joyce8/EMBER2024-capa huggingface dataset:
Function at 0x749270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
nop
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
lea eax, [esi + 0x28]
mov dword [esi + 0x2c], 0x74b020
mov ecx, dword fs:[0]
mov dword [esi + 0x28], ecx
mov dword fs:[0], eax
mov dword [esi + 0x30], 0
call fcn.008ef61f
mov dword [esi + 4], eax
mov dword [esi], edx
call fcn.008ef608
nop
push dword [esi]
push dword [esi + 4]
push edx
push eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
call fcn.008ea7c0
mov ebx, eax
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov dword [esi + 0x14], eax
imul eax, ecx, 0x3b9aca00
add eax, edx
mov dword [esi + 0x10], eax
mov edi, dword [esi]
imul edi, ebx
mov eax, ebx
mov ebx, dword [esi + 4]
mul ebx
add edx, edi
imul ecx, ebx
mov edi, ebx
add ecx, edx
mov edx, dword [esi + 8]
sub edx, eax
mov ebx, dword [esi + 0xc]
sbb ebx, ecx
mov eax, edx
mov ecx, 0x3b9aca00
mul ecx
imul ecx, ebx, 0x3b9aca00
add edx, ecx
push dword [esi]
push edi
push edx
push eax
call fcn.008ea7c0
mov edi, eax
add edi, dword [esi + 0x14]
adc edx, dword [esi + 0x10]
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
cmp ebx, 1
mov eax, ecx
sbb eax, 0
jl 0x749389
mov dword [esi], edx
mov edx, 0xfff0bdc0
mov eax, ebx
mul edx
sub edx, ebx
mov dword [esi + 4], ecx
imul ecx, ecx, 0xfff0bdc0
add ecx, edx
add eax, 0xffffffff
adc ecx, 0x7fffffff
cmp edi, eax
mov eax, dword [esi]
sbb eax, ecx
jge 0x74937f
mov ecx, 0xf4240
mov eax, ebx
mul ecx
imul ecx, dword [esi + 4], 0xf4240
add ecx, edx
mov edx, dword [esi]
add edi, eax
adc edx, ecx
jmp 0x749389
mov edx, 0x7fffffff
mov edi, 0xffffffff
nop
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edx
mov dword [esi + 0x30], 0xffffffff
lea eax, [esi + 0x18]
push eax
call fcn.007493d0
add esp, 4
mov eax, dword [esi + 0x28]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7493d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
nop
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
lea eax, [esi + 0x30]
mov dword [esi + 0x34], 0x74b030
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
nop word cs:[eax + eax]
nop
mov dword [esi + 0x38], 0
call fcn.008ef61f
mov dword [esi + 4], eax
mov dword [esi], edx
call fcn.008ef608
nop
push dword [esi]
push dword [esi + 4]
push edx
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.008ea7c0
mov ebx, eax
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov dword [esi + 0xc], eax
imul eax, ecx, 0x3b9aca00
add eax, edx
mov dword [esi + 8], eax
mov edi, dword [esi]
imul edi, ebx
mov eax, ebx
mov ebx, dword [esi + 4]
mul ebx
add edx, edi
imul ecx, ebx
mov edi, ebx
add ecx, edx
mov edx, dword [esi + 0x10]
sub edx, eax
mov ebx, dword [esi + 0x14]
sbb ebx, ecx
mov eax, edx
mov ecx, 0x3b9aca00
mul ecx
imul ecx, ebx, 0x3b9aca00
add edx, ecx
push dword [esi]
push edi
push edx
push eax
call fcn.008ea7c0
mov ebx, eax
add ebx, dword [esi + 0xc]
adc edx, dword [esi + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
mov dword [esi], ecx
mov dword [esi + 8], ebx
cmp ebx, ecx
mov dword [esi + 0xc], edx
mov eax, edx
mov dword [esi + 4], edi
sbb eax, edi
jge 0x74952f
nop
mov dword [esi + 0x38], 1
call fcn.008ef697
mov ecx, edx
mov edi, dword [esi]
sub edi, dword [esi + 8]
mov ebx, dword [esi + 4]
sbb ebx, dword [esi + 0xc]
mov edx, 0x64
mul edx
imul ecx, ecx, 0x64
add ecx, edx
cmp edi, 0xad160000
mov edx, ebx
sbb edx, 0x311cd
mov edx, 0x311cd
cmovge ebx, edx
mov edx, 0xad160000
cmovge edi, edx
add edi, eax
adc ebx, ecx
push 0
push 0x3b9aca00
push ebx
push edi
call fcn.008ea7c0
mov dword [esi + 0x1c], edx
mov dword [esi + 0x18], eax
imul eax, eax, 0xc4653600
add eax, edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x38], 0xffffffff
lea eax, [esi + 0x18]
push eax
call fcn.008ef709
add esp, 4
jmp 0x749410
nop
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x74b080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x74b6d0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call fcn.0074b6c0
movzx esi, byte [0xa56fc2]
mov ecx, dword [0xa20e10]
add ecx, eax
mov edx, dword [0xa20e08]
mov edi, 0xffff5b25
sub edi, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], esi
add ecx, esi
add ecx, edx
add ecx, 0xa4db
call dword [0xa0535c]
call ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0
call fcn.00657000
nop
mov edx, dword fs:[0x2c]
cmp byte [0xa56fe4], 0
nop
mov ebx, dword [ebp - 0x24]
jne 0x74b14f
nop
test byte [0xa56fc2], 1
jne 0x74b14f
nop
mov ecx, dword [0xa587a8]
sub eax, dword [edx + ecx*4]
mov edx, ebx
xor edx, 0xd127784a
cmp eax, edx
jg 0x74b14f
nop
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x74b13d
nop
mov edx, dword [ebp + 8]
mov dword [edx + eax], ecx
nop
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
nop
movzx eax, byte [0xa20d73]
mov ch, bl
xor ch, 0x35
cmp al, ch
je 0x74b1fd
mov eax, dword [ebp - 0x24]
mov cl, al
xor cl, 0x33
mov edx, eax
xor dl, 0x3c
nop word cs:[eax + eax]
mov eax, ecx
lock cmpxchg byte [0xa20d73], dl
je 0x74b192
cmp al, ch
jne 0x74b180
jmp 0x74b1fd
nop
mov byte [ebp - 0x1d], ch
mov eax, dword [ebp - 0x24]
mov ecx, eax
xor ecx, 0x896c12a7
mov dword [ebp - 0x30], ecx
mov edi, eax
xor edi, 0xd1277860
mov esi, eax
xor eax, 0xd1277861
cmp eax, 2
mov ebx, 1
cmovge ebx, eax
xor ecx, ecx
nop
mov eax, dword [ebp - 0x30]
add eax, ecx
xor edx, edx
div edi
not edx
movzx eax, byte [ecx + 0xa20d50]
xor al, byte [edi + edx + 0x9a5650]
mov edx, esi
xor al, dl
xor al, 0x2c
mov byte [ecx + 0xa20d50], al
inc ecx
cmp ebx, ecx
jne 0x74b1c0
nop
movzx eax, byte [ebp - 0x1d]
xchg byte [0xa20d73], al
mov dword [ebp - 0x10], 0xffffffff
nop
mov eax, dword [0xa20e14]
mov esi, dword [0xa20e00]
xor esi, dword [ebp - 0x2c]
sub esi, dword [ebp - 0x28]
add esi, eax
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [0xa0535c]
lea edi, [ebp - 0x40]
mov ecx, edi
push 0xa20d50
call esi
mov dword [ebp - 0x10], 0
push 0x9ed7c4
push edi
call fcn.00901c9b
add esp, 8
nop word cs:[eax + eax]
push ebp
sub esp, 8
add ebp, 0xc
mov dword [ebp - 0x1c], esp
nop
mov esi, dword [ebp - 0x34]
mov eax, dword [esi]
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov ecx, edi
call dword [0xa0535c]
mov ecx, esi
call edi
mov esi, eax
mov eax, dword [0xa20e18]
mov edi, dword [ebp - 0x2c]
xor edi, dword [0xa20e04]
sub edi, dword [ebp - 0x28]
add edi, eax
mov ecx, edi
call dword [0xa0535c]
mov ecx, esi
call edi
int3
Function at 0x754520
Capabilities:
Encode data using xor

Disassembly:
push ebx
movzx eax, byte [0xa21840]
cmp al, 0x4d
je 0x754540
mov cl, 0xc4
nop
mov al, 0x2e
lock cmpxchg byte [0xa21840], cl
je 0x75454a
cmp al, 0x4d
jne 0x754530
push 0xa21830
call fcn.008ebdaa
mov eax, 0xb
nop
mov ecx, eax
not ecx
lea edx, [eax - 1]
and edx, 0xe
xor edx, 0xf
movzx ebx, byte [eax + 0xa21825]
xor bl, byte [edx + 0x9a5d60]
xor bl, 0xa6
mov byte [eax + 0xa21825], bl
and ecx, 0xe
movzx edx, byte [eax + 0xa21826]
xor dl, byte [ecx + 0x9a5d60]
xor dl, 0xa6
mov byte [eax + 0xa21826], dl
add eax, 2
cmp eax, 0x1b
jne 0x754550
mov al, 0x4d
xchg byte [0xa21840], al
push 0xa21830
call fcn.008ebdaa
int3
Function at 0x75e220
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x75f680
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
push 2
mov dword [ebp - 0x20], ecx
push ecx
call fcn.008eb654
add esp, 8
mov eax, dword [ebp - 0x20]
add eax, 0x30
mov dword [ebp - 0x10], 1
push eax
call fcn.008ef8ce
add esp, 4
mov eax, dword [ebp - 0x20]
add eax, 0x58
push eax
call fcn.008ef8ce
add esp, 4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x80], 0
mov byte [ecx + 0x84], 0
add ecx, 0x88
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x30], ecx
push eax
push edx
call fcn.00761a30
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [ebp - 0x10], 3
push 0x118
call fcn.008ea17d
add esp, 4
mov ecx, eax
mov edx, dword [ebp - 0x20]
lea eax, [edx + 0xd4]
mov dword [edx + 0xd4], ecx
mov dword [edx + 0xd8], ecx
lea esi, [ecx + 0x118]
mov dword [ebp - 0x34], esi
mov dword [edx + 0xdc], esi
mov dword [ebp - 0x2c], eax
xorps xmm0, xmm0
movsd qword [ecx + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [ecx + 0x20], xmm0
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx], xmm0
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x24], ecx
call fcn.0075eb50
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 0x38]
xorps xmm0, xmm0
movsd qword [eax + 0x68], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0x58], xmm0
movups xmmword [eax + 0x48], xmm0
movups xmmword [eax + 0x38], xmm0
mov dword [ebp - 0x28], ecx
call fcn.0075eb50
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 0x70]
xorps xmm0, xmm0
movsd qword [eax + 0xa0], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0x90], xmm0
movups xmmword [eax + 0x80], xmm0
movups xmmword [eax + 0x70], xmm0
mov dword [ebp - 0x28], ecx
call fcn.0075eb50
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 0xa8]
xorps xmm0, xmm0
movsd qword [eax + 0xd8], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0xc8], xmm0
movups xmmword [eax + 0xb8], xmm0
movups xmmword [eax + 0xa8], xmm0
mov dword [ebp - 0x28], ecx
call fcn.0075eb50
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 0xe0]
xorps xmm0, xmm0
movsd qword [eax + 0x110], xmm0
xorps xmm0, xmm0
movups xmmword [eax + 0x100], xmm0
movups xmmword [eax + 0xf0], xmm0
movups xmmword [eax + 0xe0], xmm0
mov dword [ebp - 0x28], ecx
call fcn.0075eb50
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov dword [esi + 0xd8], eax
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
call fcn.0075ed90
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x760460
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [ecx + 4]
mov esi, dword [ecx + 8]
sub esi, eax
je 0x7604be
mov edi, esi
mov edx, esi
and edi, 7
je 0x760487
and edx, 0xfffffff8
nop dword [eax + eax]
mov byte [eax], 0
inc eax
dec edi
jne 0x760480
cmp esi, 8
jb 0x7604be
xor esi, esi
nop
mov byte [eax + esi], 0
mov byte [eax + esi + 1], 0
mov byte [eax + esi + 2], 0
mov byte [eax + esi + 3], 0
mov byte [eax + esi + 4], 0
mov byte [eax + esi + 5], 0
mov byte [eax + esi + 6], 0
mov byte [eax + esi + 7], 0
add esi, 8
cmp edx, esi
jne 0x760490
pop esi
pop edi
jmp fcn.006c4510
Function at 0x7661d0
Capabilities:
Persist via run registry key

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov esi, dword [esp + 0x44]
push esi
push 0x9a6709
push 0x9a6718
push 0x80000002
call fcn.00766370
add esp, 0x10
mov eax, dword [esi + 0x10]
test eax, eax
je 0x766336
mov ecx, dword [esi + 0x14]
mov edx, ecx
sub edx, eax
cmp edx, 0x13
jae 0x766235
sub esp, 0x10
movzx eax, byte [esp + 0x18]
mov byte [esp + 4], al
mov dword [esp + 0xc], 0x13
mov dword [esp + 8], 0x9a6759
mov dword [esp], 0x13
mov ecx, esi
call fcn.0066d8c0
jmp 0x76625c
lea edx, [eax + 0x13]
mov dword [esi + 0x10], edx
mov edx, esi
cmp ecx, 0x10
jb 0x766244
mov edx, dword [esi]
movups xmm0, xmmword [0x9a6759]
movups xmmword [edx + eax], xmm0
mov dword [edx + eax + 0xf], 0x73736563
mov byte [edx + eax + 0x13], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
jae 0x766286
lea edx, [eax + 1]
mov dword [esi + 0x10], edx
mov edx, esi
cmp ecx, 0x10
jb 0x766275
mov edx, dword [esi]
mov word [edx + eax], 0x2f
cmp dword [0xa57178], 0
jne 0x7662d3
jmp 0x7662b1
sub esp, 0xc
movzx eax, byte [esp + 0x14]
mov byte [esp + 4], al
mov dword [esp + 8], 0x2f
mov dword [esp], 1
mov ecx, esi
call fcn.00676d30
cmp dword [0xa57178], 0
jne 0x7662d3
mov eax, dword [0xa5717c]
test eax, eax
jne 0x7662d3
push 0
push 0x766730
push 0xa57180
push 0xa57178
call fcn.00766540
add esp, 0x10
mov eax, dword [0xa57178]
mov ecx, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x7662e3
mov eax, dword [eax]
mov edx, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
mov edi, ebx
sub edi, edx
cmp edi, ecx
jae 0x766311
sub esp, 0x10
movzx edx, byte [esp + 0x18]
mov byte [esp + 4], dl
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp], ecx
mov ecx, esi
call fcn.0066d8c0
jmp 0x76632f
lea edi, [edx + ecx]
mov dword [esi + 0x10], edi
cmp ebx, 0x10
jb 0x76631e
mov esi, dword [esi]
add edx, esi
push ecx
push eax
push edx
call fcn.00901d90
add esp, 0xc
mov byte [esi + edi], 0
add esp, 0x34
pop esi
pop edi
pop ebx
ret
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
push eax
call fcn.0076b180
add esp, 4
mov dword [esp + 4], eax
mov eax, esp
lea esi, [esp + 8]
mov ecx, esi
push 0
push eax
call fcn.00765980
push 0x9f8788
push esi
call fcn.00901c9b
int3
Function at 0x766370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea edx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x76db70
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], edx
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x7663b1
mov edx, dword [edi]
mov dword [edi + 0x10], 0
mov byte [edx], 0
lea edx, [ebp - 0x30]
push edx
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x7663d6
xor eax, eax
jmp 0x7664fc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push edx
push 0
push ecx
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
jne 0x7664e6
mov eax, dword [ebp - 0x28]
add eax, 0xfffffffd
cmp eax, 0xfffffffe
jb 0x7664e6
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ecx + 0x10]
mov eax, esi
sub eax, ebx
jbe 0x76644d
mov edx, dword [ecx + 0x14]
mov edi, edx
sub edi, ebx
cmp edi, eax
jae 0x766460
sub esp, 0x10
movzx edx, byte [ebp - 0x20]
mov byte [esp + 4], dl
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 0xc], 0
call fcn.00673b20
jmp 0x76647e
cmp dword [ecx + 0x14], 0x10
mov eax, ecx
jb 0x766457
mov eax, dword [ecx]
mov dword [ecx + 0x10], esi
mov byte [eax + esi], 0
jmp 0x766481
mov dword [ecx + 0x10], esi
mov edi, ecx
cmp edx, 0x10
jb 0x76646c
mov edi, dword [ecx]
add ebx, edi
push eax
push 0
push ebx
call fcn.00901a10
add esp, 0xc
mov byte [edi + esi], 0
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 0x14], 0x10
mov eax, ecx
jb 0x76648b
mov eax, dword [ecx]
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x7664aa
xor ecx, ecx
jmp 0x7664e6
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx + 0x10]
cmp dword [ebx + 0x14], 0x10
mov esi, ebx
jb 0x7664ba
mov esi, dword [ebx]
lea edx, [esi + eax]
lea ecx, [esi + eax]
dec ecx
mov edi, ecx
sub edi, esi
mov esi, ebx
xor ebx, ebx
cmp eax, edi
setne bl
sub eax, ebx
mov dword [esi + 0x10], eax
sub eax, edi
add edx, ebx
dec edx
inc eax
push eax
push edx
push ecx
call fcn.00901d90
add esp, 0xc
mov cl, 1
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x766910
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, ecx
mov eax, dword [0xa47d50]
xor eax, ebp
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x766938
cmp eax, 8
jae 0x766962
jmp 0x7669d4
mov ecx, dword [0xa57170]
test ecx, ecx
jne 0x76694f
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, 2
setb al
shl eax, 5
mov dword [esi + 0xc], eax
cmp eax, 8
jb 0x7669d4
cmp eax, 0x1f
ja 0x76696b
pause
jmp 0x7669d4
cmp eax, 0x20
jne 0x766979
mov ecx, esi
call fcn.007681d0
jmp 0x7669d4
cmp dword [esi + 8], 0
je 0x7669ba
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x76699d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp], eax
mov dword [esp + 4], 0
mov eax, dword [esp]
sub eax, dword [esi]
mov ecx, dword [esp + 4]
sbb ecx, dword [esi + 4]
cmp eax, dword [esi + 8]
sbb ecx, 0
jb 0x7669c2
mov dword [esi + 8], 0
jmp 0x7669be
test al, 1
jne 0x7669c2
push 1
jmp 0x7669ce
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x7669d4
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esi + 0xc]
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.008ea1d3
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x7671c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov esi, esp
mov dword [esi + 0xe0], ebp
mov dword [esi + 0xe4], esp
mov dword [esi + 0xf0], 0xffffffff
lea eax, [esi + 0xe8]
mov dword [esi + 0xec], 0x76dbd0
mov ecx, dword fs:[0]
mov dword [esi + 0xe8], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x30]
push 1
call fcn.006863c0
mov dword [esi + 0xf0], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esi + 0x40]
push eax
call fcn.00767960
push 0x5f
push eax
call fcn.00767590
add esp, 8
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 4]
mov dword [esi + eax + 0x48], 6
mov dword [esi + eax + 0x4c], 0
mov eax, dword [esi + 0x40]
mov eax, dword [eax + 4]
mov ecx, 0xffffcfff
and ecx, dword [esi + eax + 0x54]
or ecx, 0x2000
mov dword [esi + eax + 0x54], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esi + 0x18]
lea edx, [esi + 0x20]
lea edi, [esi + 0x28]
mov ebx, esi
push ecx
push edx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
movsd xmm1, qword [0x9a6680]
movss xmm0, dword [esi + 4]
orpd xmm0, xmm1
movss xmm2, dword [esi]
orpd xmm2, xmm1
subsd xmm2, xmm1
mulsd xmm2, qword [0x9a6688]
subsd xmm0, xmm1
mulsd xmm0, qword [0x9a6690]
addsd xmm0, xmm2
sub esp, 8
movsd qword [esp], xmm0
lea ecx, [esi + 0x40]
call fcn.00767c30
lea ecx, [esi + 0x48]
mov eax, esi
push eax
call fcn.0069bd10
mov edi, dword [ebp + 8]
mov eax, esi
cmp eax, edi
je 0x767336
mov eax, dword [edi + 0x14]
cmp eax, 0x10
jb 0x767313
mov ecx, dword [edi]
lea edx, [eax + 1]
cmp edx, 0x1000
jb 0x767309
mov ebx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, ebx
cmp ecx, 0x20
jae 0x767394
add eax, 0x24
mov edx, eax
mov ecx, ebx
push edx
push ecx
call fcn.008ea1ad
add esp, 8
movsd xmm0, qword [esi + 0x10]
movsd qword [edi + 0x10], xmm0
movupd xmm0, xmmword [esi]
movupd xmmword [edi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov eax, dword [esi + 0x14]
cmp eax, 0x10
jb 0x767369
mov ecx, dword [esi]
lea edx, [eax + 1]
cmp edx, 0x1000
jb 0x76735f
mov edi, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edi
cmp ecx, 0x20
jae 0x767385
add eax, 0x24
mov edx, eax
mov ecx, edi
push edx
push ecx
call fcn.008ea1ad
add esp, 8
lea ecx, [esi + 0x30]
call fcn.00686ff0
mov eax, dword [esi + 0xe8]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0xf0], 1
call fcn.008cd651
mov dword [esi + 0xf0], 0
call fcn.008cd651
nop word cs:[eax + eax]
push ebp
sub esp, 0x14
lea esi, [ebp - 0xf4]
mov ebp, dword [esi + 0xe0]
call fcn.00901a00
nop word cs:[eax + eax]
push ebp
sub esp, 0x14
lea esi, [ebp - 0xf4]
mov ebp, dword [esi + 0xe0]
call fcn.00901a00
nop word cs:[eax + eax]
push ebp
sub esp, 0x14
lea esi, [ebp - 0xf4]
mov ebp, dword [esi + 0xe0]
lea ecx, [esi + 0x30]
call fcn.00686ff0
add esp, 0x14
pop ebp
ret
Function at 0x769690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea ecx, [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp]
and eax, 0xfffffffe
je 0x7696ca
mov ecx, dword [ecx + 8]
movzx edx, byte [ecx]
test dl, 1
jne 0x7696d2
mov edx, dword [ecx]
shr edx, 1
mov dword [esp], edx
mov ecx, dword [ecx + 8]
mov dword [esp + 8], ecx
jmp 0x7696dc
xor esi, esi
mov bl, 1
xor edi, edi
jmp 0x76974f
inc ecx
mov dword [esp + 8], ecx
shr edx, 1
mov dword [esp], edx
xor edi, edi
xor esi, esi
jmp 0x769738
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
shr eax, 1
mov edx, dword [esp]
xor ebx, ebx
cmp edx, eax
setb bl
mov esi, ebx
cmovb eax, edx
push eax
push ecx
push dword [esp + 0x10]
call fcn.00902bc6
add esp, 0xc
xor ebx, ebx
test eax, eax
sets bl
cmove ebx, esi
test bl, bl
mov esi, dword [esp + 4]
cmove esi, ebp
mov eax, ebx
xor al, 1
movzx eax, al
mov eax, dword [ebp + eax*4 + 4]
inc edi
test eax, eax
je 0x76974b
mov ebp, eax
movzx eax, byte [eax + 0xc]
test al, 1
mov dword [esp + 4], esi
je 0x7696f0
lea ecx, [ebp + 0xd]
jmp 0x7696f6
lea ecx, [esp + 0x24]
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x769758
mov dword [eax], edi
test esi, esi
je 0x7697d0
mov eax, dword [ecx + 8]
movzx ecx, byte [esi + 0xc]
mov byte [esp + 4], cl
movzx edx, cl
mov ecx, dword [esi + 0x14]
mov dword [esp + 8], ecx
movzx ecx, byte [eax]
test cl, 1
jne 0x769780
mov ecx, dword [eax]
mov eax, dword [eax + 8]
jmp 0x769781
inc eax
mov dword [esp], eax
shr ecx, 1
lea edi, [esi + 0xd]
shr edx, 1
mov eax, edx
mov edx, dword [esi + 0xc]
shr edx, 1
test byte [esp + 4], 1
cmove edi, dword [esp + 8]
cmovne edx, eax
xor eax, eax
cmp edx, ecx
setb al
mov dword [esp + 4], eax
cmovae edx, ecx
push edx
push dword [esp + 4]
push edi
call fcn.00902bc6
add esp, 0xc
xor ecx, ecx
test eax, eax
sets cl
cmove ecx, dword [esp + 4]
cmp cl, 1
lea ecx, [esp + 0x24]
jne 0x7697df
mov eax, dword [ecx + 0x10]
mov byte [eax], bl
mov eax, dword [ecx + 0x10]
mov dword [eax + 4], ebp
mov al, 1
jmp 0x7697e1
xor eax, eax
mov edx, dword [esp + 0xc]
mov dword [edx], esi
mov byte [edx + 4], al
mov eax, dword [ecx]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x76b680
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0xa47d50]
xor eax, ebp
mov dword [esp + 0x10], eax
mov eax, esp
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x76b755
mov edi, dword [ebp + 0xc]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
cmp eax, edi
mov edx, ecx
sbb edx, 0
jge 0x76b71c
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x76b6e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x76b755
sub edi, dword [esp]
je 0x76b751
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [eax]
cmp edi, 0x200
mov ebx, 0x200
cmovb ebx, edi
push 0
lea eax, [esp + 0x10]
push eax
push ebx
push 0xa57224
push dword [ebp + 8]
call esi
cmp dword [esp + 0xc], ebx
jne 0x76b755
sub edi, ebx
jne 0x76b6f0
jmp 0x76b751
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push 0
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x76b744
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x76b755
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x76b755
mov bl, 1
jmp 0x76b757
xor ebx, ebx
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.008ea1d3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret