joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68c8d1
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x68c98b
mov eax, dword [ebp + 8]
cmp dword [eax + 0x19c], 0
je 0x68c98b
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x19c]
cmp dword [edx + 0x1d0c], 0
je 0x68c98b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x19c]
mov edx, dword [ecx + 0x1d0c]
cmp dword [edx + 4], 0
je 0x68c98b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x19c]
mov edx, dword [ecx + 0x1d0c]
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x7d0
mov dword [ebp - 4], eax
push 0
mov ax, word [ebp + 0x10]
push eax
mov cx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
call dword [edx + 4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x68c972
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x68c97a
cmp dword [ebp - 0xc], 0
jge 0x68c97a
jmp 0x68c98b
cmp dword [ebp - 0xc], 0
jne 0x68c98b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 4]
jb 0x68c94d
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x68efd4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x68f002
cmp dword [ebp + 0x10], 0
jne 0x68f004
jmp 0x68f05d
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0068fa23
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x68f05d
cmp dword [ebp - 4], 0
je 0x68f05d
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.0068fa23
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x68f05d
cmp dword [ebp - 4], 0
je 0x68f05d
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.MSVCR80.dll_rename]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
je 0x68f076
mov eax, dword [ebp - 0x10]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 0
je 0x68f08f
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.006511ab
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x68f096
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x68f0c4
cmp dword [ebp + 0x10], 0
jne 0x68f0c6
jmp 0x68f11f
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0068fce4
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x68f11f
cmp dword [ebp - 4], 0
je 0x68f11f
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.0068fce4
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x68f11f
cmp dword [ebp - 4], 0
je 0x68f11f
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.MSVCR80.dll__wrename]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
je 0x68f138
mov eax, dword [ebp - 0x10]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 0
je 0x68f151
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.006511ab
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x68f2d4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp + 0xc], 0
jne 0x68f2f7
jmp 0x68f326
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0068fa23
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x68f326
cmp dword [ebp - 4], 0
je 0x68f326
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.MSVCR80.dll_remove]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x68f33f
mov eax, dword [ebp - 8]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x68f346
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp + 0xc], 0
jne 0x68f369
jmp 0x68f398
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0068fce4
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x68f398
cmp dword [ebp - 4], 0
je 0x68f398
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.MSVCR80.dll__wremove]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x68f3b1
mov eax, dword [ebp - 8]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x690631
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x690672
cmp dword [ebp + 0xc], 0
je 0x690672
cmp dword [ebp + 0x10], 0
je 0x690672
cmp dword [ebp + 0x14], 0
jne 0x690677
jmp 0x69074b
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0068fa23
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x69074b
cmp dword [ebp - 0xc], 0
je 0x69074b
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x69074b
mov edx, dword [ebp - 0xc]
add edx, 1
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x69074b
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x69074b
mov edx, dword [ebp + 0x10]
cmp dword [edx], 1
je 0x690721
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x690736
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.0068fedb
add esp, 8
mov dword [ebp - 8], eax
jmp 0x69074b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
cmp dword [ebp - 0x10], 0
je 0x690764
mov eax, dword [ebp - 0x10]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x14], 0
je 0x69077d
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.006511ab
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x690784
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x6907c5
cmp dword [ebp + 0xc], 0
je 0x6907c5
cmp dword [ebp + 0x10], 0
je 0x6907c5
cmp dword [ebp + 0x14], 0
jne 0x6907ca
jmp 0x69089e
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0068fce4
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x69089e
cmp dword [ebp - 0xc], 0
je 0x69089e
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x69089e
mov edx, dword [ebp - 0xc]
add edx, 1
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x69089e
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x69089e
mov edx, dword [ebp + 0x10]
cmp dword [edx], 1
je 0x690874
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x690889
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0068fd8a
add esp, 8
mov dword [ebp - 8], eax
jmp 0x69089e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
cmp dword [ebp - 0x14], 0
je 0x6908b7
mov eax, dword [ebp - 0x14]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
je 0x6908d0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.006511ab
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x690933
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x69096d
cmp dword [ebp + 0xc], 0
je 0x69096d
cmp dword [ebp + 0x14], 0
je 0x69096d
cmp dword [ebp + 0x18], 0
jne 0x690972
jmp 0x6909f4
cmp dword [ebp + 0x10], 1
je 0x69097e
cmp dword [ebp + 0x10], 2
jne 0x6909d5
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0068fa23
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x690999
jmp 0x6909f4
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.0068fa23
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x6909b4
jmp 0x6909f4
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
jmp 0x6909f4
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
je 0x690a0d
mov edx, dword [ebp - 0x10]
push edx
call fcn.006511ab
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 8], 0
je 0x690a26
mov eax, dword [ebp - 8]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x690a2d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x690a67
cmp dword [ebp + 0xc], 0
je 0x690a67
cmp dword [ebp + 0x14], 0
je 0x690a67
cmp dword [ebp + 0x18], 0
jne 0x690a6c
jmp 0x690af6
cmp dword [ebp + 0x10], 1
je 0x690a78
cmp dword [ebp + 0x10], 2
jne 0x690ad7
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0068fce4
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x690a93
jmp 0x690af6
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.0068fce4
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x690aae
jmp 0x690af6
mov ecx, dword [ebp - 0xc]
shl ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x690af6
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
je 0x690b0f
mov eax, dword [ebp - 0x10]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 8], 0
je 0x690b28
mov ecx, dword [ebp - 8]
push ecx
call fcn.006511ab
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x690b73
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x690bad
cmp dword [ebp + 8], 0
jne 0x690bad
jmp 0x690c4e
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp dword [ebp - 0x10], 0
je 0x690c4e
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x690c4e
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x690c4e
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0068fedb
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x690c4e
cmp dword [ebp + 0xc], 0
je 0x690c48
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0xc]
jle 0x690c22
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
cmp dword [ebp - 0xc], 0
je 0x690c67
mov eax, dword [ebp - 0xc]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x690c80
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.006511ab
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x690c87
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x690cc1
cmp dword [ebp + 8], 0
jne 0x690cc1
jmp 0x690d64
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [ebp - 0x10], 0
je 0x690d64
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x690d64
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x690d64
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0068fd8a
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x690d64
cmp dword [ebp + 0xc], 0
je 0x690d5e
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0xc]
jle 0x690d38
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
je 0x690d7d
mov eax, dword [ebp - 8]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x690d96
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.006511ab
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x690e9b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0068fa23
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x690f93
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x690f93
cmp dword [ebp + 0x10], 0
je 0x690f93
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x690f93
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x690f93
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0068fedb
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x690f7a
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
jle 0x690f5a
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR80.dll_strncpy]
add esp, 0xc
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x10]
mov byte [edx], 0
jmp 0x690f93
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x690fac
mov edx, dword [ebp - 8]
push edx
call fcn.006511ab
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x690fc5
mov eax, dword [ebp - 4]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x690fde
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.006511ab
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x690fe5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0068fce4
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x6910df
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6910df
cmp dword [ebp + 0x10], 0
je 0x6910df
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6910df
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6910df
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0068fd8a
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6910c6
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
jle 0x6910a6
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR80.dll_strncpy]
add esp, 0xc
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x10]
mov byte [edx], 0
jmp 0x6910df
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x6910f8
mov edx, dword [ebp - 8]
push edx
call fcn.006511ab
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x691111
mov eax, dword [ebp - 4]
push eax
call fcn.006511ab
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x69112a
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.006511ab
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x6a4d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
mov byte [ebp - 0xc], cl
mov edx, dword [ebp + 0x10]
sar edx, 8
and edx, 0xff
mov byte [ebp - 0xb], dl
mov eax, dword [ebp + 0x10]
sar eax, 0x10
and eax, 0xff
mov byte [ebp - 0xa], al
mov ecx, dword [ebp + 0x10]
sar ecx, 0x18
and ecx, 0xff
mov byte [ebp - 9], cl
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
test edx, edx
je 0x6a4dad
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov al, byte [ecx]
xor al, byte [ebp + edx - 0xc]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jle 0x6a4da2
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x6a4d6b
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x6a5880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov byte [ebp - 0x40], 0xc
mov byte [ebp - 0x3f], 0x52
mov byte [ebp - 0x3e], 0xe3
mov byte [ebp - 0x3d], 0xa8
mov byte [ebp - 0x3c], 0xf6
mov byte [ebp - 0x3b], 0xd4
mov byte [ebp - 0x3a], 0xc7
mov byte [ebp - 0x39], 0x68
mov byte [ebp - 0x38], 0xf2
mov byte [ebp - 0x37], 0x36
mov byte [ebp - 0x36], 0x1c
mov byte [ebp - 0x35], 0x88
mov byte [ebp - 0x34], 0x15
mov byte [ebp - 0x33], 0x36
mov byte [ebp - 0x32], 0x97
mov byte [ebp - 0x31], 0xde
mov byte [ebp - 0x30], 0x55
mov byte [ebp - 0x2f], 0x9a
mov byte [ebp - 0x2e], 0x9e
mov byte [ebp - 0x2d], 0xdf
mov byte [ebp - 0x2c], 5
mov byte [ebp - 0x2b], 0xd5
mov byte [ebp - 0x2a], 0xf3
mov byte [ebp - 0x29], 0x52
mov byte [ebp - 0x28], 0xe1
mov byte [ebp - 0x27], 0xe1
mov byte [ebp - 0x26], 0xcb
mov byte [ebp - 0x25], 0xfb
mov byte [ebp - 0x24], 0xb4
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0xca
mov byte [ebp - 0x20], 0x29
mov byte [ebp - 0x1f], 0xed
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x62
mov byte [ebp - 0x1c], 0x6a
mov byte [ebp - 0x1b], 0xba
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0xa1
mov byte [ebp - 0x18], 0xb0
mov byte [ebp - 0x17], 0x2b
mov byte [ebp - 0x16], 0x27
mov byte [ebp - 0x15], 0x60
mov byte [ebp - 0x14], 0x87
mov byte [ebp - 0x13], 0x81
mov byte [ebp - 0x12], 0xd1
mov byte [ebp - 0x11], 0xa4
mov byte [ebp - 0x10], 0x10
mov byte [ebp - 0xf], 0xf7
mov byte [ebp - 0xe], 0xd2
mov byte [ebp - 0xd], 0x6b
mov byte [ebp - 0xc], 0xce
mov byte [ebp - 0xb], 0xb5
mov byte [ebp - 0xa], 0x12
mov byte [ebp - 9], 0xc5
mov dword [ebp - 8], 0x38
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
ja 0x6a5997
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp + edx - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret