joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6640d620
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x44c
mov eax, dword [eax + 0xa8]
mov dword [esp + 4], eax
movzx eax, word [ebx + 0x98]
mov dword [esp], eax
call fcn.6642fb90
mov esi, eax
mov eax, dword [ebx + 0x9c]
mov dword [esp + 4], eax
movzx eax, word [ebx + 0x94]
mov dword [esp], eax
call fcn.6642fb90
mov ebx, eax
test byte [0x664447b0], 8
jne 0x6640d700
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], esi
lea edi, [ebp - 0x428]
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], edi
lea esi, [ebp - 0x220]
mov dword [esp + 0xc], 0xffffffff
mov dword [ebp - 0x42c], edx
mov dword [esp + 4], 0
mov dword [esp], 1
call edx
mov edx, dword [ebp - 0x42c]
sub esp, 0x18
mov dword [esp + 0x10], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0x104
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 1
call edx
sub esp, 0x18
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_MoveFileW]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.RENAME_FILE__s_to__s_n
mov dword [esp + 8], str.INT21_RenameFile
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
call fcn.6640d110
jmp 0x6640d671

Function at 0x6640d740
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x230
mov edx, dword [eax + 0xa8]
mov dword [esp + 4], edx
movzx eax, word [eax + 0x98]
mov dword [esp], eax
call fcn.6642fb90
mov ebx, eax
test byte [0x664447b0], 8
jne 0x6640d800
mov dword [esp + 0x14], 0x104
lea esi, [ebp - 0x210]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
jne 0x6640d7f0
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x34]
cmp edx, 0xb7
je 0x6640d830
cmp edx, 0xce
je 0x6640d830
cmp edx, 0x70
je 0x6640d830
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.CREATE_DIRECTORY__s_n
mov dword [esp + 8], str.INT21_CreateDirectory
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
call fcn.6640d110
jmp 0x6640d773
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], 5
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6640e720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x210]
sub esp, 0x224
mov dword [esp + 4], eax
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
sub esp, 8
test eax, eax
je 0x6640e780
cmp word [ebp - 0x20e], 0x3a
jne 0x6640e780
movzx ebx, word [ebp - 0x210]
lea eax, [ebx - 0x41]
cmp ax, 0x19
jbe 0x6640e7c0
lea eax, [ebx - 0x61]
sub ebx, 0x61
cmp ax, 0x1a
mov eax, 0x1a
cmovae ebx, eax
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov ebx, 0x1a
test byte [0x664447b0], 8
je 0x6640e774
mov dword [esp + 0xc], str.Failed_to_get_current_drive._n
mov dword [esp + 8], str.INT21_GetCurrentDrive
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
call fcn.6640d110
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
sub ebx, 0x41
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x6640e7d0
Capabilities:
Check if file exists
Get file attributes
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x23c
mov edx, dword [eax + 0xa8]
mov dword [esp + 4], edx
movzx eax, word [eax + 0x98]
mov dword [esp], eax
call fcn.6642fb90
mov esi, eax
call fcn.6640e720
mov edi, eax
test byte [0x664447b0], 8
jne 0x6640e898
mov dword [esp + 0x14], 0x104
lea ebx, [ebp - 0x220]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetFullPathNameW]
sub esp, 0x10
test eax, eax
jne 0x6640e870
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x6640e885
test al, 0x10
jne 0x6640e8c8
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 3
jmp 0x6640e865
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.SET_CURRENT_DIRECTORY__s_n
mov dword [esp + 8], str.INT21_SetCurrentDirectory
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
call fcn.6640d110
jmp 0x6640e80b
mov eax, 0x3d
mov dword [esp + 4], ebx
mov word [ebp - 0x228], ax
movzx eax, word [ebp - 0x220]
mov dword [ebp - 0x224], 0x3a
mov word [ebp - 0x226], ax
lea eax, [ebp - 0x228]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
sub esp, 8
test eax, eax
je 0x6640e865
movzx edx, word [ebp - 0x220]
lea ecx, [edx - 0x41]
cmp cx, 0x19
jbe 0x6640e950
lea ecx, [edx - 0x61]
sub edx, 0x61
cmp cx, 0x1a
mov ecx, 0x1a
cmovae edx, ecx
mov ecx, edi
cmp cl, dl
jne 0x6640e867
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
sub esp, 4
jmp 0x6640e867
sub edx, 0x41
jmp 0x6640e92c
Function at 0x6640eb60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test dl, dl
je 0x6640ebb8
movzx eax, dl
mov ebx, edx
mov dword [ebp - 0x1c], 0x3a
add eax, 0x40
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x1e]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
sub esp, 4
cmp eax, 1
jbe 0x6640ec40
sub ebx, 1
movzx edi, bl
mov eax, edi
call fcn.6640cd90
test eax, eax
jne 0x6640ebcd
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.6640e720
movzx edi, al
mov ebx, edi
mov eax, edi
call fcn.6640cd90
test eax, eax
je 0x6640ebab
call fcn.6640cc30
imul edi, edi, 0x3d
add eax, edi
movzx ecx, byte [eax + 0x2b9]
lea edx, [ecx + 1]
mov byte [esi + 0xb0], dl
movzx edx, word [eax + 0x2b7]
mov word [esi + 0xac], dx
movzx eax, word [eax + 0x2c2]
mov word [esi + 0xa8], ax
call fcn.6640cc30
mov edx, 0x3d
movzx eax, word [eax + 0x2b3]
mov dword [esi + 0x98], eax
mov eax, ebx
mul dl
add ax, 0x2cc
mov word [esi + 0xa4], ax
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, 0x1a
mov ebx, 0x1a
jmp 0x6640ebc2
Function at 0x66418150
Capabilities:
Read file on windows

Disassembly:
push ebp
xor ecx, ecx
mov eax, 0x41
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [ebp - 0x26], 0x5c005c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x22], 0x5c002e
mov dword [ebp - 0x1e], 0x3a0041
mov word [ebp - 0x1a], cx
test byte [0x664447c0], 8
jne 0x66418250
movzx edx, bl
mov dword [esp + 0x18], 0
add edx, eax
mov dword [esp + 0x14], 0x2000000
lea eax, [ebp - 0x26]
mov word [ebp - 0x1e], dx
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, dword [ebp + 0x10]
sub esp, 0x1c
mov esi, eax
shl edi, 9
cmp eax, 0xffffffff
je 0x664182a0
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
shl ebx, 9
mov dword [esp + 4], ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [ebp - 0x2c]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], str.abs_diskread__drive__d__sector__ld__count__ld__buffer__p_n
mov dword [esp + 8], str.DOSVM_RawRead
mov dword [esp + 4], 0x664447c0
mov dword [esp], 3
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
movzx eax, bl
mov dword [esp + 0x10], eax
call fcn.664180c0
movzx eax, word [ebp - 0x1e]
jmp 0x66418189
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.ucrtbase.dll_memset
mov edx, dword [ebp + 0x18]
xor eax, eax
test edx, edx
je 0x6641823f
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x664182e8
cmp dword [ebp + 0x10], 1
jbe 0x664182e8
mov eax, dword [ebp + 0x14]
mov byte [eax + 0x200], 0xf8
mov eax, 1
jmp 0x6641823f
cmp dword [ebp + 0xc], 1
mov eax, 1
jne 0x6641823f
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 0xf8
jmp 0x6641823f
Function at 0x664184c0
Capabilities:
Write file on windows

Disassembly:
push ebp
xor ecx, ecx
mov eax, 0x41
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [ebp - 0x16], 0x5c005c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x12], 0x5c002e
mov dword [ebp - 0xe], 0x3a0041
mov word [ebp - 0xa], cx
test byte [0x664447d0], 8
jne 0x664185c0
movzx ebx, bl
mov dword [esp + 0x18], 0
add ebx, eax
mov dword [esp + 0x14], 0
lea eax, [ebp - 0x16]
mov word [ebp - 0xe], bx
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x664185b0
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
shl eax, 9
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [ebp - 0x1c]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x10], 0
shl eax, 9
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 4]
mov eax, 1
sub esp, 4
leave
ret
mov edx, dword [ebp + 0x18]
xor eax, eax
mov ebx, dword [ebp - 4]
leave
test edx, edx
setne al
ret
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], str.abs_diskwrite__drive__d__sector__ld__count__ld__buffer__p_n
mov dword [esp + 8], str.DOSVM_RawWrite
mov dword [esp + 4], 0x664447d0
mov dword [esp], 3
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
movzx eax, bl
mov dword [esp + 0x10], eax
call fcn.66418430
movzx eax, word [ebp - 0xe]
jmp 0x664184f7
Function at 0x664187c0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x66451d54]
test eax, eax
je 0x664187d0
ret
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x4c
mov dword [esp + 4], 0x18
mov dword [esp], 0x40
call sym.krnl386.exe16_GlobalAlloc16
movzx eax, ax
sub esp, 8
mov dword [esp], eax
mov ebx, eax
call sym.krnl386.exe16_GlobalLock16
sub esp, 4
mov dword [ebp - 0x30], eax
mov dword [0x66451d54], eax
mov word [eax + 0x16], bx
jmp 0x6641881c
add esi, 1
cmp esi, 0x1a
je 0x664188d0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x5c3a41
lea ebx, [esi + 0x41]
mov dword [esp], eax
mov byte [ebp - 0x1c], bl
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
sub esp, 4
cmp eax, 5
jne 0x66418810
mov eax, esi
xor edi, edi
mov dword [ebp - 0x34], esi
mov byte [ebp - 0x29], al
jmp 0x66418853
add edi, 1
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], 0x5c3a41
mov byte [ebp - 0x1c], al
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
sub esp, 4
cmp eax, 5
je 0x66418850
mov esi, dword [ebp - 0x34]
mov ebx, edi
test byte [0x664447e0], 8
je 0x664188ae
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.Installation_check:__d_cdroms__starting_at__d_n
mov dword [esp + 8], str.CDROM_FillHeap
mov dword [esp + 4], 0x664447e0
mov dword [esp], 3
call fcn.66418730
mov edx, dword [ebp - 0x30]
movzx eax, byte [ebp - 0x29]
mov byte [edx + 0x15], bl
mov byte [edx + 0x14], al
xor eax, eax
mov word [edx + 0x12], ax
mov eax, dword [0x66451d54]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [0x664447e0]
and eax, 8
mov byte [ebp - 0x29], al
jne 0x664188e8
xor ebx, ebx
jmp 0x664188ae
mov dword [esp + 0x14], 0x1a
xor ebx, ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.Installation_check:__d_cdroms__starting_at__d_n
mov dword [esp + 8], str.CDROM_FillHeap
mov dword [esp + 4], 0x664447e0
mov dword [esp], 3
call fcn.66418730
mov byte [ebp - 0x29], 0
jmp 0x664188ae
Function at 0x6641a9d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov edi, dword [0x66451d58]
test edi, edi
je 0x6641ab00
mov eax, edi
xor ebx, ebx
jmp 0x6641aa13
cmp dword [0x66451d58], edi
jae 0x6641aa0a
test byte [0x664447f0], 1
jne 0x6641aac0
mov ebx, 1
test edx, edx
jne 0x6641aa54
mov eax, dword [0x66451d58]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov edx, eax
sub esp, 0x10
mov eax, dword [0x66451d58]
test edx, edx
je 0x6641aa70
test ebx, ebx
je 0x6641a9f0
cmp ebx, 1
jne 0x6641aa80
cmp edi, eax
ja 0x6641aa05
mov ebx, 2
test edx, edx
je 0x6641aa0e
lea eax, [edx + esi + 0xffff]
xor ax, ax
mov dword [0x66451d58], eax
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, 0x10000
mov dword [0x66451d58], eax
jmp 0x6641aa3e
cmp edi, eax
jbe 0x6641aa4b
xor edx, edx
test byte [0x664447f0], 1
je 0x6641aa63
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.failed_to_allocate_any_memory_of__lu_bytes__n
mov dword [esp + 8], str.DPMI_xalloc
mov dword [esp + 4], 0x664447f0
mov dword [esp], 0
mov dword [ebp - 0x1c], edx
call fcn.6641a940
mov edx, dword [ebp - 0x1c]
jmp 0x6641aa63
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.failed_to_allocate_linearly_growing_memory___lu_bytes___using_non_linear_growing..._n
mov dword [esp + 8], str.DPMI_xalloc
mov dword [esp + 4], 0x664447f0
mov dword [esp], 0
mov dword [ebp - 0x1c], edx
call fcn.6641a940
mov eax, dword [0x66451d58]
mov edx, dword [ebp - 0x1c]
jmp 0x6641aa47
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov edx, eax
jmp 0x6641aa54

Function at 0x6641ed80
Capabilities:
Get system information on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc0]
push ecx
sub esp, 0xd0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
movzx edx, word [ebp - 0xa0]
mov eax, 4
mov dword [ebp - 0x9c], 0x94
sub esp, 4
cmp dx, ax
cmovbe eax, edx
mov eax, dword [eax*4 + 0x6644ca6c]
mov ecx, eax
or eax, 0xc21
or ecx, 0x2c21
cmp dx, 4
mov ebx, ecx
cmovb ebx, eax
lea eax, [ebp - 0x9c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
sub esp, 4
cmp dword [ebp - 0x8c], 2
jne 0x6641edfe
or bh, 0x40
lea esp, [ebp - 8]
mov eax, ebx
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x664256e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
movzx esi, word [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
call sym.krnl386.exe16_GetExePtr
sub esp, 4
movzx eax, ax
mov dword [esp], eax
call sym.krnl386.exe16_GlobalLock16
sub esp, 4
test eax, eax
je 0x66425739
mov ecx, eax
movzx eax, word [eax + 4]
mov edi, ebx
add eax, ecx
jmp 0x66425722
add eax, ecx
movzx edx, word [eax]
cmp dx, di
jae 0x66425730
cmp word [eax + 2], di
jae 0x66425748
movzx eax, word [eax + 4]
test ax, ax
jne 0x66425720
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, bx
add eax, 6
mov dword [ebp - 0x20], ebx
sub ebx, edx
mov edi, ebx
sub edi, 1
test edi, edi
jle 0x6642576d
xor edx, edx
nop
add edx, 1
add eax, 5
movzx ebx, dx
cmp ebx, edi
jl 0x66425760
movzx edx, byte [eax + 2]
movzx ebx, word [eax + 3]
cmp dl, 0xfe
je 0x664257c0
movzx eax, word [ecx + 0x22]
lea edx, [edx + edx*4]
lea edx, [ecx + edx*2]
movzx eax, word [eax + edx - 2]
mov dword [esp], eax
call fcn.66409b70
sub esp, 4
cmp ax, 0xffff
je 0x664257c0
shl eax, 0x10
or eax, ebx
cmp word [ebp - 0x1c], 0
je 0x6642573b
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.664312e0
lea esp, [ebp - 0xc]
mov eax, ebx
or eax, 0xffff0000
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6642a240
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
movzx edx, dx
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov dword [esp], edx
call fcn.664253a0
test eax, eax
je 0x6642a27c
mov edx, dword [esi]
mov ebx, eax
test edx, edx
jle 0x6642a288
mov ecx, dword [esi + 8]
xor eax, eax
jmp 0x6642a277
add eax, 1
cmp eax, edx
je 0x6642a288
cmp dword [ecx + eax*4], ebx
jne 0x6642a270
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebx + 0x37]
test al, al
js 0x6642a27c
test byte [0x66444934], 8
jne 0x6642a380
or eax, 0xffffff80
xor edi, edi
cmp word [ebx + 0x1e], 0
mov byte [ebx + 0x37], al
movzx eax, word [ebx + 0x28]
lea ecx, [ebx + eax]
je 0x6642a2c7
movzx edx, word [ecx + edi*2]
test dx, dx
jne 0x6642a320
movzx eax, word [ebx + 0x1e]
add edi, 1
cmp eax, edi
jg 0x6642a2b3
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, dword [esi + 4]
je 0x6642a330
lea ecx, [eax + 1]
mov dword [esi], ecx
mov dword [edx + eax*4], ebx
movzx eax, byte [0x66444934]
and byte [ebx + 0x37], 0x7f
test al, 8
je 0x6642a27c
movzx eax, word [ebx + 0xa]
mov dword [esp + 0xc], str.__s____END_n
mov dword [esp + 8], str.fill_init_list
mov dword [esp + 4], 0x66444934
lea eax, [ebx + eax + 8]
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.66429340
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
mov dword [ebp - 0x1c], ecx
call fcn.6642a240
mov ecx, dword [ebp - 0x1c]
jmp 0x6642a2bc
lea edi, [eax + 0x80]
lea eax, [edi*4]
test edx, edx
je 0x6642a3b9
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
mov edx, eax
test edx, edx
je 0x6642a3e2
mov eax, dword [esi]
mov dword [esi + 8], edx
mov dword [esi + 4], edi
jmp 0x6642a2d1
movzx eax, word [ebx + 0xa]
mov dword [esp + 0xc], str.__s____START_n
mov dword [esp + 8], str.fill_init_list
mov dword [esp + 4], 0x66444934
mov dword [esp], 3
lea eax, [ebx + eax + 8]
mov dword [esp + 0x10], eax
call fcn.66429340
movzx eax, byte [ebx + 0x37]
jmp 0x6642a29d
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edx, eax
jmp 0x6642a36c
movzx eax, byte [0x66444934]
test al, 1
je 0x6642a2e0
mov dword [esp + 0xc], str.Out_of_memory__n
mov dword [esp + 8], str.add_to_init_list
mov dword [esp + 4], 0x66444934
mov dword [esp], 0
call fcn.66429340
movzx eax, byte [0x66444934]
jmp 0x6642a2e0
Function at 0x6642b0c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x14]
sub esp, 0x24
movzx edx, word [ebp + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.6642a240
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x6642b10b
xor ebx, ebx
lea esi, [esi]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
add ebx, 1
call fcn.6642a430
cmp ebx, dword [ebp - 0x14]
jl 0x6642b0f8
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x6642b137
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x6642b4f0
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp], str.advapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
sub esp, 4
mov dword [0x6645217c], eax
test eax, eax
je 0x6642b652
mov ebx, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esp + 4], str.RegCloseKey
mov dword [esp], eax
call ebx
mov dword [0x664521ac], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegCreateKeyA
mov dword [esp], eax
call ebx
mov dword [0x664521a8], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegDeleteKeyA
mov dword [esp], eax
call ebx
mov dword [0x664521a4], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegDeleteValueA
mov dword [esp], eax
call ebx
mov dword [0x664521a0], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegEnumKeyA
mov dword [esp], eax
call ebx
mov dword [0x6645219c], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegEnumValueA
mov dword [esp], eax
call ebx
mov dword [0x66452198], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegFlushKey
mov dword [esp], eax
call ebx
mov dword [0x66452194], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegOpenKeyA
mov dword [esp], eax
call ebx
mov dword [0x66452190], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegQueryValueA
mov dword [esp], eax
call ebx
mov dword [0x6645218c], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegQueryValueExA
mov dword [esp], eax
call ebx
mov dword [0x66452188], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegSetValueA
mov dword [esp], eax
call ebx
mov dword [0x66452184], eax
mov eax, dword [0x6645217c]
sub esp, 8
mov dword [esp + 4], str.RegSetValueExA
mov dword [esp], eax
call ebx
mov ebx, dword [ebp - 4]
sub esp, 8
mov dword [0x66452180], eax
leave
ret
test byte [0x66444954], 2
jne 0x6642b668
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Unable_to_load_advapi32.dll_n
mov dword [esp + 8], str.init_func_ptrs
mov dword [esp + 4], 0x66444954
mov dword [esp], 1
call fcn.6642b460
jmp 0x6642b65b
Function at 0x6642bc40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, 1
sub esp, 0x1c
mov edi, dword [sym.imp.ucrtbase.dll_wcschr]
jmp 0x6642bc63
add eax, 2
mov dword [esp + 4], 0x3b
add ebx, 1
mov dword [esp], eax
call edi
test eax, eax
jne 0x6642bc60
shl ebx, 2
cmp word [esi], 0
je 0x6642bd20
mov eax, esi
lea esi, [esi]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6642bc90
sub eax, esi
sar eax, 1
lea eax, [ebx + eax + 1]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x6642bd15
lea edx, [eax + ebx]
xor eax, eax
lea esi, [esi]
movzx ecx, word [esi + eax*2]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x6642bcd8
mov esi, dword [sym.imp.ucrtbase.dll_strchr]
xor ebx, ebx
jmp 0x6642bcf6
lea edx, [eax + 1]
mov byte [eax], 0
add ebx, 1
mov dword [edi + ebx*4 - 4], edx
mov dword [esp + 4], 0x3b
mov dword [esp], edx
call esi
test eax, eax
jne 0x6642bcf0
mov dword [edi + ebx*4], 0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x6642bc9d