joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c7e14
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00429d30
cmp eax, 2
je 0x5c7e31
mov byte [ebp - 1], 1
jmp 0x5c8006
mov byte [ebp - 1], 0
mov eax, 0x6cdce0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x5c8006
xor eax, eax
push ebp
push 0x5c7fff
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x5c7e9a
push 0x5c8010
push 0x5c803c
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414030
mov ebx, eax
test ebx, ebx
je 0x5c7ec1
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x5c7fe8
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x5c7fe8
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x5c7f12
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x5c7ef3
call fcn.004099b8
jmp 0x5c8006
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x5c7f12
call fcn.004099b8
jmp 0x5c8006
xor eax, eax
push ebp
push 0x5c7fe1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5c7f55
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x5c7f55
call fcn.004099b8
call fcn.004099b8
jmp 0x5c8006
mov eax, dword [ebp - 0x14]
call fcn.00406f0c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5c7f87
call fcn.004099b8
call fcn.004099b8
jmp 0x5c8006
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x5c7fc2
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x5c7fbe
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x5c7fbe
mov byte [ebp - 1], 1
jmp 0x5c7fc2
inc ebx
dec esi
jne 0x5c7f94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7fe8
mov eax, dword [ebp - 0x18]
call fcn.00406f28
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c8006
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5cd14c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x6d6828
mov eax, esi
mov edx, 8
test al, 1
je 0x5cd168
shr eax, 1
xor eax, 0xedb88320
jmp 0x5cd16a
shr eax, 1
dec edx
jne 0x5cd15b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5cd154
pop esi
ret

Function at 0x5cd180
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x6d6824], 0
jne 0x5cd1aa
call fcn.005cd14c
mov dword [esp], 0x6d6824
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x5cd1d4
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x6d6828]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5cd1b0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5fd524
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ebx, ebx
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x5fd570
cmp dword [ebp - 0x104], 2
jne 0x5fd570
cmp dword [ebp - 0x110], 5
ja 0x5fd56e
cmp dword [ebp - 0x110], 5
jne 0x5fd570
cmp dword [ebp - 0x10c], 1
jb 0x5fd570
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5fd578
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00424328
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6006e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00424328
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x605694
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
xor edx, edx
mov dword [ebp - 0x25c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x605766
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, ebx
call fcn.005c4ebc
lea eax, [ebp - 0x25c]
mov edx, 0x605784
call fcn.0040b470
mov eax, dword [ebp - 0x25c]
call fcn.0040b278
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x60574d
xor eax, eax
push ebp
push 0x605746
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
call fcn.00605644
test al, al
je 0x60571b
mov byte [ebp - 1], 1
jmp 0x60572f
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x605706
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60574d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60576d
lea eax, [ebp - 0x25c]
call fcn.0040a1c8
ret

Function at 0x605788
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x6057c8
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.0040b318
jmp 0x6057cf
mov eax, ebx
call fcn.0040a1c8
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x6057d8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cdf50]
or eax, 0x4001
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x605817
mov eax, dword [esp + 4]
jmp 0x605819
xor eax, eax
add esp, 0x2b4
pop esi
pop ebx
ret
Function at 0x605824
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cdf58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x605868
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x60585d
mov eax, dword [esp + 4]
jmp 0x60585f
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x605847
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cdf58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x605868
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x60585d
mov eax, dword [esp + 4]
jmp 0x60585f
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x605d04
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
test dl, dl
je 0x605d18
add esp, 0xfffffff0
call fcn.00408a40
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0051556c
mov eax, dword [0x605db8]
not eax
and dword [esi + 0x60], eax
mov edx, 0x79
mov eax, esi
call fcn.005118d0
mov edx, 0x61
mov eax, esi
call fcn.00511904
xor edx, edx
mov eax, esi
call fcn.00512604
mov dl, 1
mov eax, esi
call fcn.0051b730
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jae 0x605d74
mov dx, 0xfffe
mov eax, esi
call fcn.0051264c
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x5c
push 0x1f
call sub.user32.dll_SystemParametersInfoW
test eax, eax
je 0x605d9a
lea eax, [ebp - 0x5c]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [esi + 0x74]
call fcn.004ee4ec
mov eax, esi
test bl, bl
je 0x605daf
call fcn.00408a98
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60fd98
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x60fdf2
inc esi
xor edi, edi
cmp edi, 1
jne 0x60fdbe
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x60fdcc
cmp edi, 1
jle 0x60fdcc
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0060c494
test eax, eax
jne 0x60fdf2
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x60fdf2
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x60fdf2
inc edi
dec esi
jne 0x60fdae
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x61065c
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, edx
mov edi, eax
test cl, cl
je 0x61066f
mov ebx, 0x80000001
jmp 0x610674
mov ebx, 0x80000002
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.005c7834
and eax, 0x7f
mov ecx, dword [eax*4 + 0x6cdfc0]
mov edx, ebx
xor eax, eax
call fcn.005c7a60
test eax, eax
jne 0x6106b4
mov eax, edi
call fcn.0040b278
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, esi
call fcn.0040b278
push eax
call sub.gdi32.dll_RemoveFontResourceW
test eax, eax
je 0x6106d5
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x618cd8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00424328
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x618d08
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x618e24
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [0x6d7340]
cmp dword [0x6d733c], 0
jne 0x618dff
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jb 0x618dff
lea eax, [ebp - 8]
call fcn.00618cd8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.005c4ebc
lea eax, [ebp - 4]
mov edx, 0x618e40
call fcn.0040b470
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x6d733c], eax
cmp dword [0x6d733c], 0
je 0x618dff
push 0x618e5c
mov eax, dword [0x6d733c]
push eax
call fcn.00414030
mov dword [0x6d7320], eax
push 0x618e7c
mov eax, dword [0x6d733c]
push eax
call fcn.00414030
mov dword [0x6d7324], eax
push 0x618ea4
mov eax, dword [0x6d733c]
push eax
call fcn.00414030
mov dword [0x6d7328], eax
push 0x618eb8
mov eax, dword [0x6d733c]
push eax
call fcn.00414030
mov dword [0x6d732c], eax
push 0x618ed0
mov eax, dword [0x6d733c]
push eax
call fcn.00414030
mov dword [0x6d7330], eax
push 0x618ee4
mov eax, dword [0x6d733c]
push eax
call fcn.00414030
mov dword [0x6d7334], eax
cmp dword [0x6d733c], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618e2b
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a228
ret
Function at 0x666d68
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x666ecc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 8]
test esi, esi
je 0x666daa
or ebx, 0xffff
mov eax, esi
call fcn.0040b278
mov esi, eax
jmp 0x666dac
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
call sub.kernel32.dll_GetLastError
cmp eax, 0x2f76
jne 0x666ddc
mov eax, edi
call fcn.0040a1c8
jmp 0x666eb1
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x666e2c
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x20]
mov edx, dword [0x6d7408]
call fcn.00427d6c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x6ceba4]
mov dl, 1
mov eax, dword [0x669c3c]
call fcn.00429118
call fcn.004098c4
mov edx, dword [ebp - 0xc]
shr edx, 1
dec edx
mov eax, edi
call fcn.0040b3f0
mov eax, dword [edi]
test eax, eax
je 0x666e44
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x666eb1
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi]
call fcn.0040b278
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x666eb1
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x24]
mov edx, dword [0x6d7408]
call fcn.00427d6c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x6ceba4]
mov dl, 1
mov eax, dword [0x669c3c]
call fcn.00429118
call fcn.004098c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x666ed3
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040a228
ret

Function at 0x6670de
Capabilities:
Initialize winhttp library

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x66709f
add esp, 0xfffffff0
call fcn.00408a40
mov ebx, edx
mov edi, eax
mov eax, edi
call fcn.0066ff24
mov dl, 1
mov eax, dword [0x665794]
call fcn.006697e0
mov dword [edi + 0xa0], eax
mov dl, 1
mov eax, dword [0x651714]
call fcn.006599a4
mov dword [edi + 0x9c], eax
mov eax, dword [0x6648e4]
call fcn.006693c8
push 0
push 0
push 0
push 1
push 0x667140
call sub.winhttp.dll_WinHttpOpen
mov esi, eax
mov dword [edi + 0x98], esi
test esi, esi
jne 0x66710d
mov ecx, dword [0x6ced68]
mov dl, 1
mov eax, dword [0x669cf4]
call fcn.004290dc
call fcn.004098c4
push 0
push 0x10010
push 0x666eec
mov eax, dword [edi + 0x98]
push eax
call sub.winhttp.dll_WinHttpSetStatusCallback
mov eax, edi
test bl, bl
je 0x66713a
call fcn.00408a98
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x668100
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6682cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0xa0], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jle 0x668143
mov esi, dword [ebp - 4]
movzx esi, word [esi + 0x10]
jmp 0x668145
xor esi, esi
push 0
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040b278
push eax
mov eax, dword [ebx + 0x50]
mov eax, dword [eax + 0x98]
push eax
call sub.winhttp.dll_WinHttpConnect
mov edi, eax
mov dword [ebx + 0x88], edi
test edi, edi
jne 0x668199
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6ce8c0]
mov dl, 1
mov eax, dword [0x669dbc]
call fcn.00429118
call fcn.004098c4
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0x6682e8
call fcn.0040b660
jne 0x6681b2
or esi, 0x800000
push esi
push 0
push 0
push 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00666d28
mov eax, dword [ebp - 0x10]
call fcn.0040b278
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00656e08
mov eax, dword [ebp - 0x14]
call fcn.0040b278
push eax
mov eax, dword [ebx + 0x88]
push eax
call sub.winhttp.dll_WinHttpOpenRequest
mov edi, eax
mov dword [ebx + 0x8c], edi
test edi, edi
jne 0x66823e
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x28]
mov edx, dword [0x6d7408]
call fcn.00427d6c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [0x6cece0]
mov dl, 1
mov eax, dword [0x669dbc]
call fcn.00429118
call fcn.004098c4
mov edi, dword [ebx + 0x10]
push edi
push edi
mov esi, dword [ebx + 0xc]
push esi
push esi
mov eax, dword [ebx + 0x8c]
push eax
call sub.winhttp.dll_WinHttpSetTimeouts
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x6682a4
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x2c]
mov edx, dword [0x6d7408]
call fcn.00427d6c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [0x6cee5c]
mov dl, 1
mov eax, dword [0x669dbc]
call fcn.00429118
call fcn.004098c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6682d3
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0040a228
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040a228
ret
Function at 0x67df88
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, esi
test ebx, ebx
je 0x67dfa1
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b278
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x67dfd5
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
xor eax, eax
call fcn.0067de54
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x67fe68
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x67ffd9
push dword fs:[eax]
mov dword fs:[eax], esp
test cl, cl
je 0x67febd
mov eax, dword [0x6ceda8]
cmp dword [eax], 0xa0042ee
jae 0x67febd
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x67ff43
mov eax, 0x67fff4
call fcn.0061674c
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x67ff43
test cl, cl
je 0x67fec8
mov esi, 0x80000001
jmp 0x67fecd
mov esi, 0x80000002
push 0
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [0x6cec84]
movzx eax, byte [eax]
mov ecx, dword [eax*4 + 0x6ce2a0]
mov edx, esi
xor eax, eax
call fcn.005c7a60
test eax, eax
jne 0x67ff39
mov esi, ebx
test esi, esi
je 0x67fefc
sub esi, 4
mov esi, dword [esi]
inc esi
mov eax, esi
add eax, eax
push eax
mov eax, ebx
call fcn.0040b278
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x67ff2e
mov eax, 0x6800d0
call fcn.0061674c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x67ff43
mov eax, 0x680134
call fcn.0061674c
cmp byte [ebp + 0xc], 0
je 0x67ffbe
mov eax, ebx
call fcn.0040b278
push eax
call sub.gdi32.dll_AddFontResourceW
test eax, eax
je 0x67ff6c
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
jmp 0x67ffbe
lea ecx, [ebp - 0x10]
mov edx, 0x680188
mov ax, 0x47
call fcn.005cd844
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.005c8430
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x6ceed8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x6ceed8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x6ceed8]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
pop eax
call fcn.0067d410
test al, al
je 0x67ff49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67ffe0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040a228
ret
Function at 0x68354c
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x68360d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x6835f2
test bl, 0x10
je 0x6835f2
lea ecx, [ebp - 4]
mov edx, 0x683628
mov eax, esi
call fcn.005c502c
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x68364c
mov eax, 0x683668
call fcn.005c68e4
mov edx, 0x683694
mov eax, dword [ebp - 8]
call fcn.00422380
test eax, eax
jne 0x6835f2
mov eax, dword [ebp - 4]
call fcn.00423a38
lea ecx, [ebp - 0xc]
mov edx, 0x6836f0
mov eax, esi
call fcn.005c502c
mov eax, dword [ebp - 0xc]
call fcn.00423a38
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.0040b278
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesW
push edi
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x683614
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a228
ret

Function at 0x684654
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x68472e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.0060d2d4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x68474c
call fcn.006169d0
mov eax, dword [0x6cea38]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
call fcn.00464ce8
mov esi, eax
mov eax, dword [esi]
mov ebx, eax
test ebx, ebx
je 0x6846c7
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
push eax
mov eax, ebx
mov ecx, 0x14
cdq
idiv ecx
push eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.0062d464
test al, al
jne 0x684718
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x6846fd
mov eax, 0x68479c
call fcn.0061674c
jmp 0x684718
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x68483c
call fcn.006169d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x684735
lea eax, [ebp - 0x1c]
call fcn.0040a1c8
ret