joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5808f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x20
add esp, 0xfffff004
push eax
dec eax
jne 0x5808f9
mov eax, dword [ebp - 4]
push ebx
xor edx, edx
mov dword [ebp - 0x20004], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x580974
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1fffe]
push eax
push 0xffff
call sub.kernel32.dll_GetCurrentDirectoryW
mov ecx, eax
lea edx, [ebp - 0x1fffe]
mov eax, ebx
call fcn.00409cb4
lea edx, [ebp - 0x20004]
mov eax, dword [ebx]
call fcn.00580980
mov edx, dword [ebp - 0x20004]
mov eax, ebx
call fcn.00409f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58097b
lea eax, [ebp - 0x20004]
call fcn.00409b1c
pop eax
jmp eax

Function at 0x580aa8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x580b24
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathW
test eax, eax
jbe 0x580b04
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040a6f4
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.00580980
jmp 0x580b09
call fcn.0042cda8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x580b2b
lea eax, [ebp - 0x210]
call fcn.00409b1c
pop eax
jmp eax

Function at 0x580b30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x580bba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
push eax
push 0
mov eax, ebx
call fcn.0040a640
push eax
lea eax, [ebp - 0x210]
call fcn.00580aa8
mov eax, dword [ebp - 0x210]
call fcn.0040a640
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
jbe 0x580b9a
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040a6f4
jmp 0x580b9f
call fcn.0042cda8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x580bc1
lea eax, [ebp - 0x210]
call fcn.00409b1c
pop eax
jmp eax
Function at 0x580dd8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x580eec
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
test ebx, ebx
je 0x580ecc
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x580ec5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
test eax, eax
je 0x580e29
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x104
jl 0x580e91
mov cl, 1
mov edx, 0x580f08
mov eax, ebx
call fcn.00577c04
test al, al
je 0x580e4e
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f54
jmp 0x580e9b
mov eax, ebx
call fcn.0057fe28
test al, al
je 0x580e80
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, ebx
call fcn.0040aa14
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 0x580f20
call fcn.0040a8a4
jmp 0x580e9b
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x580f08
call fcn.0040a8a4
jmp 0x580e9b
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f54
mov eax, dword [ebp - 4]
call fcn.0040a640
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x580ecc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x580ef3
lea eax, [ebp - 0x10]
call fcn.00409b1c
lea eax, [ebp - 4]
call fcn.00409b1c
pop eax
jmp eax

Function at 0x580f4c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x581016
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
test eax, eax
je 0x580f72
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x104
jl 0x580fda
mov cl, 1
mov edx, 0x581034
mov eax, ebx
call fcn.00577c04
test al, al
je 0x580f97
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f54
jmp 0x580fe4
mov eax, ebx
call fcn.0057fe28
test al, al
je 0x580fc9
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, ebx
call fcn.0040aa14
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x58104c
call fcn.0040a8a4
jmp 0x580fe4
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x581034
call fcn.0040a8a4
jmp 0x580fe4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f54
push esi
mov eax, dword [ebp - 4]
call fcn.0040a640
push eax
call sub.kernel32.dll_SetFileAttributesW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58101d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409b7c
pop eax
jmp eax
Function at 0x5813e0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 9], cl
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58154d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
test eax, eax
je 0x58140f
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x104
jl 0x581477
mov cl, 1
mov edx, 0x581568
mov eax, ebx
call fcn.00577c04
test al, al
je 0x581434
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f54
jmp 0x581481
mov eax, ebx
call fcn.0057fe28
test al, al
je 0x581466
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, ebx
call fcn.0040aa14
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 0x581580
call fcn.0040a8a4
jmp 0x581481
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x581568
call fcn.0040a8a4
jmp 0x581481
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f54
mov eax, esi
test eax, eax
je 0x58148c
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x104
jl 0x5814f4
mov cl, 1
mov edx, 0x581568
mov eax, esi
call fcn.00577c04
test al, al
je 0x5814b1
lea eax, [ebp - 8]
mov edx, esi
call fcn.00409f54
jmp 0x5814fe
mov eax, esi
call fcn.0057fe28
test al, al
je 0x5814e3
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, esi
call fcn.0040aa14
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 0x581580
call fcn.0040a8a4
jmp 0x5814fe
lea eax, [ebp - 8]
mov ecx, esi
mov edx, 0x581568
call fcn.0040a8a4
jmp 0x5814fe
lea eax, [ebp - 8]
mov edx, esi
call fcn.00409f54
cmp byte [ebp - 9], 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.0040a640
push eax
mov eax, dword [ebp - 4]
call fcn.0040a640
push eax
call sub.kernel32.dll_CopyFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581554
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409b7c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409b7c
pop eax
jmp eax

Function at 0x581594
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x58165a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
test eax, eax
je 0x5815b7
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x104
jl 0x58161f
mov cl, 1
mov edx, 0x581674
mov eax, ebx
call fcn.00577c04
test al, al
je 0x5815dc
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f54
jmp 0x581629
mov eax, ebx
call fcn.0057fe28
test al, al
je 0x58160e
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, ebx
call fcn.0040aa14
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x58168c
call fcn.0040a8a4
jmp 0x581629
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x581674
call fcn.0040a8a4
jmp 0x581629
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f54
mov eax, dword [ebp - 4]
call fcn.0040a640
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581661
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409b7c
pop eax
jmp eax
Function at 0x5816a0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x581766
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
test eax, eax
je 0x5816c3
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x104
jl 0x58172b
mov cl, 1
mov edx, 0x581780
mov eax, ebx
call fcn.00577c04
test al, al
je 0x5816e8
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f54
jmp 0x581735
mov eax, ebx
call fcn.0057fe28
test al, al
je 0x58171a
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, ebx
call fcn.0040aa14
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x581798
call fcn.0040a8a4
jmp 0x581735
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x581780
call fcn.0040a8a4
jmp 0x581735
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409f54
mov eax, dword [ebp - 4]
call fcn.0040a640
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58176d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409b7c
pop eax
jmp eax

Function at 0x5834ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x58352f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
call fcn.0040a744
push esi
push ebx
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a4e4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
mov ebx, eax
test ebx, ebx
je 0x58350b
push 0x1388
mov eax, dword [esi]
push eax
call sub.user32.dll_WaitForInputIdle
cmp eax, 0x102
jne 0x58350f
xor eax, eax
jmp 0x583511
mov al, 1
neg al
sbb eax, eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x583536
lea eax, [ebp - 4]
call fcn.00409b64
pop eax
jmp eax
Function at 0x5b2b6c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
xor ecx, ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5b2cae
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x5b2b9e
cmp dword [ebp - 4], 0
jne 0x5b2ba2
xor ebx, ebx
jmp 0x5b2ba4
mov bl, 1
test bl, bl
je 0x5b2c93
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005b2fcc
test al, al
je 0x5b2c93
xor edx, edx
push ebp
push 0x5b2c7f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
call fcn.005b2ae4
test al, al
je 0x5b2c67
mov ebx, dword [ebp - 0xc]
dec ebx
cmp ebx, 0
jl 0x5b2c67
mov dword [ebp - 0x10], 0x40
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x80
call fcn.00407740
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x94]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x5b2c61
lea eax, [ebp - 0x98]
lea edx, [ebp - 0x94]
mov ecx, 0x40
call fcn.0040a6f4
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x14]
call fcn.005b2b6c
dec ebx
cmp ebx, 0xffffffff
jne 0x5b2c03
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b2c86
mov eax, dword [ebp - 0x14]
call fcn.005b2e58
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b2cb5
lea eax, [ebp - 0x98]
call fcn.00409b1c
pop eax
jmp eax

Function at 0x5b2cf4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040e460
xor eax, eax
push ebp
push 0x5b2deb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, ebx
call fcn.005b2fc0
mov ebx, eax
test ebx, ebx
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x5b2dc8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push ebx
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x5b2dc8
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x5b2dc1
inc esi
xor edi, edi
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 0x21a]
call fcn.0057fe10
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21a]
push eax
push edi
push ebx
call sub.advapi32.dll_RegEnumKeyExW
lea eax, [ebp - 0x220]
lea edx, [ebp - 0x21a]
mov ecx, 0x105
call fcn.0040a6f4
mov edx, dword [ebp - 0x220]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0xc]
inc edi
dec esi
jne 0x5b2d6d
mov eax, ebx
call fcn.005b2e58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b2df2
lea eax, [ebp - 0x220]
call fcn.00409b1c
lea eax, [ebp - 4]
call fcn.0040e3ec
pop eax
jmp eax
Function at 0x5b2e00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, ecx
mov edi, edx
mov ebx, eax
mov dword [esp], esi
test ebx, ebx
je 0x5b2e4d
mov dword [esp + 8], 4
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov eax, edi
call fcn.0040a640
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW
call fcn.005b2ae4
test al, al
je 0x5b2e4a
cmp dword [esp + 4], 4
je 0x5b2e4d
mov dword [esp], esi
mov eax, dword [esp]
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x5b2e64
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov ebp, edx
mov esi, eax
test esi, esi
setne al
test al, al
je 0x5b2ea7
mov ebx, edi
test ebx, ebx
je 0x5b2e82
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, edi
call fcn.0040a640
push eax
push 1
push 0
mov eax, ebp
call fcn.0040a640
push eax
push esi
call sub.advapi32.dll_RegSetValueExW
call fcn.005b2ae4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x629748
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x629757
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x70b1a0]
cmp byte [eax], 0
je 0x62978c
mov eax, ebx
call fcn.0057fe4c
test al, al
jne 0x62977e
mov cl, 1
mov edx, 0x6297c4
mov eax, ebx
call fcn.00577c04
test al, al
je 0x62978c
mov edx, ebx
mov eax, 0x6297e0
call fcn.00629748
jmp 0x6297b5
push 5
push 0x6297f8
mov eax, esi
call fcn.0040a640
push eax
mov eax, ebx
call fcn.0040a640
push eax
push 0x6297fc
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
setae al
pop esi
pop ebx
ret

Function at 0x6298fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x62997d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push esi
lea eax, [ebp - 0x20a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x62995b
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040a6f4
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.00580980
jmp 0x629962
mov eax, ebx
call fcn.00580aa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x629984
lea eax, [ebp - 0x210]
call fcn.00409b1c
pop eax
jmp eax

Function at 0x62998c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x629a08
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
call fcn.0057fe10
push 0x105
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040a6f4
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.00580980
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x629a0f
lea eax, [ebp - 0x210]
call fcn.00409b1c
pop eax
jmp eax

Function at 0x62a0c3
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffd4c
mov eax, esp
xor ecx, ecx
mov edx, 0x2b4
call fcn.00407740
push 0x4011
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
push 0x62a0d8
call sub.shell32.dll_SHGetFileInfoW
add esp, 0x2b4
ret

Function at 0x62a5d8
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffd4c
push 0x4009
push 0x2b4
lea edx, [esp + 8]
push edx
push 0
mov eax, dword [eax + 4]
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
add esp, 0x2b4
ret
Function at 0x630614
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov byte [ebx + 0x30], 1
mov eax, dword [ebx + 0x2c]
xor edx, edx
call fcn.006312fc
mov eax, dword [ebx + 0x28]
xor edx, edx
call fcn.00630bd4
lea eax, [ebx + 0x20]
mov edx, esi
call fcn.00409f0c
mov edx, dword [ebp - 4]
mov eax, dword [0x62d3f0]
call fcn.0062f4b8
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x6306d0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x28]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, esi
call fcn.0040a640
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x630686
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
jmp 0x6306af
mov ebx, dword [ebp - 0xc]
dec ebx
test ebx, ebx
jl 0x6306af
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + esi*4]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call edi
test al, al
jne 0x6306af
inc esi
dec ebx
jne 0x630696
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
jne 0x63068b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6306d7
mov eax, dword [ebp - 8]
call fcn.00407e08
pop eax
jmp eax

Function at 0x649d14
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
mov bx, ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x649d2a
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x649d3a
or bx, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x649d4a
or bx, 2
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x649d5a
or bx, 8
push 4
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x649d6a
or bx, 0x20
push 2
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x649d7a
or bx, 0x10
mov eax, ebx
pop ebx
ret
Function at 0x697e14
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x697f2d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x697f48
push 0x697f5c
mov ecx, 0x697f74
mov dl, 1
mov eax, dword [0x5751c8]
call fcn.00575390
mov dword [ebp - 8], eax
xor ecx, ecx
push ebp
push 0x697f01
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 8]
mov byte [eax + 0x36], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x34], 1
mov eax, dword [ebp - 8]
mov byte [eax + 0x35], 1
call sub.kernel32.dll_GetCommandLineW
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.0040a6a0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00578628
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00575444
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00575474
test al, al
je 0x697eda
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
test eax, eax
jle 0x697ec6
lea ecx, [ebp - 4]
xchg ecx, eax
call fcn.00409cb4
jmp 0x697ece
lea eax, [ebp - 4]
call fcn.00409b1c
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00578628
jmp 0x697ee9
mov eax, ebx
mov edx, dword [0x70b56c]
mov edx, dword [edx]
call fcn.00409f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x697f08
mov eax, dword [ebp - 8]
call fcn.00407e08
pop eax
jmp eax

Function at 0x6a8a64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x6a8a9e
inc ecx
xor edx, edx
mov ebx, eax
add ebx, ebx
add ebx, ebx
shr eax, 0x1e
or ebx, eax
mov eax, dword [ebp - 8]
add eax, edx
mov esi, dword [ebp - 4]
movzx eax, word [esi + eax*2]
xor ebx, eax
mov eax, ebx
inc edx
dec ecx
jne 0x6a8a7f
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x6b1eac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff6c
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp]
mov edx, dword [eax + 0x10]
mov dword [esp + 0xc], edx
mov ecx, dword [esp]
mov eax, dword [ecx + 0x34]
mov dword [esp + 0x10], eax
mov edx, dword [esp]
mov ecx, dword [edx + 0x38]
mov dword [esp + 0x14], ecx
mov eax, dword [esp]
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x18], edx
mov ecx, dword [esp]
mov eax, dword [ecx + 0x40]
mov dword [esp + 0x1c], eax
mov edx, dword [esp]
mov ecx, dword [edx + 0x44]
mov edx, 1
mov dword [esp + 0x20], ecx
mov eax, dword [esp]
mov ecx, dword [eax + 8]
shl edx, cl
dec edx
mov dword [esp + 0x24], edx
mov edx, 1
mov eax, dword [esp]
mov ecx, dword [eax + 4]
shl edx, cl
dec edx
mov dword [esp + 0x28], edx
mov eax, dword [esp]
mov edx, dword [eax]
mov dword [esp + 0x2c], edx
mov ecx, dword [esp]
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x30], eax
mov edx, dword [esp]
mov ecx, dword [edx + 0x28]
mov dword [esp + 0x34], ecx
mov eax, dword [esp]
mov edx, dword [eax + 0x24]
mov dword [esp + 0x38], edx
mov ecx, dword [esp]
mov eax, dword [ecx + 0x2c]
mov dword [esp + 0x3c], eax
xor eax, eax
mov edx, dword [esp]
mov ecx, dword [edx + 0x30]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
mov edx, dword [esp]
mov ecx, dword [edx + 0x18]
mov dword [esp + 0x48], ecx
mov eax, dword [esp]
mov esi, dword [eax + 0x1c]
mov eax, dword [esp]
mov eax, dword [eax + 0x20]

Function at 0x6b4824
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, pe_nt_image_headers32
or ebx, 0x100
add edi, edi
mov edx, esi
mov eax, ebx
and edx, edi
shr eax, 8
add edx, esi
add edx, eax
mov ecx, dword [ebp - 8]
add edx, edx
mov eax, dword [ebp - 4]
add edx, ecx
mov ecx, ebx
shr ecx, 7
and ecx, 1
call fcn.006b4794
add ebx, ebx
mov edx, ebx
xor edx, edi
not edx
and esi, edx
cmp ebx, 0x10000
jb 0x6b4843
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x6b48e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
or edx, 0x100
mov esi, edx
mov edi, edx
shr esi, 8
shr edi, 7
movzx esi, word [eax + esi*2]
and edi, 1
neg edi
and edi, 0x7ff
xor esi, edi
sar esi, 4
add ebx, dword [ecx + esi*4]
add edx, edx
cmp edx, 0x10000
jb 0x6b48f3
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x6b4924
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ebx, pe_nt_image_headers32
or edx, 0x100
add ecx, ecx
mov esi, ebx
mov edi, edx
and esi, ecx
shr edi, 8
add esi, ebx
add esi, edi
mov edi, dword [ebp - 4]
movzx esi, word [edi + esi*2]
mov edi, edx
add edx, edx
shr edi, 7
and edi, 1
neg edi
and edi, 0x7ff
xor esi, edi
mov edi, dword [ebp + 8]
sar esi, 4
add eax, dword [edi + esi*4]
mov esi, edx
xor esi, ecx
not esi
and ebx, esi
cmp edx, 0x10000
jb 0x6b493b
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4