joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ae76c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x7ae846
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x7ae858
call fcn.00794fa0
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x7ae7c4
mov eax, 0x7ae8b8
call fcn.00794d1c
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x7ae7af
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x7ae817
cmp dword [esp], 0
jne 0x7ae7f9
mov eax, 0x7ae910
call fcn.00794d1c
jmp 0x7ae821
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x7ae94c
call fcn.00794fa0
jmp 0x7ae821
mov eax, 0x7ae9b4
call fcn.00794d1c
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x7ae846
push 0xfa
call sub.kernel32.dll_Sleep
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x7aea1c
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7aec5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x7aebff
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x7aea91
mov eax, 0x7aec78
call fcn.0078bdb8
xor edx, edx
push ebp
push 0x7aeb94
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00405d9c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x7aeb7d
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x7aeaf9
mov eax, 0x7aec9c
call fcn.0078bdb8
xor edx, edx
push ebp
push 0x7aeb66
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x7aeb39
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x7aeb39
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.0041327c
cmp eax, 1
je 0x7aeb17
pop dword fs:[0]
add esp, 8
push 0x7aeb6d
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7aeb9b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret

Function at 0x7b06a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
push 1
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.0040990c
mov ecx, eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
mov edx, 0x80000002
call fcn.005e2608
test eax, eax
jne 0x7b071b
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.0040990c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x7b070a
cmp dword [ebp - 8], 4
je 0x7b070e
xor ebx, ebx
jmp 0x7b0710
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x7b071d
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7b4978
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe08
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11f4], ebx
mov dword [ebp - 0x11f8], ebx
mov dword [ebp - 0x11ec], ebx
mov dword [ebp - 0x11f0], ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 0x1004], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11de]
xor eax, eax
push ebp
push 0x7b4bbf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [ebp - 0x11d0]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 0x1004]
mov eax, dword [ebp - 0x11cc]
call fcn.007b15f8
cmp dword [ebp - 0x1084], 0x418
jle 0x7b4a38
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 0x1004]
mov al, 0xd9
call fcn.005e96a4
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, dword [0x41a37c]
call fcn.004276dc
call fcn.00407f04
lea eax, [ebp - 0x11f0]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
push 0
call fcn.0040902c
mov edx, dword [ebp - 0x11f0]
lea ecx, [ebp - 0x11ec]
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
call fcn.007b4294
mov edx, dword [ebp - 0x11ec]
mov eax, dword [ebp - 0x11d0]
add eax, 0x14
call fcn.00408c24
lea eax, [ebp - 0x11f8]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
push 0
call fcn.0040902c
mov edx, dword [ebp - 0x11f8]
lea ecx, [ebp - 0x11f4]
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
call fcn.007b4294
mov edx, dword [ebp - 0x11f4]
mov eax, dword [ebp - 0x11d0]
add eax, 0x18
call fcn.00408c24
lea eax, [ebp - 0x1078]
movzx eax, byte [eax]
mov edx, dword [ebp - 0x11d0]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x7b4b80
push ebp
mov eax, esi
mov edx, 0xa
call fcn.007b4900
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [ebp - 0x11d0]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
movzx edx, word [esi]
call fcn.007b1d98
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x7b4b1d
push ebp
call fcn.007b4758
pop ecx
xor eax, eax
push ebp
push 0x7b4b4e
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
call fcn.007b4900
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7b4b68
mov edx, dword [ebp - 0x11e4]
mov eax, dword [ebp - 0x11d0]
call fcn.007b1dd4
dec ebx
jne 0x7b4ae2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b4bc6
lea eax, [ebp - 0x11f8]
call fcn.00408868
lea eax, [ebp - 0x11f4]
call fcn.00408844
lea eax, [ebp - 0x11f0]
call fcn.00408868
lea eax, [ebp - 0x11ec]
mov edx, 2
call fcn.004088a4
ret
Function at 0x7b6444
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, esi
test ebx, ebx
je 0x7b645d
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040990c
push eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x7b6491
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
xor eax, eax
call fcn.007b6314
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x7b831c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x7b844d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [0x802bd0]
movzx eax, byte [eax]
mov ecx, dword [eax*4 + 0x80248c]
mov edx, 0x80000002
xor eax, eax
call fcn.005e2608
test eax, eax
jne 0x7b83b1
mov esi, edi
test esi, esi
je 0x7b8374
sub esi, 4
mov esi, dword [esi]
inc esi
mov eax, esi
add eax, eax
push eax
mov eax, edi
call fcn.0040990c
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040990c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x7b83a6
mov eax, 0x7b8468
call fcn.00794d1c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x7b83bb
mov eax, 0x7b84cc
call fcn.00794d1c
test bl, bl
je 0x7b8432
mov eax, edi
call fcn.0040990c
push eax
call fcn.00412900
test eax, eax
je 0x7b83e2
push 0
push 0
push 0x1d
push 0xffff
call int.0041338c
jmp 0x7b8432
lea ecx, [ebp - 0x10]
mov edx, 0x7b8520
mov al, 0x3f
call fcn.005e96a4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.005e2ef0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x802f10]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x802f10]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x802f10]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
pop eax
call fcn.007b58f0
test al, al
je 0x7b83bf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b8454
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004088a4
ret
Function at 0x7bb6d4
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x7bb795
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040990c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x7bb77a
test bl, 0x10
je 0x7bb77a
lea ecx, [ebp - 4]
mov edx, 0x7bb7b0
mov eax, esi
call fcn.005e0ce8
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x7bb7d4
mov eax, 0x7bb7f0
call fcn.005e14c0
mov edx, 0x7bb81c
mov eax, dword [ebp - 8]
call fcn.00420588
test eax, eax
jne 0x7bb77a
mov eax, dword [ebp - 4]
call fcn.00421eac
lea ecx, [ebp - 0xc]
mov edx, 0x7bb878
mov eax, esi
call fcn.005e0ce8
mov eax, dword [ebp - 0xc]
call fcn.00421eac
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.0040990c
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesW
push edi
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7bb79c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004088a4
ret

Function at 0x7bc7c8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x7bc8a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.0078bec4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x7bc8c0
call fcn.00794fa0
mov eax, dword [0x802908]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
call fcn.00461ae8
mov esi, eax
mov eax, dword [esi]
mov ebx, eax
test ebx, ebx
je 0x7bc83b
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
push eax
mov eax, ebx
mov ecx, 0x14
cdq
idiv ecx
push eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.007b51f0
test al, al
jne 0x7bc88c
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x7bc871
mov eax, 0x7bc910
call fcn.00794d1c
jmp 0x7bc88c
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x7bc9b0
call fcn.00794fa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7bc8a9
lea eax, [ebp - 0x1c]
call fcn.00408844
ret
Function at 0x7bed74
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7beefe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea edx, [ebp - 0x258]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005e0b78
lea eax, [ebp - 0x258]
mov edx, 0x7bef18
call fcn.00409b1c
mov eax, dword [ebp - 0x258]
call fcn.0040990c
push eax
call sub.kernel32.dll_FindFirstFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x7beed8
lea eax, [ebp - 4]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.004099c4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x7bee07
sub ebx, 4
mov ebx, dword [ebx]
cmp ebx, 9
jl 0x7bee4c
lea eax, [ebp - 0x25c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00409d44
mov eax, dword [ebp - 0x25c]
mov edx, 0x7bef3c
call fcn.00420588
test eax, eax
jne 0x7bee4c
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x7bee4e
xor eax, eax
test al, al
je 0x7bee65
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xc]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x7bee67
xor eax, eax
test al, al
je 0x7bee7e
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xe]
add eax, 0xffffffd0
sub ax, 0xa
setb al
jmp 0x7bee80
xor eax, eax
test al, al
je 0x7beebd
mov eax, dword [ebp - 4]
cmp word [eax + 0x10], 0x2e
jne 0x7beebd
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00409d44
mov eax, dword [ebp - 0x260]
call fcn.004215ec
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x254]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x7bede8
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7bef05
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.004088a4
lea eax, [ebp - 4]
call fcn.00408844
ret

Function at 0x7c3674
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
mov eax, ebx
call fcn.007c36f8
call fcn.004054a0
mov esi, eax
push esp
push 0x40
mov eax, ebx
call fcn.007c36f8
push eax
push esi
call sub.kernel32.dll_VirtualProtect
mov edx, esi
mov eax, ebx
call fcn.007c36a8
mov eax, esi
pop edx
pop esi
pop ebx
ret
Function at 0x7c511c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x7c52ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.004089cc
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x8024b8]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040990c
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.005e2608
test eax, eax
jne 0x7c52d3
xor eax, eax
push ebp
push 0x7c52c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.005fe298
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x7c51ad
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x7c51da
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00408e08
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x7c51fc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00408e08
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x7c5272
sub eax, 0xe9
je 0x7c5216
sub eax, 0x19
je 0x7c52b1
jmp 0x7c526b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x7c522d
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x7c5240
call fcn.00407ff8
jmp 0x7c52d3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x7c5257
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004089cc
jmp 0x7c51a1
call fcn.00407ff8
jmp 0x7c52d3
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.005fe298
lea eax, [ebp - 4]
call fcn.00408e08
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.004089cc
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.0060e270
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.005fc334
inc ebx
jmp 0x7c51a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c52cf
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c52f5
lea eax, [ebp - 8]
mov edx, 2
call fcn.004088a4
ret
Function at 0x7cb34c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x7cb3d0
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x7cb3b8
mov ebx, esi
test ebx, ebx
je 0x7cb37e
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040990c
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x7cb3ec
call fcn.00409b74
mov eax, dword [ebp - 8]
call fcn.0040990c
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x7cb3ba
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7cb3d7
lea eax, [ebp - 8]
call fcn.00408844
ret

Function at 0x7d16d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x7d16e2
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x7d1798
push 0x7d17cc
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00412530
mov ebx, eax
test ebx, ebx
je 0x7d1781
mov eax, esi
call fcn.0040990c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x7d1781
test al, 0x10
je 0x7d1732
mov ebp, 0x2000000
jmp 0x7d1734
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.0040990c
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x7d1781
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle
test ebx, ebx
jle 0x7d1781
cmp ebx, 0xff0
jge 0x7d1781
mov edx, edi
mov eax, esp
call fcn.007d15f0
jmp 0x7d178a
mov eax, edi
mov edx, esi
call fcn.00408c24
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x7d17e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x7d1879
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
test ebx, ebx
jle 0x7d184f
cmp ebx, 0x104
jge 0x7d184f
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.004099c4
mov eax, dword [ebp - 0x20c]
mov edx, esi
call fcn.007d16d8
jmp 0x7d1860
mov eax, 0x7d1894
call fcn.0078be6c
mov eax, esi
call fcn.00408844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7d1880
lea eax, [ebp - 0x20c]
call fcn.00408844
ret
Function at 0x7d18bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7d1a0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.007d16d8
lea eax, [ebp - 8]
call fcn.007d17e8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00405d9c
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x7d1a18
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.0040990c
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.0040990c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.0040990c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x7d1967
call sub.kernel32.dll_GetLastError
cmp eax, 0x4c7
jne 0x7d195d
call fcn.004276b0
mov eax, 0x7d1a30
call fcn.0078bdb8
cmp dword [ebp - 0x10], 0
jne 0x7d1977
mov eax, 0x7d1a5c
call fcn.0078bc64
xor edx, edx
push ebp
push 0x7d19e9
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.007d13e4
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call fcn.0041327c
cmp eax, 1
je 0x7d1985
cmp eax, 0xffffffff
jne 0x7d19b2
mov eax, 0x7d1ab0
call fcn.0078bdb8
call fcn.007d13e4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x7d19d2
mov eax, 0x7d1af0
call fcn.0078bdb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7d19f0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
Function at 0x7d8020
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x7d8028
push ecx
push ebx
xor eax, eax
push ebp
push 0x7d8172
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0078c458
mov edx, dword [ebp - 0x10]
mov eax, 0x80bdb8
call fcn.00408c24
lea eax, [ebp - 0x14]
mov ecx, dword [0x80bdb8]
mov edx, 0x7d818c
call fcn.00409b74
mov eax, dword [ebp - 0x14]
call fcn.00794d1c
mov eax, dword [0x803078]
cmp byte [eax], 0
je 0x7d8083
mov eax, dword [0x80bdb8]
call fcn.00794428
lea edx, [ebp - 0x18]
mov eax, dword [0x80bdb8]
call fcn.005e0b78
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x7d81d4
call fcn.00409b74
push 0
mov eax, dword [ebp - 4]
call fcn.0040990c
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x7d8119
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x3b
call fcn.005e96a4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0042127c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.005e3170
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x70
call fcn.005e9674
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x41a37c]
call fcn.004276dc
call fcn.00407f04
lea eax, [ebp - 8]
call fcn.007adfa4
cmp dword [ebp - 8], 0
je 0x7d814a
lea eax, [ebp - 0xc]
mov ecx, 0x7d81f0
mov edx, dword [ebp - 4]
call fcn.00409b74
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.007d7fc8
mov eax, dword [ebp - 0xc]
call fcn.007adffc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7d8179
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004088a4
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004088a4
ret

Function at 0x7de524
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x7de549
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret