joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043f50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008f798
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100b3400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x100b4468]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_bind
call fcn.10043c00
test eax, eax
je 0x10044078
mov esi, dword [ebp - 0x18]
mov edi, dword [str.SOFTWAREComMaster]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x10044023
cmp dword [esi], 0
je 0x10044016
push 0x1009aa5c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10043fe3
mov eax, 1
jmp 0x10044044
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004401c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.WS2_32.dll_bind
call eax
jmp 0x10044044
cmp dword [esi + 4], 0
jne 0x10044023
mov eax, 1
jmp 0x10044044
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1004406e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10044056
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x1004407b
xor ebx, ebx
jmp 0x1004411f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x1004411f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x100440d8
mov ecx, dword [ebx]
test ecx, ecx
je 0x1004413e
push ecx
push eax
call fcn.1005f170
add esp, 8
test eax, eax
je 0x100440d8
mov edx, dword [edi]
test edx, edx
je 0x100440d8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100440b0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x100440e3
lea eax, [edx + 0xd]
jmp 0x10044118
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100440f0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x1009aba8
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x1004412a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10015970
int3
Function at 0x10045740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100457b1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1004577f
cmp eax, 2
jne 0x1004579b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x100457ab
test ecx, ecx
je 0x100457a6
test cl, 1
jne 0x1004579b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x100457ab
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10046f50
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x100b3400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x10047154
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10047154
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.10049460
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2d8]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x10047129
xor edi, edi
mov dword [ebp - 0x2dc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10047118
lea eax, [ebp - 0x2e0]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2d8]
call esi
test eax, eax
jne 0x100470e2
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2e4], 0x104
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100470da
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.10049460
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.10047170
add esp, 0x18
test eax, eax
je 0x100470da
cmp byte [ebp - 0x68], 0
je 0x1004709c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x100470da
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x100470c9
mov al, byte [esi + ecx]
test al, al
je 0x100470c9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x100470b0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10046ff0
push dword [ebp - 0x2d8]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x10047154
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.10048140
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.1003bac5
mov esp, ebp
pop ebp
ret
Function at 0x10047290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x100b3400]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1004740f
cmp dword [ebp + 0xc], 0x20
jb 0x1004740f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.10049460
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x1009afac
push str.SoftwareComMaster
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1004740f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10047320
sub ecx, edx
cmp ecx, 0x40
jne 0x1004740f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x1004735c
mov al, byte [esi + ecx]
test al, al
je 0x1004735c
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10047346
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x10047399
mov al, byte [esi + ecx]
test al, al
je 0x10047399
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10047380
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.10049460
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.10047420
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x1004740f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.10048140
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.1003bac5
mov esp, ebp
pop ebp
ret
Function at 0x10047ce0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.1003c850
mov eax, dword [0x100b3400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x10047e4d
cmp dword [ebp + 0xc], 0
je 0x10047e4d
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.10043ed0
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10047e30
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.10049460
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10047e25
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.10049460
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.10048e40
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.10048140
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x10047e3a
inc esi
cmp esi, 0x10
jl 0x10047d20
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1003bac5
mov esp, ebp
pop ebp
ret
Function at 0x10047e60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100b3400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x10047f48
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10049460
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x10047f48
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10047eb7
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x10047f48
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10047ee0
mov eax, dword [0x1009aa58]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x10047ef5
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10047f10
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bac5
mov esp, ebp
pop ebp
ret
Function at 0x10047f60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x100b3400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.10049460
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.10047420
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10047fca
mov al, byte [edi + ecx]
test al, al
je 0x10047fca
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10047fb1
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x10047feb
inc eax
sub ecx, 1
jne 0x10047fe0
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x10048040
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x10048035
lea edi, [ebp - 0x84]
mov eax, accept
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x10048034
mov bl, byte [edi + ecx]
test bl, bl
je 0x10048034
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x10048020
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.10049460
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x1009afac
push str.SoftwareComMaster
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x100480fa
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x100480c4
test cl, cl
je 0x100480c0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x100480c4
add eax, 2
add esi, 2
test cl, cl
jne 0x100480a4
xor eax, eax
jmp 0x100480c9
sbb eax, eax
or eax, 1
test eax, eax
je 0x100480fa
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100480d6
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push reloc.WS2_32.dll_bind
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10048103
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x1009afac
push str.SoftwareComMaster
push reloc.WS2_32.dll_bind
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003bac5
mov esp, ebp
pop ebp
ret

Function at 0x10065d80
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10065bf6

Function at 0x1007574c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, reloc.comctl32.dll_MenuHelp
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x75c07e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp]
je 0x75c0f2
push word [esp + 4]
jmp 0x75c0bf
pushfd
pushfd
pop word [esp + 2]
pop word [esp + 1]
push sp
jmp 0x75c068
pop word [esp + 1]
jmp 0x75c0a9
mov dword [esp], ecx
jmp 0x75c107
lea esp, [esp + 2]
mov dword [esp], edx
call fcn.0075c0ce
cmp esp, dword [esi + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
push edi
mov esi, 0x89662889
push esp
and al, 7
mov word [esp + 7], dx
lea esp, [esp + 2]
mov dword [esp + 4], eax
jmp 0x75c0a4
push word [esp + 4]
mov word [esp + 7], dx
lea esp, [esp + 2]
mov dword [esp + 4], eax
mov dword [esp], ecx
pushfd
push dword [esp + 3]
jb 0x75c08e
pop word [esp + 1]
lea esp, [esp + 2]
mov dword [esp], edx
jmp 0x75c0b0

Function at 0x75c1c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf074d578
jmp 0x75c170
mov dword [esp], ebp
push sp
mov word [esp], ax
jmp 0x75c12b
lea esp, [esp + 2]
push esi
pushfd
push dword [esp + 1]
js 0x75c162
jns 0x75c14c
invalid
mov dword [esp], eax
lea esp, [esp + 2]
jmp 0x75c11c
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x75c16a
mov dword [esp + 4], edi
lea esp, [esp + 4]
pushfd
jmp 0x75c095
sub esp, 0xb
jmp 0x75c1aa
xchg edx, ebx
pop word [esp + 4]
lea esp, [esp + 1]
jmp 0x75c1ca
push word [esp + 1]
jbe 0x75c143
mov dword [esp], eax
lea esp, [esp + 2]
mov dword [esp], ebp
push sp
mov word [esp], ax
jmp 0x75c12b
jnp 0x75c179
xchg edx, ebx
pop word [esp + 4]
jmp 0x75c1ea
jmp 0x75c191
mov edi, dword [esp + 0x34]
xchg cl, ch
dec bp
jle 0x75c206
jg 0x75c1f0
add eax, 0xcf5ba3a0
jmp 0x75d7a1
lea esp, [esp + 1]
jmp 0x75c1ca
neg cx
jmp 0x75c209
neg cx
lea ebp, [esp + 8]
lea ebx, [ecx + ebp]
bswap esi
clc
jmp 0x75c327
sub esp, 0xb8
mov esi, esp
xchg dx, ax
jmp 0x75c262
shr eax, 0x16
jg 0x75c24c
btr eax, edi
jmp 0x75c24f
jnp 0x75c219
jp 0x75c219
call fcn.0075d78b

Function at 0x76c476
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x7508ab
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x7508c5
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x7508b4
pop esi
jmp 0x7508d0
ret 4
jmp 0x75089e

Function at 0x7841b2
Capabilities:
Encode data using base64

Disassembly:
cmp al, 0x61
call fcn.00784278
pop word [esp]
pushal
lea esp, [esp + 2]
jmp 0x784244
lea esp, [esp + 0x20]
mov al, byte [ecx]
call fcn.00784213
lea esp, [esp + 0x18]
cmp al, 0x5a
pushal
jmp 0x78428e
lea esp, [esp + 0x20]
jbe 0x74e6be
ja 0x74e674

Function at 0x784213
Capabilities:
Encode data using base64

Disassembly:
pushal
jmp 0x784315
jmp 0x784368
lea esp, [esp + 2]
jmp 0x784220
mov word [esp + 1], cx
push bp
push dword [esp + 1]
jmp 0x7841fd
mov dword [esp + 4], ebx
push si
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x7842fe
cmp al, 0x41
call fcn.00784265
jb 0x74e6d4
cmp dl, 0x5a
pushfd
push dword [esp + 1]
jmp 0x784335
lea esp, [esp + 0x20]
cmp dl, 0x61
jmp 0x784345
lea esp, [esp + 8]
jbe 0x74e700
ja 0x74e6d4
jb 0x74e74e
pushal
jmp 0x78437e
lea esp, [esp + 0x20]
cmp dl, 0x7a
jbe 0x74e700
ja 0x74e74e
Function at 0x784265
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jb 0x74e674
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x78424f

Function at 0x784278
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jb 0x74e6a8
jae 0x7842c3
jae 0x74e6f3
test dword [reloc.IPHLPAPI.DLL_GetInterfaceInfo], esi
add byte [ecx - 0x17], bl
shr edx, cl
add dword [eax], eax
salc
inc ecx
ret
cmp al, 0x30
jmp 0x78429e
enter 0x15e9, 0x5f
add eax, dword [eax]
cmp byte [ebx], bl
mov edi, 0xd94e2734
jmp 0x7842e7
push edi
jmp 0x74e67b
jb 0x74e718
cmp al, 0x39
jbe 0x74e6be
ja 0x74e718
lahf
add byte [esi + 0x23b700f1], dl
mov ebp, 0x70c7342d
or al, 0x9f
out 0x11, al
nop
cmp al, 0x7a
jbe 0x74e6be
ja 0x74e6a8
je 0x74e6be
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x7843f6
pushfd
lea esp, [esp + 4]
cmp al, 0x2b
jmp 0x7842d1

Function at 0x78435c
Capabilities:
Encode data using base64

Disassembly:
cmp dl, 0x2b
jmp 0x74e737
je 0x74e700
pushfd
pop word [esp]
lea esp, [esp + 2]
jmp 0x7843b4
lea esp, [esp + 4]
cmp dl, 0x41
call fcn.0078432f
cmp dl, 0x30
jmp 0x784391
jb 0x74e72e
cmc
jmp 0x7843ca
cmp dl, 0x39
jbe 0x74e700
ja 0x74e72e
Function at 0x784457
Capabilities:
Encode data using base64

Disassembly:
mov byte [esp + 1], bl
jmp 0x74e77f

Function at 0x7844a5
Capabilities:
Encode data using base64

Disassembly:
jbe 0x74e764
ja 0x74e77a
lea esp, [esp + 4]
jmp 0x78446d
Function at 0x77206ac9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x77208004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
test edi, edi
je 0x77206b2c
push ecx
push ecx
push ecx
mov edx, 0x400
lea ecx, [ebp - 0x404]
call fcn.7720682c
push 0x772015d4
mov edx, 0x400
lea ecx, [ebp - 0x404]
call fcn.772067c1
push edi
mov edx, 0x400
lea ecx, [ebp - 0x404]
call fcn.772067c1
lea ecx, [ebp - 0x404]
xor edi, edi
lea eax, [ebp - 0x408]
push edi
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push ecx
push 0x80000000
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExA]
test eax, eax
jne 0x77206b79
push esi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push ebx
push dword [ebp - 0x408]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
push dword [ebp - 0x408]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77207600
mov esp, ebp
pop ebp
ret 8

Function at 0x77206b8c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x77208004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x108]
mov edi, edx
push eax
push 0xf003f
push 0
mov esi, ecx
push edi
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x77206c06
jmp 0x77206bd4
mov ecx, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
call fcn.77206b8c
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0
push dword [ebp - 0x108]
call dword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegEnumKeyA]
test eax, eax
je 0x77206bc3
push dword [ebp - 0x108]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push edi
push esi
call dword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.77207600
mov esp, ebp
pop ebp
ret

Function at 0x77207770
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x772077ae
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x772077a6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x772077b0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x77207796
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x77207880
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x77207896
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x772078b1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret