joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60bcb0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x60bd0d
cmp byte [ebx + 0xeb], 0
jne 0x60bd0d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040b5fc
mov eax, dword [esi]
test eax, eax
je 0x60bcfa
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x60bd1a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040b854
jmp 0x60bd1a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040b854
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x60d93c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x60d9ad
mov eax, esi
call fcn.0055b45c
test al, al
je 0x60d9ad
mov eax, dword [ebx + 0x98]
call fcn.0055aff4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x60d9ad
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x60d99e
push 0
mov eax, dword [ebx + 0x98]
call fcn.0055aff4
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00551298
jmp 0x60d9ad
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.0060d748
pop esi
pop ebx
ret
Function at 0x61617c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x616202
mov eax, dword [ebx + 8]
call fcn.0055aff4
mov ecx, eax
mov dl, 1
mov eax, dword [0x56eb58]
call fcn.00554b28
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.0057f114
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x615a4c
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0055aff4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0055aff4
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa4], 0
jne 0x616284
mov eax, dword [ebx + 8]
call fcn.0055aff4
mov ecx, eax
mov dl, 1
mov eax, dword [0x56eb58]
call fcn.00554b28
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.0057f114
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x615a98
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0055aff4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0055aff4
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x616302
mov eax, dword [ebx + 8]
call fcn.0055aff4
mov ecx, eax
mov dl, 1
mov eax, dword [0x56f64c]
call fcn.00554b28
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0055aff4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0055aff4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x6318a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x68a158], 0
jne 0x6318bf
call fcn.00631864
mov eax, edi
dec eax
test eax, eax
jl 0x6318e7
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x689d58]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6318c9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x634940
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x634971
dec al
je 0x6349ac
dec al
je 0x6349f0
dec al
je 0x634a62
jmp 0x634afd
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x634afd
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x634981
jmp 0x634afd
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x634afd
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6349bc
jmp 0x634afd
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x634afd
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x634a23
xor edx, edx
mov dword [esp + 4], edx
jmp 0x634a38
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x634a50
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x634a00
jmp 0x634afd
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x634afd
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x634ac9
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.006318f0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x634a7e
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x639a30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
xor eax, eax
push ebp
push 0x639c1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040b464
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00644f84
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.00428a24
test al, al
je 0x639bf6
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00644f84
mov eax, dword [ebp - 0x24]
call fcn.0040bffc
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x639b0e
xor eax, eax
push ebp
push 0x639b02
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00406ff4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00644f84
mov eax, dword [ebp - 0x28]
call fcn.0040bffc
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x639b0e
test bl, bl
je 0x639bf6
xor eax, eax
push ebp
push 0x639be1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x639c2c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.00427d9c
mov eax, dword [ebp - 8]
push dword [eax]
push 0x639c3c
mov eax, dword [ebx + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00427d9c
push dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 8]
push dword [eax]
push 0x639c3c
mov eax, dword [ebx + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00427d9c
push dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 8]
push dword [eax]
push 0x639c3c
mov eax, dword [ebx + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00427d9c
push dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c2e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x639beb
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00407010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639c22
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.0040b4c4
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax
Function at 0x639c40
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00430cdc
cmp eax, 2
je 0x639c5d
mov byte [ebp - 1], 1
jmp 0x639e39
mov byte [ebp - 1], 0
mov eax, 0x681298
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x639e39
xor eax, eax
push ebp
push 0x639e32
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x639cc6
push 0x639e44
push 0x639e70
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417260
mov ebx, eax
test ebx, ebx
je 0x639ced
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x639e19
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x639e19
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x639d3e
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x639d1f
call fcn.0040ac14
jmp 0x639e39
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x639d3e
call fcn.0040ac14
jmp 0x639e39
xor eax, eax
push ebp
push 0x639e12
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x639d81
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x639d81
call fcn.0040ac14
call fcn.0040ac14
jmp 0x639e39
mov eax, dword [ebp - 0x14]
call fcn.00406ff4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x639db6
call fcn.0040ac14
call fcn.0040ac14
jmp 0x639e39
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x639df1
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x639ded
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x639ded
mov byte [ebp - 1], 1
jmp 0x639df1
inc ebx
dec esi
jne 0x639dc3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639e19
mov eax, dword [ebp - 0x18]
call fcn.00407010
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639e39
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6412ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
xor eax, eax
push ebp
push 0x64138c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b464
mov eax, dword [ebp - 4]
test eax, eax
je 0x64132f
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x64135c
mov esi, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
xor dx, di
call fcn.0040c01c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040c208
inc esi
dec ebx
jne 0x64133a
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040b854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x641393
lea eax, [ebp - 0x10]
call fcn.0040b464
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b4c4
pop eax
jmp eax

Function at 0x644d9c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x644dfb
xor eax, eax
push ebp
push 0x644df4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644dfb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
push 0x1f4
call sub.kernel32.dll_Sleep
movzx eax, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x64533c
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x6454b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040b464
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x418]
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060d00c
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
call fcn.0042936c
mov eax, dword [ebp - 0x414]
call fcn.0040bffc
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x645489
xor eax, eax
push ebp
push 0x6453f5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x84000100
push 0
push 0
mov eax, edi
call fcn.0040bffc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64540f
cmp dword [ebp - 0xc], 0
jne 0x645420
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x645489
xor eax, eax
push ebp
push 0x64546d
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x410]
lea eax, [ebp - 4]
mov ecx, dword [esi]
call fcn.0040b71c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040c208
cmp dword [esi], 0
jne 0x64542e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x645477
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6454b8
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax
Function at 0x64597c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
xor eax, eax
push ebp
push 0x645a0c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b464
mov eax, dword [ebp - 4]
test eax, eax
je 0x6459b7
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x6459e5
mov esi, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
xor dx, 2
call fcn.0040c01c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.0040c208
inc esi
dec ebx
jne 0x6459c2
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.0040b854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x645a13
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b4c4
pop eax
jmp eax

Function at 0x6463d4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040b464
push esp
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x64640e
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov edx, ebx
lea eax, [esp + 4]
call fcn.004298d0
add esp, 0x210
pop esi
pop ebx
ret
Function at 0x651ed4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b558
mov eax, dword [ebp - 8]
call fcn.0040b558
xor eax, eax
push ebp
push 0x652097
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408154
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x44], esi
test bl, bl
je 0x651f34
mov dword [ebp - 0x48], 0x540
jmp 0x651f3b
mov dword [ebp - 0x48], 0x500
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], 0
je 0x651f50
mov eax, 0x6520ac
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.0040bffc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.0040bffc
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x652049
test bl, bl
je 0x652043
cmp byte [0x68a206], 0
jne 0x651fa1
cmp byte [0x68a20f], 0
jne 0x651fa1
mov eax, dword [0x68a1c4]
mov eax, dword [eax + 0x428]
call fcn.0055199c
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
cmp byte [0x68a27f], 0
je 0x651fd4
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x65201e
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
jmp 0x65201e
mov eax, dword [0x68a1c4]
mov eax, dword [eax + 0x428]
cmp byte [eax + 0x69], 0
je 0x651fec
mov al, 1
call fcn.006451bc
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x10], 0x103
jne 0x65201e
mov eax, dword [0x6823c8]
mov eax, dword [eax]
cmp byte [eax + 0xbc], 0
je 0x651fd4
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x50]
call fcn.00427d9c
mov edx, dword [ebp - 0x50]
mov eax, 0x68a230
call fcn.0040b854
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 9], 1
jmp 0x65205c
test bl, bl
je 0x65205c
mov eax, 0x68a230
mov edx, 0x6520c4
call fcn.0040b854
mov eax, dword [0x68a1c4]
mov eax, dword [eax + 0x428]
cmp byte [eax + 0x69], 0
je 0x652072
call fcn.00551994
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65209e
lea eax, [ebp - 0x50]
call fcn.0040b464
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b4c4
pop eax
jmp eax
Function at 0x652f2c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x653019
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, ebx
call fcn.00428a24
test al, al
jne 0x652fae
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x653034
call fcn.0040c260
mov eax, dword [ebp - 4]
call fcn.00648ee0
cmp byte [0x68a206], 0
jne 0x652fa5
push 0x10
push 0x653070
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, 0x653088
call fcn.00648f38
mov eax, dword [ebp - 8]
call fcn.0040bffc
push eax
mov eax, dword [0x6823c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x68a20d], 1
jmp 0x652ffc
push 1
push 0
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0x6530c0
call fcn.0040c260
mov eax, dword [ebp - 0xc]
call fcn.0040bffc
push eax
push 0x6530fc
push 0x653118
mov eax, dword [0x6823c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.shell32.dll_ShellExecuteW
cmp byte [0x68a205], 0
je 0x652ffc
mov edx, ebx
mov eax, 0x653130
call fcn.0064ab38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x653020
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b4c4
pop eax
jmp eax
Function at 0x6584c4
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
xor eax, eax
push ebp
push 0x658590
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00644f84
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040b89c
xor eax, eax
push ebp
push 0x658566
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004283f4
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x658529
mov byte [ebp - 5], 0
jmp 0x65855c
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetSystemTime
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658570
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658597
lea eax, [ebp - 0x24]
call fcn.0040b464
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax
Function at 0x66a688
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x66a6f2
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x66a6f2
lea eax, [esp + 0xc]
push eax
push 0x66a6f8
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x66a6f2
push 0
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
ret

Function at 0x66a720
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
mov edx, 0x66a7cc
call fcn.0040b854
xor edx, edx
push ebp
push 0x66a75a
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetUserDefaultLangID
mov ebx, eax
call sub.kernel32.dll_GetSystemDefaultLangID
pop dword fs:[0]
add esp, 8
jmp 0x66a76b
cmp bx, 0x409
jne 0x66a778
cmp ax, 0x409
je 0x66a7b8
cmp bx, 0x419
je 0x66a7ac
cmp ax, 0x419
je 0x66a7ac
cmp bx, 0x423
je 0x66a7ac
cmp ax, 0x423
je 0x66a7ac
cmp bx, 0x43f
je 0x66a7ac
cmp ax, 0x43f
je 0x66a7ac
cmp bx, 0x443
je 0x66a7ac
cmp ax, 0x443
jne 0x66a7b8
mov eax, esi
mov edx, 0x66a7e4
call fcn.0040b854
pop edi
pop esi
pop ebx
pop ebp
ret