joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c80f253
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x7c8856cc]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp eax, edi
je 0x7c81ebf9
push 9
push 0x210
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x654]
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, edi
jl 0x7c81ebf9
mov eax, dword [ebp - 0x214]
shr eax, 1
cmp word [ebp + eax*2 - 0x212], 0x5c
jne 0x7c81ebf9
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.7c8097aa
leave
ret 8
cmp esi, edi
je 0x7c80f2b6
add word [esi], 0xfffe
lea eax, [ebp - 0x64c]
push eax
push 1
lea eax, [ebp - 0x628]
push eax
mov dword [ebp - 0x64c], 0x18
mov dword [ebp - 0x648], edi
mov dword [ebp - 0x640], 0x40
mov dword [ebp - 0x644], esi
mov dword [ebp - 0x63c], edi
mov dword [ebp - 0x638], edi
call dword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
add word [esi], 2
cmp eax, edi
jl 0x7c80f2b6
lea eax, [ebp - 0x624]
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x630]
push eax
push dword [ebp - 0x628]
mov word [ebp - 0x630], di
mov word [ebp - 0x62e], 0x410
mov dword [ebp - 0x634], edi
call dword [sym.imp.ntdll.dll_NtQuerySymbolicLinkObject]
push dword [ebp - 0x628]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp esi, edi
jge 0x7c80f2b3
jmp 0x7c80f2b6
Function at 0x7c8102ec
Capabilities:
Access pe header
Get process heap flags

Disassembly:
cmp eax, ecx
jb 0x7c81034c
lea ecx, [eax + 0xfffff]
and ecx, edi
mov dword [ebp + 0x10], ecx
jmp 0x7c81034c
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x54]
mov eax, dword [eax + 4]
mov dword [0x7c88503c], eax
push dword [ecx + 8]
mov esi, dword [eax + 0x12c]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x7c83ab1b
mov ecx, dword [ebp + 0x10]
test ecx, ecx
mov edx, dword [eax + 0x64]
jne 0x7c810339
mov ecx, dword [eax + 0x60]
mov dword [ebp + 0x10], ecx
mov eax, dword [ebp + 0xc]
test eax, eax
push edi
mov edi, 0xfff00000
jne 0x7c80afd2
mov eax, edx
lea eax, [esi + eax - 1]
lea edx, [esi - 1]
not edx
and eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [0x7c88503c]
mov eax, dword [eax + 0x13c]
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
mov dword [ebp + 0x10], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x208]
test ecx, ecx
mov eax, dword [ebp + 0xc]
jne 0x7c83ab25
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
jae 0x7c81a83c
lea eax, [esi + eax - 1]
and eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [0x7c88503c]
mov eax, dword [eax + 0x13c]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
lea ecx, [eax + ecx - 1]
dec eax
push 4
not eax
and ecx, eax
push 0x2000
lea eax, [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp + 0x10], ecx
call ebx
test eax, eax
jl 0x7c810467
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
and dword [edi], 0
and dword [edi + 4], 0
mov dword [edi + 0x10], ecx
add ecx, eax
mov dword [edi + 8], ecx
mov ecx, eax
sub ecx, dword [ebp + 0xc]
add dword [ebp - 4], ecx
cmp eax, dword [ebp + 0xc]
jbe 0x7c81a84c
sub dword [ebp - 4], esi
add dword [ebp + 0xc], esi
mov byte [ebp + 0x17], 1
push 4
push 0x1000
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call ebx
mov ebx, eax
test ebx, ebx
jl 0x7c83ab34
cmp byte [ebp + 0x17], 0
mov eax, dword [ebp - 4]
mov dword [edi + 0xc], eax
je 0x7c810465
lea eax, [ebp - 0xc]
push eax
push 0x104
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
jl 0x7c810467
mov eax, dword [ebp - 8]
add dword [edi + 0xc], eax
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0x10
lea ecx, [eax + 0xfffff]
and ecx, edi
mov dword [ebp + 0x10], ecx
jmp 0x7c810396
mov byte [ebp + 0x17], 0
jmp 0x7c810412
inc eax
dec ebp
in al, 0xc7
lea esi, [edi + 0x35]
xchg ebp, eax
cmp eax, 0x180f9847
stosd dword es:[edi], eax
fsubp st(3)
or eax, dword [eax]
cwde
nop dword [ebx + 0xbebde]
sub eax, 0xcc7b25ae
mov eax, dword [0xcaa5aef9]
aaa
das
invalid
scasb al, byte es:[edi]
movsd dword es:[edi], dword [esi]
retf 0x2f37
Function at 0x7c8104fc
Capabilities:
Create thread
Resume thread

Disassembly:
push 0x410
push 0x7c8106d8
call fcn.7c8024d6
mov eax, dword [0x7c8856cc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x3bc], ecx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c8], eax
xor edx, edx
mov dword [ebp - 0x3b8], edx
xor eax, eax
lea edi, [ebp - 0x3b4]
stosd dword es:[edi], eax
lea eax, [ebp - 0x3e0]
push eax
test byte [ebp + 0x1e], 1
jne 0x7c83abde
push edx
push dword [ebp + 0x10]
push ecx
call fcn.7c8102ec
test eax, eax
jl 0x7c83abe7
xor edi, edi
inc edi
push edi
push dword [ebp - 0x3d8]
push ebx
push dword [ebp - 0x3cc]
lea eax, [ebp - 0x3a8]
push eax
call fcn.7c810473
xor ebx, ebx
push ebx
push esi
lea eax, [ebp - 0x420]
push eax
call fcn.7c809398
push edi
lea ecx, [ebp - 0x3e0]
push ecx
lea ecx, [ebp - 0x3a8]
push ecx
lea ecx, [ebp - 0x3c4]
push ecx
mov esi, dword [ebp - 0x3bc]
push esi
push eax
push 0x1f03ff
lea eax, [ebp - 0x3b0]
push eax
call dword [sym.imp.ntdll.dll_NtCreateThread]
mov dword [ebp - 0x3ac], eax
cmp eax, ebx
jl 0x7c83abea
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
jne 0x7c81062e
push ebx
push 0x1c
lea eax, [ebp - 0x408]
push eax
push ebx
push dword [ebp - 0x3b0]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov dword [ebp - 0x3ac], eax
cmp eax, ebx
jl 0x7c83ac0a
push ebx
push 8
lea eax, [ebp - 0x3b8]
push eax
push edi
push ebx
push ebx
push edi
call dword [sym.imp.ntdll.dll_RtlQueryInformationActivationContext]
mov dword [ebp - 0x3ac], eax
cmp eax, ebx
jl 0x7c83ac22
cmp dword [ebp - 0x3b8], ebx
jne 0x7c835329
cmp byte [0x7c885008], 0
jne 0x7c82a82a
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xac], eax
push 0xc
push 0x10001
push ebx
lea eax, [ebp - 0xdc]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], ebx
jl 0x7c83ac73
mov eax, dword [ebp - 0x3c8]
cmp eax, ebx
je 0x7c81069e
mov ecx, dword [ebp - 0x3c0]
mov dword [eax], ecx
test byte [ebp + 0x1c], 4
jne 0x7c8106b7
lea eax, [ebp - 0x3e4]
push eax
push dword [ebp - 0x3b0]
call dword [sym.imp.ntdll.dll_NtResumeThread]
or dword [ebp - 4], 0xffffffff
call int.7c8106e9
mov eax, dword [ebp - 0x3b0]
mov ecx, dword [ebp - 0x1c]
call fcn.7c8097aa
call fcn.7c802511
ret 0x1c
cmp esi, 0xffffffff
je 0x7c810680
jmp 0x7c83ac3c
xlatb
fisttp dword [edx + 0x50]
cli
aad 0x2e
shl dh, 0x30
inc ebx
dec edi
pop esp
ljmp 0xfd89
jle 0x7c8352f4
test dword [esi + 0x5c], 0xbc7edb5a
push 0x1e
add ah, byte [edx + 0x1c06eb0e]
dec ebp
mov ebx, 0xdcb3bb89
jl 0x7c835369
pop esp
int3
adc dh, 0xf7
mov edi, 0xb23f7ec8
mov bh, dh
cmp ebx, eax
invalid
invalid
je 0x7c835336
Function at 0x7c810975
Capabilities:
Access pe header

Disassembly:
push 0x50
push 0x7c8109e0
call fcn.7c8024d6
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
jne 0x7c84218b
mov eax, dword fs:[0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x34], eax
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov dword [ebp - 0x38], eax
cmp eax, esi
je 0x7c842258
mov cx, word [eax + 0x48]
mov word [ebp - 0x26], cx
mov ax, word [eax + 0x4a]
mov word [ebp - 0x28], ax
or dword [ebp - 4], 0xffffffff
call fcn.7c8109f1
mov eax, dword [ebp - 0x28]
call fcn.7c802511
ret 4
fstp st(7)
stosd dword es:[edi], eax
pop edx
xor al, 0xf0
wait
mov eax, 0xb22d2450
and al, 0xcc
mov esi, 0x5cbd4f7e
fisttp dword [eax + 0x3a]
inc ebx
adc al, 0xeb
xlatb
push 0x2676466b
enter 0x6efd, 0xffffffffffffff86
cdq
loope 0x7c84222f
shl dword [eax - 0x61d7890], 1
Function at 0x7c810c89
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov eax, dword fs:[0x18]
cmp dword [ebp + 8], 0xfffffff4
mov eax, dword [eax + 0x30]
je 0x7c810ccc
cmp dword [ebp + 8], 0xfffffff5
jne 0x7c810cba
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x1c]
cmp esi, 0xffffffff
je 0x7c839d5d
mov eax, esi
pop esi
pop ebp
ret 4
cmp dword [ebp + 8], 0xfffffff6
jne 0x7c839d5a
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x18]
jmp 0x7c810caa
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x20]
jmp 0x7c810caa
adc dword [eax + 0x4084cda3], ecx
pop edx
push edi
lds esi, [edi + esi*4]
test byte [esp + edi], ah
rol byte [ebp + 0x41], 1
xchg edi, eax
sbb al, 0x64
shr byte [ebx - 0x3c089ef9], cl
inc eax
mov dh, 0x84
cdq
push 0x2fef45c4
and dword [eax], ebp
leave
jle 0x7c839cca
inc esi
pop edx
pop ebp
adc eax, 0xb0d4bdbd
imul edi, dword [esi - 0x2c], 0x5b
dec esi
add cl, byte [ecx - 0x6f]
inc edi
and al, 0x57
push ebp
jno 0x7c839da1
leave
sub byte [esi - 0x6a000084], cl
inc edi
mov dl, al
leave
dec esp
lodsd eax, dword [esi]
jmp dword [ecx - 0x73dbae20]
xchg dword gs:[edx], esi
jg 0x7c839cff
mov al, byte [0xb4ef46dc]
jns 0x7c839d5e
fadd qword [esi - 0x11]
mov ah, 0x26
jns 0x7c839d5e
jl 0x7c839ddd
add ch, byte [ebp + 0x6ad15d86]
pop ebx
xor al, 0x60
push edi
xor al, 0xca
lea edx, [esi]
mov dl, 0xff
ficom word [ebp + edi*8 + 5]
sbb eax, 0x51404e72
dec ebx
xlatb
call [ebp - 0x7eba9661]
cmc
rcr esp, 0x2d
adc byte [edx - 0x46], al
push eax
push ss
dec esp
invalid
call 0x23995f09
mov ss, ecx
and dword [edi], ebx
jne 0x7c839db6
aaa
and bl, al
popfd
add bh, byte [0xd5038551]
add edx, ebp
out 0x90, al
add al, cl
add ah, al
into
jbe 0x7c839e37
adc eax, 0x8fc6d554
push es
test dword [ecx - 0x4d], esp
imul esi, dword [ebx], 0xffffff9a
adc byte [ecx], ch
cwde
wait
inc eax
dec ebp
push ds
hlt
fcom qword [ebx + 0x5c738b7]
and dword [esp + esi*2], 0x11
add byte [esp + eax*4 + 0x71785114], bh
adc cl, byte [edx + 0x2e88e092]
and eax, 0xf4a0984a
sahf
add eax, 0x2ebbaa7c
fcomi st(4)
cmc
jle 0x7c839e1d
hlt
inc esi
ret
adc byte [ebx - 0x59], ah
cmp byte [edi], 0x54
pop eax
push 0x5f
fcmovnbe st(0), st(2)
test al, 0xd5
adc dword [ebp - 0x373777ea], edi
int1
push cs
int 0x95
mov dl, 0x73
add dword [edx + ebx - 0x43], edx
popal
mov edi, 0x1c60892
movsd dword es:[edi], dword [esi]
xor eax, 0xa96fec7d
and eax, ecx
test al, 0x60
cmp bh, byte [0x4d99d934]
aas
or dword [edx + 0x461bb0d1], edx
add byte [ecx + 0x58292468], cl
mov dl, 0x2c
loope 0x7c839ea4
rcr byte [edi - 0x13c0fae], 0xf4
fild word [ecx + 0x43]
movsb byte es:[edi], byte [esi]
iretd
mov bl, ch
dec ebp
sbb edi, dword [ebp - 9]
sbb eax, dword [ebx]
Function at 0x7c810f81
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push 5
push 0x18
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x7c83cd8b
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
xor eax, eax
inc eax
leave
ret 8
cmp bl, ah
mov al, 0x82
jmp 0x8bc33f68

Function at 0x7c811106
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
and eax, 0x10000003
cmp eax, 3
je 0x7c83cc6d
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
push esi
push edi
jne 0x7c8111cf
mov eax, dword [ebp + 0xc]
cdq
mov esi, eax
mov edi, edx
mov eax, dword [ebp + 0x14]
sub eax, 0
je 0x7c8111c8
dec eax
jne 0x7c82f998
push 0xe
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x7c83cc8e
add dword [ebp - 8], esi
mov eax, dword [ebp - 4]
adc eax, edi
test eax, eax
mov dword [ebp - 4], eax
jg 0x7c811184
jl 0x7c83cc96
cmp dword [ebp - 8], 0
jb 0x7c83cc96
test ebx, ebx
jne 0x7c811193
test eax, 0x7fffffff
jne 0x7c83cc7f
push 0xe
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jl 0x7c83cca9
test ebx, ebx
jne 0x7c8111d9
cmp dword [ebp - 8], 0xffffffff
je 0x7c83cc9d
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov dword [ebp - 8], esi
mov eax, edi
jmp 0x7c81116d
mov edi, dword [ebx]
mov esi, dword [ebp + 0xc]
jmp 0x7c811135
mov eax, dword [ebp - 4]
mov dword [ebx], eax
jmp 0x7c8111b4
dec eax
jne 0x7c83cc7f
push 5
push 0x18
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x7c83cc8e
mov eax, dword [ebp - 0x20]
add eax, esi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
jmp 0x7c81116b
insb byte es:[edi], dx
invalid
cmp edi, ecx
mov es, word [ebp + 0x4accad85]
int1
xor dword [0xccae97dd], esp
push edx
mov al, 3
push esp
push edx
inc edx
jne 0x7c83cc16
iretd
mov dh, 0xf6
xor dword [edi], 0x2c
add eax, 0x7787235e
pop ecx
sub bh, byte [esp + edi*4]
xchg dword [ebx + 0x74], ebp
ja 0x7c83cce2
inc ebp
bndstx [edi + 0x27854b06], bnd2
insd dword es:[edi], dx
and al, 0x2a
add dword [eax + 0x63], esi
jo 0x7c83ccf3
push ebx
sar byte [0xea75c1c8], 0x35
jo 0x7c83cc6e
ljmp 0xb97a:0xacd47035
lodsb al, byte [esi]
jp 0x7c83cc56
xlatb
sub eax, 0xd282cd4a
dec ecx
salc
pop edx
stosd dword es:[edi], eax
ret 0xd7ed
xlatb
mov edi, 0x9b002989
cmp al, al
pop edi
jmp 0x7c83ccaf
sti
cmc
iretd
jg 0x7c83ccb3
je 0x7c83cd61
sbb eax, 0x5b9b202f
hlt
jle 0x7c83ccea
arpl word [ecx + 0x47115a89], dx
Function at 0x7c8111e5
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x7c8856cc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, ebx
and eax, 0x10000003
cmp eax, 3
push edi
mov edi, dword [ebp + 0xc]
je 0x7c83cce4
push esi
push 1
push 0x18
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xc0]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov esi, 0xc0000000
mov ecx, eax
and ecx, esi
cmp ecx, esi
je 0x7c8112ef
mov eax, dword [ebp - 0x7c]
push 0x12
mov dword [ebp - 0x9c], eax
push 0x68
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xc0]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
and ecx, esi
cmp ecx, esi
je 0x7c8112ef
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x88], eax
push 0xd
pop ecx
lea esi, [ebp - 0xb8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.7c8097aa
leave
ret 8
push eax
call fcn.7c809419
jmp 0x7c83ccf5
pop es
inc esp
pop ds
ret 0x745f
adc eax, 0xc879c37b
cdq
push 0x630c8aea
neg byte [edx]
push esp
call [ebx + 0x4777212]
fstp dword [esi - 0x24]
pmuludq mm0, qword [eax - 0x495c7e9a]
push edi
adc eax, 0x40d1e8c8
wait
Function at 0x7c8112ff
Capabilities:
Write file on windows

Disassembly:
push 0x18
push 0x7c811398
call fcn.7c8024d6
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
cmp ebx, ecx
je 0x7c811316
mov dword [ebx], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [ebp + 8]
cmp edi, 0xfffffff4
je 0x7c82cf6e
cmp edi, 0xfffffff5
je 0x7c82cf63
cmp edi, 0xfffffff6
je 0x7c83cbfe
mov eax, edi
and eax, 0x10000003
cmp eax, 3
je 0x7c81c109
mov esi, dword [ebp + 0x18]
push ecx
cmp esi, ecx
jne 0x7c82d8a4
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
push ecx
push ecx
push ecx
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
je 0x7c83cc34
test eax, eax
jl 0x7c82cf4a
mov eax, dword [ebp - 0x1c]
mov dword [ebx], eax
xor eax, eax
inc eax
call fcn.7c802511
ret 0x14
push dword [ebp + 0x18]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call sym.KERNEL32.dll_WriteConsoleA
jmp 0x7c811389
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x7c811386
jmp 0x7c83cc09
mov ecx, eax
and ecx, 0xc0000000
cmp ecx, 0x80000000
jne 0x7c82d8f1
jmp 0x7c83cc4f
mov eax, dword [eax + 0x10]
mov edi, dword [eax + 0x1c]
jmp 0x7c81133d
mov eax, dword [eax + 0x10]
mov edi, dword [eax + 0x20]
jmp 0x7c81133d
mov ebx, 0x103
mov dword [esi], ebx
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x10]
lea edx, [ebp - 0x28]
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
not edx
and edx, esi
push edx
push ecx
push eax
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov edx, eax
mov ecx, 0xc0000000
and edx, ecx
cmp edx, ecx
je 0x7c82d8f1
cmp eax, ebx
jne 0x7c82cdf0
push eax
call fcn.7c809419
xor eax, eax
jmp 0x7c811389
sti
xchg ecx, eax
sbb dword [edi], edx
invalid

Function at 0x7c8113c9
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, dword fs:[0x18]
mov ebx, dword [ebp + 8]
cmp ebx, 0xfffffff4
mov eax, dword [eax + 0x30]
je 0x7c831f26
cmp ebx, 0xfffffff5
je 0x7c831f1b
cmp ebx, 0xfffffff6
je 0x7c83ce08
mov eax, ebx
and eax, 0x10000003
cmp eax, 3
jne 0x7c811417
push ebx
call sym.KERNEL32.dll_VerifyConsoleIoHandle
test eax, eax
je 0x7c811417
push 2
pop eax
pop ebx
leave
ret 4
test ebx, ebx
je 0x7c831f0a
test bl, 1
jne 0x7c831f0a
push 4
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
jl 0x7c83ce13
mov eax, dword [ebp - 8]
cmp eax, 0x16
ja 0x7c831f31
cmp eax, 0x15
jae 0x7c81140f
cmp eax, 2
jb 0x7c831f3f
cmp eax, 8
ja 0x7c81ccda
xor eax, eax
inc eax
jmp 0x7c811412
cmp eax, 0xb
je 0x7c81140f
cmp eax, 0xf
je 0x7c81140f
cmp eax, 0x11
jne 0x7c831f3f
push 3
jmp 0x7c811411
cmpsd dword [esi], dword es:[edi]
cdq
mov eax, dword [0xb0db]
add eax, 0xf80b3ca3
fild qword [ecx]
cmp al, byte [eax]
leave
add al, 0xef
xor byte [esi + 0x43], 7
mov ah, 0x63
pop es
inc esp
clc
daa
lock dec dword [ebp - 0x7e]
invalid
inc esp
mov dl, 0x26
inc ebx
xor dl, ah
invalid
Function at 0x7c81166d
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
cmp dword [ebp + 0xc], 1
push esi
push edi
jge 0x7c82b014
xor esi, esi
cmp dword [ebp + 0xc], esi
jl 0x7c82b014
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7c82b008
mov eax, dword [ebp - 0x14]
cmp ax, si
push ebx
mov ebx, dword [ebp - 4]
jne 0x7c836aed
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ntdll.dll_NtQueryFullAttributesFile]
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp edi, esi
pop ebx
jge 0x7c811710
push edi
call fcn.7c809419
xor eax, eax
pop edi
pop esi
leave
ret 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x64]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x60]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x5c]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x58]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x54]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 0x50]
mov dword [eax + 0x18], ecx
mov ecx, dword [ebp - 0x38]
mov dword [eax + 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 0x20], ecx
xor eax, eax
inc eax
jmp 0x7c81170a
push 3
call fcn.7c80935e
jmp 0x7c811708
push 0x57
jmp 0x7c82b00a
adc bl, byte [ecx + 0x1ca7f3c9]
outsb dx, byte [esi]
sub edi, dword [eax + 0x2e7b56dc]
shl dword [edi + 0x62], 1
cmp al, 0x4f
mov ecx, 0xd637989b
dec ebx
ficomp dword [esi + ebx]
xchg ebp, eax
mov eax, dword [0x353cf4eb]
stosb byte es:[edi], al
out 0x1b, al
dec esi
push ebp
dec eax
mov ch, 0x79
cmp esi, edx
or al, 0xef
or al, 0xef
sub al, byte [edi + 0x39]
xchg edi, eax
lds edx, [ebx]
push esi
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
loop 0x7c836ab0
outsb dx, byte [esi]
pop ebx
dec esp
iretd
inc esp
sub eax, 0x1718ea65
push ebp
jae 0x7c836a85
ljmp 0x3766:0x8eb3a881
Function at 0x7c812c17
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push 0x110004
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtFsControlFile]
cmp eax, 0x103
je 0x7c8410db
cmp eax, esi
jl 0x7c8410f2
xor eax, eax
inc eax
pop esi
leave
ret 4
cmpsd dword [esi], dword es:[edi]
inc ebx
invalid
sub dword [esi - 0x12], edx
push esi
out dx, al
into
inc ecx
movsd dword es:[edi], dword [esi]
sbb ecx, 0x2a9c765a
out 0x3b, al
inc ebx
or esp, eax
loop 0x7c84108f
jecxz 0x7c841034
jp 0x7c84108e
jne 0x7c8410df
invalid
mov edi, 0xf73802fa
movsb byte es:[edi], byte [esi]
sbb eax, 0xd2f69fa4
xchg dword [eax], ecx
pop edx
cmp dword [ebp - 0x6b], ebx
pop ebp
xchg ebp, eax
mov esi, dword [ecx - 0x1f]
movsb byte es:[edi], byte [esi]
sbb eax, 0x3df7d23f
je 0x7c841128
pop esi
sub ebp, edx
or ebx, dword [ebp - 0x15]
adc byte [ebx + 0x1b], ch
sbb esp, ecx
sub eax, 0x841de0e1
sub byte [ecx + 0x3f], 0x49
cmp ecx, dword [eax]
cmc
out dx, al
js 0x7c84109c
mov esi, 0x7bb27b11
popal
test al, 0xee
mov esp, esp
cmpsd dword [esi], dword es:[edi]
mov dh, 0x26
sub esi, dword [esi - 0x2e]
jns 0x7c8410d0
fbld tbyte [eax]
sbb al, ah
mov ecx, esi
invalid
xchg ebp, edi
stc
sbb eax, 0x3fa2ce14
mov dh, 0x4a
mov ebx, 0x95c109ad
sbb eax, 0x5ce46cf
dec eax
pop ds
pop ebx
adc ebx, dword [esi + 0x570672d0]
xor ecx, dword [ecx + ebx*2]
cld
lodsd eax, dword [esi]
jne 0x7c841133
adc byte [edi - 0x1a397ab3], 9
mov dh, byte [ebp + 0x18]
mov edx, 0x9b00aa0
das
imul esp, dword [esi], 0xffffff92
test al, 0
invalid