joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7537e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x880
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x7594e0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea esi, [ebp - 0x38]
mov ecx, esi
call fcn.00753af0
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x24], 8
jb 0x75382a
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x20]
push 0x9d8880
push esi
push eax
call fcn.00905f5c
add esp, 0xc
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x753942
test eax, eax
jne 0x753942
push ecx
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00904903
add esp, 0x10
push dword [ebp - 0x20]
call fcn.00905863
add esp, 4
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x24], 8
jb 0x753880
mov ecx, dword [ebp - 0x38]
jmp 0x753883
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], 4
push eax
push 0x9d88c2
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.009060ad
add esp, 0x10
cmp byte [0xa8c591], 0
jne 0x753a02
nop
mov eax, dword [ebp + 0x10]
mov esi, dword [eax + 0x24]
test esi, esi
je 0x753a02
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [0xa37360]
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call edi
nop
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x7538ee
nop
push eax
call fcn.00905931
add esp, 4
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x75392e
nop
mov ecx, dword [ebp - 0x38]
lea esi, [eax*2 + 2]
cmp esi, 0x1000
jb 0x753924
nop
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x753a07
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0091d82d
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x880
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [ebp - 0x88c]
push 0x800
push 0
push edi
mov esi, eax
call fcn.009350b0
add esp, 0xc
push esi
push 0x800
push edi
call fcn.00906166
add esp, 0xc
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x68]
push eax
push 0x9d8890
push ecx
call fcn.00755ee0
add esp, 0xc
nop
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x50]
push 0x9d8888
lea eax, [ebp - 0x68]
push eax
push ecx
call fcn.00755ba0
add esp, 0xc
nop
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0x80]
lea ecx, [ebp - 0x88c]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push eax
call fcn.00755ba0
add esp, 0xc
lea ecx, [ebp - 0x50]
call fcn.0065b8a0
lea ecx, [ebp - 0x68]
call fcn.0065b8a0
mov dword [ebp - 0x10], 5
lea ecx, [ebp - 0x50]
lea edx, [ebp - 0x80]
call fcn.007561a0
lea esi, [ebp - 0x8c]
mov ecx, esi
lea eax, [ebp - 0x50]
push eax
call fcn.00756240
mov dword [ebp - 0x10], 6
push 0xa1f334
push esi
call fcn.0093533b
add esp, 8
call fcn.0091f40d
nop
mov dword [ebp - 0x10], 0
call fcn.00900ce1
nop word cs:[eax + eax]
push ebp
sub esp, 0x10
add ebp, 0xc
lea ecx, [ebp - 0x50]
call fcn.0065b8a0
add esp, 0x10
pop ebp
ret
Function at 0x757490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
lea eax, [esi + 0x28]
mov dword [esi + 0x2c], 0x759550
mov ecx, dword fs:[0]
mov dword [esi + 0x28], ecx
mov dword fs:[0], eax
mov dword [esi + 0x30], 0
call fcn.00922cd9
mov dword [esi + 4], eax
mov dword [esi], edx
call fcn.00922cc2
push dword [esi]
push dword [esi + 4]
push edx
push eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
call fcn.0091de30
mov ebx, eax
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov dword [esi + 0x14], eax
imul eax, ecx, 0x3b9aca00
add eax, edx
mov dword [esi + 0x10], eax
mov edi, dword [esi]
imul edi, ebx
mov eax, ebx
mov ebx, dword [esi + 4]
mul ebx
add edx, edi
imul ecx, ebx
mov edi, ebx
add ecx, edx
mov edx, dword [esi + 8]
sub edx, eax
mov ebx, dword [esi + 0xc]
sbb ebx, ecx
mov eax, edx
mov ecx, 0x3b9aca00
mul ecx
imul ecx, ebx, 0x3b9aca00
add edx, ecx
push dword [esi]
push edi
push edx
push eax
call fcn.0091de30
mov edi, eax
add edi, dword [esi + 0x14]
adc edx, dword [esi + 0x10]
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
cmp ebx, 1
mov eax, ecx
sbb eax, 0
jl 0x7575a7
mov dword [esi], edx
mov edx, 0xfff0bdc0
mov eax, ebx
mul edx
sub edx, ebx
mov dword [esi + 4], ecx
imul ecx, ecx, 0xfff0bdc0
add ecx, edx
add eax, 0xffffffff
adc ecx, 0x7fffffff
cmp edi, eax
mov eax, dword [esi]
sbb eax, ecx
jge 0x75759d
mov ecx, 0xf4240
mov eax, ebx
mul ecx
imul ecx, dword [esi + 4], 0xf4240
add ecx, edx
mov edx, dword [esi]
add edi, eax
adc edx, ecx
jmp 0x7575a7
mov edx, 0x7fffffff
mov edi, 0xffffffff
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edx
mov dword [esi + 0x30], 0xffffffff
lea eax, [esi + 0x18]
push eax
call fcn.007575f0
add esp, 4
mov eax, dword [esi + 0x28]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7575f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
lea eax, [esi + 0x30]
mov dword [esi + 0x34], 0x759560
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
nop word cs:[eax + eax]
nop
mov dword [esi + 0x38], 0
call fcn.00922cd9
mov dword [esi + 4], eax
mov dword [esi], edx
call fcn.00922cc2
push dword [esi]
push dword [esi + 4]
push edx
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.0091de30
mov ebx, eax
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov dword [esi + 0xc], eax
imul eax, ecx, 0x3b9aca00
add eax, edx
mov dword [esi + 8], eax
mov edi, dword [esi]
imul edi, ebx
mov eax, ebx
mov ebx, dword [esi + 4]
mul ebx
add edx, edi
imul ecx, ebx
mov edi, ebx
add ecx, edx
mov edx, dword [esi + 0x10]
sub edx, eax
mov ebx, dword [esi + 0x14]
sbb ebx, ecx
mov eax, edx
mov ecx, 0x3b9aca00
mul ecx
imul ecx, ebx, 0x3b9aca00
add edx, ecx
push dword [esi]
push edi
push edx
push eax
call fcn.0091de30
mov ebx, eax
add ebx, dword [esi + 0xc]
adc edx, dword [esi + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
mov dword [esi], ecx
mov dword [esi + 8], ebx
cmp ebx, ecx
mov dword [esi + 0xc], edx
mov eax, edx
mov dword [esi + 4], edi
sbb eax, edi
jge 0x75774d
mov dword [esi + 0x38], 1
call fcn.00922d51
mov ecx, edx
mov edi, dword [esi]
sub edi, dword [esi + 8]
mov ebx, dword [esi + 4]
sbb ebx, dword [esi + 0xc]
mov edx, 0x64
mul edx
imul ecx, ecx, 0x64
add ecx, edx
cmp edi, 0xad160000
mov edx, ebx
sbb edx, 0x311cd
mov edx, 0x311cd
cmovge ebx, edx
mov edx, 0xad160000
cmovge edi, edx
add edi, eax
adc ebx, ecx
push 0
push 0x3b9aca00
push ebx
push edi
call fcn.0091de30
mov dword [esi + 0x1c], edx
mov dword [esi + 0x18], eax
imul eax, eax, 0xc4653600
add eax, edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x38], 0xffffffff
lea eax, [esi + 0x18]
push eax
call fcn.00922dc3
add esp, 4
jmp 0x757630
nop
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7595b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x759d30
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call fcn.00759d20
mov edx, dword [0xa53f74]
mov ecx, dword [0xa53f64]
mov esi, 0xd6d3
sub esi, eax
mov dword [ebp - 0x28], esi
sub ecx, esi
add ecx, edx
call dword [0xa37360]
call ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0
call fcn.00657000
mov edx, dword fs:[0x2c]
mov ecx, dword [0xa8dd54]
sub eax, dword [edx + ecx*4]
mov esi, dword [ebp - 0x24]
mov edx, esi
xor edx, 0x16ec961b
cmp eax, edx
mov edx, esi
jg 0x759670
cmp byte [0xa8c5cc], 0
jne 0x75965e
test byte [0xa8c3e4], 1
jne 0x75965e
nop
mov eax, dword [ebp + 0xc]
xor edx, 0x16ec962f
mov eax, dword [eax + edx]
test eax, eax
je 0x75965e
nop
mov edx, dword [ebp + 8]
mov dword [edx + eax], ecx
nop
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
nop
movzx eax, byte [0xa53ed3]
mov ecx, edx
xor cl, 0x49
mov byte [ebp - 0x1d], cl
cmp al, cl
je 0x75973b
mov eax, dword [ebp - 0x24]
mov ecx, eax
xor cl, 0xfd
mov edx, eax
xor dl, 0xe0
nop word cs:[eax + eax]
mov eax, ecx
lock cmpxchg byte [0xa53ed3], dl
mov dword [0xa53f88], 0x6c17e8f3
je 0x7596bd
cmp al, byte [ebp - 0x1d]
jne 0x7596a0
jmp 0x75973b
nop
mov eax, dword [ebp - 0x24]
mov ecx, eax
xor ecx, 0x588b9f1b
mov dword [ebp - 0x2c], ecx
mov edi, eax
xor edi, 0x16ec9633
mov ecx, eax
xor cl, 0xca
xor eax, 0x16ec9630
cmp eax, 2
mov ebx, 1
cmovge ebx, eax
xor esi, esi
nop dword [eax + eax]
nop
mov eax, dword [ebp - 0x2c]
add eax, esi
xor edx, edx
div edi
not edx
mov ah, byte [esi + 0xa53eb0]
mov al, byte [edi + edx + 0x9d8a50]
mov edx, eax
and dl, cl
xor al, byte [ebp - 0x24]
xor al, 0x35
or al, dl
mov edx, eax
xor dl, ah
and al, ah
add al, al
add al, dl
mov byte [esi + 0xa53eb0], al
inc esi
cmp ebx, esi
jne 0x7596f0
nop
movzx eax, byte [ebp - 0x1d]
xchg byte [0xa53ed3], al
mov dword [ebp - 0x10], 0xffffffff
nop
mov eax, dword [0xa53f70]
mov esi, dword [0xa53f68]
sub esi, dword [ebp - 0x28]
add esi, eax
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [0xa37360]
lea edi, [ebp - 0x3c]
mov ecx, edi
push 0xa53eb0
call esi
mov dword [ebp - 0x10], 0
push 0xa1f334
push edi
call fcn.0093533b
add esp, 8
nop dword [eax]
push ebp
sub esp, 8
add ebp, 0xc
mov dword [ebp - 0x1c], esp
nop
mov esi, dword [ebp - 0x30]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x24]
xor ecx, 0x16ec9617
mov edi, dword [eax + ecx]
mov dword [ebp - 0x10], 1
mov ecx, edi
call dword [0xa37360]
mov ecx, esi
call edi
mov esi, eax
mov eax, dword [0xa53f78]
mov edi, dword [0xa53f60]
sub edi, dword [ebp - 0x28]
add edi, eax
mov ecx, edi
call dword [0xa37360]
mov ecx, esi
call edi
int3
Function at 0x76cfb0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x76e4c0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
push 2
mov dword [ebp - 0x20], ecx
push ecx
call fcn.0091ecd4
add esp, 8
mov eax, dword [ebp - 0x20]
add eax, 0x30
mov dword [ebp - 0x10], 1
push eax
call fcn.00922f8e
add esp, 4
mov eax, dword [ebp - 0x20]
add eax, 0x58
push eax
call fcn.00922f8e
add esp, 4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x80], 0
mov byte [ecx + 0x84], 0
add ecx, 0x88
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x2c], ecx
push eax
push edx
call fcn.00770770
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [ebp - 0x10], 3
push 0x118
call fcn.0091d7fd
add esp, 4
mov ecx, eax
mov edx, dword [ebp - 0x20]
lea eax, [edx + 0xd4]
mov dword [edx + 0xd4], ecx
mov dword [edx + 0xd8], ecx
lea esi, [ecx + 0x118]
mov dword [ebp - 0x30], esi
mov dword [edx + 0xdc], esi
mov dword [ebp - 0x34], eax
xorps xmm0, xmm0
movsd qword [ecx + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [ecx + 0x20], xmm0
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx], xmm0
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x24], ecx
call fcn.0076da30
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 0x38]
xorps xmm0, xmm0
movsd qword [eax + 0x68], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0x58], xmm0
movups xmmword [eax + 0x48], xmm0
movups xmmword [eax + 0x38], xmm0
mov dword [ebp - 0x28], ecx
call fcn.0076da30
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 0x70]
xorps xmm0, xmm0
movsd qword [eax + 0xa0], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0x90], xmm0
movups xmmword [eax + 0x80], xmm0
movups xmmword [eax + 0x70], xmm0
mov dword [ebp - 0x28], ecx
call fcn.0076da30
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 0xa8]
xorps xmm0, xmm0
movsd qword [eax + 0xd8], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0xc8], xmm0
movups xmmword [eax + 0xb8], xmm0
movups xmmword [eax + 0xa8], xmm0
mov dword [ebp - 0x28], ecx
call fcn.0076da30
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 0xe0]
xorps xmm0, xmm0
movsd qword [eax + 0x110], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0x100], xmm0
movups xmmword [eax + 0xf0], xmm0
movups xmmword [eax + 0xe0], xmm0
mov dword [ebp - 0x28], ecx
call fcn.0076da30
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
mov dword [eax + 0xd8], ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x775160
Capabilities:
Persist via run registry key

Disassembly:
push ebx
push edi
push esi
sub esp, 0x38
mov esi, dword [esp + 0x48]
mov eax, dword [0xa7d04c]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push 0x9d98e9
push 0x9d98f8
push 0x80000002
call fcn.00775330
add esp, 0x10
mov eax, dword [esi + 0x10]
test eax, eax
je 0x7752fb
mov ecx, dword [esi + 0x14]
mov edx, ecx
sub edx, eax
cmp edx, 0x13
jae 0x775205
sub esp, 0x10
movzx eax, byte [esp + 0x18]
mov byte [esp + 4], al
mov dword [esp + 0xc], 0x13
mov dword [esp + 8], 0x9d9939
mov dword [esp], 0x13
mov ecx, esi
call fcn.00671270
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
jb 0x775236
sub esp, 0xc
movzx eax, byte [esp + 0x14]
mov byte [esp + 4], al
mov dword [esp + 8], 0x2f
mov dword [esp], 1
mov ecx, esi
call fcn.0067a6f0
cmp dword [0xa8c738], 0
jne 0x77525d
jmp 0x775254
lea edx, [eax + 0x13]
mov dword [esi + 0x10], edx
mov edx, esi
cmp ecx, 0x10
jb 0x775214
mov edx, dword [esi]
movups xmm0, xmmword [0x9d9939]
movups xmmword [edx + eax], xmm0
mov dword [edx + eax + 0xf], 0x73736563
mov byte [edx + eax + 0x13], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
jae 0x7751d8
lea edx, [eax + 1]
mov dword [esi + 0x10], edx
mov edx, esi
cmp ecx, 0x10
jb 0x775245
mov edx, dword [esi]
mov word [edx + eax], 0x2f
cmp dword [0xa8c738], 0
jne 0x77525d
mov eax, dword [0xa8c73c]
test eax, eax
je 0x7752cb
mov eax, dword [0xa8c738]
mov ecx, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x77526d
mov eax, dword [eax]
mov edx, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
mov edi, ebx
sub edi, edx
cmp edi, ecx
jae 0x77529b
sub esp, 0x10
movzx edx, byte [esp + 0x18]
mov byte [esp + 4], dl
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp], ecx
mov ecx, esi
call fcn.00671270
jmp 0x7752b9
lea edi, [edx + ecx]
mov dword [esi + 0x10], edi
cmp ebx, 0x10
jb 0x7752a8
mov esi, dword [esi]
add edx, esi
push ecx
push eax
push edx
call fcn.00935430
add esp, 0xc
mov byte [esi + edi], 0
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0091d849
add esp, 0x38
pop esi
pop edi
pop ebx
ret
push 0
push 0x775720
push 0xa8c740
push 0xa8c738
call fcn.00775520
add esp, 0x10
mov eax, dword [0xa8c738]
mov ecx, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
jae 0x77526b
jmp 0x77526d
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
push eax
call fcn.0077a7a0
add esp, 4
mov dword [esp + 4], eax
mov eax, esp
lea esi, [esp + 8]
mov ecx, esi
push 0
push eax
call fcn.00774910
push 0xa2a648
push esi
call fcn.0093533b
int3
Function at 0x775330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea edx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x77d110
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], edx
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x775371
mov edx, dword [edi]
mov dword [edi + 0x10], 0
mov byte [edx], 0
lea edx, [ebp - 0x30]
push edx
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x775396
xor eax, eax
jmp 0x77549d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push edx
push 0
push ecx
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
jne 0x775487
mov eax, dword [ebp - 0x28]
add eax, 0xfffffffd
cmp eax, 0xfffffffe
jb 0x775487
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ecx + 0x10]
mov eax, esi
sub eax, ebx
jbe 0x775414
mov edx, dword [ecx + 0x14]
mov edi, edx
sub edi, ebx
cmp edi, eax
jae 0x7754af
sub esp, 0x10
movzx edx, byte [ebp - 0x20]
mov byte [esp + 4], dl
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 0xc], 0
call fcn.006774c0
jmp 0x7754cd
cmp dword [ecx + 0x14], 0x10
mov eax, ecx
jb 0x77541e
mov eax, dword [ecx]
mov dword [ecx + 0x10], esi
mov byte [eax + esi], 0
cmp dword [ecx + 0x14], 0x10
mov eax, ecx
jb 0x77542f
mov eax, dword [ecx]
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x77544e
xor ecx, ecx
jmp 0x775487
mov edi, dword [ebp + 0x14]
mov eax, dword [edi + 0x10]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x77545e
mov ecx, dword [edi]
lea edx, [ecx + eax]
mov esi, ecx
not esi
add esi, edx
xor edx, edx
cmp eax, esi
setne dl
add ecx, esi
sub eax, edx
mov dword [edi + 0x10], eax
sub eax, esi
inc eax
add edx, ecx
push eax
push edx
push ecx
call fcn.00935430
add esp, 0xc
mov cl, 1
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ecx + 0x10], esi
mov edi, ecx
cmp edx, 0x10
jb 0x7754bb
mov edi, dword [ecx]
add ebx, edi
push eax
push 0
push ebx
call fcn.009350b0
add esp, 0xc
mov byte [edi + esi], 0
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 0x14], 0x10
mov eax, ecx
jae 0x77542d
jmp 0x77542f
Function at 0x775900
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, ecx
mov eax, dword [0xa7d04c]
xor eax, ebp
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x775928
cmp eax, 8
jae 0x775952
jmp 0x7759c4
mov ecx, dword [0xa8c730]
test ecx, ecx
jne 0x77593f
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, 2
setb al
shl eax, 5
mov dword [esi + 0xc], eax
cmp eax, 8
jb 0x7759c4
cmp eax, 0x1f
ja 0x77595b
pause
jmp 0x7759c4
cmp eax, 0x20
jne 0x775969
mov ecx, esi
call fcn.007773c0
jmp 0x7759c4
cmp dword [esi + 8], 0
je 0x7759aa
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x77598d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp], eax
mov dword [esp + 4], 0
mov eax, dword [esp]
sub eax, dword [esi]
mov ecx, dword [esp + 4]
sbb ecx, dword [esi + 4]
cmp eax, dword [esi + 8]
sbb ecx, 0
jb 0x7759b2
mov dword [esi + 8], 0
jmp 0x7759ae
test al, 1
jne 0x7759b2
push 1
jmp 0x7759be
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x7759c4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esi + 0xc]
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.0091d849
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x7789b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea ecx, [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp]
and eax, 0xfffffffe
je 0x7789ea
mov ecx, dword [ecx + 8]
movzx edx, byte [ecx]
test dl, 1
jne 0x7789f9
mov edx, dword [ecx]
shr edx, 1
mov dword [esp], edx
mov ecx, dword [ecx + 8]
mov dword [esp + 8], ecx
jmp 0x778a03
xor esi, esi
mov bl, 1
xor edi, edi
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x778a76
jmp 0x778a78
inc ecx
mov dword [esp + 8], ecx
shr edx, 1
mov dword [esp], edx
xor edi, edi
xor esi, esi
jmp 0x778a58
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
shr eax, 1
mov edx, dword [esp]
xor ebx, ebx
cmp edx, eax
setb bl
mov esi, ebx
cmovb eax, edx
push eax
push ecx
push dword [esp + 0x10]
call fcn.00936266
add esp, 0xc
xor ebx, ebx
test eax, eax
sets bl
cmove ebx, esi
test bl, bl
mov esi, dword [esp + 4]
cmove esi, ebp
mov eax, ebx
xor al, 1
movzx eax, al
mov eax, dword [ebp + eax*4 + 4]
inc edi
test eax, eax
je 0x778a6b
mov ebp, eax
movzx eax, byte [eax + 0xc]
test al, 1
mov dword [esp + 4], esi
je 0x778a10
lea ecx, [ebp + 0xd]
jmp 0x778a16
lea ecx, [esp + 0x24]
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x778a78
mov dword [eax], edi
test esi, esi
je 0x778af0
mov eax, dword [ecx + 8]
movzx ecx, byte [esi + 0xc]
mov byte [esp + 4], cl
movzx edx, cl
mov ecx, dword [esi + 0x14]
mov dword [esp + 8], ecx
movzx ecx, byte [eax]
test cl, 1
jne 0x778aa0
mov ecx, dword [eax]
mov eax, dword [eax + 8]
jmp 0x778aa1
inc eax
mov dword [esp], eax
shr ecx, 1
lea edi, [esi + 0xd]
shr edx, 1
mov eax, edx
mov edx, dword [esi + 0xc]
shr edx, 1
test byte [esp + 4], 1
cmove edi, dword [esp + 8]
cmovne edx, eax
xor eax, eax
cmp edx, ecx
setb al
mov dword [esp + 4], eax
cmovae edx, ecx
push edx
push dword [esp + 4]
push edi
call fcn.00936266
add esp, 0xc
xor ecx, ecx
test eax, eax
sets cl
cmove ecx, dword [esp + 4]
cmp cl, 1
lea ecx, [esp + 0x24]
jne 0x778aff
mov eax, dword [ecx + 0x10]
mov byte [eax], bl
mov eax, dword [ecx + 0x10]
mov dword [eax + 4], ebp
mov al, 1
jmp 0x778b01
xor eax, eax
mov edx, dword [esp + 0xc]
mov dword [edx], esi
mov byte [edx + 4], al
mov eax, dword [ecx]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x77aca0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0xa7d04c]
xor eax, ebp
mov dword [esp + 0x10], eax
mov eax, esp
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x77ad75
mov edi, dword [ebp + 0xc]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
cmp eax, edi
mov edx, ecx
sbb edx, 0
jge 0x77ad3c
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x77ad02
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x77ad75
sub edi, dword [esp]
je 0x77ad71
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [eax]
cmp edi, 0x200
mov ebx, 0x200
cmovb ebx, edi
push 0
lea eax, [esp + 0x10]
push eax
push ebx
push 0xa8c7e4
push dword [ebp + 8]
call esi
cmp dword [esp + 0xc], ebx
jne 0x77ad75
sub edi, ebx
jne 0x77ad10
jmp 0x77ad71
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push 0
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x77ad64
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x77ad75
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x77ad75
mov bl, 1
jmp 0x77ad77
xor ebx, ebx
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.0091d849
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret