joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5aaea0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x98
call fcn.00442cc0
mov eax, dword [0x7030b8]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xa0]
mov dword [esp + 4], edi
mov eax, dword [ecx]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x80], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x84], eax
mov dword [esp + 0x58], 0x61707865
mov dword [esp + 0x5c], 0x3320646e
mov eax, dword [ecx]
mov dword [esp + 0x88], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x8c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x90], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x60], 0x79622d32
mov dword [esp + 0x64], 0x6b206574
test eax, eax
je 0x5ab09d
push ebx
mov ebx, dword [esp + 0xa8]
push ebp
push esi
nop
mov esi, 0x40
cmp eax, esi
cmovb esi, eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], esi
push eax
call fcn.005ab0c0
add esp, 8
xor eax, eax
test esi, esi
je 0x5ab06c
cmp esi, 0x20
jb 0x5ab044
lea edx, [edi - 1]
lea ecx, [esp + esi + 0x23]
add edx, esi
cmp edi, ecx
ja 0x5aafbc
lea ecx, [esp + 0x24]
cmp edx, ecx
jae 0x5ab044
lea ecx, [ebx - 1]
add ecx, esi
cmp edi, ecx
ja 0x5aafc9
cmp edx, ebx
jae 0x5ab044
mov ebp, esi
lea edx, [edi + 0x10]
lea esi, [esp + 0x24]
mov ecx, ebx
sub ecx, esi
and ebp, 0xffffffe0
mov dword [esp + 0x14], ecx
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, ebx
mov ebx, dword [esp + 0x14]
sub ecx, edi
mov esi, dword [esp + 0x18]
mov edi, ecx
mov dword [esp + 0x1c], ecx
nop word [eax + eax]
movups xmm0, xmmword [esp + eax + 0x24]
lea ecx, [ebx + eax]
movups xmm1, xmmword [esp + ecx + 0x24]
lea ecx, [esi + eax]
lea edx, [edx + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x34]
add eax, 0x20
movups xmmword [esp + ecx + 0x24], xmm1
movups xmm1, xmmword [edi + edx - 0x20]
pxor xmm1, xmm0
movups xmmword [edx - 0x20], xmm1
cmp eax, ebp
jb 0x5ab000
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0xb0]
cmp eax, esi
jae 0x5ab06c
lea ecx, [esp + 0x24]
mov ebp, edi
sub ebx, ecx
sub ebp, ecx
lea edx, [esp + 0x24]
add edx, eax
inc eax
mov cl, byte [ebx + edx]
xor cl, byte [edx]
mov byte [edx + ebp], cl
cmp eax, esi
jb 0x5ab052
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
add edi, esi
inc dword [esp + 0x94]
sub eax, esi
add ebx, esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], eax
test eax, eax
jne 0x5aaf70
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
pop edi
xor ecx, esp
call fcn.004421e5
add esp, 0x98
ret
Function at 0x5ada00
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x5ada14
mov dword [esp + 0x18], fcn.005ac1e0
jmp fcn.0059d970
mov dword [esp + 0x18], fcn.005ab480
jmp fcn.0059d6b0
Function at 0x60b420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx - 4]
jle 0x60b48a
mov ecx, dword [ebp + 8]
sub ecx, ebx
push esi
mov dword [ebp + 8], ecx
push edi
nop word [eax + eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [ebp + 8]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
sub dword [ebp + 0x10], 1
mov dword [ebx - 4], eax
jne 0x60b440
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x60b490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jle 0x60b503
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub ecx, eax
sub dword [ebp + 0x14], eax
push ebx
push esi
mov dword [ebp + 0xc], ecx
push edi
nop word [eax + eax]
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [ebp + 0x14]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
sub dword [ebp + 0x10], 1
mov dword [ecx + eax - 4], edi
mov ecx, dword [ebp + 0xc]
jne 0x60b4b0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x60bd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
lea eax, [ebx + eax*4]
mov edi, eax
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x60bd74
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [ebx]
lea esi, [esi + 2]
mov ecx, edx
lea ebx, [ebx + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xd
xor cl, al
mov eax, edx
and cl, 7
shr eax, 0x10
xor cl, al
mov eax, edx
mov byte [esi - 2], cl
mov ecx, edx
shr ecx, 5
shr eax, 3
xor cl, al
shr edx, 5
mov eax, dword [ebp + 8]
and cl, 0x1f
xor cl, dl
inc eax
mov byte [esi - 1], cl
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x60bd30
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x60bd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x60bdeb
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x60bdb0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x62b0e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x62b0fc
mov eax, dword [ebp - 4]
jmp 0x62b0ff
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x62b7a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
call fcn.0041c260
add esp, 4
mov byte [ebp - 1], al
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x62b970
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x62b9a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x62b9a0
xor al, al
jmp 0x62b9bd
xor edx, edx
mov eax, dword [ebp - 0xc]
mov cl, 0x20
call fcn.00442cf0
xor ecx, ecx
add eax, dword [ebp - 4]
adc edx, ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x62c400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0xc]
call fcn.00419790
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x62c452
cmp dword [ebp - 8], 0xea
je 0x62c452
mov eax, dword [ebp - 8]
jmp 0x62c497
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0041c670
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0062c3c0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x62c486
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0041c8e0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x62cb80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call fcn.004a1e6f
add esp, 0x18
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.0062cc40
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x62e450
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64b168
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x7030b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
call fcn.0041f750
mov ecx, eax
call fcn.00446e37
push eax
lea ecx, [ebp - 0x28]
call fcn.0041d600
mov dword [ebp - 4], 0
push 0x6d9118
lea ecx, [ebp - 0x28]
call fcn.0041d4e0
lea ecx, [ebp - 0x28]
call fcn.0041d4a0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x62e4d3
push 0
push 0
push 0
push 0x6d9130
lea ecx, [ebp - 0x28]
call fcn.0041d4a0
push eax
call fcn.0044c5e6
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041d5b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004421e5
mov esp, ebp
pop ebp
ret

Function at 0x62e530
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64b1a3
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x7030b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], ecx
push 0x6d9098
lea ecx, [ebp - 0x230]
call fcn.0041d600
mov dword [ebp - 4], 0
push 0x6d909c
lea ecx, [ebp - 0x248]
call fcn.0041d600
mov byte [ebp - 4], 1
call fcn.0041f750
mov ecx, eax
call fcn.00446e37
push eax
lea ecx, [ebp - 0x248]
call fcn.0041d520
push 0x6d90a0
lea ecx, [ebp - 0x248]
call fcn.0041d4e0
lea ecx, [ebp - 0x248]
call fcn.0041d4a0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x62e66c
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004a08c0
add esp, 0xc
push str.7c4585
push 0x6d90cc
lea edx, [ebp - 0x218]
push edx
call fcn.00420b30
add esp, 0xc
push 0x6d90d4
lea ecx, [ebp - 0x230]
call fcn.0041d520
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
call fcn.0041d500
push 0x6d90d8
lea ecx, [ebp - 0x230]
call fcn.0041d4e0
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
call fcn.0041d4e0
push 0
push 0x1388
push 1
push 0x6d90e0
lea ecx, [ebp - 0x230]
call fcn.0041d4a0
push eax
call fcn.0044c5e6
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.0041d5b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0041d5b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004421e5
mov esp, ebp
pop ebp
ret
Function at 0x630270
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x7030b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x418], 0
lea eax, [ebp - 0x418]
push eax
push 0x20019
push 0
push 0x6dc948
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x6302c7
xor eax, eax
jmp 0x6303e9
xor ecx, ecx
mov word [ebp - 0x414], cx
push 0x206
push 0
lea edx, [ebp - 0x412]
push edx
call fcn.004a08c0
add esp, 0xc
mov dword [ebp - 0x420], 0x104
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x424]
push edx
push 0
push 0x6dc9cc
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x414]
push ecx
call fcn.0044a2be
add esp, 4
movzx edx, al
test edx, edx
jne 0x6303c4
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov word [ebp - 0x20c], cx
push 0x206
push 0
lea edx, [ebp - 0x20a]
push edx
call fcn.004a08c0
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_Exploreriexplore.exe
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004a6224
add esp, 8
lea edx, [ebp - 0x20c]
push edx
call fcn.0044a2be
add esp, 4
movzx eax, al
test eax, eax
jne 0x6303aa
xor eax, eax
jmp 0x6303e9
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004a53e9
add esp, 8
mov eax, 1
jmp 0x6303e9
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a53e9
add esp, 8
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004421e5
mov esp, ebp
pop ebp
ret 4
Function at 0x630400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x7030b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x430], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004a08c0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x414], dx
push 0x206
push 0
lea eax, [ebp - 0x412]
push eax
call fcn.004a08c0
add esp, 0xc
mov dword [ebp - 0x448], 0x104
mov dword [ebp - 0x44c], 1
lea ecx, [ebp - 0x42c]
push ecx
push 0x20019
push 0
push 0x6dc85c
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x6304e5
xor eax, eax
jmp 0x630650
lea edx, [ebp - 0x424]
push edx
push 0x20019
push 0
push 0x6dc8f0
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x63051b
xor eax, eax
jmp 0x630650
lea ecx, [ebp - 0x428]
push ecx
push 0x20019
push 0
push str.opencommand
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x630551
xor eax, eax
jmp 0x630650
mov dword [ebp - 0x430], 0x104
mov dword [ebp - 0x434], 1
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x434]
push edx
push 0
push 0x6dc900
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
call fcn.004ab5bc
add esp, 4
mov dword [ebp - 0x420], eax
push 0x6dc8fc
mov ecx, dword [ebp - 0x420]
push ecx
call fcn.0041c4c0
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x6305e4
xor eax, eax
jmp 0x630650
mov edx, dword [ebp - 0x41c]
add edx, 2
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x438], eax
push 0x6dc910
mov ecx, dword [ebp - 0x420]
push ecx
call fcn.0041c4c0
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x630626
xor eax, eax
jmp 0x630650
xor edx, edx
mov eax, dword [ebp - 0x41c]
mov word [eax], dx
mov ecx, dword [ebp - 0x438]
push ecx
call fcn.0044a2be
add esp, 4
movzx edx, al
test edx, edx
jne 0x63064b
xor eax, eax
jmp 0x630650
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004421e5
mov esp, ebp
pop ebp
ret
Function at 0x630700
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fa8
call fcn.00442cc0
mov eax, dword [0x7030b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1fa8], ecx
xor eax, eax
mov word [ebp - 0x804], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x802]
push ecx
call fcn.004a08c0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x1004], dx
push 0x7fe
push 0
lea eax, [ebp - 0x1002]
push eax
call fcn.004a08c0
add esp, 0xc
push 0x7d0
lea ecx, [ebp - 0x1fa4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
push 0x6dc854
call fcn.004a1f02
add esp, 4
lea edx, [ebp + eax*2 - 0x1fa4]
push edx
call fcn.004a53e9
add esp, 8
lea eax, [ebp - 0x1fa4]
push eax
lea ecx, [ebp - 0x1004]
push ecx
call fcn.004a53e9
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x804]
push eax
call fcn.004a53e9
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1fa4]
push edx
call fcn.004a6224
add esp, 8
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x63080a
push 0
push 0
push 0
lea ecx, [ebp - 0x804]
push ecx
lea edx, [ebp - 0x1004]
push edx
call fcn.0044c5e6
add esp, 0x14
mov eax, 1
jmp 0x63080f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004421e5
mov esp, ebp
pop ebp
ret 4
Function at 0x635d70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x7030b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], ecx
xor eax, eax
mov word [ebp - 0x414], ax
push 0x206
push 0
lea ecx, [ebp - 0x412]
push ecx
call fcn.004a08c0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.004a08c0
add esp, 0xc
mov dword [ebp - 0x428], 0
lea ecx, [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x420]
mov ecx, dword [edx + 0x28]
call fcn.00422430
jmp 0x635dfc
push 0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x424]
call fcn.0042a0a0
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 0x420]
mov ecx, dword [edx + 0x28]
call fcn.00421d90
push eax
lea ecx, [ebp - 0x424]
call fcn.00421cb0
movzx eax, al
test eax, eax
je 0x635f93
lea ecx, [ebp - 0x424]
call fcn.00421e90
mov ecx, dword [eax + 4]
mov dword [ebp - 0x41c], ecx
mov edx, dword [ebp - 0x41c]
add edx, 0xc
push edx
call fcn.004a1f02
add esp, 4
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jle 0x635f8e
mov eax, dword [ebp - 0x41c]
add eax, 0xc
push eax
push 0x6e0c74
lea ecx, [ebp - 0x414]
push ecx
call fcn.00420b30
add esp, 0xc
mov ecx, dword [ebp - 0x420]
add ecx, 0x90
call fcn.0041d4a0
push eax
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x6e0c80
lea eax, [ebp - 0x414]
push eax
push 0x6e0c5c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x6e0c6c
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004a1ba7
add esp, 8
test eax, eax
je 0x635efe
lea edx, [ebp - 0x20c]
push edx
call fcn.004a610f
add esp, 4
mov byte [ebp - 0x415], al
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x42c], ecx
mov edx, dword [ebp - 0x42c]
mov al, byte [ebp - 0x415]
mov byte [edx], al
mov ecx, dword [ebp - 0x41c]
add ecx, 0xc
push ecx
push 0x6e0ca8
lea edx, [ebp - 0x414]
push edx
call fcn.00420b30
add esp, 0xc
mov ecx, dword [ebp - 0x420]
add ecx, 0x90
call fcn.0041d4a0
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.nothing
lea ecx, [ebp - 0x414]
push ecx
push 0x6e0c88
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x6e0c98
lea edx, [ebp - 0x20c]
push edx
call fcn.004a1ba7
add esp, 8
test eax, eax
je 0x635f8e
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x430], ecx
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x430]
push eax
call fcn.004a53e9
add esp, 8
jmp 0x635de8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004421e5
mov esp, ebp
pop ebp
ret
Function at 0x6388b0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x7030b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
mov eax, dword [ebp - 0x418]
cmp dword [eax + 4], 0
jne 0x6388da
jmp 0x638b2a
lea ecx, [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x418]
mov ecx, dword [edx + 0x28]
call fcn.00422430
jmp 0x638905
push 0
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x424]
call fcn.0042a0a0
lea ecx, [ebp - 0x434]
push ecx
mov edx, dword [ebp - 0x418]
mov ecx, dword [edx + 0x28]
call fcn.00421d90
push eax
lea ecx, [ebp - 0x424]
call fcn.00421cb0
movzx eax, al
test eax, eax
je 0x638a62
lea ecx, [ebp - 0x424]
call fcn.00421e90
mov ecx, dword [eax + 4]
mov dword [ebp - 0x420], ecx
mov edx, dword [ebp - 0x420]
mov eax, dword [edx + 4]
mov dword [ebp - 0x428], eax
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x42c], edx
mov eax, dword [ebp - 0x428]
mov cl, byte [eax]
mov byte [ebp - 0x419], cl
movzx edx, byte [ebp - 0x419]
test edx, edx
je 0x638997
push 0x6e0cd0
push 0x6e0cd4
lea eax, [ebp - 0x20c]
push eax
call fcn.00420b30
add esp, 0xc
jmp 0x6389b0
push 0x6e0cc4
push 0x6e0cc8
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00420b30
add esp, 0xc
mov edx, dword [ebp - 0x420]
add edx, 0xc
push edx
push str.Is_s
lea eax, [ebp - 0x414]
push eax
call fcn.00420b30
add esp, 0xc
mov ecx, dword [ebp - 0x418]
add ecx, 0x90
call fcn.0041d4a0
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
push 0x6e0cfc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 0x420]
add eax, 0xc
push eax
push str.Use_s
lea ecx, [ebp - 0x414]
push ecx
call fcn.00420b30
add esp, 0xc
mov edx, dword [ebp - 0x42c]
push edx
push 0x6e0ce8
lea eax, [ebp - 0x20c]
push eax
call fcn.00420b30
add esp, 0xc
mov ecx, dword [ebp - 0x418]
add ecx, 0x90
call fcn.0041d4a0
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
push str.HotKey
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x6388f1
mov ecx, dword [ebp - 0x418]
add ecx, 0xc0
call fcn.0041d4a0
push eax
push 0x6e0d4c
push str.ModifyHotKey
push 0x6e0d28
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x418]
add ecx, 0xc0
call fcn.0041d4a0
push eax
push 0x6e0d68
push 0x6e0d6c
push 0x6e0d50
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x418]
add ecx, 0xc0
call fcn.0041d4a0
push eax
push 0x6e0d64
push str.TempModifyHotKey
push 0x6e0ddc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x418]
add ecx, 0xc0
call fcn.0041d4a0
push eax
push 0x6e0d8c
push 0x6e0d90
push str.SetModify
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
mov ecx, dword [ebp - 0x418]
add ecx, 0xa8
call fcn.0041d4a0
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x90
call fcn.0041d4a0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004421e5
mov esp, ebp
pop ebp
ret