.cpp
push dword [eax + 4]
lea ecx, [ebp - 0x9c]
push dword [eax]
call fcn.00409a80
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x28]
call fcn.00404132
lea ecx, [ebp - 0x9c]
call fcn.00409f90
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0xf8]
call fcn.004099c9
push 0x42da60
lea eax, [ebp - 0xf8]
push eax
call fcn.0040c149
int3

Function at 0x4083ce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x4083d6
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4083e9
test al, 0x10
je 0x4083e9
mov al, 1
ret
xor al, al
ret
Function at 0x40908c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x409094
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4090a7
test al, 0x10
jne 0x4090a7
mov al, 1
ret
xor al, al
ret

Function at 0x41baf1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b7a2

Function at 0x41bafc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b92c
Function at 0x1000a7e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000a7f4
pop dword [ebp - 0x50]
mov eax, 0x322c5fbd
add eax, 0xddd44837
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x6b9077ce
sub dword [ebp - 0x60], 0x1d3e3283
mov dword [ebp - 0x5c], 0x3160f29a
add dword [ebp - 0x5c], 0xd259ab
mov dword [ebp - 0x58], 0x8b5d5408
add dword [ebp - 0x58], 0xc0eef026
mov dword [ebp - 0x54], 0x2721c978
sub dword [ebp - 0x54], 0x2721c978
lea eax, [ebp - 0x60]
push eax
mov eax, 0xc5c853ad
sub eax, 0xb5c79389
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x5d5a233
add dword [ebp - 0x60], 0x6e9cc723
mov dword [ebp - 0x5c], 0xde40f7b7
sub dword [ebp - 0x5c], 0x9cd49642
mov dword [ebp - 0x58], 0x86e5ea5b
sub dword [ebp - 0x58], 0x23767def
mov dword [ebp - 0x54], 0xd74edc4e
sub dword [ebp - 0x54], 0xd74edc4e
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38720
push 0
call eax
mov ecx, 0x87f062da
sub ecx, 0x87f018d7
xor edx, edx
add edx, eax
mov ebx, 0x10047400
add ebx, dword [ebp - 0x50]
mov esi, 0xdc3129a9
sub esi, 0x4806b5dd
mov edi, dword [ebx]
xor dword [ebp - 0x1c], 0x8cd2239f
xor edi, esi
xor dword [ebp - 0x18], 0xda8fd787
mov dword [edx], edi
sub dword [ebp - 0x44], 0x31bf77cd
add edx, 0xf069b2f7
sub edx, 0xf069b2f3
add ebx, 0x38401f56
add ebx, 0xc7bfe0ae
loop 0x1000a90d
add eax, 0x11adf
xor ebx, ebx
add ebx, eax
add eax, 0xab0e2bf2
sub eax, 0xab0e2bed
mov ecx, 0xda05d08e
sub ecx, 0xca05d08e
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0xc0a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c0a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc0a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc0a06a
add dl, dl
jne 0xc0a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc0a0dc
xor eax, eax
add dl, dl
jne 0xc0a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc0a17d
add dl, dl
jne 0xc0a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc0a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc0a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc0a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc0a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc0a075
mov eax, 1
add dl, dl
jne 0xc0a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc0a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc0a0e1
sub eax, ebx
mov ebx, 1
jne 0xc0a128
mov ecx, 1
add dl, dl
jne 0xc0a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc0a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc0a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc0a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc0a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc0a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc0a136
cmp eax, 0x7d00
jae 0xc0a16d
cmp eax, 0x500
jb 0xc0a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc0a075
cmp eax, 0x7f
ja 0xc0a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc0a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc0a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc0a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x601420
Capabilities:
Hash data using crc32b
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x674348], 0
jne 0x601559
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
xor eax, eax
test cl, 1
je 0x601442
bts eax, 7
shr ecx, 1
test cl, 1
je 0x60144d
bts eax, 6
shr ecx, 1
test cl, 1
je 0x601458
bts eax, 5
shr ecx, 1
test cl, 1
je 0x601463
bts eax, 4
shr ecx, 1
test cl, 1
je 0x60146e
bts eax, 3
shr ecx, 1
test cl, 1
je 0x601479
bts eax, 2
shr ecx, 1
test cl, 1
je 0x601484
bts eax, 1
test cl, 2
je 0x60148d
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax*4 + 0x674350], ebx
lea ecx, [edx + 1]
nop
test bl, 1
je 0x60152f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x601520
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x674350], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x601437
mov byte [0x674348], 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x601560
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00601420
mov esi, dword [ebp + 8]
or eax, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edx, esi
or edx, edi
je 0x6015a1
nop dword [eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
add esi, 0xffffffff
movzx edx, al
adc edi, 0xffffffff
xor edx, ecx
shr eax, 8
mov ecx, esi
xor eax, dword [edx*4 + 0x674350]
or ecx, edi
jne 0x601580
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x601680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 0x10], edx
lea edx, [ecx + 8]
push esi
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
movlpd qword [ebp - 0x20], xmm0
jl 0x601715
mov edi, dword [ebp + 8]
jg 0x6016b4
test edi, edi
je 0x601715
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
nop dword [eax]
mov ecx, dword [ebp - 8]
inc bl
mov edi, dword [ebp - 8]
movzx ebx, bl
mov edx, dword [ecx + ebx*4]
mov al, dl
add al, byte [ebp - 4]
movzx eax, al
mov dword [ebp - 4], eax
mov eax, dword [ecx + eax*4]
mov dword [ecx + ebx*4], eax
mov ecx, dword [ebp - 4]
mov dword [edi + ecx*4], edx
add dl, al
mov ecx, edi
movzx eax, dl
mov edi, dword [ebp + 8]
mov al, byte [ecx + eax*4]
mov ecx, dword [ebp - 0x10]
xor byte [esi + ecx], al
add esi, 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
adc eax, 0
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp + 0xc]
jl 0x6016c0
jg 0x601712
cmp esi, edi
jb 0x6016c0
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx], ebx
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x603750
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
mov edx, dword [esi]
mov eax, edx
mov ecx, dword [esi + 4]
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 9], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 7], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, 0xfffffff7
mov byte [ebp - 0xc], dl
shr edx, 3
sub eax, edx
mov byte [ebp - 8], cl
shr ecx, 0x18
and eax, 0x3f
inc eax
mov byte [ebp - 5], cl
push eax
mov edx, 0x669618
mov ecx, esi
call fcn.00604530
push 8
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.00604530
add esp, 8
xor eax, eax
nop dword [eax + eax]
mov edx, eax
mov ecx, eax
sar edx, 2
and ecx, 3
shl ecx, 3
mov edx, dword [esi + edx*4 + 8]
shr edx, cl
mov byte [edi + eax + 4], dl
inc eax
cmp eax, 0x10
jl 0x6037d0
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop esi
call fcn.00631776
mov esp, ebp
pop ebp
ret
Function at 0x603830
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x659069
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 4], 0
push 0x58
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x78], 0
call fcn.0063178c
mov ecx, eax
add esp, 4
mov dword [ebp - 0x74], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
lea edx, [esi + 4]
mov dword [ebp - 4], 1
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x6038bf
mov edx, dword [edx]
add eax, eax
push eax
call fcn.00604530
add esp, 4
lea ecx, [ebp - 0x74]
call fcn.00603750
inc dword [0x674754]
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [edi], 0x669c14
xor ecx, ecx
movups xmm0, xmmword [ebp - 0x70]
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 7
mov byte [ebp - 0x14], 0
movups xmmword [ebp - 0x24], xmm0
mov word [edi + 4], cx
mov dword [ebp - 0x78], 1
xor esi, esi
nop
movzx eax, byte [ebp + esi - 0x24]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x44]
movq qword [ebp - 0x34], xmm0
push 0x6695f8
push eax
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x28], 0
call fcn.00603720
add esp, 0xc
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x60]
push eax
call fcn.0060e7f0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
lea ecx, [edi + 4]
push dword [ebp - 0x4c]
cmovae eax, dword [ebp - 0x5c]
push eax
call fcn.00611030
mov byte [ebp - 4], 1
dec dword [0x674754]
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x60], 0x669c14
cmp edx, 8
jb 0x6039ae
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x6039a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6039e2
push edx
push ecx
call fcn.006317bc
add esp, 8
inc esi
cmp esi, 0x10
jl 0x603910
push 0x58
push dword [ebp - 0x74]
call fcn.006317bc
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret
call fcn.006375a6
int3
Function at 0x603a90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6590f0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 8]
push 0x58
mov dword [ebp - 0x5c], eax
call fcn.0063178c
mov dword [ebp - 0x40], eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
push esi
mov edx, edi
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.00604530
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.00603750
movups xmm0, xmmword [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x58]
movups xmmword [ebp - 0x20], xmm0
call fcn.006039f0
xor ecx, ecx
mov dword [ebp - 0x2c], 0x669c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x28]
inc dword [0x674754]
mov ecx, eax
call fcn.0060eeb0
add esp, 4
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x28]
add ecx, 4
mov byte [ebp - 4], 3
cmp ecx, eax
je 0x603b7b
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00611370
dec dword [0x674754]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x603bb7
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x603bad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x603c0f
push edx
push ecx
call fcn.006317bc
add esp, 8
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x603be7
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x603bdd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x603c0f
push edx
push ecx
call fcn.006317bc
add esp, 8
push 0x58
push dword [ebp - 0x40]
call fcn.006317bc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret
call fcn.006375a6
int3
Function at 0x606d50
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x659651
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00633cb0
add esp, 0xc
mov dword [ebp - 0x24c], 0x100
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov dword [ebp - 0x248], 0x669c14
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 7
mov word [ebp - 0x244], ax
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], eax
inc dword [0x674754]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x606df0
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x244]
call fcn.00611370
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x22c], 0x669c14
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
push 6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
inc dword [0x674754]
push 0x669870
call fcn.00611370
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
lea eax, [ebp - 0x244]
cmovae ecx, dword [ebp - 0x228]
cmp dword [ebp - 0x230], 8
push ecx
cmovae eax, dword [ebp - 0x244]
push eax
call fcn.0063c93c
mov ecx, dword [0x674754]
add esp, 8
mov edx, dword [ebp - 0x214]
dec ecx
mov dword [ebp - 0x22c], 0x669c14
mov esi, eax
mov dword [0x674754], ecx
cmp edx, 8
jb 0x606ee9
mov ecx, dword [ebp - 0x228]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x606ed9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x606f58
push edx
push ecx
call fcn.006317bc
mov ecx, dword [0x674754]
add esp, 8
mov edx, dword [ebp - 0x230]
test esi, esi
mov dword [ebp - 0x248], 0x669c14
sete bl
dec ecx
mov dword [0x674754], ecx
cmp edx, 8
jb 0x606f3b
mov ecx, dword [ebp - 0x244]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x606f31
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x606f5d
push edx
push ecx
call fcn.006317bc
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret
call fcn.006375a6
call fcn.006375a6
int3
Function at 0x6071e0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x659765
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x254], esi
xor eax, eax
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x234], 0x669c14
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x230]
inc dword [0x674754]
push 0x6695b4
call fcn.00611370
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.00633cb0
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x607313
xor eax, eax
mov dword [ebp - 0x250], 0x669c14
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 2
inc dword [0x674754]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6072d0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x24c]
call fcn.00611370
mov byte [ebp - 4], 3
lea eax, [ebp - 0x24c]
cmp dword [ebp - 0x238], 8
push dword [ebp - 0x23c]
cmovae eax, dword [ebp - 0x24c]
push eax
jmp 0x60733d
lea ecx, [ebp - 0x250]
call fcn.00607430
add eax, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x230]
cmp ecx, eax
je 0x607348
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x607339
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x230]
call fcn.00611370
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 1
call fcn.0060ed70
push 1
lea ecx, [ebp - 0x234]
call fcn.00610310
lea edx, [esi + 4]
mov dword [esi], 0x669c14
xor ecx, ecx
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], cx
mov byte [ebp - 4], 5
add eax, 4
mov ecx, dword [0x674754]
inc ecx
mov dword [0x674754], ecx
cmp edx, eax
je 0x6073b3
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x6073a2
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
mov ecx, edx
call fcn.00611370
mov ecx, dword [0x674754]
mov edx, dword [ebp - 0x21c]
dec ecx
mov dword [ebp - 0x234], 0x669c14
mov dword [0x674754], ecx
cmp edx, 8
jb 0x607400
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x6073f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x60741c
push edx
push ecx
call fcn.006317bc
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret
call fcn.006375a6
int3
Function at 0x607430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6597a6
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x238], esi
call fcn.00606d50
test al, al
je 0x607479
mov ecx, esi
call fcn.00606f70
jmp 0x60753a
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00633cb0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x60746d
xor eax, eax
mov dword [ebp - 0x234], 0x669c14
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], eax
inc dword [0x674754]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6074e0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00611370
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 1
call fcn.0060f570
push 1
lea ecx, [ebp - 0x234]
call fcn.00610310
lea eax, [ebp - 0x234]
mov ecx, esi
push eax
call fcn.0060ecf0
lea ecx, [ebp - 0x234]
call fcn.0060ed70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret