joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0278
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
xor ebx, ebx
push 0
push 0
push 0
push edi
call fcn.004072e0
push 0
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call fcn.00407280
test eax, eax
je 0x4d0315
cmp word [esi], 0x5a4d
jne 0x4d0315
push 0
push 0
mov eax, dword [esi + 0x3c]
push eax
push edi
call fcn.004072e0
push 0
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00407280
test eax, eax
je 0x4d0315
cmp dword [ebp - 0x1c], 0x4550
jne 0x4d0315
lea edx, [ebp - 0x18]
mov ecx, 0x14
mov eax, dword [ebp + 0xc]
call fcn.00407cdc
mov ax, word [ebp - 0x18]
cmp ax, 0x14c
jb 0x4d0315
cmp ax, 0x150
ja 0x4d0315
push 0
lea eax, [ebp - 4]
push eax
push 0xe0
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.00407280
test eax, eax
je 0x4d0315
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d628c
Capabilities:
Parse pe header

Disassembly:
push ebx
xor ecx, ecx
test edx, edx
je 0x4d62b4
mov ebx, edx
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4d62b4
add ebx, dword [eax + 0x3c]
mov eax, ebx
cmp dword [eax], 0x4550
jne 0x4d62b4
cmp word [eax + 0x18], 0x20b
sete cl
mov eax, ecx
pop ebx
ret

Function at 0x4d62b8
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
test esi, esi
je 0x4d6311
mov edi, esi
push 0x40
push edi
call fcn.004071f0
test eax, eax
jne 0x4d6311
cmp word [edi], 0x5a4d
jne 0x4d6311
mov eax, dword [edi + 0x3c]
test eax, eax
jle 0x4d6311
cmp eax, 0x10000
jge 0x4d6311
add esi, eax
push 0x120
push esi
call fcn.004071f0
test eax, eax
jne 0x4d6311
cmp dword [esi], 0x4550
jne 0x4d6311
mov ax, word [esi + 0x18]
cmp ax, 0x10b
je 0x4d630f
cmp ax, 0x20b
jne 0x4d6311
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0xd3f708
Capabilities:
Encode data using xor

Disassembly:
jmp 0xd3f712
pushal
call 0xd3f718
pop ebp
sub ebp, 0x10
sub ebp, 0x93f708
jmp 0xd3f72e
mov eax, 0x93f708
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c2
mov edx, 0x2edb74a
xor byte [eax], dl
inc eax
dec ecx
jne 0xd3f745
jmp 0xd3f758
rol dword [edi + 0x4a76c3c1], 0x4a
dec edx
retf

Function at 0x1001609
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1001a90
call fcn.010017b4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1002370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10013c4
cmp eax, esi
jne 0x10013b7
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10013c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100139e
xor esi, esi
inc esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x10013da
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001409
mov eax, dword [0x100236c]
test eax, eax
jne 0x1001403
mov dword [0x100236c], esi
push 0x10010b8
push 0x10010ac
call fcn.01001300
pop ecx
pop ecx
test eax, eax
je 0x1001409
jmp 0x100152d
mov dword [0x1002034], esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x100142d
push 0x10010a8
push 0x10010a0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100236c], 2
cmp dword [ebp - 0x20], ebx
jne 0x100143a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1002374], ebx
je 0x100145b
push 0x1002374
call fcn.01001729
pop ecx
test eax, eax
je 0x100145b
push ebx
push 2
push ebx
call dword [0x1002374]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x100152d
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x10014c5
cmp cx, bx
je 0x1001480
cmp dword [ebp - 0x1c], ebx
jne 0x10014c5
movzx ecx, word [eax]
cmp cx, bx
je 0x1001495
cmp cx, 0x20
ja 0x1001495
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1001480
test byte [ebp - 0x40], 1
je 0x10014a1
movzx ecx, word [ebp - 0x3c]
jmp 0x10014a4
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1002030], eax
cmp dword [0x1002024], ebx
jne 0x100150a
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x10014d6
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x100146a
cmp dword [0x1002034], ebx
jne 0x1001518
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002030]
jmp 0x1001539
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010017f9
ret
call fcn.01001901
jmp 0x1001361
Function at 0x7c801812
Capabilities:
Read file on windows

Disassembly:
push 0x20
push 0x7c809c48
call fcn.7c8024d6
xor ebx, ebx
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
je 0x7c801829
mov dword [ecx], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [ebp + 8]
cmp edi, 0xfffffff4
je 0x7c8019e6
cmp edi, 0xfffffff5
je 0x7c8019db
cmp edi, 0xfffffff6
je 0x7c80189f
mov eax, edi
and eax, 0x10000003
cmp eax, 3
je 0x7c8018a7
mov esi, dword [ebp + 0x18]
cmp esi, ebx
jne 0x7c801962
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
je 0x7c80193c
cmp eax, ebx
jl 0x7c8019f1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [eax + 0x10]
mov edi, dword [eax + 0x18]
jmp 0x7c80184c
push dword [ebp + 0x18]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call sym.KERNEL32.dll_ReadConsoleA
test eax, eax
je 0x7c801a1c
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push edi
call sym.KERNEL32.dll_GetConsoleMode
test eax, eax
jne 0x7c8018d2
mov dword [ebp - 0x1c], ebx
test byte [ebp - 0x1c], 1
je 0x7c801912
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x7c8018e8
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
or dword [ebp - 4], 0xffffffff
push ebx
push ebx
push edi
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp eax, ebx
jl 0x7c8019f1
mov eax, dword [ebp - 0x28]
jmp 0x7c801884
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
jmp 0x7c801a16
mov ebx, 0x103
mov dword [esi], ebx
mov eax, dword [esi + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x10]
push 0
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
mov ecx, eax
and cl, 1
neg cl
sbb ecx, ecx
not ecx
and ecx, esi
push ecx
push 0
push eax
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
jl 0x7c8019a5
cmp eax, ebx
jne 0x7c8019bb
mov ecx, 0xc0000011
cmp eax, ecx
jne 0x7c801a16
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x7c8019b8
and dword [eax], 0
push ecx
jmp 0x7c801a17
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x7c801894
mov dword [ebp - 4], 1
mov ecx, dword [esi + 4]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
jmp 0x7c801894
mov eax, dword [eax + 0x10]
mov edi, dword [eax + 0x1c]
jmp 0x7c80184c
mov eax, dword [eax + 0x10]
mov edi, dword [eax + 0x20]
jmp 0x7c80184c
cmp eax, 0xc0000011
jne 0x7c801a02
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
jmp 0x7c801894
mov ecx, eax
and ecx, 0xc0000000
cmp ecx, 0x80000000
je 0x7c801955
push eax
Function at 0x7c801e54
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax], 0x44
mov edx, dword [ecx + 0x84]
mov dword [eax + 4], edx
mov edx, dword [ecx + 0x7c]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0x74]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x4c]
mov dword [eax + 0x10], edx
mov edx, dword [ecx + 0x50]
mov dword [eax + 0x14], edx
mov edx, dword [ecx + 0x54]
mov dword [eax + 0x18], edx
mov edx, dword [ecx + 0x58]
mov dword [eax + 0x1c], edx
mov edx, dword [ecx + 0x5c]
mov dword [eax + 0x20], edx
mov edx, dword [ecx + 0x60]
mov dword [eax + 0x24], edx
mov edx, dword [ecx + 0x64]
mov dword [eax + 0x28], edx
mov edx, dword [ecx + 0x68]
mov dword [eax + 0x2c], edx
test byte [eax + 0x2d], 7
mov dx, word [ecx + 0x6c]
mov word [eax + 0x30], dx
mov dx, word [ecx + 0x88]
mov word [eax + 0x32], dx
mov edx, dword [ecx + 0x8c]
mov dword [eax + 0x34], edx
jne 0x7c801ed9
pop ebp
ret 4
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x38], edx
mov edx, dword [ecx + 0x1c]
mov dword [eax + 0x3c], edx
mov ecx, dword [ecx + 0x20]
mov dword [eax + 0x40], ecx
jmp 0x7c801ed5
Function at 0x7c802213
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
push eax
push 0x40
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
mov dword [ebp - 4], ebx
call esi
cmp eax, 0xc000004e
je 0x7c8022a6
test eax, eax
jl 0x7c80229b
mov eax, dword [ebp + 0x14]
test al, 0xcc
je 0x7c8022b9
lea ecx, [ebp + 0x14]
push ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
call esi
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x7c802320
test eax, eax
jl 0x7c80229b
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ntdll.dll_NtFlushInstructionCache]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x14
push eax
call fcn.7c809419
jmp 0x7c80232a
lea eax, [ebp + 0x14]
push eax
push 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
call esi
jmp 0x7c80224a
test al, 3
jne 0x7c8022fd
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x7c8022de
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
call esi
cmp dword [ebp + 0x10], 0
jge 0x7c802286
mov esi, 0xc0000005
jmp 0x7c80230f
lea ecx, [ebp + 0x14]
push ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
call esi
xor esi, esi
push 0xc0000005
call fcn.7c809419
mov eax, esi
jmp 0x7c802294
mov edx, dword [ebp + 8]
mov dword [ecx], edx
jmp 0x7c802282
xor eax, eax
jmp 0x7c802294
Function at 0x7c8095d8
Capabilities:
Get number of processors

Disassembly:
push dword [ebp + 0x14]
lea eax, [ebp - 0x40]
push eax
call fcn.7c802480
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push dword [ebp + 0x18]
xor eax, eax
xor esi, esi
cmp dword [ebp + 0x10], esi
sete al
push eax
push ebx
movsx eax, byte [ebp + 8]
push eax
call dword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
mov dword [ebp - 0x20], eax
cmp eax, esi
jl 0x7c8444be
cmp dword [ebp + 0x18], esi
jne 0x7c80968c
lea eax, [ebp - 0x74]
cmp ebx, eax
jne 0x7c830901
or dword [ebp - 4], 0xffffffff
call fcn.7c8095c8
mov eax, dword [ebp - 0x20]
call fcn.7c802511
ret 0x14
push 0x64
push 0x7c809680
call fcn.7c8024d6
mov dword [ebp - 0x54], 0x14
mov dword [ebp - 0x50], 1
xor eax, eax
lea edi, [ebp - 0x4c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ntdll.dll_RtlActivateActivationContextUnsafeFast]
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
cmp ecx, 8
ja 0x7c8308d0
lea ebx, [ebp - 0x74]
mov dword [ebp - 0x24], ebx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword fs:[0x18]
mov dword [ebp - 0x30], eax
mov edi, dword [eax + 0x30]
mov dword [ebp - 0x34], edi
and dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x1c], eax
jae 0x7c809564
mov eax, dword [ebp - 0x1c]
lea esi, [ebx + eax*4]
mov eax, dword [esi]
cmp eax, 0xfffffff4
je 0x7c844497
cmp eax, 0xfffffff5
je 0x7c84448f
cmp eax, 0xfffffff6
je 0x7c844487
mov eax, dword [esi]
mov ecx, eax
and ecx, 0x10000003
cmp ecx, 3
je 0x7c8444a4
inc dword [ebp - 0x1c]
jmp 0x7c809639
cmp eax, 0x101
jne 0x7c8095a4
jmp 0x7c809573
mov eax, dword fs:[0x18]
mov dword [ebp - 0x2c], eax
shl ecx, 2
push ecx
push dword [0x7c8856d4]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x7c80961c
jmp 0x7c844468
mov eax, dword fs:[0x18]
mov dword [ebp - 0x38], eax
push ebx
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7c8095af
wait
sahf
add eax, 0x67cb3d34
jb 0x7c84444b
int 0xd2
adc dl, byte [ecx + 0x22d8bf2e]
xchg edi, eax
wait
or bl, byte [edi - 0x77]
mov ebp, 0x42bd6a72
arpl di, cx
fsub dword [ebp - 0xe07e2bc]
inc edx
and dl, byte [edi]
das
invalid
Function at 0x7c80b475
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0x28
push 0x7c80b4d0
call fcn.7c8024d6
xor edi, edi
push edi
push dword [ebp + 8]
call fcn.7c809994
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov ebx, dword [ebp + 0x10]
shl ebx, 1
cmp dword [ebp + 8], edi
je 0x7c80b635
lea eax, [ebp - 0x1c]
push eax
push edi
push 1
call sub.ntdll.dll_LdrLockLoaderLock
mov dword [ebp - 4], edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov dword [ebp - 0x34], eax
mov esi, dword [eax]
jmp 0x7c80b4f5
mov dword [ebp - 0x38], esi
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [esi + 0x18]
je 0x7c80b511
mov esi, dword [esi]
mov dword [ebp - 0x2c], esi
cmp esi, eax
jne 0x7c80b4e8
or dword [ebp - 4], 0xffffffff
call fcn.7c80b554
mov eax, edi
shr eax, 1
call fcn.7c802511
ret 0xc
movzx edi, word [esi + 0x24]
inc edi
inc edi
mov dword [ebp - 0x20], edi
cmp ebx, edi
jb 0x7c8329c7
mov dword [ebp - 4], 1
push edi
push dword [esi + 0x28]
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_memmove]
add esp, 0xc
movzx eax, word [esi + 0x24]
lea ecx, [eax + 2]
cmp edi, ecx
jne 0x7c80b549
mov edi, eax
mov dword [ebp - 0x20], edi
and dword [ebp - 4], 0
jmp 0x7c80b4fc
mov eax, dword fs:[0x18]
cmp dword [eax + 0xc], edi
je 0x7c80b4a3
jmp 0x7c840e92
cmp eax, 0x7f494d08
ret
sbb eax, 0xb318754
mov byte [eax - 0x7a3fe6f5], 0xc4
jae 0x7c840e89
xor bh, byte [ecx]
cmpsb byte [esi], byte es:[edi]
pushfd
mov ch, 0xc3
mov esp, 0x8b8b30ac
sbb ah, byte [edx - 5]
mov ch, 0x57
outsd dx, dword [esi]
jle 0x7c840efa
rcl byte [edx], 0x60
out 0xb3, al
jmp 0x956a1fc5
invalid
cmp al, 0xc6
mov esi, 0x6948d498
and eax, 0x688a0c49
jbe 0x7c840ec7
mov eax, dword [0x254e6889]
nop
pop edi
invalid
Function at 0x7c80b56f
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov eax, dword fs:[0x18]
mov edi, dword [ebp + 0x10]
mov eax, dword [eax + 0x30]
lea ecx, [edi + edi]
push ecx
push dword [0x7c8856d4]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
mov dword [ebp - 4], eax
je 0x7c840f22
push esi
push edi
push eax
push dword [ebp + 8]
call sym.KERNEL32.dll_GetModuleFileNameW
mov esi, eax
lea eax, [esi + esi]
mov word [ebp - 8], ax
add ax, 2
test esi, esi
mov word [ebp - 6], ax
je 0x7c80b612
cmp dword [0x7c8856e0], 0
lea eax, [ebp - 8]
push 1
push eax
lea eax, [ebp - 0x10]
push eax
je 0x7c81c24e
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
test eax, eax
jl 0x7c840f33
movzx esi, word [ebp - 0x10]
cmp edi, esi
jb 0x7c840f40
jbe 0x7c80b5f8
lea edi, [esi + 1]
push edi
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_memmove]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeAnsiString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, esi
pop esi
pop edi
leave
ret 0xc
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
jmp 0x7c80b5df
or al, 0x77
adc dword [edi + 0xe5b0e3b], esp
imul dword [edx - 0x1e379e39]
ret
rcr byte [edi], cl
xchg dword [edx - 0x6e399954], ebx
fisub word [esi + ebx*4 + 0x573748c5]
aaa
push edi
scasd eax, dword es:[edi]
cmp byte [ebx + 0x7d], cl
pop ecx
invalid
Function at 0x7c80b7ec
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
push esi
lea eax, [ebp - 0x14]
push eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7c83514b
mov eax, dword [ebp - 0x14]
cmp ax, si
push ebx
mov ebx, dword [ebp - 4]
push edi
jne 0x7c80bd5c
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ntdll.dll_NtQueryAttributesFile]
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp edi, esi
jl 0x7c80b8a8
mov eax, dword [ebp - 0x34]
pop edi
pop ebx
pop esi
leave
ret 4
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlIsDosDeviceName_U]
test eax, eax
jne 0x7c83d184
push edi
call fcn.7c809419
or eax, 0xffffffff
jmp 0x7c80b870
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x7c80b825
and byte [ebp + 0x61cd6093], bh
fsubr qword [ebp - 0x48]
xchg edx, eax
fdiv qword [ecx - 0x44c380df]
iretd

Function at 0x7c80b936
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x7c83cedc
test al, 2
je 0x7c80b9df
and al, 0x20
neg al
sbb eax, eax
and eax, 0x3c
add eax, 4
push eax
push 0
push 1
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp + 0x14]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0x7c82c417
mov eax, dword [ebp + 0x14]
leave
ret 0x18
test al, 4
je 0x7c82c424
and al, 0x20
neg al
sbb eax, eax
and eax, 0x1e
inc eax
inc eax
jmp 0x7c80b971
push eax
call fcn.7c809419
xor eax, eax
jmp 0x7c80b99c
xor eax, eax
jmp 0x7c80b9f1
ljmp 0x561a:0x910fddee
Function at 0x7c80e03e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x7c8856cc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x7c885700
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], edi
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [0x7c885724], 0
jne 0x7c84408b
push esi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov esi, dword [0x7c885718]
or edi, 0xffffffff
cmp esi, edi
je 0x7c816763
jle 0x7c8167cc
cmp esi, 2
jge 0x7c8167cc
push dword [ebp - 0x20]
imul esi, esi, 0x1c
push ebx
add esi, 0x7c80e0bc
push esi
call fcn.7c80e315
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.7c8097aa
leave
ret 8
push 0x7c8858e0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x7c8167a7
lea eax, [ebp - 0x1c]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push 2
push 0x7c8858d8
push dword [ebp - 0x18]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jge 0x7c8440a7
push dword [ebp - 0x18]
call dword [sym.imp.ntdll.dll_NtClose]
cmp esi, edi
jg 0x7c8167c5
xor esi, esi
inc esi
push edi
push esi
push 0x7c885718
call sym.KERNEL32.dll_InterlockedCompareExchange
cmp eax, edi
jne 0x7c8440b9
cmp esi, edi
jmp 0x7c80e08b
cmp esi, 2
jge 0x7c8167a7
jmp 0x7c8167aa
xor esi, esi
inc esi
jmp 0x7c80e09a
adc dword [edi - 0x51991462], edx
xchg dword [ecx - 0x2f2e1597], edi
in eax, 0x48
dec eax
mov al, byte [0xa82e2d42]
movsd dword es:[edi], dword [esi]
aaa
mov ebp, esi
xchg byte [ecx + 0x41], ah
xchg ecx, eax
cmp ch, ch
in eax, dx
in eax, 0x37
lds edi, [ebp + 0x187d3ae5]
invalid
sub dword [eax - 0x73], eax
bound ebx, qword [ecx]
dec ebx
sti
aad 0x28
aas
jo 0x7c844098
mov cl, ch
out 0x2a, eax
inc esi
jbe 0x7c8440e3
invalid
sub edx, dword [edx + 0x478ceec3]
dec ecx
mov es, word [eax - 0x2c93ba66]
jbe 0x7c844152
push esi
mov dword [0xb198f48b], eax
ret 0x82c5
or edx, dword [ecx + 0x66]
mov bh, 0x3c
cld
pop edx
test dword [ebx + 0x4d50cff3], edx
mov eax, dword [0x46fed993]
Function at 0x7c80f015
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
mov dword [eax + 8], ecx
jmp 0x7c80f077
push 0x30
push 0x7c80f0c8
call fcn.7c8024d6
mov edi, dword [ebp + 8]
xor eax, eax
inc eax
cmp edi, eax
je 0x7c83c8ca
cmp edi, 0xffffffff
je 0x7c8384b6
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [edi + 4], ebx
je 0x7c80f17f
mov esi, dword [edi + 8]
mov dword [ebp - 0x38], esi
cmp dword [edi + 4], esi
je 0x7c80f128
mov eax, dword [esi]
cmp eax, ebx
je 0x7c80a136
add eax, esi
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x38]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
mov eax, dword [esi + 8]
mov dword [edi + 4], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x20], eax
mov ecx, dword [esi + 0x3c]
mov eax, 0x206
cmp ecx, eax
ja 0x7c83c90b
jmp 0x7c83c909
or dword [ebp - 4], 0xffffffff
call fcn.7c80f11a
mov eax, dword [ebp - 0x24]
call fcn.7c802511
ret 8
push ebx
push ebx
push ebx
push 3
push dword [edi + 0xc]
push esi
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push ebx
push dword [edi]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov dword [ebp - 0x30], eax
cmp eax, 0x80000005
je 0x7c83c8d9
cmp eax, ebx
jge 0x7c80f065
push eax
call fcn.7c809419
mov dword [ebp - 0x24], ebx
jmp 0x7c80f101
mov eax, dword fs:[0x18]
mov dword [ebp - 0x34], eax
mov esi, 0x1000
push esi
mov ecx, dword [0x7c8856d4]
add ecx, 0xc0000
push ecx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [edi + 4], eax
cmp eax, ebx
je 0x7c8384c4
mov dword [edi + 8], eax
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], ebx
jmp 0x7c80f056
and eax, 0x91431ec5
mov esi, 0x8fdaffba
lahf
jg 0x7c83c8ca
std
invalid
outsd dx, dword [esi]
jnp 0x7c83c901
or eax, 0x5414d155
inc ebp
cmp dword [edx - 0x5f53e4a2], ebp
ljmp 0x939f
and ch, byte [ecx + 0x23d9ec1c]
mov bl, 0x2d
out dx, al
and eax, 0xc034ac3d