joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6580e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3f8
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
cmp esi, ebp
push edi
mov ebx, edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], 0x104
je 0x65832f
cmp ebx, 0xa
jl 0x65832f
mov ecx, ebx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, 0x64
lea ecx, [esp + 0xf8]
call fcn.0064cf50
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.0064d620
mov edx, 0x64
lea ecx, [esp + 0x298]
call fcn.0064d7c0
mov edx, 0x64
lea ecx, [esp + 0x1c8]
call fcn.0064d8e0
mov edx, 0x64
lea ecx, [esp + 0x90]
call fcn.0064c7d0
mov edx, 0x64
lea ecx, [esp + 0x160]
call fcn.0064ca10
mov edx, 0x64
lea ecx, [esp + 0x230]
call fcn.0064da40
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebp
lea ecx, [esp + 0x104]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658322
mov eax, dword [esp + 0x14]
test eax, eax
je 0x658322
cmp ebp, 0xff
jae 0x65830d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x300]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x314]
push ecx
push ebp
push edx
mov dword [esp + 0x3c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc ebp
cmp eax, 0x103
je 0x65830d
test eax, eax
jne 0x6581d3
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x6581d3
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x30c]
push ecx
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6581d3
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6581d3
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6582fd
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x6582fd
push ebx
push esi
lea edx, [esp + 0x2a0]
call fcn.00657d30
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x1d0]
call fcn.00657d30
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x98]
call fcn.00657d30
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x168]
call fcn.00657d30
mov ecx, dword [esp + 0x10]
push ebx
push esi
lea edx, [esp + 0x238]
call fcn.00657d30
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6581d3
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x658830
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x104
jne 0x658865
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x20]
call fcn.006505f0
cmp esi, 0xff
jae 0x65893b
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x9c]
push edx
push esi
push ebx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x65893b
test eax, eax
jne 0x658873
mov eax, dword [esp + 0x10]
test eax, eax
je 0x658873
movsx eax, byte [esp + 0x88]
push eax
call fcn.006978f7
add esp, 4
test eax, eax
je 0x658873
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x94]
push edx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658873
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x658873
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x14]
push eax
push edx
lea edx, [esp + 0x28]
call fcn.00657d30
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x658873
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x658950
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
jne 0x658980
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0xff
jae 0x658a1d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push esi
push ebx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x658a1d
test eax, eax
jne 0x658980
mov eax, dword [esp + 0x10]
test eax, eax
je 0x658980
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658980
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x658980
mov edx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x18]
call fcn.00658830
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x658980
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x658a30
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x104
jne 0x658a65
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, 0x64
lea ecx, [esp + 0x20]
call fcn.006505f0
cmp esi, 0xff
jae 0x658b4d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x9c]
push edx
push esi
push ebx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x658b4d
test eax, eax
jne 0x658a73
mov eax, dword [esp + 0x10]
test eax, eax
je 0x658a73
movsx eax, byte [esp + 0x88]
push eax
call fcn.006978f7
add esp, 4
test eax, eax
je 0x658a73
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x94]
push edx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658a73
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x658a73
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0x14]
push edi
push eax
lea edx, [esp + 0x28]
call fcn.00657d30
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edi
call fcn.00658950
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x658a73
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x658b60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp ebx, esi
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
jne 0x658b90
mov eax, 0x325
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0xff
jae 0x658c2d
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push esi
push ebx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x658c2d
test eax, eax
jne 0x658b90
mov eax, dword [esp + 0x10]
test eax, eax
je 0x658b90
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658b90
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x658b90
mov edx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x18]
call fcn.00658a30
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x658b90
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x658c40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1f0
push ebx
push ebp
push esi
push edi
mov ebp, edx
xor esi, esi
mov ebx, ecx
cmp ebx, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0x104
je 0x658ddb
cmp ebp, 0xa
jl 0x658ddb
mov ecx, ebp
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, 0x64
lea ecx, [esp + 0x90]
call fcn.0064db30
mov edx, 0x64
lea ecx, [esp + 0x28]
call fcn.006505f0
lea eax, [esp + 0x14]
push eax
push 0x20019
push esi
lea ecx, [esp + 0x9c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658dce
mov eax, dword [esp + 0x14]
test eax, eax
je 0x658dce
lea ebx, [ebx]
cmp esi, 0xff
jae 0x658db9
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0xf8]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x10c]
push ecx
push esi
push edx
mov dword [esp + 0x3c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
cmp eax, 0x103
je 0x658db9
test eax, eax
jne 0x658ce0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x658ce0
movsx eax, byte [esp + 0xf8]
push eax
call fcn.006978f7
add esp, 4
test eax, eax
je 0x658ce0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x104]
push edx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x658ce0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x658ce0
push ebp
push ebx
lea edx, [esp + 0x30]
call fcn.00657d30
mov ecx, dword [esp + 0x18]
push ebp
mov edx, ebx
call fcn.00658b60
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x658ce0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x338
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x325
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x65f486
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x65f4dc
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6b93e6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x65f4cf
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x65f4de
xor eax, eax
pop esi
leave
ret 4

Function at 0x661da0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret
Function at 0x676d90
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x696e81
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x7ed75c], esi
push edi
jne 0x696ea1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x7ed758], esi
mov byte [0x7ed754], al
jne 0x696f07
mov ecx, dword [0x7ef60c]
test ecx, ecx
je 0x696ee8
mov eax, dword [0x7ef608]
sub eax, 4
cmp eax, ecx
jmp 0x696ee1
mov eax, dword [eax]
test eax, eax
je 0x696ed3
call eax
mov eax, dword [0x7ef608]
sub eax, 4
cmp eax, dword [0x7ef60c]
mov dword [0x7ef608], eax
jae 0x696ecb
mov eax, 0x6e82c8
mov esi, 0x6e82d4
cmp eax, esi
mov edi, eax
jae 0x696f07
mov eax, dword [edi]
test eax, eax
je 0x696f00
call eax
add edi, 4
cmp edi, esi
jb 0x696ef8
mov eax, 0x6e82d8
mov esi, 0x6e82e0
cmp eax, esi
mov edi, eax
jae 0x696f26
mov eax, dword [edi]
test eax, eax
je 0x696f1f
call eax
add edi, 4
cmp edi, esi
jb 0x696f17
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x696f40
push dword [ebp + 8]
mov dword [0x7ed75c], 1
call fcn.00696de7
pop ebp
ret

Function at 0x69b600
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x6fa3d0]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x6fa3e8]
je 0x69b637
inc eax
cmp eax, 0x13
jb 0x69b628
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x6fa3e8]
jne 0x69b75a
mov eax, dword [0x7ed708]
cmp eax, 1
je 0x69b735
cmp eax, edx
jne 0x69b667
cmp dword [0x6fa0e4], 1
je 0x69b735
cmp ecx, 0xfc
je 0x69b75a
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x69b69d
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.0069d510
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.0069a0e0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x69b6d1
mov eax, edi
push eax
call fcn.0069a0e0
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x6e24fc
push edi
call fcn.006975d0
add esp, 0x10
push edi
call fcn.0069a0e0
push dword [esi + 0x6fa3ec]
mov ebx, eax
call fcn.0069a0e0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00696350
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0069d510
push edi
push ebx
call fcn.0069d520
push 0x6bbb6c
push ebx
call fcn.0069d520
push dword [esi + 0x6fa3ec]
push ebx
call fcn.0069d520
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0069f26b
add esp, 0x2c
jmp 0x69b75a
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x6fa3ec]
push dword [esi]
call fcn.0069a0e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.0069a22c
add ebp, 0x90
leave
ret
Function at 0x69d6e6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x7ee4a0]
push edi
jae 0x69d8bd
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x7ee4c0]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x69d8bd
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x69d791
test dl, 2
jne 0x69d791
test dl, 0x48
je 0x69d75b
cmp byte [eax + 5], 0xa
je 0x69d75b
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x69d7a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x69d78c
mov dword [0x7ed714], ecx
jmp 0x69d8c4
cmp eax, 0x6d
jne 0x69d798
xor eax, eax
jmp 0x69d8d1
push eax
call fcn.0069eafb
pop ecx
jmp 0x69d8ce
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x69d8b8
test eax, eax
je 0x69d7cb
cmp byte [ebx], 0xa
jne 0x69d7cb
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x69d7d4
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x69d8b2
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x69d8a2
cmp al, 0xd
je 0x69d806
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x69d894
dec ecx
cmp dword [ebp - 8], ecx
jae 0x69d820
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x69d81b
add dword [ebp - 8], 2
jmp 0x69d874
mov dword [ebp - 8], eax
jmp 0x69d890
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x69d848
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x69d890
cmp dword [ebp - 0x10], 0
je 0x69d890
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x69d869
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x69d874
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x69d893
cmp ebx, dword [ebp + 0xc]
jne 0x69d879
cmp byte [ebp - 1], 0xa
jne 0x69d879
mov byte [ebx], 0xa
jmp 0x69d893
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.006a0129
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x69d894
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x69d7ea
jmp 0x69d8b2
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x69d8b2
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x69d8d1
and dword [0x7ed714], 0
mov dword [0x7ed710], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x69d8d6
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x6fa3d0]
mov ecx, dword [ebp + 0x3ac]
push ebx
push esi
xor eax, ebp
cmp ecx, dword [0x7ee4a0]
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x78], edi
jae 0x69da78
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x7ee4c0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x69da78
and dword [ebp - 0x70], 0
and dword [ebp - 0x7c], 0
cmp dword [ebp + 0x3b4], 0
jne 0x69d94c
xor eax, eax
jmp 0x69da8c
test al, 0x20
je 0x69d95f
push 2
push 0
push 0
push ecx
call fcn.006a0129
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x69d9f4
and dword [ebp - 0x68], 0
cmp dword [ebp + 0x3b4], 0
mov dword [ebp - 0x6c], edi
jbe 0x69da55
mov ecx, dword [ebp - 0x6c]
xor edi, edi
sub ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x69d9b9
mov edx, dword [ebp - 0x6c]
inc dword [ebp - 0x6c]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x69d9aa
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x69d98c
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x69da19
mov eax, dword [ebp - 0x74]
add dword [ebp - 0x70], eax
cmp eax, edi
jl 0x69da22
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x78]
cmp eax, dword [ebp + 0x3b4]
jb 0x69d981
jmp 0x69da22
push 0
lea ecx, [ebp - 0x74]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x69da19
mov eax, dword [ebp - 0x74]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x70], eax
jmp 0x69da22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x69da73
cmp dword [ebp - 0x68], eax
je 0x69da52
push 5
pop eax
cmp dword [ebp - 0x68], eax
jne 0x69da47
mov dword [0x7ed710], 9
mov dword [0x7ed714], eax
jmp 0x69da89
push dword [ebp - 0x68]
call fcn.0069eafb
pop ecx
jmp 0x69da89
mov edi, dword [ebp - 0x78]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x69da67
cmp byte [edi], 0x1a
je 0x69d945
mov dword [0x7ed710], 0x1c
jmp 0x69da82
sub eax, dword [ebp - 0x7c]
jmp 0x69da8c
mov dword [0x7ed710], 9
and dword [0x7ed714], 0
or eax, 0xffffffff
mov ecx, dword [ebp + 0x3a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0069a22c
add ebp, 0x3a4
leave
ret
Function at 0x69db87
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x69dbb5
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x69dbbc
cmp ebx, dword [eax + 4]
jae 0x69dbbc
xor eax, eax
jmp 0x69ddac
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x69dbcd
xor eax, eax
inc eax
jmp 0x69ddab
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x69dbe3
cmp ecx, edx
jae 0x69dd28
cmp dword [eax + 4], 0
je 0x69dbec
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x69dbd4
cmp dword [ebp + 8], 0
je 0x69dc0e
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x69dd28
cmp eax, esi
jae 0x69dd28
mov eax, dword [0x7ed9f0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x69dc33
cmp dword [esi*4 + 0x7ed9f8], edi
je 0x69dd2c
inc esi
cmp esi, eax
jl 0x69dc21
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x69dda8
cmp dword [ebp - 8], 0x1000000
jne 0x69dda8
test byte [ebp - 0xc], 0xcc
je 0x69dcb1
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x69dda8
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x69dda8
cmp word [eax + 0x18], 0x10b
jne 0x69dda8
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x69dda8
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x69dcb1
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x69dcb1
test byte [ecx + 0x27], 0x80
jne 0x69dd28
push 1
push 0x7eda38
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x69dbc5
mov ecx, dword [0x7ed9f0]
test ecx, ecx
mov edx, ecx
jle 0x69dce5
lea eax, [ecx*4 + 0x7ed9f4]
cmp dword [eax], edi
je 0x69dce5
dec edx
sub eax, 4
test edx, edx
jg 0x69dcd9
test edx, edx
jne 0x69dd16
push 0xf
pop ebx
cmp ecx, ebx
jg 0x69dcf2
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x69dd0a
lea eax, [edx*4 + 0x7ed9f8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x69dcf8
cmp ecx, 0x10
jge 0x69dd16
inc ecx
mov dword [0x7ed9f0], ecx
push 0
push 0x7eda38
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x69dbc5
xor eax, eax
jmp 0x69ddab
test esi, esi
jle 0x69dbc5
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x7eda38
call ebx
test eax, eax
jne 0x69dbc5
cmp dword [esi*4 + 0x7ed9f8], edi
je 0x69dd82
mov eax, dword [0x7ed9f0]
lea esi, [eax - 1]
test esi, esi
jl 0x69dd70
cmp dword [esi*4 + 0x7ed9f8], edi
je 0x69dd6c
dec esi
jns 0x69dd60
test esi, esi
jge 0x69dd80
cmp eax, 0x10
jge 0x69dd7b
inc eax
mov dword [0x7ed9f0], eax
lea esi, [eax - 1]
jmp 0x69dd82
je 0x69dd9a
xor ecx, ecx
test esi, esi
jl 0x69dd9a
lea eax, [ecx*4 + 0x7ed9f8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x69dd88
push 0
push 0x7eda38
call ebx
jmp 0x69dbc5
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret