joyce8/EMBER2024-capa huggingface dataset:
Function at 0x634c44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x634c75
dec al
je 0x634cb0
dec al
je 0x634cf4
dec al
je 0x634d66
jmp 0x634e01
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x634e01
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x634c85
jmp 0x634e01
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x634e01
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x634cc0
jmp 0x634e01
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x634e01
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x634d27
xor edx, edx
mov dword [esp + 4], edx
jmp 0x634d3c
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x634d54
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x634d04
jmp 0x634e01
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x634e01
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x634dcd
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.00631bf4
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x634d82
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6393c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b684
xor eax, eax
push ebp
push 0x6395ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040b590
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.006452ac
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.00428b40
test al, al
je 0x639586
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.006452ac
mov eax, dword [ebp - 0x24]
call fcn.0040c128
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x63949e
xor eax, eax
push ebp
push 0x639492
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00407004
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.006452ac
mov eax, dword [ebp - 0x28]
call fcn.0040c128
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63949e
test bl, bl
je 0x639586
xor eax, eax
push ebp
push 0x639571
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x6395bc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.00427eb8
mov eax, dword [ebp - 8]
push dword [eax]
push 0x6395cc
mov eax, dword [ebx + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00427eb8
push dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 8]
push dword [eax]
push 0x6395cc
mov eax, dword [ebx + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00427eb8
push dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 8]
push dword [eax]
push 0x6395cc
mov eax, dword [ebx + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00427eb8
push dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63957b
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00407020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6395b2
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.0040b5f0
lea eax, [ebp - 4]
call fcn.0040b590
pop eax
jmp eax
Function at 0x64470c
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00430e04
cmp eax, 2
je 0x644729
mov byte [ebp - 1], 1
jmp 0x644905
mov byte [ebp - 1], 0
mov eax, 0x682b44
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x644905
xor eax, eax
push ebp
push 0x6448fe
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x644792
push 0x644910
push 0x64493c
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041738c
mov ebx, eax
test ebx, ebx
je 0x6447b9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x6448e5
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x6448e5
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x64480a
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x6447eb
call fcn.0040ad40
jmp 0x644905
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x64480a
call fcn.0040ad40
jmp 0x644905
xor eax, eax
push ebp
push 0x6448de
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x64484d
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x64484d
call fcn.0040ad40
call fcn.0040ad40
jmp 0x644905
mov eax, dword [ebp - 0x14]
call fcn.00407004
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x644882
call fcn.0040ad40
call fcn.0040ad40
jmp 0x644905
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x6448bd
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x6448b9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x6448b9
mov byte [ebp - 1], 1
jmp 0x6448bd
inc ebx
dec esi
jne 0x64488f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6448e5
mov eax, dword [ebp - 0x18]
call fcn.00407020
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644905
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x64497c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x644a98
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00407540
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00429488
mov eax, dword [ebp - 0xc]
call fcn.0040c128
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x644a0a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x84000100
push 0
push 0
push 0x644aac
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
test eax, eax
setne byte [ebp - 1]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x644a14
cmp byte [ebp - 1], 0
jne 0x644a72
mov eax, dword [0x68b270]
mov edx, 0x644ae4
call fcn.0040c4c4
je 0x644a72
xor edx, edx
push ebp
push 0x644a68
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x84000100
push 0
push 0
push 0x644af4
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
test eax, eax
setne byte [ebp - 1]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x644a72
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644a9f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040b5f0
pop eax
jmp eax

Function at 0x644c84
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x644ce3
xor eax, eax
push ebp
push 0x644cdc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644ce3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
push 0x3e8
call sub.kernel32.dll_Sleep
movzx eax, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x645658
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x6457c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040b590
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x418]
xor eax, eax
call fcn.00407540
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
call fcn.00429488
mov eax, dword [ebp - 0x414]
call fcn.0040c128
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6457a0
xor eax, eax
push ebp
push 0x64570c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x84000100
push 0
push 0
mov eax, edi
call fcn.0040c128
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x645726
cmp dword [ebp - 0xc], 0
jne 0x645737
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x6457a0
xor eax, eax
push ebp
push 0x645784
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x410]
lea eax, [ebp - 4]
mov ecx, dword [esi]
call fcn.0040b848
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040c334
cmp dword [esi], 0
jne 0x645745
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64578e
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6457cf
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.0040b5f0
lea eax, [ebp - 4]
call fcn.0040b590
pop eax
jmp eax
Function at 0x645eb4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040b684
mov eax, dword [ebp - 8]
call fcn.0040b684
xor eax, eax
push ebp
push 0x64606d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408280
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x44], esi
cmp byte [ebp + 0x10], 0
je 0x645f16
mov dword [ebp - 0x48], 0x540
jmp 0x645f1d
mov dword [ebp - 0x48], 0x500
movzx eax, word [ebp + 0x14]
mov dword [ebp - 0x30], eax
cmp byte [ebp + 0xc], 0
je 0x645f32
mov eax, 0x646080
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.0040c128
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.0040c128
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x64600e
cmp byte [ebp + 0x10], 0
je 0x646008
test bl, bl
je 0x645f95
cmp byte [0x68b206], 0
jne 0x645f95
cmp byte [0x68b210], 0
jne 0x645f95
mov eax, dword [0x68b1c4]
mov eax, dword [eax + 0x428]
call fcn.00551ca0
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
test bl, bl
je 0x645fb1
mov eax, dword [0x68b1c4]
mov eax, dword [eax + 0x428]
cmp byte [eax + 0x69], 0
je 0x645fb1
mov al, 1
call fcn.006454d8
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x10], 0x103
jne 0x645fe3
mov eax, dword [0x683324]
mov eax, dword [eax]
cmp byte [eax + 0xbc], 0
je 0x645f95
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x50]
call fcn.00427eb8
mov edx, dword [ebp - 0x50]
mov eax, 0x68b234
call fcn.0040b980
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 9], 1
jmp 0x646023
cmp byte [ebp + 0x10], 0
je 0x646023
mov eax, 0x68b234
mov edx, 0x646098
call fcn.0040b980
test bl, bl
je 0x646048
mov eax, dword [0x68b1c4]
mov eax, dword [eax + 0x428]
cmp byte [eax + 0x69], 0
je 0x646048
mov eax, dword [0x68b1c4]
mov eax, dword [eax + 0x428]
call fcn.00551c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x646074
lea eax, [ebp - 0x50]
call fcn.0040b590
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b5f0
pop eax
jmp eax

Function at 0x64668c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x6466f6
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x6466f6
lea eax, [esp + 0xc]
push eax
push 0x6466fc
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x6466f6
push 0
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
ret
Function at 0x646d84
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040b590
push esp
push 0
push 0
push esi
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x646db6
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c1dc
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x646dc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x646e3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040b590
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x646e21
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040c1dc
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.004313d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x646e43
lea eax, [ebp - 0x210]
call fcn.0040b590
pop eax
jmp eax
Function at 0x64a63c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd70
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x270]
mov edx, dword [0x41f4b4]
call fcn.0040c8d8
xor eax, eax
push ebp
push 0x64a92b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x278]
mov ecx, 0x64a948
mov edx, dword [ebp - 0x274]
call fcn.0040c38c
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.00429074
test eax, eax
jne 0x64a8bd
mov eax, dword [ebp - 0x25c]
mov edx, 0x64a960
call fcn.0040c4c4
je 0x64a89f
mov eax, dword [ebp - 0x25c]
mov edx, 0x64a970
call fcn.0040c4c4
je 0x64a89f
mov eax, dword [ebp - 0x260]
and eax, 0x10
cmp eax, 0x10
je 0x64a873
xor edx, edx
push ebp
push 0x64a867
push dword fs:[edx]
mov dword fs:[edx], esp
push dword [ebp - 0x274]
push 0x64a984
push dword [ebp - 0x25c]
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 0x27c]
call fcn.00429104
test al, al
jne 0x64a85d
mov ebx, dword [ebp - 0x25c]
mov edx, 0x64a994
mov dword [ebp - 0x280], ebx
mov eax, dword [ebp - 0x280]
call fcn.0042731c
test eax, eax
sete al
test al, al
je 0x64a785
push 0
push 0
push 0x64a9ac
push 0x64a9f0
push 0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x64a7c4
mov eax, dword [ebp - 0x260]
and eax, 1
dec eax
jne 0x64a7c4
push dword [ebp - 0x274]
push 0x64a984
push dword [ebp - 0x25c]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 0x284]
mov cl, 1
mov edx, 0x80
call fcn.00428ef0
push 0x3e8
call sub.kernel32.dll_Sleep
push dword [ebp - 0x274]
push 0x64a984
push dword [ebp - 0x25c]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 0x288]
call fcn.00429104
test al, al
jne 0x64a85d
cmp dword [0x68b27c], 0
je 0x64a85d
mov dl, 1
mov eax, dword [0x68b27c]
call fcn.00428b40
test al, al
je 0x64a85d
xor ebx, ebx
jmp 0x64a848
push 0x3e8
call sub.kernel32.dll_Sleep
inc ebx
mov eax, dword [0x68b27c]
call fcn.0040c128
mov edx, eax
lea eax, [ebp - 0x28c]
call fcn.0040c188
mov eax, dword [ebp - 0x28c]
call fcn.00429104
mov dl, 1
mov eax, dword [0x68b27c]
call fcn.00428b40
test al, al
je 0x64a85d
cmp ebx, 4
jl 0x64a81b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64a89f
push dword [ebp - 0x274]
push 0x64a984
push dword [ebp - 0x25c]
lea eax, [ebp - 0x290]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 0x290]
call fcn.0064a63c
lea eax, [ebp - 0x270]
call fcn.004290c4
test eax, eax
je 0x64a6c7
lea eax, [ebp - 0x270]
call fcn.004290e8
xor eax, eax
push ebp
push 0x64a8e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x274]
call fcn.00429724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64a8ea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a932
lea eax, [ebp - 0x290]
mov edx, 4
call fcn.0040b5f0
lea eax, [ebp - 0x27c]
mov edx, 2
call fcn.0040b5f0
lea eax, [ebp - 0x270]
mov edx, dword [0x41f4b4]
call fcn.0040cca4
pop eax
jmp eax
Function at 0x6535e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6536c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.006452ac
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.00428b40
test al, al
jne 0x65366a
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, 0x6536e4
call fcn.0040c38c
mov eax, dword [ebp - 8]
call fcn.00646d2c
cmp byte [0x68b206], 0
jne 0x653661
push 0x10
push 0x653720
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, 0x653738
call fcn.00649504
mov eax, dword [ebp - 0xc]
call fcn.0040c128
push eax
mov eax, dword [0x68b1c4]
call fcn.0055b2f8
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x68b20e], 1
jmp 0x6536ac
push 1
push 0
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 0x653770
call fcn.0040c38c
mov eax, dword [ebp - 0x10]
call fcn.0040c128
push eax
push 0x6537ac
push 0x6537c8
push 0
call sub.shell32.dll_ShellExecuteW
cmp byte [0x68b208], 0
je 0x6536ac
mov edx, ebx
mov eax, 0x6537e0
call fcn.0064b208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6536d0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040b5f0
pop eax
jmp eax
Function at 0x65925c
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b684
xor eax, eax
push ebp
push 0x659328
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.006452ac
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040b9c8
xor eax, eax
push ebp
push 0x6592fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00428510
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6592c1
mov byte [ebp - 5], 0
jmp 0x6592f4
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetSystemTime
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659308
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65932f
lea eax, [ebp - 0x24]
call fcn.0040b590
lea eax, [ebp - 4]
call fcn.0040b590
pop eax
jmp eax
Function at 0x66493c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
mov edx, 0x6649cc
call fcn.0040b980
xor edx, edx
push ebp
push 0x664976
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetUserDefaultLangID
mov ebx, eax
call sub.kernel32.dll_GetSystemDefaultLangID
pop dword fs:[0]
add esp, 8
jmp 0x664987
cmp bx, 0x409
jne 0x664994
cmp ax, 0x409
je 0x6649ba
cmp bx, 0x419
je 0x6649ae
cmp ax, 0x419
je 0x6649ae
cmp bx, 0x423
je 0x6649ae
cmp ax, 0x423
jne 0x6649ba
mov eax, esi
mov edx, 0x6649e4
call fcn.0040b980
pop edi
pop esi
pop ebx
pop ebp
ret