joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7397a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x41
push 0
push 0
dec ecx
jne 0x7397ac
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
xor eax, eax
push ebp
push 0x73ae11
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x7393bc]
call fcn.0040999c
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x50]
test edx, edx
je 0x7397e3
sub edx, 0xfffffff8
call fcn.00410d98
mov eax, dword [0x8d1a20]
cmp byte [eax], 1
je 0x73adbf
mov eax, dword [ebp - 0x3c]
inc dword [eax + 0x4bc]
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x4bc], 5
jle 0x739820
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [eax + 0x4bc], edx
mov eax, dword [ebp - 0x3c]
mov byte [eax + 0x4b9], 0x63
mov byte [ebp - 0x3f], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x5a4]
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x18]
call fcn.0040b8b4
lea eax, [ebp - 0x1c]
call fcn.0040b8b4
mov byte [ebp - 0x3d], 0
mov byte [ebp - 0x3e], 0
lea edx, [ebp - 0x3d]
mov eax, dword [ebp - 0x3c]
call fcn.00738d04
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0x514]
mov eax, dword [ebp - 0x3c]
add eax, 0x4ac
mov ecx, 0x73ae2c
call fcn.0040ca8c
cmp byte [ebp - 0x3d], 0
jne 0x7398e2
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0x514]
lea eax, [ebp - 0x10]
mov ecx, 0x73ae80
call fcn.0040ca8c
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.0043057c
cmp al, 1
jne 0x7398e2
xor eax, eax
push ebp
push 0x7398d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x73aecc
push 0x73aed0
mov eax, dword [ebp - 0x10]
call fcn.0040c824
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7398e2
cmp byte [ebp - 0x3d], 0
jne 0x73adb1
mov eax, 0x3a98
call fcn.004c719c
lea eax, [ebp - 0x2c]
call fcn.0040b8d8
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x4ac]
mov dl, 1
call fcn.0043057c
cmp al, 1
jne 0x739916
mov byte [ebp - 0x3e], 1
cmp byte [ebp - 0x3e], 1
jne 0x73adb1
mov byte [ebp - 0x40], 0
xor eax, eax
push ebp
push 0x73a8a1
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043d7c8
push eax
push 1
push 0x1000
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x4ac]
mov dl, 1
mov eax, dword [0x4a2e60]
call fcn.004ca1b4
mov esi, eax
jmp 0x73a879

Function at 0x7432e0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c8d8
add esp, 0x20c
pop ebx
ret
Function at 0x7438c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x7439bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x743999
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040bcec
lea eax, [ebp - 0x4c]
push eax
call sub.kernel32.dll_GetStartupInfoW
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_WTSGetActiveConsoleSessionId
push eax
call sub.WTSAPI32.DLL_WTSQueryUserToken
test eax, eax
je 0x74398f
test esi, esi
je 0x74394d
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
mov eax, esi
call fcn.0040c824
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x74397b
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
cmp bl, 1
jne 0x74398f
test al, al
je 0x74398f
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7439a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7439c2
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x7439cc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c8d8
add esp, 0x20c
pop ebx
ret
Function at 0x7441ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b9a8
mov eax, dword [ebp - 8]
call fcn.0040b9a8
xor eax, eax
push ebp
push 0x7443d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0x7443e8
push 0x744408
call sub.user32.dll_FindWindowW
test eax, eax
jne 0x7441ff
call sub.kernel32.dll_GetLastError
jmp 0x7443ac
lea edx, [ebp - 0x10]
push edx
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x74422c
call sub.kernel32.dll_GetLastError
jmp 0x7443ac
xor edx, edx
push ebp
push 0x7443a5
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
push eax
push 0xf01ff
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x74425f
call sub.kernel32.dll_GetLastError
call fcn.0040b014
jmp 0x7443ac
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.00408280
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], 1
mov eax, 0x744418
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.Userenv.dll_CreateEnvironmentBlock
xor edx, edx
push ebp
push 0x744385
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 8], 0
je 0x744311
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x400
push 0
push 0
push 0
push 0x744444
push dword [ebp - 4]
push 0x744444
push 0x744454
push dword [ebp - 8]
push 0x744444
lea eax, [ebp - 0x74]
mov edx, 6
call fcn.0040cb14
mov eax, dword [ebp - 0x74]
call fcn.0040c824
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
jmp 0x744361
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x400
push 0
push 0
push 0
push 0x744444
push dword [ebp - 4]
push 0x744444
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.0040cb14
mov eax, dword [ebp - 0x78]
call fcn.0040c824
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x74436c
call sub.kernel32.dll_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x74438c
mov eax, dword [ebp - 0x1c]
push eax
call sub.Userenv.dll_DestroyEnvironmentBlock
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7443dd
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.0040b914
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b914
pop eax
jmp eax
Function at 0x7508c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
xor eax, eax
push ebp
push 0x750988
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x750961
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
xor eax, eax
mov dword [ebp - 0x38], eax
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x34], eax
mov eax, 0x750998
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x44]
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e90fc
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.00430b20
mov eax, dword [ebp - 0x40]
call fcn.0040c824
mov dword [ebp - 0x2c], eax
mov eax, 0x7509a4
mov dword [ebp - 0x28], eax
mov eax, 0x7509c4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x75096b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75098f
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040b914
pop eax
jmp eax

Function at 0x7509c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
xor eax, eax
push ebp
push 0x750a84
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x750a5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
xor eax, eax
mov dword [ebp - 0x38], eax
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x44]
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e90fc
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.00430b20
mov eax, dword [ebp - 0x40]
call fcn.0040c824
mov dword [ebp - 0x2c], eax
mov eax, 0x750a94
mov dword [ebp - 0x28], eax
mov eax, 0x750ab4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x750a67
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x750a8b
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040b914
pop eax
jmp eax
Function at 0x750df4
Capabilities:
Query service status
Start service

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
xor ebx, ebx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebp, eax
test ebp, ebp
je 0x750e7b
push 0xf01ff
push 0x750e88
push ebp
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x750e75
push esp
push 0
push esi
call sub.advapi32.dll_StartServiceW
xor edi, edi
jmp 0x750e57
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e8470
cmp dword [esp + 8], 2
jne 0x750e66
push 0x3e8
call sub.kernel32.dll_Sleep
inc edi
cmp edi, 0xa
jg 0x750e66
lea eax, [esp + 4]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x750e34
cmp dword [esp + 8], 4
jne 0x750e6f
mov bl, 1
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebp
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x750ea8
Capabilities:
Query service status
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x750f1e
push 0x24
push 0x750f30
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x750f1e
push esp
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x750f18
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x750f12
jmp 0x750f0b
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_Sleep
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x750f12
cmp edi, dword [esp + 0x14]
ja 0x750f12
cmp dword [esp + 4], 1
jne 0x750eec
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [esp + 4], 1
sete al
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x750f50
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x750f94
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x750f94
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x751034
mov eax, 0x400
call fcn.00407160
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x75102d
mov eax, 0x8cb990
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
mov eax, dword [esp + 0x38]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x751023
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x75101f
mov byte [esp], 1
jmp 0x751023
inc edi
dec ebx
jne 0x751006
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.0040717c
movzx eax, byte [esp]
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x751040
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
xor eax, eax
mov edx, dword [esp + 0x10]
sub edx, 2
jne 0x751067
cmp dword [esp + 4], 6
jb 0x751067
mov al, 1
add esp, 0x114
ret
Function at 0x756528
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
lea ebx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.004ba800
xor eax, eax
push ebp
push 0x756683
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov byte [eax], 0
push 0
push 0
push 0
push 0
push 0x7566a0
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0xc], eax
push 0
push 0
push 3
push 0x7566a0
push 0x7566a0
push 0x1bb
mov eax, esi
call fcn.0040c824
mov edi, eax
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetConnectW
xor eax, eax
push ebp
push 0x756672
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80000000
push 0
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x756652
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x756632
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0x400
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetReadFile
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov cx, 2
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0x30]
mov ecx, dword [ebx]
lea edx, [ebp - 0x414]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov esi, dword [eax]
call dword [esi + 0x1c]
cmp dword [ebx], 0
jne 0x7565dd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x756639
mov eax, dword [ebp - 8]
mov byte [eax], 1
pop eax
jmp eax
Function at 0x7892bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x789417
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x7893fa
mov eax, ebx
test eax, eax
je 0x7892f5
sub eax, 4
mov eax, dword [eax]
jmp 0x7892f7
xor eax, eax
mov edi, eax
test ebx, ebx
je 0x789307
mov eax, ebx
sub eax, 0xa
movzx eax, word [eax]
jmp 0x78930b
mov ax, 2
cmp ax, 1
jne 0x78938c
test ebx, ebx
je 0x78931f
mov eax, ebx
sub eax, 0xc
movzx eax, word [eax]
jmp 0x789327
mov eax, dword [0x8d26e0]
movzx eax, word [eax]
push edi
push 0
push 0
movzx eax, ax
mov ecx, ebx
xor edx, edx
call fcn.00412438
mov edi, eax
cmp edi, 0x100
jle 0x78934f
mov eax, edi
add eax, eax
call fcn.00407160
mov esi, eax
jmp 0x789355
lea esi, [ebp - 0x200]
test ebx, ebx
je 0x789363
mov eax, ebx
sub eax, 0xc
movzx edx, word [eax]
jmp 0x78936c
mov edx, dword [0x8d26e0]
movzx edx, word [edx]
mov eax, ebx
test eax, eax
je 0x789379
sub eax, 4
mov eax, dword [eax]
jmp 0x78937b
xor eax, eax
push eax
push esi
push edi
movzx eax, dx
mov ecx, ebx
xor edx, edx
call fcn.00412438
jmp 0x7893c5
cmp edi, 0x100
jle 0x7893a1
mov eax, edi
add eax, eax
call fcn.00407160
mov esi, eax
jmp 0x7893a7
lea esi, [ebp - 0x200]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0042f26c
mov eax, dword [ebp - 0x204]
mov ecx, edi
add ecx, ecx
mov edx, esi
call fcn.00407720
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x7893e7
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x7893d1
lea eax, [ebp - 0x200]
cmp esi, eax
je 0x7893fc
mov eax, esi
call fcn.0040717c
jmp 0x7893fc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78941e
lea eax, [ebp - 0x204]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x7aa9e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x7aab87
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x8cbe9c], 0
jne 0x7aab5f
mov eax, dword [0x8d1eec]
cmp dword [eax], 0
jne 0x7aaa27
mov al, 0x1a
call fcn.00407330
mov eax, dword [0x96d3c8]
call fcn.0040a630
or edx, 0xffffffff
call fcn.0040a3ac
xor eax, eax
push ebp
push 0x7aab58
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x8cbe9c], 0
jne 0x7aab3e
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040c9b0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00517cdc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x7aaba4
call fcn.004313e8
mov eax, dword [ebp - 0x10]
call fcn.0040c824
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueW
test eax, eax
jne 0x7aaabf
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040c9b0
jmp 0x7aaaf6
lea eax, [ebp - 4]
mov edx, 0x7aabe0
call fcn.0040bcec
xor eax, eax
push ebp
push 0x7aaaec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00518210
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7aaaf6
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x8cbe9c], eax
cmp dword [0x8cbe9c], 0
jne 0x7aab29
mov ecx, dword [0x8d20b4]
mov dl, 1
mov eax, dword [0x427c50]
call fcn.004382cc
call fcn.0040af20
push 0x7aabf4
mov eax, dword [0x8cbe9c]
push eax
call fcn.00416c20
mov dword [0x96d3cc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7aab5f
mov eax, dword [0x96d3c8]
call fcn.0040a58c
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7aab8e
lea eax, [ebp - 0x1c]
call fcn.0040b8b4
lea eax, [ebp - 0x10]
call fcn.0040b8b4
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x7c13ff
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0x4001f
push 0
push 0
push 0
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x7c1453
push esi
call sub.msvcrt.dll_strlen
pop ecx
inc eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x7f7644
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7f77ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x7f77e4
push ebx
push 0x7f77e4
lea eax, [ebp - 0x6c]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 4]
call fcn.0040c928
call sub.kernel32.dll_GetCurrentProcess
mov ebx, eax
mov esi, 4
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00408280
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 8]
mov edx, 0x7f77ec
call fcn.0040bd40
mov eax, dword [ebp - 8]
call fcn.0040c5ac
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x10]
push eax
push 2
push ebx
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x7f779f
xor eax, eax
push ebp
push 0x7f7798
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 1
push 2
push 0
push 0x2000000
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x7f7779
xor eax, eax
push ebp
push 0x7f7772
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
lea eax, [ebp - 0xc]
push eax
push 0xc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_SetTokenInformation
test eax, eax
je 0x7f7759
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040c5ac
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7f777f
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
mov dword [edi], 0xf423b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7f77a5
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
mov dword [edi], 0xf423c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7f77d1
lea eax, [ebp - 0x6c]
call fcn.0040b8b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b984
pop eax
jmp eax
Function at 0x80b530
Capabilities:
Manipulate console buffer

Disassembly:
add esp, 0xffffffe8
mov word [esp + 4], 1
mov dword [esp + 8], 0xffffffff
mov word [esp + 0xc], 1
mov word [esp + 0xe], 0
mov word [esp + 0x10], 0
mov byte [esp + 0x12], cl
xor eax, eax
mov dword [esp + 0x14], eax
push esp
push 1
lea eax, [esp + 0xc]
push eax
push edx
call sub.kernel32.dll_WriteConsoleInputW
add esp, 0x18
ret
Function at 0x80d450
Capabilities:
Terminate process

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
lea eax, [esp + 4]
push eax
push 0x1388
push 2
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageTimeoutW
push ebx
call sub.user32.dll_IsWindow
test eax, eax
je 0x80d4a9
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp], 0
je 0x80d4a9
mov eax, dword [esp]
push eax
push 0
push 0x401
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x80d4a9
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle
pop ecx
pop edx
pop ebx
ret

Function at 0x80d489
Capabilities:
Terminate process

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
lea eax, [esp + 4]
push eax
push 0x1388
push 2
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageTimeoutW
push ebx
call sub.user32.dll_IsWindow
test eax, eax
je 0x80d4a9
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp], 0
je 0x80d4a9
mov eax, dword [esp]
push eax
push 0
push 0x401
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x80d4a9
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle
pop ecx
pop edx
pop ebx
ret