joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6758c4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov eax, 0x69d2ab
xor edx, edx
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0x6f5bb4
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x28], eax
mov word [ebp - 0x1c], 0
mov dword [ebp - 0x10], edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x2c]
mov dword fs:[0], eax
push 0xc
call fcn.0067ac68
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x67594b
lea edx, [ebp - 0x2c]
mov ecx, 0x6b0470
push edx
push 0
push 0
push 0
push 1
push 0x40487c
push 0
mov eax, 0x6b045c
mov word [ebp - 0x1c], 8
mov dword [ebp - 4], ecx
lea edx, [ebp - 4]
inc dword [ebp - 0x10]
mov dword [ebp - 4], eax
inc dword [ebp - 0x10]
push edx
push 0x404824
call fcn.006aa5c5
add esp, 0x24
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x1c], 0x14
mov ecx, dword [ebp + 8]
mov esi, dword [ecx]
mov eax, esi
shl eax, 3
lea eax, [eax + eax*8]
push eax
call fcn.0067ac68
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x6759ae
lea edx, [ebp - 0x2c]
mov ecx, 0x6b0470
push edx
push 0
push 0
push 0
push 1
push 0x40487c
push 0
mov eax, 0x6b045c
mov word [ebp - 0x1c], 0x20
mov dword [ebp - 8], ecx
lea edx, [ebp - 8]
inc dword [ebp - 0x10]
mov dword [ebp - 8], eax
inc dword [ebp - 0x10]
push edx
push 0x404824
call fcn.006aa5c5
add esp, 0x24
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 8], ebx
mov word [ebp - 0x1c], 0
jmp 0x6759dd
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov ecx, dword [edx + 0x10]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov ecx, dword [edx]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x30]
add eax, 8
mov dword [eax + 8], edx
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 8]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
shl edx, 3
lea edx, [edx + edx*8]
add eax, edx
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x2c]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6793ae
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
cmp dword [0x6f6064], 0
je 0x6793c4
mov eax, dword [0x6f6064]
jmp 0x6793d8
lea edx, [ebp - 0x24]
push edx
call sub.KERNEL32.DLL_GetSystemInfo
mov ecx, dword [ebp - 0x20]
mov dword [0x6f6064], ecx
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x67aca4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x24], eax
xor edx, edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x30], edx
push 0xc
call fcn.0067ac68
pop ecx
mov esi, eax
test eax, eax
je 0x67acdf
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.0067b0dc
add esp, 8
jmp 0x67ace1
mov eax, esi
mov dword [ebx + 0x48], eax
push ebx
call fcn.0067ad24
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x681754
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 1
call fcn.00681324
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x134], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x130], edx
mov eax, dword [ebp - 4]
xor dword [eax + 0x9c], edi
mov ebx, 1
mov eax, ebx
shl eax, 3
sub eax, ebx
add eax, eax
mov ecx, 0x25
cdq
idiv ecx
mov eax, edx
mov edx, dword [ebp - 4]
xor dword [edx + eax*4 + 0x9c], esi
mov eax, esi
sub edi, esi
mov esi, edi
mov edi, eax
inc ebx
cmp ebx, 0x25
jl 0x68178f
xor ebx, ebx
call fcn.00681694
inc ebx
cmp ebx, 0x3e8
jl 0x6817bc
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6851c0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [ebp + 8]
xor edx, edx
lea eax, [ecx + 0x1c]
xor ebx, ebx
mov dword [eax], ebx
inc edx
add eax, 4
cmp edx, 0x50
jl 0x6851cc
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx + 0x18], 0xc3d2e1f0
pop ebx
pop ebp
ret

Function at 0x688cb8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x688cf1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00697cb4
jmp 0x688cfa
mov eax, ebx
mov edx, esi
call fcn.00697c18
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x688d04
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x688d25
mov al, byte [esp]
jmp 0x688d27
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x6893ac
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x689224
mov eax, dword [0x6fc584]
cmp byte [eax], 0
je 0x689419
mov eax, dword [0x6fc59c]
call fcn.00696a4c
call fcn.00696640
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00686650
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x689460
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x68944f
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x6fc618]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x6fc730]
call fcn.00698fbc
push eax
call sub.USER32.DLL_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
add esp, 0x444
ret

Function at 0x68a0d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x68a134
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00697e2c
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00686348
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68a13b
lea eax, [ebp - 0xc]
call fcn.00697bc4
ret
Function at 0x697058
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x6f7114]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x6970f0
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x6970d0
xor eax, eax
push ebp
push 0x6970c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x69710c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6970d0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x6f7114]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x6f7114], ax
mov esp, ebp
pop ebp
ret

Function at 0x697a48
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x6fec6c], 0
je 0x697aa9
cmp word [0x6fee40], 0xd7b2
jne 0x697a71
cmp dword [0x6fee48], 0
jbe 0x697a71
mov eax, 0x6fee3c
call dword [0x6fee58]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x697ad0
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x6f7120], 0
jne 0x697ac5
push 0
push 0x6f7178
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x6991b0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x6993e0
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x699233
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x6993e0
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x699233
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x6993fc
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x6992bc
xor eax, eax
push ebp
push 0x6992b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00698ff8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x69929a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x69941c
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x69929a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6992bc
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x6993d6
cmp byte [ebp - 0xd], 0
jne 0x699303
cmp byte [ebp - 0x12], 0
je 0x6993d6
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x69931c
dec ebx
cmp byte [ebx], 0x2e
je 0x69932b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x69931b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x6993d6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x699368
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x6993d6
cmp byte [ebp - 0xd], 0
je 0x6993d6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x6993d6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6996cc
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x6ff1e0], 1
jae 0x699752
mov byte [0x6f7110], 2
mov dword [0x6fec30], 0x6add02
mov dword [0x6fec34], 0x6add20
mov byte [0x6fec6e], 2
mov dword [0x6fec1c], 0x6987e8
call fcn.00697028
test al, al
je 0x69970f
call fcn.00697058
call fcn.0069711c
mov word [0x6fec74], 0xd7b0
mov word [0x6fee40], 0xd7b0
mov word [0x6ff00c], 0xd7b0
call fcn.006986d4
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x6fec60], eax
call fcn.0069512c
mov dword [0x6fec5c], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x6fec54], eax
ret

Function at 0x6998b4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov eax, 0x6f7204
call fcn.0069d264
mov word [ebp - 0x14], 8
cmp dword [ebp + 8], 0
jne 0x69991d
mov edx, dword [ebp + 0xc]
imul edx, dword [ebp + 0x10]
test esi, 0x10
je 0x6998ef
mov ecx, 4
jmp 0x6998f1
xor ecx, ecx
add edx, ecx
push edx
call fcn.0067ac46
pop ecx
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x699914
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x699a68
mov dword [ebp - 0x2c], 1
jmp 0x699922
xor eax, eax
mov dword [ebp - 0x2c], eax
test esi, 0x10
je 0x699936
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [edx], ecx
add dword [ebp + 8], 4
test edi, edi
jne 0x69994c
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x699a68
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x28], ecx
mov ebx, dword [ebp + 8]
mov word [ebp - 0x14], 8
jmp 0x69999c
mov eax, esi
and eax, 7
mov word [ebp - 0x14], 8
dec eax
je 0x699978
dec eax
je 0x69997e
dec eax
je 0x699983
sub eax, 2
je 0x699989
jmp 0x69998e
push ebx
call edi
pop ecx
jmp 0x699999
push ebx
call edi
jmp 0x699999
mov eax, ebx
call edi
jmp 0x699999
push ebx
call edi
jmp 0x699999
push str.Illegal_mode_in__vector_new_
call fcn.006a76a4
pop ecx
add ebx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x28]
add dword [ebp - 0x28], 0xffffffff
test edx, edx
jg 0x69995d
mov word [ebp - 0x14], 0
jmp 0x699a5b
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x69a95c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x6f8a18
push ebx
call fcn.0069d264
mov edx, dword [ebp + 0xc]
push edx
call fcn.0067ac68
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x69a9b5
lea eax, [ebp - 0x28]
lea edx, [ebp - 4]
push eax
push 0
push 0
push 0
push 1
push 0x40487c
push 0
mov word [ebp - 0x18], 8
push edx
call fcn.0069c4f0
pop ecx
add dword [ebp - 0xc], 2
lea ecx, [ebp - 4]
push ecx
push 0x404824
call fcn.006aa5c5
add esp, 0x24
mov eax, ebx
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x69da8c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov eax, 0x6f9208
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
call fcn.0069d264
cmp dword [ebp + 8], 0
mov ebx, dword [ebp + 0x10]
jne 0x69dadf
lea eax, [ebp - 0x24]
mov edx, 0x6b0470
push eax
push 0
push 0
push 0
push 1
push 0x69dbc4
push 0
mov dword [ebp - 0x2c], edx
mov ecx, 0x6f7444
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
push 0x699ffc
call fcn.006aa5c5
add esp, 0x24
test esi, esi
je 0x69db12
test byte [ebx + 0xc], 0x80
je 0x69daed
xor edi, edi
jmp 0x69db14
sub esi, dword [esi - 4]
cmp dword [esi - 4], 0
je 0x69db0d
push 0x29e
push 0x6f8ff7
push 0x6f8fd0
call fcn.006a73e8
add esp, 0xc
mov edi, dword [esi - 0xc]
jmp 0x69db14
mov edi, ebx
mov eax, esi
add eax, edi
sar eax, 4
and eax, 0xff
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov ebx, dword [edx*4 + 0x6ff40c]
test ebx, ebx
je 0x69db42
cmp edi, dword [ebx + 4]
jne 0x69db3b
cmp esi, dword [ebx + 8]
je 0x69db42
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x69db31
test ebx, ebx
jne 0x69dbb1
push 0x14
call fcn.0067ac68
pop ecx
mov dword [ebp - 0x30], eax
test eax, eax
je 0x69dba4
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx*4 + 0x6ff40c]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], edi
mov eax, 0x6f922c
mov edx, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 4], eax
mov edx, 0x6f921c
mov ecx, dword [ebp - 0x30]
mov dword [ecx], edx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x30]
xor ecx, ecx
mov dword [edx + 0x10], ecx
mov ebx, dword [ebp - 0x30]
jmp 0x69dba7
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov dword [eax*4 + 0x6ff40c], ebx
mov eax, ebx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x69dbdc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x69dc35
cmp dword [ebx + 0x10], 0
je 0x69dbf8
mov eax, dword [ebx + 0x10]
jmp 0x69dc3e
cmp dword [ebx + 8], 0
jne 0x69dc05
mov eax, str._notype_
jmp 0x69dc3e
mov edx, dword [ebx + 8]
mov edi, dword [edx - 0x2c]
movzx esi, byte [edi]
lea eax, [esi + 1]
push eax
call fcn.0067ac46
pop ecx
mov dword [ebx + 0x10], eax
push esi
inc edi
push edi
push dword [ebx + 0x10]
call fcn.0069cc60
add esp, 0xc
mov eax, dword [ebx + 0x10]
mov byte [eax + esi], 0
mov eax, dword [ebx + 0x10]
jmp 0x69dc3e
push dword [eax + 4]
call fcn.0069d7d4
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x69e388
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0069f5bc
test byte [ebp + 0xd], 0xc0
jne 0x69e3ac
mov eax, dword [0x6f98f0]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x69e3b9
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x69e3e6
je 0x69e3f8
sub ecx, 0x100
je 0x69e406
sub ecx, 0x100
je 0x69e40d
sub ecx, 0x100
je 0x69e3ff
jmp 0x69e414
sub ecx, 0x600
je 0x69e40d
sub ecx, 0x100
je 0x69e3f8
jmp 0x69e414
mov edi, 1
jmp 0x69e419
mov edi, 2
jmp 0x69e419
mov edi, 4
jmp 0x69e419
mov edi, 5
jmp 0x69e419
mov edi, 3
test byte [ebp + 0xd], 1
je 0x69e440
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x6f9368]
test al, 0x80
je 0x69e439
mov ebx, 0x80
jmp 0x69e452
mov ebx, 1
jmp 0x69e452
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x69e452
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x69e464
je 0x69e46d
dec eax
je 0x69e476
jmp 0x69e47f
mov dword [ebp - 4], getsockname
jmp 0x69e48e
mov dword [ebp - 4], 0x40000000
jmp 0x69e48e
mov dword [ebp - 4], 0xc0000000
jmp 0x69e48e
push 1
call fcn.0069f9b4
pop ecx
mov ebx, eax
jmp 0x69e57e
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x69e4aa
sub eax, 0x10
je 0x69e4b1
sub eax, 0x10
je 0x69e4ba
sub eax, 0x10
je 0x69e4c3
jmp 0x69e4c3
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x69e4ca
mov dword [ebp - 8], 1
jmp 0x69e4ca
mov dword [ebp - 8], 2
jmp 0x69e4ca
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x69e537
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x69e52c
test byte [ebp + 0xd], 1
je 0x69e527
mov ebx, 0x50
jmp 0x69e52c
mov ebx, 2
push ebx
call fcn.0069f9b4
pop ecx
mov ebx, eax
jmp 0x69e57e
mov edi, esi
push edi
call fcn.0069e2ec
pop ecx
test eax, eax
je 0x69e54b
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x69e557
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0069f6dc
add esp, 8
mov ebx, eax
inc eax
jne 0x69e57e
push 4
call fcn.0069f9b4
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0069f5f0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x69ea3c
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x69ea58
call fcn.0069fa20
jmp 0x69eac7
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x69ea74
call fcn.0069fa20
jmp 0x69eac7
cmp dword [0x6ffbe8], 1
je 0x69eac5
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.006a7380
pop ecx
cmp al, 0x41
jl 0x69eac5
cmp al, 0x5a
jg 0x69eac5
cmp byte [ebp - 0x107], 0x3a
jne 0x69eac5
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x69eac5
call fcn.0069fa20
jmp 0x69eac7
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x69eacc
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x69eae8
call fcn.0069fa20
jmp 0x69eb09
test byte [ebp + 0xc], 0x80
jne 0x69eaf3
or ebx, 1
jmp 0x69eaf6
and ebx, 0xfffffffe
push ebx
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
dec eax
je 0x69eb07
call fcn.0069fa20
jmp 0x69eb09
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x69eb10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x69eb40
movsx edx, byte [ebp - 0x104]
sub edx, 0x61
inc edx
jmp 0x69eb4b
movsx edx, byte [ebp - 0x104]
sub edx, 0x41
inc edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret

Function at 0x69eb54
Capabilities:
Get disk information
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
mov dword [esi], eax
mov byte [ebp - 4], 0x3d
mov dl, byte [ebp + 8]
add dl, 0x40
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x104
push edi
push ecx
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
jne 0x69ebba
mov al, byte [ebp - 3]
mov byte [edi], al
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
push edi
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x69ebba
call fcn.0069fa20
jmp 0x69ebf5
push edi
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x69ebca
call fcn.0069fa20
jmp 0x69ebf5
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
mov byte [edi], 0x41
jmp 0x69ebf0
push edi
call sub.KERNEL32.DLL_GetDriveTypeA
mov ebx, eax
test eax, eax
je 0x69ebee
cmp ebx, 1
je 0x69ebee
inc dword [esi]
inc byte [edi]
cmp byte [edi], 0x5a
jle 0x69ebdb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x69f4bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.0067ab08
pop ecx
mov ebx, eax
test eax, eax
jne 0x69f4e0
xor eax, eax
jmp 0x69f589
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x69f501
cmp esi, 0x104
jb 0x69f50c
push ebx
call fcn.0067abcd
pop ecx
xor eax, eax
jmp 0x69f589
cmp byte [ebx + 1], 0x3a
jne 0x69f53c
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x69f53c
push ebx
call fcn.0067abcd
pop ecx
xor eax, eax
jmp 0x69f589
inc esi
test edi, edi
je 0x69f57f
cmp esi, dword [ebp + 0x10]
jbe 0x69f551
push ebx
call fcn.0067abcd
pop ecx
xor eax, eax
jmp 0x69f589
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.0067abcd
pop ecx
mov eax, edi
jmp 0x69f589
push esi
push ebx
call fcn.0067ab8b
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret