joyce8/EMBER2024-capa huggingface dataset:
Function at 0x618cd8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00424328
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x618d08
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x618e24
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [0x6d8340]
cmp dword [0x6d833c], 0
jne 0x618dff
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jb 0x618dff
lea eax, [ebp - 8]
call fcn.00618cd8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.005c4ebc
lea eax, [ebp - 4]
mov edx, 0x618e40
call fcn.0040b470
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x6d833c], eax
cmp dword [0x6d833c], 0
je 0x618dff
push 0x618e5c
mov eax, dword [0x6d833c]
push eax
call fcn.00414030
mov dword [0x6d8320], eax
push 0x618e7c
mov eax, dword [0x6d833c]
push eax
call fcn.00414030
mov dword [0x6d8324], eax
push 0x618ea4
mov eax, dword [0x6d833c]
push eax
call fcn.00414030
mov dword [0x6d8328], eax
push 0x618eb8
mov eax, dword [0x6d833c]
push eax
call fcn.00414030
mov dword [0x6d832c], eax
push 0x618ed0
mov eax, dword [0x6d833c]
push eax
call fcn.00414030
mov dword [0x6d8330], eax
push 0x618ee4
mov eax, dword [0x6d833c]
push eax
call fcn.00414030
mov dword [0x6d8334], eax
cmp dword [0x6d833c], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618e2b
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a228
ret
Function at 0x626330
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x62640a
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x62641c
call fcn.006169d0
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x626388
mov eax, 0x62647c
call fcn.0061674c
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x626373
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x6263db
cmp dword [esp], 0
jne 0x6263bd
mov eax, 0x6264d4
call fcn.0061674c
jmp 0x6263e5
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x626510
call fcn.006169d0
jmp 0x6263e5
mov eax, 0x626578
call fcn.0061674c
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x62640a
push 0xfa
call sub.kernel32.dll_Sleep
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x6265e0
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x62681e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x6267c3
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x626655
mov eax, 0x62683c
call fcn.0060d1c0
xor edx, edx
push ebp
push 0x626758
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00407760
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x626741
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x6266bd
mov eax, 0x626860
call fcn.0060d1c0
xor edx, edx
push ebp
push 0x62672a
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x6266fd
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x6266fd
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x6266db
pop dword fs:[0]
add esp, 8
push 0x626731
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62675f
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret

Function at 0x62826c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
push 1
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.0040b278
mov ecx, eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
mov edx, 0x80000002
call fcn.005c7a60
test eax, eax
jne 0x6282df
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x6282ce
cmp dword [ebp - 8], 4
je 0x6282d2
xor ebx, ebx
jmp 0x6282d4
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x6282e1
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x62cbec
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe08
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11f4], ebx
mov dword [ebp - 0x11f8], ebx
mov dword [ebp - 0x11ec], ebx
mov dword [ebp - 0x11f0], ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 0x1004], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11de]
xor eax, eax
push ebp
push 0x62ce35
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [ebp - 0x11d0]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 0x1004]
mov eax, dword [ebp - 0x11cc]
call fcn.006291c0
cmp dword [ebp - 0x1084], 0x418
jle 0x62ccae
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 0x1004]
mov ax, 0xeb
call fcn.005cd844
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, dword [0x41baa4]
call fcn.00429020
call fcn.004098c4
lea eax, [ebp - 0x11f0]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
push 0
call fcn.0040a998
mov edx, dword [ebp - 0x11f0]
lea ecx, [ebp - 0x11ec]
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
call fcn.0062c508
mov edx, dword [ebp - 0x11ec]
mov eax, dword [ebp - 0x11d0]
add eax, 0x14
call fcn.0040a5a8
lea eax, [ebp - 0x11f8]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
push 0
call fcn.0040a998
mov edx, dword [ebp - 0x11f8]
lea ecx, [ebp - 0x11f4]
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
call fcn.0062c508
mov edx, dword [ebp - 0x11f4]
mov eax, dword [ebp - 0x11d0]
add eax, 0x18
call fcn.0040a5a8
lea eax, [ebp - 0x1078]
movzx eax, byte [eax]
mov edx, dword [ebp - 0x11d0]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x62cdf6
push ebp
mov eax, esi
mov edx, 0xa
call fcn.0062cb74
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
movzx edx, word [esi]
call fcn.00629960
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x62cd93
push ebp
call fcn.0062c9cc
pop ecx
xor eax, eax
push ebp
push 0x62cdc4
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
call fcn.0062cb74
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62cdde
mov edx, dword [ebp - 0x11e4]
mov eax, dword [ebp - 0x11d0]
call fcn.0062999c
dec ebx
jne 0x62cd58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62ce3c
lea eax, [ebp - 0x11f8]
call fcn.0040a1ec
lea eax, [ebp - 0x11f4]
call fcn.0040a1c8
lea eax, [ebp - 0x11f0]
call fcn.0040a1ec
lea eax, [ebp - 0x11ec]
mov edx, 2
call fcn.0040a228
ret
Function at 0x67e0e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, esi
test ebx, ebx
je 0x67e0f9
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b278
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x67e12d
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
xor eax, eax
call fcn.0067dfac
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x67ffc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x680131
push dword fs:[eax]
mov dword fs:[eax], esp
test cl, cl
je 0x680015
mov eax, dword [0x6cfe20]
cmp dword [eax], 0xa0042ee
jae 0x680015
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x68009b
mov eax, 0x68014c
call fcn.0061674c
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x68009b
test cl, cl
je 0x680020
mov esi, 0x80000001
jmp 0x680025
mov esi, 0x80000002
push 0
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [0x6cfcfc]
movzx eax, byte [eax]
mov ecx, dword [eax*4 + 0x6cf310]
mov edx, esi
xor eax, eax
call fcn.005c7a60
test eax, eax
jne 0x680091
mov esi, ebx
test esi, esi
je 0x680054
sub esi, 4
mov esi, dword [esi]
inc esi
mov eax, esi
add eax, eax
push eax
mov eax, ebx
call fcn.0040b278
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x680086
mov eax, 0x680228
call fcn.0061674c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x68009b
mov eax, 0x68028c
call fcn.0061674c
cmp byte [ebp + 0xc], 0
je 0x680116
mov eax, ebx
call fcn.0040b278
push eax
call sub.gdi32.dll_AddFontResourceW
test eax, eax
je 0x6800c4
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
jmp 0x680116
lea ecx, [ebp - 0x10]
mov edx, 0x6802e0
mov ax, 0x47
call fcn.005cd844
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.005c8430
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x6cff50]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x6cff50]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x6cff50]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
pop eax
call fcn.0067d568
test al, al
je 0x6800a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x680138
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040a228
ret
Function at 0x6836a4
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x683765
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x68374a
test bl, 0x10
je 0x68374a
lea ecx, [ebp - 4]
mov edx, 0x683780
mov eax, esi
call fcn.005c502c
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x6837a4
mov eax, 0x6837c0
call fcn.005c68e4
mov edx, 0x6837ec
mov eax, dword [ebp - 8]
call fcn.00422380
test eax, eax
jne 0x68374a
mov eax, dword [ebp - 4]
call fcn.00423a38
lea ecx, [ebp - 0xc]
mov edx, 0x683848
mov eax, esi
call fcn.005c502c
mov eax, dword [ebp - 0xc]
call fcn.00423a38
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.0040b278
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesW
push edi
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68376c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a228
ret

Function at 0x6847ac
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x684886
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.0060d2d4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x6848a4
call fcn.006169d0
mov eax, dword [0x6cfab0]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
call fcn.00464ce8
mov esi, eax
mov eax, dword [esi]
mov ebx, eax
test ebx, ebx
je 0x68481f
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
push eax
mov eax, ebx
mov ecx, 0x14
cdq
idiv ecx
push eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0062d464
test al, al
jne 0x684870
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x684855
mov eax, 0x6848f4
call fcn.0061674c
jmp 0x684870
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x684994
call fcn.006169d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68488d
lea eax, [ebp - 0x1c]
call fcn.0040a1c8
ret
Function at 0x686d6c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x686ef6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea edx, [ebp - 0x258]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005c4ebc
lea eax, [ebp - 0x258]
mov edx, 0x686f10
call fcn.0040b470
mov eax, dword [ebp - 0x258]
call fcn.0040b278
push eax
call sub.kernel32.dll_FindFirstFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x686ed0
lea eax, [ebp - 4]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.0040b318
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x686dff
sub ebx, 4
mov ebx, dword [ebx]
cmp ebx, 9
jl 0x686e44
lea eax, [ebp - 0x25c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040b698
mov eax, dword [ebp - 0x25c]
mov edx, 0x686f34
call fcn.00422380
test eax, eax
jne 0x686e44
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x686e46
xor eax, eax
test al, al
je 0x686e5d
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xc]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x686e5f
xor eax, eax
test al, al
je 0x686e76
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xe]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x686e78
xor eax, eax
test al, al
je 0x686eb5
mov eax, dword [ebp - 4]
cmp word [eax + 0x10], 0x2e
jne 0x686eb5
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.0040b698
mov eax, dword [ebp - 0x260]
call fcn.004233b4
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x254]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x686de0
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x686efd
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.0040a228
lea eax, [ebp - 4]
call fcn.0040a1c8
ret
Function at 0x6959f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
call fcn.006958c8
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4a
mov eax, dword [0x6d8454]
push eax
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408444
cmp ebx, 0x6c840001
jne 0x695a54
call fcn.00429014
mov eax, 0xffff0000
and eax, ebx
cmp eax, 0x6c830000
je 0x695a78
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x695b2c
call fcn.0060d0c0
mov word [ebp - 0xa], bx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 8]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x695ace
mov ebx, eax
mov edx, 1
movzx eax, word [ebp - 0xa]
call fcn.00695948
mov esi, eax
mov eax, esi
sub ax, 2
je 0x695ace
dec eax
sub ax, 2
jb 0x695ae2
movzx eax, si
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x695b8c
call fcn.0060d0c0
push 0x4ff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x695a83
mov edx, 2
movzx eax, word [ebp - 0xa]
call fcn.00695948
movzx ebx, ax
mov edx, 3
movzx eax, word [ebp - 0xa]
call fcn.00695948
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x697e24
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
mov eax, ebx
call fcn.00697ea8
call fcn.00406f0c
mov esi, eax
push esp
push 0x40
mov eax, ebx
call fcn.00697ea8
push eax
push esi
call sub.kernel32.dll_VirtualProtect
mov edx, esi
mov eax, ebx
call fcn.00697e58
mov eax, esi
pop edx
pop esi
pop ebx
ret
Function at 0x699e0c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x699fde
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.0040a350
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x6cf720]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040b278
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.005c7a60
test eax, eax
jne 0x699fc3
xor eax, eax
push ebp
push 0x699fb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.005e21b0
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x699e9d
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x699eca
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.0040a774
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x699eec
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.0040a774
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x699f62
sub eax, 0xe9
je 0x699f06
sub eax, 0x19
je 0x699fa1
jmp 0x699f5b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x699f1d
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x699f30
call fcn.004099b8
jmp 0x699fc3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x699f47
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a350
jmp 0x699e91
call fcn.004099b8
jmp 0x699fc3
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.005e21b0
lea eax, [ebp - 4]
call fcn.0040a774
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.0040a350
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.005f387c
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.005e0350
inc ebx
jmp 0x699e91
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x699fbf
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x699fe5
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a228
ret
Function at 0x6a0b40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x6a0bc4
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x6a0bac
mov ebx, esi
test ebx, ebx
je 0x6a0b72
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b278
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x6a0be0
call fcn.0040b4c8
mov eax, dword [ebp - 8]
call fcn.0040b278
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x6a0bae
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0bcb
lea eax, [ebp - 8]
call fcn.0040a1c8
ret

Function at 0x6a6fd8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x6a6fe2
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x6a7098
push 0x6a70cc
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414030
mov ebx, eax
test ebx, ebx
je 0x6a7081
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6a7081
test al, 0x10
je 0x6a7032
mov ebp, 0x2000000
jmp 0x6a7034
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x6a7081
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle
test ebx, ebx
jle 0x6a7081
cmp ebx, 0xff0
jge 0x6a7081
mov edx, edi
mov eax, esp
call fcn.006a6ef0
jmp 0x6a708a
mov eax, edi
mov edx, esi
call fcn.0040a5a8
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6a70e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x6a7179
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
test ebx, ebx
jle 0x6a714f
cmp ebx, 0x104
jge 0x6a714f
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040b318
mov eax, dword [ebp - 0x20c]
mov edx, esi
call fcn.006a6fd8
jmp 0x6a7160
mov eax, 0x6a7194
call fcn.0060d278
mov eax, esi
call fcn.0040a1c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a7180
lea eax, [ebp - 0x20c]
call fcn.0040a1c8
ret