joyce8/EMBER2024-capa huggingface dataset:
Function at 0x638380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x63840f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, esi
call fcn.00424e30
test al, al
je 0x6383be
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040abb8
jmp 0x6383c6
lea eax, [ebp - 4]
call fcn.00638344
lea eax, [ebp - 0x20c]
push eax
xor bl, 1
movzx eax, bl
push eax
push 0x638420
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
mov eax, edi
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040b8b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638416
lea eax, [ebp - 4]
call fcn.0040a790
ret

Function at 0x6384a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x63855c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004257c4
mov edx, dword [ebp - 4]
mov eax, 0x638578
call fcn.004c5a3c
test al, al
je 0x6384e9
lea eax, [ebp - 4]
mov ecx, 8
mov edx, 1
call fcn.0040bc7c
jmp 0x63850c
mov edx, dword [ebp - 4]
mov eax, 0x638598
call fcn.004c5a3c
test al, al
je 0x63850c
lea eax, [ebp - 4]
mov ecx, 4
mov edx, 1
call fcn.0040bc7c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00425660
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042c2e4
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.0040abb8
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_GetDriveTypeW
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638563
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a7f0
ret

Function at 0x6396c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x6396eb
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x8ba270]
shr edx, 8
and edx, 0xffffff
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x6396cc
mov dword [eax], edx
pop esi
pop ebx
ret

Function at 0x63b1a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x63b1c8
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov edi, dword [0x8c06d8]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x63b1ad
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x63fde4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63fe2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x30]
call fcn.0063ec1c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63fe31
lea eax, [ebp - 4]
call fcn.0040a790
ret
Function at 0x641e78
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x641f95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408ac4
inc dword [ebx + 0x10]
cmp dword [ebx + 0x2c], 0
jne 0x641ebe
cmp dword [ebx + 0x28], 0
jbe 0x641ef8
jmp 0x641ec0
jle 0x641ef8
mov esi, dword [ebx + 4]
lea ecx, [ebp - 0xc]
mov edx, dword [ebx + 0x10]
mov eax, ebx
call fcn.00641858
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
call fcn.0040b7f8
push eax
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x14]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x641f5a
cmp word [ebx + 0x32], 0
je 0x641f39
mov byte [ebp - 1], 0
lea ecx, [ebp - 1]
mov edx, ebx
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
cmp byte [ebp - 1], 0
je 0x641f25
mov dl, 1
mov eax, dword [0x634058]
call fcn.006369e0
call fcn.00409e94
mov eax, dword [ebx + 4]
call fcn.006385a4
cmp edx, 0xffffffff
jne 0x641f35
cmp eax, 0xffffffff
je 0x641f03
jmp 0x641f4a
mov dl, 1
mov eax, dword [0x634058]
call fcn.006369e0
call fcn.00409e94
mov eax, dword [ebx + 4]
call fcn.00638428
mov edx, dword [ebx + 0x10]
call fcn.00639b88
push 0xff20
mov ecx, dword [ebx + 4]
mov dl, 1
mov eax, dword [0x4817c0]
call fcn.004a2a38
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x641f9c
lea eax, [ebp - 0xc]
call fcn.0040a790
ret
Function at 0x6551b8
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
mov ebx, edx
mov esi, ecx
dec esi
test esi, esi
jl 0x655240
inc esi
mov eax, dword [ebp - 8]
and eax, 0xffff
or eax, 2
movzx edx, byte [ebx]
mov ecx, 1
xor ecx, eax
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [ebx], dl
movzx eax, byte [ebx]
mov edx, dword [ebp - 0x10]
call fcn.006396f0
mov edi, eax
mov dword [ebp - 0x10], edi
and edi, 0xff
add dword [ebp - 0xc], edi
imul edi, dword [ebp - 0xc], 0x8088405
inc edi
mov dword [ebp - 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebp - 8]
call fcn.006396f0
mov dword [ebp - 8], eax
inc ebx
dec esi
jne 0x6551e9
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x10], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x655264
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov edx, ecx
mov eax, ebx
call fcn.006552f8
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, 1
xor edx, eax
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
movzx eax, byte [esi]
call fcn.006396f0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396f0
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x655288
movzx eax, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6552f8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [ebp - 4]
test eax, eax
je 0x655325
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x65536e
mov edi, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.006396f0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396f0
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x655330
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x655508
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00655790
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov eax, pe_nt_image_headers32
call fcn.00407638
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.006396f0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396f0
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x65552d
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00655790
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [edi]
call fcn.006396f0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396f0
mov dword [ebx + 0x10], eax
mov eax, esi
xor byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x6555ab
movzx eax, byte [ebp + 0xa]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.006396f0
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396f0
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x12], al
movzx eax, byte [ebp + 0xb]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.006396f0
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396f0
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x11], al
mov byte [ebx + 4], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6556e4
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
mov esi, edx
mov edi, ecx
dec edi
test edi, edi
jl 0x65576d
inc edi
mov eax, dword [ebp - 8]
and eax, 0xffff
or eax, 2
movzx ebx, byte [esi]
mov edx, ebx
mov ecx, 1
xor ecx, eax
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [esi], dl
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.006396f0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0xff
add dword [ebp - 0xc], eax
imul ebx, dword [ebp - 0xc], 0x8088405
inc ebx
mov dword [ebp - 0xc], ebx
mov eax, ebx
shr eax, 0x18
mov edx, dword [ebp - 8]
call fcn.006396f0
mov dword [ebp - 8], eax
inc esi
dec edi
jne 0x655715
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x10], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x655790
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [ebp - 4]
test eax, eax
je 0x6557bd
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x655806
mov edi, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.006396f0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006396f0
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x6557c8
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6560ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x28]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jle 0x656109
inc eax
mov edx, dword [ebx + 0x18]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jl 0x656149
inc esi
mov dword [ebp - 0x10], esi
shl edx, 5
movzx esi, byte [eax + 2]
xor edx, esi
and edx, 0x3fff
mov esi, dword [ebx + 0x5c]
and esi, eax
mov edi, dword [ebp - 0xc]
lea edi, [edi + esi*4]
mov esi, dword [ecx + edx*4]
mov dword [edi], esi
mov dword [ecx + edx*4], eax
inc eax
dec dword [ebp - 0x10]
jne 0x656121
mov esi, dword [ebp - 0xc]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x656181
mov eax, dword [ebp - 4]
add dword [ebx + 0x44], eax
mov eax, dword [ebp - 4]
add dword [ebx + 0x48], eax
cmp byte [ebx + 0x34], 0
je 0x65619b
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x65619b
mov eax, ebx
call fcn.00656544
jmp 0x65619b
mov edx, eax
sub edx, dword [ebx + 0x44]
cmp edx, dword [ebx + 0x60]
jl 0x65619b
mov byte [ebx + 4], 1
sub eax, dword [ebx + 0x60]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x6561d1
mov eax, dword [ebp - 4]
add dword [ebx + 0x10], eax
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x6561d1
mov dword [ebp - 0x14], esi
fild dword [ebp - 0x14]
fmul dword [0x6561e8]
fild qword [ebx + 0x50]
fdivp st(1)
call fcn.004078b0
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x6561e0
mov eax, ebx
call fcn.00656544
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x66e170
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x66e17f
or edx, 0x200
test eax, 0x20000000
je 0x66e1b3
test eax, 0x40000000
je 0x66e19e
test eax, 0x80000000
je 0x66e199
or edx, 0x40
jmp 0x66e1da
or edx, 0x20
jmp 0x66e1da
test eax, 0x80000000
je 0x66e1ad
or edx, 0x80
jmp 0x66e1da
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x66e1cb
test eax, 0x80000000
je 0x66e1c6
or edx, 4
jmp 0x66e1da
or edx, 2
jmp 0x66e1da
test eax, 0x80000000
je 0x66e1d7
or edx, 8
jmp 0x66e1da
or edx, 1
mov eax, edx
ret
Function at 0x674ee8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6750cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0063ed90
cmp ebx, eax
jl 0x674f4f
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x8c14d0]
call fcn.00410254
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41d20c]
call fcn.0042b008
call fcn.00409e94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.0063ed78
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x6a]
sub al, 2
jne 0x674f7b
mov dl, 1
mov eax, dword [0x6354e0]
call fcn.00637f30
call fcn.00409e94
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x6a], 1
jne 0x674fd6
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x674f9b
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
jl 0x674fa4
mov al, 1
jmp 0x674fc1
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00672954
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x674fbb
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
setge al
test al, al
je 0x674fd6
mov dl, 1
mov eax, dword [0x6354e0]
call fcn.00637f30
call fcn.00409e94
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x10]
test al, al
je 0x674fef
mov eax, dword [ebp - 8]
call fcn.00638260
jmp 0x675088
push 0xff40
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4817c0]
call fcn.004a2a38
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x675056
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x675045
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67504c
mov eax, dword [ebp - 0xc]
call fcn.00408ac4
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x48]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 8]
call fcn.006399b4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00639a70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6750d3
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040a7f0
ret
Function at 0x6750dc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x675220
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x30]
call fcn.0063ed90
cmp ebx, eax
jl 0x67513a
mov dword [ebp - 8], ebx
mov byte [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 0xc]
mov eax, dword [0x8c14d0]
call fcn.00410254
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x41d20c]
call fcn.0042b008
call fcn.00409e94
mov eax, dword [esi + 0x30]
mov edx, ebx
call fcn.0063ed78
mov ebx, eax
movzx eax, byte [ebx + 0x6a]
sub al, 2
jne 0x67515f
mov dl, 1
mov eax, dword [0x6354e0]
call fcn.00637f30
call fcn.00409e94
cmp byte [ebx + 0x6a], 1
jne 0x6751b5
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x67517b
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
jl 0x675184
mov al, 1
jmp 0x6751a0
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00672954
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x67519a
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
setge al
test al, al
je 0x6751b5
mov dl, 1
mov eax, dword [0x6354e0]
call fcn.00637f30
call fcn.00409e94
mov eax, dword [ebx + 0xac]
shl eax, 9
cdq
push edx
push eax
mov eax, dword [ebx + 0xa0]
mov edx, dword [ebx + 0xa4]
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [esi + 4]
call fcn.004a2200
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
cmp edx, 0
jne 0x6751f0
cmp eax, 0
je 0x675205
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
push edx
push eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.004a26f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x675227
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040a7f0
ret

Function at 0x67d544
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x67d55d
add esp, 0xfffffff0
call fcn.0040906c
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x67d5ee
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call fcn.00424148
mov ecx, dword [ebp - 8]
lea eax, [esi + 0x10]
mov edx, 0x67d620
call fcn.0040ba64
lea eax, [esi + 0x33]
call fcn.0040a790
lea eax, [esi + 0xc]
mov edx, dword [ebp - 4]
call fcn.0040ab70
xor eax, eax
mov dword [esi + 0x1c], eax
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x37], 0
mov byte [esi + 0x30], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67d5f5
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a7f0
ret
Function at 0x67f59c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x67f5f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004253d8
test al, al
jne 0x67f5df
push 0
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004253d8
test al, al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67f5fc
lea eax, [ebp - 4]
call fcn.0040a790
ret

Function at 0x68213c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0040b7f8
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x682161
test eax, 0x10
ja 0x682161
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x6aaad0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a874
xor eax, eax
push ebp
push 0x6aab3f
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x6aab0e
push 0
movzx ecx, word [0x6aab4c]
mov dl, 3
mov eax, 0x6aab5c
call fcn.00660af0
cmp eax, 6
jne 0x6aab29
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040b7f8
push eax
push 0x6aab70
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aab46
lea eax, [ebp - 4]
call fcn.0040a790
ret