joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62c858
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x62ca0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea edx, [ebp - 0x258]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00599cf0
lea eax, [ebp - 0x258]
mov edx, 0x62ca24
call fcn.00408f18
mov eax, dword [ebp - 0x258]
call fcn.00408d1c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x62c9e5
lea eax, [ebp - 4]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00408dc0
mov eax, dword [ebp - 4]
test eax, eax
je 0x62c8ea
sub eax, 4
mov eax, dword [eax]
cmp eax, 9
jl 0x62c91f
lea eax, [ebp - 0x25c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00409140
mov eax, dword [ebp - 0x25c]
mov edx, 0x62ca48
call fcn.00421500
test eax, eax
sete al
jmp 0x62c921
xor eax, eax
test al, al
je 0x62c943
mov eax, 0x62ca54
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0xa]
cmp dx, 0xff
ja 0x62c93e
movzx edx, dx
bt dword [eax], edx
setb al
jmp 0x62c945
xor eax, eax
test al, al
je 0x62c967
mov eax, 0x62ca54
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0xc]
cmp dx, 0xff
ja 0x62c962
movzx edx, dx
bt dword [eax], edx
setb al
jmp 0x62c969
xor eax, eax
test al, al
je 0x62c98b
mov eax, 0x62ca54
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0xe]
cmp dx, 0xff
ja 0x62c986
movzx edx, dx
bt dword [eax], edx
setb al
jmp 0x62c98d
xor eax, eax
test al, al
je 0x62c9ca
mov eax, dword [ebp - 4]
cmp word [eax + 0x10], 0x2e
jne 0x62c9ca
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00409140
mov eax, dword [ebp - 0x260]
call fcn.004223d0
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x62c8cb
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62ca12
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.00407cb8
lea eax, [ebp - 4]
call fcn.00407c58
ret
Function at 0x62ed60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.0062ec28
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4a
mov eax, dword [0x66b0d0]
push eax
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, dword [edi]
xor edx, edx
mov dword [edi], edx
call fcn.004060a0
cmp ebx, 0x6c840001
jne 0x62edb4
call fcn.00427c94
mov eax, 0xffff0000
and eax, ebx
cmp eax, 0x6c830000
je 0x62edd8
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x62ee8c
call fcn.005f2f90
mov word [ebp - 6], bx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
call dword [ebp - 4]
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x62ee2e
mov ebx, eax
mov edx, 1
movzx eax, word [ebp - 6]
call fcn.0062ecb0
mov esi, eax
mov eax, esi
sub ax, 2
je 0x62ee2e
dec eax
sub ax, 2
jb 0x62ee42
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x62eeec
call fcn.005f2f90
push 0x4ff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x62ede3
mov edx, 2
movzx eax, word [ebp - 6]
call fcn.0062ecb0
movzx ebx, ax
mov edx, 3
movzx eax, word [ebp - 6]
call fcn.0062ecb0
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6311fc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0063128c
call fcn.00404b80
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
mov eax, ebx
call fcn.0063128c
push eax
push esi
call sub.kernel32.dll_VirtualProtect
mov edx, esi
mov eax, ebx
call fcn.00631238
mov eax, esi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x632cfc
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x632ece
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.00407de0
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x661c94]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00408d1c
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.0059b85c
test eax, eax
jne 0x632eb3
xor eax, eax
push ebp
push 0x632ea8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.005b6b00
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x632d8d
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x632dba
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00408210
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x632ddc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00408210
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x632e52
sub eax, 0xe9
je 0x632df6
sub eax, 0x19
je 0x632e91
jmp 0x632e4b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x632e0d
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x632e20
call fcn.00407448
jmp 0x632eb3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x632e37
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407de0
jmp 0x632d81
call fcn.00407448
jmp 0x632eb3
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.005b6b00
lea eax, [ebp - 4]
call fcn.00408210
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.00407de0
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.005c7ddc
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.005b4cac
inc ebx
jmp 0x632d81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x632eaf
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x632ed5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407cb8
ret
Function at 0x638eb4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x638f38
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x638f20
mov ebx, esi
test ebx, ebx
je 0x638ee6
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00408d1c
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x638f54
call fcn.00408f70
mov eax, dword [ebp - 8]
call fcn.00408d1c
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x638f22
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638f3f
lea eax, [ebp - 8]
call fcn.00407c58
ret

Function at 0x63ee30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x63ee39
mov eax, dword [ebp - 4]
add esp, 0xfffffffc
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
push 0x63ef04
push 0x63ef38
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040f500
mov ebx, eax
test ebx, ebx
je 0x63eef1
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x63eef1
test al, 0x10
je 0x63ee8e
mov dword [ebp - 4], 0x2000000
jmp 0x63ee93
xor eax, eax
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x63eef1
push 0
push 0x1000
lea eax, [ebp - 0x2008]
push eax
mov eax, dword [ebp - 8]
push eax
call ebx
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
jle 0x63eef1
cmp ebx, 0xff0
jge 0x63eef1
mov edx, edi
lea eax, [ebp - 0x2008]
call fcn.0063ed48
jmp 0x63eefa
mov eax, edi
mov edx, esi
call fcn.00408038
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x63ef54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x63efe5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW_1
mov ebx, eax
test ebx, ebx
jle 0x63efbb
cmp ebx, 0x104
jge 0x63efbb
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00408dc0
mov eax, dword [ebp - 0x20c]
mov edx, esi
call fcn.0063ee30
jmp 0x63efcc
mov eax, 0x63f000
call fcn.005f3144
mov eax, esi
call fcn.00407c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63efec
lea eax, [ebp - 0x20c]
call fcn.00407c58
ret
Function at 0x63f028
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63f177
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0063ee30
lea eax, [ebp - 8]
call fcn.0063ef54
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.004053f4
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x63f184
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.00408d1c
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.00408d1c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00408d1c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x63f0d3
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x4c7
jne 0x63f0c9
call fcn.00427c74
mov eax, 0x63f19c
call fcn.005f308c
cmp dword [ebp - 0x10], 0
jne 0x63f0e3
mov eax, 0x63f1c8
call fcn.005f2f38
xor edx, edx
push ebp
push 0x63f155
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0063eb20
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x63f0f1
cmp eax, 0xffffffff
jne 0x63f11e
mov eax, 0x63f21c
call fcn.005f308c
call fcn.0063eb20
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x63f13e
mov eax, 0x63f25c
call fcn.005f308c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63f15c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x63f284
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x63f353
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x63e8f4]
call fcn.0063f37c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x63f32c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x63f36c
call fcn.0042365c
mov edx, dword [ebp - 8]
mov eax, dword [0x6624a0]
mov eax, dword [eax]
call fcn.0058eec0
call fcn.0063eb20
call sub.user32.dll_GetFocus
mov edx, dword [0x6624a0]
mov edx, dword [edx]
cmp eax, dword [edx + 0x178]
jne 0x63f30f
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x63f316
call sub.user32.dll_WaitMessage
jmp 0x63f2e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63f333
mov eax, dword [ebp - 4]
call fcn.004060a0
ret
Function at 0x6455dc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6455e4
push ecx
push ebx
xor eax, eax
push ebp
push 0x64572e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005f3734
mov edx, dword [ebp - 0x10]
mov eax, 0x66b1a4
call fcn.00408038
lea eax, [ebp - 0x14]
mov ecx, dword [0x66b1a4]
mov edx, 0x645748
call fcn.00408f70
mov eax, dword [ebp - 0x14]
call fcn.006028c8
mov eax, dword [0x6625ac]
cmp byte [eax], 0
je 0x64563f
mov eax, dword [0x66b1a4]
call fcn.00601fd8
lea edx, [ebp - 0x18]
mov eax, dword [0x66b1a4]
call fcn.00599cf0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x645790
call fcn.00408f70
push 0
mov eax, dword [ebp - 4]
call fcn.00408d1c
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x6456d5
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x3b
call fcn.005a1474
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0042218c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.0059c40c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x70
call fcn.005a1444
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41d324]
call fcn.00427ca0
call fcn.00407354
lea eax, [ebp - 8]
call fcn.0061bbb8
cmp dword [ebp - 8], 0
je 0x645706
lea eax, [ebp - 0xc]
mov ecx, 0x6457ac
mov edx, dword [ebp - 4]
call fcn.00408f70
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00645584
mov eax, dword [ebp - 0xc]
call fcn.0061bc14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x645735
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00407cb8
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00407cb8
ret

Function at 0x648218
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov byte [0x66b499], 1
call fcn.005f5584
test al, al
jne 0x64826d
push 5
mov eax, dword [0x6624a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x178]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x6624a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x178]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x6624b4]
mov eax, dword [eax + 0x138]
mov cl, 2
xor edx, edx
call fcn.00647fb8
pop ebp
ret

Function at 0x64bba8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x64bbcd
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x64da2c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x64da5b
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jae 0x64da64
call fcn.0064c710
mov eax, 0xa
call fcn.0059c830
call fcn.0064c710
call fcn.0064d9f8
test al, al
jne 0x64da39
pop ebx
pop ebp
ret

Function at 0x64df9c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, dword [0x661ef8]
cmp dword [eax], 0
je 0x64e04e
mov eax, dword [0x661ef8]
mov eax, dword [eax]
call fcn.004fa0cc
test al, al
je 0x64e04e
mov eax, dword [0x661ef8]
mov eax, dword [eax]
cmp byte [eax + 0x1fd], 0
je 0x64dff4
cmp byte [ebx + 0x3b1], 0
jne 0x64dff4
mov eax, dword [0x6624a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x178]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x64dff8
xor eax, eax
jmp 0x64dffa
mov al, 1
mov ebx, eax
mov eax, dword [0x661ef8]
mov eax, dword [eax]
call fcn.004f9d18
mov edx, 0xfffffff0
push edx
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x64e04e
test bl, bl
je 0x64e03a
push 5
mov eax, dword [0x661ef8]
mov eax, dword [eax]
call fcn.004f9d18
push eax
call sub.user32.dll_ShowWindow
jmp 0x64e04e
push 0
mov eax, dword [0x661ef8]
mov eax, dword [eax]
call fcn.004f9d18
push eax
call sub.user32.dll_ShowWindow
pop ebx
pop ebp
ret
Function at 0x64e108
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov byte [0x66b451], 0
push 0x64e290
call sub.kernel32.dll_GetModuleHandleW_2
mov ebx, eax
push 0x64e2ac
push ebx
call fcn.0040f500
mov esi, eax
test esi, esi
je 0x64e1b0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x64e1b0
cmp word [ebp - 2], 0
je 0x64e1b0
mov byte [0x66b451], 1
movzx eax, word [ebp - 4]
sub ax, 0x14c
je 0x64e174
sub ax, 0xb4
je 0x64e180
sub ax, 0x8464
je 0x64e18c
sub ax, 0x2400
je 0x64e198
jmp 0x64e1a4
mov byte [0x661d29], 1
jmp 0x64e247
mov byte [0x661d29], 3
jmp 0x64e247
mov byte [0x661d29], 2
jmp 0x64e247
mov byte [0x661d29], 4
jmp 0x64e247
mov byte [0x661d29], 0
jmp 0x64e247
push 0x64e2cc
push ebx
call fcn.0040f500
test eax, eax
je 0x64e1f5
lea edx, [ebp - 0x2c]
push edx
call eax
push 0x64e2f4
push ebx
call fcn.0040f500
mov esi, eax
test esi, esi
je 0x64e1fe
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x64e1fe
cmp dword [ebp - 8], 0
je 0x64e1fe
mov byte [0x66b451], 1
jmp 0x64e1fe
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
movzx eax, word [ebp - 0x2c]
sub ax, 1
jb 0x64e21c
sub ax, 5
je 0x64e225
sub ax, 3
je 0x64e22e
sub ax, 3
je 0x64e237
jmp 0x64e240
mov byte [0x661d29], 1
jmp 0x64e247
mov byte [0x661d29], 3
jmp 0x64e247
mov byte [0x661d29], 2
jmp 0x64e247
mov byte [0x661d29], 4
jmp 0x64e247
mov byte [0x661d29], 0
cmp byte [0x66b451], 0
je 0x64e288
call fcn.005f2174
test al, al
je 0x64e281
push 0x64e314
push ebx
call fcn.0040f500
test eax, eax
je 0x64e281
push 0x64e348
push 0x64e368
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040f500
test eax, eax
jne 0x64e288
mov byte [0x66b451], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x64e384
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x64e3f4
mov edx, 0x80000002
xor eax, eax
call fcn.0059b85c
test eax, eax
jne 0x64e3ed
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x64e448
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x64e3e4
cmp dword [ebp - 0xc], 4
jne 0x64e3e4
cmp dword [ebp - 8], 4
jne 0x64e3e4
movzx eax, word [ebp - 0x10]
mov word [0x66b468], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret
Function at 0x64e5f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x64e6ad
movzx eax, byte [ebp - 0x110]
shl eax, 0x18
movzx edx, byte [ebp - 0x10c]
shl edx, 0x10
or eax, edx
movzx edx, word [ebp - 0x108]
or eax, edx
mov dword [0x66b464], eax
cmp byte [0x66b450], 0
je 0x64e6ad
mov eax, dword [ebp - 0x110]
cmp eax, 5
jb 0x64e69e
mov dword [ebp - 0x230], 0x11c
lea eax, [ebp - 0x230]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x64e6ad
movzx eax, byte [ebp - 0x11c]
shl eax, 8
movzx edx, byte [ebp - 0x11a]
or ax, dx
mov word [0x66b468], ax
movzx eax, byte [ebp - 0x116]
mov byte [0x66b46a], al
movzx eax, word [ebp - 0x118]
mov word [0x66b46c], ax
jmp 0x64e6ad
cmp eax, 4
jne 0x64e6ad
call fcn.0064e384
call fcn.0064e460
mov esp, ebp
pop ebp
ret

Function at 0x64f604
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x64f6ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x64f6c8
push ebx
push 0x64f6d8
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00408ff8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004053f4
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00408d1c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x64f68a
mov eax, dword [0x6624b4]
mov eax, dword [eax + 0x1c8]
call fcn.0064f55c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64f6b3
lea eax, [ebp - 4]
call fcn.00407c58
ret