joyce8/EMBER2024-capa huggingface dataset:
Function at 0x601b98
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x601ce5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x601cfc
push 0x601d24
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00415434
mov ebx, eax
lea edx, [ebp - 0xc]
movzx eax, byte [ebp - 1]
call fcn.005fdb78
test al, al
jne 0x601bf7
mov byte [ebp - 2], 0
jmp 0x601cc8
xor eax, eax
push ebp
push 0x601cc1
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x601c3b
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.005ba104
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.005b9cdc
mov eax, dword [ebp - 0x20]
call fcn.0040b88c
push eax
call ebx
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
jmp 0x601ca9
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.005ba104
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.005ba1d4
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.005b9cdc
mov eax, dword [ebp - 0x28]
call fcn.0040b88c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x601ca9
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.005bf398
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.005bf398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x601cc8
lea eax, [ebp - 0xc]
call fcn.005fdbb4
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x601cec
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.0040a8cc
pop eax
jmp eax

Function at 0x601ed8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x601efc
mov eax, dword [ebp - 4]
jmp 0x601eff
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x601f04
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x601f51
xor ebx, ebx
jmp 0x601f46
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00423d10
test eax, eax
jne 0x601f45
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x601ffc
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x601f27
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x601f5d
je 0x601f66
jmp 0x601f6f
call fcn.005bd2d4
mov esi, eax
jmp 0x601f71
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x601f71
xor esi, esi
test si, si
je 0x601ffc
xor ebx, ebx
jmp 0x601f97
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x601f96
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x601ffc
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x601f7e
xor ebx, ebx
jmp 0x601ff1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x601ff0
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x601fe5
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.00601ed8
push eax
mov eax, esi
call fcn.00601ed8
pop edx
cmp edx, eax
jne 0x601ff0
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x601ffc
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x601fa6
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x617ae4
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x617d28
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x617ccb
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x617b59
mov eax, 0x617d44
call fcn.005feac0
xor edx, edx
push ebp
push 0x617c60
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00407d24
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x617c47
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x617bc1
mov eax, 0x617d68
call fcn.005feac0
xor edx, edx
push ebp
push 0x617c30
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x617c01
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x617c01
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x617bdf
pop dword fs:[0]
add esp, 8
push 0x617c37
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError
pop edx
jmp edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x617c67
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax

Function at 0x61979c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
push 1
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.0040b88c
mov ecx, eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
mov edx, 0x80000002
call fcn.005bcc2c
test eax, eax
jne 0x61980f
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.0040b88c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x6197fe
cmp dword [ebp - 8], 4
je 0x619802
xor ebx, ebx
jmp 0x619804
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x619811
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x65595c
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x655ac2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 8]
test esi, esi
je 0x65599e
or ebx, 0xffff
mov eax, esi
call fcn.0040b88c
mov esi, eax
jmp 0x6559a0
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
call sub.kernel32.dll_GetLastError
cmp eax, 0x2f76
jne 0x6559d0
mov eax, edi
call fcn.0040a86c
jmp 0x655aa5
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x655a20
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x20]
mov edx, dword [0x6bf7c0]
call fcn.00429e78
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x6b77a8]
mov dl, 1
mov eax, dword [0x658fe0]
call fcn.0042b60c
call fcn.00409f64
mov edx, dword [ebp - 0xc]
shr edx, 1
dec edx
mov eax, edi
call fcn.0040ba00
mov eax, dword [edi]
test eax, eax
je 0x655a38
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x655aa5
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi]
call fcn.0040b88c
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x655aa5
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x24]
mov edx, dword [0x6bf7c0]
call fcn.00429e78
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x6b77a8]
mov dl, 1
mov eax, dword [0x658fe0]
call fcn.0042b60c
call fcn.00409f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x655ac9
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040a8cc
pop eax
jmp eax

Function at 0x655c88
Capabilities:
Initialize winhttp library

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x655c97
add esp, 0xfffffff0
call fcn.004090d4
mov ebx, edx
mov edi, eax
mov eax, edi
call fcn.0065f998
mov dl, 1
mov eax, dword [0x65406c]
call fcn.00658e30
mov dword [edi + 0xb8], eax
mov dl, 1
mov eax, dword [0x645128]
call fcn.006504fc
mov dword [edi + 0xb4], eax
mov eax, dword [0x65313c]
call fcn.006589ec
push 0
push 0
push 0
push 1
push 0x655d38
call sub.winhttp.dll_WinHttpOpen
mov esi, eax
mov dword [edi + 0xb0], esi
test esi, esi
jne 0x655d05
mov ecx, dword [0x6b7970]
mov dl, 1
mov eax, dword [0x659098]
call fcn.0042b5d0
call fcn.00409f64
push 0
push 0x10010
push 0x655ae4
mov eax, dword [edi + 0xb0]
push eax
call sub.winhttp.dll_WinHttpSetStatusCallback
mov eax, edi
test bl, bl
je 0x655d32
call fcn.0040912c
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x665594
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, esi
test ebx, ebx
je 0x6655ad
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b88c
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x6655e1
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
xor eax, eax
call fcn.0066545c
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x6674c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x66762b
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x667518
mov cx, 0x42ee
xor edx, edx
mov al, 0xa
call fcn.0068f2a4
test al, al
jne 0x667518
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x667593
mov eax, 0x667648
call fcn.00607c20
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x667593
test bl, bl
je 0x667523
mov ebx, 0x80000001
jmp 0x667528
mov ebx, 0x80000002
push 0
push 2
lea eax, [ebp - 4]
push eax
mov ecx, 0x667718
mov edx, ebx
xor eax, eax
call fcn.005bcc2c
test eax, eax
jne 0x667589
mov ebx, esi
test ebx, ebx
je 0x66754d
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b88c
push eax
push 1
push 0
mov eax, edi
call fcn.0040b88c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x66757e
mov eax, 0x66778c
call fcn.00607c20
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x667593
mov eax, 0x6677f0
call fcn.00607c20
cmp byte [ebp + 0xc], 0
je 0x66760e
mov eax, esi
call fcn.0040b88c
push eax
call sub.gdi32.dll_AddFontResourceW
test eax, eax
je 0x6675bc
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
jmp 0x66760e
lea ecx, [ebp - 0xc]
mov edx, 0x667844
mov ax, 0x47
call fcn.005c327c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.005bd550
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x6b7af0]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [0x6b7af0]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x6b7af0]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
pop eax
call fcn.00664ae0
test al, al
je 0x667599
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x667632
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040a8cc
pop eax
jmp eax
Function at 0x66ab84
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x66ac47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b88c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x66ac2a
test bl, 0x10
je 0x66ac2a
lea ecx, [ebp - 4]
mov edx, 0x66ac64
mov eax, esi
call fcn.005b9e4c
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x66ac88
mov eax, 0x66aca4
call fcn.005bbb1c
mov edx, 0x66acd0
mov eax, dword [ebp - 8]
call fcn.00423d10
test eax, eax
jne 0x66ac2a
mov eax, dword [ebp - 4]
call fcn.00425184
lea ecx, [ebp - 0xc]
mov edx, 0x66ad2c
mov eax, esi
call fcn.005b9e4c
mov eax, dword [ebp - 0xc]
call fcn.00425184
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.0040b88c
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesW
push edi
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66ac4e
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a8cc
pop eax
jmp eax

Function at 0x66bb50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x66bc2c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.005febd4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x66bc48
call fcn.00607ea8
mov eax, dword [0x6b7630]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
call fcn.0049a7d0
mov esi, eax
mov eax, dword [esi]
mov ebx, eax
test ebx, ebx
je 0x66bbc3
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
push eax
mov eax, ebx
mov ecx, 0x14
cdq
idiv ecx
push eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0061ea14
test al, al
jne 0x66bc14
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x66bbf9
mov eax, 0x66bc98
call fcn.00607c20
jmp 0x66bc14
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x66bd38
call fcn.00607ea8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66bc33
lea eax, [ebp - 0x1c]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x67d284
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
call fcn.0067d158
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4a
mov eax, dword [0x6bf810]
push eax
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408bcc
cmp ebx, 0x6c840001
jne 0x67d2e4
call fcn.0042b504
mov eax, 0xffff0000
and eax, ebx
cmp eax, 0x6c830000
je 0x67d308
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x67d3bc
call fcn.005fe9c0
mov word [ebp - 0xa], bx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 8]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x67d35e
mov ebx, eax
mov edx, 1
movzx eax, word [ebp - 0xa]
call fcn.0067d1d8
mov esi, eax
mov eax, esi
sub ax, 2
je 0x67d35e
dec eax
sub ax, 2
jb 0x67d372
movzx eax, si
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x67d41c
call fcn.005fe9c0
push 0x1cff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x67d313
mov edx, 2
movzx eax, word [ebp - 0xa]
call fcn.0067d1d8
movzx ebx, ax
mov edx, 3
movzx eax, word [ebp - 0xa]
call fcn.0067d1d8
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x67e108
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
mov eax, ebx
call fcn.0067e184
call fcn.0040704c
mov esi, eax
push esp
push 0x40
mov eax, ebx
call fcn.0067e184
push eax
push esi
call sub.kernel32.dll_VirtualProtect
mov edx, esi
mov eax, ebx
call fcn.0067e13c
mov eax, esi
pop edx
pop esi
pop ebx
ret
Function at 0x6800d4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x6802aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.0040aa04
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x6b7200]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040b88c
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.005bcc2c
test eax, eax
jne 0x68028d
xor eax, eax
push ebp
push 0x680282
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.005d3860
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x680165
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x680192
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.0040ae2c
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x6801b4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.0040ae2c
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x68022a
sub eax, 0xe9
je 0x6801ce
sub eax, 0x19
je 0x680269
jmp 0x680223
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x6801e5
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x6801f8
call fcn.0040a058
jmp 0x68028d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x68020f
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040aa04
jmp 0x680159
call fcn.0040a058
jmp 0x68028d
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.005d3860
lea eax, [ebp - 4]
call fcn.0040ae2c
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.0040aa04
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.005e4f5c
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.005d19e8
inc ebx
jmp 0x680159
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x680289
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6802b1
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a8cc
pop eax
jmp eax
Function at 0x687168
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x6871ee
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x6871d4
mov ebx, esi
test ebx, ebx
je 0x68719a
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b88c
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x68720c
call fcn.0040bad8
mov eax, dword [ebp - 8]
call fcn.0040b88c
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x6871d6
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6871f5
lea eax, [ebp - 8]
call fcn.0040a86c
pop eax
jmp eax

Function at 0x68d76c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x68d776
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x68d82c
push 0x68d860
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00415434
mov ebx, eax
test ebx, ebx
je 0x68d815
mov eax, esi
call fcn.0040b88c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x68d815
test al, 0x10
je 0x68d7c6
mov ebp, 0x2000000
jmp 0x68d7c8
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.0040b88c
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x68d815
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle
test ebx, ebx
jle 0x68d815
cmp ebx, 0xff0
jge 0x68d815
mov edx, edi
mov eax, esp
call fcn.0068d684
jmp 0x68d81e
mov eax, edi
mov edx, esi
call fcn.0040ac5c
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x68d87c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x68d90b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jle 0x68d8df
cmp eax, 0x104
jge 0x68d8df
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040b928
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0068d76c
jmp 0x68d8f0
mov eax, 0x68d924
call fcn.005feb78
mov eax, ebx
call fcn.0040a86c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68d912
lea eax, [ebp - 0x20c]
call fcn.0040a86c
pop eax
jmp eax