joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60fca0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x60fcfd
cmp byte [ebx + 0xeb], 0
jne 0x60fcfd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040b5f8
mov eax, dword [esi]
test eax, eax
je 0x60fcea
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x60fd0a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040b850
jmp 0x60fd0a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040b850
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x61192c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x61199d
mov eax, esi
call fcn.0055b4c0
test al, al
je 0x61199d
mov eax, dword [ebx + 0x98]
call fcn.0055b058
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x61199d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x61198e
push 0
mov eax, dword [ebx + 0x98]
call fcn.0055b058
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.005512fc
jmp 0x61199d
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.00611738
pop esi
pop ebx
ret
Function at 0x61a16c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x61a1f2
mov eax, dword [ebx + 8]
call fcn.0055b058
mov ecx, eax
mov dl, 1
mov eax, dword [0x56f964]
call fcn.00554b8c
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.0057ff20
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x619a3c
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0055b058
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0055b058
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa4], 0
jne 0x61a274
mov eax, dword [ebx + 8]
call fcn.0055b058
mov ecx, eax
mov dl, 1
mov eax, dword [0x56f964]
call fcn.00554b8c
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.0057ff20
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x619a88
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0055b058
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0055b058
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x61a2f2
mov eax, dword [ebx + 8]
call fcn.0055b058
mov ecx, eax
mov dl, 1
mov eax, dword [0x570458]
call fcn.00554b8c
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0055b058
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0055b058
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x62d998
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b554
xor eax, eax
push ebp
push 0x62db83
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040b460
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00637bb4
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.0042895c
test al, al
je 0x62db5e
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00637bb4
mov eax, dword [ebp - 0x24]
call fcn.0040bfd8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x62da76
xor eax, eax
push ebp
push 0x62da6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00406ffc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00637bb4
mov eax, dword [ebp - 0x28]
call fcn.0040bfd8
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62da76
test bl, bl
je 0x62db5e
xor eax, eax
push ebp
push 0x62db49
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x62db94
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.00427cd4
mov eax, dword [ebp - 8]
push dword [eax]
push 0x62dba4
mov eax, dword [ebx + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00427cd4
push dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c2ac
mov eax, dword [ebp - 8]
push dword [eax]
push 0x62dba4
mov eax, dword [ebx + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00427cd4
push dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c2ac
mov eax, dword [ebp - 8]
push dword [eax]
push 0x62dba4
mov eax, dword [ebx + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00427cd4
push dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c2ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62db53
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00407018
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62db8a
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.0040b4c0
lea eax, [ebp - 4]
call fcn.0040b460
pop eax
jmp eax
Function at 0x62dba8
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00430bfc
cmp eax, 2
je 0x62dbc5
mov byte [ebp - 1], 1
jmp 0x62dda1
mov byte [ebp - 1], 0
mov eax, 0x672154
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x62dda1
xor eax, eax
push ebp
push 0x62dd9a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x62dc2e
push 0x62ddac
push 0x62ddd8
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.004171b0
mov ebx, eax
test ebx, ebx
je 0x62dc55
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x62dd81
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x62dd81
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x62dca6
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x62dc87
call fcn.0040ac10
jmp 0x62dda1
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x62dca6
call fcn.0040ac10
jmp 0x62dda1
xor eax, eax
push ebp
push 0x62dd7a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x62dce9
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x62dce9
call fcn.0040ac10
call fcn.0040ac10
jmp 0x62dda1
mov eax, dword [ebp - 0x14]
call fcn.00406ffc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x62dd1e
call fcn.0040ac10
call fcn.0040ac10
jmp 0x62dda1
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x62dd59
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x62dd55
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x62dd55
mov byte [ebp - 1], 1
jmp 0x62dd59
inc ebx
dec esi
jne 0x62dd2b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62dd81
mov eax, dword [ebp - 0x18]
call fcn.00407018
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62dda1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x632344
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6323b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x67215c]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x63239f
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0063232c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x631b1c]
call fcn.00632aec
mov dword [0x6721c0], eax
mov eax, dword [ebp - 4]
call fcn.006322d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6323be
lea eax, [ebp - 8]
call fcn.0040fe68
pop eax
jmp eax

Function at 0x6323e8
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffd4c
mov esi, 0x4008
test cl, cl
je 0x6323fb
or esi, 2
test dl, dl
je 0x632404
or esi, 0
jmp 0x632407
or esi, 1
push esi
push 0x2b4
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
add esp, 0x2b4
pop esi
ret

Function at 0x6379cc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x637a2b
xor eax, eax
push ebp
push 0x637a24
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x637a2b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
push 0x1f4
call sub.kernel32.dll_Sleep
movzx eax, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x6380a4
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x638219
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040b460
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x418]
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610ffc
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
call fcn.004292a4
mov eax, dword [ebp - 0x414]
call fcn.0040bfd8
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6381f1
xor eax, eax
push ebp
push 0x63815d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x84000100
push 0
push 0
mov eax, edi
call fcn.0040bfd8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x638177
cmp dword [ebp - 0xc], 0
jne 0x638188
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x6381f1
xor eax, eax
push ebp
push 0x6381d5
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x410]
lea eax, [ebp - 4]
mov ecx, dword [esi]
call fcn.0040b718
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040c1cc
cmp dword [esi], 0
jne 0x638196
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6381df
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638220
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.0040b4c0
lea eax, [ebp - 4]
call fcn.0040b460
pop eax
jmp eax
Function at 0x6386a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b554
xor eax, eax
push ebp
push 0x638730
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b460
mov eax, dword [ebp - 4]
test eax, eax
je 0x6386db
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x638709
mov esi, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
xor dx, 2
call fcn.0040bff8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.0040c1cc
inc esi
dec ebx
jne 0x6386e6
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.0040b850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638737
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b4c0
pop eax
jmp eax

Function at 0x638c34
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040b460
push esp
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x638c6e
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov edx, ebx
lea eax, [esp + 4]
call fcn.004297f0
add esp, 0x210
pop esi
pop ebx
ret
Function at 0x63c70c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
push 0x31
mov eax, dword [0x67ae40]
call fcn.0040bfd8
push eax
push 0x63c7a4
mov eax, dword [0x67add4]
call fcn.0055b058
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 2
je 0x63c79d
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x63c79d
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x63c79d
lea eax, [esp + 0xc]
push eax
push 0x63c824
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x63c79d
push 0
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
ret
Function at 0x643b34
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b554
mov eax, dword [ebp - 8]
call fcn.0040b554
xor eax, eax
push ebp
push 0x643cdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408150
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x44], esi
test bl, bl
je 0x643b94
mov dword [ebp - 0x48], 0x540
jmp 0x643b9b
mov dword [ebp - 0x48], 0x500
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], 0
je 0x643bb0
mov eax, 0x643cf0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.0040bfd8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.0040bfd8
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x643c8f
test bl, bl
je 0x643c89
cmp byte [0x67ae1a], 0
jne 0x643bf8
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x504]
call fcn.00551a00
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
cmp byte [0x67ae2e], 0
je 0x643c2b
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x643c64
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
jmp 0x643c64
mov al, 1
call fcn.00637e10
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x10], 0x103
jne 0x643c64
mov eax, dword [0x6732d4]
mov eax, dword [eax]
cmp byte [eax + 0xbc], 0
je 0x643c2b
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x50]
call fcn.00427cd4
mov edx, dword [ebp - 0x50]
mov eax, 0x67ae50
call fcn.0040b850
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 9], 1
jmp 0x643ca2
test bl, bl
je 0x643ca2
mov eax, 0x67ae50
mov edx, 0x643d08
call fcn.0040b850
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x504]
cmp byte [eax + 0x69], 0
je 0x643cb8
call fcn.005519f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x643ce4
lea eax, [ebp - 0x50]
call fcn.0040b460
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b4c0
pop eax
jmp eax
Function at 0x644ba4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x644c91
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, ebx
call fcn.0042895c
test al, al
jne 0x644c26
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x644cac
call fcn.0040c224
mov eax, dword [ebp - 4]
call fcn.0063b82c
cmp byte [0x67ae1a], 0
jne 0x644c1d
push 0x10
push 0x644ce8
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, 0x644d00
call fcn.0063b884
mov eax, dword [ebp - 8]
call fcn.0040bfd8
push eax
mov eax, dword [0x6732d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x67ae20], 1
jmp 0x644c74
push 1
push 0
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0x644d38
call fcn.0040c224
mov eax, dword [ebp - 0xc]
call fcn.0040bfd8
push eax
push 0x644d74
push 0x644d90
mov eax, dword [0x6732d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.shell32.dll_ShellExecuteW
cmp byte [0x67ae19], 0
je 0x644c74
mov edx, ebx
mov eax, 0x644da8
call fcn.0063cc5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644c98
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b4c0
pop eax
jmp eax
Function at 0x64a37c
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b554
xor eax, eax
push ebp
push 0x64a448
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00637bb4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040b898
xor eax, eax
push ebp
push 0x64a41e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0042832c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x64a3e1
mov byte [ebp - 5], 0
jmp 0x64a414
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetSystemTime
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64a428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a44f
lea eax, [ebp - 0x24]
call fcn.0040b460
lea eax, [ebp - 4]
call fcn.0040b460
pop eax
jmp eax
Function at 0x6538ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b554
xor eax, eax
push ebp
push 0x65398c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b460
mov eax, dword [ebp - 4]
test eax, eax
je 0x65392f
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x65395c
mov esi, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
xor dx, di
call fcn.0040bff8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0040c1cc
inc esi
dec ebx
jne 0x65393a
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040b850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x653993
lea eax, [ebp - 0x10]
call fcn.0040b460
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b4c0
pop eax
jmp eax
Function at 0x65eb2c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
mov edx, 0x65ebac
call fcn.0040b850
xor edx, edx
push ebp
push 0x65eb5f
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetUserDefaultLangID
pop dword fs:[0]
add esp, 8
jmp 0x65eb70
cmp ax, 0x419
je 0x65eb8e
cmp ax, 0x422
je 0x65eb8e
cmp ax, 0x423
je 0x65eb8e
cmp ax, 0x43f
je 0x65eb8e
cmp ax, 0x443
jne 0x65eb9a
mov eax, ebx
mov edx, 0x65ebc4
call fcn.0040b850
pop edi
pop esi
pop ebx
pop ebp
ret