joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57efc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65a298
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00434600
fld qword [esp + 0x30]
mov eax, dword [esp + 0x20]
fstp qword [esi + 0x1f8]
fld qword [esp + 0x38]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
fstp qword [esi + 0x200]
fld dword [esp + 0x2c]
mov dword [esi + 0x1e8], eax
mov eax, dword [esp + 0x1c]
fstp dword [esi + 0x208]
cmp dword [esi + 0x1ac], eax
mov dword [esi + 0x1ec], ecx
mov dword [esp + 0x14], 0
mov dword [esi], 0x6a0770
mov dword [esi + 0x20], 0x6a0760
mov dword [esi + 0x1f0], edx
mov byte [esi + 0x49], 1
je 0x57f05c
mov ecx, esi
mov dword [esi + 0x1ac], eax
call dword [fcn.006a07ec]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x24

Function at 0x580d30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6754b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x24]
mov eax, dword [ecx + 0xc]
xor ebx, ebx
cmp byte [eax + 0x300], bl
je 0x580e2b
cmp byte [eax + 0x301], bl
je 0x580e2b
push 0x145
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x16
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6a09f4
mov byte [ecx + 4], bl
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x14]
lea edx, [esp + 0x34]
push edx
call fcn.00443d60
mov esi, 0x10
cmp dword [eax + 0x18], esi
mov dword [esp + 0x3c], ebx
jb 0x580dc9
mov eax, dword [eax + 4]
jmp 0x580dcc
add eax, 4
push eax
push 0x6a0aa8
push 0x6a0a6c
push 0x6ba0ac
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x3c
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6ba0c0
mov byte [ecx + 4], bl
call fcn.004027b0
mov ecx, dword [0x717c9c]
mov edx, dword [ecx + 0x14]
push edx
call fcn.00443a50
add esp, 0x34
cmp dword [esp + 0x2c], esi
mov dword [esp + 0x38], 0xffffffff
jb 0x580e2b
mov eax, dword [esp + 0x18]
push eax
call fcn.0060445c
add esp, 4
mov ecx, dword [edi + 0x90]
call fcn.0043f7d0
mov esi, eax
cmp esi, ebx
je 0x580e88
call fcn.00615c6f
cdq
idiv esi
mov eax, dword [edi + 0x90]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], eax
mov esi, edx
call fcn.0056aac0
cmp byte [esp + 0x14], bl
jne 0x580e88
cmp esi, ebx
je 0x580e9d
lea ecx, [esp + 0x14]
sub esi, 1
call fcn.0056aac0
cmp byte [esp + 0x14], bl
je 0x580e72
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x5818c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65be60
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x24]
mov edx, dword [ecx + 0xc]
xor ebx, ebx
cmp byte [edx + 0x1d0], bl
mov dword [esp + 0x30], ebx
je 0x5819aa
push 0x1e3
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x16
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6a09f4
mov byte [ecx + 4], bl
call fcn.004027b0
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x14]
lea eax, [esp + 0x2c]
push eax
call fcn.00443d60
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x34], 1
jb 0x58194b
mov eax, dword [eax + 4]
jmp 0x58194e
add eax, 4
push eax
push 0x6a0bac
push 0x6a09bc
push 0x6ba0ac
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x3c
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6ba0c0
mov byte [ecx + 4], bl
call fcn.004027b0
mov edx, dword [0x717c9c]
mov eax, dword [edx + 0x14]
push eax
call fcn.00443a50
add esp, 0x34
cmp dword [esp + 0x24], 0x10
mov byte [esp + 0x30], bl
jb 0x5819aa
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0060445c
add esp, 4
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x24], esp
push edx
lea ecx, [esp + 0x58]
call fcn.00573e60
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x24]
mov edx, dword [ecx + 0xc]
mov ecx, dword [edx + 0x2e38]
call fcn.00405110
cmp byte [esp + 0x54], bl
je 0x581a11
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x74], esp
push 0xb
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6be174
mov byte [ecx + 4], bl
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x2c]
call fcn.0043fe00
mov ecx, eax
call fcn.00457660
cmp dword [esp + 0x50], 0x10
jb 0x581a25
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0060445c
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x2c
ret 0x20
Function at 0x591b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65b678
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x30]
call fcn.0044d2e0
fstp qword [esi + 0x848]
add dword [esi + 0x850], 1
mov edx, dword [0x717c9c]
mov ecx, dword [edx + 0x24]
mov eax, dword [ecx + 0xc]
mov bl, byte [eax + 0x301]
mov al, byte [eax + 0x1d0]
test al, al
mov cl, 1
mov byte [esp + 0xc], bl
mov byte [esp + 0xd], cl
je 0x591ba9
mov edx, dword [edx + 0x24]
mov eax, dword [edx + 0xc]
xor cl, cl
mov byte [esp + 0xd], cl
mov byte [eax + 0x301], cl
test cl, cl
mov dword [esp + 0x30], 0
jne 0x591c44
mov ecx, dword [0x717c9c]
mov edx, dword [ecx + 0x24]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0x304]
mov ecx, dword [ecx + 0x94]
add ecx, 0x368
call fcn.00402fb0
test eax, eax
jne 0x591c44
mov edx, dword [0x717c9c]
fld qword [0x6dda50]
mov eax, dword [edx + 0x24]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x304]
mov eax, dword [edx + 0x94]
fcomp qword [eax + 0x2e8]
fnstsw ax
test ah, 0x41
jne 0x591c44
push 3
lea ecx, [esp + 0x14]
call fcn.0043b9a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x6a26c0
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], 0xa
mov dword [esp + 0x24], 0
call fcn.0043bbe0
lea ecx, [esp + 0x10]
call fcn.0043bc10
mov ecx, dword [0x717c9c]
mov edx, dword [ecx + 0x24]
mov eax, dword [edx + 0xc]
mov byte [eax + 0x301], bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x5ab450
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x65e188
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.005aa680
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
xor ebx, ebx
mov dword [esi], 0x6a4a40
mov dword [esi + 0x20], 0x6a4a30
push 0xa
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6a4b3c
mov dword [esp + 0x44], ebx
mov byte [ecx + 4], bl
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x2c]
call fcn.0043fe00
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
mov dword [esi + 0x410], eax
push 0xa
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6a4b30
mov byte [ecx + 4], bl
call fcn.004027b0
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x2c]
call fcn.0043fe00
fld1
push 1
push ecx
fstp dword [esp]
push 6
mov ecx, esi
mov dword [esi + 0x414], eax
mov dword [esi + 0x1f8], 0x270f
mov dword [esi + 0x1f4], 4
mov dword [esi + 0x1f0], 0x80
call fcn.00562710
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x5abda0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65e188
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.005aa680
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
xor ebx, ebx
mov dword [esi], 0x6a4b80
mov dword [esi + 0x20], 0x6a4b6c
push 0xa
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6a4c8c
mov dword [esp + 0x44], ebx
mov byte [ecx + 4], bl
call fcn.004027b0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x2c]
call fcn.0043fe00
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
mov dword [esi + 0x410], eax
push 0xa
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x6a4c80
mov byte [ecx + 4], bl
call fcn.004027b0
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x2c]
call fcn.0043fe00
fld qword [0x6dda50]
fstp qword [esi + 0x308]
push 1
fld qword [0x6ddd38]
push ecx
fstp qword [esi + 0x310]
mov ecx, esi
fld dword [0x692024]
mov dword [esi + 0x414], eax
fstp dword [esp]
push ebx
mov dword [esi + 0x1f8], 0x9c4
mov dword [esi + 0x1f4], 8
mov dword [esi + 0x1f0], 0x80
call fcn.00562710
fld dword [0x692024]
push 1
push ecx
fstp dword [esp]
push 1
mov ecx, esi
call fcn.00562710
fld dword [0x692024]
push 1
push ecx
fstp dword [esp]
push 8
mov ecx, esi
call fcn.00562710
fld dword [0x691790]
push 1
push ecx
fstp dword [esp]
push 9
mov ecx, esi
call fcn.00562710
fld dword [0x69178c]
push 1
push ecx
fstp dword [esp]
push 0xa
mov ecx, esi
call fcn.00562710
fld dword [0x691788]
push 1
push ecx
fstp dword [esp]
push 0xf
mov ecx, esi
call fcn.00562710
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x604320
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x661f98
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x702ca8]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x717c98]
xor ebx, ebx
cmp eax, ebx
je 0x6043fe
push 0xffffffffffffffff
add eax, 0xf5814
push ebx
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00402610
mov ecx, dword [0x717c98]
cmp ecx, ebx
mov dword [esp + 0x30], ebx
je 0x60439c
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [0x717c98], ebx
mov ecx, dword [0x717c9c]
cmp ecx, ebx
je 0x6043b5
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
mov dword [0x717c9c], ebx
mov eax, dword [esp + 0x1c]
push ebx
push 0x6ba06e
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.00403f60
test eax, eax
je 0x6043ea
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x6043dd
lea eax, [esp + 0xc]
push 1
push ebx
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esp + 0x20], 0x10
jb 0x6043fe
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0060445c
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00615b69
add esp, 0x2c
ret

Function at 0x60dca6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x702ca8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x60dce6
push 0x6ab100
push 4
push eax
call fcn.0061b1c5
push eax
call fcn.00603c00
add esp, 0x10
jmp 0x60dcf8
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
je 0x60dd66
push edi
call fcn.00619ae6
mov edi, dword [eax]
call fcn.00619ae6
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0061639e
add esp, 0x18
mov ebx, eax
call fcn.00619ae6
cmp dword [eax], 0
je 0x60dd46
call fcn.00619ae6
push dword [eax]
call fcn.00607e73
pop ecx
jmp 0x60dd4d
call fcn.00619ae6
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x60dd66
cmp ebx, esi
jae 0x60dd66
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
jmp 0x60dd68
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00615b69
leave
ret
Function at 0x6109fe
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x610a2c
push dword [esi]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x610a4a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00610968
jmp 0x610a4a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x610a4a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00610968
test edi, edi
mov eax, edi
jne 0x610a34
pop edi
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x715c10]
test ecx, ecx
je 0x610b0d
jmp 0x6109fd
ret 8

Function at 0x615b69
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x702ca8]
jne 0x615b73
repz ret
jmp fcn.0061e5ec

Function at 0x61fabf
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x703428]
je 0x61fada
inc edi
cmp edi, 0x17
jb 0x61facb
cmp edi, 0x17
jae 0x61fc5a
push ebp
push 3
call fcn.006296f8
cmp eax, 1
pop ecx
je 0x61fc26
push 3
call fcn.006296f8
test eax, eax
pop ecx
jne 0x61fb0e
cmp dword [0x702d10], 1
je 0x61fc26
cmp ebx, 0xfc
je 0x61fc59
push 0x6ad5cc
mov ebx, 0x314
push ebx
mov ebp, 0x7163b8
push ebp
call fcn.0061b1c5
add esp, 0xc
test eax, eax
je 0x61fb44
push esi
push esi
push esi
push esi
push esi
call fcn.006150de
add esp, 0x14
push 0x104
mov esi, 0x7163d1
push esi
push 0
mov byte [0x7164d5], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x61fb88
push 0x6ad5b4
push 0x2fb
push esi
call fcn.0061b1c5
add esp, 0xc
test eax, eax
je 0x61fb88
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.006150de
add esp, 0x14
push esi
call fcn.00619a20
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x61fbcd
push esi
call fcn.00619a20
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x7166cc
push 0x6bad10
sub ecx, eax
push ecx
push eax
call fcn.006194ab
add esp, 0x14
test eax, eax
je 0x61fbcd
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.006150de
add esp, 0x14
jmp 0x61fbcf
xor esi, esi
push 0x6ad5b0
push ebx
push ebp
call fcn.0061b22a
add esp, 0xc
test eax, eax
je 0x61fbef
push esi
push esi
push esi
push esi
push esi
call fcn.006150de
add esp, 0x14
push dword [edi*8 + 0x70342c]
push ebx
push ebp
call fcn.0061b22a
add esp, 0xc
test eax, eax
je 0x61fc11
push esi
push esi
push esi
push esi
push esi
call fcn.006150de
add esp, 0x14
push 0x12010
push 0x6ad588
push ebp
call fcn.0062953b
add esp, 0xc
jmp 0x61fc59
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x61fc59
cmp ebp, 0xffffffff
je 0x61fc59
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x70342c]
push dword [esi]
call fcn.00619a20
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x62953b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0061b8fc
xor ebx, ebx
cmp dword [0x716aa8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x629611
push 0x6adfc4
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x6296f1
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x6adfb8
push edi
call esi
cmp eax, ebx
je 0x6296f1
push eax
call fcn.0061b88e
mov dword [esp], 0x6adfa8
push edi
mov dword [0x716aa8], eax
call esi
push eax
call fcn.0061b88e
mov dword [esp], 0x6adf94
push edi
mov dword [0x716aac], eax
call esi
push eax
call fcn.0061b88e
mov dword [0x716ab0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0061704a
test eax, eax
pop ecx
pop ecx
je 0x6295df
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.006150de
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x629611
push 0x6adf78
push edi
call esi
push eax
call fcn.0061b88e
cmp eax, ebx
pop ecx
mov dword [0x716ab8], eax
je 0x629611
push 0x6adf60
push edi
call esi
push eax
call fcn.0061b88e
pop ecx
mov dword [0x716ab4], eax
mov eax, dword [0x716ab4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x629696
cmp dword [0x716ab8], ecx
je 0x629696
push eax
call fcn.0061b905
push dword [0x716ab8]
mov esi, eax
call fcn.0061b905
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x629696
cmp edi, ebx
je 0x629696
call esi
cmp eax, ebx
je 0x629663
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x629663
test byte [ebp - 0x18], 1
jne 0x629696
lea eax, [ebp - 0x10]
push eax
call fcn.00617081
test eax, eax
pop ecx
je 0x62967e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.006150de
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x62968d
or dword [ebp + 0x10], 0x200000
jmp 0x6296d1
or dword [ebp + 0x10], 0x40000
jmp 0x6296d1
mov eax, dword [0x716aac]
cmp eax, dword [ebp - 8]
je 0x6296d1
push eax
call fcn.0061b905
cmp eax, ebx
pop ecx
je 0x6296d1
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x6296d1
mov eax, dword [0x716ab0]
cmp eax, dword [ebp - 8]
je 0x6296d1
push eax
call fcn.0061b905
cmp eax, ebx
pop ecx
je 0x6296d1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x716aa8]
call fcn.0061b905
cmp eax, ebx
pop ecx
je 0x6296f1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x6296f3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x631887
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x702ca8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0063181c
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00615fd0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x6318d6
cmp dword [ebp - 0x1c], 5
jb 0x6318ee
jmp 0x6318ea
cmp dword [ebp - 0x10], 1
jne 0x6318ee
cmp dword [ebp - 0x1c], 4
ja 0x6318ea
jne 0x6318ee
cmp dword [ebp - 0x18], 0
jbe 0x6318ee
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x6af1ec
call fcn.0063170d
test eax, eax
jge 0x63190f
mov byte [0x71422c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00615b69
add ebp, 0x78
leave
ret

Function at 0x63593b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x6afc9c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x635993
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x635993
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x635993
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x6359bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x6afc9c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x635a2a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x6afcb8
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x635a21
cmp dword [ebp - 0xc], 4
jne 0x635a21
cmp dword [ebp - 0x10], edi
je 0x635a21
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x704698], edi
xor eax, eax
jmp 0x635a52
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x704698], edi
jge 0x635a4d
mov dword [0x704698], edi
call fcn.00635997
test eax, eax
je 0x635a4d
emms
mov dword [0x704698], 1
mov eax, dword [0x704698]
pop edi
leave
ret
Function at 0x635b32
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0x635b69
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x635b8b
cmp dword [ebp - 0x20], 4
ja 0x635b95
jne 0x635b85
cmp dword [ebp - 0x1c], 0xa
jb 0x635b85
cmp word [ebp - 0x18], 0x55d
jae 0x635b95
mov byte [ebp + 0x73], 1
jmp 0x635b95
cmp dword [ebp - 0x14], 2
jne 0x635bab
test bl, bl
je 0x635bc6
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x635bb6
dec eax
je 0x635baf
sub eax, 3
jne 0x635bab
cmp byte [ebp + 0x73], 0
je 0x635bd7
xor eax, eax
jmp 0x635bdf
call fcn.00635a55
jmp 0x635bdf
cmp byte [ebp + 0x73], 0
jne 0x635bab
call fcn.00635a8d
and eax, 4
jmp 0x635bdf
cmp dword [ebp + 0x7c], 0xa
je 0x635bd7
push dword [ebp + 0x7c]
call dword [sym.imp.kernel32.dll_IsProcessorFeaturePresent]
jmp 0x635bdf
call fcn.00635a8d
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x63669c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x6367bd
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x6367a1
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x6366f3
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x6366d1
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret