joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66d348
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x66d498
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x348]
test eax, eax
je 0x66d470
cmp dword [eax + 0x3e8], 0
je 0x66d470
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2e8]
cmp eax, 0xc8
jbe 0x66d470
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2e8], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004835c4
mov eax, dword [ebp - 0xc]
call fcn.0040517c
dec eax
jne 0x66d3f0
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004835c4
mov eax, dword [ebp - 0x10]
call fcn.0040537c
push eax
mov eax, ebx
call fcn.0066df8c
push eax
push 0x18f
mov eax, dword [ebx + 0x348]
mov eax, dword [eax + 0x3e8]
call fcn.0048a000
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x66d423
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004835c4
mov eax, dword [ebp - 0x14]
call fcn.0040537c
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x348]
mov eax, dword [eax + 0x3e8]
call fcn.0048a000
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x66d470
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004835c4
mov edx, esi
mov eax, ebx
call fcn.0066df98
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004835c4
mov eax, dword [ebp - 4]
call fcn.0040517c
mov edx, eax
mov eax, ebx
call fcn.0066d628
mov eax, dword [ebp - 8]
call fcn.0040517c
push eax
mov eax, dword [ebp - 4]
call fcn.0040517c
pop edx
sub edx, eax
mov eax, ebx
call fcn.0066d644
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66d49f
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404ee0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ee0
ret
Function at 0x66d4a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040536c
xor eax, eax
push ebp
push 0x66d5c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x348]
test eax, eax
je 0x66d5af
cmp dword [eax + 0x3e8], 0
je 0x66d5af
cmp byte [ebx + 0x2f0], 0
je 0x66d530
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x2e8]
cmp eax, 0x1f4
jb 0x66d509
lea eax, [ebx + 0x2ec]
call fcn.00404ebc
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2e8], eax
lea eax, [ebx + 0x2ec]
mov edx, dword [ebp - 4]
call fcn.00405184
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x2ec]
call fcn.00404f54
mov eax, dword [ebp - 4]
call fcn.0040517c
test eax, eax
jle 0x66d59f
mov eax, dword [ebp - 4]
call fcn.0040517c
dec eax
jne 0x66d576
mov eax, dword [ebp - 4]
call fcn.0040537c
push eax
mov eax, ebx
call fcn.0066df8c
push eax
push 0x18f
mov eax, dword [ebx + 0x348]
mov eax, dword [eax + 0x3e8]
call fcn.0048a000
push eax
call sub.user32.dll_SendMessageA
jmp 0x66d5a2
mov eax, dword [ebp - 4]
call fcn.0040537c
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x348]
mov eax, dword [eax + 0x3e8]
call fcn.0048a000
push eax
call sub.user32.dll_SendMessageA
jmp 0x66d5a2
or eax, 0xffffffff
test eax, eax
jl 0x66d5af
mov edx, eax
mov eax, ebx
call fcn.0066df98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66d5cc
lea eax, [ebp - 4]
call fcn.00404ebc
ret
Function at 0x6866b4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x6866bc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x6868ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x6868c4
mov eax, esi
call fcn.00684540
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404f10
lea ecx, [ebp - 0x10]
mov edx, 0x6868d8
mov eax, esi
call fcn.00684540
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404f10
lea ecx, [ebp - 0x14]
mov edx, 0x6868f0
mov eax, esi
call fcn.00684540
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404f10
lea ecx, [ebp - 0x18]
mov edx, 0x68690c
mov eax, esi
call fcn.00684540
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404f10
lea ecx, [ebp - 0x1c]
mov edx, 0x686928
mov eax, esi
call fcn.00684540
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404f10
lea ecx, [ebp - 0x24]
mov edx, 0x686940
mov eax, esi
call fcn.00684540
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040a134
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040a850
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x686958
mov eax, esi
call fcn.00684540
mov eax, dword [ebp - 0x28]
call fcn.004c092c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x686968
mov eax, esi
call fcn.00684540
mov eax, dword [ebp - 0x2c]
call fcn.004c092c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x686980
mov eax, esi
call fcn.00684540
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040a850
inc eax
je 0x686851
lea ecx, [ebp - 0x34]
mov edx, 0x686980
mov eax, esi
call fcn.00684540
mov eax, dword [ebp - 0x34]
call fcn.0040a814
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040cbe0
fstp qword [ebp - 0x3c]
wait
call fcn.0040d054
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x68686c
lea ecx, [ebp - 0x40]
mov edx, 0x686980
mov eax, esi
call fcn.00684540
mov eax, dword [ebp - 0x40]
call fcn.004c092c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x686990
mov eax, esi
call fcn.00684540
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404f10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6868b5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404ee0
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404ee0
ret
Function at 0x68d640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x68d69a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0068d630
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004bf598
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004bf198
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68d6a1
lea eax, [ebp - 4]
call fcn.00404ebc
ret

Function at 0x693a5c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x693a8a
mov eax, ebx
call fcn.00694510
cmp dword [ebx + 0x40], 0
je 0x693a83
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x693afb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x693aed
cmp dword [ebx + 8], 0
je 0x693aac
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x693abe
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x693aed
cmp dword [ebx + 8], 0
je 0x693a9f
cmp eax, 3
je 0x693ad1
dec eax
jne 0x693a9f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x693a9f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x693a9f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x693b19
cmp dword [ebx + 0x14], 0xcc
je 0x693b19
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00693b24
pop ebx
ret

Function at 0x6a4a0c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040537c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x6a4a25
test al, 0x10
jne 0x6a4a29
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x6a9b50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6a9bb9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x7b1b04]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x6a9ba3
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.006a9b40
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6a64b0]
call fcn.006aaa08
mov dword [0x7b1b6c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a9bc0
lea eax, [ebp - 8]
call fcn.00406f7c
ret
Function at 0x6a9c58
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x6a9c6b
or esi, 2
test dl, dl
je 0x6a9c74
or esi, 0
jmp 0x6a9c77
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfo
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret

Function at 0x6aa894
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040536c
xor eax, eax
push ebp
push 0x6aa9ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x6a628c]
call fcn.0041bfe4
test eax, eax
jl 0x6aa8fb
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.006a9c3c
and eax, 0x7f
mov eax, dword [eax*4 + 0x7b1b04]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x6aa95e
mov eax, dword [ebx]
call fcn.0040517c
test eax, eax
jle 0x6aa95e
mov eax, dword [ebx]
call fcn.0040517c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x6aa922
mov eax, ebx
mov edx, 0x6aaa04
call fcn.00405184
mov eax, dword [ebx]
call fcn.0040517c
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.00406154
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.006a9b40
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x6aa9a9
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x6a9864
call fcn.0040745c
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040b894
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404f10
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x408fb8]
call fcn.0040eef8
call fcn.00404838
mov eax, dword [ebp - 8]
call fcn.006aa80c
mov ebx, eax
test edi, edi
je 0x6aa9be
mov eax, edi
call fcn.00403fa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aa9f3
lea eax, [ebp - 0x1c]
call fcn.00404ebc
lea eax, [ebp - 0x18]
call fcn.00406f7c
lea eax, [ebp - 0x14]
call fcn.00404ebc
lea eax, [ebp - 4]
call fcn.00404ebc
ret
Function at 0x6abac4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x6abadb
add esp, 0xfffffff0
call fcn.0040430c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0063973c
lea eax, [ebx + 0x360]
call fcn.00404ebc
xor eax, eax
mov dword [ebx + 0x36c], eax
xor edx, edx
mov eax, ebx
call fcn.0045d2ec
mov al, byte [0x6abbc8]
mov byte [ebx + 0x370], al
mov byte [ebx + 0x244], 1
mov byte [ebx + 0x372], 1
mov byte [ebx + 0x373], 0
xor eax, eax
mov dword [ebx + 0x374], eax
xor eax, eax
mov dword [ebx + 0x378], eax
mov byte [ebx + 0x37d], 0
mov byte [ebx + 0x37e], 1
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x6abbcc
call sub.shell32.dll_SHGetFileInfo
mov esi, eax
mov dword [ebx + 0x398], esi
push 0xffffffffffffffff
push esi
call sub.comctl32.dll_ImageList_SetBkColor
mov ecx, ebx
mov dl, 1
mov eax, dword [0x6a6788]
call fcn.006ab6f8
mov esi, eax
mov dword [ebx + 0x380], esi
mov al, byte [esi + 0x24]
or al, byte [0x6abbd0]
mov byte [esi + 0x24], al
lea eax, [ebx + 0x364]
mov edx, 0x6abbdc
call fcn.00404f10
mov byte [ebx + 0x371], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x6abbc0
call fcn.00404364
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6ac194
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ac2fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7b616c]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x7b616c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004a3214
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.0045c3fc
xor edx, edx
push ebp
push 0x6ac2e1
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x6ac251
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00406f7c
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x370]
call fcn.006aa254
push eax
mov eax, dword [0x7b5a74]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x6ac247
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004048e4
jmp 0x6ac2e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ac28d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.0045bfdc
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.006ac02c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x6ac269
push 0
mov edx, 0x6abfc4
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.0045bb94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ac2e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.0045c448
mov eax, dword [0x7b616c]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.004a3214
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ac305
lea eax, [ebp - 0x10]
call fcn.00406f7c
ret
Function at 0x6ad3b0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
test dl, dl
je 0x6ad3c7
add esp, 0xfffffff0
call fcn.0040430c
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00639e84
lea eax, [esi + 0x4b8]
mov edx, 0x6ad4c8
call fcn.00404f10
xor eax, eax
mov dword [esi + 0x478], eax
mov dl, 1
mov eax, esi
call fcn.00464a30
mov byte [esi + 0x47f], 1
mov al, byte [0x6ad4d0]
mov byte [esi + 0x481], al
mov byte [esi + 0x47c], 1
mov byte [esi + 0x47e], 1
mov byte [esi + 0x47d], 0
mov dl, 1
mov eax, dword [0x41dc64]
call fcn.00403f78
mov dword [esi + 0x498], eax
xor eax, eax
mov dword [esi + 0x49c], eax
mov byte [esi + 0x480], 0
mov byte [esi + 0x4b0], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x6ad4d4
call sub.shell32.dll_SHGetFileInfo
mov dword [esi + 0x488], eax
push 0x4000
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x6ad4d4
call sub.shell32.dll_SHGetFileInfo
mov dword [esi + 0x484], eax
lea eax, [esi + 0x474]
mov edx, 0x6ad4e0
call fcn.00404f10
xor edx, edx
mov eax, esi
call fcn.00464e50
mov eax, esi
test bl, bl
je 0x6ad4b8
call fcn.00404364
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6b2200
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x6b2217
add esp, 0xfffffff0
call fcn.0040430c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0066cfb4
xor eax, eax
mov dword [ebx + 0x44c], eax
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x6b22e0
call sub.shell32.dll_SHGetFileInfo
mov esi, eax
mov dword [ebx + 0x434], esi
lea eax, [ebx + 0x438]
push eax
lea eax, [ebx + 0x43c]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov byte [ebx + 0x45a], 0
mov al, byte [0x6b22e4]
mov byte [ebx + 0x458], al
lea eax, [ebx + 0x448]
mov edx, 0x6b22f0
call fcn.00404f10
mov byte [ebx + 0x459], 1
mov dl, 1
mov eax, dword [0x6a83ec]
call fcn.006b21b0
mov dword [ebx + 0x430], eax
push ebx
push 0x6b2410
mov eax, ebx
call fcn.0066da54
mov dword [ebx + 0x324], ebx
mov dword [ebx + 0x320], 0x6b22fc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x6b22d5
call fcn.00404364
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6bd944
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.0040343c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x6c48bc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040536c
mov eax, dword [ebp - 8]
call fcn.0040536c
xor eax, eax
push ebp
push 0x6c498d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1027]
xor ecx, ecx
mov edx, 0x1001
call fcn.0040343c
lea ebx, [ebp - 0x1027]
mov eax, dword [ebp - 4]
call fcn.0040537c
mov edx, eax
mov eax, ebx
call fcn.0040b1ac
lea eax, [ebp - 0x26]
xor ecx, ecx
mov edx, 0x1e
call fcn.0040343c
mov eax, esi
mov edx, dword [0x700c38]
call fcn.00404158
call fcn.0048a000
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], 2
lea eax, [ebp - 0x1027]
mov dword [ebp - 0x1e], eax
mov eax, dword [ebp - 8]
call fcn.0040537c
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperation
test eax, eax
je 0x6c4970
xor ebx, ebx
jmp 0x6c4972
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c4994
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ee0
ret

Function at 0x6c499c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x6c49a4
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6c4b11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7b5150]
mov byte [eax], 0x2d
mov eax, dword [0x7b53bc]
mov edx, 0x6c4b2c
call fcn.00404f10
xor eax, eax
push ebp
Function at 0x6c4bcc
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x49
push 0
push 0
dec ecx
jne 0x6c4bd4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040536c
xor eax, eax
push ebp
push 0x6c4dc8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x6c4de0
mov eax, dword [0x7b4f24]
push dword [eax]
push 0x6c4e14
push 0x6c4e68
lea eax, [ebp - 0x224]
call fcn.007a5d4c
push dword [ebp - 0x224]
push 0x6c4e8c
mov eax, dword [0x7b5770]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 7
call fcn.0040523c
lea eax, [ebp - 0x10b]
push eax
push 0x28
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x20a]
push eax
push 0
push 0x6c4e90
lea eax, [ebp - 0x10b]
push eax
call sub.kernel32.dll_GetTempFileNameA
lea eax, [ebp - 8]
lea edx, [ebp - 0x20a]
mov ecx, 0xff
call fcn.0040512c
mov eax, dword [ebp - 8]
call fcn.0040537c
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
xor eax, eax
push ebp
push 0x6c4d5f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x228]
mov eax, 0x6c4e9c
call fcn.004abfe4
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x220]
call fcn.004173a0
lea eax, [ebp - 0x23c]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x244], eax
mov byte [ebp - 0x240], 0xb
lea edx, [ebp - 0x244]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.0040b894
mov eax, dword [ebp - 0x23c]
push eax
lea eax, [ebp - 0x248]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x244], eax
mov byte [ebp - 0x240], 0xb
lea edx, [ebp - 0x244]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.0040b894
mov eax, dword [ebp - 0x248]
push eax
push 0x6c4eac
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.00412b7c
add esp, 0x14
lea eax, [ebp - 0x238]
call fcn.00413894
call fcn.004abf38
push 0
mov eax, dword [ebp - 4]
call fcn.0040537c
push eax
push esi
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6c4d6b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c4dcf
lea eax, [ebp - 0x248]
call fcn.00404ebc
lea eax, [ebp - 0x23c]
call fcn.00404ebc
lea eax, [ebp - 0x238]
call fcn.00412b74
lea eax, [ebp - 0x228]
call fcn.00406f7c
lea eax, [ebp - 0x224]
call fcn.00404ebc
lea eax, [ebp - 0x220]
call fcn.00412b74
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ee0
ret

Function at 0x6f33fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040536c
xor eax, eax
push ebp
push 0x6f345a
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040537c
push eax
push 0x6f3464
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xb8]
call fcn.0048a000
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f3461
lea eax, [ebp - 4]
call fcn.00404ebc
ret
Function at 0x6f3a94
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
lea eax, [esp + 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x6f3ad8
lea eax, [esp + 0x111]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.0040b3a4
add esp, 0x20c
pop ebx
ret