joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68f02a90
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor ecx, ecx
cmp dword [ebp + 8], ecx
jbe 0x68f02bb2
mov dword [ebp - 4], 1
sub dword [ebp - 4], esi
mov dword [ebp - 8], 2
sub dword [ebp - 8], esi
push ebx
push edi
mov ebx, dword [eax]
lea edi, [ecx + esi]
movzx edx, byte [edi]
shr edx, 2
movzx dx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ebx], dx
mov edx, dword [ebp - 4]
add dword [eax], 2
add edx, edi
cmp edx, dword [ebp + 8]
je 0x68f02b55
mov dl, byte [edi]
movzx ebx, byte [ecx + esi + 1]
and dl, 3
shl dl, 4
movzx edx, dl
shr ebx, 4
or edx, ebx
movzx bx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [eax]
mov word [edx], bx
mov ebx, dword [ebp - 8]
add dword [eax], 2
mov edx, dword [eax]
add ebx, edi
cmp ebx, dword [ebp + 8]
je 0x68f02b85
mov bl, byte [ecx + esi + 1]
and bl, 0xf
shl bl, 2
movzx edi, bl
movzx ebx, byte [ecx + esi + 2]
shr ebx, 6
or edi, ebx
movzx di, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [edx], di
add dword [eax], 2
movzx edx, byte [ecx + esi + 2]
mov edi, dword [eax]
and edx, 0x3f
movzx dx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [edi], dx
add dword [eax], 2
add ecx, 3
cmp ecx, dword [ebp + 8]
jb 0x68f02ab6
jmp 0x68f02bb0
mov cl, byte [ecx + esi]
and cl, 3
shl cl, 4
movzx ecx, cl
movzx dx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [eax]
mov word [ecx], dx
add dword [eax], 2
cmp byte [ebp + 0xc], 0
mov ecx, dword [eax]
je 0x68f02bb0
mov word [ecx], 0x3d
add dword [eax], 2
mov ecx, dword [eax]
jmp 0x68f02ba8
mov cl, byte [ecx + esi + 1]
and cl, 0xf
shl cl, 2
movzx ecx, cl
movzx cx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [edx], cx
add dword [eax], 2
cmp byte [ebp + 0xc], 0
mov ecx, dword [eax]
je 0x68f02bb0
mov word [ecx], 0x3d
add dword [eax], 2
pop edi
pop ebx
leave
ret 8

Function at 0x68f02dcb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi], 0xffffffff
push 0x80004005
sete al
push 0x2e68367a
push eax
call fcn.68ef3ed8
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x68f02e39
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
test eax, eax
mov dword [esi], eax
jne 0x68f02e19
or dword [esi], 0xffffffff
leave
ret 0xc
Function at 0x68f0333c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x666
cmp dword [ebp + 8], edi
jne 0x68f03391
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0xbb8
push 0x668
push dword [esi + 4]
call edi
push 0
push 0x7d
push 0x667
push dword [esi + 4]
call edi
mov byte [esi + 0x5c], 0
mov dword [esi + 0x44], 3
jmp 0x68f033fd
cmp dword [ebp + 8], 0x667
jne 0x68f033d1
mov eax, dword [0x68fac0c4]
push 0x1e
pop ecx
cdq
idiv ecx
inc dword [0x68fac0c4]
push 0
push edx
push dword [esi + 0x54]
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
push 0
push eax
push 0x170
push dword [esi + 0x58]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x68f033fd
mov eax, 0x668
cmp dword [ebp + 8], eax
jne 0x68f033fd
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [esi + 0x44], 2
mov byte [esi + 0x5c], 1
jne 0x68f033fd
mov eax, esi
mov dword [esi + 0x44], 3
call fcn.68f0300f
pop edi
pop ebp
ret 4
Function at 0x68f08b5d
Capabilities:
Terminate process

Disassembly:
push 0x24
mov eax, 0x68f5f422
call fcn.68f54c95
xor ebx, ebx
push ebx
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCCriticalErrorInfo::StartErrorBlock_bool_
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp byte [ebp + 0xc], bl
je 0x68f08b98
test byte [0x68fa87d8], 0x10
je 0x68f08b98
push 0x666
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [ebp + 8]
test byte [0x68fa87d8], 1
je 0x68f08baa
push esi
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCCSM::ReportErrorCSM_class_GCError_const__
test byte [0x68fa87d8], 2
je 0x68f08bb9
push esi
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCErrorServices::HandleErrorThroughSystemEventLog_class_GCError_const__
cmp byte [ebp + 0xc], bl
je 0x68f08c3d
mov eax, dword [esi]
mov ecx, SysReAllocString
and eax, ecx
cmp eax, ecx
jne 0x68f08c3d
mov al, byte [0x68fa87d8]
test al, 4
jne 0x68f08be8
test al, 8
je 0x68f08c3d
mov edi, dword [sym.GrooveUtil.DLL_unsigned_long_int_GCGrooveThreadId::ms_MainSTAThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, edi
jne 0x68f08c3d
push 1
lea ecx, [ebp + 0xc]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCAutoWaitCursor::constructor_bool_
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], bl
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 5
lea ebx, [ebp - 0x30]
call fcn.68f08935
mov byte [ebp - 4], 6
mov byte [ebp - 4], 2
mov eax, ebx
push eax
call fcn.68f08ac6
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCAutoWaitCursor::destructor_void_
xor ebx, ebx
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCCriticalErrorInfo::EndErrorBlock_void_
call fcn.68f54d3a
ret 8
Function at 0x68f09a16
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f59320
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1144
call fcn.68f54e20
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x1140], eax
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x1158]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x12c]
push eax
call fcn.68f0a872
xor ebx, ebx
mov dword [esp + 0x1160], ebx
cmp esi, ebx
je 0x68f09adc
push 1
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call sym.GrooveUtil.DLL_public:_class_GCStrRetVal___thiscall_GCError::OpenErrorMessage_bool_
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov byte [esp + 0x1160], 1
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x12c]
mov edi, eax
je 0x68f09abe
push eax
call fcn.68ef25a7
push eax
push edi
lea ecx, [esp + 0x134]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStackStrBase::Set_wchar_t_const__const__unsigned_long_int_
mov byte [esp + 0x1160], bl
cmp dword [esp + 0x10], ebx
je 0x68f09ad4
lea ecx, [esp + 0x10]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
push ebx
mov ecx, esi
call sym.GrooveUtil.DLL_public:_void___thiscall_GCError::Report_bool_const
cmp dword [ebp + 0xc], ebx
je 0x68f09b56
call sym.GrooveUtil.DLL_public:_static_struct_HINSTANCE______stdcall_GCGrooveResourceModule::GetHandle_void_
push eax
push 0x2d53
lea eax, [esp + 0x24]
push eax
call fcn.68f08ee6
mov byte [esp + 0x1160], 2
call sym.GrooveUtil.DLL_public:_static_struct_HINSTANCE______stdcall_GCGrooveResourceModule::GetHandle_void_
push eax
push dword [ebp + 0xc]
lea eax, [esp + 0x944]
push eax
call fcn.68f0a82e
mov byte [esp + 0x1160], 3
push 0x186a02
push dword [esp + 0x940]
push dword [esp + 0x24]
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCMso::DoAlert_wchar_t_const___wchar_t_const___unsigned_long_int_
mov byte [esp + 0x1160], 2
lea eax, [esp + 0x93c]
push eax
call fcn.68f08ae9
mov byte [esp + 0x1160], bl
lea ecx, [esp + 0x1c]
call fcn.68ef3ef5
cmp byte [ebp + 0x10], bl
je 0x68f09b71
cmp dword [esp + 0x14], ebx
je 0x68f09b6c
push dword [esp + 0x14]
call sym.GrooveUtil.DLL_public:_static_int___stdcall_GCMso::InvokeCrashWatson_struct__EXCEPTION_POINTERS__
jmp 0x68f09b71
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCMso::InvokeCrashWatson_void_
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or dword [esp + 0x1160], 0xffffffff
lea eax, [esp + 0x12c]
push eax
call fcn.68f08ae9
mov ecx, dword [esp + 0x1158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1140]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 0x14
Function at 0x68f0b22a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x68f6edd8]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x68f0b36b
push esi
push edi
xor esi, esi
mov dword [ebp - 0x43c], esi
lea edi, [ebp - 0x438]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x42c], 0xc
lea edi, [ebp - 0x428]
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x47c]
push esi
push eax
mov dword [ebp - 0x480], 0x44
call sub.MSVCR80.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, 0x208
push edi
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x41a]
push esi
push eax
mov word [ebp - 0x41c], si
call sub.MSVCR80.dll_memset
push edi
lea eax, [ebp - 0x20e]
push esi
push eax
mov word [ebp - 0x210], si
call sub.MSVCR80.dll_memset
add esp, 0x18
lea eax, [ebp - 0x41c]
push eax
call fcn.68f0b377
test eax, eax
je 0x68f0b369
push ebx
push esi
xor edi, edi
push esi
inc edi
push edi
lea eax, [ebp - 0x42c]
push eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
push ebx
push dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x480]
push eax
push esi
push esi
push esi
push edi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x68f0b365
push dword [ebp - 0x43c]
call esi
push dword [ebp - 0x438]
call esi
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call esi
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68f53fd7
leave
ret

Function at 0x68f0b377
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionAeDebug
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x68f0b3d7
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x20a
push esi
push esi
push str.Debugger
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
sete al
pop edi
mov esi, eax
mov eax, esi
pop esi
leave
ret 4
Function at 0x68f0b681
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 4
push edi
mov esi, eax
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x24]
push 3
push 0xc0000000
push eax
add ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x68f0b6bc
xor eax, eax
jmp 0x68f0b7f7
push edi
push ebx
push edi
push 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x68f0b6db
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x68f0b6b5
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x68f0b700
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 4]
call esi
jmp 0x68f0b6b5
push dword [esi + 0x24]
push dword [esi + 0x20]
push ebx
push eax
call dword [sym.imp.MSVCR80.dll_memcpy_s]
add esp, 0x10
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x68f0b74c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
call edi
push dword [ebp - 4]
call edi
jmp 0x68f0b6b5
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 4]
push eax
mov dword [esi + 0x20], eax
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi + 8]
call edi
push dword [esi + 4]
call edi
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x68f0b6b5
mov eax, dword [esi + 0x14]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x68f0b6b5
push ebx
push dword [esi + 0x24]
push ebx
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, ebx
mov dword [esi + 8], eax
jne 0x68f0b7d4
push dword [esi + 4]
call edi
or dword [esi + 4], 0xffffffff
jmp 0x68f0b6b5
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [esi + 0x20], eax
jne 0x68f0b7f1
push dword [esi + 8]
call edi
mov dword [esi + 8], ebx
jmp 0x68f0b7c6
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x68f0e4ba
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x68f0e4d7
mov edx, eax
shr edx, 4
and dl, 1
mov byte [ecx], dl
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret 8

Function at 0x68f0e4eb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5de28
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x248], ebx
cmp esi, ebx
je 0x68f0e54e
cmp word [esi], bx
jne 0x68f0e569
lea eax, [esp + 0x20]
push eax
call sym.GrooveUtil.DLL_public:_static_class_GCStrRetVal___stdcall_GCFileInterface::GetTemporaryPath_void_
mov esi, dword [eax]
lea ecx, [esp + 0x14]
call fcn.68ef1154
mov dword [esp + 0x14], esi
jmp 0x68f0e579
push esi
call sym.GrooveUtil.DLL_public:_static_void___stdcall_GCFileInterface::CreateDirectories_wchar_t_const__
push esi
lea ecx, [esp + 0x18]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::Set_wchar_t_const__
lea eax, [esp + 0x24]
push eax
push ebx
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, ebx
jne 0x68f0e5b5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x68f0e59e
call esi
jmp 0x68f0e5aa
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e746e
call fcn.68ef1014
mov dword [esp + 0x18], ebx
mov byte [esp + 0x248], 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::Set_wchar_t_const__
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esi], eax
mov byte [esp + 0x248], bl
cmp dword [esp + 0x18], ebx
je 0x68f0e5f3
lea ecx, [esp + 0x18]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
or dword [esp + 0x248], 0xffffffff
cmp dword [esp + 0x14], ebx
je 0x68f0e60a
lea ecx, [esp + 0x14]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 0xc

Function at 0x68f0ed52
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
call fcn.68ef25a7
cmp eax, 0x104
jbe 0x68f0ed67
and word [esi + 0x208], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret
Function at 0x68f0ed79
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x68f0edb6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x68f0ed9e
call esi
jmp 0x68f0edaa
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e7474
call fcn.68ef1014
pop esi
mov eax, edi
shr eax, 4
not eax
and eax, 1
pop edi
pop ebp
ret 4

Function at 0x68f0edc5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x68f0ee02
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x68f0edea
call esi
jmp 0x68f0edf6
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e7475
call fcn.68ef1014
pop esi
mov eax, edi
shr eax, 4
and eax, 1
pop edi
pop ebp
ret 4
Function at 0x68f12f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp eax, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x9e3779b9
mov dword [ebp - 4], eax
mov ebx, edi
jb 0x68f13048
push 0xc
pop ecx
xor edx, edx
div ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x10], eax
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, edi
shl eax, 8
lea edi, [edx + eax]
movzx eax, byte [ecx + 0xb]
movzx edx, byte [ecx + 0xa]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, esi
shl eax, 8
lea esi, [edx + eax]
movzx edx, byte [ecx + 3]
movzx eax, byte [ecx + 2]
shl edx, 8
add edx, eax
movzx eax, byte [ecx + 1]
shl edx, 8
add edx, eax
movzx eax, byte [ecx]
shl edx, 8
add edx, eax
sub edx, esi
sub edx, edi
sub edi, esi
mov eax, esi
shr eax, 0xd
add edx, ebx
xor edx, eax
sub edi, edx
mov eax, edx
shl eax, 8
xor edi, eax
sub esi, edi
sub esi, edx
mov eax, edi
shr eax, 0xd
xor esi, eax
sub edx, esi
sub edx, edi
mov eax, esi
shr eax, 0xc
xor edx, eax
sub edi, esi
sub edi, edx
mov eax, edx
shl eax, 0x10
xor edi, eax
sub esi, edi
sub esi, edx
mov eax, edi
shr eax, 5
xor esi, eax
sub edx, esi
mov eax, esi
shr eax, 3
sub edx, edi
xor edx, eax
sub edi, esi
mov ebx, edx
mov eax, ebx
shl eax, 0xa
sub edi, ebx
xor edi, eax
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 0xf
xor esi, eax
add ecx, 0xc
sub dword [ebp - 4], 0xc
dec dword [ebp + 0x10]
jne 0x68f12f6d
jmp 0x68f1304b
mov ecx, dword [ebp + 8]
add esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
dec eax
cmp eax, 0xa
ja case.default.0x68f13057
jmp dword [eax*4 + 0x68f13124]
movzx eax, byte [ecx + 0xa]
shl eax, 0x18
add esi, eax
movzx eax, byte [ecx + 9]
shl eax, 0x10
add esi, eax
movzx eax, byte [ecx + 8]
shl eax, 8
add esi, eax
movzx eax, byte [ecx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ecx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ecx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ecx + 4]
add edi, eax
movzx eax, byte [ecx + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [ecx + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [ecx + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [ecx]
add ebx, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov eax, esi
shr eax, 0xd
xor ebx, eax
sub edi, ebx
mov eax, ebx
shl eax, 8
xor edi, eax
sub esi, edi
sub esi, ebx
mov eax, edi
shr eax, 0xd
xor esi, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov eax, esi
shr eax, 0xc
xor ebx, eax
sub edi, ebx
mov eax, ebx
shl eax, 0x10
xor edi, eax
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 5
xor esi, eax
mov eax, esi
sub ebx, eax
sub ebx, edi
mov ecx, eax
shr ecx, 3
xor ebx, ecx
sub edi, eax
sub edi, ebx
mov ecx, ebx
shl ecx, 0xa
xor edi, ecx
sub eax, edi
sub eax, ebx
shr edi, 0xf
xor eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x68f1668d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
push edi
mov byte [ebp - 1], 1
jne 0x68f166d7
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
jmp 0x68f166fe
shr eax, 2
test al, 1
je 0x68f16707
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x68f1673a
push ebx
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x28]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x68f16739
or byte [esi + 0x58], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebx
mov al, byte [ebp - 1]
pop edi
leave
ret