joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7747020d
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x7753d344]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, 0xa0
mov dword [ebp - 0xc0], edx
push edi
lea eax, [ebp - 0xac]
mov byte [ebp - 0xad], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0xbc], esi
call fcn.77498e60
add esp, 0xc
lea ebx, [ebp - 0xac]
cmp byte [0x77537c28], 0
mov ecx, edi
jne 0x7747027f
push 0
push 0
push 0x7744ae10
push 0x775386d4
call fcn.77470340
test eax, eax
jne 0x774baaad
mov ecx, edi
lea eax, [esi + 0xc]
mov esi, eax
mov edi, ebx
mov eax, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xbc]
mov dword [ebx + 0x10], eax
movzx eax, word [esi + 0x34]
and dword [ebx + 0x24], 0
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebx + 0x20], eax
lea eax, [ebp - 0xb4]
push eax
push ecx
push ebx
push 0xa0
push ebx
push 0xf
call fcn.774944b0
cmp eax, 0xc0000023
je 0x774baab8
test eax, eax
jne 0x774bab0c
xor edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x18]
mov dword [esi + 0x30], ecx
cmp eax, 3
jne 0x77470326
lea edx, [ebx + 0x28]
mov ecx, esi
call fcn.7747088b
push 0x10
lea eax, [esi + 0xc]
push 0x77424f98
push eax
call fcn.77498780
add esp, 0xc
test eax, eax
je 0x7747032d
cmp byte [ebp - 0xad], 0
jne 0x774bab21
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77494a40
mov esp, ebp
pop ebp
ret 4
cmp eax, 2
je 0x774702e3
jmp 0x774702ed
mov dword [0x775360c0], esi
jmp 0x77470304
push eax
call fcn.774762b0
jmp 0x77470313
cmp byte [ebp - 0xad], 0
je 0x774baad2
mov eax, dword fs:[0x30]
push ebx
push 0
push dword [eax + 0x18]
call fcn.77461440
push dword [ebp - 0xb4]
mov eax, dword fs:[0x30]
push 8
mov byte [ebp - 0xad], 1
push dword [eax + 0x18]
call fcn.77463940
mov ecx, dword [ebp - 0xb4]
mov ebx, eax
lea eax, [esi + 0xc]
test ebx, ebx
jne 0x77470282
mov eax, 0xc0000017
jmp 0x774702cb
push eax
call fcn.774762b0
mov edi, eax
test edi, edi
jne 0x77470304
jmp 0x774702d5
test ebx, ebx
je 0x77470311
mov eax, dword fs:[0x30]
push ebx
push 0
push dword [eax + 0x18]
call fcn.77461440
jmp 0x77470311

Function at 0x774715bd
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
je 0x774bb233
cmp byte [esi + 0xdd], 0
jne 0x774bb233
call fcn.7746d879
test eax, eax
je 0x774bb233
cmp dword [esi + 4], 0x77421100
jne 0x774bb233
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x774bb233
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
cmp dword [ebp + 8], 0
jne 0x774bb248
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x774bb24d
call fcn.77515c15
xor eax, eax
jmp 0x7747160a
Function at 0x774719b9
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
push esi
push edi
movzx edi, word [ecx + 6]
xor ecx, ecx
movzx eax, ax
add edx, eax
test edi, edi
je 0x774719f0
mov esi, dword [ebp + 8]
cmp esi, dword [edx + 0xc]
jb 0x774719e8
mov eax, dword [edx + 0x10]
add eax, dword [edx + 0xc]
cmp esi, eax
jb 0x774719f4
add edx, 0x28
inc ecx
cmp ecx, edi
jb 0x774719d9
xor eax, eax
jmp 0x774719f6
mov eax, edx
pop edi
pop esi
pop ebp
ret 4
Function at 0x7747260a
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
not eax
test eax, eax
jns 0x7747266e
mov edi, 0x77537b60
push edi
call fcn.7746be50
mov ecx, dword [0x77537b84]
lea eax, [esi + 0x20]
mov edx, 0x77537b80
cmp dword [ecx], edx
jne 0x77472672
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [ecx], eax
push edi
mov dword [0x77537b84], eax
call fcn.7746bdd0
cmp dword [0x77537b20], 0
je 0x7747266e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7747266e
push dword [0x77537b20]
call fcn.7746f680
pop edi
pop esi
pop ecx
ret
push 3
pop ecx
int 0x29
Function at 0x77475e42
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edx
mov edx, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
test edi, edi
je 0x77475eca
test edx, edx
jne 0x77475e75
mov ax, word [edi + 0x14]
lea esi, [edi + 0x18]
movzx eax, ax
add esi, eax
je 0x77475eca
mov eax, dword [ebp - 4]
movzx ecx, word [edi + 6]
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x77475ece
mov edi, dword [ebp + 0x10]
test edx, edx
jne 0x77475ea1
cmp byte [ebp + 0x14], dl
je 0x77475ea1
mov ecx, dword [ebp - 8]
and ecx, 0xfffffffc
add ecx, eax
lea eax, [esi + 0x28]
cmp eax, ecx
ja 0x77475ece
mov ecx, dword [ebp - 0xc]
cmp edi, dword [esi + 0xc]
je 0x77475ebf
jbe 0x77475eb2
mov eax, dword [esi + 0x10]
add eax, dword [esi + 0xc]
cmp edi, eax
jb 0x77475ebf
add esi, 0x28
inc ebx
cmp ebx, ecx
jge 0x77475ece
mov eax, dword [ebp - 4]
jmp 0x77475e86
mov eax, esi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
jmp 0x77475ec2
xor eax, eax
jmp 0x77475ec1
Function at 0x774762b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x7751fd00
push 0x7749a000
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7753d344]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ecx, dword fs:[0x18]
test ecx, ecx
je 0x774bd8e8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ecx + 0xbf4], eax
mov dword [ebp - 4], 0xfffffffe
test eax, eax
je 0x774763b5
cmp eax, 0x103
je 0x774763cb
test eax, 0x20000000
jne 0x774763a1
mov ecx, eax
and ecx, 0xff0000
cmp ecx, 0x70000
je 0x774763fe
mov ecx, eax
and ecx, 0xf0000000
cmp ecx, 0xd0000000
je 0x774bd901
xor edi, edi
mov ebx, 0x11b
lea edx, [ebx + edi]
shr edx, 1
mov ecx, dword [edx*8 + 0x7742a940]
mov esi, eax
sub esi, ecx
cmp eax, ecx
jae 0x77476374
lea ebx, [edx - 1]
cmp edi, ebx
jbe 0x77476354
jmp 0x774bd90b
movzx ecx, byte [edx*8 + 0x7742a944]
cmp esi, ecx
jb 0x77476385
lea edi, [edx + 1]
jmp 0x7747636b
movzx eax, word [edx*8 + 0x7742a946]
cmp byte [edx*8 + 0x7742a945], 1
jne 0x774763e4
add eax, esi
movzx eax, word [eax*2 + 0x77428d40]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0x3e5
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [eax + esi*2]
movzx eax, word [ecx*2 + 0x77428d42]
shl eax, 0x10
movzx ecx, word [ecx*2 + 0x77428d40]
or eax, ecx
jmp 0x774763a1
mov ecx, eax
shr ecx, 0x18
cmp ecx, 0x80
jne 0x774bd8f0
movzx eax, ax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
jmp 0x7747630b
cmp ecx, 0xc0
je 0x7747640f
jmp 0x77476339
and eax, 0xcfffffff
jmp 0x7747634d
mov ecx, eax
and ecx, 0xffff0000
cmp ecx, 0xc0010000
je 0x7747640f
push eax
push 0x77427628
call fcn.7744afb0
push 0x7742766c
call fcn.7744afb0
add esp, 0xc
push 0x774276a0
call fcn.7744afb0
add esp, 4
mov eax, 0x13d
jmp 0x774763a1
Function at 0x77476750
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0x14
push 0x7751fd68
call fcn.774a611c
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x774bdb0f
mov edi, 0x77536d60
mov edx, edi
mov ecx, 0x77536d94
call fcn.77476904
push edi
call fcn.7746be50
mov dword [ebp - 4], esi
mov edi, esi
mov dword [ebp - 0x20], edi
mov edx, dword [0x77536d78]
cmp edi, dword [0x77536d80]
jb 0x77476863
test edx, edx
je 0x77476878
mov eax, dword [0x77536d44]
cmp dword [0x77536d80], eax
jae 0x774bdb3c
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x77476808
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x774767c2
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
mov dword [ebp - 0x24], eax
add eax, 2
push eax
push 8
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.77463940
mov esi, eax
test esi, esi
je 0x774bdb6b
push dword [ebp - 0x24]
push edi
push esi
call fcn.774987e0
add esp, 0xc
mov edx, dword [0x77536d78]
imul ecx, dword [0x77536d80], 0x18
mov dword [ecx + edx], ebx
mov dword [ecx + edx + 4], esi
mov eax, dword [ebp + 0x10]
mov dword [ecx + edx + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + edx + 0xc], eax
mov dword [ecx + edx + 0x10], 1
mov eax, dword [ebp + 0x18]
mov dword [ecx + edx + 0x14], eax
inc dword [0x77536d80]
mov dword [ebp - 4], 0xfffffffe
call fcn.774768ac
cmp dword [ebp - 0x1c], 0
jl 0x77476858
test edi, edi
je 0x77476858
mov edx, edi
mov ecx, ebx
call fcn.774768b7
mov eax, dword [ebp - 0x1c]
call fcn.774a6161
ret 0x14
imul eax, edi, 0x18
cmp dword [eax + edx], ebx
je 0x774bdb19
inc edi
mov dword [ebp - 0x20], edi
jmp 0x77476791
push 0x300
push 8
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.77463940
mov edx, eax
test edx, edx
je 0x774bdb2d
mov dword [0x77536d78], edx
mov dword [0x77536d44], 0x20
jmp 0x774767b6
mov eax, 0xc000000d
jmp 0x7747685b
push esi
push esi
push esi
push ebx
call fcn.77476600
mov edx, dword [0x77536d78]
jmp 0x7747686f
mov dword [ebp - 0x1c], 0xc0000017
mov edi, dword [ebp + 0xc]
jmp 0x77476839
add eax, 0x20
imul eax, eax, 0x18
push eax
push edx
push esi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.774601b0
mov edx, eax
test edx, edx
je 0x774bdb2d
mov dword [0x77536d78], edx
add dword [0x77536d44], 0x20
jmp 0x774767b6
mov dword [ebp - 0x1c], 0xc0000017
jmp 0x77476839
Function at 0x77476c36
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0
push 0
push dword [ebx + 0x18]
mov dword [ebp - 8], ebx
push 3
call fcn.7746ba70
mov edx, dword [ebx + 0x1c]
xor edi, edi
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
movzx eax, word [ebx + 0x14]
lea esi, [ebx + 0x18]
add esi, eax
xor eax, eax
cmp ax, word [ebx + 6]
jae 0x77476cd0
cmp dword [esi + 0xc], 0
je 0x77476cc4
cmp dword [esi + 8], 0
je 0x77476cc4
push 8
push 0x774253e8
push esi
call fcn.77499cf0
add esp, 0xc
test eax, eax
je 0x774bde48
push 6
push 0x774253e0
push esi
call fcn.77499cf0
add esp, 0xc
test eax, eax
je 0x774bde48
push 8
push 0x774253d8
push esi
call fcn.77499cf0
add esp, 0xc
test eax, eax
je 0x77476cd9
movzx eax, word [ebx + 6]
inc edi
add esi, 0x28
cmp edi, eax
jb 0x77476c74
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
jmp 0x77476cd2
mov eax, dword [ebp - 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp - 0xc]
add ecx, dword [eax + 0x18]
cmp edx, ecx
jb 0x77476cc4
mov eax, dword [esi + 8]
add eax, ecx
cmp edx, eax
ja 0x77476cc4
test dword [esi + 0x24], 0x20000000
jmp 0x77476cc2

Function at 0x77476f43
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ecx + 0x18]
lea eax, [ebp - 8]
push esi
push edi
push eax
xor esi, esi
push esi
push esi
push ebx
push 3
call fcn.7746ba70
mov edi, dword [ebp - 8]
mov edx, dword [edi + 0x78]
test edx, edx
jne 0x77476f73
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x7c], esi
jbe 0x77476f6a
mov ecx, dword [edi + 0x50]
lea eax, [ecx - 0xd]
cmp edx, eax
jae 0x77476f6a
mov edx, dword [edx + ebx + 0xc]
lea eax, [ecx - 0xc]
cmp edx, eax
ja 0x77476f6a
push 0xc
lea eax, [edx + ebx]
push 0x774254b8
push eax
call fcn.77497440
add esp, 0xc
test eax, eax
jne 0x77476f6a
jmp 0x774be152
movzx eax, word [edi + 0x14]
lea ebx, [edi + 0x18]
add ebx, eax
xor ecx, ecx
xor eax, eax
inc ecx
inc eax
mov dword [ebp - 8], ecx
xor edx, edx
mov dword [ebp - 4], eax
cmp dx, word [edi + 6]
jae 0x77476f6a
test eax, eax
je 0x774be18d
push 5
push 0x7742cb34
push ebx
call fcn.77499cf0
mov ecx, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 4], eax
test ecx, ecx
je 0x774be1a6
push 6
push 0x7742cb3c
push ebx
call fcn.77499cf0
mov ecx, eax
add esp, 0xc
mov dword [ebp - 8], ecx
cmp dword [ebp - 4], 0
jne 0x774be1b7
test ecx, ecx
jne 0x774be1b7
mov al, 1
jmp 0x77476f6c
movzx eax, word [edi + 6]
add ebx, 0x28
inc esi
cmp esi, eax
jae 0x77476f6a
mov eax, dword [ebp - 4]
jmp 0x774be173
Function at 0x774772d5
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x7753d344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x210]
push 0x208
push ebx
push eax
mov dword [ebp - 0x214], ebx
call fcn.77498e60
add esp, 0xc
lea ecx, [ebp - 0x210]
mov edi, ebx
call fcn.77477392
dec eax
cmp eax, 0x102
ja 0x77477325
lea edi, [ebp - 0x210]
mov eax, dword fs:[0x30]
push 0x1c
push 8
push dword [eax + 0x18]
call fcn.77463940
mov esi, eax
test esi, esi
je 0x774be551
lea eax, [ebp - 0x214]
mov dword [esi + 8], ebx
push eax
push ebx
push ebx
push ebx
or ecx, 0xffffffff
call fcn.77477255
mov dword [esi + 0xc], eax
test eax, eax
jne 0x774be56c
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x7747738b
mov eax, dword fs:[0x30]
push esi
push ebx
push dword [eax + 0x18]
call fcn.77461440
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77494a40
mov esp, ebp
pop ebp
ret
call fcn.7751a998
jmp 0x77477368
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], ebx
jne 0x77477378
push 0xe
call fcn.77476240
jmp 0x77477378
mov eax, dword [eax + 0xc]
cmp dword [eax + 0x44], 1
jae 0x774be588
push 0x20010502
jmp 0x774be57e
push 0xe
call fcn.77476240
jmp 0x77477361
call fcn.7751ac50
mov ecx, dword [esi + 0xc]
mov dword [ecx + 0x20], eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x34]
shl eax, 2
push eax
mov eax, dword fs:[0x30]
push 8
push dword [eax + 0x18]
call fcn.77463940
mov dword [esi + 0x10], eax
test eax, eax
jne 0x774be5c8
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], ebx
jne 0x77477361
jmp 0x774be57c
test edi, edi
je 0x774be5d5
mov ecx, edi
call fcn.77477f81
jmp 0x774be5d7
mov eax, ebx
or dword [esi], 0x80
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x214]
and eax, 7
mov dword [esi + 0x18], ebx
or dword [esi + 4], eax
mov eax, esi
jmp 0x7747737a

Function at 0x774778e0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
push esi
push edi
mov edi, edx
test ebx, ebx
je 0x774be626
mov eax, dword [ebx]
add eax, 0xc
push eax
mov dword [ebp - 4], eax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call fcn.77463940
mov esi, eax
test esi, esi
je 0x774be62d
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push edi
push dword [ebp - 8]
call fcn.77492ab0
mov edi, eax
cmp edi, 0xc0000034
je 0x77477973
test edi, edi
js 0x774be637
test ebx, ebx
je 0x7747794b
mov eax, dword [esi + 8]
mov dword [ebx], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x77477957
mov eax, dword [esi + 4]
mov dword [ecx], eax
test edi, edi
js 0x77477973
cmp dword [ebp + 0xc], 0
je 0x77477973
push dword [esi + 8]
lea eax, [esi + 0xc]
push eax
push dword [ebp + 0xc]
call fcn.774987e0
add esp, 0xc
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call fcn.77461440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
jmp 0x774778fc
mov eax, 0xc000009a
jmp 0x77477986
cmp edi, 0x80000005
jne 0x77477957
jmp 0x77477942
Function at 0x77477f81
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x77477fad
xor edx, edx
mov edi, 0x104
mov eax, edx
cmp word [ecx], dx
je 0x77477fa2
inc eax
add ecx, 2
cmp eax, edi
jl 0x77477f95
cmp eax, edi
jl 0x77477fb3
push 0x57
call fcn.77476240
xor eax, eax
pop edi
pop esi
pop ebx
ret
lea ebx, [eax + eax]
lea eax, [ebx + 2]
push eax
mov eax, dword fs:[0x30]
push edx
push dword [eax + 0x18]
call fcn.77463940
mov edi, eax
test edi, edi
je 0x77477fad
push ebx
push esi
push edi
call fcn.774987e0
add esp, 0xc
xor eax, eax
mov word [ebx + edi], ax
mov eax, edi
jmp 0x77477faf
Function at 0x7747caee
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
je 0x774c0c2e
lea ecx, [esi + 0x30]
call fcn.7746d879
test eax, eax
je 0x774c0c2e
cmp dword [esi + 0x34], 0x77421244
jne 0x774c0c2e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x774c0c2e
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
cmp dword [ebp + 8], 0
jne 0x774c0c43
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x774c0c48
call fcn.77515c15
xor eax, eax
jmp 0x7747cb31
Function at 0x7747d266
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
test ecx, ecx
je 0x7747d2bf
test edx, edx
je 0x7747d2bf
mov esi, dword [ebp + 8]
test esi, esi
je 0x7747d2bf
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7747d2bf
mov eax, dword [esi + 0x28]
push 0x1e
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 8
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], edx
push eax
push ecx
call fcn.77492bd0
test eax, eax
js 0x7747d2b8
xor edx, edx
mov ecx, esi
inc edx
call fcn.7747d2cb
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.77515c15
mov eax, 0xc000000d
jmp 0x7747d2b8
Function at 0x7747d8c0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0xc00000bb
test edi, edi
je 0x774c12d7
cmp dword [edi + 0x24], 0
jne 0x774c12d7
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x7747d998
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
test eax, eax
je 0x774c12dc
cmp dword [0x775386dc], eax
je 0x774c12d3
or ecx, 0xffffffff
lock xadd dword [eax + 0xf8], ecx
dec ecx
mov dword [ebp - 0x10], ecx
lock inc dword [eax + 0xfc]
add eax, 8
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov edx, eax
mov esi, ecx
lea eax, [ecx + 1]
mov dword [ebp - 0xc], edx
xor eax, ecx
movzx ebx, ax
mov eax, esi
xor ebx, ecx
mov ecx, dword [ebp - 4]
lock cmpxchg8b qword [edi]
mov ecx, eax
mov eax, edx
mov dword [ebp - 4], eax
cmp ecx, esi
jne 0x7747d931
cmp eax, dword [ebp - 0xc]
jne 0x7747d931
mov edi, dword [ebp + 8]
xor esi, esi
inc esi
or dword [edi + 0x50], 0x10
mov ecx, dword [edi + 0x4c]
mov dword [edi + 0x24], esi
test ecx, ecx
jne 0x7747d9a0
cmp dword [ebp - 0x10], 0
je 0x7747d980
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
mov eax, dword [ebp - 8]
push 9
push dword [eax + 0x24]
call fcn.77494280
jmp 0x7747d977
mov eax, dword [edi + 0x48]
jmp 0x7747d8f3
call fcn.774565d0
jmp 0x7747d96f
mov ecx, esi
jmp 0x774c12e1
call fcn.77515c15
mov ecx, 0xc000000d
mov eax, ecx
sub eax, esi
neg eax
sbb eax, eax
and eax, ecx
jmp 0x7747d977
Function at 0x7747df56
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
push ebx
push esi
mov dword [ebp - 8], edx
xor esi, esi
mov edx, dword [eax + 0x30]
mov ebx, ecx
push edi
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
test eax, eax
je 0x7747df82
and dword [eax], esi
mov eax, dword [ebx + 0x10]
push 2
pop ecx
sub eax, 0
je 0x7747dffb
sub eax, 1
je 0x7747e00e
sub eax, 1
je 0x7747e01f
cmp dword [ebx + 0x10], 3
ja 0x774c1497
test edi, edi
je 0x7747e03c
push dword [ebp + 8]
mov edx, dword [ebx + 8]
mov ecx, edi
push dword [ebp - 8]
push dword [ebx + 0xc]
call fcn.77468810
test eax, eax
js 0x774c147a
cmp esi, 0xfffffffc
jne 0x7747e043
push 2
pop ecx
xor eax, eax
test esi, esi
sete al
or eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0x14], eax
test ecx, ecx
je 0x7747dff0
mov eax, esi
sub eax, 0xfffffffc
neg eax
sbb eax, eax
and eax, esi
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a8]
test eax, eax
je 0x7747e00e
mov esi, dword [eax]
test esi, esi
jne 0x7747e047
mov edi, dword [edx + 0x1f8]
xor esi, esi
test edi, edi
je 0x7747e01f
mov dword [ebx + 0x10], ecx
jmp 0x7747dfa5
mov edi, dword [edx + 0x200]
push 0xfffffffffffffffc
pop esi
test edi, edi
je 0x7747df9b
mov dword [ebx + 0x10], 3
jmp 0x7747dfa5
mov eax, 0xc0150001
jmp 0x7747dff2
xor ecx, ecx
jmp 0x7747dfd0
mov esi, dword [esi + 4]
test esi, esi
je 0x7747e056
cmp esi, 0xfffffffc
je 0x7747e066
mov edi, dword [esi + 0x10]
test edi, edi
je 0x7747e00e
mov dword [ebx + 0x10], 1
jmp 0x7747dfa5
mov edi, dword [edx + 0x200]
jmp 0x7747e056
cmp eax, 0xc0150001
jne 0x7747dff2
cmp dword [ebx + 0x10], 3
je 0x7747dff2
mov edx, dword [ebp - 0xc]
jmp 0x7747df82
mov eax, 0xc00000e5
jmp 0x7747dff2
Function at 0x7747f590
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
shr edi, 1
cmp byte [0x77536d39], 0
jne 0x774c1d62
cmp edi, dword [ebp + 0xc]
jae 0x7747f6a0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x7747f5be
mov dword [eax], edi
mov ecx, dword [ebp + 0x14]
mov ebx, edi
mov edx, dword [ebp + 8]
and ebx, 0xf
mov esi, dword [0x77536d2c]
add edx, 0xfffffff1
add edx, ebx
lea ecx, [ecx + ebx*2]
add ecx, 0xffffffe2
cmp ebx, 0xf
ja 0x7747f5e6
jmp dword [ebx*4 + 0x7747eaa8]
movzx eax, word [ecx + 0x1e]
add ecx, 0x20
add edx, 0x10
mov al, byte [eax + esi]
mov byte [edx - 1], al
movzx eax, word [ecx]
mov al, byte [eax + esi]
mov byte [edx], al
movzx eax, word [ecx + 2]
mov al, byte [eax + esi]
mov byte [edx + 1], al
movzx eax, word [ecx + 4]
mov al, byte [eax + esi]
mov byte [edx + 2], al
movzx eax, word [ecx + 6]
mov al, byte [eax + esi]
mov byte [edx + 3], al
movzx eax, word [ecx + 8]
mov al, byte [eax + esi]
mov byte [edx + 4], al
movzx eax, word [ecx + 0xa]
mov al, byte [eax + esi]
mov byte [edx + 5], al
movzx eax, word [ecx + 0xc]
mov al, byte [eax + esi]
mov byte [edx + 6], al
movzx eax, word [ecx + 0xe]
mov al, byte [eax + esi]
mov byte [edx + 7], al
movzx eax, word [ecx + 0x10]
mov al, byte [eax + esi]
mov byte [edx + 8], al
movzx eax, word [ecx + 0x12]
mov al, byte [eax + esi]
mov byte [edx + 9], al
movzx eax, word [ecx + 0x14]
mov al, byte [eax + esi]
mov byte [edx + 0xa], al
movzx eax, word [ecx + 0x16]
mov al, byte [eax + esi]
mov byte [edx + 0xb], al
movzx eax, word [ecx + 0x18]
mov al, byte [eax + esi]
mov byte [edx + 0xc], al
movzx eax, word [ecx + 0x1a]
mov al, byte [eax + esi]
mov byte [edx + 0xd], al
movzx eax, word [ecx + 0x1c]
mov al, byte [eax + esi]
mov byte [edx + 0xe], al
push 0x10
sub edi, ebx
pop ebx
jne 0x7747f5da
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebp + 0xc]
jmp 0x7747f5b5
mov ecx, dword [ebp + 8]
mov edx, ecx
mov dword [ebp - 8], edx
test edi, edi
je 0x774c1db0
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x774c1dad
movzx eax, word [esi]
add esi, 2
mov ebx, dword [0x775368e4]
movzx eax, word [ebx + eax*2]
mov bx, ax
mov dword [ebp - 4], eax
shr bx, 8
test bl, bl
je 0x774c1da4
mov eax, edx
dec edx
cmp eax, 2
jb 0x774c1dad
mov eax, dword [ebp - 4]
mov byte [ecx], bl
inc ecx
mov byte [ecx], al
inc ecx
dec edx
sub edi, 1
jne 0x774c1d74
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x7747f695
sub ecx, edx
mov dword [eax], ecx
jmp 0x7747f695