joyce8/EMBER2024-capa huggingface dataset:
Function at 0x77cf2420
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x20]
push ebx
push esi
mov esi, dword [ebp + 0x30]
push edi
lea ecx, [ebp - 4]
push ecx
push esi
push dword [ebp + 0x2c]
mov edi, eax
push dword [ebp + 0x28]
or eax, 4
push dword [ebp + 0x24]
xor ebx, ebx
push eax
push dword [ebp + 0x1c]
shr edi, 2
push dword [ebp + 0x18]
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
and edi, 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessInternalA]
test eax, eax
jne 0x77cf247f
cmp dword [ebp - 4], ebx
je 0x77cf2478
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
jmp 0x77cf251d
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 4
or eax, ecx
or edi, eax
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x77cf2509
mov ecx, dword [esi]
test cl, 2
mov dword [ebp + 0x20], ebx
je 0x77cf24d0
push eax
push ebx
mov ebx, 0x1fffff
push ebx
mov dword [ebp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [esi], eax
jne 0x77cf24d0
push dword [esi + 8]
push eax
push ebx
call fcn.77cf232d
mov dword [esi], eax
cmp dword [ebp - 4], 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
jne 0x77cf24e2
push dword [ebp + 8]
jmp 0x77cf24e5
push dword [ebp - 4]
push edi
call fcn.77cb0726
mov edi, eax
test edi, edi
je 0x77cf250c
mov ebx, dword [ebp + 0x20]
test ebx, ebx
je 0x77cf250c
mov eax, dword [esi]
test eax, eax
je 0x77cf2505
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [esi], ebx
jmp 0x77cf250c
xor edi, edi
inc edi
cmp dword [ebp - 4], 0
je 0x77cf251b
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x2c
Function at 0x77cf2bef
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xfc
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x68
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0xf8], ebx
call sub.ntdll.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0xf4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov esi, eax
cmp esi, 0xffffffff
jne 0x77cf2c47
push 0x8009001e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x77cf2cb6
lea eax, [ebp - 0xfc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x77cf2c69
push 0x8009001c
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x77cf2caf
lea eax, [ebp - 0x6c]
push eax
call fcn.77c98166
lea eax, [ebp - 0x6c]
push eax
push ebx
push esi
call fcn.77cf2b41
test eax, eax
je 0x77cf2c5c
lea eax, [ebp - 0x6c]
push eax
call fcn.77c981a0
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push edi
call fcn.77c98b07
test eax, eax
jne 0x77cf2ca5
push 0x80090006
jmp 0x77cf2c61
mov dword [ebp - 0xf8], 1
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xf8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0x10
Function at 0x77cf4a33
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x77cf4b48
lea eax, [ebp - 0x10]
push eax
call edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
xor ebx, ebx
push 1
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x77cf4b12
mov eax, dword fs:[0x18]
push esi
push 0x14
pop ecx
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
je 0x77cf4b08
push 0x77cf4b18
lea eax, [ebp - 0x18]
push eax
call edi
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push esi
push 2
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jl 0x77cf4ad4
mov eax, dword [esi + 0xc]
mov dword [0x77d2b2b8], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test dword [ebp + 8], 0x20000
je 0x77cf4af8
and dword [0x77d2b2b8], 0xfffffffd
test dword [ebp + 8], 0x10000
je 0x77cf4b08
and dword [0x77d2b2b8], 0xfffffffe
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x77cf51ff
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push 1
xor ebx, ebx
push ebx
push ebx
call sym.ADVAPI32.dll_OpenSCManagerW
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x77cf5228
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x77cf52bf
push edi
push 0x54
push 0x77cf52c8
push eax
call sym.ADVAPI32.dll_OpenServiceW
mov edi, eax
cmp edi, ebx
jne 0x77cf5246
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x77cf52ac
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 4], eax
jmp 0x77cf5293
mov eax, dword [ebp - 0x20]
dec eax
je 0x77cf526c
sub eax, 6
jne 0x77cf5278
lea eax, [ebp - 0x24]
push eax
push 3
push edi
call sym.ADVAPI32.dll_ControlService
jmp 0x77cf5274
push ebx
push ebx
push edi
call sym.ADVAPI32.dll_StartServiceW
test eax, eax
je 0x77cf523c
cmp dword [ebp - 0x20], 4
je 0x77cf52a3
call esi
sub eax, dword [ebp - 4]
cmp eax, 0x4e20
ja 0x77cf52a7
push ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp - 0x24]
push eax
push edi
call sym.ADVAPI32.dll_QueryServiceStatus
test eax, eax
je 0x77cf523c
jmp 0x77cf5253
xor esi, esi
jmp 0x77cf52ac
mov esi, 0x41d
push dword [ebp - 8]
call sym.ADVAPI32.dll_CloseServiceHandle
cmp edi, ebx
je 0x77cf52be
push edi
call sym.ADVAPI32.dll_CloseServiceHandle
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x77cf9cd1
Capabilities:
Identify system language via api

Disassembly:
push 0x14
push 0x77cf9d78
call fcn.77cd5e30
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
cmp si, ax
jne 0x77cf9d02
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push dword [ebp + 0x14]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.77cfb602
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x77cf9d64
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.77cd5e80
ret 0x10

Function at 0x77cfc8d9
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.77cfc20b

Function at 0x77cfd2b4
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push 0
mov edi, 0x80
push edi
push 3
push 0
push 1
push 6
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x77cfd320
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x77cfd320
push 0
push edi
push 4
push 0
push 1
push 6
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x77cfd320
push 0
lea eax, [ebp - 4]
push eax
push 8
push 0x77cfd32c
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x77cfd320
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x77cfda5f
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
lea edi, [ebx + 0x210]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x77cfda97
mov dword [ebp + 0x18], 0xc0000017
jmp 0x77cfdb16
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 4]
push eax
push edi
push esi
push 2
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
mov dword [ebp + 0x18], eax
jl 0x77cfdb01
mov eax, dword [esi + 4]
cmp eax, dword [ebp + 0x10]
je 0x77cfdad1
mov dword [ebp + 0x18], 0xc0000225
jmp 0x77cfdb01
mov edi, dword [esi + 8]
cmp edi, ebx
mov dword [ebp - 4], edi
jbe 0x77cfdae4
mov dword [ebp + 0x18], 0xc0000023
jmp 0x77cfdaf8
push edi
lea eax, [esi + 0xc]
push eax
push dword [ebp + 0x14]
call sub.ntdll.dll_memcpy
add esp, 0xc
and dword [ebp + 0x18], 0
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x77cfdb01
mov dword [eax], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x77cfde6d
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0xa0], ebx
jne 0x77cfde89
cmp dword [esi + 0x9c], ebx
je 0x77cfde9e
mov eax, dword [esi + 0xa8]
or eax, dword [esi + 0xac]
je 0x77cfde9e
xor eax, eax
jmp 0x77cfdf27
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x58]
or ecx, dword [eax + 0x5c]
je 0x77cfdeca
mov ecx, dword [eax + 0x64]
cmp ecx, ebx
je 0x77cfdeca
mov dword [esi + 0x9c], ecx
mov ecx, dword [eax + 0x58]
mov dword [esi + 0xa8], ecx
mov eax, dword [eax + 0x5c]
mov dword [esi + 0xac], eax
jmp 0x77cfde97
mov eax, dword [esi + 0x8c]
cmp eax, ebx
jne 0x77cfdedb
mov eax, 0xc0000225
jmp 0x77cfdf27
push edi
lea edi, [esi + 0xa8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x77cfdf21
mov eax, dword [edi]
or eax, dword [edi + 4]
jne 0x77cfdefc
mov eax, 0xc000000d
jmp 0x77cfdf26
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esi + 0x8c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, ebx
je 0x77cfdf21
cmp eax, 0xffffffff
je 0x77cfdf21
mov dword [esi + 0xa0], eax
xor eax, eax
jmp 0x77cfdf26
mov eax, 0xc0000022
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x77cfe730
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
push ebx
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 0x10], 1
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x218], edi
je 0x77cfe76a
mov edi, 0xc000000d
jmp 0x77cfe946
push esi
push dword [edi + 0x220]
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x224]
push eax
call esi
add edi, 0x20
push edi
lea eax, [ebp - 0x234]
push eax
call esi
cmp word [ebp - 0x234], 0x200
jae 0x77cfe940
xor esi, esi
cmp word [ebp - 0x224], si
je 0x77cfe940
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x22c]
push eax
push ebx
push 0x77cef1d8
push dword [ebx + 0x14]
mov word [ebp - 0x22c], si
mov word [ebp - 0x22a], 0x208
call fcn.77cff68d
mov edi, eax
cmp edi, esi
jl 0x77cfe945
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x2001f
push eax
push dword [0x77d2a6ec]
push dword [ebx + 0x18]
call fcn.77cb6edb
mov edi, eax
cmp edi, esi
jl 0x77cfe945
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 8
lea eax, [ebp - 0x23c]
push eax
push 0xb
push esi
mov esi, dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x77cfe958
push dword [ebp - 0x214]
call esi
mov edi, eax
test edi, edi
jl 0x77cfe932
movzx eax, word [ebp - 0x232]
push eax
push dword [ebp - 0x230]
push 1
push 0
push 0x77cfe960
push dword [ebp - 0x214]
call esi
mov edi, eax
test edi, edi
jl 0x77cfe932
mov eax, dword [ebp - 0x218]
mov eax, dword [eax + 0x224]
push 4
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push 0x77cfe968
push dword [ebp - 0x214]
call esi
mov edi, eax
test edi, edi
jl 0x77cfe932
mov eax, dword [ebp - 0x218]
push 0x25
push dword [eax + 0x220]
call sub.ntdll.dll_wcschr
pop ecx
test eax, eax
movzx eax, word [ebp - 0x222]
pop ecx
push eax
push dword [ebp - 0x220]
setne byte [ebp - 0x20d]
xor eax, eax
cmp byte [ebp - 0x20d], al
setne al
inc eax
push eax
push 0
push 0x77cfe970
push dword [ebp - 0x214]
call esi
mov edi, eax
test edi, edi
jl 0x77cfe932
cmp dword [ebp + 0x14], 0
je 0x77cfe930
lea esi, [ebx + 0x24]
push esi
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
push esi
lea eax, [ebp - 0x224]
push eax
push 1
call dword [sym.imp.ntdll.dll_RtlDuplicateUnicodeString]
mov edi, eax
test edi, edi
jl 0x77cfe932
movzx eax, byte [ebp - 0x20d]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebx + 0x2c], eax
xor edi, edi
push dword [ebp - 0x214]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77cfe945
mov edi, 0xc000000d
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0x10
Function at 0x77cfee35
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [esi + 0x10], 3
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], edi
je 0x77cfee71
mov ebx, 0xc000000d
jmp 0x77cfef86
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
push eax
push esi
push 0x77cef228
push dword [esi + 0x14]
mov word [ebp - 0x220], di
mov word [ebp - 0x21e], 0x208
call fcn.77cff68d
mov ebx, eax
cmp ebx, edi
jl 0x77cfef86
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x2001f
push eax
push dword [0x77d2a6ec]
push dword [esi + 0x18]
call fcn.77cb6edb
mov ebx, eax
cmp ebx, edi
jl 0x77cfef86
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 8
lea eax, [ebp - 0x228]
push eax
push 0xb
push edi
mov edi, dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x77cfef9c
push dword [ebp - 0x210]
call edi
mov ebx, eax
test ebx, ebx
jl 0x77cfef7a
mov eax, dword [ebp - 0x214]
mov eax, dword [eax + 0x24]
push 4
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
push eax
push 4
push 0
push 0x77cfefa4
push dword [ebp - 0x210]
call edi
mov ebx, eax
test ebx, ebx
jl 0x77cfef7a
mov eax, dword [ebp - 0x218]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x214]
push 4
add eax, 0x20
push eax
push 4
push 0
push 0x77cfefac
push dword [ebp - 0x210]
mov dword [ebp - 0x214], eax
call edi
mov ebx, eax
test ebx, ebx
jl 0x77cfef7a
mov eax, dword [ebp - 0x214]
mov eax, dword [eax]
mov dword [esi + 0x20], eax
xor ebx, ebx
push dword [ebp - 0x210]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0xc
Function at 0x77cff1f7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x214]
push ecx
push eax
call fcn.77cb7a5d
mov esi, eax
test esi, esi
jl 0x77cff410
mov eax, dword [ebp - 0x214]
push ebx
push dword [eax + 4]
push 0x77d26860
call fcn.77cb6e85
mov ebx, eax
test ebx, ebx
jne 0x77cff24f
mov esi, 0xc0000008
jmp 0x77cff40f
mov eax, dword [ebp - 0x214]
mov esi, dword [eax + 8]
mov eax, dword [ebp + 0xc]
test eax, eax
mov dword [ebp - 0x218], esi
jle 0x77cff40a
cmp eax, 2
jle 0x77cff40a
cmp eax, 4
jle 0x77cff2bc
cmp eax, 5
je 0x77cff40a
cmp eax, 0xe
je 0x77cff40a
cmp eax, 0xf
jne 0x77cff40a
and dword [ebp - 0x210], 0
sub eax, 3
je 0x77cff3c4
dec eax
je 0x77cff3bd
sub eax, 0xb
je 0x77cff345
mov esi, 0xc0000003
jmp 0x77cff3f3
cmp byte [ebx + 4], 0
je 0x77cff2cc
mov esi, 0xc0000022
jmp 0x77cff40f
and word [ebp - 0x228], 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x228]
push eax
mov word [ebp - 0x226], 0x208
push dword [ebx]
call fcn.77cff605
mov esi, eax
test esi, esi
jl 0x77cff40f
lea eax, [ebp - 0x210]
push eax
push 1
push 0x20006
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [0x77d2a6ec]
xor ecx, ecx
test eax, eax
setne cl
push eax
lea ecx, [ecx + ecx + 1]
push ecx
call fcn.77cb6edb
mov esi, eax
test esi, esi
jl 0x77cff40f
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0x218]
jmp 0x77cff299
test edi, edi
jne 0x77cff353
mov esi, 0xc0000005
jmp 0x77cff3f3
mov eax, dword [ebp + 0x14]
cmp eax, 0x20
jb 0x77cff3b6
cmp eax, dword [edi + 4]
jb 0x77cff3b6
lea eax, [edi + 8]
push eax
push 0x77d26820
call fcn.77cb56e3
test eax, eax
jne 0x77cff37c
push edi
push ebx
push esi
call fcn.77cff023
jmp 0x77cff3f1
cmp dword [edi], 0
mov ecx, dword [eax + 0x14]
jne 0x77cff39d
cmp ecx, dword [ebx]
jne 0x77cff396
cmp dword [eax + 0x18], esi
jne 0x77cff396
push eax
push ebx
call fcn.77cfe62d
jmp 0x77cff3f1
mov esi, 0xc0000225
jmp 0x77cff3f3
cmp ecx, dword [ebx]
jne 0x77cff3af
cmp dword [eax + 0x18], esi
jne 0x77cff3af
push edi
push eax
call fcn.77cfefb9
jmp 0x77cff3f1
mov esi, 0xc0000035
jmp 0x77cff3f3
mov esi, 0xc0000004
jmp 0x77cff3f3
push 0x77cef200
jmp 0x77cff3c9
push 0x77cef1e4
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push dword [ebp + 0x14]
lea eax, [ebp - 0x220]
push edi
push 1
push 0
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
cmp dword [ebp - 0x210], 0
je 0x77cff40f
push dword [ebp - 0x210]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77cff40f
mov esi, 0xc0000003
pop ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.77cd6011
leave
ret 0x10
Function at 0x77cff493
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x77cff4eb
cmp dword [eax + 4], ebx
je 0x77cff4eb
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push 0x30019
lea eax, [ebp + 0xc]
push eax
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 0x40
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
cmp eax, ebx
jl 0x77cff5fb
mov byte [ebp + 0xb], 1
jmp 0x77cff4f4
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
mov byte [ebp + 0xb], bl
mov ecx, dword fs:[0x18]
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov eax, 0x100
push eax
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x30]
push ebx
push dword [eax + 0x18]
call edi
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push esi
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
cmp eax, 0xc0000023
je 0x77cff538
cmp eax, 0x80000005
jne 0x77cff58d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jbe 0x77cff5c6
cmp esi, ebx
je 0x77cff55c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call edi
mov esi, eax
cmp esi, ebx
je 0x77cff5de
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push esi
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
cmp eax, 0x8000001a
je 0x77cff5c6
cmp eax, ebx
jl 0x77cff5c6
cmp esi, ebx
je 0x77cff5de
lea eax, [esi + 0x10]
mov dword [ebp - 0xc], eax
mov ax, word [esi + 0xc]
mov word [ebp - 0xe], ax
mov ax, word [esi + 0xc]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call fcn.77cff493
test eax, eax
jge 0x77cff517
cmp esi, ebx
je 0x77cff5de
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
cmp byte [ebp + 0xb], bl
mov esi, eax
je 0x77cff5f7
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x77cff84b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 0x14]
movzx eax, si
shr eax, 4
inc eax
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x77cff8bc
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x77cff8bc
and esi, 0xf
movzx ecx, word [eax]
lea eax, [eax + 2]
je 0x77cff896
lea eax, [eax + ecx*2]
movzx ecx, word [eax]
dec esi
inc eax
inc eax
test esi, esi
jne 0x77cff889
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ecx + ecx]
mov word [ebp - 6], ax
mov word [ebp - 8], ax
lea eax, [ebp - 8]
push eax
push 1
call dword [sym.imp.ntdll.dll_RtlDuplicateUnicodeString]
test eax, eax
jl 0x77cff8bc
xor eax, eax
inc eax
jmp 0x77cff8be
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x77cffd5b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp word [ebx], di
mov eax, ebx
je 0x77cffdad
movzx esi, word [eax]
cmp si, 0x2d
jne 0x77cffd9b
lea ecx, [eax + 2]
cmp word [ecx], 0x2a
jne 0x77cffd9b
movzx edx, word [eax + 4]
test dx, dx
je 0x77cffd91
cmp dx, si
jne 0x77cffd9b
test edi, edi
jne 0x77cffdce
mov edi, ecx
mov eax, ecx
jmp 0x77cffda1
cmp si, 0x2a
je 0x77cffdce
inc eax
inc eax
cmp word [eax], 0
jne 0x77cffd71
test edi, edi
jne 0x77cffdd8
mov eax, dword [ebp + 0xc]
or dword [eax + 4], 0xffffffff
push eax
push ebx
call sym.ADVAPI32.dll_ConvertStringSidToSidW
neg eax
sbb eax, eax
and eax, 0x3fffffff
add eax, 0xc0000001
jmp 0x77cffee0
mov eax, 0xc0000078
jmp 0x77cffee0
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x77cffddd
mov ecx, dword fs:[0x18]
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 2]
mov eax, dword [ecx + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
mov dword [ebp - 8], eax
je 0x77cffedb
push esi
push ebx
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
sub edi, ebx
mov ebx, dword [ebp - 8]
lea eax, [ebp + 8]
sar edi, 1
push eax
lea esi, [ebx + edi*2]
push ebx
mov word [esi], 0x30
call sym.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x77cffe81
lea eax, [ebp - 4]
push eax
push ebx
mov word [esi], 0x31
call sym.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x77cffe78
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + 1]
xor esi, esi
test eax, eax
jbe 0x77cffe6f
mov edi, dword [ebp - 4]
lea edx, [ecx + 8]
sub edi, ecx
mov ebx, dword [edx]
cmp ebx, dword [edi + edx]
jne 0x77cffe88
inc esi
add edx, 4
cmp esi, eax
jb 0x77cffe60
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, 0xc0000001
jmp 0x77cffec0
sub eax, esi
lea eax, [eax*4 - 4]
push eax
lea eax, [ecx + esi*4 + 0xc]
push eax
lea eax, [ecx + esi*4 + 8]
push eax
call sub.ntdll.dll_memmove
mov eax, dword [ebp + 8]
add esp, 0xc
dec byte [eax + 1]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp - 4]
mov dword [eax], ecx
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
jmp 0x77cffee0
mov eax, 0xc0000017
pop edi
pop esi
pop ebx
leave
ret 8