joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10007073
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10007073
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10007073
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10007073
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10007073
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10007073
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10007073
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10007073
push 0xd008
push edi
call fcn.10007073
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10007073
int3

Function at 0x10007073
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10007082
pop dword [ebp - 0x50]
mov eax, 0xc3a33422
add eax, 0x4c5d3c60
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x36ddd
push 0
mov eax, 0x3e338b0e
sub eax, 0x2e324aaa
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x88a4a3f3
add ecx, 0x775b9b66
mov esi, eax
mov edi, 0xc140b641
sub edi, 0xb13f3041
add edi, dword [ebp - 0x50]
mov ebx, 0x3eecbbac
add ebx, 0x1c635131
add dword [ebp - 0x24], edi
mov edx, dword [edi]
add dword [ebp - 8], eax
xor edx, ebx
sub dword [ebp - 0x34], esi
mov dword [esi], edx
add dword [ebp - 0x20], 0x44526138
add esi, 0x4b4b8a5c
add esi, 0xb4b475a8
add edi, 0x42bccf0c
add edi, 0xbd4330f8
loop 0x100070e1
add eax, 0xf037
xor ebx, ebx
add ebx, eax
add eax, 0x70af2291
sub eax, 0x70af228c
mov ecx, 0x428387db
sub ecx, 0x328387db
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x77c82974
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call sym.ADVAPI32.dll_RegQueryValueExW
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x77c82a38
push esi
push edi
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
je 0x77cd2986
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.ADVAPI32.dll_RegQueryValueExW
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x77cd29b4
cmp dword [ebp - 0xc], 2
jne 0x77c82a36
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push ebx
push dword [esi]
call edi
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x77cd298f
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x77cd2986
push dword [ebp + 8]
push eax
push dword [esi]
call edi
test eax, eax
je 0x77cd299d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
cmp dword [ebp - 4], ebx
jne 0x77cd29b4
pop edi
pop esi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0xc
mov dword [ebp - 4], 8
jmp 0x77cd29b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x77c82a2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x77c82a2d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], ebx
jmp 0x77c82a36
Function at 0x77c886b3
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ebp + 8]
cmp dword [eax + 0x180], ecx
je 0x77c88602
mov ecx, dword [ebx + 0x30]
inc dword [eax + 0x10]
push esi
mov dword [eax + 0x188], ecx
call fcn.77c98978
test eax, eax
jne 0x77cd533b
cmp dword [esi + 0x1f8], 0xffffffff
je 0x77c8862c
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [esi + 0x1fc]
push eax
push dword [esi + 0x21c]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x77c8877f
mov edi, dword [edi + 4]
add edi, 0x1d
cmp edi, dword [esi + 0x228]
jae 0x77c8877f
mov ebx, dword [esi + 0x224]
push dword [esi + 0x20c]
imul ebx, edi
call dword [sym.imp.ntdll.dll_NtClearEvent]
xor eax, eax
mov dword [esi + 0x208], eax
lea eax, [esi + 0x1fc]
push eax
push 0
push dword [esi + 0x224]
mov dword [esi + 0x204], ebx
push dword [ebp - 0xc]
push dword [esi + 0x21c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x77c88694
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x77cd5345
mov eax, edi
push 0x1d
cdq
pop ecx
idiv ecx
mov dword [esi + 0x1f8], edi
mov dword [esi + edx*8 + 0x240], edi
jmp 0x77c8877f
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
push esi
mov esi, dword [eax + 0x198]
test esi, esi
je 0x77cd530c
push edi
lea eax, [esi + 0x238]
push eax
call fcn.77c8859b
mov edi, eax
test edi, edi
je 0x77cd531c
push ebx
push edi
push esi
call fcn.77c887aa
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0xc], ebx
je 0x77cd532b
cmp dword [ebp + 0xc], 0
je 0x77c8871a
lea eax, [edi + 0x18]
push eax
push dword [ebp + 8]
call fcn.77c981f3
test eax, eax
mov dword [ebp - 8], eax
jne 0x77c8879e
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [edi + 8]
push ebx
call fcn.77c973ca
test eax, eax
je 0x77c88757
mov ecx, dword [ebp - 4]
test ecx, ecx
jbe 0x77c88757
cmp eax, 7
je 0x77cd5333
lea ecx, [edi + 0x18]
push ecx
push eax
push dword [edi + 8]
push ebx
push esi
call fcn.77c9749e
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add dword [edi + 8], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov dword [edi + 0x10], eax
cmp dword [ebp - 4], ecx
jbe 0x77c885dd
cmp dword [ebp - 8], ecx
jne 0x77c885dd
push edi
lea eax, [esi + 0x238]
push eax
push esi
call fcn.77c8854b
mov eax, dword [esi + 0x238]
test eax, eax
je 0x77c88a0e
mov edx, dword [eax + 0x28]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0x2c]
mov dword [ecx + 0xc], eax
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8
mov dword [esi + 0x220], 1
jmp 0x77c8879c
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
push 0x57
pop eax
jmp 0x77c887a0
mov dword [esi + 0x220], 1
jmp 0x77c8879f
push 0x20
pop eax
jmp 0x77c8879e
add dword [edi + 8], ecx
jmp 0x77c8871a
mov eax, 0x4c7
jmp 0x77c8879e
push 0
push dword [esi + 0x20c]
call dword [sym.imp.ntdll.dll_NtSetEvent]
or dword [esi + 0x1f8], 0xffffffff
jmp 0x77c8877f
Function at 0x77c88f1e
Capabilities:
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xfffffffffffffffe
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
je 0x77c88f66
push ebx
lea eax, [edi + 0x20]
push eax
call esi
test eax, eax
jne 0x77cd848e
and dword [ebp + 8], 0
push 4
lea eax, [ebp + 8]
push eax
push 0x16
push ebx
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x77cd849a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x77c88f53
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [ebp - 4], eax
je 0x77c88f76
push 0
add edi, 0x20
push edi
call esi
jmp 0x77c88f76
Function at 0x77c8a93d
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4

Function at 0x77c8b3cf
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x77d1a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov byte [ebp - 0xc], 0xa2
mov byte [ebp - 0xb], 0x17
mov byte [ebp - 0xa], 0x9c
mov byte [ebp - 9], 0x98
mov byte [ebp - 8], 0xca
xor eax, eax
mov cl, byte [ebp + 0x10]
xor byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 5
jb 0x77c8b3fe
lea eax, [ebp - 0xc]
push eax
push 5
lea eax, [ebp - 0x110]
push eax
call fcn.77c8a9ff
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x110]
push eax
call fcn.77c8b43c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.77cc744e
leave
ret 0xc

Function at 0x77c8b43c
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x77c8b54d
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x77ccc093
test eax, eax
jne 0x77ccc093
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x77c8b48c
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
jne 0x77ccc090
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
je 0x77c8b54d
jmp 0x77ccc093
Function at 0x77c8b772
Capabilities:
Query environment variable

Disassembly:
push 0x77c8b56c
push esi
push dword [ebp - 4]
call fcn.77c9e187
lea eax, [edi + 0x18]
push eax
jmp 0x77c8b8df
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
push edi
push 0x410
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
mov dword [ebp - 4], esi
je 0x77c8b9df
mov ebx, dword [ebp + 0xc]
mov eax, ebx
lea edi, [esi + 0x208]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x77c8b7b1
sub eax, edx
sar eax, 1
je 0x77c8b9c9
lea ebx, [ebx + eax*2]
dec ebx
dec ebx
cmp word [ebx], 0x5c
je 0x77c8b7d3
dec eax
jne 0x77c8b7c8
test eax, eax
je 0x77c8b9ae
push 0x77c8b968
mov esi, 0x104
inc ebx
push esi
inc ebx
push edi
mov dword [ebp - 0x14], ebx
call fcn.77c9e187
push ebx
push esi
push edi
call fcn.77ca0f32
lea eax, [ebp - 0xc]
push eax
push edi
push 0x80000002
mov byte [ebp + 0xf], 1
call sym.ADVAPI32.dll_RegOpenKeyW
test eax, eax
mov edi, dword [ebp + 8]
jne 0x77cd2ed4
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push 0x77c8b948
push dword [ebp - 0xc]
mov ebx, 0x208
mov dword [ebp - 8], ebx
call sym.ADVAPI32.dll_RegQueryValueExW
test eax, eax
je 0x77c8b85a
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push 0x77c8b934
push dword [ebp - 0xc]
mov dword [ebp - 8], ebx
call sym.ADVAPI32.dll_RegQueryValueExW
test eax, eax
jne 0x77c8b85e
mov byte [ebp + 0xf], 0
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
cmp byte [ebp + 0xf], 0
jne 0x77c8b9d7
cmp dword [ebp - 0x10], 2
jne 0x77cd2eb3
cmp dword [ebp - 8], 4
jb 0x77c8b9d7
mov ebx, dword [sym.imp.ntdll.dll__wcsnicmp]
push 0xc
push 0x77c8b918
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x77c8b756
cmp word [edi], 0x25
je 0x77c8b9d1
cmp dword [ebp - 8], 6
jbe 0x77c8b8bb
cmp word [edi + 2], 0x3a
je 0x77c8b9d1
push 4
push 0x77cb5cb4
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x77cd2ec2
push 0x77c8b56c
push esi
push dword [ebp - 4]
call fcn.77c9e187
push edi
push esi
push dword [ebp - 4]
call fcn.77ca0f32
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
push esi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
jmp 0x77c8b90f
mov ebx, dword [ebp - 0x14]
jmp 0x77c8b7d3
push edi
jmp 0x77cd2ec6
mov ebx, dword [ebp - 0x14]
jmp 0x77cd2ed4
xor edi, edi
jmp 0x77c8b90d
cmp dword [ebp - 0x10], 1
je 0x77c8b87b
jmp 0x77c8b9d7
lea eax, [edi + 8]
push eax
push esi
push dword [ebp - 4]
call fcn.77c9e187
jmp 0x77c8b8e8
push 0x77cd2f04
push esi
push dword [ebp - 4]
call fcn.77c9e187
push ebx
push esi
push dword [ebp - 4]
call fcn.77ca0f32
push 0x77cd2ef8
jmp 0x77c8b8df
Function at 0x77c8bc85
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 8
mov dword [esi], eax
pop ebx
mov dword [edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword fs:[0x18]
push 0x20
mov dword [ebp - 8], ebx
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
mov dword [ebp - 4], eax
je 0x77c8bcf3
lea eax, [ebp - 0xc]
push eax
push 0x18
push 0x77c8bd01
call dword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
test eax, eax
je 0x77cd2fdb
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov eax, dword [ebp - 4]
xor ebx, ebx
mov dword [esi], eax
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0
jne 0x77cd2fe8
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x77c8bce9
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x77c8bcf3

Function at 0x77c8c861
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x14], esi
push edi
je 0x77c8c952
cmp dword [ebp + 0x14], 0xffffffff
je 0x77c8c952
cmp dword [ebp + 0x18], esi
je 0x77c8c952
mov ecx, dword [ebp + 0x1c]
cmp ecx, esi
je 0x77c8c952
mov eax, dword [ebp + 0x24]
cmp eax, esi
je 0x77c8c952
mov ebx, dword [eax]
push dword [ebp + 0x18]
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], si
mov word [ebp - 0xe], si
mov dword [ebp - 0xc], esi
xor edi, edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov dword [ecx], esi
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
test al, al
je 0x77cd38ff
add ebx, 0x10
cmp dword [ebp - 4], ebx
jae 0x77c8c920
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x68
push 0x77c8c95c
call fcn.77c8c01b
mov esi, eax
test esi, esi
je 0x77c8c920
lea eax, [ebp - 8]
push eax
push ebx
push esi
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edi, eax
test edi, edi
mov ecx, 0x80000005
jge 0x77cd38bb
cmp edi, ecx
je 0x77cd38bb
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push esi
push dword [ebp + 0x10]
mov edi, eax
push dword [ebp + 0xc]
push 0x88
push 0x77c8c95c
call fcn.77c8c99c
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x20
push 0x57
jmp 0x77cd3901
test edi, edi
mov eax, dword [esi + 8]
mov edx, dword [ebp + 0x24]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov edx, dword [ebp + 0x1c]
mov dword [edx], eax
jl 0x77c8c920
cmp dword [ebp + 0x20], 0
je 0x77cd38f8
mov eax, dword [esi + 8]
cmp eax, dword [ebp - 4]
ja 0x77cd38f8
push eax
lea eax, [esi + 0xc]
push eax
push dword [ebp + 0x20]
call sub.ntdll.dll_memcpy
add esp, 0xc
xor edi, edi
jmp 0x77c8c920
mov edi, ecx
jmp 0x77c8c920
push 0xe
pop edi
jmp 0x77c8c949
Function at 0x77c8ceb9
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x20]
push ebx
push esi
mov esi, dword [ebp + 0x30]
push edi
lea ecx, [ebp - 4]
push ecx
push esi
push dword [ebp + 0x2c]
mov edi, eax
push dword [ebp + 0x28]
or eax, 4
push dword [ebp + 0x24]
xor ebx, ebx
push eax
push dword [ebp + 0x1c]
shr edi, 2
push dword [ebp + 0x18]
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
and edi, 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessInternalA]
test eax, eax
je 0x77ccd94f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 4
or eax, ecx
or edi, eax
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x77c8cf78
mov ecx, dword [esi]
test cl, 2
mov dword [ebp + 0x20], ebx
jne 0x77ccd964
cmp dword [ebp - 4], 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
jne 0x77c8cf73
push dword [ebp + 8]
push edi
call fcn.77ca221b
mov edi, eax
test edi, edi
je 0x77c8cf60
mov ebx, dword [ebp + 0x20]
test ebx, ebx
jne 0x77ccd990
cmp dword [ebp - 4], 0
jne 0x77ccd9a4
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x2c
push dword [ebp - 4]
jmp 0x77c8cf49
xor edi, edi
inc edi
jmp 0x77c8cf60
cmp dword [ebp - 4], ebx
je 0x77ccd95d
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
jmp 0x77c8cf6c
push eax
push ebx
mov ebx, 0x1fffff
push ebx
mov dword [ebp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [esi], eax
jne 0x77c8cf39
push dword [esi + 8]
push eax
push ebx
call fcn.77ce42db
mov dword [esi], eax
jmp 0x77c8cf39
mov eax, dword [esi]
test eax, eax
je 0x77ccd99d
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [esi], ebx
jmp 0x77c8cf60
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x77c8cf6a
Function at 0x77c8e7a5
Capabilities:
Write file on windows

Disassembly:
mov dword [ebp - 0x54], esi
jmp 0x77c8e83b
mov eax, 0x427
jmp 0x77c8e8bb
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x77d1a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xd
pop ecx
mov esi, 0x77c8e8fc
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp + 8]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
cmp dword [0x77d1e644], esi
stosd dword es:[edi], eax
jne 0x77c82452
lea eax, [ebp - 0x58]
push eax
push 1
push esi
push 0x77c8e8cc
push 0x80000002
call sym.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x77c8245a
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push dword [ebp - 0x58]
mov dword [ebp - 0x60], 4
call sym.ADVAPI32.dll_RegQueryValueExA
push dword [ebp - 0x58]
mov edi, eax
call sym.ADVAPI32.dll_RegCloseKey
cmp edi, esi
jne 0x77c8245a
cmp dword [ebp - 0x5c], 4
jne 0x77c8245a
push 0xa
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x54]
call sub.ntdll.dll__itow
add esp, 0xc
push 0x3a98
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push esi
push 0x80
push 3
push esi
push 3
push 0xc0000000
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebx], eax
je 0x77c8245a
push esi
push esi
lea ecx, [ebp - 0x64]
push ecx
push eax
mov dword [ebp - 0x64], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
cmp eax, 1
jne 0x77cd8466
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x68]
push eax
push 4
lea eax, [ebp - 0x54]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cc744e
leave
ret 4
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x77c8245a
Function at 0x77c8f4c1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call edi
cmp eax, 1
jne 0x77cd8681
cmp dword [ebp - 4], 0x28
jbe 0x77c8f882
mov eax, dword [ebx + 4]
cmp eax, 0xb
jb 0x77c8f525
cmp eax, 0xe
ja 0x77c8f845
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp - 4]
push ebx
call fcn.77c8f78b
test eax, eax
jne 0x77c8f527
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
add eax, 0xffffffb0
cmp eax, 1
ja 0x77c8f525
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp - 4]
push ebx
call fcn.77c8f78b
test eax, eax
jne 0x77c8f527
push dword [esi]
push ebx
call fcn.77c8f8a2
jmp 0x77c8f525
cmp eax, 0x50
je 0x77c8f86b
jmp 0x77c8f525
push 0xd
pop eax
jmp 0x77c8f527
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x77c8f527
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp - 4]
push ebx
call fcn.77c8f78b
test eax, eax
mov dword [ebp + 0xc], eax
je 0x77cd86c6
push dword [ebp + 8]
call fcn.77d07f8e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi], 0
mov eax, dword [ebp + 0xc]
jmp 0x77c8f527
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
cmp eax, 1
jne 0x77cd86f5
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 4], eax
jb 0x77cd8707
mov eax, dword [ebx + 4]
cmp eax, 0x51
jne 0x77c8f878
jmp 0x77c8f86b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 8]
mov edi, eax
call fcn.77d07f8e
jmp 0x77cd870a
push 0x18
pop edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi], 0
mov eax, edi
jmp 0x77c8f527
Function at 0x77c92e35
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4