joyce8/EMBER2024-capa huggingface dataset:
Function at 0x613294
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6134d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x613477
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x613309
mov eax, 0x6134f0
call fcn.005f07f0
xor edx, edx
push ebp
push 0x61340c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00405ce4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x6133f5
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x613371
mov eax, 0x613514
call fcn.005f07f0
xor edx, edx
push ebp
push 0x6133de
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x6133b1
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x6133b1
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x61338f
pop dword fs:[0]
add esp, 8
push 0x6133e5
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x613413
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret

Function at 0x614d84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
push 1
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.004097c0
mov ecx, eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
mov edx, 0x80000002
call fcn.005a4308
test eax, eax
jne 0x614df7
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.004097c0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x614de6
cmp dword [ebp - 8], 4
je 0x614dea
xor ebx, ebx
jmp 0x614dec
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x614df9
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x618a20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe08
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11f4], ebx
mov dword [ebp - 0x11f8], ebx
mov dword [ebp - 0x11ec], ebx
mov dword [ebp - 0x11f0], ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 0x1004], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11de]
xor eax, eax
push ebp
push 0x618c67
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [ebp - 0x11d0]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 0x1004]
mov eax, dword [ebp - 0x11cc]
call fcn.00615ccc
cmp dword [ebp - 0x1084], 0x418
jle 0x618ae0
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 0x1004]
mov al, 0xd9
call fcn.005ab338
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, dword [0x41994c]
call fcn.0042660c
call fcn.00407e08
lea eax, [ebp - 0x11f0]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
push 0
call fcn.00408edc
mov edx, dword [ebp - 0x11f0]
lea ecx, [ebp - 0x11ec]
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
call fcn.00618364
mov edx, dword [ebp - 0x11ec]
mov eax, dword [ebp - 0x11d0]
add eax, 0x14
call fcn.00408aec
lea eax, [ebp - 0x11f8]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
push 0
call fcn.00408edc
mov edx, dword [ebp - 0x11f8]
lea ecx, [ebp - 0x11f4]
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
call fcn.00618364
mov edx, dword [ebp - 0x11f4]
mov eax, dword [ebp - 0x11d0]
add eax, 0x18
call fcn.00408aec
lea eax, [ebp - 0x1078]
movzx eax, byte [eax]
mov edx, dword [ebp - 0x11d0]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x618c28
push ebp
mov eax, esi
mov edx, 0xa
call fcn.006189a8
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
movzx edx, word [esi]
call fcn.006162b0
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x618bc5
push ebp
call fcn.00618800
pop ecx
xor eax, eax
push ebp
push 0x618bf6
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
call fcn.006189a8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x618c10
mov edx, dword [ebp - 0x11e4]
mov eax, dword [ebp - 0x11d0]
call fcn.006162ec
dec ebx
jne 0x618b8a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618c6e
lea eax, [ebp - 0x11f8]
call fcn.00408730
lea eax, [ebp - 0x11f4]
call fcn.0040870c
lea eax, [ebp - 0x11f0]
call fcn.00408730
lea eax, [ebp - 0x11ec]
mov edx, 2
call fcn.0040876c
ret
Function at 0x61adcc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, esi
test ebx, ebx
je 0x61ade5
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004097c0
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x61ae19
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
xor eax, eax
call fcn.0061ac9c
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x61c9e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x61cb11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [0x658674]
movzx eax, byte [eax]
mov ecx, dword [eax*4 + 0x6580b8]
mov edx, 0x80000002
xor eax, eax
call fcn.005a4308
test eax, eax
jne 0x61ca75
mov esi, edi
test esi, esi
je 0x61ca38
sub esi, 4
mov esi, dword [esi]
inc esi
mov eax, esi
add eax, eax
push eax
mov eax, edi
call fcn.004097c0
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x61ca6a
mov eax, 0x61cb2c
call fcn.005f958c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x61ca7f
mov eax, 0x61cb58
call fcn.005f958c
test bl, bl
je 0x61caf6
mov eax, edi
call fcn.004097c0
push eax
call sub.gdi32.dll_AddFontResourceW
test eax, eax
je 0x61caa6
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
jmp 0x61caf6
lea ecx, [ebp - 0x10]
mov edx, 0x61cb7c
mov al, 0x3f
call fcn.005ab338
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.005a4bf0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x6588a8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x6588a8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x6588a8]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
pop eax
call fcn.0061a2bc
test al, al
je 0x61ca83
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61cb18
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040876c
ret
Function at 0x61f550
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x61f611
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x61f5f6
test bl, 0x10
je 0x61f5f6
lea ecx, [ebp - 4]
mov edx, 0x61f62c
mov eax, esi
call fcn.005a29e8
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x61f650
mov eax, 0x61f66c
call fcn.005a31c0
mov edx, 0x61f698
mov eax, dword [ebp - 8]
call fcn.0041fb1c
test eax, eax
jne 0x61f5f6
mov eax, dword [ebp - 4]
call fcn.00421114
lea ecx, [ebp - 0xc]
mov edx, 0x61f6f4
mov eax, esi
call fcn.005a29e8
mov eax, dword [ebp - 0xc]
call fcn.00421114
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.004097c0
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesW
push edi
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f618
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040876c
ret

Function at 0x6204f8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x6205d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.005f08fc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x6205f0
call fcn.005f9810
mov eax, dword [0x658460]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
call fcn.0045a568
mov esi, eax
mov eax, dword [esi]
mov ebx, eax
test ebx, ebx
je 0x62056b
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
push eax
mov eax, ebx
mov ecx, 0x14
cdq
idiv ecx
push eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.00619264
test al, al
jne 0x6205bc
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x6205a1
mov eax, 0x620620
call fcn.005f958c
jmp 0x6205bc
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x620650
call fcn.005f9810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6205d9
lea eax, [ebp - 0x1c]
call fcn.0040870c
ret
Function at 0x622558
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6226e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea edx, [ebp - 0x258]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005a2878
lea eax, [ebp - 0x258]
mov edx, 0x6226fc
call fcn.004099bc
mov eax, dword [ebp - 0x258]
call fcn.004097c0
push eax
call sub.kernel32.dll_FindFirstFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x6226bc
lea eax, [ebp - 4]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00409864
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x6225eb
sub ebx, 4
mov ebx, dword [ebx]
cmp ebx, 9
jl 0x622630
lea eax, [ebp - 0x25c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00409be4
mov eax, dword [ebp - 0x25c]
mov edx, 0x622720
call fcn.0041fb1c
test eax, eax
jne 0x622630
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x622632
xor eax, eax
test al, al
je 0x622649
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xc]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x62264b
xor eax, eax
test al, al
je 0x622662
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xe]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x622664
xor eax, eax
test al, al
je 0x6226a1
mov eax, dword [ebp - 4]
cmp word [eax + 0x10], 0x2e
jne 0x6226a1
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00409be4
mov eax, dword [ebp - 0x260]
call fcn.00420b68
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x254]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x6225cc
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6226e9
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.0040876c
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x624474
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
call fcn.00624368
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4a
mov eax, dword [0x66015c]
push eax
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx], ecx
call fcn.004069c8
cmp ebx, 0x6c840001
jne 0x6244d4
call fcn.00426600
mov eax, 0xffff0000
and eax, ebx
cmp eax, 0x6c830000
je 0x6244f8
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x6245ac
call fcn.005f06f4
mov word [ebp - 0xa], bx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 8]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x62454e
mov ebx, eax
mov edx, 1
movzx eax, word [ebp - 0xa]
call fcn.006243e8
mov esi, eax
mov eax, esi
sub ax, 2
je 0x62454e
dec eax
sub ax, 2
jb 0x624562
movzx eax, si
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x6245f0
call fcn.005f06f4
push 0x4ff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x624503
mov edx, 2
movzx eax, word [ebp - 0xa]
call fcn.006243e8
movzx ebx, ax
mov edx, 3
movzx eax, word [ebp - 0xa]
call fcn.006243e8
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x62686c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
mov eax, ebx
call fcn.006268f0
call fcn.00405490
mov esi, eax
push esp
push 0x40
mov eax, ebx
call fcn.006268f0
push eax
push esi
call sub.kernel32.dll_VirtualProtect
mov edx, esi
mov eax, ebx
call fcn.006268a0
mov eax, esi
pop edx
pop esi
pop ebx
ret
Function at 0x628144
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x628316
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.00408894
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x6580e4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004097c0
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.005a4308
test eax, eax
jne 0x6282fb
xor eax, eax
push ebp
push 0x6282f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.005bfd94
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x6281d5
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x628202
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00408cb8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x628224
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00408cb8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x62829a
sub eax, 0xe9
je 0x62823e
sub eax, 0x19
je 0x6282d9
jmp 0x628293
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x628255
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x628268
call fcn.00407efc
jmp 0x6282fb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x62827f
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408894
jmp 0x6281c9
call fcn.00407efc
jmp 0x6282fb
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.005bfd94
lea eax, [ebp - 4]
call fcn.00408cb8
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.00408894
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.005d1408
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.005bdeb4
inc ebx
jmp 0x6281c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6282f7
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62831d
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040876c
ret
Function at 0x62e2e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x62e364
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x62e34c
mov ebx, esi
test ebx, ebx
je 0x62e312
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004097c0
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x62e380
call fcn.00409a14
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x62e34e
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62e36b
lea eax, [ebp - 8]
call fcn.0040870c
ret

Function at 0x634d28
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x634d32
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x634de8
push 0x634e1c
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041218c
mov ebx, eax
test ebx, ebx
je 0x634dd1
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x634dd1
test al, 0x10
je 0x634d82
mov ebp, 0x2000000
jmp 0x634d84
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x634dd1
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle
test ebx, ebx
jle 0x634dd1
cmp ebx, 0xff0
jge 0x634dd1
mov edx, edi
mov eax, esp
call fcn.00634c40
jmp 0x634dda
mov eax, edi
mov edx, esi
call fcn.00408aec
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x634e38
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x634ec9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
test ebx, ebx
jle 0x634e9f
cmp ebx, 0x104
jge 0x634e9f
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00409864
mov eax, dword [ebp - 0x20c]
mov edx, esi
call fcn.00634d28
jmp 0x634eb0
mov eax, 0x634ee4
call fcn.005f08a4
mov eax, esi
call fcn.0040870c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x634ed0
lea eax, [ebp - 0x20c]
call fcn.0040870c
ret
Function at 0x634f0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63505b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00634d28
lea eax, [ebp - 8]
call fcn.00634e38
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00405ce4
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x635068
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.004097c0
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.004097c0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.004097c0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x634fb7
call sub.kernel32.dll_GetLastError
cmp eax, 0x4c7
jne 0x634fad
call fcn.004265e0
mov eax, 0x635080
call fcn.005f07f0
cmp dword [ebp - 0x10], 0
jne 0x634fc7
mov eax, 0x6350ac
call fcn.005f069c
xor edx, edx
push ebp
push 0x635039
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00634a34
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x634fd5
cmp eax, 0xffffffff
jne 0x635002
mov eax, 0x635100
call fcn.005f07f0
call fcn.00634a34
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x635022
mov eax, 0x635140
call fcn.005f07f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x635040
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret

Function at 0x635168
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x635237
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x634808]
call fcn.00635260
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x635210
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x635250
call fcn.00421bec
mov edx, dword [ebp - 8]
mov eax, dword [0x658894]
mov eax, dword [eax]
call fcn.00596160
call fcn.00634a34
call sub.user32.dll_GetFocus
mov edx, dword [0x658894]
mov edx, dword [edx]
cmp eax, dword [edx + 0x188]
jne 0x6351f3
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x6351fa
call sub.user32.dll_WaitMessage
jmp 0x6351cd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x635217
mov eax, dword [ebp - 4]
call fcn.004069c8
ret