joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d0690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc7e8
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x228]
call fcn.00403290
mov dword [ebp - 4], 0
mov word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.00524800
add esp, 0xc
push 0
push 0x10
lea ecx, [ebp - 0x224]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
je 0x5d074b
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x228]
call fcn.0040b1c0
lea edx, [ebp - 0x228]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x230]
or eax, 1
mov dword [ebp - 0x230], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00403270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret

Function at 0x5d07a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc81b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x228]
call fcn.00403290
mov dword [ebp - 4], 0
mov word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.00524800
add esp, 0xc
push 0
push 0x19
lea ecx, [ebp - 0x224]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
je 0x5d085b
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x228]
call fcn.0040b1c0
lea edx, [ebp - 0x228]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov eax, dword [ebp - 0x230]
or eax, 1
mov dword [ebp - 0x230], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00403270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret
Function at 0x5d4820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x5d4835
jmp 0x5d48f9
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1c], 0
jne 0x5d4856
jmp 0x5d48af
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x20], 0
jne 0x5d4877
jmp 0x5d48af
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x5d45f0
push 0
push 0
call fcn.005277fd
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x18], 0
jne 0x5d48a3
jmp 0x5d48af
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 1
jmp 0x5d48f9
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x1c], 0
je 0x5d48cf
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x20], 0
je 0x5d48ef
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 0
mov esp, ebp
pop ebp
ret
Function at 0x5d4970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0cec
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00524800
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x5d4a04
push 0x634fec
mov ecx, dword [ebp + 8]
call fcn.004092b0
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp + 8]
jmp 0x5d4b3c
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x228]
call fcn.004092b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.00403290
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str._x_
lea edx, [ebp - 0x224]
push edx
call fcn.00403240
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.00454f00
mov ecx, dword [ebp - 0x220]
add ecx, 1
mov dword [ebp - 0x220], ecx
lea ecx, [ebp - 0x228]
call fcn.00493020
push eax
call fcn.00466610
add esp, 4
test eax, eax
je 0x5d4aa0
cmp dword [ebp - 0x220], 0xa
jl 0x5d4a43
lea ecx, [ebp - 0x228]
call fcn.00493020
push eax
call fcn.0057a6d0
add esp, 4
test eax, eax
jne 0x5d4afa
push 0x634ffc
mov ecx, dword [ebp + 8]
call fcn.004092b0
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00403270
mov eax, dword [ebp + 8]
jmp 0x5d4b3c
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402050
mov ecx, dword [ebp - 0x22c]
or ecx, 1
mov dword [ebp - 0x22c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00403270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret 4
Function at 0x5d4b60
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2d17
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x284], ecx
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x10]
call fcn.00403290
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403290
mov byte [ebp - 4], 1
mov dword [ebp - 0x270], 0xffffffff
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ca60
lea ecx, [ebp - 0x10]
push ecx
call fcn.0057a000
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
push str._s.
lea eax, [ebp - 0x14]
push eax
call fcn.00403240
add esp, 0xc
lea ecx, [ebp - 0x26c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00493020
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xffffffff
jne 0x5d4c14
jmp 0x5d4d77
push 0x635354
lea edx, [ebp - 0x240]
push edx
call fcn.005236c0
add esp, 8
test eax, eax
je 0x5d4c44
push 0x635358
lea eax, [ebp - 0x240]
push eax
call fcn.005236c0
add esp, 8
test eax, eax
jne 0x5d4c49
jmp 0x5d4d54
mov ecx, dword [ebp - 0x26c]
and ecx, 0x10
je 0x5d4cc4
lea ecx, [ebp - 0x274]
call fcn.00403290
mov byte [ebp - 4], 2
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x10]
push eax
push str._s_s_
lea ecx, [ebp - 0x274]
push ecx
call fcn.00403240
add esp, 0x10
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x274]
push eax
mov ecx, dword [ebp - 0x284]
call fcn.005d4b60
test eax, eax
jne 0x5d4cb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x274]
call fcn.00403270
jmp 0x5d4d77
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x274]
call fcn.00403270
jmp 0x5d4d54
lea ecx, [ebp - 0x278]
call fcn.00403290
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x63536c
lea eax, [ebp - 0x278]
push eax
call fcn.00403240
add esp, 0x10
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x27c]
call fcn.004092b0
mov byte [ebp - 4], 4
push str.sencecfg.dat
lea ecx, [ebp - 0x27c]
call fcn.004031c0
test eax, eax
je 0x5d4d36
lea edx, [ebp - 0x278]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0045b9e0
mov ecx, eax
call fcn.0043d980
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x27c]
call fcn.00403270
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x278]
call fcn.00403270
lea ecx, [ebp - 0x26c]
push ecx
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5d4c14
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x270], 0xffffffff
je 0x5d4d8d
mov eax, dword [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x280], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403270
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret 8
Function at 0x5d54c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e448c
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x38]
call fcn.005d34d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00459740
push eax
lea ecx, [ebp - 0x20]
call fcn.0045b100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004da6a0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.004d5bb0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
jmp 0x5d5544
push 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x14]
call fcn.0045b250
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00403210
push eax
lea ecx, [ebp - 0x14]
call fcn.00519c20
movzx edx, al
test edx, edx
je 0x5d560c
push str.respath
lea ecx, [ebp - 0x14]
call fcn.004d4760
push eax
call fcn.0040b540
add esp, 8
movzx eax, al
test eax, eax
je 0x5d5583
jmp 0x5d5536
push 0x635154
mov ecx, dword [ebp + 0xc]
call fcn.0046ff60
push str.copyres
lea ecx, [ebp - 0x14]
call fcn.004d4760
push eax
call fcn.0040b540
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x5d55bc
push str.copyok
mov ecx, dword [ebp + 0xc]
call fcn.0046ff60
jmp 0x5d55cd
lea ecx, [ebp - 0x14]
call fcn.004d4760
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00454f40
lea ecx, [ebp - 0x14]
call fcn.004d4760
add eax, 4
mov ecx, eax
call fcn.0040ee60
movzx edx, al
test edx, edx
jne 0x5d5607
push 0x63517c
mov ecx, dword [ebp + 0xc]
call fcn.0046ff60
lea ecx, [ebp - 0x14]
call fcn.004d4760
add eax, 4
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00454f40
jmp 0x5d5536
lea ecx, [ebp - 0x3c]
call fcn.00403290
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
call fcn.0040ee60
movzx eax, al
test eax, eax
jne 0x5d5643
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0x635180
push str.___s:__s_
lea eax, [ebp - 0x3c]
push eax
call fcn.00403240
add esp, 0x10
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00454f40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.00403270
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0044c7f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.005d3450
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x5d5d70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e44dd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 8]
call fcn.0040ee60
movzx eax, al
test eax, eax
je 0x5d5dac
jmp 0x5d5ec6
push 0x6349ac
lea ecx, [ebp - 0x20]
call fcn.004092b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00577040
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00403270
cmp dword [ebp - 0x10], 0
jne 0x5d5ec6
push 1
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00493020
push eax
push 0x6349c8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cdq
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
cmp dword [0x67e1c8], 0
je 0x5d5ec6
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x18], 0
jl 0x5d5e37
jg 0x5d5e31
cmp dword [ebp - 0x1c], 0x20
jbe 0x5d5e37
mov byte [ebp - 0x31], 1
jmp 0x5d5e3b
mov byte [ebp - 0x31], 0
mov al, byte [ebp - 0x31]
mov byte [ebp - 0x25], al
mov dword [ebp - 0x24], 0xc0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x25]
push edx
push 0x634a38
mov ecx, dword [ebp + 8]
call fcn.00493020
push eax
push 0x634a1c
push 0x634a14
push str.KCommonPopMgr::HandleUrl
push 0x6349d8
lea eax, [ebp - 0x24]
push eax
push 0x6349d4
call fcn.00447600
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004476c0
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.00447680
mov ecx, eax
call fcn.004540b0
mov ecx, eax
call fcn.00447700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5d8780
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e6a09
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.9E17783B_FC0D_4152_BFB5_91D4F1C24A4CLieShow
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 0x254], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x5d87d9
xor eax, eax
jmp 0x5d88ae
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x28]
call fcn.004092b0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00493020
push eax
lea ecx, [ebp - 0x24]
call fcn.005d34d0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x34]
add edx, 0x24c
push edx
push str.poptype
lea ecx, [ebp - 0x24]
call fcn.005d2ed0
mov ecx, dword [ebp - 0x34]
add ecx, 0x24c
call fcn.0040ee60
movzx eax, al
test eax, eax
je 0x5d886c
push str.poptype_empty
mov ecx, dword [ebp - 0x34]
add ecx, 0x250
call fcn.0040b1c0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.005d3450
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403270
mov eax, dword [ebp - 0x2c]
jmp 0x5d88ae
mov ecx, dword [ebp + 8]
add ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0x248
call fcn.0040ca60
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x34]
call fcn.005be630
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.005d3450
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403270
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5db4a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x5db4be
xor eax, eax
jmp 0x5db5e2
call fcn.004793c0
mov ecx, eax
call fcn.00479540
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x3c], eax
push 0x630c48
lea ecx, [ebp - 4]
call fcn.004092b0
lea ecx, [ebp - 0x38]
call fcn.0059ce00
lea ecx, [ebp - 0x10]
call fcn.00479320
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.0057a250
add esp, 8
mov ecx, eax
call fcn.00493020
push eax
lea ecx, [ebp - 0x10]
call fcn.00479360
lea ecx, [ebp - 0x40]
call fcn.00403270
lea ecx, [ebp - 4]
call fcn.00493020
push eax
lea ecx, [ebp - 0x10]
call fcn.00479360
push 0
push 1
lea ecx, [ebp - 0x10]
call fcn.00479340
push eax
push str.krecommend_ctrl.dat
lea ecx, [ebp - 0x38]
call fcn.0059d880
lea ecx, [ebp - 4]
push ecx
call fcn.00478cc0
add esp, 4
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 0x404
call fcn.0047e890
add esp, 4
push 0
mov edx, dword [ebp + 8]
push edx
push 0
mov ecx, 0x67e160
call fcn.0047e6e0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0xc], 0
je 0x5db59b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.005db3e0
add esp, 8
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x38]
call fcn.0059cd40
call fcn.004793c0
mov ecx, eax
call fcn.004796c0
mov ecx, 0x67e160
call fcn.0047e350
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x685842
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x6858b3
cmp dword [esp + 8], edi
je 0x6858b3
mov eax, dword [esi + 8]
cmp eax, edi
je 0x68586e
push edi
push eax
call dword [0x100a6324]
test eax, eax
jne 0x68586e
push dword [esi + 8]
call dword [0x100a6378]
mov dword [esi + 8], edi
cmp dword [esi + 8], edi
jne 0x6858b3
push ebx
mov ebx, dword [esi]
push 0xc
call fcn.006db02c
cmp eax, edi
pop ecx
jne 0x685886
xor eax, eax
jmp 0x6858a4
mov ecx, dword [esp + 0xc]
push edi
push edi
push eax
push 0x100076e5
push edi
push edi
mov dword [eax], ebx
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
call fcn.006de661
add esp, 0x18
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [esi + 8], eax
pop ebx
mov eax, ecx
jmp 0x6858b5
xor eax, eax
pop edi
ret 4
Function at 0x68d933
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100a386e
call fcn.0071ff0c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
fld1
fstp qword [esi + 0x10]
mov dword [esi], 0x100ae29c
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x48], edi
mov eax, 0x100ae0d4
mov dword [esi + 0x44], eax
mov dword [esi + 0x54], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x5c], eax
mov dword [esi + 0x6c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov byte [ebp - 4], 2
mov dword [esi + 0x70], edi
call fcn.0069f28e
lea ecx, [esi + 0x78]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x7c], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x694cf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x694d0a
mov eax, dword [ebp - 4]
jmp 0x694de4
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x694dbf
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100b38e0]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100b38e0]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100b38e0]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100b38e0]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100b38e0]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100b38e0]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100b38e0]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100b38e0]
dec ebp
jne 0x694d29
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x694ddb
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x100b38e0]
dec ecx
jne 0x694dc9
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x694eb6
Capabilities:
Hash data with md5

Disassembly:
push esi
xor ecx, ecx
push 0x40
lea esi, [eax + 0x58]
push ecx
push esi
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
call fcn.006dbdb0
add esp, 0xc
mov byte [esi], 0x80
pop esi
ret

Function at 0x694fa0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
xor esi, esi
cmp dword [edi + 0x58], esi
jne 0x694fd0
push 0x98
call fcn.006db02c
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x694fc3
call fcn.00694eb6
mov eax, ebx
jmp 0x694fc5
xor eax, eax
cmp eax, esi
mov dword [edi + 0x58], eax
jne 0x694fd0
xor eax, eax
jmp 0x695046
push ebp
push 0x100b3ce4
push dword [esp + 0x14]
call fcn.006decf5
mov ebp, eax
cmp ebp, esi
pop ecx
pop ecx
jne 0x694feb
xor eax, eax
jmp 0x695045
cmp dword [edi + 0x5c], esi
mov ebx, 0xff
jne 0x694fff
push ebx
call fcn.006d92ca
pop ecx
mov dword [edi + 0x5c], eax
push ebp
push ebx
push 1
push dword [edi + 0x5c]
call fcn.006defa4
add esp, 0x10
cmp eax, esi
je 0x695030
push dword [edi + 0x5c]
mov esi, dword [edi + 0x58]
call fcn.006a2ace
push ebp
push ebx
push 1
push dword [edi + 0x5c]
call fcn.006defa4
add esp, 0x10
test eax, eax
jne 0x695012
push ebp
call fcn.006df031
mov eax, dword [edi + 0x58]
pop ecx
lea esi, [edi + 4]
push esi
call fcn.00694eee
mov eax, esi
pop ebp
pop esi
pop ebx
ret 4
Function at 0x69504b
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push esi
push 0x58
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.006dbdb0
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
lea esi, [esp + 0x18]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.006950ad
push dword [ebp + 8]
mov eax, esi
call fcn.00695143
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x69cfab
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x69cfc3
mov eax, dword [esp + 4]
add eax, ecx
xor byte [eax], 0x88
inc ecx
cmp ecx, dword [esp + 8]
jl 0x69cfb3
ret 8

Function at 0x6a32b4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push esi
push 0x40
xor esi, esi
lea eax, [ebp - 0x9c]
push esi
push eax
call fcn.006dbdb0
add esp, 0xc
push 0x58
lea eax, [ebp - 0x5c]
push esi
push eax
mov byte [ebp - 0x9c], 0x80
call fcn.006dbdb0
mov eax, dword [ebp + 0x10]
add esp, 0xc
push dword [ebp + 0xc]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], esi
lea esi, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
call fcn.006a2ace
push dword [ebp + 8]
lea eax, [ebp - 0x9c]
push eax
mov eax, esi
call fcn.006a2b65
pop esi
leave
ret