joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d53
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94
mov esi, dword [esp + 0xb4]
mov ebx, dword [esp + 0xb0]
test ebx, ebx
mov ebp, 0x8000
je 0x403d76
mov ebp, esi
mov eax, dword [esp + 0xa8]
mov dword [esp + 4], 0x4381f0
je 0x403d8b
mov dword [esp + 4], ebx
test eax, eax
js 0x403da6
add eax, dword [0x4341e8]
xor ecx, ecx
push ecx
push ecx
push eax
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esp
push 4
push eax
push dword [0x418010]
call fcn.00407654
test eax, eax
je 0x403f8a
mov edi, dword [esp]
test edi, edi
js 0x403df4
test ebx, ebx
je 0x403f40
cmp edi, esi
jl 0x403dd3
mov edi, esi
push edi
push ebx
push dword [0x418010]
call fcn.00407654
test eax, eax
mov esi, 0xfffffffd
je 0x403f8f
mov esi, edi
jmp 0x403f8f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 8], eax
mov ecx, 0x4401f0
call fcn.0040824c
mov edi, 0x7fffffff
and edi, dword [esp]
mov dword [esp], edi
je 0x403f9e
xor esi, esi
mov dword [esp + 0x10], edi
mov eax, 0x4000
cmp edi, eax
jl 0x403e2d
mov edi, 0x4000
push edi
push 0x4341f0
push dword [0x418010]
call fcn.00407654
test eax, eax
je 0x403f8a
mov dword [0x440208], 0x4341f0
mov dword [0x44020c], edi
sub dword [esp], edi
mov eax, dword [esp + 4]
mov dword [esp + 4], eax
mov dword [0x440210], eax
mov dword [0x440214], ebp
mov ecx, 0x4401f0
call fcn.00408277
test eax, eax
js 0x403fa2
mov ebx, eax
mov dword [esp + 0xc], ebp
mov edi, dword [0x440210]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov eax, dword [0x40b044]
test byte [eax + 0x34], 1
je 0x403ee7
mov eax, ebp
sub eax, dword [esp + 8]
cmp eax, 0xc8
mov eax, dword [esp]
ja 0x403eb1
test eax, eax
jne 0x403ee7
mov edx, dword [esp + 0x10]
mov ecx, edx
sub ecx, eax
push edx
push 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
push str....__d__
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0
call fcn.004068cc
mov dword [esp + 8], ebp
mov eax, dword [esp + 4]
cmp edi, eax
je 0x403f2f
sub edi, eax
cmp dword [esp + 0xb0], 0
mov ebp, dword [esp + 0xc]
je 0x403f08
sub ebp, edi
mov eax, dword [0x440210]
jmp 0x403f22
push edi
push eax
push dword [esp + 0xb4]
call fcn.00407686
test eax, eax
mov eax, dword [esp + 4]
je 0x403fa9
add esi, edi
cmp ebx, 1
jne 0x403e5d
jmp 0x403f8f
mov edi, dword [esp]
test edi, edi
mov ebp, dword [esp + 0xc]
jg 0x403e1f
jmp 0x403f8f
xor esi, esi
test edi, edi
je 0x403f8f
mov ebx, dword [esp + 0xac]
cmp edi, ebp
jl 0x403f53
mov edi, ebp
push edi
push 0x4341f0
push dword [0x418010]
call fcn.00407654
test eax, eax
je 0x403f8a
push edi
push 0x4341f0
push ebx
call fcn.00407686
test eax, eax
je 0x403fa9
add esi, edi
mov eax, dword [esp]
sub eax, edi
mov dword [esp], eax
test eax, eax
mov edi, eax
jg 0x403f4d
jmp 0x403f8f
mov esi, 0xfffffffd
mov eax, esi
add esp, 0x94
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
xor esi, esi
jmp 0x403f8f
mov esi, 0xfffffffc
jmp 0x403f8f
mov esi, 0xfffffffe
jmp 0x403f8f
Function at 0x406cb0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
lea ebx, [esp + 0xc]
mov dword [ebx], 0x40001
mov eax, 0x40b3d4
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
xor esi, esi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], 0x40b3c4
mov eax, esp
mov dword [eax], 0xc
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406d22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0xb7
jne 0x406d22
push ebx
push 0x80000007
push edi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
mov esi, 0
jne 0x406d22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret 4

Function at 0x406d9e
Capabilities:
Create process on windows

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [0x46c310], 0x44
mov ecx, esp
xor esi, esi
push ecx
push 0x46c310
push esi
push esi
push 0x4000000
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406ddd
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp]
mov eax, esi
add esp, 0x10
pop esi
ret 4

Function at 0x406de6
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x406e92
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00406ee3
xor esi, esi
cmp eax, 0xffffffff
je 0x406eda
mov edi, eax
mov eax, dword [esp + 0x18]
mov ebp, eax
test al, 1
jne 0x406ebc
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x406ec3
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x406ecc
xor esi, esi
inc esi
jmp 0x406eda
mov eax, ebp
test al, 4
jne 0x406eda
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x406ee3
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
je 0x406f04
mov eax, esi
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
pop edi
ret 4
Function at 0x40719e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, 0x470354
push 0x2000
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call fcn.004073b5
xor ebx, ebx
test eax, eax
je 0x407230
mov esi, eax
push eax
call fcn.0040742a
mov eax, dword [0x40b398]
test byte [eax], 0x80
je 0x4071e1
movzx eax, word [esi]
test eax, eax
je 0x407230
cmp eax, 0x5c
je 0x407230
mov edi, 0x470354
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub esi, edi
sar esi, 1
cmp eax, esi
jle 0x40721b
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x470354
call fcn.004072fa
test eax, eax
je 0x40720e
test byte [eax], 0x10
je 0x407230
push edi
call fcn.00407255
push edi
call ebp
cmp eax, esi
jg 0x4071fb
push edi
call fcn.00407322
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4072cb
Capabilities:
Move file

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4072ed
push edi
push esi
call fcn.00407762
add esp, 8
mov eax, dword [0x40b044]
inc dword [eax + 0x10]
pop esi
pop edi
ret 8

Function at 0x4075ae
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
mov edx, 0
je 0x4075d2
mov edx, eax
push ecx
push edx
push ebx
push ecx
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop esi
pop edi
pop ebx
ret 0xc

Function at 0x4075e6
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
mov ebx, 0xffffff9b
mov ebp, esp
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc ebx
je 0x407641
mov dword [esp + 4], 0x61
mov dword [esp], 0x73006e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov edx, 0x4ec4ec4f
mul edx
shr edx, 3
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
add eax, edx
sub ecx, eax
add word [esp + 4], cx
push esi
push 0
push ebp
push dword [esp + 0x2c]
call edi
test eax, eax
je 0x4075fe
jmp 0x407648
mov word [esi], 0
xor esi, esi
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x407654
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, esp
push 0
push edi
push esi
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
cmp dword [edi], esi
sete cl
and cl, al
movzx eax, cl
add esp, 4
pop esi
pop edi
ret 0xc
Function at 0x407686
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, esp
push 0
push edi
push esi
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
cmp dword [edi], esi
sete cl
and cl, al
movzx eax, cl
add esp, 4
pop esi
pop edi
ret 0xc

Function at 0x4076b8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x1c]
xor ebx, ebx
push 1
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor esi, esi
inc esi
test eax, eax
jne 0x40772a
lea eax, [esp + 4]
lea ecx, [esp + 2]
push 0
push eax
push 2
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407706
cmp dword [esp + 4], 2
jne 0x407706
movzx eax, word [esp + 2]
cmp eax, 0xfeff
jne 0x407706
mov esi, ebx
jmp 0x40772a
cmp dword [esp + 0x20], 0
je 0x40771e
xor ebx, ebx
push 1
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x407735
xor eax, eax
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
ret 8
lea esi, [esp + 8]
push ebx
push esi
push 2
push 0x40b5e4
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi], 2
mov ebx, 0x80004005
mov ecx, 0x80004005
jne 0x40775a
xor ecx, ecx
test eax, eax
je 0x407702
mov ebx, ecx
jmp 0x407702
Function at 0x407762
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
mov dword [0x474f5c], 0x4c
mov dword [0x474f58], 0x55004e
test esi, esi
je 0x4077d5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
mov edx, 0
je 0x40779a
mov edx, eax
xor eax, eax
inc eax
push ecx
push edx
push eax
push ecx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x474f58
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x407930
cmp eax, 0x400
jg 0x407930
push 0x400
push 0x474754
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x407930
cmp eax, 0x400
jg 0x407930
mov edi, 0x474754
push edi
push 0x474f58
push str._ls_ls_r_n
push 0x474354
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov esi, eax
mov eax, dword [0x40a004]
mov eax, dword [eax]
push dword [eax + 0x128]
push edi
call fcn.00407938
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
mov edx, 0
je 0x407844
mov edx, eax
push ecx
push edx
push 4
push ecx
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x407930
mov edi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
lea eax, [esi + eax + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x407929
mov ebx, eax
mov eax, esp
push 0
push eax
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407929
cmp dword [esp], ebp
jne 0x407929
push str._Rename__r_n
push ebx
call fcn.0040751f
test eax, eax
je 0x4078d9
add eax, 0xa
push 0x40b5fb
push eax
call fcn.0040751f
test eax, eax
je 0x4078eb
mov ecx, ebp
add ecx, ebx
cmp ecx, eax
jbe 0x4078d4
mov dl, byte [ecx]
mov byte [ecx + esi], dl
dec ecx
jmp 0x4078c8
sub eax, ebx
inc eax
jmp 0x4078ed
lea eax, [ebx + ebp]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ebp, 0xa
mov eax, ebp
test esi, esi
je 0x407905
mov ecx, ebx
add ecx, eax
xor eax, eax
mov dl, byte [eax + 0x474354]
mov byte [ecx + eax], dl
inc eax
cmp esi, eax
jne 0x4078f7
add ebp, esi
xor esi, esi
push esi
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 4]
push esi
push eax
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407cd7
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], 0x4000
xor edx, edx
cmp dword [esp + 0x28], 0
setne dl
shl edx, 8
or edx, 0x20019
mov esi, esp
push esi
push edx
push ecx
push eax
call fcn.00407c6e
test eax, eax
jne 0x407d51
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push edi
push ecx
push 0
push dword [esp + 0x30]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [edi + 0x3ffe], 0
test esi, esi
jne 0x407d51
mov eax, dword [esp + 4]
add eax, 0xfffffffd
cmp eax, 0xfffffffd
ja 0x407d56
mov word [edi], 0
add esp, 0xc
pop esi
pop edi
ret 0x14

Function at 0x407e33
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push edi
push esi
push eax
cmp dword [esp + 0x10], 0
je 0x407e60
mov eax, dword [0x418040]
cmp eax, 0xffffffff
je 0x407e4e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x418040], 0xffffffff
add esp, 4
pop esi
pop edi
ret 4
cmp dword [0x47d758], 0
je 0x407e58
cmp word [0x47d75c], 0
mov eax, dword [0x418040]
je 0x407ec6
cmp eax, 0xffffffff
jne 0x407ec6
mov esi, 0x47d75c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
mov edx, 0
je 0x407e97
mov edx, eax
push ecx
push edx
push 4
push ecx
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x418040], eax
cmp eax, 0xffffffff
je 0x407e58
xor ecx, ecx
push 2
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x418040]
cmp eax, 0xffffffff
je 0x407e58
mov esi, 0x47df5c
push 0x40b6be
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [0x418040]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, esp
push 0
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x407e58

Function at 0x4080ab
Capabilities:
Get common file path

Disassembly:
push esi
sub esp, 0x23c
mov esi, esp
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, 0x105
jae 0x4080cb
mov ecx, eax
mov eax, dword [esp + 0x244]
test ecx, ecx
je 0x4080e3
xor edx, edx
cmp word [esp + ecx*2 - 2], 0x5c
sete dl
jmp 0x4080e6
xor edx, edx
inc edx
lea ecx, [esp + ecx*2]
lea edx, [edx + edx + 0x40b402]
push eax
push edx
push str._s_S.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x23c
pop esi
ret 4
Function at 0x4081e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
cmp dword [0x47f1b0], 0
jne 0x408220
xor eax, eax
mov edx, 8
mov esi, eax
mov edi, esi
shr edi, 1
and esi, 1
neg esi
and esi, 0xedb88320
xor esi, edi
dec edx
jne 0x4081fd
mov dword [eax*4 + 0x47f1ac], esi
inc eax
cmp eax, 0x100
jne 0x4081f6
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x408245
mov edx, dword [esp + 0x14]
not eax
mov bl, byte [edx]
xor bl, al
inc edx
movzx esi, bl
shr eax, 8
xor eax, dword [esi*4 + 0x47f1ac]
dec ecx
jne 0x40822e
not eax
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x6c2620
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a890
xor eax, eax
push ebp
push 0x6c26e7
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0x6c2704
call fcn.00689418
xor eax, eax
push ebp
push 0x6c269e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040b230
push eax
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x6c2692
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
push esi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x6c2694
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6c26aa
push 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov dword [ebp - 0xc], ebx
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6c275c
call fcn.00689358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c26ee
lea eax, [ebp - 4]
call fcn.0040a7ac
pop eax
jmp eax
Function at 0x6cc128
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6cc156
mov eax, ebx
call fcn.006ccbe4
cmp dword [ebx + 0x40], 0
je 0x6cc14f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x6cc1c7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x6cc1b9
cmp dword [ebx + 8], 0
je 0x6cc178
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x6cc18a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x6cc1b9
cmp dword [ebx + 8], 0
je 0x6cc16b
cmp eax, 3
je 0x6cc19d
dec eax
jne 0x6cc16b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6cc16b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6cc16b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x6cc1e5
cmp dword [ebx + 0x14], 0xcc
je 0x6cc1e5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.006cc1f0
pop ebx
ret

Function at 0x6e4790
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, eax
push 0
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0x11
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x6e48d4
call fcn.00689358
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov dl, 1
mov eax, ebx
call fcn.00426b14
test al, al
je 0x6e48a1
xor edx, edx
push ebp
push 0x6e489a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x8000000
push 3
push 0
push 0
push 0x80000000
mov eax, ebx
call fcn.0040b230
push eax
call sub.KERNEL32.DLL_CreateFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x6e487b
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 4
jbe 0x6e487b
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 0xc], 4
jne 0x6e487b
movzx eax, word [ebp - 8]
mov edx, dword [ebp - 8]
sub edx, 0xe0ffd8ff
je 0x6e4865
sub edx, 0x57467048
je 0x6e4853
sub edx, 0xf080742
je 0x6e485c
jmp 0x6e486e
mov dword [ebp - 4], 3
jmp 0x6e487b
mov dword [ebp - 4], 2
jmp 0x6e487b
mov dword [ebp - 4], 1
jmp 0x6e487b
cmp ax, 0x4d42
jne 0x6e487b
mov dword [ebp - 4], 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e48a1
cmp dword [ebp - 0x10], 0xffffffff
je 0x6e4897
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
pop eax
jmp eax
push 0
mov eax, dword [ebp - 4]
movsx eax, al
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x6e4918
call fcn.00689358
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x703490
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x70353e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x70351c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0040ac80
mov edx, eax
add edx, 2
lea eax, [ebp - 4]
call fcn.0040b3c0
mov eax, dword [ebp - 4]
call fcn.0040ac80
push eax
lea eax, [ebp - 4]
call fcn.0040ad48
push eax
push ebx
call sub.user32.dll_GetWindowTextW
cmp eax, 1
jle 0x703512
mov edx, eax
dec edx
lea eax, [ebp - 4]
call fcn.0040b3c0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
call fcn.0040b5d0
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x703526
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x703545
lea eax, [ebp - 4]
call fcn.0040a7ac
pop eax
jmp eax
Function at 0x730b78
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x730b80
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x730d37
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x730d50
call fcn.0040b498
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.0072e740
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x730d64
call fcn.00690ab8
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x730bfb
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x730c3c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.0072e740
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x730dcc
call fcn.00690ab8
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b440
mov eax, esi
mov edx, 0x730df8
call fcn.0040b440
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x730c54
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x730cc2
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x730e0c
call fcn.00690ab8
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b440
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x730c8b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x730cb6
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x730e3c
call fcn.00690ab8
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b440
mov eax, esi
mov edx, 0x730df8
call fcn.0040b440
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x730cce
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x730cf9
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x730e68
call fcn.00690ab8
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b440
mov eax, esi
mov edx, 0x730df8
call fcn.0040b440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x730d3e
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040a80c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a80c
lea eax, [ebp - 4]
call fcn.0040a7ac
pop eax
jmp eax