joyce8/EMBER2024-capa huggingface dataset:
Function at 0x77d0ad33
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push 0x28
push 0x77d0af48
call fcn.77cd5e30
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x19], 1
cmp byte [ebp + 8], 1
jne 0x77d0ad58
xor eax, eax
call fcn.77cd5e80
ret 8
mov dword [ebp - 0x24], 0xa00000
push 4
push 0x2000
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
mov edi, dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
call edi
cmp eax, esi
jl 0x77d0ad9a
mov dword [ebp - 0x24], 0x10000
push 4
push 0x1000
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
call edi
jmp 0x77d0ad9d
mov dword [ebp - 0x20], esi
cmp eax, esi
jge 0x77d0adad
mov dword [ebp + 8], 0xc0000017
jmp 0x77d0af0b
mov esi, 0x10000
mov ebx, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
jmp 0x77d0adea
cmp esi, dword [ebp - 0x28]
jae 0x77d0adc2
mov esi, dword [ebp - 0x28]
add esi, 0x1fff
and esi, 0xfffff000
mov dword [ebp - 0x24], esi
push 4
push 0x1000
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
call edi
test eax, eax
jl 0x77d0ada1
lea eax, [ebp - 0x28]
push eax
push esi
push dword [ebp - 0x20]
push 5
call ebx
cmp eax, 0xc0000004
mov dword [ebp + 8], eax
je 0x77d0adba
test eax, eax
jl 0x77d0af0b
push 2
call sym.ADVAPI32.dll_ImpersonateSelf
test eax, eax
jne 0x77d0ae1f
mov dword [ebp + 8], 0xc000010d
jmp 0x77d0af0b
lea eax, [ebp - 0x19]
push eax
push 1
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov dword [ebp + 8], eax
test eax, eax
jl 0x77d0af06
and dword [ebp - 0x2c], 0
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x34], esi
mov edi, dword [esi + 0x44]
push 0
push 0
call dword [sym.imp.ntdll.dll_RtlCreateQueryDebugBuffer]
mov ebx, eax
mov dword [ebp - 0x38], ebx
test ebx, ebx
jne 0x77d0ae63
mov dword [ebp + 8], 0xe
jmp 0x77d0aede
push ebx
push 0x80000204
push edi
call dword [sym.imp.ntdll.dll_RtlQueryProcessDebugInformation]
test eax, eax
jge 0x77d0ae80
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp + 8], eax
jmp 0x77d0aede
and dword [ebp - 4], 0
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x77d0ae95
push eax
push edi
push dword [ebp + 0xc]
call fcn.77d0ac38
mov dword [ebp - 4], 0xfffffffe
jmp 0x77d0aede
cmp dword [ebp - 0x20], 0
je 0x77d0aeeb
push ebx
call dword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
mov esi, dword [esi]
test esi, esi
jne 0x77d0af32
cmp byte [ebp - 0x19], 0
jne 0x77d0af06
lea eax, [ebp - 0x19]
push eax
push 1
push esi
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call sym.ADVAPI32.dll_RevertToSelf
cmp dword [ebp - 0x20], 0
je 0x77d0af2a
and dword [ebp - 0x24], 0
push 0x8000
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov eax, dword [ebp + 8]
jmp 0x77d0ad50
add dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
lea esi, [eax + ecx]
jmp 0x77d0ae41
Function at 0x77d0b152
Capabilities:
Access peb ldr_data
Get process heap flags
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov edi, dword [ebp + 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add edi, 0xc
push edi
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x77d0b190
mov eax, 0xc0000017
jmp 0x77d0b20d
push ebx
mov ebx, dword [ebp + 0x18]
push ebx
push edi
push esi
push 2
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
mov dword [ebp + 0xc], eax
jl 0x77d0b1f4
push dword [esi + 8]
mov edi, dword [ebp + 0x14]
lea eax, [esi + 0xc]
push eax
push edi
call sub.ntdll.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
mov dword [ebx], eax
cmp dword [esi + 4], 1
jne 0x77d0b1f4
mov eax, dword [esi + 8]
lea ecx, [eax + 2]
cmp ecx, dword [ebp + 0x10]
jbe 0x77d0b1dc
add eax, 0xfffffffe
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
mov byte [edi + eax], 0
inc dword [esi + 8]
mov eax, dword [esi + 8]
mov byte [edi + eax], 0
mov eax, dword [esi + 8]
inc eax
inc eax
mov dword [ebx], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp + 0xc]
pop ebx
pop edi
pop esi
leave
ret 0x14

Function at 0x77d0b218
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push edi
xor edi, edi
mov dword [eax], edi
lea eax, [ebp - 8]
push eax
push edi
xor ebx, ebx
mov dword [ebp - 0xc], edi
push edi
jmp 0x77d0b285
cmp dword [ebp - 4], 0xc0000004
jne 0x77d0b2c5
test ebx, ebx
je 0x77d0b25f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edi, dword [ebp - 8]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
je 0x77d0b2e8
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 0x49
call esi
test eax, eax
mov dword [ebp - 4], eax
jl 0x77d0b23d
test edi, edi
jbe 0x77d0b2bd
push 0x18
xor edx, edx
lea eax, [edi - 1]
pop esi
div esi
lea ecx, [ebx + 8]
inc eax
cmp dword [ecx - 4], 0
jne 0x77d0b2b7
mov edx, dword [ecx - 8]
test edx, edx
jbe 0x77d0b2b7
cmp byte [ecx], 1
jne 0x77d0b2b7
or dword [ebp - 0xc], edx
add ecx, 0x18
dec eax
jne 0x77d0b2a2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test ebx, ebx
je 0x77d0b2de
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
mov dword [ebp - 4], 0xc0000017
jmp 0x77d0b2c5
Function at 0x77d0cf8e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x44
push 0
push esi
call sub.ntdll.dll_memset
add esp, 0xc
push 0x77cef458
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi], eax
je 0x77d0d0ed
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x77d0d298
push eax
call edi
test eax, eax
mov dword [esi + 4], eax
je 0x77d0d0df
push 0x77d0d278
push dword [esi]
call edi
test eax, eax
mov dword [esi + 8], eax
je 0x77d0d0df
push 0x77d0d260
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0xc], eax
je 0x77d0d0df
push 0x77d0d23c
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x10], eax
je 0x77d0d0df
push 0x77d0d21c
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x14], eax
je 0x77d0d0df
push 0x77d0d200
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x18], eax
je 0x77d0d0df
push 0x77d0d1e4
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x1c], eax
je 0x77d0d0df
push 0x77d0d1c0
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x20], eax
je 0x77d0d0df
push 0x77d0d1a4
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x28], eax
je 0x77d0d0df
push 0x77d0d188
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x2c], eax
je 0x77d0d0df
push 0x77d0d170
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x30], eax
je 0x77d0d0df
push 0x77d0d154
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x34], eax
je 0x77d0d0df
push 0x77d0d13c
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x38], eax
je 0x77d0d0df
push 0x77d0d124
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x3c], eax
je 0x77d0d0df
push 0x77d0d10c
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x40], eax
je 0x77d0d0df
push 0x77d0d0f4
push dword [esi]
call edi
test eax, eax
mov dword [esi + 0x24], eax
jne 0x77d0d0e9
push esi
call fcn.77d0b95b
xor eax, eax
jmp 0x77d0d0ec
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x77d0d324
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword fs:[0x18]
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov eax, 0x20e
push edi
mov dword [ebp - 4], eax
push eax
mov eax, dword [ecx + 0x30]
jmp 0x77d0d3b0
mov edx, dword [ebp + 0x1c]
push 7
pop ecx
xor eax, eax
push edx
mov dword [ebx], 6
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push ebx
push dword [ebp + 0x10]
mov dword [edx], 0x1c
push dword [ebp + 0xc]
call dword [eax + 0x20]
test eax, eax
jne 0x77d0d3c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x7a
jne 0x77d0d416
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [ebp - 8]
push ebx
push 0
push dword [eax + 0x18]
mov dword [ebp - 4], edi
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 8
push dword [eax + 0x18]
call esi
mov ebx, eax
test ebx, ebx
jne 0x77d0d349
push 0xe
pop edi
jmp 0x77d0d416
lea eax, [ebx + 4]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x77d0d3c8
mov edi, dword [ebp + 0x18]
sub eax, ecx
mov ecx, dword fs:[0x18]
sar eax, 1
mov dword [edi], eax
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ecx + 0x30]
push 8
push dword [eax + 0x18]
call esi
test eax, eax
mov esi, dword [ebp + 0x14]
mov dword [esi], eax
je 0x77d0d3bd
mov ecx, dword [edi]
add ecx, ecx
push ecx
lea ecx, [ebx + 4]
push ecx
push eax
call sub.ntdll.dll_memcpy
mov eax, dword [edi]
mov ecx, dword [esi]
add esp, 0xc
xor edi, edi
mov word [ecx + eax*2], di
test ebx, ebx
je 0x77d0d42f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x77d0df63
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push esi
push edi
mov esi, 0x104
push 0x208
jmp 0x77d0dfb2
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
cmp edi, esi
jbe 0x77d0dfd1
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
lea esi, [edi + 1]
lea ecx, [esi + esi]
push ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call ebx
test eax, eax
mov dword [ebp - 8], eax
jne 0x77d0df84
push 0xe
pop esi
jmp 0x77d0e0f7
test edi, edi
jne 0x77d0dfe2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x77d0e0f7
mov eax, dword [ebp - 8]
jmp 0x77d0e0cb
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x77d0e0b1
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.77d0dc1e
test eax, eax
jne 0x77d0e090
mov eax, dword [ebp - 4]
test eax, eax
je 0x77d0e0b1
add eax, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
cmp eax, 0xffff
jae 0x77d0e121
lea edi, [eax + 0x20]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 8
push dword [eax + 0x18]
call ebx
mov esi, eax
test esi, esi
je 0x77d0e11d
mov eax, dword [ebp - 0x10]
mov word [esi + 6], 0xb0c
push dword [eax]
lea eax, [esi + 0x20]
push dword [ebp - 4]
push eax
call sub.ntdll.dll_memcpy
movzx eax, word [ebp + 8]
add esp, 0xc
push esi
add edi, 0xffffffe0
push edi
push 0x40000004
push eax
call dword [sym.imp.ntdll.dll_NtTraceEvent]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 4], 0
je 0x77d0e0b1
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
and dword [ebp - 4], 0
mov esi, dword [ebp - 0xc]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x77d0e0b9
sub eax, edx
sar eax, 1
lea eax, [esi + eax*2 + 2]
cmp word [eax], 0
mov dword [ebp - 0xc], eax
jne 0x77d0dfea
xor esi, esi
cmp dword [ebp - 4], 0
je 0x77d0e0f7
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 8], 0
je 0x77d0e114
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
push 0xe
jmp 0x77d0e123
push 8
pop esi
jmp 0x77d0e0da
Function at 0x77d0eb86
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], ebx
je 0x77d0ec19
cmp word [edi], bx
je 0x77d0ec19
cmp byte [0x77d34484], bl
push esi
mov esi, 0x77d34278
jne 0x77d0ebdc
push 0x20a
push ebx
push esi
mov dword [ebp + 8], 0x105
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
setne al
cmp al, bl
mov byte [0x77d34484], al
je 0x77d0ec18
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
push edi
call ebx
test eax, eax
je 0x77d0ec18
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
mov dword [ebp + 8], eax
jbe 0x77d0ec11
cmp word [edi], 0x5c
jne 0x77d0ec11
cmp word [edi + 2], 0x5c
jne 0x77d0ec11
push esi
add edi, 4
push edi
call ebx
test eax, eax
je 0x77d0ec18
mov dword [ebp - 4], 0xd
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 4
Function at 0x77d0fa01
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [ebp + 0x10]
not al
and al, 1
push ebx
mov byte [ebp + 0x13], al
mov eax, dword [0x77d2662c]
push esi
push edi
mov byte [ebp - 1], 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x77d26630
xor ebx, ebx
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push edi
call dword [ebp - 0x10]
mov esi, eax
cmp esi, ebx
jne 0x77d0fb5b
cmp dword [ebp - 0x10], 0x77d21d1a
je 0x77d0fa7d
push dword [0x77d26120]
push dword [ebp - 8]
call dword [sym.imp.RPCRT4.dll_RpcEpResolveBinding]
mov esi, eax
cmp esi, ebx
jne 0x77d0fb92
push ebx
push ebx
push 0xa
push 2
push 0x77cef810
push dword [ebp - 8]
call dword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoA]
mov esi, eax
jmp 0x77d0fb17
cmp byte [ebp - 1], bl
je 0x77d0fb17
cmp word [edi], 0x5c
mov dword [ebp - 0xc], edi
jne 0x77d0fa9c
cmp word [edi + 2], 0x5c
jne 0x77d0fa9c
add edi, 4
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x77d0faa2
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, ebx
jne 0x77d0fad3
mov edi, dword [ebp - 0xc]
jmp 0x77d0fae9
push 0x77cef804
push esi
push edi
call fcn.77ca4bd4
push dword [ebp - 0xc]
push esi
push edi
call fcn.77d150b6
push ebx
push ebx
push 9
push 6
push edi
push dword [ebp - 8]
call dword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoW]
cmp edi, dword [ebp - 0xc]
mov esi, eax
je 0x77d0fb14
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [ebp + 8]
cmp esi, ebx
jne 0x77d0fb92
push dword [ebp + 0x18]
lea eax, [ebp - 8]
push dword [ebp + 0x14]
push eax
call dword [ebp + 0xc]
mov esi, eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.RPCRT4.dll_RpcBindingFree]
cmp esi, ebx
je 0x77d0fb88
cmp byte [ebp - 1], bl
je 0x77d0fb88
cmp byte [ebp + 0x13], bl
je 0x77d0fb88
lea eax, [ebp - 8]
push eax
push edi
mov byte [ebp - 1], bl
call dword [ebp - 0x10]
mov esi, eax
cmp esi, ebx
je 0x77d0fa40
cmp esi, ebx
je 0x77d0fbb3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
add dword [ebp - 0x14], 4
cmp esi, ebx
mov dword [ebp - 0x10], eax
je 0x77d0fbb3
cmp eax, ebx
jne 0x77d0fa2b
cmp esi, 0x6aa
je 0x77d0fbae
cmp esi, 0x6ab
je 0x77d0fbae
push 0x35
pop esi
jmp 0x77d0fbb3
cmp esi, 0x6ba
je 0x77d0fb5b
jmp 0x77d0fbb3
lea eax, [ebp - 8]
push eax
call dword [sym.imp.RPCRT4.dll_RpcBindingFree]
cmp byte [ebp - 1], bl
je 0x77d0fb57
cmp byte [ebp + 0x13], bl
je 0x77d0fb57
mov byte [ebp - 1], bl
jmp 0x77d0fa2b
mov esi, 0x4ba
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x77d1004f
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push edi
mov ebx, 0x1800
push ebx
xor edi, edi
push edi
push dword [eax + 0x18]
mov dword [ebp - 4], edi
call esi
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x77d1008b
push 8
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
push ebx
push edi
push eax
call sub.ntdll.dll_memset
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add esp, 0xc
push 0x202
push edi
push dword [eax + 0x18]
call esi
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x77d100ce
push 8
pop ebx
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
jmp 0x77d10084
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp - 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x77d100ff
cmp word [eax], di
je 0x77d100ff
push esi
push 0x2000000
push 8
push eax
push dword [ebp + 8]
call sym.ADVAPI32.dll_RegOpenKeyExW
mov ebx, eax
cmp ebx, edi
je 0x77d10104
jmp 0x77d101f7
mov eax, dword [ebp + 8]
mov dword [esi], eax
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [esi]
call fcn.77d0fc3f
mov ebx, eax
cmp ebx, edi
jne 0x77d101f7
mov eax, esi
lea ecx, [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x10], ecx
mov dword [ebp + 8], eax
push edi
push edi
mov dword [ebp - 0x10], 0x100
mov eax, dword [esi + 8]
push edi
lea ecx, [eax + 1]
push edi
mov dword [esi + 8], ecx
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0xc]
push eax
push dword [esi]
call sym.ADVAPI32.dll_RegEnumKeyExW
mov ebx, eax
cmp ebx, 0x103
jne 0x77d10184
cmp dword [ebp - 4], edi
jle 0x77d10172
push dword [esi]
call sym.ADVAPI32.dll_RegCloseKey
push dword [esi + 4]
call sym.ADVAPI32.dll_RegCloseKey
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
dec dword [ebp - 4]
sub dword [ebp + 8], 0xc
sub dword [ebp + 0x10], 0xc
sub esi, 0xc
xor ebx, ebx
jmp 0x77d101c0
cmp ebx, edi
jne 0x77d101cd
cmp dword [ebp - 4], 0x1ff
jge 0x77d101ca
push dword [ebp + 8]
mov eax, dword [ebp - 0xc]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
push eax
mov word [eax + ecx*2], di
push dword [esi + 4]
push dword [esi]
call fcn.77d0fc3f
mov ebx, eax
cmp ebx, edi
jne 0x77d101cd
inc dword [ebp - 4]
add dword [ebp + 8], 0xc
add esi, 0xc
add dword [ebp + 0x10], 0xc
cmp dword [ebp - 4], edi
jl 0x77d101f4
jmp 0x77d10129
push 8
pop ebx
mov esi, dword [ebp - 4]
cmp esi, edi
jle 0x77d101f4
imul esi, esi, 0xc
add esi, dword [ebp - 8]
push dword [esi]
call sym.ADVAPI32.dll_RegCloseKey
push dword [esi + 4]
call sym.ADVAPI32.dll_RegCloseKey
dec dword [ebp - 4]
sub esi, 0xc
cmp dword [ebp - 4], edi
jg 0x77d101da
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x77d1020a
cmp word [eax], di
je 0x77d1020a
push dword [esi]
call sym.ADVAPI32.dll_RegCloseKey
push dword [ebp - 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x77d100b4
Function at 0x77d10772
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x1c], 0
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x77d107ab
mov eax, 0xc0000001
jmp 0x77d10817
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov edi, eax
test edi, edi
jl 0x77d10817
mov eax, dword [ebp - 0x1c]
mov ecx, dword fs:[0x18]
add eax, 0x1a
mov word [esi + 2], ax
movzx eax, ax
push eax
mov eax, dword [ecx + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
mov dword [esi + 4], eax
jne 0x77d107f0
mov edi, 0xc000009a
jmp 0x77d1080b
and word [esi], 0
push 0x77d10828
push esi
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.77cd6011
leave
ret 4
Function at 0x77d14765
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push ebx
mov dword [ebp - 0xc], ebx
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 0x18
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x77d147b9
push 0x218
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x77d147c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x77d147e6
lea eax, [ebp - 4]
push eax
lea edi, [ebx + 0x18]
push edi
push dword [ebp - 0xc]
mov esi, ebx
mov dword [ebp - 4], 0x80
call dword [sym.imp.ntdll.dll_LdrQueryModuleServiceTags]
test eax, eax
je 0x77d147eb
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 8], eax
jmp 0x77d1481a
cmp dword [ebp - 4], 0
jne 0x77d147fa
mov dword [ebp - 8], 0x103
jmp 0x77d1481a
push 0x77d1473a
push 4
push dword [ebp - 4]
push edi
call sub.ntdll.dll_qsort
mov eax, dword [ebp - 4]
lea eax, [eax*4 + 0x18]
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
je 0x77d14829
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
push 0
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x77d1582d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x77ccac50
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and dword [ebp - 0x1f8], 0
lea eax, [ebp - 0x210]
push eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push 2
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
pop esi
jl 0x77d158c0
push 9
lea eax, [ebp - 0x1f8]
push 0x77d158ec
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x77d158a6
xor eax, eax
inc eax
jmp 0x77d158c2
push 0xc
lea eax, [ebp - 0x1f8]
push 0x77d158d0
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x77d158a1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.77cd6011
leave
ret 4