joyce8/EMBER2024-capa huggingface dataset:
Function at 0x798bd8
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1058], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x798dfc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x798e18
call fcn.0040b534
mov esi, dword [ebx + 0xa4]
cmp dword [esi + 4], 0
je 0x798dd9
cmp dword [esi + 8], 0
je 0x798dd9
lea eax, [ebp - 0x52]
mov edx, 0x798e54
call fcn.0043260c
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x1c4]
call fcn.0040becc
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
push 1
push 0
push 3
push 0
push 0
push 0x50
mov eax, dword [ebx + 0xa4]
mov eax, dword [eax + 4]
call fcn.0040becc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetConnectW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x798dbe
mov esi, 0x7000
push 1
push esi
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
mov eax, dword [eax + 8]
call fcn.0040becc
push eax
push 0x798e64
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_HttpOpenRequestW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x798da1
mov eax, dword [ebx + 0xa4]
add eax, 0x14
call fcn.0040b078
mov esi, dword [ebp - 4]
test esi, esi
je 0x798cd4
mov esi, dword [esi - 4]
mov eax, dword [ebx + 0xa4]
mov eax, dword [eax + 0xc]
mov edi, eax
test edi, edi
je 0x798ce6
mov edi, dword [edi - 4]
push edi
mov eax, dword [ebx + 0xa4]
mov eax, dword [eax + 0xc]
call fcn.0040ba84
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.0040ba84
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_HttpSendRequestA
test eax, eax
je 0x798d96
mov dword [ebp - 0x14], 0x1000
cmp dword [ebp - 0x14], 0
jbe 0x798d96
mov eax, dword [0x8cd198]
mov eax, dword [eax]
call fcn.005cf924
lea eax, [ebp - 0x14]
push eax
push 0x1000
lea eax, [ebp - 0x1052]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x798d96
cmp dword [ebp - 0x14], 0
jbe 0x798d90
cmp dword [ebp - 0x14], 0x1000
ja 0x798d90
mov edi, dword [ebp - 0x14]
dec edi
test edi, edi
jl 0x798d90
inc edi
lea esi, [ebp - 0x1052]
lea eax, [ebp - 0x1058]
movzx edx, byte [esi]
mov ecx, 0
call fcn.0040b75c
mov edx, dword [ebp - 0x1058]
mov eax, dword [ebx + 0xa4]
add eax, 0x14
call fcn.0040b860
inc esi
dec edi
jne 0x798d65
cmp dword [ebp - 0x14], 0
ja 0x798d1e
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x798db3
push 0x11
push 5
xor ecx, ecx
mov edx, 0x3b8
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x48]
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x798dd0
push 0x10
push 5
xor ecx, ecx
mov edx, 0x3b7
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x48]
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x798e03
lea eax, [ebp - 0x1058]
call fcn.0040b078
lea eax, [ebp - 4]
call fcn.0040b078
pop eax
jmp eax
Function at 0x7a4c4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x7a4c62
mov eax, dword [0x8cd198]
mov eax, dword [eax]
call fcn.005cf924
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x15e
jb 0x7a4c56
pop ebx
ret

Function at 0x7a6eb8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7a6f6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004b7c58
xor eax, eax
push ebp
push 0x7a6f50
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x48]
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x7a6f08
bt edi, eax
jae 0x7a6f32
mov esi, ebx
add si, 0x61
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040beec
lea eax, [ebp - 8]
mov edx, 0x7a6f8c
call fcn.0040c0d8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc ebx
cmp ebx, 0x1a
jne 0x7a6efe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a6f57
mov eax, dword [ebp - 4]
call fcn.004b7d18
pop eax
jmp eax

Function at 0x7a6f94
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b148
xor eax, eax
push ebp
push 0x7a701c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040becc
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, ebx
call fcn.00407108
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x7a702c
push esi
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
shr edi, 0x10
mov edx, ebx
mov eax, esi
call fcn.00407124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a7023
lea eax, [ebp - 4]
call fcn.0040b054
pop eax
jmp eax
Function at 0x7a7030
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b148
xor eax, eax
push ebp
push 0x7a7228
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.0040becc
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
mov eax, esi
call fcn.00407108
mov edi, eax
push edi
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040becc
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x7a7238
push edi
call sub.version.dll_VerQueryValueW
cmp byte [ebp - 5], 0
je 0x7a715b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00430de4
push dword [ebx]
push 0x7a7248
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00430de4
push dword [ebp - 0x20]
mov eax, ebx
mov edx, 3
call fcn.0040c1b8
push dword [ebx]
push 0x7a7248
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00430de4
push dword [ebp - 0x24]
mov eax, ebx
mov edx, 3
call fcn.0040c1b8
push dword [ebx]
push 0x7a7248
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.00430de4
push dword [ebp - 0x28]
mov eax, ebx
mov edx, 3
call fcn.0040c1b8
jmp 0x7a71fa
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00430de4
push dword [ebx]
push 0x7a7248
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00430de4
push dword [ebp - 0x2c]
mov eax, ebx
mov edx, 3
call fcn.0040c1b8
push dword [ebx]
push 0x7a7248
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00430de4
push dword [ebp - 0x30]
mov eax, ebx
mov edx, 3
call fcn.0040c1b8
push dword [ebx]
push 0x7a7248
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00430de4
push dword [ebp - 0x34]
mov eax, ebx
mov edx, 3
call fcn.0040c1b8
mov edx, esi
mov eax, edi
call fcn.00407124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a722f
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.0040b0b4
lea eax, [ebp - 4]
call fcn.0040b054
pop eax
jmp eax
Function at 0x7a72fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x7a73a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.0040c058
push 0
call sub.kernel32.dll_SetLastError
mov eax, dword [ebx]
call fcn.0040becc
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, edi
call fcn.0040becc
push eax
mov eax, esi
call fcn.0040becc
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
jne 0x7a737d
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 8]
xor edx, edx
call fcn.0043755c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4296b0]
call fcn.004394a8
call fcn.0040a700
mov eax, dword [ebx]
call fcn.0040becc
call fcn.0040b584
mov edx, ebx
xchg edx, eax
call fcn.0040c058
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a73b0
lea eax, [ebp - 8]
call fcn.0040b054
pop eax
jmp eax

Function at 0x7a7790
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0
call sub.kernel32.dll_SetLastError
push esp
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x7a77c0
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040bf80
add esp, 0x20c
pop ebx
ret

Function at 0x7a77c8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0
call sub.kernel32.dll_SetLastError
push esp
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x7a77f8
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040bf80
add esp, 0x20c
pop ebx
ret

Function at 0x7aca11
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 8], 0
jle 0x7aca69
xor eax, eax
mov dl, byte [esi + eax]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + eax]
mov byte [ebx + eax], dl
inc eax
cmp eax, 8
jl 0x7aca2c
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.007abfc6
mov ecx, 8
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.007aeaa1
add esi, 8
add ebx, 8
sub dword [ebp + 8], 8
cmp dword [ebp + 8], 0
jg 0x7aca2a
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x7aca71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 8], 0
jle 0x7acada
lea eax, [ebp - 0x10]
mov ecx, 8
mov edx, dword [ebp - 8]
call fcn.007aeaa1
mov eax, dword [ebp - 4]
add eax, 0x80
mov ecx, ebx
mov edx, dword [ebp - 8]
call fcn.007abfc6
xor eax, eax
mov dl, byte [esi + eax]
xor byte [ebx + eax], dl
inc eax
cmp eax, 8
jl 0x7acaae
lea edx, [ebp - 0x10]
mov ecx, 8
mov eax, esi
call fcn.007aeaa1
add dword [ebp - 8], 8
add ebx, 8
sub dword [ebp + 8], 8
cmp dword [ebp + 8], 0
jg 0x7aca8a
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x7ae7c6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 8], 0
jle 0x7ae81e
xor eax, eax
mov dl, byte [esi + eax]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + eax]
mov byte [ebx + eax], dl
inc eax
cmp eax, 8
jl 0x7ae7e1
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.007acc3b
mov ecx, 8
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.007aeaa1
add esi, 8
add ebx, 8
sub dword [ebp + 8], 8
cmp dword [ebp + 8], 0
jg 0x7ae7df
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x7ae826
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 8], 0
jle 0x7ae88f
lea eax, [ebp - 0x10]
mov ecx, 8
mov edx, dword [ebp - 8]
call fcn.007aeaa1
mov eax, dword [ebp - 4]
add eax, 0x180
mov ecx, ebx
mov edx, dword [ebp - 8]
call fcn.007acc3b
xor eax, eax
mov dl, byte [esi + eax]
xor byte [ebx + eax], dl
inc eax
cmp eax, 8
jl 0x7ae863
lea edx, [ebp - 0x10]
mov ecx, 8
mov eax, esi
call fcn.007aeaa1
add dword [ebp - 8], 8
add ebx, 8
sub dword [ebp + 8], 8
cmp dword [ebp + 8], 0
jg 0x7ae83f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x7b0224
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov esi, edi
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [0x872408], 0
jne 0x7b025e
push str.ADVAPI32.DLL
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
push str.SystemFunction036
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x872408], eax
cmp dword [0x872408], 0
je 0x7b0273
push dword [ebp - 4]
push edi
call dword [0x872408]
jmp 0x7b02c1
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x7b0283
push 1
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
jne 0x7b027c
xor ecx, ecx
cmp ecx, dword [ebp - 4]
jge 0x7b02c1
lea eax, [ecx + 1]
push eax
mov eax, ebx
pop edx
mov edi, edx
xor edx, edx
div edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov edx, ecx
and edx, 0x80000003
jns 0x7b02b5
dec edx
or edx, 0xfffffffc
inc edx
mov al, byte [eax + edx]
mov byte [esi + ecx], al
inc ecx
cmp ecx, dword [ebp - 4]
jl 0x7b0293
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x7b0794
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ebx, ebx
jne 0x7b07b4
mov ebx, 0x7d0
push esi
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call sub.kernel32.dll_ReadFile
push ebx
push dword [esi + 0x10]
call sub.kernel32.dll_WaitForSingleObject
sub eax, 1
jb 0x7b07db
sub eax, 0x101
je 0x7b07e7
jmp 0x7b07fe
mov eax, dword [esi + 4]
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
xor ebx, ebx
jmp 0x7b0813
push edi
call sub.kernel32.dll_CancelIo
mov ebx, 1
mov eax, 0x18
call fcn.007a8ff4
jmp 0x7b0813
push edi
call sub.kernel32.dll_CancelIo
mov ebx, 2
mov eax, 0x19
call fcn.007a8ff4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x7b081e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x7b0839
mov edi, 0x7d0
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
push edx
push ebx
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x7b0850
call sub.kernel32.dll_GetLastError
push edi
push dword [esi + 0x10]
call sub.kernel32.dll_WaitForSingleObject
sub eax, 1
jb 0x7b0867
sub eax, 0x101
je 0x7b0873
jmp 0x7b088a
mov eax, dword [esi + 4]
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
xor ebx, ebx
jmp 0x7b089f
push ebx
call sub.kernel32.dll_CancelIo
mov ebx, 1
mov eax, 0x1a
call fcn.007a8ff4
jmp 0x7b089f
push ebx
call sub.kernel32.dll_CancelIo
mov ebx, 2
mov eax, 0x1b
call fcn.007a8ff4
xor eax, eax
call fcn.007a8ff4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x7b0b97
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0
lea ebx, [ebp - 4]
push ebx
push ecx
push edx
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x7b0bc4
mov eax, 0x36
call fcn.007a8ff4
mov eax, 2
jmp 0x7b0bcd
xor eax, eax
call fcn.007a8ff4
xor eax, eax
pop ebx
pop ecx
pop ebp
ret

Function at 0x7b0bd1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0
lea ebx, [ebp - 4]
push ebx
push ecx
push edx
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x7b0bfe
mov eax, 0x37
call fcn.007a8ff4
mov eax, 2
jmp 0x7b0c07
xor eax, eax
call fcn.007a8ff4
xor eax, eax
pop ebx
pop ecx
pop ebp
ret
Function at 0x7b0fe3
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
call fcn.007b0df3
xor eax, eax
mov edx, eax
mov esi, eax
cmp edi, eax
jle 0x7b109a
mov ecx, edi
sub ecx, eax
cmp ecx, 2
jl 0x7b1028
xor ecx, ecx
mov cl, byte [ebx + eax]
cmp ecx, 0xd
jne 0x7b1028
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0xa
je 0x7b1091
xor ecx, ecx
mov cl, byte [ebx + eax]
cmp ecx, 0xa
je 0x7b1091
xor ecx, ecx
mov cl, byte [ebx + eax]
cmp ecx, 0x3d
jne 0x7b104c
inc esi
cmp esi, 2
jle 0x7b104c
mov eax, 0x12
jmp 0x7b1172
xor ecx, ecx
mov cl, byte [ebx + eax]
cmp ecx, 0x7f
jg 0x7b1067
xor ecx, ecx
mov cl, byte [ebx + eax]
movzx ecx, byte [ecx + 0x87313c]
cmp ecx, 0x7f
jne 0x7b1071
mov eax, 0x12
jmp 0x7b1172
xor ecx, ecx
mov cl, byte [ebx + eax]
movzx ecx, byte [ecx + 0x87313c]
cmp ecx, 0x40
jge 0x7b1090
test esi, esi
je 0x7b1090
mov eax, 0x12
jmp 0x7b1172
inc edx
inc eax
cmp edi, eax
jg 0x7b100a
test edx, edx
jne 0x7b10a5
xor eax, eax
jmp 0x7b1172
add edx, edx
lea edx, [edx + edx*2]
add edx, 7
sar edx, 3
mov ecx, dword [ebp - 8]
cmp edx, dword [ecx]
jle 0x7b10c6
mov eax, dword [ebp - 8]
mov dword [eax], edx
mov eax, 0x10
jmp 0x7b1172
mov esi, 3
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
test eax, eax
jle 0x7b1165
xor ecx, ecx
mov cl, byte [ebx]
cmp ecx, 0xd
je 0x7b115b
xor ecx, ecx
mov cl, byte [ebx]
cmp ecx, 0xa
je 0x7b115b
xor ecx, ecx
mov cl, byte [ebx]
movzx ecx, byte [ecx + 0x87313c]
cmp ecx, 0x40
sete cl
and ecx, 1
sub esi, ecx
mov ecx, dword [ebp - 0xc]
shl ecx, 6
movzx edi, byte [ebx]
movzx edi, byte [edi + 0x87313c]
and edi, 0x3f
or ecx, edi
mov dword [ebp - 0xc], ecx
inc edx
cmp edx, 4
jne 0x7b115b
xor edx, edx
test esi, esi
jle 0x7b1138
mov ecx, dword [ebp - 0xc]
shr ecx, 0x10
mov edi, dword [ebp - 0x10]
mov byte [edi], cl
inc dword [ebp - 0x10]
cmp esi, 1
jle 0x7b114b
mov ecx, dword [ebp - 0xc]
shr ecx, 8
mov edi, dword [ebp - 0x10]
mov byte [edi], cl
inc dword [ebp - 0x10]
cmp esi, 2
jle 0x7b115b
mov cl, byte [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov byte [edi], cl
inc dword [ebp - 0x10]
dec eax
inc ebx
test eax, eax
jg 0x7b10de
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7c3da8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x7c3ed4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004e7884
xor eax, eax
push ebp
push 0x7c3ead
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004e7cbc
test al, al
je 0x7c3e8f
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.007c3c80
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040b1ec
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x7c3e8f
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040becc
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004e77e4
test al, al
je 0x7c3e8b
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040becc
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040bf2c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.007c3c80
pop ecx
inc edi
dec ebx
jne 0x7c3e33
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c3eb4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004e7884
pop eax
jmp eax
Function at 0x7c3ee4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x7c413c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004e7884
xor eax, eax
push ebp
push 0x7c4110
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004e7cbc
test al, al
je 0x7c40f2
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040b1ec
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x7c40f2
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040becc
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004e77e4
test al, al
je 0x7c40e6
mov eax, dword [ebp - 4]
call fcn.0040becc
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040bf2c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004e8634
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x7c40e6
xor eax, eax
push ebp
push 0x7c40df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004e7884
xor eax, eax
push ebp
push 0x7c40bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040becc
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040bf2c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004e7888
mov eax, dword [ebp - 4]
call fcn.0040becc
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040bf2c
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004e8634
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x7c409a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.007c3da8
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.007c3ee4
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c40a1
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x7c3f6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c4117
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004e7884
pop eax
jmp eax