joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65594c
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x655ab2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 8]
test esi, esi
je 0x65598e
or ebx, 0xffff
mov eax, esi
call fcn.0040b88c
mov esi, eax
jmp 0x655990
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
call sub.kernel32.dll_GetLastError
cmp eax, 0x2f76
jne 0x6559c0
mov eax, edi
call fcn.0040a86c
jmp 0x655a95
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x655a10
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x20]
mov edx, dword [0x6bf7c0]
call fcn.00429e78
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x6b77a8]
mov dl, 1
mov eax, dword [0x658fd0]
call fcn.0042b60c
call fcn.00409f64
mov edx, dword [ebp - 0xc]
shr edx, 1
dec edx
mov eax, edi
call fcn.0040ba00
mov eax, dword [edi]
test eax, eax
je 0x655a28
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x655a95
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi]
call fcn.0040b88c
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x655a95
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x24]
mov edx, dword [0x6bf7c0]
call fcn.00429e78
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x6b77a8]
mov dl, 1
mov eax, dword [0x658fd0]
call fcn.0042b60c
call fcn.00409f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x655ab9
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040a8cc
pop eax
jmp eax

Function at 0x655cc6
Capabilities:
Initialize winhttp library

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x655c87
add esp, 0xfffffff0
call fcn.004090d4
mov ebx, edx
mov edi, eax
mov eax, edi
call fcn.0065f988
mov dl, 1
mov eax, dword [0x65405c]
call fcn.00658e20
mov dword [edi + 0xb8], eax
mov dl, 1
mov eax, dword [0x645118]
call fcn.006504ec
mov dword [edi + 0xb4], eax
mov eax, dword [0x65312c]
call fcn.006589dc
push 0
push 0
push 0
push 1
push 0x655d28
call sub.winhttp.dll_WinHttpOpen
mov esi, eax
mov dword [edi + 0xb0], esi
test esi, esi
jne 0x655cf5
mov ecx, dword [0x6b7970]
mov dl, 1
mov eax, dword [0x659088]
call fcn.0042b5d0
call fcn.00409f64
push 0
push 0x10010
push 0x655ad4
mov eax, dword [edi + 0xb0]
push eax
call sub.winhttp.dll_WinHttpSetStatusCallback
mov eax, edi
test bl, bl
je 0x655d22
call fcn.0040912c
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x657200
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6573dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0xb9], 0
mov byte [ebx + 0xb8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jle 0x65724a
mov esi, dword [ebp - 4]
movzx esi, word [esi + 0x10]
jmp 0x65724c
xor esi, esi
push 0
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040b88c
push eax
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0xb0]
push eax
call sub.winhttp.dll_WinHttpConnect
mov edi, eax
mov dword [ebx + 0xa0], edi
test edi, edi
jne 0x6572a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6b7488]
mov dl, 1
mov eax, dword [0x659150]
call fcn.0042b60c
call fcn.00409f64
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0x6573f8
call fcn.0040bc70
jne 0x6572b9
or esi, 0x800000
push esi
push 0
push 0
push 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0065590c
mov eax, dword [ebp - 0x10]
call fcn.0040b88c
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0064c7a0
mov eax, dword [ebp - 0x14]
call fcn.0040b88c
push eax
mov eax, dword [ebx + 0xa0]
push eax
call sub.winhttp.dll_WinHttpOpenRequest
mov edi, eax
mov dword [ebx + 0xa4], edi
test edi, edi
jne 0x657345
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x28]
mov edx, dword [0x6bf7c0]
call fcn.00429e78
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [0x6b78e8]
mov dl, 1
mov eax, dword [0x659150]
call fcn.0042b60c
call fcn.00409f64
mov eax, dword [ebx + 0x14]
push eax
mov eax, ebx
call fcn.0064c8f4
push eax
mov esi, dword [ebx + 0xc]
push esi
push esi
mov eax, dword [ebx + 0xa4]
push eax
call sub.winhttp.dll_WinHttpSetTimeouts
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x6573b2
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x2c]
mov edx, dword [0x6bf7c0]
call fcn.00429e78
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [0x6b7a68]
mov dl, 1
mov eax, dword [0x659150]
call fcn.0042b60c
call fcn.00409f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6573e3
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0040a8cc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040a8cc
pop eax
jmp eax
Function at 0x665584
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, esi
test ebx, ebx
je 0x66559d
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b88c
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x6655d1
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
xor eax, eax
call fcn.0066544c
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x6674b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x66761b
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x667508
mov cx, 0x42ee
xor edx, edx
mov al, 0xa
call fcn.0068f294
test al, al
jne 0x667508
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x667583
mov eax, 0x667638
call fcn.00607c10
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x667583
test bl, bl
je 0x667513
mov ebx, 0x80000001
jmp 0x667518
mov ebx, 0x80000002
push 0
push 2
lea eax, [ebp - 4]
push eax
mov ecx, 0x667708
mov edx, ebx
xor eax, eax
call fcn.005bcc2c
test eax, eax
jne 0x667579
mov ebx, esi
test ebx, ebx
je 0x66753d
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b88c
push eax
push 1
push 0
mov eax, edi
call fcn.0040b88c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x66756e
mov eax, 0x66777c
call fcn.00607c10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x667583
mov eax, 0x6677e0
call fcn.00607c10
cmp byte [ebp + 0xc], 0
je 0x6675fe
mov eax, esi
call fcn.0040b88c
push eax
call sub.gdi32.dll_AddFontResourceW
test eax, eax
je 0x6675ac
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
jmp 0x6675fe
lea ecx, [ebp - 0xc]
mov edx, 0x667834
mov ax, 0x47
call fcn.005c327c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.005bd550
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x6b7af0]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [0x6b7af0]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x6b7af0]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
pop eax
call fcn.00664ad0
test al, al
je 0x667589
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x667622
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040a8cc
pop eax
jmp eax
Function at 0x66ab74
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x66ac37
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b88c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x66ac1a
test bl, 0x10
je 0x66ac1a
lea ecx, [ebp - 4]
mov edx, 0x66ac54
mov eax, esi
call fcn.005b9e4c
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x66ac78
mov eax, 0x66ac94
call fcn.005bbb1c
mov edx, 0x66acc0
mov eax, dword [ebp - 8]
call fcn.00423d10
test eax, eax
jne 0x66ac1a
mov eax, dword [ebp - 4]
call fcn.00425184
lea ecx, [ebp - 0xc]
mov edx, 0x66ad1c
mov eax, esi
call fcn.005b9e4c
mov eax, dword [ebp - 0xc]
call fcn.00425184
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.0040b88c
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesW
push edi
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66ac3e
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a8cc
pop eax
jmp eax

Function at 0x66bb40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x66bc1c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.005febc4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x66bc38
call fcn.00607e98
mov eax, dword [0x6b7630]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
call fcn.0049a7d0
mov esi, eax
mov eax, dword [esi]
mov ebx, eax
test ebx, ebx
je 0x66bbb3
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
push eax
mov eax, ebx
mov ecx, 0x14
cdq
idiv ecx
push eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0061ea04
test al, al
jne 0x66bc04
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x66bbe9
mov eax, 0x66bc88
call fcn.00607c10
jmp 0x66bc04
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x66bd28
call fcn.00607e98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66bc23
lea eax, [ebp - 0x1c]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x66e124
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x66e2b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea edx, [ebp - 0x258]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005b9cdc
lea eax, [ebp - 0x258]
mov edx, 0x66e2cc
call fcn.0040ba80
mov eax, dword [ebp - 0x258]
call fcn.0040b88c
push eax
call sub.kernel32.dll_FindFirstFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x66e288
lea eax, [ebp - 4]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.0040b928
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x66e1b7
sub ebx, 4
mov ebx, dword [ebx]
cmp ebx, 9
jl 0x66e1fc
lea eax, [ebp - 0x25c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040bca8
mov eax, dword [ebp - 0x25c]
mov edx, 0x66e2f0
call fcn.00423d10
test eax, eax
jne 0x66e1fc
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x66e1fe
xor eax, eax
test al, al
je 0x66e215
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xc]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x66e217
xor eax, eax
test al, al
je 0x66e22e
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xe]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x66e230
xor eax, eax
test al, al
je 0x66e26d
mov eax, dword [ebp - 4]
cmp word [eax + 0x10], 0x2e
jne 0x66e26d
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.0040bca8
mov eax, dword [ebp - 0x260]
call fcn.00424b4c
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x254]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x66e198
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66e2b7
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.0040a8cc
lea eax, [ebp - 4]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x67d274
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
call fcn.0067d148
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4a
mov eax, dword [0x6bf810]
push eax
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00408bcc
cmp ebx, 0x6c840001
jne 0x67d2d4
call fcn.0042b504
mov eax, 0xffff0000
and eax, ebx
cmp eax, 0x6c830000
je 0x67d2f8
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x67d3ac
call fcn.005fe9b0
mov word [ebp - 0xa], bx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 8]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x67d34e
mov ebx, eax
mov edx, 1
movzx eax, word [ebp - 0xa]
call fcn.0067d1c8
mov esi, eax
mov eax, esi
sub ax, 2
je 0x67d34e
dec eax
sub ax, 2
jb 0x67d362
movzx eax, si
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x67d40c
call fcn.005fe9b0
push 0x1cff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x67d303
mov edx, 2
movzx eax, word [ebp - 0xa]
call fcn.0067d1c8
movzx ebx, ax
mov edx, 3
movzx eax, word [ebp - 0xa]
call fcn.0067d1c8
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x67e0f8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
mov eax, ebx
call fcn.0067e174
call fcn.0040704c
mov esi, eax
push esp
push 0x40
mov eax, ebx
call fcn.0067e174
push eax
push esi
call sub.kernel32.dll_VirtualProtect
mov edx, esi
mov eax, ebx
call fcn.0067e12c
mov eax, esi
pop edx
pop esi
pop ebx
ret
Function at 0x6800c4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x68029a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.0040aa04
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x6b7200]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040b88c
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.005bcc2c
test eax, eax
jne 0x68027d
xor eax, eax
push ebp
push 0x680272
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.005d3860
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x680155
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x680182
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.0040ae2c
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x6801a4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.0040ae2c
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x68021a
sub eax, 0xe9
je 0x6801be
sub eax, 0x19
je 0x680259
jmp 0x680213
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x6801d5
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x6801e8
call fcn.0040a058
jmp 0x68027d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x6801ff
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040aa04
jmp 0x680149
call fcn.0040a058
jmp 0x68027d
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.005d3860
lea eax, [ebp - 4]
call fcn.0040ae2c
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.0040aa04
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.005e4f5c
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.005d19e8
inc ebx
jmp 0x680149
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x680279
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6802a1
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a8cc
pop eax
jmp eax
Function at 0x687158
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x6871de
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x6871c4
mov ebx, esi
test ebx, ebx
je 0x68718a
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b88c
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x6871fc
call fcn.0040bad8
mov eax, dword [ebp - 8]
call fcn.0040b88c
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x6871c6
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6871e5
lea eax, [ebp - 8]
call fcn.0040a86c
pop eax
jmp eax

Function at 0x68d75c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x68d766
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x68d81c
push 0x68d850
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00415434
mov ebx, eax
test ebx, ebx
je 0x68d805
mov eax, esi
call fcn.0040b88c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x68d805
test al, 0x10
je 0x68d7b6
mov ebp, 0x2000000
jmp 0x68d7b8
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.0040b88c
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x68d805
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle
test ebx, ebx
jle 0x68d805
cmp ebx, 0xff0
jge 0x68d805
mov edx, edi
mov eax, esp
call fcn.0068d674
jmp 0x68d80e
mov eax, edi
mov edx, esi
call fcn.0040ac5c
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x68d86c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x68d8fb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
test eax, eax
jle 0x68d8cf
cmp eax, 0x104
jge 0x68d8cf
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040b928
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0068d75c
jmp 0x68d8e0
mov eax, 0x68d914
call fcn.005feb68
mov eax, ebx
call fcn.0040a86c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68d902
lea eax, [ebp - 0x20c]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x68d93c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x68dacb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x4c]
mov eax, ebx
call fcn.005ba204
mov esi, dword [ebp - 0x4c]
mov edx, 0x68dae8
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x50]
call fcn.00423d10
test eax, eax
sete al
test al, al
jne 0x68d995
mov eax, 0x68db00
call fcn.005fe954
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0068d75c
lea eax, [ebp - 8]
call fcn.0068d86c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407d24
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x68db48
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.0040b88c
mov dword [ebp - 0x38], eax
mov eax, edi
call fcn.0040b88c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.0040b88c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x68da1b
call sub.kernel32.dll_GetLastError
cmp eax, 0x4c7
jne 0x68da11
call fcn.0042b4e4
mov eax, 0x68db60
call fcn.005feab0
cmp dword [ebp - 0x10], 0
jne 0x68da2b
mov eax, 0x68db8c
call fcn.005fe954
xor edx, edx
push ebp
push 0x68da9f
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0068d548
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x68da39
cmp eax, 0xffffffff
jne 0x68da66
mov eax, 0x68dbe0
call fcn.005feab0
call fcn.0068d548
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x68da86
mov eax, 0x68dc20
call fcn.005feab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68daa6
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax

Function at 0x68dc48
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x68dd1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x68d31c]
call fcn.0068dd44
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x68dcf2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x68dd34
call fcn.00425bfc
mov edx, dword [ebp - 8]
mov eax, dword [0x6b7adc]
mov eax, dword [eax]
call fcn.005ab3ac
call fcn.0068d548
call sub.user32.dll_GetFocus
mov edx, dword [0x6b7adc]
mov edx, dword [edx]
cmp eax, dword [edx + 0x190]
jne 0x68dcd3
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x68dcda
call sub.user32.dll_WaitMessage
jmp 0x68dcad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68dcf9
mov eax, dword [ebp - 4]
call fcn.00408bcc
pop eax
jmp eax