joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fefec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00423454
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ff01c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x5ff138
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [0x666040]
cmp dword [0x66603c], 0
jne 0x5ff113
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jb 0x5ff113
lea eax, [ebp - 8]
call fcn.005fefec
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00599cd0
lea eax, [ebp - 4]
mov edx, 0x5ff154
call fcn.00408f18
mov eax, dword [ebp - 4]
call fcn.00408d1c
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x66603c], eax
cmp dword [0x66603c], 0
je 0x5ff113
push 0x5ff170
mov eax, dword [0x66603c]
push eax
call fcn.0040f4e8
mov dword [0x666020], eax
push 0x5ff190
mov eax, dword [0x66603c]
push eax
call fcn.0040f4e8
mov dword [0x666024], eax
push 0x5ff1b8
mov eax, dword [0x66603c]
push eax
call fcn.0040f4e8
mov dword [0x666028], eax
push 0x5ff1cc
mov eax, dword [0x66603c]
push eax
call fcn.0040f4e8
mov dword [0x66602c], eax
push 0x5ff1e4
mov eax, dword [0x66603c]
push eax
call fcn.0040f4e8
mov dword [0x666030], eax
push 0x5ff1f8
mov eax, dword [0x66603c]
push eax
call fcn.0040f4e8
mov dword [0x666034], eax
cmp dword [0x66603c], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ff13f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407cb8
ret
Function at 0x603a3c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor eax, eax
push ebp
push 0x603c3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov eax, dword [eax + 0x4d8]
mov edx, 0x20
call fcn.004f0380
mov eax, dword [ebx]
mov eax, dword [eax + 0x4d8]
mov edx, 0x20
call fcn.004f03b4
mov eax, dword [ebx]
mov eax, dword [eax + 0x4dc]
mov edx, 0x20
call fcn.004f0380
mov eax, dword [ebx]
mov eax, dword [eax + 0x4dc]
mov edx, 0x20
call fcn.004f03b4
xor eax, eax
push ebp
push 0x603c12
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0x10
push 0x603c4c
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x603b19
cmp word [ebp - 0x2ac], 0
je 0x603b19
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x660c50]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x3e0]
mov ecx, dword [edx + 0x74]
mov edx, dword [ebx]
mov edx, dword [edx + 0x4d8]
call fcn.00603978
xor edx, edx
mov al, 6
call fcn.0063a6ec
test al, al
je 0x603b7e
push 0x27
lea edx, [ebp - 0x2bc]
mov eax, dword [0x65d718]
mov eax, dword [eax]
call fcn.00599cd0
lea eax, [ebp - 0x2bc]
mov edx, 0x603c74
call fcn.00408f18
mov eax, dword [ebp - 0x2bc]
call fcn.00408d1c
push eax
mov eax, dword [0x660c50]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x3e8]
mov ecx, dword [edx + 0x74]
mov edx, dword [ebx]
mov edx, dword [edx + 0x4dc]
call fcn.00603978
jmp 0x603c08
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.0063fe9c
cmp dword [ebp - 4], 0
jne 0x603ba2
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.0063fe9c
cmp dword [ebp - 4], 0
je 0x603c08
push 0x1000
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00408d1c
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x603c08
cmp word [ebp - 0x2ac], 0
je 0x603c08
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x660c50]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x3e8]
mov ecx, dword [edx + 0x74]
mov edx, dword [ebx]
mov edx, dword [edx + 0x4dc]
call fcn.00603978
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x603c1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x603c44
lea eax, [ebp - 0x2bc]
call fcn.00407c58
lea eax, [ebp - 4]
call fcn.00407c58
ret
Function at 0x61651c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x6165f6
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x616608
call fcn.005fcce4
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x616574
mov eax, 0x616668
call fcn.005fca60
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x61655f
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x6165c7
cmp dword [ebp - 4], 0
jne 0x6165ac
mov eax, 0x6166c0
call fcn.005fca60
jmp 0x6165d1
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x6166fc
call fcn.005fcce4
jmp 0x6165d1
mov eax, 0x616764
call fcn.005fca60
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x6165f6
push 0xfa
call sub.kernel32.dll_Sleep_2
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6167cc
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x616a0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x6169af
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x616841
mov eax, 0x616a28
call fcn.005f3060
xor edx, edx
push ebp
push 0x616944
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.004053f4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x61692d
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x3e5
je 0x6168a9
mov eax, 0x616a4c
call fcn.005f3060
xor edx, edx
push ebp
push 0x616916
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x6168e9
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x6168e9
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x6168c7
pop dword fs:[0]
add esp, 8
push 0x61691d
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61694b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x618470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
push 1
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.00408d1c
mov ecx, eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
mov edx, 0x80000002
call fcn.0059b83c
test eax, eax
jne 0x6184e3
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.00408d1c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x6184d2
cmp dword [ebp - 8], 4
je 0x6184d6
xor ebx, ebx
jmp 0x6184d8
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x6184e5
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61c618
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe08
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11f4], ebx
mov dword [ebp - 0x11f8], ebx
mov dword [ebp - 0x11ec], ebx
mov dword [ebp - 0x11f0], ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 0x1004], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11de]
lea edi, [ebp - 0x11d0]
xor eax, eax
push ebp
push 0x61c845
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [edi]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 0x1004]
mov eax, dword [ebp - 0x11cc]
call fcn.006192a4
cmp dword [ebp - 0x1084], 0x418
jle 0x61c6da
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 0x1004]
mov al, 0xd9
call fcn.005a1448
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, dword [0x41d304]
call fcn.00427c80
call fcn.00407354
lea eax, [ebp - 0x11f0]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
push 0
call fcn.00408434
mov edx, dword [ebp - 0x11f0]
lea ecx, [ebp - 0x11ec]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0061bf70
mov edx, dword [ebp - 0x11ec]
mov eax, dword [edi]
add eax, 0x14
call fcn.00408038
lea eax, [ebp - 0x11f8]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
push 0
call fcn.00408434
mov edx, dword [ebp - 0x11f8]
lea ecx, [ebp - 0x11f4]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0061bf70
mov edx, dword [ebp - 0x11f4]
mov eax, dword [edi]
add eax, 0x18
call fcn.00408038
lea eax, [ebp - 0x1078]
movzx eax, byte [eax]
mov edx, dword [edi]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x61c806
push ebp
mov eax, esi
mov edx, 0xa
call fcn.0061c5a0
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
movzx edx, word [esi]
call fcn.00619a4c
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x61c7a7
push ebp
call fcn.0061c3f8
pop ecx
xor eax, eax
push ebp
push 0x61c7d8
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
call fcn.0061c5a0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61c7f2
mov edx, dword [ebp - 0x11e4]
mov eax, dword [edi]
call fcn.00619a88
dec ebx
jne 0x61c770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c84c
lea eax, [ebp - 0x11f8]
call fcn.00407c7c
lea eax, [ebp - 0x11f4]
call fcn.00407c58
lea eax, [ebp - 0x11f0]
call fcn.00407c7c
lea eax, [ebp - 0x11ec]
mov edx, 2
call fcn.00407cb8
ret
Function at 0x61e118
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, esi
test ebx, ebx
je 0x61e131
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00408d1c
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x61e165
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
xor eax, eax
call fcn.0061dfe8
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x61fff4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x620125
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [0x65d210]
movzx eax, byte [eax]
mov ecx, dword [eax*4 + 0x65cc10]
mov edx, 0x80000002
xor eax, eax
call fcn.0059b83c
test eax, eax
jne 0x620089
mov esi, edi
test esi, esi
je 0x62004c
sub esi, 4
mov esi, dword [esi]
inc esi
mov eax, esi
add eax, eax
push eax
mov eax, edi
call fcn.00408d1c
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00408d1c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x62007e
mov eax, 0x620140
call fcn.005fca60
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x620093
mov eax, 0x6201a4
call fcn.005fca60
test bl, bl
je 0x62010a
mov eax, edi
call fcn.00408d1c
push eax
call sub.gdi32.dll_AddFontResourceW
test eax, eax
je 0x6200ba
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
jmp 0x62010a
lea ecx, [ebp - 0x10]
mov edx, 0x6201f8
mov al, 0x3f
call fcn.005a1448
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0059c15c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x65d45c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x65d45c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x65d45c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
pop eax
call fcn.0061d5cc
test al, al
je 0x620097
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62012c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407cb8
ret
Function at 0x623344
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x623405
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x6233ea
test bl, 0x10
je 0x6233ea
lea ecx, [ebp - 4]
mov edx, 0x623420
mov eax, esi
call fcn.00599e54
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x623444
mov eax, 0x623460
call fcn.0059a6b4
mov edx, 0x62348c
mov eax, dword [ebp - 8]
call fcn.004214e0
test eax, eax
jne 0x6233ea
mov eax, dword [ebp - 4]
call fcn.00422a4c
lea ecx, [ebp - 0xc]
mov edx, 0x6234e8
mov eax, esi
call fcn.00599e54
mov eax, dword [ebp - 0xc]
call fcn.00422a4c
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.00408d1c
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesW
push edi
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62340c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407cb8
ret

Function at 0x62443c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x624514
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.005f3170
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x624530
call fcn.005fcce4
mov eax, dword [0x65cff4]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
call fcn.00495454
mov esi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x6244ad
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
push eax
mov eax, ebx
mov ecx, 0x14
cdq
idiv ecx
push eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0061cea0
test al, al
jne 0x6244fe
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
jne 0x6244e3
mov eax, 0x624580
call fcn.005fca60
jmp 0x6244fe
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x624620
call fcn.005fcce4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62451b
lea eax, [ebp - 0x1c]
call fcn.00407c58
ret
Function at 0x6269e4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x626b97
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea edx, [ebp - 0x258]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00599cd0
lea eax, [ebp - 0x258]
mov edx, 0x626bb0
call fcn.00408f18
mov eax, dword [ebp - 0x258]
call fcn.00408d1c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x626b71
lea eax, [ebp - 4]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00408dc0
mov eax, dword [ebp - 4]
test eax, eax
je 0x626a76
sub eax, 4
mov eax, dword [eax]
cmp eax, 9
jl 0x626aab
lea eax, [ebp - 0x25c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00409140
mov eax, dword [ebp - 0x25c]
mov edx, 0x626bd4
call fcn.004214e0
test eax, eax
sete al
jmp 0x626aad
xor eax, eax
test al, al
je 0x626acf
mov eax, 0x626be0
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0xa]
cmp dx, 0xff
ja 0x626aca
movzx edx, dx
bt dword [eax], edx
setb al
jmp 0x626ad1
xor eax, eax
test al, al
je 0x626af3
mov eax, 0x626be0
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0xc]
cmp dx, 0xff
ja 0x626aee
movzx edx, dx
bt dword [eax], edx
setb al
jmp 0x626af5
xor eax, eax
test al, al
je 0x626b17
mov eax, 0x626be0
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0xe]
cmp dx, 0xff
ja 0x626b12
movzx edx, dx
bt dword [eax], edx
setb al
jmp 0x626b19
xor eax, eax
test al, al
je 0x626b56
mov eax, dword [ebp - 4]
cmp word [eax + 0x10], 0x2e
jne 0x626b56
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00409140
mov eax, dword [ebp - 0x260]
call fcn.004223b0
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x626a57
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x626b9e
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.00407cb8
lea eax, [ebp - 4]
call fcn.00407c58
ret
Function at 0x628eec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.00628db4
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4a
mov eax, dword [0x6660d0]
push eax
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, dword [edi]
xor edx, edx
mov dword [edi], edx
call fcn.004060a0
cmp ebx, 0x6c840001
jne 0x628f40
call fcn.00427c74
mov eax, 0xffff0000
and eax, ebx
cmp eax, 0x6c830000
je 0x628f64
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x629018
call fcn.005f2f64
mov word [ebp - 6], bx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
call dword [ebp - 4]
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x628fba
mov ebx, eax
mov edx, 1
movzx eax, word [ebp - 6]
call fcn.00628e3c
mov esi, eax
mov eax, esi
sub ax, 2
je 0x628fba
dec eax
sub ax, 2
jb 0x628fce
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x629078
call fcn.005f2f64
push 0x4ff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x628f6f
mov edx, 2
movzx eax, word [ebp - 6]
call fcn.00628e3c
movzx ebx, ax
mov edx, 3
movzx eax, word [ebp - 6]
call fcn.00628e3c
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x62b388
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0062b418
call fcn.00404b80
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
mov eax, ebx
call fcn.0062b418
push eax
push esi
call sub.kernel32.dll_VirtualProtect
mov edx, esi
mov eax, ebx
call fcn.0062b3c4
mov eax, esi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x62ce88
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x62d05a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.00407de0
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x65cc3c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00408d1c
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.0059b83c
test eax, eax
jne 0x62d03f
xor eax, eax
push ebp
push 0x62d034
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.005b6ad4
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x62cf19
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x62cf46
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00408210
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x62cf68
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00408210
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x62cfde
sub eax, 0xe9
je 0x62cf82
sub eax, 0x19
je 0x62d01d
jmp 0x62cfd7
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x62cf99
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x62cfac
call fcn.00407448
jmp 0x62d03f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x62cfc3
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407de0
jmp 0x62cf0d
call fcn.00407448
jmp 0x62d03f
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.005b6ad4
lea eax, [ebp - 4]
call fcn.00408210
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.00407de0
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.005c7db0
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.005b4c80
inc ebx
jmp 0x62cf0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62d03b
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62d061
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407cb8
ret