joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c81d739
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 0xc]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 4], ebx
je 0x7c81d7dd
cmp dword [esi + 0x20], ebx
je 0x7c81d784
cmp dword [esi + 0x2c], 0xffffffff
push edi
jne 0x7c81df9b
push 0x8000
lea edi, [esi + 0x28]
push edi
lea eax, [esi + 0x20]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov dword [edi], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
pop edi
cmp byte [esi + 0x1a], bl
je 0x7c81d7b5
or dword [ebp - 0x14], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov eax, dword fs:[0x18]
push dword [eax + 0x24]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x14]
call dword [sym.imp.ntdll.dll_NtUnlockFile]
push dword [esi + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 4], ebx
jl 0x7c81d7c6
mov dword [ebp - 4], eax
mov dword [esi + 0x14], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
cmp byte [esi + 0x18], bl
je 0x7c81d766
mov dword [ebp - 8], ebx
mov eax, dword [esi + 0x2c]
push 0x7c885604
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x30]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [esi + 0x20]
sub edi, eax
push edi
add ecx, eax
push ecx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push dword [esi + 0x14]
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x7c81d766
cmp dword [ebp - 0x18], edi
jne 0x7c83b7b2
mov eax, dword [esi + 0x1c]
push 0x14
mov dword [ebp - 0x14], eax
push 8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x10], ebx
push dword [esi + 0x14]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 4], eax
jmp 0x7c81d766
jne 0x7c83b7d2
xlatb
movsd dword es:[edi], dword [esi]
jne 0x7c83b75e
cmp ecx, dword [eax + 0x1dc1123e]
dec eax
invalid
Function at 0x7c81e079
Capabilities:
Check for peb beingdebugged flag
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
xor ebx, ebx
call fcn.7c81d7eb
mov edi, eax
test edi, edi
jl 0x7c8368bc
push esi
mov byte [ebp - 1], 0
call fcn.7c81da1d
mov edi, eax
xor edx, edx
cmp edi, edx
jge 0x7c81e28e
cmp dword [esi], 3
je 0x7c8359d3
cmp byte [ebp - 1], 0
jne 0x7c81e0c4
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
cmp byte [eax + 0x19], 0
lea eax, [ebp - 0x18]
jne 0x7c83bfdd
push edx
push eax
push esi
call fcn.7c80f833
test al, al
je 0x7c83c048
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
lea ebx, [ebx + eax + 3]
mov byte [ebp + 0xb], 1
xor edx, edx
mov eax, dword [esi + 0xc]
cmp byte [eax + 0x19], 0
lea eax, [ebp - 8]
push eax
jne 0x7c83c01c
push edx
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.7c81deed
test al, al
je 0x7c83c048
dec dword [ebp - 8]
test ebx, ebx
je 0x7c8333a5
add ebx, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ecx, [ebx + 2]
push ecx
push dword [0x7c8856d4]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x7c83c052
mov eax, dword [esi + 0xc]
cmp byte [eax + 0x19], 0
mov eax, edi
jne 0x7c83c05c
cmp byte [ebp - 1], 0
jne 0x7c8368fd
cmp byte [ebp + 0xb], 0
je 0x7c81e18d
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 4]
movzx edx, word [edx]
test edx, edx
je 0x7c81e189
mov dword [ebp - 0x1c], edx
mov dl, byte [ecx]
mov byte [eax], dl
inc eax
inc ecx
dec dword [ebp - 0x1c]
jne 0x7c81e17e
mov byte [eax], 0x3d
inc eax
mov edx, dword [ebp - 8]
test edx, edx
mov ecx, dword [ebp - 0x20]
je 0x7c81e1a3
mov bl, byte [ecx]
mov byte [eax], bl
inc eax
inc ecx
dec edx
jne 0x7c81e197
mov ebx, dword [ebp - 0xc]
cmp byte [ebp + 0xb], 0
je 0x7c81e1b0
mov byte [eax], 0xd
mov byte [eax + 1], 0xa
push ebx
push edi
push 0
push dword [ebp - 0x10]
push esi
call fcn.7c81e1e2
mov esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [esi + 0xc]
cmp byte [eax + 0x19], 0
jne 0x7c83bff8
cmp dword [esi], 3
jne 0x7c833390
push esi
call fcn.7c835929
push edx
push edx
push eax
mov eax, dword [esi + 0x84]
push dword [eax + 4]
push esi
call fcn.7c81e1e2
jmp 0x7c81e1d6
inc ebp
scasd eax, dword es:[edi]
ret 0x4241
pop edi
mov bh, 0x2e
fsubr qword [eax]
in eax, 0xcb
popfd
xor eax, 0x803924cc
mov ch, 0xa5
ja 0x7c8368fe
retf
inc eax
fld xword [esi + 0x1b]
vpand xmm6, xmm7, xmmword [ebp - 0x75]
jo 0x7c836902
js 0x7c836903
out 0x69, eax
push eax
mov edx, 0x886344f5
add esi, dword [ebx - 0x553bf3d5]
add dword [edx], 0x67d9f289
leave
push ecx
pushfd
adc al, byte [ebp + 0x5e50b6ef]
inc edi
iretd
sub al, 0x92
scasb al, byte es:[edi]
jle 0x7c83c031
mov bl, 0x1a
cmp edx, dword [ebp - 0x2db7cf1e]
jp 0x7c83bfe2
Function at 0x7c81e9ea
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x184
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0x40
jne 0x7c840692
push ebx
push edi
push 0
push 0x138
lea eax, [ebp - 0x184]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov eax, dword [0x7c88503c]
mov eax, dword [eax + 0x12c]
mov ebx, dword [0x7ffe02e8]
mul ebx
push 0x64
mov ecx, eax
pop eax
cmp dword [ebp - 0x158], eax
mov edi, edx
jb 0x7c81ea4b
mov eax, ebx
sub eax, dword [ebp - 0x158]
xor edx, edx
imul eax, eax, 0x64
div ebx
mov dword [esi + 0xc], edi
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov eax, dword [0x7c88503c]
mov eax, dword [eax + 0x12c]
mul dword [ebp - 0x158]
push 8
pop ecx
push 0xb
mov dword [esi + 0x10], eax
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
pop ecx
xor ebx, ebx
push ebx
lea edi, [ebp - 0x4c]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push 0x20
lea eax, [ebp - 0x20]
push eax
push 1
push 0xffffffffffffffff
mov dword [esi + 0x14], edx
call edi
push ebx
push 0x2c
lea eax, [ebp - 0x4c]
push eax
push 3
push 0xffffffffffffffff
call edi
mov edi, dword [ebp - 0x150]
mov dword [esi + 0x1c], ebx
mov ebx, dword [ebp - 0x10]
cmp ebx, edi
mov dword [esi + 0x18], edi
jb 0x7c8406a0
push dword [esi + 0x1c]
mov eax, dword [0x7c88503c]
push dword [esi + 0x18]
push 0
push dword [eax + 0x12c]
call sub.ntdll.dll__allmul
sub edi, dword [ebp - 0x154]
sub ebx, dword [ebp - 0x28]
mov dword [esi + 0x18], eax
mov eax, edi
xor edi, edi
xor ecx, ecx
cmp ebx, eax
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edi
jbe 0x7c81eaf3
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
push dword [esi + 0x24]
mov eax, dword [0x7c88503c]
push dword [esi + 0x20]
push edi
push dword [eax + 0x12c]
call sub.ntdll.dll__allmul
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
mov eax, dword [0x7c88503c]
mov ecx, dword [eax + 0x144]
sub ecx, dword [eax + 0x140]
mov eax, dword [ebp - 0x48]
inc ecx
mov dword [esi + 0x28], ecx
mov edx, dword [esi + 0x28]
xor ecx, ecx
sub edx, eax
mov eax, edi
sbb eax, ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
xor eax, eax
pop edi
mov dword [esi + 0x30], edx
inc eax
pop ebx
pop esi
leave
ret 4
Function at 0x7c8200af
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0x10000003
cmp eax, 3
je 0x7c83ccc1
mov eax, dword [ebp + 0x18]
sub eax, 0
jne 0x7c820122
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
jg 0x7c8200f1
jl 0x7c83cccc
test ecx, ecx
jb 0x7c83cccc
push 0xe
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jl 0x7c82017d
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x7c82011a
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
xor eax, eax
inc eax
pop esi
leave
ret 0x14
dec eax
jne 0x7c82014e
push 0xe
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x7c82017d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
add ecx, eax
mov eax, dword [ebp - 4]
adc eax, edx
jmp 0x7c8200d9
dec eax
jne 0x7c83ccc8
push 5
push 0x18
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x7c82017d
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
adc eax, dword [ebp + 0x10]
jmp 0x7c8200d9
push eax
jmp 0x7c83ccd8
invalid
outsd dx, dword [esi]
aaa
xchg dword [edi + 0x6d], esi
insd dword es:[edi], dx
sub bh, byte [esp + esi*2]
insb byte es:[edi], dx
sbb esp, edi
push ebp
mov ch, dh
cmp esp, dword [eax]
fmulp st(7)
or ah, al
pop esp
jmp 0xe84e04c5
Function at 0x7c827515
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x18]
push 0x23
push 8
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x7c83d4e2
test byte [esi + 1], 4
jne 0x7c83d4fb
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 1
pop esi
leave
ret 0x14
push ebp
jecxz 0x7c83d544
sal edi, cl
retf 0x44f6
cdq

Function at 0x7c82758c
Capabilities:
Get number of processors

Disassembly:
mov eax, dword [ebp - 0x454]
cmp eax, 0xffffffff
je 0x7c82759f
mov ecx, dword [ebp - 0x5ac]
mov dword [ecx], eax
cmp dword [ebp - 0x460], ebx
jne 0x7c83ec3a
cmp dword [ebp - 0x464], ebx
je 0x7c8275c1
push dword [ebp - 0x464]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, dword fs:[0x18]
push dword [ebp - 0x558]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
call esi
mov eax, dword fs:[0x18]
push dword [ebp - 0x5c0]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
mov eax, dword fs:[0x18]
push dword [ebp - 0x514]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
lea eax, [ebp - 0x228]
cmp dword [ebp - 0x584], eax
je 0x7c8276c3
ret
mov eax, dword fs:[0x18]
lea edi, [eax + 0xc00]
push 0x41
pop ecx
lea esi, [ebp - 0x228]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x7c827618
add al, 0xbf

Function at 0x7c827aeb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ax, word [0x7c885610]
push esi
mov esi, dword [ebp + 8]
movzx ecx, word [esi]
mov word [ebp - 8], ax
movzx eax, ax
sub ecx, eax
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
shr ecx, 1
lea eax, [eax + ecx*2]
push 1
mov dword [ebp - 4], eax
push 0x7c885610
lea eax, [ebp - 8]
push eax
call edi
test al, al
jne 0x7c8453a7
mov ax, word [0x7c885608]
movzx ecx, word [esi]
mov word [ebp - 8], ax
movzx eax, ax
sub ecx, eax
mov eax, dword [esi + 4]
shr ecx, 1
lea eax, [eax + ecx*2]
push 1
mov dword [ebp - 4], eax
push 0x7c885608
lea eax, [ebp - 8]
push eax
call edi
test al, al
jne 0x7c8453af
mov ax, word [0x7c885114]
movzx ecx, word [esi]
mov word [ebp - 8], ax
movzx eax, ax
sub ecx, eax
mov eax, dword [esi + 4]
shr ecx, 1
lea eax, [eax + ecx*2]
push 1
mov dword [ebp - 4], eax
push 0x7c885114
lea eax, [ebp - 8]
push eax
call edi
neg al
sbb eax, eax
neg eax
pop edi
pop esi
leave
ret 8
xchg esp, eax
fmul qword [edi - 0x46c1669]
push ecx
sub dword [esi], esi
cmp dword [ebx - 0x27], ecx
invalid
Function at 0x7c82a5af
Capabilities:
Get process heap force flags
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push 0x7c887218
push 1
lea eax, [ebp - 4]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x7c82a664
push esi
push edi
mov edi, dword [ebp + 0xc]
add edi, 0x10
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x7c82a652
lea eax, [ebp - 8]
push eax
push edi
push esi
push 2
push 0x7c887300
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jl 0x7c82a63b
cmp dword [esi + 4], 3
jne 0x7c82a63b
lea edi, [esi + 0xc]
push edi
call fcn.7c8153f6
test eax, eax
je 0x7c82a63b
push dword [esi + 8]
push edi
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_memmove]
xor ebx, ebx
add esp, 0xc
inc ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, ebx
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x7c82a65f
Function at 0x7c82abfb
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7c8856cc]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], esi
jne 0x7c82ac3a
lea eax, [ebp - 0x18]
push eax
push esi
push edi
call fcn.7c80f833
test al, al
je 0x7c83bac5
mov esi, dword [ebp - 0x18]
cmp dword [ebp - 0x20], 0
jne 0x7c82ac52
push esi
push ebx
call fcn.7c81ba6e
test eax, eax
mov dword [ebp - 0x20], eax
je 0x7c83bacf
lea eax, [ebp - 0x18]
push eax
push 0
push edi
call fcn.7c80f7f6
test al, al
je 0x7c83bac5
lea eax, [ebp - 0x1c]
push eax
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push edi
call fcn.7c81baa3
xor ebx, ebx
cmp eax, ebx
jl 0x7c82ad05
cmp dword [ebp - 0x1c], 0xffffffff
je 0x7c82ad05
lea eax, [ebp - 0x28]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
cmp eax, ebx
jge 0x7c82aca8
cmp eax, 0x80000005
jne 0x7c82acb2
cmp dword [ebp - 0x10], 1
jne 0x7c83bad9
mov eax, dword [edi]
cmp eax, 2
jne 0x7c82cc36
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
call fcn.7c81deed
test al, al
je 0x7c83baf3
push dword [ebp - 0x18]
push dword [ebp - 0x24]
push 1
push ebx
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
cmp esi, ebx
jl 0x7c82ad03
mov eax, dword [ebp - 0x20]
test byte [eax + 0xc], 1
jne 0x7c83bacf
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.7c8097aa
leave
ret 0x10
cmp eax, 7
je 0x7c82acbd
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov esi, eax
cmp esi, 0xc0000034
jne 0x7c82ace9
jmp 0x7c83baec
xlatb
out 0x2a, eax
or dword [edx], 0x4f
xchg dword [edx - 0x7c], eax
sub dword [edi], edi
aas
salc
push esi
xor byte [ebp + 0x31], dh
sub dword [esi + 0x66], ebp
jns 0x7c83baf3
sbb ebp, edx
idiv byte [eax + 0x7d]
aad 0xf6
js 0x7c83bb5b
xchg esp, eax
xor dword [ebp + 0x372697b1], 0xffffffa0
and eax, 0x49b0854f
inc ecx
dec ebx
push ecx
cmpsd dword [esi], dword es:[edi]
and bh, byte [ebx]
or esp, dword [ebx]
ljmp 0xbe0e
Function at 0x7c82ad63
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x18]
and dword [ebp - 4], 0
test eax, eax
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ecx, dword [esi + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [esi + 0xc]
mov ebx, 0x7c82adec
mov dword [ebp + 0x18], eax
mov dword [ebp - 8], ecx
je 0x7c82adaf
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push 2
call fcn.7c809724
test eax, eax
jl 0x7c83cda6
mov eax, dword [ebp - 4]
test eax, eax
jne 0x7c83cda9
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x18]
push ebx
push 0
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov esi, eax
mov eax, 0xc0000000
mov ecx, esi
and ecx, eax
cmp ecx, eax
je 0x7c83cdb6
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 0x14
inc eax
push ecx
mov byte [edi], 0xa4
pop es
movsb byte es:[edi], byte [esi]
invalid
invalid
Function at 0x7c82be40
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
or eax, 0xffffffff
cmp dword [ebp + 0xc], eax
je 0x7c840ae2
push eax
push 0xffffd8f0
push 0
push dword [ebp + 0xc]
call sub.ntdll.dll__allmul
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
push 0x1b
lea eax, [ebp - 8]
mov dword [ebp + 0xc], eax
push 4
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jl 0x7c840aea
xor eax, eax
inc eax
leave
ret 8
movsd dword es:[edi], dword [esi]
dec dword [ecx - 0x6da44c59]
xor al, 0x7e
ret

Function at 0x7c82c3d7
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0xc
lea eax, [ebp - 0xc]
push eax
push 0x1c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x7c83b172
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
movzx eax, byte [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
inc eax
leave
ret 0xc
adc ebp, dword [ebx]
rcl byte [ebx], 0xc6
sub al, 0xf9
or byte [ebx + 0x2a], bh
fisubr dword [ebx - 0x7888a468]
or al, 0x6d
cmp dword [0xda07aea3], ecx
adc eax, dword [esi + 0x468d759e]
xor byte [ebp - 0x459f4496], 0xb5
fadd qword [ebp - 0x53de9e03]
aam 0xa6
cmpsb byte [esi], byte es:[edi]

Function at 0x7c82cce1
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x7c8856cc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi + 0xc]
mov dword [ebp - 4], eax
test esi, esi
jne 0x7c83bb11
mov edi, dword [edi + 0x10]
test edi, edi
je 0x7c83bb39
lea eax, [ebp - 0x20c]
push eax
push 0
push ebx
call fcn.7c80f7f6
test al, al
je 0x7c83bb43
lea eax, [ebp - 0x208]
push eax
push 1
push dword [ebp - 0x20c]
push edi
push ebx
call fcn.7c81baa3
test eax, eax
jl 0x7c82cde1
cmp dword [ebp - 0x208], 0xffffffff
je 0x7c82cde1
lea eax, [ebp - 0x218]
push eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push dword [ebp - 0x208]
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
mov esi, eax
test esi, esi
jl 0x7c82cdc4
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x210], eax
mov ax, word [ebp - 0x1fc]
mov word [ebp - 0x214], ax
mov word [ebp - 0x212], ax
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x208]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov esi, eax
cmp esi, 0xc0000034
je 0x7c83bb4d
test esi, esi
jge 0x7c82cd55
cmp esi, 0x8000001a
jne 0x7c82cdce
xor esi, esi
push dword [ebp - 0x208]
call dword [sym.imp.ntdll.dll_NtClose]
call fcn.7c81ba20
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.7c8097aa
leave
ret 8
sar dword [ebp - 0x47], 1
cmp eax, 0xfb0e9089
inc edi
sahf
dec esp
ljmp 0x5fb
and eax, 0xdd5fa983
sti
rol byte [eax], 0x3f

Function at 0x7c82d01f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 0xc], eax
jne 0x7c841f8f
leave
ret 0xc
Function at 0x7c82d903
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0x28
push 0x7c82d9d8
call fcn.7c8024d6
push dword [ebp + 8]
call fcn.7c80e114
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x7c82da10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp + 0x10]
lea eax, [edi - 1]
mov word [ebp - 0x36], ax
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x2e], bx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x36]
lea eax, [eax + eax + 2]
mov word [ebp - 0x2e], ax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x24], eax
movzx ecx, word [ebp - 0x2e]
push ecx
push dword [0x7c8856d4]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x7c845b48
push edi
push eax
push dword [esi + 4]
call sym.KERNEL32.dll_GetVolumePathNameW
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x7c82d9bd
push dword [ebp - 0x2c]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x30]
push ebx
push eax
lea eax, [ebp - 0x38]
push eax
cmp dword [0x7c8856e0], ebx
je 0x7c82da08
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x7c845b51
movzx eax, word [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov byte [eax + ecx], bl
or dword [ebp - 4], 0xffffffff
call fcn.7c82d9e9
mov eax, dword [ebp - 0x20]
call fcn.7c802511
ret 0xc
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
jmp 0x7c82d9a8
xor eax, eax
jmp 0x7c82d9c9

Function at 0x7c82eecc
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x10]
mov esi, dword [ebp + 8]
cmp ecx, esi
je 0x7c838d9a
and dword [ebp - 4], 0
push 0x8000
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x10]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop esi
leave
ret 4
invalid
ret
jg 0x7c838df5
pop ds
jp 0x7c838d50
salc
in eax, 0x6d
inc edx
sbb al, byte [edx + 0x5e7514de]
mov dl, 0xac
out dx, eax
sbb ebx, dword [0x49ab6525]
dec ebx
jge 0x7c838ded
sal byte [edi + 0x770f7ea0], 0x36
dec ebx
jge 0x7c838d63
int 0x4f
xor eax, 0x65402ac7
inc ecx
jne 0x7c838dd5
cmc
sub bl, bh
in eax, 4
or dl, byte [ebp + 0x55]
mov edx, 0x7c59d042
cmp dword [ecx], eax
mov byte [0x1eabf204], al
pop ecx
jl 0x7c838e11
add dword [edx + 0x1eabf204], esp
das
cmc
fadd st(0), st(0)
aas
jmp 0x3649131a
mov cl, 0x99
adc dword [ecx - 0x15], 0xffffffb5
leave
scasd eax, dword es:[edi]
sar ah, 1
ror esi, 1
push ebx
mov esi, 0x16e067d2
push ss
mov edi, 0x6d671751
sahf
fmul qword [edx]
jo 0x7c838dfe
popfd
adc esp, dword [eax - 0x7a]
push 0x921fa24c
pop ds
xchg edx, eax
xor byte [esi - 0x239791d4], ah
cld
pop ebp
inc edx
invalid