joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65746a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65d0c33
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x65e4e2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.065cb59e
mov dword [ebp - 4], 0
push 4
call fcn.065b6e17
mov edi, eax
add esp, 4
test edi, edi
je 0x6574724
call fcn.065cb94c
mov dword [edi], eax
call fcn.065cb70b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.065cb640
mov byte [ebp - 4], 1
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x6574716
inc eax
mov dword [ebx + 4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.065cb668
jmp 0x6574726
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6576930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65d1158
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push edi
mov eax, dword [0x65e4e2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 4
mov dword [esi + 0x30], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0xc], edi
call fcn.065b6e17
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x65769df
call fcn.065cb94c
mov dword [ebx], eax
call fcn.065cb70b
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.065cb640
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jae 0x65769bc
inc eax
mov dword [ecx + 4], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.065cb668
mov dword [esi + 0x30], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6578d80
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], fcn.065783d0
ret

Function at 0x6578dd0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
call fcn.06578c90
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, ecx
shr eax, 0x18
mov byte [esi], al
mov edx, ecx
shr edx, 0x10
mov byte [esi + 1], dl
mov edx, ecx
shr edx, 8
lea eax, [esi + 1]
mov byte [eax + 1], dl
add eax, 1
mov byte [eax + 1], cl
mov ecx, dword [ebx + 4]
add eax, 1
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 0x18
mov byte [eax - 1], dl
add eax, 1
mov edx, ecx
shr edx, 0x10
mov byte [eax - 1], dl
add eax, 1
mov edx, ecx
shr edx, 8
mov byte [eax - 1], dl
mov byte [eax], cl
mov ecx, dword [ebx + 8]
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 0x18
mov byte [eax - 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 8
mov byte [eax - 1], dl
mov byte [eax], cl
mov ecx, dword [ebx + 0xc]
add eax, 1
mov edx, ecx
shr edx, 0x18
mov byte [eax], dl
add eax, 1
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
add eax, 1
mov edx, ecx
shr edx, 8
mov byte [eax], dl
mov byte [eax + 1], cl
mov ecx, dword [ebx + 0x10]
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 0x18
mov byte [eax], dl
add eax, 1
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
mov edx, ecx
add eax, 1
shr edx, 8
mov byte [eax], dl
add eax, 1
mov byte [eax], cl
mov ecx, dword [ebx + 0x14]
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 0x18
mov byte [eax - 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 8
mov byte [eax - 1], dl
mov byte [eax], cl
mov ecx, dword [ebx + 0x18]
add eax, 1
mov edx, ecx
shr edx, 0x18
mov byte [eax], dl
add eax, 1
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
add eax, 1
mov edx, ecx
shr edx, 8
mov byte [eax], dl
mov byte [eax + 1], cl
mov ecx, dword [ebx + 0x1c]
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 0x18
mov byte [eax], dl
add eax, 1
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
add eax, 1
mov edx, ecx
shr edx, 8
mov byte [eax], dl
mov byte [eax + 1], cl
xor eax, eax
pop esi
mov dword [ebx], 0x6a09e667
mov dword [ebx + 4], 0xbb67ae85
mov dword [ebx + 8], 0x3c6ef372
mov dword [ebx + 0xc], 0xa54ff53a
mov dword [ebx + 0x10], 0x510e527f
mov dword [ebx + 0x14], 0x9b05688c
mov dword [ebx + 0x18], 0x1f83d9ab
mov dword [ebx + 0x1c], 0x5be0cd19
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], fcn.065783d0
pop ebx
ret
Function at 0x657a4e0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, dword [esp + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.0657c080
cmp eax, 0x17
je 0x657a51e
mov dword [esi], 0x657b718
pop esi
ret
mov dword [esi], 0x657a4b0
pop esi
ret

Function at 0x657a530
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x4c
mov eax, dword [0x65e4e2c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
mov esi, dword [esp + 0x5c]
mov eax, dword [esi + 0x18]
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
push edi
mov edi, 0x38
jb 0x657a562
mov edi, 0x78
sub edi, eax
push edi
lea eax, [esp + 0x14]
push 0
push eax
call fcn.065cf4a0
add esp, 0xc
mov byte [esp + 0x10], 0x80
lea ecx, [esp + edi + 0x11]
lea eax, [esi + 0x1a]
mov ebp, 2
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x657a585
add edi, 8
push edi
lea eax, [esp + 0x14]
push eax
push esi
call fcn.0657a3b0
add esp, 0xc
lea ecx, [ebx + 1]
lea eax, [esi + 0xa]
lea edi, [ebp + 4]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x657a5c5
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.0657c080
cmp eax, 0x17
je 0x657a634
pop edi
mov dword [esi], 0x657b718
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.065b6645
add esp, 0x4c
ret
mov ecx, dword [esp + 0x58]
pop edi
mov dword [esi], 0x657a4b0
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.065b6645
add esp, 0x4c
ret

Function at 0x657ae30
Capabilities:
Hash data using sha1

Disassembly:
call fcn.0657c080
add eax, 0xfffffffd
cmp eax, 0x25
ja case.0x657ae44.8
movzx eax, byte [eax + 0x657aecc]
jmp dword [eax*4 + 0x657aeb8]
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x657f8b8
jmp 0x657ae8a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x657e780
jmp 0x657ae8a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x657d6d0
jmp 0x657ae8a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x657ae00
jmp 0x657ae8a
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x6579590
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x657af00
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x60
mov eax, dword [0x65e4e2c]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x6c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x70]
push edi
mov edi, dword [esp + 0x78]
lea ecx, [esp + 0x1c]
and ecx, 7
push 0x48
lea ebx, [esp + 0x28]
sub ebx, ecx
push 0
push ebx
mov dword [esp + 0x1c], eax
call fcn.065cf4a0
mov edx, dword [esi + 0x18]
and edx, 0x3f
mov eax, 0x40
sub eax, edx
add esp, 0xc
cmp eax, 8
ja 0x657af51
add eax, 0x40
mov ecx, dword [esi + 0x14]
mov ebp, dword [esi + 0x18]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebp
shr edx, 0x1d
or ecx, edx
mov byte [ebx], 0x80
lea edx, [ebp*8]
mov dword [esp + 0x18], edx
mov edx, ecx
shr edx, 0x18
mov byte [eax + ebx - 8], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + ebx - 7], dl
mov edx, ecx
shr edx, 8
mov byte [eax + ebx - 6], dl
mov byte [eax + ebx - 5], cl
mov ecx, dword [esp + 0x18]
mov edx, ecx
shr edx, 0x18
mov byte [eax + ebx - 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + ebx - 3], dl
mov edx, ecx
mov byte [eax + ebx - 1], cl
mov ecx, dword [esp + 0x10]
push ecx
push eax
shr edx, 8
push ebx
push esi
mov byte [eax + ebx - 2], dl
call fcn.0657ad00
movzx edx, byte [esi + 3]
mov byte [edi], dl
movzx eax, byte [esi + 2]
mov byte [edi + 1], al
mov ecx, dword [esi]
shr ecx, 8
mov byte [edi + 2], cl
movzx edx, byte [esi]
mov byte [edi + 3], dl
movzx eax, byte [esi + 7]
mov byte [edi + 4], al
movzx ecx, byte [esi + 6]
mov byte [edi + 5], cl
mov edx, dword [esi + 4]
shr edx, 8
mov byte [edi + 6], dl
movzx eax, byte [esi + 4]
mov byte [edi + 7], al
movzx ecx, byte [esi + 0xb]
mov byte [edi + 8], cl
movzx edx, byte [esi + 0xa]
mov byte [edi + 9], dl
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 0xa], al
movzx ecx, byte [esi + 8]
mov byte [edi + 0xb], cl
movzx edx, byte [esi + 0xf]
mov byte [edi + 0xc], dl
movzx eax, byte [esi + 0xe]
mov byte [edi + 0xd], al
mov ecx, dword [esi + 0xc]
shr ecx, 8
mov byte [edi + 0xe], cl
movzx edx, byte [esi + 0xc]
mov byte [edi + 0xf], dl
movzx eax, byte [esi + 0x13]
mov byte [edi + 0x10], al
movzx ecx, byte [esi + 0x12]
mov byte [edi + 0x11], cl
mov edx, dword [esi + 0x10]
shr edx, 8
mov byte [edi + 0x12], dl
movzx eax, byte [esi + 0x10]
push esi
mov byte [edi + 0x13], al
call fcn.0657ae30
push 0x140
push 0
add esi, 0x60
push esi
call fcn.065cf4a0
mov ecx, dword [esp + 0x8c]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.065b6645
add esp, 0x60
ret
Function at 0x658bd9b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.0658b9e0
mov ecx, dword [0x65e688c]
test ecx, ecx
jne 0x658bdc1
push 0x65e6888
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x65e688c]
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
push ebx
xor ebx, ebx
push 4
cmp ebx, edx
sbb edx, edx
imul eax, ecx
and edx, ecx
add edx, eax
pop eax
push eax
push 0x1000
push edx
push ebx
mov dword [esi + 8], edx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0xc], eax
pop ebx
test eax, eax
jne 0x658be2c
mov eax, dword [0x65e4c3c]
cmp eax, 0x65e4c3c
je 0x658be22
test byte [eax + 0x1c], 1
je 0x658be22
cmp byte [eax + 0x19], 2
jb 0x658be22
push 0x65d24b0
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0658b8a5
add esp, 0x10
and dword [esi + 8], 0
and dword [esi + 4], 0
jmp 0x658be37
push dword [esi + 8]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 4]
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 4
Function at 0x659b812
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x65e4e2c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x659b9a8
test esi, esi
je 0x659b9a8
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x64
jb 0x659b9a8
xor eax, eax
push 0x208
push eax
mov word [esi], ax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.065b84a0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x659b88d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x659b9ab
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x659b993
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCServerW]
test eax, eax
jne 0x659b993
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.065b76f1
add esp, 0xc
test eax, eax
jne 0x659b98c
push str.isolate.ini
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x659b98c
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x659b88d
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push str.SoftwareSymantecIsolation
push str.reghive
push str.isolation
call fcn.0659b519
add esp, 0x18
dec ebx
cmp eax, ebx
jne 0x659b92f
push 0x7a
jmp 0x659b9aa
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x659b95b
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x659b97e
cmp eax, 5
jne 0x659b96d
push str.CIsolation::GetRegistryHive__:_RegOpenKeyEx___returned_ERROR_ACCESS_DENIED
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x659b97e
cmp eax, 2
jne 0x659b979
push str.CIsolation::GetRegistryHive__:_RegOpenKeyEx___returned_ERROR_FILE_NOT_FOUND
jmp 0x659b965
xor eax, eax
mov word [esi], ax
xor eax, eax
cmp word [esi], ax
setne al
dec eax
and eax, 0xd
jmp 0x659b9ab
mov eax, 0x54f
jmp 0x659b9ab
push 0x1c
push str.SoftwareSymantecIsolation
push ebx
push esi
call fcn.065ba98a
add esp, 0x10
xor eax, eax
jmp 0x659b9ab
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.065b6645
leave
ret
Function at 0x659b9ba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x65e4e2c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x659baf8
test esi, esi
je 0x659baf8
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x26
jb 0x659baf8
xor eax, eax
push 0x208
push eax
mov word [esi], ax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.065b84a0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x659ba35
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x659bafb
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x659baf4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCServerW]
test eax, eax
jne 0x659baf4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.065b76f1
add esp, 0xc
test eax, eax
jne 0x659baed
push str.isolate.ini
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x659baed
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x659ba35
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push 0x65d8dc0
push str.silo
push str.isolation
call fcn.0659b519
add esp, 0x18
dec ebx
cmp eax, ebx
jne 0x659bacf
push 0x7a
jmp 0x659bafa
push esi
call fcn.0659aa48
pop ecx
test al, al
jne 0x659badf
xor eax, eax
mov word [esi], ax
xor eax, eax
cmp word [esi], ax
setne al
dec eax
and eax, 0xd
jmp 0x659bafb
mov eax, 0x54f
jmp 0x659bafb
push 2
jmp 0x659bafa
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.065b6645
leave
ret
Function at 0x659c091
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x65e4e2c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x62
push eax
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
mov esi, ecx
push eax
mov dword [ebp - 0x70], esi
call fcn.065b84a0
add esp, 0xc
push 0x65e5eb8
lea ecx, [ebp - 0x6c]
call fcn.0658db8f
lea eax, [ebp - 0x6c]
push eax
push str._APPDATAEXTENSION_
call fcn.0659c008
pop ecx
pop ecx
cmp eax, 1
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
jne 0x659c0e8
push dword [ebp - 0x6c]
jmp 0x659c0ed
push str.Symantec
push 0x32
push eax
call fcn.065ba98a
add esp, 0x10
push edi
push 0x105
mov ecx, esi
call fcn.0658e066
push 0
push dword [ebp + 8]
mov edi, eax
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x659c13c
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x68]
push eax
push edi
call esi
test eax, eax
je 0x659c13c
call fcn.0659bc1c
push eax
push edi
call esi
test eax, eax
je 0x659c13c
xor esi, esi
inc esi
jmp 0x659c13e
xor esi, esi
mov ecx, dword [ebp - 0x70]
push 0xffffffffffffffff
call fcn.0659023e
pop edi
test esi, esi
jne 0x659c182
mov eax, dword [0x65e4c3c]
cmp eax, 0x65e4c3c
je 0x659c17a
test byte [eax + 0x1c], 1
je 0x659c17a
cmp byte [eax + 0x19], 2
jb 0x659c17a
push 0x65d3a20
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0658b8a5
add esp, 0x10
mov ecx, dword [ebp - 0x70]
call fcn.0658db49
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.065711e0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.065b6645
leave
ret
Function at 0x659c19c
Capabilities:
Get common file path

Disassembly:
push 0x264
mov eax, 0x65cfd01
call fcn.065b9f4b
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x659beed
push 8
push 0x3c
push 0x65d3a30
push eax
mov edi, ecx
call fcn.065badc5
add esp, 0x18
lea ecx, [ebp - 0x268]
mov esi, eax
call fcn.0658de1b
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x659c2a7
mov esi, dword [esi + 4]
cmp esi, 0xf0000000
je 0x659c431
cmp esi, 0xf0000001
je 0x659c42d
cmp esi, 0xf0000002
je 0x659c2c4
cmp esi, 0xf0000003
je 0x659c26d
lea eax, [ebp - 0x23c]
push eax
push 1
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x659c25a
mov eax, dword [0x65e4c3c]
cmp eax, 0x65e4c3c
je 0x659c2a7
test byte [eax + 0x1c], 1
je 0x659c2a7
cmp byte [eax + 0x19], 2
jb 0x659c2a7
push 0x65d3a20
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0658b8a5
add esp, 0x10
jmp 0x659c2a7
lea eax, [ebp - 0x23c]
push eax
mov ecx, edi
call fcn.0658e1ba
jmp 0x659c314
push 0x65e5eb8
lea ecx, [ebp - 0x240]
call fcn.0658db8f
lea eax, [ebp - 0x240]
push eax
push dword [0x65e4c80]
mov byte [ebp - 4], 2
call fcn.0659bf01
pop ecx
pop ecx
test eax, eax
jns 0x659c2ae
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.065711e0
xor esi, esi
jmp 0x659c43d
lea eax, [ebp - 0x240]
push eax
mov ecx, edi
call fcn.0659d00b
mov ecx, dword [ebp - 0x240]
jmp 0x659c30c
push 0x65e5eb8
lea ecx, [ebp - 0x244]
call fcn.0658db8f
lea eax, [ebp - 0x244]
push eax
push dword [0x65e4c7c]
mov byte [ebp - 4], 3
call fcn.0659bf01
pop ecx
pop ecx
test eax, eax
jns 0x659c2f8
mov ecx, dword [ebp - 0x244]
jmp 0x659c29f
lea eax, [ebp - 0x244]
push eax
mov ecx, edi
call fcn.0659d00b
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.065711e0
xor esi, esi
inc esi
jmp 0x659c43d
push 0x1c
jmp 0x659c433
push 0x23
mov ecx, edi
call fcn.0659c091
mov esi, eax
pop ecx
lea ecx, [ebp - 0x268]
call fcn.0658ddd9
mov eax, esi
call fcn.065b9fa7
ret

Function at 0x659da0d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
cmp edi, 1
je 0x659da57
cmp edi, 2
je 0x659da57
cmp edi, 7
je 0x659da57
mov eax, dword [0x65e4c3c]
cmp eax, 0x65e4c3c
je 0x659da53
test byte [eax + 0x1c], 1
je 0x659da53
cmp byte [eax + 0x19], 2
jb 0x659da53
push 0x65d3ce0
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0658b8a5
add esp, 0x10
xor eax, eax
jmp 0x659da83
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push edi
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 8], eax
mov eax, ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x659da89
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov esi, ecx
push dword [esi + 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 8], eax
test eax, eax
je 0x659dac0
xor eax, eax
jmp 0x659daff
cmp dword [ebp - 4], 4
je 0x659dafc
mov eax, dword [0x65e4c3c]
cmp eax, 0x65e4c3c
je 0x659daf3
test byte [eax + 0x1c], 1
je 0x659daf3
cmp byte [eax + 0x19], 2
jb 0x659daf3
push 0x65d3ce0
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0658b8a5
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x659dabc
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x659e6a1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x64
mov eax, 0x65cfd91
call fcn.065b9f4b
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, ecx
lea ecx, [ebp - 0x38]
push ecx
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x3c]
push ecx
push eax
push ebx
push dword [esi + 4]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x659e6e7
xor eax, eax
jmp 0x659e860
cmp dword [ebp - 0x3c], 1
je 0x659e729
cmp dword [ebp - 0x3c], 2
je 0x659e729
mov eax, dword [0x65e4c3c]
cmp eax, 0x65e4c3c
je 0x659e720
test byte [eax + 0x1c], 1
je 0x659e720
cmp byte [eax + 0x19], 2
jb 0x659e720
push 0x65d3ce0
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0658b8a5
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x659e6e0
test byte [ebp - 0x38], 1
je 0x659e750
mov eax, dword [0x65e4c3c]
cmp eax, 0x65e4c3c
je 0x659e720
test byte [eax + 0x1c], 1
je 0x659e720
cmp byte [eax + 0x19], 2
jb 0x659e720
push 0x65d3ce0
push 0x1a
jmp 0x659e712
lea ecx, [ebp - 0x68]
call fcn.0658de1b
mov eax, dword [ebp - 0x38]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
add eax, 2
mov dword [ebp - 0x38], eax
shr eax, 1
push eax
mov byte [ebp - 4], 1
call fcn.065906ff
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
push dword [esi + 4]
call edi
mov ecx, dword [ebp - 0x40]
push 0xffffffffffffffff
mov dword [esi + 8], eax
call fcn.0659023e
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x659e839
mov eax, dword [0x65e4c3c]
cmp eax, 0x65e4c3c
je 0x659e7cb
test byte [eax + 0x1c], 1
je 0x659e7cb
cmp byte [eax + 0x19], 2
jb 0x659e7cb
push ecx
push 0x65d3ce0
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.065af7a9
add esp, 0x14
mov ecx, dword [ebp - 0x40]
call fcn.0658db49
jmp 0x659e839
lea ecx, [ebp - 0x68]
call fcn.0658ddc3
test al, al
je 0x659e84c
mov dword [esi + 8], 0xe
xor eax, eax
cmp dword [esi + 8], eax
lea ecx, [ebp - 0x68]
sete al
mov esi, eax
call fcn.0658ddd9
mov eax, esi
call fcn.065b9fa7
ret 8