joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63c150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x63c1c3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x6812bc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x63c1ab
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0063c138
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x63b928]
call fcn.0063c8f8
mov dword [0x681320], eax
mov eax, dword [ebp - 4]
call fcn.0063c0e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63c1ca
lea eax, [ebp - 8]
call fcn.0040fe98
pop eax
jmp eax

Function at 0x63c1f4
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffd4c
mov esi, 0x4008
test cl, cl
je 0x63c207
or esi, 2
test dl, dl
je 0x63c210
or esi, 0
jmp 0x63c213
or esi, 1
push esi
push 0x2b4
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
add esp, 0x2b4
pop esi
ret
Function at 0x641514
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00430ce4
cmp eax, 2
je 0x641531
mov byte [ebp - 1], 1
jmp 0x64170d
mov byte [ebp - 1], 0
mov eax, 0x681bd0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x64170d
xor eax, eax
push ebp
push 0x641706
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x64159a
push 0x641718
push 0x641744
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417254
mov ebx, eax
test ebx, ebx
je 0x6415c1
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x6416ed
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x6416ed
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x641612
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x6415f3
call fcn.0040ac08
jmp 0x64170d
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x641612
call fcn.0040ac08
jmp 0x64170d
xor eax, eax
push ebp
push 0x6416e6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x641655
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x641655
call fcn.0040ac08
call fcn.0040ac08
jmp 0x64170d
mov eax, dword [ebp - 0x14]
call fcn.00407004
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x64168a
call fcn.0040ac08
call fcn.0040ac08
jmp 0x64170d
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x6416c5
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x6416c1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x6416c1
mov byte [ebp - 1], 1
jmp 0x6416c5
inc ebx
dec esi
jne 0x641697
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6416ed
mov eax, dword [ebp - 0x18]
call fcn.00407020
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64170d
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x641784
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6418b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00407540
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00429368
mov eax, dword [ebp - 0xc]
call fcn.0040bff0
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x64180e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x84000100
push 0
push 0
push 0x6418c8
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
test eax, eax
setne byte [ebp - 1]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x641818
cmp byte [ebp - 1], 0
jne 0x641887
lea edx, [ebp - 0x14]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x478]
call fcn.005516f4
mov eax, dword [ebp - 0x14]
mov edx, 0x641900
call fcn.0040c38c
je 0x641887
xor edx, edx
push ebp
push 0x64187d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x84000100
push 0
push 0
push 0x641910
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
test eax, eax
setne byte [ebp - 1]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x641887
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6418bc
lea eax, [ebp - 0x14]
call fcn.0040b458
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040b4b8
pop eax
jmp eax

Function at 0x641b28
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x641b87
xor eax, eax
push ebp
push 0x641b80
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x641b87
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
push 0x3e8
call sub.kernel32.dll_Sleep
movzx eax, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x6428a8
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x642a1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040b458
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x418]
mov eax, dword [0x682278]
mov eax, dword [eax]
call fcn.006112f8
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
call fcn.00429368
mov eax, dword [ebp - 0x414]
call fcn.0040bff0
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6429f5
xor eax, eax
push ebp
push 0x642961
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x84000100
push 0
push 0
mov eax, edi
call fcn.0040bff0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64297b
cmp dword [ebp - 0xc], 0
jne 0x64298c
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x6429f5
xor eax, eax
push ebp
push 0x6429d9
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x410]
lea eax, [ebp - 4]
mov ecx, dword [esi]
call fcn.0040b710
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040c1fc
cmp dword [esi], 0
jne 0x64299a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6429e3
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x642a24
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.0040b4b8
lea eax, [ebp - 4]
call fcn.0040b458
pop eax
jmp eax
Function at 0x643b40
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x643baa
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x643baa
lea eax, [esp + 0xc]
push eax
push 0x643bb0
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x643baa
push 0
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
ret

Function at 0x644248
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040b458
push esp
push 0
push 0
push esi
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x64427a
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c0a4
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x644284
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x644300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040b458
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x6442e5
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040c0a4
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.004312b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644307
lea eax, [ebp - 0x210]
call fcn.0040b458
pop eax
jmp eax
Function at 0x64724c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd70
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x270]
mov edx, dword [0x41f394]
call fcn.0040c7a0
xor eax, eax
push ebp
push 0x64753b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x278]
mov ecx, 0x647558
mov edx, dword [ebp - 0x274]
call fcn.0040c254
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.00428f54
test eax, eax
jne 0x6474cd
xor eax, eax
push ebp
push 0x6474f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x274]
call fcn.00429604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6474fa
invalid
Function at 0x64aac4
Capabilities:
Persist via active setup registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x64aacc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x64acf9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov dl, 1
mov eax, dword [0x515430]
call fcn.0051657c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0xf003f
test bl, bl
je 0x64ab24
lea eax, [ebp - 4]
mov edx, 0x64ad18
call fcn.0040b890
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516664
jmp 0x64ab3e
lea eax, [ebp - 4]
mov edx, 0x64ad4c
call fcn.0040b890
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00516664
lea edx, [ebp - 0x14]
mov al, 0x54
call fcn.0064430c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 0x64ad7c
call fcn.0040c254
cmp byte [0x68a220], 0
jne 0x64ab89
mov eax, 0x64adf4
call fcn.00641db8
test al, al
jne 0x64ab89
lea edx, [ebp - 0x18]
mov al, 0x54
call fcn.0064430c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 0x64ae18
call fcn.0040c254
xor eax, eax
push ebp
push 0x64abae
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.005167c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64abf6
lea edx, [ebp - 0x20]
mov al, 1
call fcn.0064430c
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00517120
push 0x64af1c
lea edx, [ebp - 0x28]
mov eax, 0x64af2c
call fcn.00645518
push dword [ebp - 0x28]
push 0x64af0c
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00407540
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00429368
push dword [ebp - 0x2c]
push 0x64af84
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.0040c2dc
mov ecx, dword [ebp - 0x24]
mov edx, 0x64af9c
mov eax, dword [ebp - 0x10]
call fcn.00517120
movzx eax, byte [0x64afb0]
push eax
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x38]
mov al, 2
call fcn.0064430c
mov eax, dword [ebp - 0x38]
mov ecx, 0x64afc0
mov edx, 0x64afd0
call fcn.004316b8
mov ecx, dword [ebp - 0x34]
mov edx, 0x64afe0
mov eax, dword [ebp - 0x10]
call fcn.00517120
mov eax, dword [ebp - 0x10]
call fcn.00409668
mov byte [ebp - 9], 1
push 0x64affc
push dword [ebp - 4]
push 0x64af0c
push dword [ebp - 8]
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.0040c2dc
mov edx, dword [ebp - 0x3c]
mov eax, 0x64b00c
call fcn.00647e14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64ad00
lea eax, [ebp - 0x3c]
mov edx, 0xb
call fcn.0040b4b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b4b8
pop eax
jmp eax
Function at 0x64fd18
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.0040b54c
mov eax, dword [ebp - 8]
call fcn.0040b54c
xor eax, eax
push ebp
push 0x64fe9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408280
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x44], esi
test bl, bl
je 0x64fd78
mov dword [ebp - 0x48], 0x540
jmp 0x64fd7f
mov dword [ebp - 0x48], 0x500
movzx eax, word [ebp + 0x14]
mov dword [ebp - 0x30], eax
cmp byte [ebp + 0xc], 0
je 0x64fd94
mov eax, 0x64feb0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.0040bff0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.0040bff0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x64fe4c
test bl, bl
je 0x64fe46
cmp byte [0x68a223], 0
jne 0x64fddc
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4f8]
call fcn.00551cfc
mov eax, dword [0x682278]
mov eax, dword [eax]
call fcn.0061056c
mov al, 1
call fcn.0064237c
mov eax, dword [0x682278]
mov eax, dword [eax]
call fcn.0061056c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x10], 0x103
jne 0x64fe21
mov eax, dword [0x682278]
mov eax, dword [eax]
cmp byte [eax + 0xbc], 0
je 0x64fde8
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x50]
call fcn.00427d98
mov edx, dword [ebp - 0x50]
mov eax, 0x68a260
call fcn.0040b848
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 9], 1
jmp 0x64fe5f
test bl, bl
je 0x64fe5f
mov eax, 0x68a260
mov edx, 0x64fec8
call fcn.0040b848
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4f8]
cmp byte [eax + 0x69], 0
je 0x64fe75
call fcn.00551cf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64fea1
lea eax, [ebp - 0x50]
call fcn.0040b458
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b4b8
pop eax
jmp eax
Function at 0x650d28
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x650e15
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, ebx
call fcn.00428a20
test al, al
jne 0x650daa
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x650e30
call fcn.0040c254
mov eax, dword [ebp - 4]
call fcn.0064422c
cmp byte [0x68a223], 0
jne 0x650da1
push 0x10
push 0x650e6c
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, 0x650e84
call fcn.00646d00
mov eax, dword [ebp - 8]
call fcn.0040bff0
push eax
mov eax, dword [0x682278]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x68a22a], 1
jmp 0x650df8
push 1
push 0
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0x650ebc
call fcn.0040c254
mov eax, dword [ebp - 0xc]
call fcn.0040bff0
push eax
push 0x650ef8
push 0x650f14
mov eax, dword [0x682278]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.shell32.dll_ShellExecuteW
cmp byte [0x68a222], 0
je 0x650df8
mov edx, ebx
mov eax, 0x650f2c
call fcn.00647e14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x650e1c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b4b8
pop eax
jmp eax
Function at 0x65763c
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b54c
xor eax, eax
push ebp
push 0x657708
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00642150
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040b890
xor eax, eax
push ebp
push 0x6576de
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004283f0
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6576a1
mov byte [ebp - 5], 0
jmp 0x6576d4
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetSystemTime
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6576e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65770f
lea eax, [ebp - 0x24]
call fcn.0040b458
lea eax, [ebp - 4]
call fcn.0040b458
pop eax
jmp eax
Function at 0x66d7cc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
mov edx, 0x66d868
call fcn.0040b848
xor edx, edx
push ebp
push 0x66d806
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetUserDefaultLangID
mov ebx, eax
call sub.kernel32.dll_GetSystemDefaultLangID
pop dword fs:[0]
add esp, 8
jmp 0x66d817
cmp bx, 0x409
jne 0x66d824
cmp ax, 0x409
je 0x66d857
cmp bx, 0x419
je 0x66d84b
cmp ax, 0x419
je 0x66d84b
cmp bx, 0x423
je 0x66d84b
cmp ax, 0x423
je 0x66d84b
cmp bx, 0x43f
je 0x66d84b
cmp ax, 0x43f
jne 0x66d857
mov eax, esi
mov edx, 0x66d880
call fcn.0040b848
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401eb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
mov edx, dword [esp + 8]
jne 0x401eca
test edx, edx
je 0x401eca
push 0x57
call fcn.00412210
xor eax, eax
ret
push esi
or eax, 0xffffffff
mov esi, edx
dec edx
test esi, esi
je 0x401ef8
push ebx
lea esi, [edx + 1]
xor ebx, ebx
mov bl, byte [ecx]
mov edx, eax
and edx, 0xff
shr eax, 8
xor edx, ebx
mov edx, dword [edx*4 + 0x44070c]
xor eax, edx
inc ecx
dec esi
jne 0x401ed9
pop ebx
not eax
pop esi
ret

Function at 0x4024d0
Capabilities:
Get disk size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esi], 0
push ecx
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x40250d
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x14]
mov dword [esi], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 4], 0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
push 0
push edx
call fcn.0040dfa0
mov dword [esi], eax
mov eax, edx
mov dword [esi + 4], edx
mov ecx, dword [esi]
mov edx, dword [esp + 4]
push eax
push ecx
push 0
push edx
call fcn.0040dfa0
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x402600
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
test edi, edi
jne 0x402629
push 0x57
call fcn.00412210
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
cmp byte [edi], 0
mov esi, edi
je 0x4026cb
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov al, byte [esi]
test al, al
je 0x402652
cmp al, 0x5c
je 0x402652
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x402646
mov eax, esi
sub eax, edi
add eax, 2
cmp eax, 0x105
jb 0x402665
mov eax, 0x105
push eax
push edi
lea eax, [esp + 0x18]
push eax
call fcn.00410250
cmp eax, 0x104
jae 0x40261c
push 0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x402690
cmp byte [esi], 0
je 0x4026cb
jmp 0x4026ba
call ebx
cmp eax, 0xb7
je 0x4026a2
cmp eax, 5
jne 0x40261c
lea edx, [esp + 0x10]
push edx
call ebp
cmp eax, 0xffffffff
je 0x40261c
test al, 0x10
je 0x40261c
cmp byte [esi], 0
je 0x4026cb
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x402640
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x108
ret
Function at 0x402e90
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
test eax, eax
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
je 0x402ebe
mov esi, dword [esp + 0x14]
push eax
push 0x41c
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x402edc
mov esi, dword [esp + 0x14]
push 0
push 0x41c
push esi
call ebx
push eax
call edi
push 0
push 0x41f
push esi
call ebx
push eax
call edi
mov eax, dword [ebp + 4]
test eax, eax
je 0x402efb
push eax
call fcn.0040e180
add esp, 4
push eax
push 0x41d
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x402f15
push 0
push 0x41d
push esi
call ebx
push eax
call edi
push 0
push 0x420
push esi
call ebx
push eax
call edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x402f2e
push eax
push 0x41b
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push 0x41b
push esi
call ebx
push eax
call edi
push 0
push 0x41e
push esi
call ebx
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
jne 0x40371d
xor eax, eax
pop ebp
ret
push ebx
mov ebx, dword [0x45b2b8]
test bl, 1
push esi
push edi
jne 0x40372f
test ebx, ebx
jne 0x403731
xor ebx, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test bl, 1
jne 0x403766
test ebx, ebx
je 0x403766
lea esi, [ebx + 0x10c]
push esi
call edi
cmp eax, 0xffffffff
je 0x403761
push esi
call fcn.004037c0
push eax
call fcn.004038b0
add esp, 8
test eax, eax
je 0x4037a3
mov ebx, dword [ebx + 4]
jmp 0x403737
mov ebx, dword [0x45d700]
test bl, 1
jne 0x403775
test ebx, ebx
jne 0x403777
xor ebx, ebx
test bl, 1
jne 0x4037aa
test ebx, ebx
je 0x4037aa
lea esi, [ebx + 8]
push esi
call edi
cmp eax, 0xffffffff
je 0x40379e
push esi
call fcn.004037c0
push eax
call fcn.004038b0
add esp, 8
test eax, eax
je 0x4037a3
mov ebx, dword [ebx + 4]
jmp 0x403777
xor ebp, ebp
call fcn.00403920
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
ret