joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7333c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.000144b8
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x73362
test byte [ebp - 0xc], 0x10
jne 0x73366
xor eax, eax
jmp 0x73368
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x73374
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.000144b8
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x7339a
test byte [ebp - 0xc], 0x10
je 0x7339e
xor eax, eax
jmp 0x733a0
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x733ac
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
call fcn.000144b8
push eax
call sub.kernel32.dll_CreateDirectoryW
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
call sub.kernel32.dll_GetLastError_1
mov dword [0xe72c8], eax
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x7373c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, 0x400
call fcn.000793dc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x7379e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00078a68
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00078aa4
push eax
call sub.advapi32.dll_GetUserNameW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00078a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x737a5
lea eax, [ebp - 0xc]
call fcn.00079400
ret

Function at 0x737b4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, 0x400
call fcn.000793dc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x73818
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00078a68
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00078aa4
push eax
push 2
call sub.secur32.dll_GetUserNameExW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00078a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7381f
lea eax, [ebp - 8]
call fcn.00079400
ret
Function at 0x73824
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014294
mov eax, pe_nt_image_headers32
call fcn.000793dc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x738a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00078a68
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00078aa4
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x7387e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00078a84
jmp 0x7388b
mov eax, dword [ebp - 4]
mov edx, 0x738b0
call fcn.000142d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x738a8
lea eax, [ebp - 8]
call fcn.00079400
ret

Function at 0x738e0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x73a54
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.00013c64
lea eax, [ebp - 0x20]
mov edx, 0x400
call fcn.000744bc
mov eax, 0x400
call fcn.000793dc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x73a37
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x400
mov eax, dword [ebp - 0x10]
call fcn.00078a68
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00078aa4
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.000144b8
push eax
push 0
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
je 0x73a09
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
call fcn.00013c64
xor eax, eax
push ebp
push 0x73a02
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_ConvertSidToStringSidA
test al, al
je 0x739e0
xor eax, eax
push ebp
push 0x739ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call fcn.00074694
mov ecx, eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
call fcn.00013d4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x739e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73a09
cmp dword [ebp - 0x1c], 0
je 0x739fc
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
mov dword [ebp - 0x1c], eax
ret
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.00013cb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73a3e
lea eax, [ebp - 0x10]
call fcn.00079400
lea eax, [ebp - 0x20]
mov edx, 0x400
call fcn.000744f8
ret
Function at 0x742c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x74371
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x74354
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0xe72dc]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0xc]
call fcn.000694a0
mov eax, dword [ebp - 0xc]
call fcn.000140a8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x74332
push 0x74380
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7435b
cmp dword [ebp - 8], 0
je 0x7434e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0x743a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x74486
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x74469
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0xe72dc]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.000694a0
mov eax, dword [ebp - 0x18]
call fcn.000140a8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x74447
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x74494
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x74447
cmp dword [ebp - 0xc], 4
jne 0x74447
cmp dword [ebp - 0x14], 1
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x74470
cmp dword [ebp - 0x10], 0
je 0x74463
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret

Function at 0x748ac
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.000140a8
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x748db
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x749cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, 0x400
call fcn.00079390
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x74a63
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.000788b0
push eax
mov eax, dword [ebp - 0xc]
call fcn.000788ec
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x74a40
mov eax, dword [ebp - 0xc]
call fcn.000788b0
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
cdq
cmp edx, dword [esp + 4]
jne 0x74a2f
cmp eax, dword [esp]
pop edx
pop eax
jae 0x74a40
jmp 0x74a33
pop edx
pop eax
jge 0x74a40
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.000788cc
jmp 0x74a4d
mov eax, dword [ebp - 4]
mov edx, 0x74a78
call fcn.00013cb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x74a6a
lea eax, [ebp - 0xc]
call fcn.000793b4
ret

Function at 0x74a7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0x74b20
call fcn.000142d0
mov eax, 0x400
call fcn.000793dc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x74b11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00078aa4
push eax
mov eax, dword [ebp - 8]
call fcn.00078a68
push eax
call sub.kernel32.dll_GetTempPathW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x74afb
mov eax, dword [ebp - 8]
call fcn.00078a68
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
cdq
cmp edx, dword [esp + 4]
jne 0x74aec
cmp eax, dword [esp]
pop edx
pop eax
jae 0x74afb
jmp 0x74af0
pop edx
pop eax
jge 0x74afb
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00078a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x74b18
lea eax, [ebp - 8]
call fcn.00079400
ret
Function at 0x74dec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7505a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x7506c
call fcn.000142d0
xor eax, eax
push ebp
push 0x75018
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x74ff6
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
call fcn.000744bc
xor eax, eax
push ebp
push 0x74fef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x74fc9
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x75070
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x74fba
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
call fcn.00017df4
movzx eax, ax
lea edx, [ebp - 0x124]
call fcn.00012bbc
lea edx, [ebp - 0x124]
lea eax, [ebp - 0xc]
call fcn.00013e88
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 8]
call fcn.00012bbc
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x10]
call fcn.00013e88
push dword [ebp - 0xc]
lea edx, [ebp - 0x128]
mov eax, 0x75074
call fcn.00078120
push dword [ebp - 0x128]
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00013fa4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
call fcn.00017df4
movzx eax, ax
lea edx, [ebp - 0x124]
call fcn.00012bbc
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x10]
call fcn.00013e88
push dword [ebp - 0xc]
lea edx, [ebp - 0x12c]
mov eax, 0x75074
call fcn.00078120
push dword [ebp - 0x12c]
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00013fa4
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0xc]
call fcn.00012bbc
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x10]
call fcn.00013e88
push dword [ebp - 0xc]
lea edx, [ebp - 0x130]
mov eax, 0x75074
call fcn.00078120
push dword [ebp - 0x130]
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00013fa4
jmp 0x74fd6
lea edx, [ebp - 0xc]
mov eax, 0x75078
call fcn.00078120
jmp 0x74fd6
lea edx, [ebp - 0xc]
mov eax, 0x750b0
call fcn.00078120
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75003
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
call fcn.000744f8
ret
lea edx, [ebp - 0xc]
mov eax, 0x750c8
call fcn.00078120
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00014444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7502f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75061
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.00013c88
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00013c88
ret
Function at 0x75c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
xor eax, eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x75ece
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x75ea1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0xe72dc]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.000694a0
mov eax, dword [ebp - 0x14]
call fcn.000140a8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x75e7f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x75edc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x75e7f
cmp dword [ebp - 0x10], 4
jne 0x75e7f
mov eax, dword [ebp - 8]
mov dword [0xe72e0], eax
mov eax, dword [ebp - 8]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x118]
call fcn.0007476c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00013ec0
lea edx, [ebp - 0x114]
mov eax, 0xe72cc
mov cl, 0xb
call fcn.00012a00
shr dword [ebp - 8], 8
lea eax, [ebp - 0x120]
mov edx, 0xe72cc
call fcn.00013e88
push dword [ebp - 0x120]
lea edx, [ebp - 0x124]
mov eax, 0x75ef0
call fcn.00078120
push dword [ebp - 0x124]
mov eax, dword [ebp - 8]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x128]
call fcn.0007476c
push dword [ebp - 0x128]
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.00013fa4
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00013ec0
lea edx, [ebp - 0x114]
mov eax, 0xe72cc
mov cl, 0xb
call fcn.00012a00
shr dword [ebp - 8], 8
lea eax, [ebp - 0x130]
mov edx, 0xe72cc
call fcn.00013e88
push dword [ebp - 0x130]
lea edx, [ebp - 0x134]
mov eax, 0x75ef0
call fcn.00078120
push dword [ebp - 0x134]
mov eax, dword [ebp - 8]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x138]
call fcn.0007476c
push dword [ebp - 0x138]
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.00013fa4
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00013ec0
lea edx, [ebp - 0x114]
mov eax, 0xe72cc
mov cl, 0xb
call fcn.00012a00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75ea8
cmp dword [ebp - 0xc], 0
je 0x75e9b
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x76b18
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, 0x76bec
call fcn.00078120
mov eax, 0x400
call fcn.00079390
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x76bde
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.000788b0
push eax
mov eax, dword [ebp - 8]
call fcn.000788ec
push eax
push 0x76bf8
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jb 0x76b88
mov eax, dword [ebp - 8]
call fcn.000788b0
cmp eax, dword [ebp - 0xc]
jb 0x76b88
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.000788cc
jmp 0x76bc8
mov eax, dword [ebp - 8]
call fcn.00078874
mov eax, dword [ebp - 8]
call fcn.000788b0
push eax
mov eax, dword [ebp - 8]
call fcn.000788ec
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jb 0x76bc8
mov eax, dword [ebp - 8]
call fcn.000788b0
cmp eax, dword [ebp - 0xc]
jb 0x76bc8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.000788cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76be5
lea eax, [ebp - 8]
call fcn.000793b4
ret

Function at 0x76c00
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0x76cd8
call fcn.000142d0
mov eax, 0x400
call fcn.000793dc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x76cc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00078a68
push eax
mov eax, dword [ebp - 8]
call fcn.00078aa4
push eax
push 0x76cf0
call sub.kernel32.dll_GetEnvironmentVariableW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jb 0x76c70
mov eax, dword [ebp - 8]
call fcn.00078a68
cmp eax, dword [ebp - 0xc]
jb 0x76c70
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00078a84
jmp 0x76cb0
mov eax, dword [ebp - 8]
call fcn.00078a2c
mov eax, dword [ebp - 8]
call fcn.00078a68
push eax
mov eax, dword [ebp - 8]
call fcn.00078aa4
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jb 0x76cb0
mov eax, dword [ebp - 8]
call fcn.00078a68
cmp eax, dword [ebp - 0xc]
jb 0x76cb0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00078a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76ccd
lea eax, [ebp - 8]
call fcn.00079400
ret
Function at 0x76db4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x76e56
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0xe72dc]
add eax, 0xf003f
push eax
push 0
push 0x76e64
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x76e34
cmp dword [ebp - 8], 0
jne 0x76e34
push 0x76e9c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x76eac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x76ec0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x76ed0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76e5d
cmp dword [ebp - 4], 0
je 0x76e50
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
ret

Function at 0x77080
Capabilities:
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014294
xor eax, eax
mov dword [ebp - 8], eax
mov eax, 0x400
call fcn.000793dc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x7718e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0xe72dc]
add eax, 0x20019
push eax
push 0
push 0x7719c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x7714e
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x771e0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.00078ac0
test eax, eax
jne 0x7714e
cmp dword [ebp - 0x10], 1
jne 0x7714e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00078a84
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0007333c
test al, al
jne 0x7714e
mov eax, dword [ebp - 0x14]
call fcn.00078a2c
mov eax, dword [ebp - 0x14]
call fcn.00078a68
push eax
mov eax, dword [ebp - 0x14]
call fcn.00078aa4
push eax
push 0x77200
call sub.kernel32.dll_GetEnvironmentVariableW
cmp eax, 3
jbe 0x7714e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00078a84
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0007333c
test al, al
jne 0x77164
mov eax, dword [ebp - 4]
call fcn.00074a7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x77195
cmp dword [ebp - 8], 0
je 0x77180
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
call fcn.00079400
ret
Function at 0x77220
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014294
xor eax, eax
mov dword [ebp - 8], eax
mov eax, 0x800
call fcn.000793dc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x772d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0xe72dc]
add eax, 0x20019
push eax
push 0
push 0x772e4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x772ac
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x77328
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00078ac0
test eax, eax
jne 0x772ac
cmp dword [ebp - 0x10], 1
jne 0x772ac
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00078a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x772dd
cmp dword [ebp - 8], 0
je 0x772c8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
call fcn.00079400
ret

Function at 0x77988
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebp
push 0x77a61
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.000144b8
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x14], eax
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp - 8]
mov dword [edx], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x779fa
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
jmp 0x77a3d
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 0x18], eax
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x77a2f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.00077948
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x77a3d
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x77a68
cmp dword [ebp - 0x14], 0xffffffff
je 0x77a59
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 0x14], 0xffffffff
ret