joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6636d0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesA]

Function at 0x6636e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesW]

Function at 0x663940
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WININET.dll_InternetCrackUrlA]

Function at 0x663950
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WININET.dll_InternetCrackUrlW]

Function at 0x663d30
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]

Function at 0x663d40
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]

Function at 0x663d90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExA]

Function at 0x663da0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x665e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7bef63
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x8d3fc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x14]
mov dword [edi], vtable.diagnostic_events::CpuInfo.0
mov dword [ebp - 4], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0xf
mov byte [edi + 0x38], 0
push 0
push 0x858903
mov byte [ebp - 4], 2
mov dword [edi + 4], 0
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.00439710
push 0
push 0x858903
lea ecx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call fcn.00439710
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
cmp dword [esi + 0xc], 0
setne al
mov byte [edi + 4], al
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
mov byte [edi + 5], 1
cmp ecx, eax
je 0x665f2d
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x665f24
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00439710
mov byte [edi + 6], 1
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov dword [edi + 0x30], eax
lea eax, [esi + 0x38]
mov dword [edi + 0x34], ecx
lea ecx, [edi + 0x38]
mov byte [edi + 7], 1
cmp ecx, eax
je 0x665f5e
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x665f55
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00439710
mov byte [edi + 8], 1
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, byte [esi + 6]
mov byte [edi + 6], al
movzx eax, byte [esi + 7]
mov byte [edi + 7], al
movzx eax, byte [esi + 8]
mov byte [edi + 8], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x665fa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7befb3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x8d3fc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
lea ecx, [edi + 0x14]
mov dword [edi], vtable.diagnostic_events::CpuInfo.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0xf
mov byte [edi + 0x38], 0
push 0
push 0x858903
mov byte [ebp - 4], 4
mov dword [edi + 4], 0
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.00439710
push 0
push 0x858903
lea ecx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call fcn.00439710
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x14]
movss xmm0, dword [ebp + 0xc]
test eax, eax
mov dword [edi + 0xc], eax
setne al
mov byte [edi + 4], al
lea eax, [ebp + 0x10]
movss dword [edi + 0x10], xmm0
mov byte [edi + 5], 1
cmp ecx, eax
je 0x66607f
cmp dword [ebp + 0x24], 0x10
push dword [ebp + 0x20]
cmovae eax, dword [ebp + 0x10]
push eax
call fcn.00439710
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x2c]
mov dword [edi + 0x30], eax
lea eax, [ebp + 0x30]
mov dword [edi + 0x34], ecx
lea ecx, [edi + 0x38]
mov word [edi + 6], 0x101
cmp ecx, eax
je 0x6660ac
cmp dword [ebp + 0x44], 0x10
push dword [ebp + 0x40]
cmovae eax, dword [ebp + 0x30]
push eax
call fcn.00439710
mov edx, dword [ebp + 0x24]
xor ecx, ecx
cmp dword [edi + 0x48], ecx
mov byte [edi + 8], 1
movzx eax, byte [edi + 8]
cmove eax, ecx
mov byte [edi + 8], al
cmp edx, 0x10
jb 0x6660ef
mov ecx, dword [ebp + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x6660e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x666146
push edx
push ecx
call fcn.007009b8
add esp, 8
mov edx, dword [ebp + 0x44]
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0xf
mov byte [ebp + 0x10], 0
cmp edx, 0x10
jb 0x666131
mov ecx, dword [ebp + 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x666127
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x666146
push edx
push ecx
call fcn.007009b8
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x40
call fcn.0071c489
int3
Function at 0x666220
Capabilities:
Access peb ldr_data
Enumerate pe sections
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7bf03e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x8d3fc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
lea esi, [ecx + 0x18]
mov dword [ecx], vtable.diagnostic_events::Error.0
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ebx, [ecx + 0x30]
mov byte [ebp - 4], 1
push 0
mov ecx, ebx
call fcn.00435a60
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x48]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
push 0
push 0x858903
mov ecx, esi
mov byte [ebp - 4], 3
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov byte [eax + 0xa], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00439710
sub esp, 0x18
mov ecx, esp
push 0x8eda48
call fcn.00435df0
mov ecx, ebx
call fcn.00435ef0
push 0
push 0x858903
mov ecx, edi
call fcn.00439710
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov byte [ebx + 0x60], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
cmp dword [esi + 0xc], 0
setne al
mov byte [ebx + 4], al
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [ebx + 0x10], eax
lea eax, [esi + 0x18]
mov dword [ebx + 0x14], ecx
lea ecx, [ebx + 0x18]
mov byte [ebx + 5], 1
cmp ecx, eax
je 0x666347
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x66633e
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00439710
sub esp, 0x18
mov byte [ebx + 6], 1
lea eax, [esi + 0x30]
mov ecx, esp
push eax
call fcn.00435df0
lea ecx, [ebx + 0x30]
call fcn.00435ef0
lea eax, [esi + 0x48]
mov byte [ebx + 7], 1
lea ecx, [ebx + 0x48]
cmp ecx, eax
je 0x666382
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x666379
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00439710
mov byte [ebx + 8], 1
movzx eax, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov byte [ebx + 9], 1
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov dword [ebx + 0x68], eax
mov byte [ebx + 0xa], 1
mov dword [ebx + 0x6c], ecx
movzx eax, byte [esi + 4]
mov byte [ebx + 4], al
movzx eax, byte [esi + 5]
mov byte [ebx + 5], al
movzx eax, byte [esi + 6]
mov byte [ebx + 6], al
movzx eax, byte [esi + 7]
mov byte [ebx + 7], al
movzx eax, byte [esi + 8]
mov byte [ebx + 8], al
movzx eax, byte [esi + 9]
mov byte [ebx + 9], al
movzx eax, byte [esi + 0xa]
mov byte [ebx + 0xa], al
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6663f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7bf08e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x8d3fc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea esi, [ecx + 0x18]
mov dword [ecx], vtable.diagnostic_events::Error.0
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ebx, [ecx + 0x30]
mov byte [ebp - 4], 1
push 0
mov ecx, ebx
call fcn.00435a60
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x48]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
push 0
push 0x858903
mov ecx, esi
mov byte [ebp - 4], 3
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov byte [eax + 0xa], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00439710
sub esp, 0x18
mov ecx, esp
push 0x8eda48
call fcn.00435df0
mov ecx, ebx
call fcn.00435ef0
push 0
push 0x858903
mov ecx, edi
call fcn.00439710
mov eax, dword [ebp - 0x10]
mov ecx, esi
push 0
push 0x858903
mov byte [eax + 0x60], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00439710
sub esp, 0x18
mov ecx, esp
push 0x8eda48
call fcn.00435df0
mov ecx, ebx
call fcn.00435ef0
push 0
push 0x858903
mov ecx, edi
call fcn.00439710
mov ecx, dword [ebp - 0x10]
mov eax, ecx
mov byte [ecx + 0x60], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x6c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x667e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7bf221
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x8d3fc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx], vtable.diagnostic_events::Origin.0
mov dword [ebp - 4], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0xf
mov byte [ecx + 0x1c], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0xf
mov byte [ecx + 0x34], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0xf
mov byte [ecx + 0x50], 0
lea edi, [ecx + 0x68]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea ebx, [ecx + 0x88]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
lea ecx, [ecx + 0xa0]
mov byte [ebp - 4], 5
push 0
call fcn.00435a60
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc8], 0
mov dword [edx + 0xcc], 0xf
mov byte [edx + 0xb8], 0
lea esi, [edx + 0xd0]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
push 0
push 0x858903
lea ecx, [edx + 0x1c]
mov byte [ebp - 4], 8
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
mov word [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
call fcn.00439710
mov ecx, dword [ebp - 0x10]
push 0
push 0x858903
lea ecx, [ecx + 0x34]
call fcn.00439710
mov eax, dword [ebp - 0x10]
push 0
push 0x858903
lea ecx, [eax + 0x50]
mov byte [eax + 0x4c], 0
call fcn.00439710
push 0
push 0x858903
mov ecx, edi
call fcn.00439710
mov eax, dword [ebp - 0x10]
mov ecx, ebx
push 0
push 0x858903
mov dword [eax + 0x80], 0
mov dword [eax + 0x84], 0
call fcn.00439710
sub esp, 0x18
mov ecx, esp
push 0x8eda48
call fcn.00435df0
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx + 0xa0]
call fcn.00435ef0
push 0
mov ecx, dword [ebp - 0x10]
push 0x858903
lea ecx, [ecx + 0xb8]
call fcn.00439710
push 0
push 0x858903
mov ecx, esi
call fcn.00439710
mov ecx, dword [ebp - 0x10]
push 0
push 0x858903
mov byte [ecx + 0xe8], 0
lea ecx, [ecx + 0x1c]
mov dword [ecx - 8], 0
mov dword [ecx - 4], 0
call fcn.00439710
mov ecx, dword [ebp - 0x10]
push 0
push 0x858903
lea ecx, [ecx + 0x34]
call fcn.00439710
mov ecx, dword [ebp - 0x10]
push 0
push 0x858903
mov byte [ecx + 0x4c], 0
lea ecx, [ecx + 0x50]
call fcn.00439710
push 0
push 0x858903
mov ecx, edi
call fcn.00439710
mov edi, dword [ebp - 0x10]
mov ecx, ebx
push 0
push 0x858903
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
call fcn.00439710
sub esp, 0x18
mov ecx, esp
push 0x8eda48
call fcn.00435df0
lea ecx, [edi + 0xa0]
call fcn.00435ef0
push 0
push 0x858903
lea ecx, [edi + 0xb8]
call fcn.00439710
push 0
push 0x858903
mov ecx, esi
call fcn.00439710
mov byte [edi + 0xe8], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x67c2d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7c0fe5
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x8d3fc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x4c], edi
push 0
mov dword [ebp - 0x50], edi
movups xmmword [ebp - 0x28], xmm0
movq qword [ebp - 0x18], xmm0
call fcn.00435a60
cmp byte [esi + 4], 0
mov dword [ebp - 4], 0
je 0x67c363
lea edi, [esi + 8]
mov ecx, edi
call fcn.00436cf0
test al, al
jne 0x67c360
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x4c], esp
push edi
call fcn.00435df0
push str.GeoInformation
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004376b0
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00435ef0
mov edi, dword [ebp - 0x50]
cmp byte [esi + 5], 0
je 0x67c39c
cmp dword [esi + 0x30], 0
je 0x67c39c
sub esp, 0x18
lea eax, [esi + 0x20]
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.00435d70
push str.clientCountryCode
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004376b0
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00435ef0
cmp byte [esi + 6], 0
je 0x67c3d5
cmp dword [esi + 0x48], 0
je 0x67c3d5
sub esp, 0x18
lea eax, [esi + 0x38]
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.00435d70
push str.clientRegion
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004376b0
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00435ef0
cmp byte [esi + 7], 0
je 0x67c40e
cmp dword [esi + 0x60], 0
je 0x67c40e
sub esp, 0x18
lea eax, [esi + 0x50]
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.00435d70
push str.networkPrefix
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.004376b0
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00435ef0
xorps xmm0, xmm0
lea ecx, [ebp - 0x48]
movups xmmword [ebp - 0x48], xmm0
movups xmmword [ebp - 0x38], xmm0
call fcn.0043e8d0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x48]
push eax
push edi
call fcn.0043f600
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.0043e990
lea ecx, [ebp - 0x28]
call fcn.00435e20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00700c25
mov esp, ebp
pop ebp
ret 4
Function at 0x6ae710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
jne 0x6ae730
push edi
push edi
push edi
push 2
call fcn.006b1030
pop edi
xor al, al
pop esi
pop ebp
ret 8
push ebx
call fcn.006ad7a0
push 2
push 0
push edi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.0072b166
push edi
call fcn.0072e6cb
push 0
mov ebx, eax
push 0
push edi
mov dword [ebp + 8], ebx
call fcn.0072b166
add esp, 0x1c
test ebx, ebx
jg 0x6ae782
push 0
push 0
push 0
push 0xc
mov ecx, esi
call fcn.006b1030
pop ebx
pop edi
xor al, al
pop esi
pop ebp
ret 8
lea eax, [ebx + 1]
push eax
call fcn.00700faa
push edi
mov edi, dword [ebp + 8]
mov ebx, eax
push 1
push edi
push ebx
mov byte [ebx], 0
call fcn.00721ff9
add esp, 0x14
cmp eax, 1
je 0x6ae7c6
push ebx
call fcn.00700fb3
add esp, 4
mov ecx, esi
push 0
push 0
push 0
push 2
call fcn.006b1030
pop ebx
pop edi
xor al, al
pop esi
pop ebp
ret 8
mov byte [ebx + edi], 0
mov eax, ebx
mov dl, byte [ebx]
mov ecx, ebx
test dl, dl
je 0x6ae7f2
inc eax
lea edi, [ecx + 1]
cmp dl, 0xd
jne 0x6ae7e8
mov byte [ecx], 0xa
cmp byte [eax], 0xa
jne 0x6ae7ea
inc eax
jmp 0x6ae7ea
mov byte [ecx], dl
mov dl, byte [eax]
mov ecx, edi
test dl, dl
jne 0x6ae7d4
push dword [ebp + 0xc]
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push ebx
call dword [eax + 8]
push ebx
call fcn.00700fb3
add esp, 4
cmp byte [esi + 0x40], 0
sete al
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x6b2538
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x8d3fc4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x8ee6a4], 0x64
jbe 0x6b255f
mov eax, str.SaveLogFile_more_than_100_files_r_n
jmp 0x6b268e
push ebx
push esi
push str.SaveLogFile__Start_r_n
call fcn.006b26d4
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, 0x8edab0
pop ecx
push esi
call ebx
cmp eax, 0xa
ja 0x6b258c
push 0x104
push esi
call fcn.006b27a0
pop ecx
pop ecx
push esi
call ebx
cmp eax, 0xa
jbe 0x6b2687
inc word [0x8ee6a4]
lea eax, [ebp - 0x1fa]
push edi
mov esi, str..wbt
lea edi, [ebp - 0x204]
push 0x1f6
push 0
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00719250
push 0x208
lea eax, [ebp - 0x40c]
push 0
push eax
call fcn.00719250
add esp, 0x18
lea eax, [ebp - 0x40c]
mov esi, 0x8edab0
mov edi, 0x104
push esi
push edi
push eax
call fcn.0051460b
push esi
call ebx
mov esi, eax
lea eax, [ebp - 0x204]
push eax
call ebx
movzx ecx, word [0x8ee6a4]
sub esi, eax
lea eax, [ebp - 0x204]
sub edi, esi
push eax
push ecx
push str._d_s
lea eax, [ebp - 0x40c]
lea eax, [eax + esi*2]
push edi
push eax
call fcn.00514679
mov eax, dword [0x8ee1f8]
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
test eax, eax
je 0x6b2655
push 0
push eax
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
test eax, eax
jne 0x6b2655
call esi
push eax
push str.SaveLogFile_FlushViewOfFile_Failed__lastError___u__r_n
call fcn.006b26d4
pop ecx
pop ecx
push str.SaveLogFile__FlushViewOfFile_r_n
call fcn.006b26d4
pop ecx
push 0
lea eax, [ebp - 0x40c]
push eax
push 0x8edab0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x6b2687
call esi
push eax
push str.SaveLogFile_save_Failed__lastError___u__r_n
call fcn.006b26d4
pop ecx
pop ecx
pop esi
mov eax, str.SaveLogFile__End_r_n
pop ebx
push eax
call fcn.006b26d4
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00700c25
leave
ret

Function at 0x6b26d4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x8d3fc4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.004fc29c
xor eax, eax
add esp, 0x14
mov word [ebp - 6], ax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00700c25
leave
ret
Function at 0x6b27a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x8d3fc4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x8ee1f8], 0
push esi
mov esi, dword [ebp + 8]
je 0x6b2933
test esi, esi
je 0x6b2933
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x6b2932
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x6b2932
push ebx
push str.GetMappedFileNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x6b2931
lea ecx, [edi - 1]
push ecx
push esi
push dword [0x8ee1f8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x6b2931
xor eax, eax
mov word [ebp - 0x81c], ax
lea eax, [ebp - 0x81c]
push eax
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x6b2931
mov eax, dword [0x83ad00]
lea edi, [ebp - 0x81c]
movzx ecx, word [ebp - 0x81c]
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov ax, word [0x83ad04]
mov word [ebp - 8], ax
mov dword [ebp - 0x820], edi
push 0x104
lea eax, [ebp - 0x214]
mov word [ebp - 0xc], cx
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x6b290e
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
cmp edi, 0x104
jae 0x6b2908
push edi
lea eax, [ebp - 0x214]
push eax
push esi
call fcn.0072b76e
add esp, 0xc
test eax, eax
lea eax, [esi + edi*2]
jne 0x6b28c4
cmp word [eax], 0x5c
jne 0x6b28c4
xor ebx, ebx
inc ebx
jmp 0x6b28c6
xor ebx, ebx
test ebx, ebx
je 0x6b2908
push eax
lea eax, [ebp - 0xc]
push eax
push 0x83accc
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.00514679
add esp, 0x14
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x105
push esi
call fcn.006b2bbf
mov edi, dword [ebp - 0x820]
movzx eax, word [edi]
add edi, 2
test ax, ax
jne 0x6b290e
mov dword [ebp - 0x820], edi
test ebx, ebx
jne 0x6b2931
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x6b2868
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00700c25
leave
ret