joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63090c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [edx + 0x18]
test al, 0x40
je 0x630927
push 5
mov eax, ebx
call fcn.004a0e60
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
test al, 0x80
je 0x63093a
push 0
mov eax, ebx
call fcn.004a0e60
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x63b940
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edi, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x48]
test esi, esi
je 0x63ba6c
test edi, edi
je 0x63ba6c
test eax, eax
je 0x63ba6c
test edx, edx
je 0x63ba6c
mov eax, dword [ebp - 0x4c]
cdq
idiv esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x44]
dec eax
cdq
idiv esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
cdq
idiv edi
mov ebx, eax
mov eax, dword [ebp - 0x40]
dec eax
cdq
idiv edi
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x25]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0063b820
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_IntersectClipRect
mov eax, dword [ebp - 0x18]
sub eax, ebx
jl 0x63ba5e
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
sub ebx, eax
jl 0x63ba56
inc ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
imul edi
mov edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x38]
sub eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
imul esi
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x3c]
sub eax, edx
mov dword [ebp - 0x1c], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp + 8]
call fcn.004669c0
call fcn.0046122c
push eax
push edi
push esi
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_BitBlt
inc dword [ebp - 8]
dec ebx
jne 0x63ba06
inc dword [ebp - 0xc]
dec dword [ebp - 0x2c]
jne 0x63b9f8
lea ecx, [ebp - 0x25]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0063b7f8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x63bbf8
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x63bc11
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
Function at 0x63bc20
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x63bc39
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret

Function at 0x640708
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x100]
test byte [eax], 0x80
setne cl
test cl, cl
jne 0x640736
inc eax
dec edx
jne 0x640728
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x640888
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
movzx eax, byte [eax + 0xc]
mov word [ebp - 4], ax
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x6408af
add word [ebp - 4], 0x2000
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x6408c1
add word [ebp - 4], 0x4000
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x6408d3
add word [ebp - 4], 0x8000
lea eax, [ebp - 8]
call fcn.006406d4
mov ebx, eax
test ebx, ebx
je 0x6408f9
mov cx, word [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00640390
test al, al
je 0x6408f9
mov byte [ebp - 1], 1
jmp 0x64093f
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
call fcn.00640798
pop ecx
cmp byte [ebp - 1], 0
jne 0x64093f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
cmp eax, dword [edx - 4]
je 0x64093f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp dword [eax - 8], 0
je 0x64093f
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 8]
call fcn.00640798
pop ecx
mov al, byte [ebp - 1]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x6409fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push ebp
call fcn.00640888
pop ecx
test al, al
je 0x640a1c
mov eax, dword [ebp + 8]
mov dword [eax - 0xc], 1
jmp 0x640b04
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x640b04
call fcn.0064073c
mov dl, byte [0x640b0c]
not edx
and dl, al
mov byte [ebp - 1], dl
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00640948
pop ecx
mov esi, eax
test esi, esi
jne 0x640a77
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 4]
je 0x640a77
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x640a77
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00640948
pop ecx
mov esi, eax
test esi, esi
je 0x640b04
mov eax, dword [esi + 0x18]
call fcn.0065fa98
test al, al
je 0x640b04
push esi
mov eax, esi
call fcn.0064de90
mov edx, dword [ebp + 8]
mov dx, word [edx + 0xc]
mov cl, byte [ebp - 1]
call fcn.0064f308
cmp esi, eax
sete bl
mov eax, dword [esi + 0x10]
mov edx, dword [eax]
call dword [edx + 0xa4]
test al, al
je 0x640aba
test bl, bl
jne 0x640acc
mov eax, esi
call fcn.0064dd60
mov edx, dword [esi + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x190]
test bl, bl
je 0x640afa
mov eax, dword [esi + 0x10]
mov edx, dword [0x638704]
call fcn.0040439c
test al, al
je 0x640af0
mov eax, esi
call fcn.0064dd60
mov byte [eax + 0x2a0], 1
xor edx, edx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp + 8]
mov dword [eax - 0xc], 1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x641b28
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x74e81c]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.004261ac
test eax, eax
jge 0x641b4d
mov eax, dword [0x74e81c]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.00425e78
cmp byte [ebx + 0x51], 0
jne 0x641b6d
cmp dword [0x74e898], 0
jne 0x641b6d
xor ecx, ecx
mov dl, 1
mov eax, dword [0x74851c]
call dword [eax + 0x2c]
mov dword [0x74e898], eax
cmp dword [0x74e874], 0
jne 0x641b8f
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push fcn.00640b10
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x74e874], eax
cmp dword [0x74e878], 0
jne 0x641bb1
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x6411c4
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [0x74e878], eax
cmp dword [0x74e87c], 0
jne 0x641bd3
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x6418d0
push 4
call sub.user32.dll_SetWindowsHookExA
mov dword [0x74e87c], eax
pop ebx
ret
Function at 0x6457c4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0064235c
test al, al
jne 0x6458e6
cmp byte [esi + 0x127], 0
je 0x6458e6
test bl, bl
jne 0x6457fb
cmp byte [0x74e8bc], 0
je 0x6458e6
mov byte [0x74e8bc], bl
mov eax, 0x74e8a8
mov edx, edi
call fcn.004051a8
mov byte [0x74e89c], 0
mov byte [esp], bl
test bl, bl
je 0x64583a
mov edi, dword [esi + 0x120]
test edi, edi
je 0x645831
mov eax, dword [edi + 0x20]
cmp byte [eax + 0x234], 0
je 0x64583e
cmp dword [0x74e8a8], 0
jne 0x64583e
xor eax, eax
jmp 0x645840
mov al, 1
mov ebx, eax
test bl, bl
je 0x645891
call fcn.0064068c
mov eax, dword [0x74e898]
call fcn.004a0e60
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x645888
cmp byte [0x74e8ac], 0
jne 0x645888
mov dword [0x74e8b8], esi
push 0x645538
push 0x3e8
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x74e8a0], eax
jmp 0x6458e6
mov eax, esi
call fcn.006455a8
jmp 0x6458e6
call fcn.0064068c
mov eax, dword [0x74e898]
call fcn.004a0e60
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x6458e6
push 0
mov eax, dword [0x74e898]
call fcn.004a0e60
push eax
call sub.user32.dll_ShowWindow
cmp byte [esp], 0
je 0x6458e6
call fcn.006406ac
mov byte [0x74e8ac], 1
push 0x64559c
push 0x190
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x74e8a4], eax
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x64d588
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x35], 0
je 0x64d5c1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x64d642
push ebp
mov al, 1
call fcn.0064d49c
pop ecx
test al, al
jne 0x64d642
push ebp
mov al, 3
call fcn.0064d49c
pop ecx
test al, al
jne 0x64d642
push ebp
mov al, 2
call fcn.0064d49c
pop ecx
test al, al
jne 0x64d642
push ebp
mov al, 4
call fcn.0064d49c
pop ecx
test al, al
jne 0x64d642
mov eax, dword [ebp - 4]
cmp byte [eax + 0x35], 0
je 0x64d610
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x41]
sub dword [ebp - 0x10], eax
push ebp
mov al, 1
call fcn.0064d49c
pop ecx
test al, al
jne 0x64d642
push ebp
mov al, 3
call fcn.0064d49c
pop ecx
test al, al
jne 0x64d642
push ebp
mov al, 2
call fcn.0064d49c
pop ecx
test al, al
jne 0x64d642
push ebp
mov al, 4
call fcn.0064d49c
pop ecx
test al, al
mov al, byte [ebp - 0x15]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x64e5a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x64e665
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0064de48
mov eax, dword [ebp - 8]
call fcn.0064e4f8
pop ecx
mov ebx, eax
test bl, bl
jne 0x64e5e9
xor ebx, ebx
jmp 0x64e64f
mov eax, ebx
add al, 0xd0
sub al, 0xa
jae 0x64e608
xor eax, eax
mov al, bl
cmp di, ax
jne 0x64e608
mov al, byte [0x64e678]
cmp al, byte [ebp - 1]
jne 0x64e608
mov bl, 1
jmp 0x64e64f
push ebx
call sub.user32.dll_VkKeyScanA
mov esi, eax
mov eax, esi
and ax, 0xff
cmp di, ax
jne 0x64e64d
shr si, 8
mov bl, byte [0x64e678]
mov eax, esi
and ax, 1
cmp ax, 1
jne 0x64e634
or bl, 1
and si, 2
cmp si, 2
jne 0x64e641
or bl, 4
mov al, byte [ebp - 1]
cmp al, bl
sete al
mov ebx, eax
jmp 0x64e64f
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64e66c
lea eax, [ebp - 8]
call fcn.00405154
ret

Function at 0x663934
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
lea ecx, [esp + 8]
mov edx, ebx
mov eax, dword [ebx + 0x20]
call fcn.0065507c
push esp
call sub.user32.dll_GetCursorPos
push esp
mov eax, dword [ebx + 0x20]
call fcn.004a0e60
push eax
call sub.user32.dll_ScreenToClient
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x66397e
push dword [esp + 4]
push dword [esp + 4]
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PtInRect
test eax, eax
jne 0x663982
xor eax, eax
jmp 0x663984
mov al, 1
test al, al
je 0x6639a5
cmp byte [0x74e888], 0
je 0x663998
call fcn.0063bbf8
jmp 0x6639a5
push 1
call sub.user32.dll_GetKeyState
test ax, ax
setl al
add esp, 0x18
pop ebx
ret
Function at 0x674c14
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 1
sete byte [0x74e82d]
cmp byte [0x74e82d], 0
je 0x674c43
cmp dword [esp + 8], 0
je 0x674c47
xor eax, eax
jmp 0x674c49
mov al, 1
mov byte [0x74e82c], al
cmp dword [esp + 0x10], 1
jne 0x674c5c
cmp dword [esp + 8], 0
jne 0x674c6e
cmp dword [esp + 0x10], 2
jne 0x674c6a
cmp dword [esp + 4], 5
je 0x674c6e
xor eax, eax
jmp 0x674c70
mov al, 1
mov byte [0x74e82e], al
add esp, 0x94
ret

Function at 0x6c6a6c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x88], 2
jne 0x6c6aa3
cmp dword [ebp - 0x94], 5
jb 0x6c6aa3
mov byte [ebp - 1], 1
jmp 0x6c6aa7
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x6dd690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd94
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xd0], eax
xor eax, eax
push ebp
push 0x6dd778
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x6dd788]
mov byte [ebp - 1], al
push 0xc8
lea eax, [ebp - 0xc9]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
xor ebx, ebx
mov esi, 0x7499a0
lea eax, [ebp - 0x19c]
lea edx, [ebp - 0xc9]
mov ecx, 0xc8
call fcn.00403c5c
lea edx, [ebp - 0x19c]
lea eax, [ebp - 0x268]
call fcn.004036d4
mov edx, 0x6dd78c
lea eax, [ebp - 0x268]
mov cl, 0xc9
call fcn.004036a4
lea edx, [ebp - 0x268]
lea eax, [ebp - 0xd0]
call fcn.004053c8
lea eax, [ebp - 0xd0]
mov edx, dword [esi]
call fcn.0040542c
mov eax, dword [ebp - 0xd0]
call fcn.0040b470
test al, al
je 0x6dd752
mov edx, ebx
lea eax, [ebp - 0x26c]
mov cl, 1
call fcn.00403c80
mov al, byte [ebp - 0x26c]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
inc ebx
add esi, 4
cmp bl, 3
jne 0x6dd6d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6dd77f
lea eax, [ebp - 0xd0]
call fcn.00405154
ret
Function at 0x6e5ddc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6e5ec3
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
xor esi, esi
mov eax, esi
cmp eax, 0x1f
ja 0x6e5e17
bt edi, eax
jae 0x6e5e9e
mov ebx, esi
add bl, 0x61
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.0040533c
lea eax, [ebp - 0x14]
mov edx, 0x6e5edc
call fcn.0040542c
mov eax, dword [ebp - 0x14]
call fcn.00405624
push eax
call sub.kernel32.dll_GetDriveTypeA
mov byte [ebp - 0xd], al
mov eax, ebx
call fcn.004031c4
mov ebx, eax
mov al, byte [ebp - 0xd]
add al, 0xfd
sub al, 4
jae 0x6e5e9e
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x20]
call fcn.004036d4
mov edx, 0x6e5ee0
lea eax, [ebp - 0x20]
mov cl, 2
call fcn.004036a4
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x18]
call fcn.004053c8
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.006e6c04
inc esi
cmp esi, 0x1a
jne 0x6e5e0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e5eca
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405178
ret
Function at 0x6e82f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405614
xor eax, eax
push ebp
push 0x6e835d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x6e8340
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.006f4e20
mov eax, dword [ebp - 8]
call fcn.006f4d80
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
jmp 0x6e8342
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e8364
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405178
ret

Function at 0x6e836c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405614
xor eax, eax
push ebp
push 0x6e8438
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6e8413
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x60]
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x6e83f8
push pe_nt_image_headers32
lea eax, [ebx + 0x10d]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push pe_nt_image_headers32
lea eax, [ebx + 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.006f4e20
mov eax, dword [ebp - 0x10]
call fcn.006f4d80
push eax
call sub.kernel32.dll_GetVolumeInformationA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x6e83fc
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e841a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x6eb678
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405614
xor eax, eax
push ebp
push 0x6eb76e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405154
cmp dword [ebp - 4], 0
je 0x6eb6d4
mov eax, dword [ebp - 4]
call fcn.006f4fbc
test al, al
je 0x6eb6d4
lea eax, [ebp - 0x109]
mov edx, dword [ebp - 4]
call fcn.0040bed8
jmp 0x6eb6e5
lea eax, [ebp - 0x109]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.0040c118
mov eax, dword [ebp - 0x110]
call fcn.006f4fbc
test al, al
jne 0x6eb721
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x109]
call fcn.0040c118
mov eax, dword [ebp - 0x114]
call fcn.006f5694
lea eax, [ebp - 0x109]
push eax
push 0
push 0x6eb77c
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040c118
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6eb775
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00405178
lea eax, [ebp - 4]
call fcn.00405154
ret
Function at 0x6f0480
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405614
xor eax, eax
push ebp
push 0x6f054a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
test al, al
jne 0x6f04b7
cmp byte [esi + 0x468], 0
je 0x6f04bd
mov byte [ebp - 5], 0
jmp 0x6f0534
mov eax, dword [ebp - 4]
call fcn.006f5570
test al, al
jne 0x6f0530
mov byte [ebp - 5], 0
cmp word [esi + 0x322a], 0
je 0x6f0510
lea eax, [ebp - 5]
push eax
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [esi + 0x322c]
call dword [esi + 0x3228]
cmp byte [ebp - 5], 0
je 0x6f0534
push 0x80
mov eax, dword [ebp - 4]
call fcn.00405624
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x6f0534
mov eax, dword [esi + 0x524]
push eax
push 0x62b6
mov ecx, 0x6f0564
mov edx, dword [ebp - 4]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x98]
jmp 0x6f0534
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f0551
lea eax, [ebp - 4]
call fcn.00405154
ret
Function at 0x6f232c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00405614
xor eax, eax
push ebp
push 0x6f2420
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.006eaff8
test al, al
je 0x6f23f4
xor edx, edx
push ebp
push 0x6f2396
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.006ebb30
mov edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.0040b5c8
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6f23a0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.006eb578
test al, al
jne 0x6f23ce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x524]
push eax
push 0x6232
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3200], 0
je 0x6f240a
cmp dword [ebp + 8], 0x20
je 0x6f240a
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405624
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x6f240a
mov eax, dword [ebp - 4]
add eax, 0x4d8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3208]
call fcn.004051a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f2427
lea eax, [ebp - 0xc]
call fcn.00405154
ret

Function at 0x6f29ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x6f2a18
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
mov esi, dword [0x74c77c]
movzx ebx, word [esi + ebx*2]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x6f29f2
pop esi
pop ebx
ret

Function at 0x6f2be0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x74fbe0
and eax, 0xff
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x74c688]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x74c688]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x6f2d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x6f2d29
call fcn.006f2ce0
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.006f2be0
inc dword [esi]
dec ebx
jne 0x6f2d12
pop esi
pop ebx
pop ecx
pop ebp
ret