joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7887a6da
Capabilities:
Parse credit card information

Disassembly:
push 0x18
call fcn.78807713
mov ecx, eax
call fcn.78879b25
mov dword [ebp - 8], eax
jmp 0x7887a6f9
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x7887a5db
and dword [ebp - 8], 0
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov edx, dword [ecx + 8]
sub edx, eax
test edx, edx
jle 0x7887a718
push eax
call fcn.78849fcf
cmp ax, 0x5e
je 0x788917f3

Function at 0x7887c16e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea esi, [ecx + 4]
mov eax, dword [esi]
test eax, eax
mov dword [ebp - 4], ecx
jne 0x78896210
push dword [0x78918190]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push dword [eax + 0x28]
call fcn.78885e76
test eax, eax
jl 0x7887c230
cmp dword [ebp + 0x20], 0
push edi
je 0x7887c1bd
mov edi, dword [esi]
push ebx
mov ebx, dword [edi]
mov eax, ebx
push edi
call dword [eax + 0x30]
or eax, dword [ebp + 0x20]
push eax
push edi
call dword [ebx + 0x70]
pop ebx
mov eax, dword [esi]
mov ecx, dword [eax]
xor edi, edi
push edi
push 2
push 0x7883761c
push eax
call dword [ecx + 0x44]
cmp eax, edi
jl 0x7887c22f
mov edx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
add edx, edx
push edx
push dword [ebp + 8]
push eax
call dword [ecx + 0x44]
cmp eax, edi
jl 0x7887c22f
mov edx, dword [ebp + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
add edx, edx
push edx
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x44]
cmp eax, edi
jl 0x7887c22f
mov edx, dword [ebp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax]
push 1
add edx, edx
push edx
push dword [ebp + 0x18]
push eax
call dword [ecx + 0x44]
cmp eax, edi
jl 0x7887c22f
mov eax, dword [esi]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, edi
jl 0x7887c22f
mov esi, dword [esi]
mov eax, dword [esi]
push 0xffffffffffffffff
push esi
call dword [eax + 0x60]
pop edi
pop esi
leave
ret 0x1c
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
jmp 0x7887c1a2

Function at 0x7887cf63
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
or dword [ecx + 0x54], 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x7887cf96
push esi
push dword [0x78918190]
mov esi, dword [ecx + 0x8c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x50]
cmp eax, ebx
jne 0x78893c29
pop esi
pop edi
pop ebx
pop ebp
ret 4
cmp dword [eax + 0x10], esi
jne 0x7887cf95
mov ecx, dword [eax + 8]
xor edx, edx
dec ecx
cmp ecx, ebx
jbe 0x7887cf95
mov eax, dword [eax + 0xc]
cmp dword [eax + 4], edi
jne 0x78893c4f
mov esi, dword [eax]
cmp esi, dword [edi + 0x14]
je 0x78893c5c
inc edx
add eax, 0x14
cmp edx, ecx
jb 0x78893c43
jmp 0x7887cf95
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], ebx
mov byte [eax + 0x24], bl
jmp 0x7887cf95
Function at 0x7887e74c
Capabilities:
Get thread local storage value

Disassembly:
push 0x34
push 0x7887e850
call fcn.78801330
mov esi, ecx
mov byte [ebp - 0x1c], 0
mov edi, dword [esi + 0x34]
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0xb4]
xor ecx, ecx
cmp dword [ebp + 8], ecx
jne 0x7887e781
mov ecx, edi
call fcn.78809024
mov dword [ebp + 8], eax
mov byte [ebp - 0x1c], 1
xor ecx, ecx
mov eax, dword [edi + 0xbc]
cmp eax, 4
jne 0x788a73f0
mov eax, dword [edi + 0x54]
shr eax, 0xa
test al, 1
jne 0x788a73fa
mov ecx, dword [edi + 0x60]
mov dword [ebp - 0x20], ecx
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [edi + 0xbc], 2
and dword [ebp - 4], 0
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x7887e83f
test ebx, ebx
je 0x7887e7d9
mov byte [esi + 0x2f], 1
push edi
mov eax, dword [0x7891e2a4]
push eax
push eax
push ebx
mov ecx, esi
call fcn.7885b2b7
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
test al, 0x20
jne 0x788a744d
test al, 0x1f
jne 0x788a7477
cmp byte [ebp - 0x1c], 0
je 0x7887e814
push dword [0x78918190]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov ecx, dword [ebx + 0x50]
test ecx, ecx
jne 0x788a7459
push dword [ebp - 0x1c]
push edi
push dword [ebp + 8]
push esi
call fcn.7887e6c4
mov dword [edi + 0xbc], 4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
call dword [eax + 0x10]
call fcn.78801370
ret 4
cmp byte [ebp - 0x1c], 0
je 0x7887e7d9
jmp 0x788a7417
push 0xc00ce212
call fcn.788b1104
cmp dword [esi + 0x5c], ecx
je 0x7887e79e
push ecx
push ecx
push ecx
push ecx
push 0xc00ce23d
push 0x80004005
push ecx
call fcn.788617eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x2c], eax
push eax
mov ecx, esi
call fcn.78839ae6
push eax
mov ecx, esi
call fcn.7890b8b6
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x7887e7d9
mov dword [ebp - 0x34], eax
mov ecx, eax
call fcn.78815218
jmp 0x7887e7d9
push ecx
push esi
call fcn.7890c629
jmp 0x7887e821
cmp dword [ecx + 0x10], esi
jne 0x7887e814
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [ebx + 0x50], 0
jmp 0x7887e814
push ecx
call fcn.788b9daf
push 0
push dword [ebp - 0x14]
call fcn.78860de2
ret
Function at 0x78880721
Capabilities:
Accept command line arguments

Disassembly:
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x94
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x7888093e
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
push esi
push 0
je 0x788a22d6
mov eax, dword [esi + 0x10]
mov dword [0x789280f8], eax
mov eax, dword [esi + 4]
mov dword [0x78928104], eax
mov eax, dword [esi + 8]
mov dword [0x78928108], eax
mov eax, dword [esi + 0xc]
and eax, 0x7fff
mov dword [0x789280fc], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x789280f8], 2
jne 0x788a22e4
mov eax, dword [0x78928104]
shl eax, 8
add eax, dword [0x78928108]
push 1
mov dword [0x78928100], eax
call fcn.78854737
test eax, eax
pop ecx
je 0x7888093e
call fcn.78852cce
test eax, eax
je 0x788a22f0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x78928710], eax
call fcn.7884e779
mov dword [0x789280f4], eax
call fcn.7884e82d
test eax, eax
jl 0x788a22fa
call fcn.7885398f
test eax, eax
jl 0x78880934
call fcn.78853b2a
test eax, eax
jl 0x78880934
call fcn.78853eca
test eax, eax
jne 0x78880934
inc dword [0x789280f0]
jmp 0x78880785
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
inc ecx
cmp eax, ecx
push esi
push edi
je 0x78853a33
xor edi, edi
cmp eax, edi
je 0x788a2301
cmp eax, 2
jne 0x7888091f
mov edx, 0x8c
call fcn.78853774
mov esi, eax
cmp esi, edi
je 0x7888093e
push esi
push dword [0x7891e55c]
call dword [0x7891e564]
test eax, eax
push esi
je 0x788a2333
call fcn.78852cb6
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0xc
cmp eax, 3
jne 0x78880785
push edi
call fcn.788808e8
pop ecx
jmp 0x78880785
call fcn.788a2a66
jmp 0x788a22fa
xor eax, eax
jmp 0x78880788
xor ah, bh
invalid
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x7888093e
or byte [0x789280fd], 0x80
jmp 0x78853aa6
call fcn.788f8bb2
jmp 0x7888093e
call fcn.788f8b47
jmp 0x788a22f0
cmp dword [0x789280f0], edi
jle 0x7888093e
dec dword [0x789280f0]
cmp dword [0x7892d0a0], edi
jne 0x788a2320
call fcn.788a274c
cmp dword [ebp + 0x10], edi
jne 0x78880785
call fcn.788a2a66
jmp 0x7888e130
call fcn.78852a1e
pop ecx
jmp 0x7888093e
Function at 0x78888910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
add esi, 0x10
test edi, edi
jne 0x7888d845
push esi
call fcn.78809e5e
and dword [eax + 4], 0
lea ecx, [eax + 0x10]
mov dword [eax], edi
mov dword [eax + 8], ecx
lea ecx, [eax + esi]
pop edi
mov dword [eax + 0xc], ecx
pop esi
pop ebp
ret 8
push edi
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
invalid
invalid
invalid
cld
invalid
Function at 0x7888d034
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x7888d06f
Function at 0x7888d867
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [esi - 0x3a]
test dword [edx + 0x6dfffffc], edi

Function at 0x7888e441
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x7888e44a
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x7888e3f4
call fcn.7888cff4
xlatb
scasb al, byte es:[edi]
xor ebp, dword [esi]
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.7888cff4
mov word [edi], cs
cmp al, 0x29
lea eax, [ebp - 0x72c]
push eax
call fcn.7888d004
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.7888cfb9
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.7888cff4
push ds
sub cl, 0x25
lea eax, [ebp - 0x718]
push eax
push 0x40
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
push 5
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0x3a8]
call fcn.7888cf65
add esp, 0xc
lea eax, [ebp - 0x718]
push eax
push dword [ebp - 0x718]
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
call fcn.7888cff4
salc
and esi, dword [ecx + 0xa583a8]
stc
invalid
Function at 0x7888f3d3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cld
invalid
cmp dh, al
test dword [ecx + 0x11fffffc], esp
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
daa
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.7888d004
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.7888cfb9
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.7888cff4
sub dword [ebp + 0x46894fa], edi
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
push 0x20
push 0x7888f498
call fcn.78801330
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x7888f3fa
xor eax, eax
call fcn.78801370
jmp 0x7888df74
and dword [ebp - 4], 0
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x1c], eax
jae 0x7888f46e
mov eax, dword [ebp - 0x1c]
shl eax, 4
add eax, dword [ebx + 0x20]
mov dword [ebp - 0x28], eax
cmp dword [eax + 0xc], 0
je 0x7888df8c
mov esi, dword [eax + 4]
mov dword [ebp - 0x2c], esi
mov ecx, esi
call fcn.78820613
mov edi, eax
mov dword [ebp - 0x30], edi
cmp edi, 0xffffffff
je 0x7888df8c
test edi, 0xfffffff8
jne 0x7888f466
push edi
mov ecx, esi
call fcn.788166bc
test eax, eax
jne 0x7888f466
mov eax, dword [esi + 0xc]
cmp eax, dword [0x7891e298]
je 0x7888f466
inc dword [ebp - 0x20]
mov eax, dword [esi]
call dword [eax + 0x40]
jmp 0x7888df77
mov dword [esi + 4], edi
jmp 0x7888df8c
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
jmp 0x7888f3f0
Function at 0x788afe34
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x7891e1e4]
push ebx
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x41c]
push eax
push 1
xor edi, edi
push edi
push 0x788aff38
push 0x80000000
mov ebx, 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x788aff29
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x424]
push eax
push edi
push 0x788aff37
push dword [ebp - 0x41c]
mov dword [ebp - 0x420], 0x103
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x788aff1d
push 0x103
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jbe 0x788aff1d
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
mov ebx, eax
cmp ebx, edi
jl 0x788aff1d
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
mov ebx, eax
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
pop ebx
call fcn.78809964
leave
ret
Function at 0x788ccafe
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x7891e1e4]
mov dword [ebp - 4], eax
mov eax, dword [0x7892a46c]
cmp eax, 0xffffffff
jne 0x788ccb67
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je fcn.788b0842
xor eax, eax
inc eax
cmp dword [ebp - 0x108], 2
jne 0x788ccb4f
cmp dword [ebp - 0x114], 5
jae 0x788ccb62
cmp dword [ebp - 0x108], eax
jne 0x788ccb60
cmp dword [ebp - 0x110], 0x5a
jae 0x788ccb62
xor eax, eax
mov dword [0x7892a46c], eax
mov ecx, dword [ebp - 4]
call fcn.78809964
leave
ret

Function at 0x788ccb71
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 8], ecx
je 0x788ccb8c
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
jmp 0x788ccb8f
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
cmp eax, ecx
je 0x788ccb9e
mov eax, dword [eax + 0xc]
mov dword [ebp + 8], eax
jmp 0x788ccba1
mov dword [ebp + 8], ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push ecx
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push dword [ebp + 8]
push dword [ebp - 4]
push eax
call esi
test eax, eax
jne 0x788ccc12
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, 0xffff
mov edi, 0x80070000
jle 0x788ccbd6
and eax, ebx
or eax, edi
cmp eax, 0x80090016
jne 0x788ccc06
test byte [ebp + 0x14], 8
je 0x788ccc0a
push 8
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push dword [ebp + 8]
push dword [ebp - 4]
push eax
call esi
test eax, eax
jne 0x788ccc10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x788ccc08
and eax, ebx
or eax, edi
test eax, eax
je 0x788ccc10
push eax
call fcn.788b1104
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret 0x10

Function at 0x788d8bc4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push dword [0x78918190]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [ebp + 8]
push edi
push eax
lea ecx, [esi + 0xc]
call fcn.788184a3
push dword [edi + 0xc]
mov ecx, esi
call fcn.7881e43b
pop edi
pop esi
pop ebp
ret 4

Function at 0x788d8bf6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [0x78918190]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [ebp + 8]
lea ecx, [esi + 0xc]
push eax
call fcn.7881846a
push dword [ebp + 8]
mov ecx, esi
call fcn.7881e43b
pop esi
pop ebp
ret 4
Function at 0x788db23b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x7891e1e4]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 0x20], eax
xor eax, eax
mov edi, 0x20019
push edi
push eax
push str.SoftwareMicrosoftInternet_ExplorerActiveX_Compatibility
push 0x80000002
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebx], eax
call esi
test eax, eax
je 0x788db28e
mov dword [ebp - 0x20], 1
jmp 0x788db300
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
mov dword [ebp - 0x20], eax
jl 0x788db300
lea eax, [ebp - 0x2c]
push eax
push edi
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call esi
test eax, eax
jne 0x788db285
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push str.Compatibility_Flags
push dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0x18
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x788db285
cmp dword [ebp - 0x30], 4
jne 0x788db2ea
mov eax, dword [ebp - 0x1c]
jmp 0x788db2fe
cmp dword [ebp - 0x30], 1
jne 0x788db300
cmp dword [ebp - 0x34], 2
jbe 0x788db300
lea edx, [ebp - 0x18]
call fcn.788db1f2
mov dword [ebx], eax
cmp dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x788db311
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x28], 0
je 0x788db31c
push dword [ebp - 0x28]
call esi
cmp dword [ebp - 0x24], 0
pop edi
pop esi
pop ebx
je 0x788db32e
push dword [ebp - 0x24]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.78809964
leave
ret 8
Function at 0x788f86d3
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 4
pop eax
call fcn.7880a414
mov dword [ebp - 8], esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x788f87cf
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x4c]
xor esi, esi
cmp dword [0x789280f8], 2
jne 0x788f8754
push 0x78854710
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, esi
je 0x788f8754
push 0x788f87dc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x788f8754
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], esi
call eax
cmp eax, 1
pop ecx
jne 0x788f8754
cmp dword [ebp - 4], esi
jbe 0x788f8754
mov esi, dword [ebp - 4]
mov edx, dword [0x789280f8]
mov ebx, edx
dec ebx
neg ebx
sbb ebx, ebx
and ebx, 0x103
lea ecx, [edi - 1]
lea eax, [esi + edi - 1]
not ecx
inc ebx
and eax, ecx
mov dword [ebp - 4], eax
je 0x788f877d
add eax, edi
mov dword [ebp - 4], eax
lea ecx, [edi + edi]
cmp eax, ecx
jae 0x788f8789
mov dword [ebp - 4], ecx
mov eax, ecx
lea esi, [edi - 1]
not esi
and esi, dword [ebp - 8]
sub esi, eax
cmp edx, 1
jne 0x788f879b
push 0x11
pop edi
mov ecx, dword [ebp - 0xc]
add edi, ecx
cmp esi, edi
jb 0x788f87cf
push 4
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x788f87cf
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x788f87cf
xor eax, eax
inc eax
jmp 0x788f87d1
xor eax, eax
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x788f8ad7
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x788f8b1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x788f8b00
push 0x788f8b0c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x788f8b00
push dword [ebp + 8]
call eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x788f8c3e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp ecx, dword [esi*8 + 0x7892bc78]
je 0x788f8c60
inc esi
cmp esi, 0x13
mov dword [ebp - 4], esi
jb 0x788f8c4e
cmp esi, 0x13
je 0x788f8d9c
mov eax, dword [0x7892d090]
cmp eax, 1
push ebx
je 0x788f8d6b
test eax, eax
jne 0x788f8c89
cmp dword [0x7892d094], 1
je 0x788f8d6b
cmp ecx, 0xfc
je 0x788f8d9b
push edi
push 6
pop ecx
mov esi, 0x788f8de8
mov edi, 0x7892d0a8
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ebx, 0x7892d0c2
push ebx
movsw word es:[edi], word [esi]
push 0
mov byte [0x7892d1c6], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x788f8cd7
push 5
pop ecx
mov esi, 0x788f8dd0
mov edi, 0x7892d0c2
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x788f8cdc
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x788f8d0f
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x788f8cf0
sub eax, edx
push 3
lea eax, [eax + 0x7892d087]
push 0x788f8dcc
push eax
call fcn.7888e441
add esp, 0xc
mov edx, 0x7892d0a8
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x788f8d17
mov eax, dword [ebp - 4]
mov eax, dword [eax*8 + 0x7892bc7c]
mov esi, 0x788f8dc8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x788f8d33
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x788f8d3f
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x788f8da0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.788fb821
add esp, 0xc
pop edi
jmp 0x788f8d9b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x788f8d9b
mov edx, dword [esi*8 + 0x7892bc7c]
mov ecx, edx
lea esi, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x788f8d83
push 0
sub ecx, esi
lea esi, [ebp - 8]
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
leave
ret
Function at 0x788fb821
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x7892d3c8], ebx
push esi
push edi
jne 0x788fb8a3
push 0x788fb980
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x788fb8de
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x788fb974
push edi
call esi
test eax, eax
mov dword [0x7892d3c8], eax
je 0x788fb8de
push 0x788fb964
push edi
call esi
push 0x788fb950
push edi
mov dword [0x7892d3cc], eax
call esi
cmp dword [0x789280f8], 2
mov dword [0x7892d3d0], eax
jne 0x788fb8a3
push 0x788fb934
push edi
call esi
test eax, eax
mov dword [0x7892d3d8], eax
je 0x788fb8a3
push 0x788fb91c
push edi
call esi
mov dword [0x7892d3d4], eax
mov eax, dword [0x7892d3d4]
test eax, eax
je 0x788fb8e8
call eax
test eax, eax
je 0x788fb8cf
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x7892d3d8]
test eax, eax
je 0x788fb8cf
test byte [ebp - 8], 1
jne 0x788fb8e8
cmp dword [0x78928104], 4
jb 0x788fb8e2
or byte [ebp + 0x12], 0x20
jmp 0x788fb907
xor eax, eax
jmp 0x788fb917
or byte [ebp + 0x12], 4
jmp 0x788fb907
mov eax, dword [0x7892d3cc]
test eax, eax
je 0x788fb907
call eax
mov ebx, eax
test ebx, ebx
je 0x788fb907
mov eax, dword [0x7892d3d0]
test eax, eax
je 0x788fb907
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x7892d3c8]
pop edi
pop esi
pop ebx
leave
ret