joyce8/EMBER2024-capa huggingface dataset:
Function at 0x772da6
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x772efb
push ebx
mov ebx, 0xffc03fc0
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*4]
add edi, eax
cmp eax, edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x772ed6
mov esi, dword [eax + 4]
mov eax, dword [eax]
mov edx, dword [edi + 4]
mov edi, dword [edi]
mov ecx, eax
shr ecx, 2
and ecx, ebx
mov ebp, edi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, esi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, edx
shr ebp, 2
and ebp, ebx
lea ebx, [ecx + ebp - 0x7fff80]
mov ecx, eax
mov ebp, edi
and ecx, 0xff00ff
and ebp, 0xff00ff
add ecx, ebp
mov ebp, esi
and ebp, 0xff00ff
add ecx, ebp
mov ebp, edx
and ebp, 0xff00ff
shr eax, 2
lea ecx, [ecx + ebp + 0x20002]
shr ecx, 2
xor ebx, ecx
mov ecx, 0x3fc03fc0
and eax, ecx
shr edi, 2
and edi, ecx
add eax, edi
mov edi, dword [esp + 0x18]
shr esi, 2
and esi, ecx
add eax, esi
shr edx, 2
and edx, ecx
lea eax, [eax + edx + 0x800080]
and ebx, 0xff00ff
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 4
mov dword [eax], ebx
mov eax, dword [esp + 0x14]
add eax, 8
add edi, 8
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov ebx, 0xffc03fc0
jb 0x772e09
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x772de6
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x773020
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x773167
push ebx
mov edx, 0xf81f
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x773142
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x773089
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x773060
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x773294
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x7733da
push ebx
mov eax, 0x83e0
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x7733b5
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x7732fd
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x7732d4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x7733e3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x77352d
push ebx
mov edx, 0xf0f0
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x773508
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x77344c
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x773423
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x773536
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x77366c
push ebx
mov edx, dword [edx + 0x1050]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x773647
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x773595
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x773571
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x773710
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1048]
push edi
mov edi, dword [edx + 0x1054]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x773854
push ebx
push esi
mov esi, 0xff1c
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x77382e
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xe3
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 0x42]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x208]
shr eax, 2
and edx, 0xffff00e3
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x773779
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1048]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1048]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x773750
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x773983
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1048]
push edi
mov edi, dword [edx + 0x1054]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x773ac7
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x773aa1
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x7739ec
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1048]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1048]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x7739c3
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x773acf
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x773c05
push ebx
mov edx, dword [edx + 0x1050]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x773be0
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x773b2e
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x773b0a
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x776e20
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x776e41
mov eax, 0x8876086c
jmp 0x776f2c
cmp dword [ebp + 0x7c], esi
je 0x776ebb
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x776e9b
mov ebx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.007a3530
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x776ebb
push esi
push 0x10000000
push 3
push esi
push 1
push SysReAllocString
push dword [ebp + 0x78]
call dword [sym.imp.kernel32.dll_CreateFileW]
jmp 0x776ed4
push esi
push 0x10000000
push 3
push esi
push 1
push SysReAllocString
push dword [ebp + 0x78]
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x776f14
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x776f14
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
je 0x776f14
push esi
push dword [edi]
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
jne 0x776f2a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, esi
jle 0x776f2c
and eax, 0xffff
or eax, 0x80070000
jmp 0x776f2c
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8
Function at 0x794bf0
Capabilities:
Create thread

Disassembly:
push ecx
push 0
push 0
push 0
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.kernel32.dll_CreateEventA]
test eax, eax
jne 0x794c22
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [0x9ed104], eax
mov dword [0x9ed108], 0x2005
pop ecx
ret
mov dword [0x9ed0f0], eax
lea eax, [esp]
push eax
push 0
push 0
push 0x794c70
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
jne 0x794c5a
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [0x9ed104], eax
mov dword [0x9ed108], 0x2006
pop ecx
ret
mov ecx, dword [esp + 8]
mov dword [0x9ed0ec], eax
mov dword [ecx + 0x24], 2
pop ecx
ret
Function at 0x796750
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
push esi
push edi
xor esi, esi
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], esi
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x150]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x796792
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x140
ret
mov edi, dword [esp + 0x154]
push ebp
mov ebp, dword [sym.imp.kernel32.dll_FindNextFileA]
mov dword [edi], 1
lea edx, [esp + 0x10]
push edx
push ebx
call ebp
test eax, eax
jne 0x7967bd
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x12
je 0x7967c8
mov edx, dword [edi]
inc edx
inc esi
cmp esi, 0x64
mov dword [edi], edx
jl 0x7967a6
push ebx
call dword [sym.imp.kernel32.dll_FindClose]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x140
ret
Function at 0x797970
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0x202
mov dword [esi], 0x7f3434
call dword [sym.imp.wsock32.dll_WSAStartup]
test eax, eax
jne 0x7979a1
cmp byte [esp + 4], 2
jne 0x7979a1
mov dword [esi + 8], 0xffffffff
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x797a70
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push esi
push 0
push 1
mov esi, ecx
push 2
call dword [sym.imp.wsock32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x797a91
call dword [sym.imp.wsock32.dll_WSAGetLastError]
pop esi
ret 8
mov eax, dword [esp + 8]
mov word [esi + 0xc], 2
test eax, eax
je 0x797aa6
push eax
call dword [sym.imp.wsock32.dll_inet_addr]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.wsock32.dll_htons]
mov word [esi + 0xe], ax
mov eax, 1
pop esi
ret 8

Function at 0x797ad0
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x10
mov eax, dword [edi + 8]
lea ebx, [edi + 0xc]
push ebx
push eax
call dword [sym.imp.wsock32.dll_connect]
cmp eax, 0xffffffff
jne 0x797b5f
call dword [sym.imp.wsock32.dll_WSAGetLastError]
cmp eax, 0x274c
je 0x797baf
push 0
push 0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateEventA]
mov ebp, eax
test ebp, ebp
je 0x797baf
mov dword [esp + 0x10], 0
push 0xc8
push ebp
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov ecx, dword [edi + 8]
push 0x10
push ebx
push ecx
call dword [sym.imp.wsock32.dll_connect]
mov esi, eax
cmp esi, 0xffffffff
jne 0x797b53
call dword [sym.imp.wsock32.dll_WSAGetLastError]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xa
mov dword [esp + 0x10], eax
jl 0x797b1f
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x797baf
xor edx, edx
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
mov dword [esp + 0x24], edx
mov esi, 0x10
mov dword [esp + 0x28], edx
mov edx, dword [edi + 8]
push ecx
push edx
mov dword [esp + 0x20], esi
call dword [sym.imp.wsock32.dll_getsockname]
cmp eax, 0xffffffff
je 0x797baf
cmp dword [esp + 0x14], esi
jne 0x797baf
mov eax, dword [esp + 0x1c]
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 4

Function at 0x797bc0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
mov eax, dword [ecx + 8]
push edx
push eax
call dword [sym.imp.wsock32.dll_send]
cmp eax, 0xffffffff
jne 0x797be3
mov eax, 4
ret 0x10
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, 1
ret 0x10
Function at 0x797c20
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20019
push 0
push 0x866204
push reloc.oleaut32.dll_SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x797ca0
mov dword [esp + 8], eax
mov eax, 4
lea ecx, [esp + 4]
push esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], eax
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0x8661fc
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
mov esi, eax
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x797ca0
mov eax, dword [esp + 4]
test eax, eax
jbe 0x797ca0
mov eax, dword [esp + 8]
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret