joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dfe0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x50], 0x6a8f
mov dword [ebp - 0x1c], 0xb679
mov dword [ebp - 0x54], 0x150f9
mov dword [ebp - 0x44], 0x16a23
mov dword [ebp - 0x48], 0x15bf1
mov dword [ebp - 0x4c], 0x3be6
mov dword [ebp - 0x40], 0x18177
mov dword [ebp - 0x58], 0x91ef
mov dword [ebp - 0x5c], 0x14e34
mov dword [ebp - 0x28], 0xe0d9
mov dword [ebp - 4], 0xd100
mov dword [ebp - 0x60], 0x1765d
mov dword [ebp - 0x3c], 0xe5a3
mov dword [ebp - 0x64], 0x18401
mov dword [ebp - 0x10], 0x13648
mov dword [ebp - 0x68], 0xe562
mov dword [ebp - 0x24], 0xa2aa
mov dword [ebp - 0x30], 0xe9ff
mov dword [ebp - 0x34], 0x7c81
mov dword [ebp - 0x6c], 0x8349
mov dword [ebp - 0x2c], 0x15b5
mov dword [ebp - 0x38], 0xe913
mov dword [ebp - 8], 0
jmp 0x40e092
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0xa2a9
cmp dword [ebp - 8], ecx
jge 0x40e0ab
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x40e089
mov dword [ebp - 0xc], 0
jmp 0x40e0bd
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0xe912
cmp dword [ebp - 0xc], ecx
jge 0x40e1a4
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 4]
jge 0x40e0e9
mov dword [ebp - 0x14], 1
jmp 0x40e0f0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x1c]
jge 0x40e101
mov dword [ebp - 0x18], 1
jmp 0x40e108
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x14]
and edx, dword [ebp - 0x18]
je 0x40e19f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x1c]
jge 0x40e12e
mov dword [ebp - 0x20], 1
jmp 0x40e135
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x40]
or edx, dword [ebp - 0x20]
je 0x40e19f
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jne 0x40e19f
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x2c]
jne 0x40e19f
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x30]
jne 0x40e19f
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x30]
jne 0x40e19f
push 0x14616
push 0x16fc3
push 0x1056f
push 0x6eb
push 0x3512
push 0x2e78
push 0xb18a
push 0x1488e
push 0x11e7e
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
add esp, 0x24
mov ecx, dword [ebp - 0x34]
sub ecx, 1
mov dword [ebp - 0x34], ecx
jmp 0x40e0b4
mov esp, ebp
pop ebp
ret
Function at 0x40f2f0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x38], 0x1410c
mov dword [ebp - 0x40], 0xebed
mov dword [ebp - 0x28], 0x63f9
mov dword [ebp - 0x3c], 0x14a71
mov dword [ebp - 0x30], 0x148a
mov dword [ebp - 0x48], 0x7df3
mov dword [ebp - 0x14], 0x100bc
mov dword [ebp - 4], 0x267a
mov dword [ebp - 0x50], 0xdc90
mov dword [ebp - 0xc], 0xbf8b
mov dword [ebp - 0x10], 0x7a0d
mov dword [ebp - 0x4c], 0x3ffc
mov dword [ebp - 0x54], 0x42cf
mov dword [ebp - 0x18], 0x1f8c
mov dword [ebp - 0x58], 0x10009
mov dword [ebp - 0x5c], 0x307b
mov dword [ebp - 0x2c], 0x123ac
mov dword [ebp - 0x60], 0x15f30
mov dword [ebp - 0x1c], 0x1270f
mov dword [ebp - 0x64], 0xfe65
mov dword [ebp - 0x34], 0xc408
mov dword [ebp - 0x44], 0x1ae0
mov dword [ebp - 0x68], 0xfdc6
mov eax, dword [ebp + 0xc]
add eax, 0x9b2
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x14941
push ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x3def
push edx
mov eax, dword [ebp - 0x1c]
sub eax, 0xceeb
push eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x3c30
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0xdf77
push edx
call fcn.00417250
add esp, 0x18
mov dword [ebp - 8], 0
jmp 0x40f3eb
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 0x6c83
cmp dword [ebp - 8], ecx
jge 0x40f4a1
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
jge 0x40f417
mov dword [ebp - 0x20], 1
jmp 0x40f41e
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x1c]
jge 0x40f42f
mov dword [ebp - 0x24], 1
jmp 0x40f436
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x3c]
and edx, dword [ebp - 0x20]
and edx, dword [ebp - 0x24]
je 0x40f49c
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x14]
jne 0x40f49c
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x28]
jne 0x40f49c
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jne 0x40f49c
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xc]
jne 0x40f49c
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0xc]
jne 0x40f49c
push 0x1402e
push 0x15db5
push 0x8d50
push 0x1e44
push 0x90cc
push 0x347a
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
add esp, 0x18
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x40f3e2
mov eax, dword [ebp - 0x48]
add eax, 0xc0c3
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x2e7
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0xa805
push edx
mov eax, dword [ebp - 0x4c]
sub eax, 0x2351
push eax
mov ecx, dword [ebp - 4]
add ecx, 0xad6b
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0xc996
push edx
call fcn.00405bf0
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x412be0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x30], 0x266f
mov dword [ebp - 0x58], 0x8f96
mov dword [ebp - 0x5c], 0xc7c0
mov dword [ebp - 0x60], 0x18330
mov dword [ebp - 0x34], 0x159b3
mov dword [ebp - 0x64], 0x11f13
mov dword [ebp - 0x2c], 0x17215
mov dword [ebp - 0x68], 0x9dd
mov dword [ebp - 0x54], 0xb026
mov dword [ebp - 0x44], 0x17b42
mov dword [ebp - 0x18], 0x44a1
mov dword [ebp - 0x38], 0x9e7f
mov dword [ebp - 0x10], 0x6cfd
mov dword [ebp - 0x48], 0x15fce
mov dword [ebp - 0x4c], 0x1b21
mov dword [ebp - 0x50], 0xc80
mov dword [ebp - 0x6c], 0x8b2b
mov dword [ebp - 0x70], 0x112c
mov dword [ebp - 0xc], 0x150a6
mov dword [ebp - 0x74], 0xf8c7
mov dword [ebp - 0x78], 0xaf0b
mov dword [ebp - 8], 0x8549
mov dword [ebp - 4], 0x102af
mov dword [ebp - 0x7c], 0x2237
mov eax, dword [ebp - 0x34]
add eax, 0x22ae
push eax
call fcn.0040b880
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 0
jmp 0x412cba
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x6cfc
cmp dword [ebp - 0x14], eax
jge 0x412cd2
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x412cb1
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 0x18]
jge 0x412ce3
mov dword [ebp - 0x1c], 1
jmp 0x412cea
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x40]
jge 0x412d10
mov dword [ebp - 0x20], 1
jmp 0x412d17
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x18]
jge 0x412d31
mov dword [ebp - 0x24], 1
jmp 0x412d38
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x20]
xor ecx, dword [ebp - 0x10]
or ecx, dword [ebp - 0x24]
je 0x412dde
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x2c]
jge 0x412d6d
mov dword [ebp - 0x28], 1
jmp 0x412d74
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, dword [ebp - 0x28]
xor edx, dword [ebp - 0x44]
je 0x412dde
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp + 8]
jne 0x412dde
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 0x4c]
jne 0x412dde
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x50]
jne 0x412dde
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0xc]
jne 0x412dde
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 0xc]
jne 0x412dde
push 0x8c2e
push 0xdb34
push 0x6eb2
push 0x13453
call dword [sym.imp.KERNEL32.dll_MoveFileA]
add esp, 0x10
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x30]
jge 0x412dde
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret
Function at 0x4136a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x28], 0x8811
mov dword [ebp - 0x30], 0x1224b
mov dword [ebp - 0x44], 0x1244b
mov dword [ebp - 0x38], 0x15dd3
mov dword [ebp - 0x2c], 0x15dd4
mov dword [ebp - 0x48], 0x39dd
mov dword [ebp - 0x40], 0x17486
mov dword [ebp - 0x14], 0x82a
mov dword [ebp - 0xc], 0x149b0
mov dword [ebp - 0x20], 0xcceb
mov dword [ebp - 0x4c], 0x109fa
mov dword [ebp - 0x24], 0xaf5
mov dword [ebp - 0x10], 0xfc4f
mov dword [ebp - 0x50], 0x1100c
mov dword [ebp - 0x54], 0x110d3
mov dword [ebp - 0x58], 0xc9dc
mov dword [ebp - 0x5c], 0x89c3
mov dword [ebp - 0x60], 0x144ba
mov dword [ebp - 0x64], 0x38f7
mov dword [ebp - 0x68], 0x13bec
mov dword [ebp - 0x3c], 0xf5f6
mov dword [ebp - 8], 0x2447
mov dword [ebp - 0x34], 0xaccd
mov dword [ebp - 4], 0
jmp 0x413759
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x829
cmp dword [ebp - 4], ecx
jge 0x413772
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
jmp 0x413750
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jge 0x413783
mov dword [ebp - 0x18], 1
jmp 0x41378a
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x41379b
mov dword [ebp - 0x1c], 1
jmp 0x4137a2
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x2c]
xor edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x1c]
je 0x4137f6
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
jne 0x4137f6
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jne 0x4137f6
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0xc]
jne 0x4137f6
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0xc]
jne 0x4137f6
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x10]
jne 0x4137f6
push 0x9df9
push 0xd0ae
push 0x48f2
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
add esp, 0xc
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x418050
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x50], 0x4e3f
mov dword [ebp - 0x54], 0xc166
mov dword [ebp - 0x48], 0x108f7
mov dword [ebp - 4], 0x83de
mov dword [ebp - 8], 0x746
mov dword [ebp - 0x30], 0xbd18
mov dword [ebp - 0x40], 0x10f9c
mov dword [ebp - 0x10], 0x1389
mov dword [ebp - 0x24], 0x4ea4
mov dword [ebp - 0x58], 0xd61
mov dword [ebp - 0x4c], 0x13a08
mov dword [ebp - 0x5c], 0x157a6
mov dword [ebp - 0xc], 0x1004
mov dword [ebp - 0x3c], 0xde37
mov dword [ebp - 0x18], 0x5387
mov dword [ebp - 0x2c], 0xa975
mov dword [ebp - 0x38], 0xad48
mov dword [ebp - 0x34], 0x4348
mov dword [ebp - 0x60], 0x7f06
mov dword [ebp - 0x28], 0x7b87
mov dword [ebp - 0x44], 0x167ee
mov dword [ebp - 0x14], 0x7e70
mov dword [ebp - 0x64], 0x16d57
mov eax, dword [ebp - 0x18]
add eax, 0x9ad
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xb45c
push ecx
mov edx, dword [ebp - 0x24]
add edx, 0x65ea
push edx
mov eax, dword [ebp - 0x28]
add eax, 0x96c
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x29bf
push ecx
mov edx, dword [ebp - 4]
add edx, 0x4f48
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x160c1
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x1259
push ecx
mov edx, dword [ebp + 0x10]
add edx, 0x1274
push edx
call fcn.00413aa0
add esp, 0x24
mov eax, dword [ebp - 0x10]
add eax, 0x103a5
push eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x2b11
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0x7044
push edx
mov eax, dword [ebp - 0x30]
sub eax, 0xa287
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x15ef1
push ecx
call fcn.004093e0
add esp, 0x14
mov edx, dword [ebp + 0x10]
add edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jge 0x4181a8
mov dword [ebp - 0x1c], 1
jmp 0x4181af
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x18]
jge 0x4181c0
mov dword [ebp - 0x20], 1
jmp 0x4181c7
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x20]
je 0x41823d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x38]
jge 0x41823d
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x40]
jge 0x41823d
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x44]
xor eax, dword [ebp + 0x10]
je 0x41823d
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jne 0x41823d
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 8]
jne 0x41823d
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 8]
jne 0x41823d
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x1ba0
push 0x827
push 0x534c
push 0xaf10
push 0x2870
push 0x3615
push 0xacd
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x420b20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x50], 0x3768
mov dword [ebp - 0x4c], 0x1741d
mov dword [ebp - 0x54], 0xf25
mov dword [ebp - 0x44], 0x14f09
mov dword [ebp - 0x48], 0x13c6f
mov dword [ebp - 0x58], 0x2e2f
mov dword [ebp - 0x5c], 0x14fd2
mov dword [ebp - 0x60], 0xf589
mov dword [ebp - 0x64], 0xbc19
mov dword [ebp - 0x2c], 0x16144
mov dword [ebp - 8], 0x1d39
mov dword [ebp - 0x68], 0x1016f
mov dword [ebp - 0x1c], 0x295
mov dword [ebp - 0x40], 0x1983
mov dword [ebp - 0x34], 0x60d7
mov dword [ebp - 4], 0x1135
mov dword [ebp - 0x38], 0x13436
mov dword [ebp - 0x30], 0x173b2
mov dword [ebp - 0x18], 0xa80a
mov dword [ebp - 0x28], 0x42d7
mov dword [ebp - 0x6c], 0x166ab
mov dword [ebp - 0x3c], 0x18b5
mov dword [ebp - 0x70], 0x114d0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp + 0x2c]
jge 0x420bd8
mov dword [ebp - 0xc], 1
jmp 0x420bdf
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x2c]
jge 0x420bf0
mov dword [ebp - 0x10], 1
jmp 0x420bf7
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x3c]
jge 0x420c0b
mov dword [ebp - 0x14], 1
jmp 0x420c12
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
or eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x10]
or eax, dword [ebp - 0x14]
je 0x420caa
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x18]
jne 0x420caa
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 0x20]
jne 0x420caa
mov eax, dword [ebp + 0x28]
cmp eax, dword [ebp + 0x10]
jne 0x420caa
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x44]
jne 0x420caa
push 0x66aa
push 0x9d
push 0x13285
push 0x14983
push 0x9d12
call dword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
add esp, 0x14
mov edx, dword [ebp + 0x14]
cmp edx, dword [ebp - 8]
jge 0x420c7a
mov dword [ebp - 0x20], 1
jmp 0x420c81
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x1c]
jge 0x420c92
mov dword [ebp - 0x24], 1
jmp 0x420c99
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
or ecx, dword [ebp - 0x24]
je 0x420caa
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x15ee
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x12119
push ecx
mov edx, dword [ebp - 0x4c]
sub edx, 0xd233
push edx
mov eax, dword [ebp - 0x28]
add eax, 0x17de
push eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0xf1c3
push ecx
call fcn.0040e1b0
add esp, 0x14
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov esp, ebp
pop ebp
ret
Function at 0x6ae130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0x90], 0xf42c
mov dword [ebp - 0x68], 0x2d95
mov dword [ebp - 4], 0x8b34
mov dword [ebp - 0x78], 0x1231f
mov dword [ebp - 0x84], 0x7f03
mov dword [ebp - 0x6c], 0x1676a
mov dword [ebp - 0x7c], 0x17ead
mov dword [ebp - 0x4c], 0x3bb
mov dword [ebp - 0x80], 0x1309d
mov dword [ebp - 0x94], 0xf2eb
mov dword [ebp - 8], 0x468a
mov dword [ebp - 0x40], 0xe3ce
mov dword [ebp - 0x98], 0x6f63
mov dword [ebp - 0xc], 0xee8a
mov dword [ebp - 0x18], 0xe6f4
mov dword [ebp - 0x70], 0xed55
mov dword [ebp - 0x9c], 0x3d2c
mov dword [ebp - 0x1c], 0x126aa
mov dword [ebp - 0xa0], 0xb94
mov dword [ebp - 0xa4], 0x108f8
mov dword [ebp - 0x58], 0x2af9
mov dword [ebp - 0xa8], 0x645e
mov dword [ebp - 0x24], 0x82f0
mov dword [ebp - 0x20], 0xc87b
mov eax, dword [0x7f8334]
sub eax, 1
mov dword [0x7f8334], eax
mov dword [ebp - 0x10], 0
jmp 0x6ae218
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x68]
sub edx, 0x2d94
cmp dword [ebp - 0x10], edx
jge 0x6ae298
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x24]
jge 0x6ae237
mov dword [ebp - 0x2c], 1
jmp 0x6ae23e
mov dword [ebp - 0x2c], 0
mov ecx, dword [0x7f832c]
add ecx, 1
mov dword [0x7f832c], ecx
mov edx, dword [0x7f832c]
xor edx, dword [0x7f83b8]
cmp edx, dword [0x7f8328]
jge 0x6ae26a
mov dword [ebp - 0x28], 1
jmp 0x6ae271
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
or edx, dword [ebp - 0x20]
or edx, ecx
je 0x6ae293
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x6ae20f
mov ecx, dword [0x7f8320]
sub ecx, 1
mov dword [0x7f8320], ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x6bcb19
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x6bcb58
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6bcb58
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6bcb58
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x6bcb58
cmp dword [ecx + 0x74], 0xe
jbe 0x6bcb58
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x6c91d4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x6c9213
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6c9213
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6c9213
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x6c9213
cmp dword [ecx + 0x74], 0xe
jbe 0x6c9213
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x6e8e59
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006e8d2d
Function at 0x6e9954
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x810240]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x6e999f
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.006e9df4
test al, al
jne 0x6e9999
sub edx, 2
cmp edx, edi
jne 0x6e997f
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x6e99c1
lea eax, [edi + 2]
cmp edx, eax
je 0x6e99c1
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.006e961b
add esp, 0x10
jmp 0x6e9abb
push esi
lea ecx, [ebp - 0x255]
call fcn.006e9df4
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x6e9a04
push dword [ebp - 0x25c]
jmp 0x6e99b1
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x6e9a41
cmp word [ebp - 0x226], 0
je 0x6e9a62
cmp word [ebp - 0x226], ax
jne 0x6e9a41
cmp word [ebp - 0x224], 0
je 0x6e9a62
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.006e961b
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x6e9aae
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x6e9a1b
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x6e9a96
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x6e9abb
push 0x6e906b
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.006f4bd0
add esp, 0x10
jmp 0x6e9a8b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006bd089
leave
ret
Function at 0x6eb33b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x6eb3d8
push ebx
push esi
call fcn.006eb2f7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.006eb234
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x6eb385
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x6eb3d7
push edi
push eax
call fcn.006edb3e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x6eb3a5
call fcn.006e9019
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x6eb3d6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.006eb234
add esp, 0x20
test eax, eax
jne 0x6eb3c4
push edi
call fcn.006e9019
jmp 0x6eb3cc
push ebx
call fcn.006e9019
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x6eb3db
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x6eb3ec
pop esi
ret
push ebx
push edi
push esi
call fcn.006eb2f7
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.006edb3e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x6eb414
push ebx
push esi
push edi
call fcn.006c5c40
add esp, 0xc
push 0
call fcn.006e9019
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x6ebd03
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006eb689

Function at 0x6efe56
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.006e8373
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x6efec5
cmp esi, dword [ebp - 4]
je 0x6efec0
cmp dword [ebp + 0xc], 0
je 0x6efec0
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x6efe9d
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.006ef9a8
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x6efec7
xor eax, eax
inc eax
jmp 0x6efec7
xor eax, eax
pop edi
pop esi
leave
ret