joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59eea0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x716650
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x7b7fc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x83c], ecx
mov eax, dword [ebp - 0x83c]
movzx ecx, byte [eax + 0x20]
test ecx, ecx
jne 0x59eee4
jmp 0x59f061
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x59eef5
jmp 0x59f061
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
jne 0x59ef17
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x59f061
mov edx, dword [ebp - 0x82c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
jne 0x59ef4b
mov eax, dword [ebp - 0x82c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x59f061
mov ecx, dword [ebp - 0x834]
push ecx
lea ecx, [ebp - 0x828]
call fcn.00447530
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x82c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x828]
call fcn.00447040
movzx eax, al
test eax, eax
je 0x59efa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x828]
call fcn.004419f0
jmp 0x59f061
lea ecx, [ebp - 0x828]
call fcn.00441d60
mov dword [ebp - 0x830], eax
lea ecx, [ebp - 0x828]
call fcn.00447050
add eax, dword [ebp - 0x830]
mov dword [ebp - 0x840], eax
push 0x400
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp - 0x840]
sub edx, dword [ebp - 0x830]
push edx
mov eax, dword [ebp - 0x830]
push eax
push 0
mov ecx, dword [0x807b9c]
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0
jg 0x59f01a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x828]
call fcn.004419f0
jmp 0x59f061
mov edx, dword [ebp - 0x838]
push edx
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp - 0x83c]
call fcn.0059e660
cmp dword [0x807380], 0
je 0x59f04f
mov ecx, dword [0x807380]
mov edx, dword [ecx]
mov ecx, dword [0x807380]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x828]
call fcn.004419f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0065d40e
mov esp, ebp
pop ebp
ret

Function at 0x59f9c0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x7b7fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80c], ecx
push 0x800
lea eax, [ebp - 0x804]
push eax
push 0x800
mov ecx, dword [ebp + 8]
push ecx
call sub.IMM32.dll_ImmGetCompositionStringW
shr eax, 1
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
jg 0x59fa06
jmp 0x59fa1f
mov edx, dword [ebp - 0x808]
push edx
lea eax, [ebp - 0x804]
push eax
mov ecx, dword [ebp - 0x80c]
call fcn.0059e660
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0065d40e
mov esp, ebp
pop ebp
ret 4
Function at 0x5a7480
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5a749f
xor al, al
jmp 0x5a74c4
push 4
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + edx]
push edx
mov eax, dword [ebp - 8]
add eax, 4
push eax
call fcn.00678240
add esp, 0xc
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x5b0a10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x717010
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x7b7fc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x138], 0
push 0x76d053
lea ecx, [ebp - 0x40]
call fcn.00447530
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.00674610
mov byte [ebp - 4], 1
mov dword [ebp - 0x134], 0
push 1
lea eax, [ebp - 0x134]
push eax
call fcn.00675c30
add esp, 8
push 0x5e
push 0x7a7fd0
lea ecx, [ebp - 0x28]
call fcn.00447570
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x158], esp
lea edx, [ebp - 0x28]
push edx
call fcn.004475a0
lea eax, [ebp - 0x70]
push eax
call fcn.005b2b70
add esp, 0x1c
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x140]
push edx
lea ecx, [ebp - 0x28]
call fcn.00447470
lea ecx, [ebp - 0x70]
call fcn.004419f0
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x15c], esp
lea ecx, [ebp - 0x28]
call fcn.00441d60
push eax
mov ecx, esi
call fcn.00447530
mov eax, dword [ebp - 0x134]
push eax
lea ecx, [ebp - 0x130]
call fcn.00675c50
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 4
jne 0x5b0b35
lea ecx, [ebp - 0x130]
call fcn.006764e0
movzx ecx, al
test ecx, ecx
jne 0x5b0b50
push 0
push str.Error
push str.Cannot_connect_to_the_server_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.00687048
lea ecx, [ebp - 0x130]
call fcn.0049e0e0
mov ecx, eax
call fcn.0048cbd0
mov esi, eax
lea ecx, [ebp - 0x130]
call fcn.004ef570
add esi, eax
mov dword [ebp - 0x148], esi
lea ecx, [ebp - 0x130]
call fcn.00675b70
mov esi, eax
mov edi, edx
lea ecx, [ebp - 0x130]
call fcn.004ef570
xor edx, edx
sub esi, eax
sbb edi, edx
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x150], edi
mov eax, dword [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x148]
push ecx
lea ecx, [ebp - 0x58]
call fcn.00447570
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x40]
call fcn.00447470
lea ecx, [ebp - 0x58]
call fcn.004419f0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x160], esp
lea eax, [ebp - 0x40]
push eax
call fcn.004475a0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14c]
mov ecx, dword [edx]
call fcn.005b1000
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x138]
or eax, 1
mov dword [ebp - 0x138], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004419f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.00674750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004419f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0065d40e
mov esp, ebp
pop ebp
ret 4
Function at 0x5b1e20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 8]
call fcn.00441d60
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
call fcn.00447050
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jae 0x5b1e72
imul ecx, dword [ebp - 8], 0x1000193
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x5b1e49
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x5b4090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7173f4
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x7b7fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x80b1f4
call fcn.0049bab0
push eax
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x80b1f4
call fcn.0059a680
mov ecx, eax
call fcn.00499a10
movzx eax, al
test eax, eax
je 0x5b40ec
mov eax, dword [ebp + 0xc]
jmp 0x5b418f
call fcn.005b1490
movzx ecx, al
test ecx, ecx
je 0x5b40ff
push 1
call fcn.00687048
push 0x20
call fcn.0065d3d0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x5b412d
push 0
push 0x400
mov ecx, dword [ebp - 0x10]
call fcn.00441410
mov dword [ebp - 0x14], eax
jmp 0x5b4134
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.005b0120
add esp, 0xc
push eax
lea ecx, [ebp - 0x38]
push ecx
mov ecx, 0x80b1f4
call fcn.005affe0
mov ecx, eax
call fcn.00499a70
mov edx, dword [eax + 4]
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004415a0
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00441610
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5b6df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x73d3e4
mov eax, dword [ebp - 8]
add eax, 0x255
push eax
call fcn.006822aa
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5b6e2d
mov ecx, dword [ebp - 4]
push ecx
call fcn.00682164
add esp, 4
mov al, 1
jmp 0x5b6eb5
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x364]
test eax, eax
je 0x5b6e3f
xor al, al
jmp 0x5b6eb5
push 0x73f868
mov ecx, dword [ebp - 8]
add ecx, 0x255
push ecx
call fcn.006822aa
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5b6e63
xor al, al
jmp 0x5b6eb5
mov edx, dword [ebp - 4]
push edx
push 1
push 4
push str.EPKD
call fcn.006824e0
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
push 1
push 4
push 0x73f174
call fcn.006824e0
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
push 1
push 4
mov edx, dword [ebp - 8]
add edx, 0x150
push edx
call fcn.006824e0
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00682164
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x5b83d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7b7fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x5b83f7
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3e]
test edx, edx
jne 0x5b83fe
mov al, 1
jmp 0x5b84d6
call fcn.005ba680
movzx eax, ax
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
movzx ecx, ax
push ecx
call fcn.005ba680
movzx edx, ax
push edx
call fcn.005ba6b0
add esp, 8
movzx eax, al
test eax, eax
je 0x5b8437
xor al, al
jmp 0x5b84d6
mov dword [ebp - 0x40], 0x20
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.005bbd40
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x5b8473
cmp dword [ebp - 0x30], 1
je 0x5b847a
cmp dword [ebp - 0x30], 3
je 0x5b84c9
jmp 0x5b84d4
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3e], 0
mov ecx, dword [ebp - 0x3c]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x5b84a9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.006824e0
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x5b84a9
xor al, al
jmp 0x5b84d6
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3e]
test edx, edx
jne 0x5b84bd
mov dword [ebp - 0x38], 1
jmp 0x5b84c4
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x5b84d6
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3e], 0
mov al, 1
jmp 0x5b84d6
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0065d40e
mov esp, ebp
pop ebp
ret
Function at 0x5bab60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x7b7fc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x2c], ecx
movzx eax, word [ebp + 8]
push eax
call fcn.005ba680
movzx ecx, ax
push ecx
call fcn.005ba6b0
add esp, 8
movzx edx, al
test edx, edx
je 0x5baba3
movzx eax, word [ebp + 8]
push eax
call fcn.005bab10
add esp, 4
jmp 0x5bad33
mov ecx, dword [ebp - 0x2c]
call fcn.005baf10
test eax, eax
je 0x5babe9
mov ecx, dword [ebp - 0x2c]
call fcn.005baf10
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.005ba690
cmp esi, eax
jae 0x5babe9
movzx ecx, word [ebp + 8]
push ecx
call fcn.005bb9a0
add esp, 4
mov si, ax
mov ecx, dword [ebp - 0x2c]
call fcn.005b8a80
mov word [eax], si
mov ax, word [ebp + 8]
jmp 0x5bad33
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x4c], 0
jne 0x5babfc
call fcn.005ba680
jmp 0x5bad33
mov ecx, dword [ebp - 0x2c]
call fcn.005b8ad0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x5bac50
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
movzx eax, word [ebp + 8]
push eax
call fcn.005bb9a0
add esp, 4
movzx ecx, ax
push ecx
call fcn.005b48e0
add esp, 8
movzx edx, al
test edx, edx
je 0x5bac3e
mov ax, word [ebp + 8]
mov word [ebp - 0x32], ax
jmp 0x5bac47
call fcn.005ba680
mov word [ebp - 0x32], ax
mov ax, word [ebp - 0x32]
jmp 0x5bad33
mov dword [ebp - 0x48], 0x20
movzx ecx, word [ebp + 8]
push ecx
call fcn.005bb9a0
add esp, 4
mov word [ebp - 0x30], ax
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x2e]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.00442e50
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x5bacac
cmp dword [ebp - 0x38], 1
je 0x5bacac
cmp dword [ebp - 0x38], 3
je 0x5bacfa
jmp 0x5bad2e
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x3c], ecx
je 0x5bacde
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.006824e0
add esp, 0x10
cmp dword [ebp - 0x3c], eax
je 0x5bacde
call fcn.005ba680
jmp 0x5bad33
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3e], 1
lea edx, [ebp - 0x30]
cmp dword [ebp - 0x44], edx
je 0x5bacf3
mov ax, word [ebp + 8]
jmp 0x5bad33
call fcn.005ba680
jmp 0x5bad33
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, word [ebp - 0x30]
push edx
call fcn.005b48e0
add esp, 8
movzx eax, al
test eax, eax
je 0x5bad1f
mov cx, word [ebp + 8]
mov word [ebp - 0x34], cx
jmp 0x5bad28
call fcn.005ba680
mov word [ebp - 0x34], ax
mov ax, word [ebp - 0x34]
jmp 0x5bad33
call fcn.005ba680
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0065d40e
mov esp, ebp
pop ebp
ret 4
Function at 0x5ef690
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.00681de0
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x1505
mov dword [ebp - 4], 0
jmp 0x5ef6be
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jae 0x5ef6e3
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
shl edx, 5
add edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
jmp 0x5ef6b5
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x601f40
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x71a540
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7b7fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CPhysicsObject.0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00489bd0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00489bd0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00489bd0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00489bd0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.006074f0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
call fcn.006074f0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x65cec0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.0069101c
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x65ceff
sub eax, 1
je 0x65cefa
sub eax, 1
je 0x65cef6
xor eax, eax
leave
ret
push 3
jmp 0x65cf01
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x65e79a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x65e7d9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x65e7d9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x65e7d9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x65e7d9
cmp dword [ecx + 0x74], 0xe
jbe 0x65e7d9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x66c770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x71f4ad
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x7b7fc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.006622a0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00441fd0
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00441fd0
add esp, 4
push eax
lea edx, [ebp - 0x20]
push edx
call fcn.0066d550
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00581080
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0066e6e0
mov dword [ebp - 0x24], 0x66c590
mov ecx, dword [ebp - 0x18]
add ecx, 4
push ecx
push 0
lea ecx, [ebp - 0x14]
call fcn.0048cbd0
push eax
mov edx, dword [ebp - 0x24]
push edx
push 0
push 0
call fcn.0068d18d
add esp, 0x18
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x66c829
lea ecx, [ebp - 0x14]
call fcn.005821d0
jmp 0x66c83a
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
push 6
call fcn.006479d6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0066e6e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0065d40e
mov esp, ebp
pop ebp
ret 8
Function at 0x66e1f0
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x71f66a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x7b7fc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
call fcn.0066e0c0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
add ecx, 8
call fcn.0066e0c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
add ecx, 0x10
call fcn.0066e150
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.0066e180
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x24]
add ecx, 0x5c
call fcn.004907d0
mov ecx, dword [ebp - 0x24]
add ecx, 0x64
call fcn.004907d0
mov ecx, dword [ebp - 0x24]
add ecx, 0x6c
call fcn.004907d0
mov ecx, dword [ebp - 0x24]
add ecx, 0x74
call fcn.004907d0
mov ecx, dword [ebp - 0x24]
add ecx, 0xa8
call fcn.00443a00
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x24]
add ecx, 0xe0
call fcn.0066df60
mov ecx, dword [ebp - 0x24]
add ecx, 0xe1
call fcn.0066df60
mov ecx, dword [ebp - 0x24]
add ecx, 0xe2
call fcn.0066df60
mov ecx, dword [ebp - 0x24]
add ecx, 0xe3
call fcn.0066df60
mov ecx, dword [ebp - 0x24]
add ecx, 0xe4
call fcn.0066df60
mov ecx, dword [ebp - 0x24]
add ecx, 0xe5
call fcn.0066df60
mov ecx, dword [ebp - 0x24]
add ecx, 0xe6
call fcn.0066df60
mov ecx, dword [ebp - 0x24]
add ecx, 0xe7
call fcn.0066df60
mov ecx, dword [ebp - 0x24]
add ecx, 0xec
call fcn.0066df40
mov ecx, dword [ebp - 0x24]
add ecx, 0x114
call fcn.004c9e20
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xd8], 0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0xdc], 0
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0xe0
call fcn.00445220
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0xe3
call fcn.00445220
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0xe4
call fcn.00445220
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0xe6
call fcn.00445220
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0xe7
call fcn.00445220
push 1
mov ecx, dword [ebp - 0x24]
add ecx, 0xe1
call fcn.00445220
mov edx, dword [ebp - 0x24]
mov byte [edx + 0xe8], 0
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0xe5
call fcn.00445220
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0xe2
call fcn.00445220
call fcn.004abc10
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x98], eax
call fcn.004abc10
mov edx, dword [ebp - 0x24]
mov dword [edx + 0xa0], eax
mov ecx, dword [ebp - 0x24]
call fcn.00671da0
mov eax, dword [ebp - 0x24]
mov byte [eax + 0xe9], 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.0066e1b0
push 0
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
add edx, 0x110
push edx
call fcn.00672310
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0065d40e
mov esp, ebp
pop ebp
ret
Function at 0x676810
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 1
push str.http:__www.google.com
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
jne 0x67683a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x67683a
mov dword [ebp - 4], 0
jmp 0x676841
mov dword [ebp - 4], 1
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x699e54
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00699b05

Function at 0x699e5f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00699c8f

Function at 0x6a56da
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006a522d

Function at 0x6bd8b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70cee0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x7b7fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov ebx, str.advapi32.dll
push 0x800
push eax
push ebx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x6bd922
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x6bd9aa
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x6bd9aa
push str.RegisterTraceGuidsW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.006bfa06
mov dword [esp], str.UnregisterTraceGuids
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.006bfa06
mov dword [esp], str.TraceEvent
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.006bfa06
mov dword [esp], str.GetTraceLoggerHandle
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.006bfa06
mov dword [esp], str.GetTraceEnableLevel
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.006bfa06
mov dword [esp], str.GetTraceEnableFlags
push edi
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.006bfa06
pop ecx
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6c0383
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret