joyce8/EMBER2024-capa huggingface dataset:
Function at 0x644370
Capabilities:
Get system information on windows

Disassembly:
jmp 0x6472e0
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov dword [esp + 4], 0x14
mov dword [esp], 1
call fcn.00493840
mov esi, eax
mov dword [esp + 0x14], esi
mov edi, 0xc
test esi, esi
jne 0x647319
mov eax, 3
sub eax, esi
xor eax, esi
jne 0x647549
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
lea ebx, [esp + 0x18]
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.0063d6e0
mov ebp, dword [esp + 0x18]
mov dword [esp + 4], ebx
mov dword [esp], 0x80000000
call fcn.0063d6e0
mov eax, dword [esp + 0x18]
mov ecx, eax
movzx edx, al
and eax, 0xffff0000
and ecx, 0xff80
xor ebx, ebx
cmp ecx, 0x80
cmovae edx, ebx
cmp eax, 0x80000000
cmovne edx, ebx
mov dword [esp + 0xc], edx
lea eax, [edx + ebp]
shl eax, 4
add eax, 0x20
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
sub esp, 4
mov eax, dword [esp + 0x3c]
imul eax, dword [esp + 0x10]
mov dword [esi + 4], eax
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00493840
mov dword [esi], eax
test eax, eax
je 0x647479
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.007ce3c0
mov edi, dword [esi]
xor eax, eax
nop dword [eax]
mov ebx, eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0063d6e0
add edi, 0x10
mov eax, ebx
and eax, 1
xor eax, ebx
cmp eax, 0xffffffff
setne al
movzx eax, al
add eax, ebx
mov ecx, 3
sub ecx, eax
xor ecx, eax
cmp eax, ebp
jbe 0x6473f0
test ecx, ecx
je 0x6473f0
mov dword [esp + 4], edi
mov dword [esp], 0x80000000
call fcn.0063d6e0
mov eax, dword [edi]
mov ecx, eax
and ecx, 0xffff0000
cmp ecx, 0x80000000
jne 0x6474dd
and eax, 0xff80
cmp eax, 0x7f
ja 0x6474dd
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x6474f8
add edi, 0x10
xor eax, eax
mov ecx, 0xffffffff
jmp 0x6474a2
inc ebx
mov dword [esp], esi
call fcn.004936c0
mov eax, ebx
or eax, 2
mov ecx, ebx
xor ecx, 2
add ecx, eax
setne al
movzx eax, al
cmp ebx, eax
jb 0x647470
jmp 0x647549
inc eax
dec ecx
mov edx, eax
and edx, 1
xor edx, ecx
setne dl
movzx edx, dl
cmp eax, edx
jb 0x6474a0
mov ebx, 1
nop dword [eax + eax]
mov eax, ebx
or eax, 0x80000000
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.0063d6e0
inc ebx
add edi, 0x10
cmp ebx, ebp
jbe 0x6474c0
jmp 0x6474f8
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov ebx, 0xffffffff
cmp dword [esp + 0x3c], 2
jb 0x647535
mov edi, 1
mov ecx, dword [esp + 0x10]
mov ebp, ecx
nop
mov eax, dword [esi]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
add eax, ebp
mov dword [esp], eax
mov esi, ecx
call fcn.007ce510
mov ecx, esi
mov esi, dword [esp + 0x14]
inc edi
add ebp, ecx
cmp edi, dword [esp + 0x3c]
jb 0x647510
mov eax, dword [esp + 0x60]
jmp 0x647542
mov dword [eax], esi
xor edi, edi
add ebx, 1
jb 0x647540
mov eax, edi
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x648690
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], str.ADVAPI32.DLL
call fcn.007c60a0
mov dword [0x80f30c], eax
test eax, eax
jne 0x6486bf
mov ecx, 3
sub ecx, eax
xor ecx, eax
mov esi, 0xffffffff
jne 0x6487ba
mov dword [esp], eax
mov dword [esp + 4], 0x7e2c26
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80f2f8], eax
test eax, eax
je 0x64877c
mov eax, dword [0x80f30c]
mov dword [esp], eax
mov dword [esp + 4], 0x7e2c36
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80f2fc], eax
test eax, eax
je 0x64877c
mov eax, dword [0x80f30c]
mov dword [esp], eax
mov dword [esp + 4], 0x7e2c46
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80f300], eax
test eax, eax
je 0x64877c
mov eax, dword [0x80f30c]
mov dword [esp], eax
mov dword [esp + 4], 0x7e2c57
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80f304], eax
test eax, eax
jne 0x64874e
mov ecx, eax
or ecx, 2
xor eax, 2
add eax, ecx
jne 0x64877c
mov eax, dword [0x80f30c]
mov dword [esp], eax
mov dword [esp + 4], 0x7e2c70
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80f308], eax
test eax, eax
je 0x64877c
imul eax, eax
and eax, 3
xor esi, esi
cmp eax, 2
jne 0x6487ba
mov edi, dword [0x80f30c]
test edi, edi
mov esi, 0xffffffff
je 0x6487ba
xor eax, eax
test al, al
jne 0x6487ba
mov ebx, 0xffffffff
jmp 0x6487b5
mov dword [esp], edi
call sub.KERNEL32.dll_FreeLibrary
sub esp, 4
mov dword [0x80f30c], 0
add ebx, 1
jb 0x6487a0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x648da0
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebx
push edi
push esi
sub esp, 0x81c
mov edi, dword [esp + 0x82c]
mov dword [esp + 0x18], edi
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], esi
lea ebx, [esp + 0x81c]
mov dword [esp], edi
call fcn.007c3e70
lea eax, [edi + eax + 1]
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x14]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 0x10], 0
call fcn.007c5b50
mov ecx, eax
mov eax, 0x6b
test ecx, ecx
jne 0x648e40
mov dword [esp], esi
mov dword [esp + 4], 0
call sub.KERNEL32.dll_CreateDirectoryW
sub esp, 8
test eax, eax
je 0x648e2c
mov dword [esp], esi
mov dword [esp + 4], 2
call sub.KERNEL32.dll_SetFileAttributesW
sub esp, 8
xor eax, eax
jmp 0x648e40
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
sete al
movzx eax, al
lea eax, [eax + eax*2 + 0x6b]
add esp, 0x81c
pop esi
pop edi
pop ebx
ret

Function at 0x649550
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x649690
sub esp, 8
mov eax, dword [0x7fe974]
cmp eax, 0xffffffff
jne 0x6496bf
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x7fe974], eax
mov dword [esp], eax
mov dword [esp + 4], 0
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov eax, dword [0x7fe974]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
pop ecx
ret
Function at 0x649660
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
sub esp, 8
mov esi, dword [esp + 0x10]
mov eax, dword [0x7fe974]
cmp eax, 0xffffffff
jne 0x64967c
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x7fe974], eax
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
pop esi
ret
Function at 0x66f090
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], str.ADVAPI32.DLL
call fcn.007c60a0
mov dword [0x80f9f0], eax
test eax, eax
jne 0x66f0bf
mov ecx, 3
sub ecx, eax
xor ecx, eax
mov esi, 0xffffffff
jne 0x66f1ba
mov dword [esp], eax
mov dword [esp + 4], 0x7e2c26
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80f9dc], eax
test eax, eax
je 0x66f17c
mov eax, dword [0x80f9f0]
mov dword [esp], eax
mov dword [esp + 4], 0x7e2c36
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80f9e0], eax
test eax, eax
je 0x66f17c
mov eax, dword [0x80f9f0]
mov dword [esp], eax
mov dword [esp + 4], 0x7e2c46
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80f9e4], eax
test eax, eax
je 0x66f17c
mov eax, dword [0x80f9f0]
mov dword [esp], eax
mov dword [esp + 4], 0x7e2c57
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80f9e8], eax
test eax, eax
jne 0x66f14e
mov ecx, eax
or ecx, 2
xor eax, 2
add eax, ecx
jne 0x66f17c
mov eax, dword [0x80f9f0]
mov dword [esp], eax
mov dword [esp + 4], 0x7e2c70
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x80f9ec], eax
test eax, eax
je 0x66f17c
imul eax, eax
and eax, 3
xor esi, esi
cmp eax, 2
jne 0x66f1ba
mov edi, dword [0x80f9f0]
test edi, edi
mov esi, 0xffffffff
je 0x66f1ba
xor eax, eax
test al, al
jne 0x66f1ba
mov ebx, 0xffffffff
jmp 0x66f1b5
mov dword [esp], edi
call sub.KERNEL32.dll_FreeLibrary
sub esp, 4
mov dword [0x80f9f0], 0
add ebx, 1
jb 0x66f1a0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x67a460
Capabilities:
Write file on windows

Disassembly:
call fcn.0066eab0
jmp fcn.007c3eb0

Function at 0x67a490
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x81c
mov esi, dword [esp + 0x830]
mov dword [esp + 0x18], esi
lea edi, [esp + 0x1c]
mov dword [esp + 0x14], edi
lea ebx, [esp + 0x81c]
mov dword [esp], esi
call fcn.007c3e70
lea eax, [esi + eax + 1]
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x14]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 0x10], 0
call fcn.007c5b50
mov esi, 0x76
test eax, eax
jne 0x67a57c
mov ebp, 0x11
xor ebx, ebx
jmp 0x67a51a
mov ebp, 2
mov dword [esp], edi
mov dword [esp + 4], 2
call sub.KERNEL32.dll_SetFileAttributesW
sub esp, 8
xor esi, esi
cmp ebp, 2
je 0x67a57c
test bl, bl
jne 0x67a57c
mov ebp, 0x11
mov dword [esp], edi
mov dword [esp + 4], 0
call sub.KERNEL32.dll_CreateDirectoryW
sub esp, 8
test eax, eax
jne 0x67a577
imul eax, eax
and eax, 3
cmp eax, 1
ja 0x67a577
mov ebp, 5
call sub.KERNEL32.dll_GetLastError
mov ecx, 3
sub ecx, eax
xor ecx, eax
mov esi, 0x76
mov ecx, 0x84
cmovne esi, ecx
cmp eax, 0xb7
mov eax, 0x76
cmovne esi, eax
cmp ebp, 5
jne 0x67a500
mov eax, esi
add esp, 0x81c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6885d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov eax, edx
and eax, 1
xor eax, edx
cmp eax, 0xffffffff
setne al
movzx ecx, al
xor eax, eax
sub edx, ecx
mov dword [esp + 4], edx
mov ecx, 0
je 0x68874d
mov eax, dword [esp + 0x2c]
imul eax, eax
and eax, 3
cmp eax, 2
sete al
movzx eax, al
mov dword [esp], eax
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x688638
cmp ebp, 0x10
je 0x6886c0
imul ebp, ebp
and ebp, 3
cmp ebp, 3
je 0x6886c0
mov edi, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov edx, dword [esp]
cmp dword [esp + 0x2c], edx
mov edx, 1
mov ebx, 0
je 0x688728
nop dword [eax]
mov esi, ebx
mov eax, dword [esp + 0x28]
movzx eax, byte [eax + edx - 1]
cmp eax, edi
jne 0x68867f
mov ebp, 0x10
mov ecx, 3
sub ecx, eax
xor ecx, eax
jne 0x6886b0
cmp edi, eax
setb cl
imul eax, eax
and eax, 3
cmp eax, 2
sete al
or al, cl
movzx ebx, al
add ebx, esi
cmp edx, dword [esp + 0x2c]
lea edx, [edx + 1]
jb 0x688660
xor eax, eax
test al, al
jne 0x688660
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
jmp 0x688728
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, edi
jmp 0x688620
mov eax, edi
and eax, 1
inc eax
xor eax, edi
sete al
movzx eax, al
xor ecx, ecx
mov edx, 1
cmp edi, eax
mov ebp, 0
je 0x688717
nop
mov ebx, ebp
mov eax, dword [esp + 0x2c]
sub eax, ebx
mov ebp, ecx
imul ebp, eax
mul edx
mov ecx, edx
add ecx, ebp
mov edx, ebx
not edx
and edx, 1
add edx, ebx
setne dl
movzx ebp, dl
add ebp, ebx
mov ebx, 3
sub ebx, ebp
xor ebx, ebp
cmp ebp, edi
mov edx, eax
jne 0x6886e0
test ebx, ebx
je 0x6886e0
mov eax, edx
mul esi
imul ecx, esi
add ecx, edx
add eax, dword [esp + 8]
adc ecx, dword [esp + 0xc]
mov ebp, 0x12
lea edx, [edi + 1]
mov ebx, edx
not ebx
and ebx, 1
lea ebx, [edi + ebx + 1]
cmp edx, dword [esp + 4]
jne 0x688620
test ebx, ebx
je 0x688620
mov edx, dword [esp + 0x24]
mov dword [edx], eax
mov dword [edx + 4], ecx
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x699080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x48]
mov dword [esp + 0x30], 0
mov ebp, dword [eax + 8]
test ebp, ebp
je 0x69910e
mov al, 0x22
movzx ecx, al
mov eax, 0xffffffff
cmp ecx, 0x22
jne 0x6990d2
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + 4]
mov dword [esp + 0x24], ecx
xor esi, esi
jmp 0x6990c4
mov bl, 0x71
mov bh, 0x31
add eax, 1
jb 0x6990c0
mov dword [esp + 0x28], eax
jmp 0x69915e
mov edx, 0x99
add edx, 0xffffff75
mov ecx, dword [esp + 0x48]
lea ecx, [ecx + 4]
mov dword [esp + 0x24], ecx
xor esi, esi
jmp 0x6990fa
mov bl, dl
xor bl, 0x7f
mov bh, bl
add bh, 0xc0
add eax, 1
jb 0x6990f0
mov dword [esp + 0x1c], ebp
mov ebp, edx
mov dword [esp + 0x20], edx
jmp 0x69927b
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov dword [esp + 0x18], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
call fcn.007855d0
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 2
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx]
lea edx, [esi + esi*2]
cmp dword [ecx + edx*8], 0x1e
jne 0x6991e3
lea eax, [ecx + edx*8]
lea ecx, [esp + 0x2c]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.007898a0
mov dword [esp + 0x30], eax
test eax, eax
je 0x6991b7
mov cl, 0x1b
mov edi, 0xe
movzx ecx, cl
cmp ecx, 0x15
je 0x6991df
mov dword [esp + 0x28], eax
cmp ecx, 0x1b
je 0x699152
cmp ecx, 0x78
je 0x699152
mov eax, 0xffffffff
nop
add eax, 1
jb 0x6991b0
jmp 0x699152
mov dword [esp + 0x28], eax
movzx edx, bh
cmp edx, 0x1f
je 0x6991f7
mov ecx, 0x14
mov eax, 0xf
cmp edx, 0x31
mov dword [esp + 0x20], esi
je 0x69928e
jmp 0x6992a9
mov dword [esp + 0x28], eax
cmp edi, 2
mov eax, ebp
mov dword [esp + 0x20], esi
jne 0x699152
jmp 0x6992d2
mov bh, 0x1f
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00692a60
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 8]
mov dword [esp + 0x20], esi
jmp 0x6992d2
mov bh, 0x31
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00692a60
mov eax, dword [esp + 0x48]
mov ebp, dword [eax + 8]
add esi, 1
jb 0x699220
mov eax, ebp
jmp 0x6992f7
mov ebp, 0x13
mov bh, 0xd
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00692a60
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 8]
add edi, 1
jb 0x699250
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x28], ecx
cmp ebp, 0xe
mov ebp, dword [esp + 0x1c]
je 0x69915e
jmp 0x6992d2
cmp ecx, 0xf
jne 0x6992bd
mov eax, 0x19
mov bl, 0x79
mov ecx, dword [esp + 0x20]
lea esi, [ecx + 1]
cmp esi, ebp
jb 0x69915e
cmp eax, 0xf
jne 0x69910e
mov dword [esp + 0x1c], ebp
mov edi, 0xffffffff
jmp 0x699272
mov esi, 0xffffffff
mov edi, 0xec
add edi, 0xffffff1f
jmp 0x69923d
mov ecx, 0xf
movzx edx, bl
cmp edx, 0x71
jne 0x699302
mov edi, 8
mov bl, 0x71
mov ecx, dword [esp + 0x20]
lea esi, [ecx + 1]
cmp esi, eax
mov ebp, eax
jb 0x69915e
cmp edi, 8
je 0x69910e
jmp 0x6992d2
mov ebp, eax
jmp 0x69928e
Function at 0x787a90
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov edi, dword [esp + 0x78]
lea esi, [esp + 0x40]
mov dword [esp], esi
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
call fcn.007c51a0
mov dword [esp + 0x50], 0x7265696e
mov dword [esp + 0x54], edi
mov dword [esp + 4], esi
mov dword [esp + 8], 0x20
mov dword [esp], 0xfffffff7
call fcn.0068ece0
mov ecx, eax
imul ecx, ecx
and ecx, 3
cmp ecx, 2
sete cl
movzx ecx, cl
cmp eax, ecx
jne 0x787c41
mov edi, dword [esp + 0x74]
mov eax, 0x23
movzx ebx, al
cmp ebx, 0x5f
jne 0x787b8a
mov dword [esp + 0x18], esi
mov dword [esp + 4], edi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x20
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x10], 0xff
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x31
mov dword [esp], 0x18
call fcn.007880d0
jmp 0x787c41
add ebx, 0x3b
xor ebp, ebp
jmp 0x787c39
and ebx, 0xffffff82
add bl, 0x21
mov eax, ebp
or eax, 2
mov ecx, ebp
xor ecx, 2
add ecx, eax
setne al
movzx eax, al
add ebp, eax
mov dword [esp + 0x18], esi
mov dword [esp + 4], edi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x20
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x10], 0xff
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x31
mov dword [esp], 0x18
call fcn.007880d0
movzx ebx, bl
test ebp, ebp
je 0x787ba0
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x78a580
Capabilities:
Check os version

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
mov ebp, 0x10
mov dword [esp + 0xc], 0x94
lea eax, [esp + 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
test eax, eax
jne 0x78a714
jmp 0x78a744
mov bl, 0x1f
mov esi, dword [esp + 0x10]
cmp esi, 6
ja 0x78a6a5
mov al, 0x14
mov ecx, 7
movzx edx, al
cmp edx, 0x14
je 0x78a5ee
mov eax, 0x18
cmp edx, 0x4b
jne 0x78a605
mov ecx, 4
mov eax, 0xb
cmp esi, 6
je 0x78a776
cmp ecx, 4
je 0x78a744
cmp esi, 6
je 0x78a68b
jmp 0x78a744
cmp eax, 0xa
jne 0x78a673
mov ebp, 0xa
mov dword [0x8187e0], 0
mov dword [0x8187e4], 0
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x8187e8
mov dword [esp], 0x8189e8
call fcn.007c5710
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x8189f0
mov dword [esp], 0x818bf0
call fcn.007c5710
mov dword [0x818bf8], 0
mov dword [0x818bfc], 0
xor edi, edi
jmp 0x78a6c6
mov ecx, 0xa
mov eax, 0x13
cmp esi, 6
jne 0x78a69c
cmp eax, 4
je 0x78a744
mov ecx, 0xf
mov ebp, 0x19
cmp dword [esp + 0x14], 1
jbe 0x78a6c6
cmp ecx, 0xa
je 0x78a744
mov eax, 9
movsx ecx, bl
cmp ecx, 0x44
jg 0x78a6d2
movzx edx, bl
cmp edx, 0x1f
je 0x78a706
mov ecx, 7
cmp edx, 0x22
je 0x78a736
jmp 0x78a72d
cmp ebp, 0xa
mov eax, edi
jne 0x78a744
jmp 0x78a8d7
movzx ecx, bl
cmp ecx, 0x45
je 0x78a71f
cmp ecx, 0x6e
jne 0x78a72d
mov ecx, 0xffffffff
mov eax, 0x23
xor eax, 0x27
jmp 0x78a6fc
mov bl, al
xor bl, 0xc
mov byte [0x8187d4], 1
add ecx, 1
jb 0x78a6f0
jmp 0x78a682
mov ebp, 3
mov bl, 0x6e
mov byte [0x8187d4], 1
cmp ebp, 3
jne 0x78a5b3
jmp 0x78a744
mov eax, 7
mov bl, 0x1f
mov byte [0x8187d4], 1
cmp eax, 7
je 0x78a744
mov bl, 0x22
jmp 0x78a73d
cmp ecx, 1
je 0x78a7b1
mov bl, 0x45
mov byte [0x8187d4], 1
mov eax, dword [esp + 0xb4]
mov dword [esp], eax
call fcn.0079dcf0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x78a8d7
mov al, 0x59
movzx eax, al
cmp eax, 0x59
jne 0x78a77f
mov eax, 5
mov edi, 0xffffffff
cmp eax, 5
jne 0x78a68b
mov bh, 0x52
mov dword [esp + 4], 0
mov dword [esp], 0x8187d8
call fcn.007c74b0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x78a8d7
mov ecx, 1
movzx eax, bh
cmp eax, 0x27
jne 0x78a736
mov bh, 0x6d
mov dword [esp + 4], 0
mov dword [esp], 0x8187dc
call fcn.007c74b0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x78a8d7
mov edi, 0xffffffff
movzx ecx, bh
cmp ecx, 0x6d
je 0x78a869
mov eax, 0xa
cmp ecx, 2
je 0x78a605
mov eax, 0xffffffff
jmp 0x78a862
mov dword [0x8187e0], 0
mov dword [0x8187e4], 0
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x8187e8
mov dword [esp], 0x8189e8
call fcn.007c5710
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x8189f0
mov dword [esp], 0x818bf0
call fcn.007c5710
mov dword [0x818bf8], 0
mov dword [0x818bfc], 0
xor eax, eax
add edi, 1
jb 0x78a800
jmp 0x78a8d7
mov eax, 0xffffffff
jmp 0x78a8d2
mov dword [0x8187e0], 0
mov dword [0x8187e4], 0
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x8187e8
mov dword [esp], 0x8189e8
call fcn.007c5710
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x8189f0
mov dword [esp], 0x818bf0
call fcn.007c5710
mov dword [0x818bf8], 0
mov dword [0x818bfc], 0
xor eax, eax
add edi, 1
jb 0x78a870
add esp, 0xa0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7920f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [esp + 0x34]
test esi, esi
jne 0x792113
mov eax, 3
sub eax, esi
xor eax, esi
mov eax, 0xf900000e
jne case.0x79212d.6
mov al, byte [esp + 0x30]
mov byte [esp + 0x17], al
movzx ecx, al
mov eax, 0xf9000016
cmp ecx, 0xd
ja case.default.0x79212d
mov edi, 2
jmp dword [ecx*4 + 0x7ec990]
mov edi, 0x3f
jmp case.0x79212d.0
cmp ecx, 0x22
jne case.0x79212d.6
mov edi, 0x121
jmp case.0x79212d.0
mov edi, 0xd
jmp case.0x79212d.0
mov edi, 0x15
jmp case.0x79212d.0
mov edi, 0x1c
jmp case.0x79212d.0
mov edi, 0x44
jmp case.0x79212d.0
mov edi, 9
jmp case.0x79212d.0
mov edi, 0x2e
mov eax, 0xf9000016
mov ebx, 0xffffffff
lea ebp, [esp + 0x17]
jmp 0x7921a0
mov dword [esp + 0x10], esi
mov dword [esp + 8], edi
mov dword [esp], ebp
mov dword [esp + 0xc], 1
mov dword [esp + 4], 1
call fcn.007aa280
add ebx, 1
jb 0x792180
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x793570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x24]
mov eax, edx
imul eax, eax
and eax, 3
cmp eax, 2
sete al
movzx ecx, al
xor eax, eax
cmp edx, ecx
je 0x7936e5
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], 0
nop word cs:[eax + eax]
mov ecx, 0xb
test ebx, ebx
mov eax, 0xf900000e
je 0x793670
test edi, edi
je 0x793670
mov eax, 0xfa000004
cmp byte [ebx + 0x1f], 0
js 0x7936e5
mov dword [esp], edi
mov dword [esp + 8], 0x21c
mov dword [esp + 4], 0
call fcn.007c51a0
lea eax, [ebx + 0x20]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], 0x10
call fcn.007c51d0
mov ax, word [ebx + 0x30]
mov word [edi + 0x10], ax
mov eax, dword [ebx + 0x32]
mov dword [edi + 0x14], eax
mov al, byte [ebx + 0x36]
mov byte [edi + 0x18], al
movzx eax, word [ebx + 0x37]
test eax, eax
mov word [edi + 0x1a], ax
je 0x7936aa
mov ecx, 0x1b
lea edx, [eax - 1]
sar edx, 0x1f
shr edx, 0x1c
lea ebp, [eax + edx - 1]
and ebp, 0xff0
add ebp, 0x10
and ebp, 0xff0
lea edx, [ebp + 0x19]
mov eax, 0xf9000022
cmp edx, 0x201
jb 0x793670
mov esi, edx
or esi, 2
xor edx, 2
add edx, esi
jne 0x7936e5
nop dword [eax]
xor esi, esi
cmp ecx, 0xb
jne 0x793697
jmp 0x7936e5
inc esi
lea eax, [ebx + 0x39]
lea ecx, [edi + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.007c51d0
mov eax, esi
not eax
and eax, 1
add eax, esi
setne al
movzx eax, al
cmp esi, eax
jb 0x793680
add ebx, 0x220
add edi, 0x21c
mov ecx, dword [esp + 0xc]
mov eax, ecx
not eax
and eax, 1
add eax, ecx
setne al
movzx eax, al
add ecx, eax
mov dword [esp + 0xc], ecx
cmp ecx, dword [esp + 0x24]
jb 0x7935b0
xor eax, eax
xor ecx, ecx
test cl, cl
jne 0x7935b0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x79c5f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov cx, word [ebp + 0xc]
test cx, cx
je 0x79c69c
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x3c]
nop word cs:[eax + eax]
mov dword [esp + 0x1c], ecx
mov dword [esp + 4], esi
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 8], 0x10
call fcn.007c51d0
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x38
mov dword [esp + 8], 0
call fcn.0079cbf0
mov dword [esp + 0x10], esi
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x39
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0079cbf0
mov ecx, dword [esp + 0x1c]
movups xmm0, xmmword [esi]
xorps xmm0, xmmword [esp + 0x20]
movups xmmword [esi], xmm0
dec ecx
add ebx, 0x10
test cx, cx
jne 0x79c620
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret