joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a147268
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [ebp + 0x18]
and al, 2
sub al, 2
neg al
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sbb eax, eax
inc eax
xor ebx, ebx
cmp esi, ebx
mov edi, eax
je 0x7a147293
neg eax
sbb eax, eax
and eax, 0x16
add eax, esi
jmp 0x7a147295
xor eax, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7a1470e0
cmp eax, ebx
mov dword [ebp + 0x18], eax
je 0x7a1473a8
cmp edi, ebx
je 0x7a1473a8
add dword [ebp + 0x18], 0x16
cmp esi, ebx
je 0x7a1473a8
lea eax, [ebp - 0x6c]
mov byte [esi], 0xd7
mov byte [esi + 1], 0xcd
mov byte [esi + 2], 0xc6
mov byte [esi + 3], 0x9a
push eax
mov byte [esi + 4], bl
mov byte [esi + 5], bl
push 0x6c
push dword [ebp + 8]
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
call sub.GDI32.dll_GetEnhMetaFileHeader
test eax, eax
je 0x7a14736a
fild dword [ebp - 0x24]
fidiv dword [ebp - 0x1c]
fmul dword [0x7a0f6750]
fiadd dword [ebp - 0x20]
fidiv dword [ebp - 0x18]
fmul dword [0x7a0f6750]
fmul dword [0x7a0ebf08]
fild dword [ebp - 0x54]
fmul st(1)
call fcn.7a094688
fild dword [ebp - 0x50]
mov byte [esi + 6], al
mov byte [esi + 7], ah
fmul st(1)
call fcn.7a094688
fild dword [ebp - 0x4c]
mov byte [esi + 8], al
mov byte [esi + 9], ah
fmul st(1)
call fcn.7a094688
fild dword [ebp - 0x48]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], ah
fmul st(1)
call fcn.7a094688
fmul dword [0x7a0f6830]
mov byte [esi + 0xc], al
mov byte [esi + 0xd], ah
call fcn.7a094688
mov byte [esi + 0xe], al
mov byte [esi + 0xf], ah
jmp 0x7a14738d
mov byte [esi + 6], bl
mov byte [esi + 7], bl
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], 0xd0
mov byte [esi + 0xb], 7
mov byte [esi + 0xc], 0xd0
mov byte [esi + 0xd], 7
mov byte [esi + 0xe], 0x60
mov byte [esi + 0xf], bl
lea edx, [esi + 0x14]
cmp esi, edx
mov ecx, esi
mov dword [ebp + 8], ebx
mov ax, bx
jae 0x7a1473a5
xor ax, word [ecx]
inc ecx
inc ecx
cmp ecx, edx
jb 0x7a14739c
mov word [ecx], ax
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7a14fe43
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
lea eax, [ebp - 4]
push eax
push 9
xor edi, edi
push edi
push 0x7a1edda0
push 0x80000002
mov dword [0x7a20a838], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7a14ff8a
call fcn.7a097a5a
cmp eax, edi
je 0x7a14fe84
mov eax, dword [eax + 8]
cmp eax, edi
mov dword [ebp - 0x14], eax
jne 0x7a14fe92
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7a14ff8a
push ebx
mov dword [ebp - 0xc], edi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x68]
push eax
push edi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 8], 8
push dword [ebp - 4]
mov dword [ebp - 0x10], 0x20
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp - 0x18], eax
jne 0x7a14ff73
cmp dword [ebp - 8], 6
mov esi, dword [ebp - 0x1e]
mov word [ebp - 0x1e], di
je 0x7a14fef7
cmp dword [ebp - 8], 7
jne 0x7a14ff73
cmp word [ebp - 0x1c], 0x30
jb 0x7a14ff73
cmp word [ebp - 0x1c], 0x36
ja 0x7a14ff73
cmp si, 0x31
jb 0x7a14ff73
cmp si, 0x39
ja 0x7a14ff73
push 0x7a1edd94
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x7a14ff73
cmp dword [ebp - 8], 7
jne 0x7a14ff2f
movzx ecx, word [ebp - 0x1c]
movzx eax, si
lea eax, [eax + eax*4]
lea esi, [ecx + eax*2 - 0x211]
jmp 0x7a14ff35
movzx esi, si
sub esi, 0x31
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x68]
push eax
call fcn.7a099c6a
mov ebx, eax
cmp ebx, edi
je 0x7a14ff73
cmp dword [0x7a20a838], edi
jne 0x7a14ff6b
push 0x40
call fcn.7a09152c
mov edi, eax
test edi, edi
mov dword [0x7a20a838], edi
je 0x7a14ff7f
push 0x10
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
xor edi, edi
mov eax, dword [0x7a20a838]
mov dword [eax + esi*4], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0x18], edi
je 0x7a14fe97
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop edi
leave
ret

Function at 0x7a1508c8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x7a1508f3
xor eax, eax
jmp 0x7a15091d
push edi
mov edi, dword [ebp + 0x10]
push esi
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x7a150913
cmp edi, dword [ebp + 8]
jne 0x7a150913
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x7a15caef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, dword [0x7a20a688]
je 0x7a15cbb8
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, 0x7a1f0fcc
push ebx
push 0x7a1f0fc0
push esi
call edi
test eax, eax
je 0x7a15cbb5
mov ebp, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
push esi
call ebp
test eax, eax
je 0x7a15cbb5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x7a15cbb5
cmp dword [eax], 0x2e435269
jne 0x7a15cbb5
cmp dword [eax + 4], 0
jne 0x7a15cbb5
lea ecx, [eax + 0x10]
push ebx
mov dword [0x7a214010], ecx
mov eax, dword [eax + 0xc]
push 0x7a1f0fb8
push esi
mov dword [0x7a21401c], eax
call edi
test eax, eax
je 0x7a15cbb5
push eax
push esi
call ebp
test eax, eax
je 0x7a15cbb5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x7a15cbbc
cmp dword [eax], 0x2e435269
jne 0x7a15cbbc
cmp dword [eax + 4], 1
jne 0x7a15cbbc
lea ecx, [eax + 0x10]
mov dword [0x7a214014], ecx
mov eax, dword [eax + 0xc]
add eax, ecx
mov dword [0x7a214018], eax
mov eax, dword [esp + 0x14]
mov dword [eax], 0x7a1638bb
mov dword [eax + 4], 0x7a15ca9a
mov dword [eax + 8], 0x7a15cacf
pop edi
pop ebp
pop ebx
pop esi
ret 4
mov dword [0x7a214014], 0x7a214020
jmp 0x7a15cbb5
Function at 0x7a163271
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
movzx esi, byte [eax]
lea ecx, [eax + 1]
movzx eax, byte [ecx]
xor edx, edx
shl esi, 8
push edi
mov edi, dword [0x7a21401c]
inc edx
add esi, eax
cmp edi, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
jb 0x7a16341d
mov eax, dword [0x7a214010]
push ebx
mov ecx, dword [ebp - 8]
add ecx, edi
shr ecx, 1
movzx edx, byte [eax + ecx*8 - 8]
movzx ebx, byte [eax + ecx*8 - 7]
shl edx, 8
add edx, ebx
cmp edx, esi
jae 0x7a1632cb
lea edx, [ecx + 1]
mov dword [ebp - 8], edx
jmp 0x7a1632d0
jbe 0x7a1632d5
lea edi, [ecx - 1]
cmp edi, dword [ebp - 8]
jae 0x7a1632a9
cmp edi, dword [ebp - 8]
jb 0x7a16341c
mov ebx, dword [ebp - 0xc]
lea ecx, [eax + ecx*8]
mov esi, dword [ecx - 4]
mov edi, dword [ecx + 4]
add esi, eax
add edi, eax
mov al, byte [ebx]
mov dword [ebp - 8], 0xffff
mov dword [ebp - 0x10], 1
mov byte [ebp - 1], al
jmp 0x7a163414
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
jae 0x7a16341c
jmp 0x7a163381
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
and al, 0x7f
movzx ax, al
inc ecx
imul eax, ecx
inc dword [ebp - 0x10]
mov dword [ebp - 8], eax
movzx eax, byte [ebp - 1]
inc ebx
cmp dword [eax*4 + 0x7a20db90], 2
mov al, byte [ebx]
mov byte [ebp - 1], al
jl 0x7a163381
test al, al
je 0x7a163387
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
jae 0x7a163387
movzx eax, byte [ebp - 1]
mov eax, dword [eax*4 + 0x7a20db90]
cdq
push 2
pop ecx
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jne 0x7a163381
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, 0xfffffffe
cmp ebx, eax
ja 0x7a163387
cmp byte [ebx + 1], 0xec
je 0x7a163381
cmp ebx, eax
je 0x7a163387
cmp byte [ebx + 2], 0xec
jne 0x7a163387
cmp byte [ebp - 1], 0x7f
ja 0x7a163313
cmp esi, edi
jae 0x7a163407
mov ecx, dword [ebp - 0x10]
push 2
pop edx
mov ax, word [esi]
cmp cx, ax
je 0x7a1633b6
jb 0x7a163407
cmp esi, edi
jae 0x7a163407
cmp al, 2
jne 0x7a1633a7
add esi, edx
jmp 0x7a1633b0
add esi, edx
movzx eax, word [esi]
lea esi, [esi + eax*2 + 2]
cmp esi, edi
jb 0x7a163391
jmp 0x7a163407
add esi, edx
cmp cx, dx
jne 0x7a1633c8
push edx
push dword [ebp + 0xc]
call fcn.7a162708
jmp 0x7a163407
xor eax, eax
mov ax, word [esi]
add esi, edx
test ax, ax
mov dword [ebp - 0xc], eax
jbe 0x7a163407
mov ax, word [esi]
cmp word [ebp - 8], ax
je 0x7a1633f4
jbe 0x7a163400
add dword [ebp - 0xc], 0xffff
inc esi
inc esi
cmp word [ebp - 0xc], 0
ja 0x7a1633d7
jmp 0x7a163407
movzx eax, cx
push eax
push dword [ebp + 0xc]
call fcn.7a162708
movzx eax, word [ebp - 0xc]
lea esi, [esi + eax*2]
cmp byte [ebp - 1], 0x80
jb 0x7a16341c
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
ja 0x7a16341c
cmp esi, edi
jb 0x7a163306
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x7a1691c1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7a20a83c]
push esi
xor esi, esi
cmp eax, esi
jne 0x7a16920c
push 0x48
call fcn.7a09152c
cmp eax, esi
je 0x7a1691e7
mov ecx, eax
call fcn.7a16906f
jmp 0x7a1691e9
xor eax, eax
cmp eax, esi
mov dword [0x7a20a83c], eax
je 0x7a1691ff
cmp dword [eax], esi
je 0x7a16920c
push 1
mov ecx, eax
call fcn.7a12f6f5
mov dword [0x7a20a83c], esi
xor eax, eax
jmp 0x7a1692b4
push ebx
push edi
mov edi, dword [ebp + 8]
movzx ebx, di
mov ecx, ebx
sar ecx, 0x10
mov eax, dword [eax + ecx*4 + 4]
movzx edx, bh
mov eax, dword [eax + edx*4]
mov ecx, ebx
and ecx, 0xff
movzx eax, byte [eax + ecx]
sub eax, esi
je 0x7a169268
dec eax
je 0x7a16923d
sub eax, 0xfe
jmp 0x7a1692b0
mov esi, 0x3ff
and di, si
cmp di, 0x78
ja 0x7a1692b0
and ebx, esi
mov ebx, dword [ebx*4 + 0x7a1f4d50]
lea eax, [ebx + ebx*4]
mov ax, word [eax*4 + 0x7a1ede38]
neg ax
sbb eax, eax
and eax, ebx
jmp 0x7a1692b2
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x7a16929c
cmp dword [0x7a20a03c], esi
je 0x7a1692b9
push 0x14
lea eax, [ebp - 0x28]
push eax
push 0x13
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jbe 0x7a16929c
cmp word [ebp - 0x26], 0x31
jne 0x7a169388
mov ecx, dword [0x7a20a83c]
lea eax, [ebp + 0xb]
push eax
push ebx
or byte [ebp + 0xb], 0xff
call fcn.7a169108
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 4
mov eax, 0xc01
cmp ebx, eax
ja 0x7a169339
je 0x7a169388
cmp ebx, 0x447
ja 0x7a169305
cmp ebx, 0x446
jae 0x7a169388
mov eax, ebx
sub eax, 0x401
je 0x7a169388
sub eax, 0x1d
je 0x7a169388
dec eax
dec eax
je 0x7a169388
sub eax, 9
je 0x7a169388
jmp 0x7a16929c
cmp ebx, 0x44a
jb 0x7a16929c
cmp ebx, 0x44b
jbe 0x7a169388
cmp ebx, 0x44d
jbe 0x7a16929c
cmp ebx, 0x44f
jbe 0x7a169388
cmp ebx, 0x457
je 0x7a169388
cmp ebx, 0x801
jmp 0x7a1692fd
mov eax, 0x3001
cmp ebx, eax
ja 0x7a169364
je 0x7a169388
cmp ebx, 0x2001
je 0x7a169388
cmp ebx, 0x2401
je 0x7a169388
cmp ebx, 0x2801
je 0x7a169388
cmp ebx, 0x2c01
jmp 0x7a1692fd
cmp ebx, 0x3401
je 0x7a169388
cmp ebx, 0x3801
je 0x7a169388
cmp ebx, 0x3c01
je 0x7a169388
cmp ebx, 0x4001
jne 0x7a16929c
mov ecx, dword [0x7a20a83c]
mov esi, 0x3ff
lea eax, [ebp + 0xb]
and di, si
cmp di, 0x78
push eax
push ebx
ja 0x7a1692a7
mov byte [ebp + 0xb], 1
call fcn.7a169108
jmp 0x7a16924b

Function at 0x7a16f784
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push edi
xor edi, edi
cmp dword [0x7a20a118], edi
lea eax, [ebp - 0xc]
push eax
push edi
push edi
lea eax, [ebp - 4]
push edi
mov dword [ebp - 4], 0x104
push eax
je 0x7a16f7bb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x7a16f7f0
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, edi
jne 0x7a16f7f0
push 0x104
push dword [ebp + 0x10]
lea eax, [ebp - 0x110]
push eax
call fcn.7a12b44b
neg eax
sbb eax, eax
and eax, 0xfffffff3
add eax, 0xd
pop edi
leave
ret 0xc
Function at 0x7a16f857
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [0x7a20a118], 0
push dword [ebp + 0xc]
je 0x7a16f877
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x7a16f8a2
lea ecx, [ebp - 0x10c]
call fcn.7a0afae6
cmp dword [ebp - 0x10c], 0x55464131
jne 0x7a16f89f
push dword [ebp - 0x108]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x7a16f8a2
push 0xd
pop eax
leave
ret 8

Function at 0x7a16f8a6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
cmp dword [0x7a20a118], 0
je 0x7a16f8da
push dword [ebp + 0x10]
call fcn.7a0963ee
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x7a16f93d
push dword [ebp + 0xc]
lea ecx, [ebp - 0x218]
call fcn.7a0afae6
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10c]
call fcn.7a0afae6
mov eax, 0x55464131
cmp dword [ebp - 0x218], eax
jne 0x7a16f93a
cmp dword [ebp - 0x10c], eax
jne 0x7a16f93a
mov eax, dword [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7a16f914
sub eax, edx
inc eax
push eax
push dword [ebp - 0x108]
push 1
push 0
push dword [ebp - 0x214]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x7a16f93d
push 0xd
pop eax
leave
ret 0xc

Function at 0x7a16f941
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [0x7a20a118], 0
je 0x7a16f96b
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x7a16f9a3
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10c]
call fcn.7a0afae6
cmp dword [ebp - 0x10c], 0x55464131
jne 0x7a16f9a0
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp - 0x108]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x7a16f9a3
push 0xd
pop eax
leave
ret 0xc

Function at 0x7a16f9a7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [0x7a20a118], 0
je 0x7a16f9d1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x7a16fa09
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10c]
call fcn.7a0afae6
cmp dword [ebp - 0x10c], 0x55464131
jne 0x7a16fa06
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push 0
push dword [ebp - 0x108]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x7a16fa09
push 0xd
pop eax
leave
ret 0x10
Function at 0x7a16fa0d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
cmp dword [0x7a20a118], 0
mov dword [ebp - 4], 4
je 0x7a16fa41
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x7a16fa77
push dword [ebp + 0xc]
lea ecx, [ebp - 0x110]
call fcn.7a0afae6
cmp dword [ebp - 0x110], 0x55464131
jne 0x7a16fa87
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp - 0x10c]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7a16fa8a
cmp dword [ebp + 0xc], 4
jne 0x7a16fa87
cmp dword [ebp - 4], 4
je 0x7a16fa8a
push 0xd
pop eax
leave
ret 0xc

Function at 0x7a16fa8e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [0x7a20a118], 0
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp + 0x14], edi
je 0x7a16fac2
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x7a16faf8
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10c]
call fcn.7a0afae6
cmp dword [ebp - 0x10c], 0x55464131
jne 0x7a16fb07
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp - 0x108]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7a16fb0a
cmp dword [ebp + 0xc], 3
jne 0x7a16fb07
cmp dword [ebp + 0x14], edi
je 0x7a16fb0a
push 0xd
pop eax
pop edi
leave
ret 0x10

Function at 0x7a17011a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push edi
mov ebp, 0x7a20a0fc
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x7a21404c]
cmp eax, 1
jne 0x7a170139
xor edi, edi
jmp 0x7a170212
push 2
pop ecx
cmp eax, ecx
mov edi, 0x80004005
je 0x7a170212
push ebx
push 0x7a1f52e4
mov dword [0x7a21404c], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
cmp eax, ebx
mov dword [0x7a214050], eax
je 0x7a170211
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x7a1f52d0
push eax
call esi
push 0x7a1f52bc
push dword [0x7a214050]
mov dword [0x7a214054], eax
call esi
push 0x7a1f52a0
push dword [0x7a214050]
mov dword [0x7a214058], eax
call esi
push 0x7a1f528c
push dword [0x7a214050]
mov dword [0x7a214060], eax
call esi
push 0x7a1f5278
push dword [0x7a214050]
mov dword [0x7a214068], eax
call esi
push 0x7a1f5260
push dword [0x7a214050]
mov dword [0x7a21405c], eax
call esi
cmp dword [0x7a214054], ebx
mov dword [0x7a214064], eax
pop esi
je 0x7a170211
cmp dword [0x7a214058], ebx
je 0x7a170211
cmp dword [0x7a21405c], ebx
je 0x7a170211
cmp dword [0x7a214060], ebx
je 0x7a170211
cmp eax, ebx
je 0x7a170211
cmp dword [0x7a214068], ebx
je 0x7a170211
mov dword [0x7a21404c], 1
xor edi, edi
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop ebp
ret
Function at 0x7a184a5c
Capabilities:
Terminate process

Disassembly:
push 0x7a1f55b0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x7a184a81
push 0x7a1f55a0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x7a184a81
push dword [esp + 4]
call eax
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x7a184a9c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x7a20e668]
je 0x7a184abc
inc eax
cmp eax, 0x12
jb 0x7a184aad
shl eax, 3
cmp edx, dword [eax + 0x7a20e668]
mov dword [ebp + 8], eax
jne 0x7a184c5a
mov ecx, dword [0x7a21406c]
cmp ecx, 1
je 0x7a184c2f
test ecx, ecx
jne 0x7a184aee
cmp dword [0x7a214070], 1
je 0x7a184c2f
cmp edx, 0xfc
je 0x7a184c5a
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7a184b29
push 5
pop ecx
mov esi, 0x7a1f5a9c
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7a184b38
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x7a184b70
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7a184b50
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x7a1f5a98
push ebx
call fcn.7a0f7d44
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7a184b75
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x7a20e66c]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x7a184b8c
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.7a0dfae3
mov edx, esp
push 6
pop ecx
mov esi, 0x7a1f5a7c
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7a184bb8
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x7a184bc4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x7a184bdd
mov eax, dword [ebp + 8]
mov esi, 0x7a1f5a78
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x7a20e66c]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7a184bf8
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x7a184c04
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x7a1f5a50
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.7a18591d
add esp, 0xc
jmp 0x7a184c5a
mov ecx, dword [eax + 0x7a20e66c]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x7a184c3a
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7a18591d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x7a214090], ebx
push esi
push edi
jne 0x7a18599d
push 0x7a0f33b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x7a1859d8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x7a1f5b14
push edi
call esi
test eax, eax
mov dword [0x7a214090], eax
je 0x7a1859d8
push 0x7a1f5b04
push edi
call esi
push 0x7a1f5af0
push edi
mov dword [0x7a214094], eax
call esi
cmp dword [0x7a20b1bc], 2
mov dword [0x7a214098], eax
jne 0x7a18599d
push 0x7a1f5ad4
push edi
call esi
test eax, eax
mov dword [0x7a2140a0], eax
je 0x7a18599d
push 0x7a1f5abc
push edi
call esi
mov dword [0x7a21409c], eax
mov eax, dword [0x7a21409c]
test eax, eax
je 0x7a1859e2
call eax
test eax, eax
je 0x7a1859c9
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x7a2140a0]
test eax, eax
je 0x7a1859c9
test byte [ebp - 8], 1
jne 0x7a1859e2
cmp dword [0x7a20b1c8], 4
jb 0x7a1859dc
or byte [ebp + 0x12], 0x20
jmp 0x7a185a01
xor eax, eax
jmp 0x7a185a11
or byte [ebp + 0x12], 4
jmp 0x7a185a01
mov eax, dword [0x7a214094]
test eax, eax
je 0x7a185a01
call eax
mov ebx, eax
test ebx, ebx
je 0x7a185a01
mov eax, dword [0x7a214098]
test eax, eax
je 0x7a185a01
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x7a214090]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x7a186b13
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.7a0dfae3
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x7a186ba8
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x7a20b1bc]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x7a186ba8
cmp eax, 1
je 0x7a186bc0
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x7a186ba8
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x7a186b7d
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x7a186ba4
xor eax, eax
inc eax
jmp 0x7a186bdc
cmp esi, ebx
jae 0x7a186bac
xor eax, eax
jmp 0x7a186bdc
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x7a20b1bc]
jmp 0x7a186bc2
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret