joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7df276ba
Capabilities:
Get process heap force flags

Disassembly:
test edi, edi
je 0x7df276cf
jmp 0x7df7c03d
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
je 0x7df20515
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 8
push 8
push dword [eax + 0x18]
call fcn.7df16026
mov esi, eax
test esi, esi
je 0x7df7c045
push dword [ebp + 0x14]
mov dword [esi + 4], ebx
push esi
push 0x7deaf9ac
push 3
push dword [ebp + 8]
mov dword [esi], edi
call fcn.7df27532
mov edi, eax
test edi, edi
jne 0x7df7c04d
push edi
call fcn.7df204f1
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x7df278fd
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
mov esi, dword [ebp + 0x14]
imul esi, esi, 0x18
add esi, 0x40
push esi
push 8
push dword [eax + 0x18]
jo 0x7df27934

Function at 0x7df27d44
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
push edi
mov esi, edx
mov edi, ecx
jne 0x7df27d66
call fcn.7df27dbe
push eax
push 0
push esi
call fcn.7df15f20
add esp, 0xc
push esi
call fcn.7df1ac42
lea eax, [esi + 0x18]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [esi + 0x24], edi
pop edi
mov dword [esi + 0x20], 0x20
lea eax, [esi + 0x113]
xor ecx, ecx
pop esi
mov byte [eax - 1], cl
mov edx, dword [ecx*4 + 0x7dea7650]
shr edx, 3
inc edx
mov word [eax - 3], dx
mov dl, byte [0x7df721e8]
add dl, dl
xor dl, byte [eax]
and dl, 6
xor byte [eax], dl
inc ecx
add eax, 4
cmp ecx, 0x80
jb 0x7df27d88
pop ebp
ret 4

Function at 0x7df28783
Capabilities:
Get process heap flags

Disassembly:
push 0xc
push 0x7de9cc50
call fcn.7df15eb4
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x30]
push 0x7df72120
call fcn.7df0a2b0
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x8c]
cmp dword [esi + 0x88], eax
je 0x7df622e1
mov ecx, dword [esi + 0x88]
mov edx, dword [esi + 0x90]
mov eax, dword [ebp + 8]
mov dword [edx + ecx*4], eax
inc dword [esi + 0x88]
mov cx, word [esi + 0x88]
mov word [eax + 0x80], cx
mov dword [ebp - 4], 0xfffffffe
call fcn.7df287f8
call fcn.7df15ef9
ret 4
Function at 0x7df2ca85
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 0x44]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x48]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x4c]
mov ebx, dword [esi + 0x54]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x38]
mov dword [ebp - 4], eax
mov al, byte [esi + 0x2c]
mov byte [ebp + 0xb], al
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0x5c]
mov edi, dword [esi + 0x40]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x58]
push esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], eax
call fcn.7df2cbfa
push 0x78
push 0
push esi
call fcn.7df15f20
xor esi, esi
add esp, 0xc
cmp dword [ebp - 8], esi
jne 0x7df8249b
cmp ebx, esi
jne 0x7df824a8
cmp dword [ebp - 0x24], esi
jne 0x7df82500
cmp dword [ebp - 0x18], esi
jne 0x7df82559
cmp dword [ebp - 0x30], esi
je 0x7df2cbae
mov ecx, dword [ebp - 0x20]
xor edx, edx
inc edx
cmp ecx, esi
jne 0x7df2d05e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x44]
add ecx, 0x68
lock xadd dword [ecx], edx
mov ecx, dword [eax + 0x44]
add ecx, 0x6c
or edx, 0xffffffff
lock xadd dword [ecx], edx
mov esi, dword [eax + 0x44]
add esi, 8
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
lea edi, [ebx - 1]
xor edi, ebx
and edi, 0xffff
mov eax, ebx
mov edx, ecx
xor ebx, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov edi, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov ecx, edx
cmp ebx, dword [ebp - 0x14]
jne 0x7df2cb5b
cmp ecx, dword [ebp - 0x10]
jne 0x7df2cb5b
mov eax, dword [ebp - 4]
push dword [eax + 0x44]
call fcn.7df1aa4e
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x30], 2
jne 0x7df2cbac
and dword [ebp - 0x38], 0
push 4
lea ecx, [ebp - 0x38]
push ecx
push 9
push eax
call fcn.7df09ac0
xor esi, esi
mov eax, dword [ebp - 0x3c]
cmp eax, esi
jne 0x7df825bb
cmp dword [ebp - 4], esi
je 0x7df2cbce
cmp byte [ebp + 0xb], 0
jne 0x7df2cbce
push 1
push dword [ebp - 4]
call fcn.7df2cdc6
cmp dword [ebp - 0x1c], esi
jne 0x7df825cc
cmp dword [ebp - 0x34], esi
jne 0x7df82624
mov eax, dword [ebp - 4]
pop edi
cmp eax, esi
pop esi
pop ebx
je 0x7df2cbf1
mov ecx, dword [eax + 4]
push eax
call dword [ecx + 4]
leave
ret 4
lea eax, [ecx + 0x68]
lock xadd dword [eax], edx
lea eax, [ecx + 0x6c]
or edx, 0xffffffff
lock xadd dword [eax], edx
mov ebx, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
lea edx, [ebx - 1]
xor edx, ebx
and edx, 0xffff
mov eax, ebx
xor ebx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
mov edx, esi
add ecx, 8
mov dword [ebp - 0x10], ecx
mov ecx, esi
mov esi, dword [ebp - 0x10]
lock cmpxchg8b qword [esi]
mov ebx, eax
mov esi, edx
cmp ebx, dword [ebp - 0x2c]
jne 0x7df2d0b5
cmp esi, ecx
jne 0x7df2d0b5
push dword [ebp - 0x20]
call fcn.7df1aa4e
jmp 0x7df2cb94
mov ecx, dword [ebp - 0x20]
jmp 0x7df2d075
Function at 0x7df2cec4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x60
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x7deb4fac
mov ebx, 0x7deb4e90
test eax, eax
jne 0x7df826eb
test esi, esi
je 0x7df827aa
cmp dword [esi + 0x28], 0
jne 0x7df827aa
mov eax, dword [esi + 0x38]
test eax, eax
je 0x7df56237
mov esi, dword [eax + 0x44]
test esi, esi
je 0x7df82716
cmp dword [0x7df72094], esi
je 0x7df82748
lea ecx, [esi + 0x68]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
mov dword [ebp - 4], eax
xor eax, eax
lea ecx, [esi + 0x6c]
inc eax
lock xadd dword [ecx], eax
inc eax
mov ebx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 8], eax
lea edi, [ebx + 1]
xor edi, ebx
and edi, 0xffff
mov eax, ebx
mov edx, ecx
xor ebx, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea edi, [esi + 8]
lock cmpxchg8b qword [edi]
mov ebx, eax
mov ecx, edx
cmp ebx, dword [ebp - 0x10]
jne 0x7df2cf3f
cmp ecx, dword [ebp - 0xc]
jne 0x7df2cf3f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x28], ecx
mov eax, dword [eax + 0x74]
test eax, eax
je 0x7df2cf81
push eax
call fcn.7df4ca09
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7df82777
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7df2d89c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x7df81e2d
push esi
call fcn.7df2cd5b
mov eax, dword [esi + 0x80]
push ebx
push edi
mov edx, eax
mov edi, eax
and eax, 0xfffffffe
mov ecx, eax
and ecx, 0xfffffffe
and edx, 1
inc ecx
and eax, 1
inc ecx
xor ecx, eax
lea eax, [esi + 0x80]
mov ebx, eax
mov eax, edi
lock cmpxchg dword [ebx], ecx
cmp eax, edi
jne 0x7df2d8c0
pop edi
pop ebx
test edx, edx
je 0x7df2d924
push 2
pop eax
mov ecx, esi
lock xadd dword [ecx], eax
cmp byte [0x7ffe0384], 0
jne 0x7df81e60
push 0
push dword [esi + 0x5c]
lea eax, [esi + 0x60]
push dword [esi + 0x44]
push eax
call fcn.7df2d133
mov eax, esi
or ecx, 0xffffffff
lock xadd dword [eax], ecx
je 0x7df4e8de
mov eax, dword [0x7df700b4]
pop esi
test eax, eax
jne 0x7df81e7a
pop ebp
ret 4
add bh, al
inc ebp
shl byte [ebx], 0
add al, al
jmp 0x7df4e8c5

Function at 0x7df2e533
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword fs:[0x18]
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
mov eax, dword [0x7df700b0]
add eax, 0x300000
push 0x60
or eax, 8
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call fcn.7df16026
test eax, eax
je 0x7df2e5cc
or dword [eax], 3
push ebx
push edi
mov ecx, dword [0x7ffe03b0]
mov dword [ebp - 8], ecx
mov ecx, dword [0x7ffe03b4]
mov dword [ebp - 4], ecx
mov ecx, dword [0x7ffe000c]
mov edx, dword [0x7ffe0008]
mov edi, dword [0x7ffe0010]
cmp ecx, edi
jne 0x7df2e5d1
mov edi, dword [0x7ffe03b0]
mov ebx, dword [0x7ffe03b4]
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 8], edi
jne 0x7df2e56d
mov edi, dword [ebp - 4]
cmp edi, ebx
jne 0x7df2e56d
sub edx, dword [ebp - 8]
sbb ecx, edi
mov dword [eax + 0x14], ecx
mov ecx, dword fs:[0x18]
mov dword [eax + 0x10], edx
pop edi
mov dword [ecx + 0xf90], eax
mov dword [esi], eax
pop ebx
pop esi
leave
ret 4
pause
jmp 0x7df2e57f
Function at 0x7df2f163
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
push esi
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0x10]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0x7ab7
cmp word [eax + 0x38], cx
je 0x7df2f237
cmp word [eax + 0x40], cx
je 0x7df2f237
push ebx
push edi
mov edi, dword [eax + 0x3c]
add eax, 0x38
movzx ecx, word [eax]
shr ecx, 1
lea ebx, [edi + ecx*2 - 2]
lea ecx, [ebp - 8]
push ecx
push 0x7deb7240
push eax
push 1
call fcn.7df17b37
test eax, eax
jl 0x7df2f1fe
mov ax, word [ebp - 8]
shr ax, 1
inc ax
movzx ecx, ax
mov dword [ebp - 8], ecx
mov eax, dword [esi + 0x10]
mov edx, dword [eax + 0x3c]
movzx eax, word [eax + 0x38]
movzx ecx, cx
lea edx, [edx + ecx*2]
shr eax, 1
add ecx, 0xb
cmp eax, ecx
jb 0x7df2f1fe
push 0xb
push 0x7de95e48
push edx
call fcn.7df1763b
add esp, 0xc
test eax, eax
je 0x7df6b4ae
mov esi, ebx
cmp ebx, edi
jb 0x7df2f235
movzx eax, word [esi]
push 0x5c
pop ecx
cmp cx, ax
je 0x7df2f235
push eax
call fcn.7df16819
movzx ecx, ax
mov eax, dword [ebp - 0xc]
mov edx, eax
imul eax, eax, 0x6a2f
imul edx, dword [ebp - 4]
add ecx, edx
dec esi
dec esi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp esi, edi
jae 0x7df2f204
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x7df30167
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov dword [ebp - 4], ecx
cmp ecx, 0xfffd
ja 0x7df65a83
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
add ecx, 2
push ecx
push 0
push dword [eax + 0x18]
call fcn.7df15026
mov ebx, eax
test ebx, ebx
je 0x7df65a8d
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, 0x7deaa840
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ecx, word [eax]
mov eax, dword [eax + 4]
sub ecx, 8
push ecx
add eax, 8
push eax
lea eax, [ebx + 8]
push eax
call fcn.7df09340
mov ecx, dword [ebp - 4]
mov eax, ecx
shr eax, 1
xor edx, edx
mov word [ebx + eax*2], dx
mov eax, dword [ebp + 0x14]
xor esi, esi
add esp, 0xc
cmp eax, esi
jne 0x7df317fb
mov edx, dword [ebp + 0x10]
cmp edx, esi
jne 0x7df65a97
mov eax, dword [ebp + 0xc]
mov word [eax], cx
add ecx, 2
pop edi
mov dword [eax + 4], ebx
mov word [eax + 2], cx
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
mov word [eax], dx
mov word [eax + 2], dx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
jmp 0x7df301e6
Function at 0x7df375d7
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x7deb4168
test eax, eax
jne 0x7df7ff46
mov eax, dword [0x7df700b4]
mov edi, 0x7dec02f8
test eax, eax
jne 0x7df7ff8d
test ebx, ebx
je 0x7df8000f
mov eax, dword [ebx + 0x50]
test eax, 0x30000
jne 0x7df8000f
cmp dword [ebx + 4], 0x7dea2878
jne 0x7df8000f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7df8000f
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7df7ffba
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.7df37324
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7df7ffe1
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x7df39a3f
Capabilities:
Encode data using xor

Disassembly:
push 0xc0
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.7df15f20
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
push edi
call fcn.7df2e5e9
mov byte [ebp - 0x1b], 1
push 0x7df72054
call fcn.7df1a9f1
mov dword [ebp - 4], 4
mov eax, dword [0x7df70184]
mov dword [ebp - 0x140], 0x7df70180
mov dword [ebp - 0x13c], eax
lea ecx, [ebp - 0x140]
mov dword [eax], ecx
mov eax, ecx
mov dword [0x7df70184], eax
mov byte [ebp - 0x1a], 1
mov dword [ebp - 4], esi
call fcn.7df2e7d8
push 0x78
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.7df15f20
add esp, 0xc
lea eax, [edi + 0x68]
xor ecx, ecx
inc ecx
lock xadd dword [eax], ecx
mov byte [ebp - 0x1d], 1
push 0
lea eax, [ebp - 0x9c]
push eax
push edi
call fcn.7df1a7e0
jmp 0x7df2c6e3
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x18]
push esi
mov esi, dword [eax + 0x30]
push edi
call fcn.7df39ba0
mov dword [0x7df70098], eax
call fcn.7df1edd1
xor edi, edi
test eax, 0x100000
jne 0x7df644ff
lea eax, [ebp - 4]
push eax
push edi
push edi
push dword [esi + 8]
push 3
call fcn.7df16495
mov ecx, dword [ebp - 4]
movzx eax, word [ecx + 0x5c]
cmp ax, 1
je 0x7df39a95
cmp ax, 2
je 0x7df39a95
cmp ax, 3
jne 0x7df39aa0
cmp word [ecx + 0x48], 6
jae 0x7df2e736
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], 0x10
mov dword [esi + 0x90], 0x7df74740
call fcn.7df39ad7
push 0x80000fa0
push 0x7df72120
call fcn.7df195e8
pop edi
pop esi
leave
ret
Function at 0x7df3caa5
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x7df78ef2
cmp word [esi + 4], 0x40
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
ja 0x7df78ef2
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0xaa
push 8
push dword [eax + 0x18]
call fcn.7df15026
mov dword [ebp + 8], eax
cmp eax, edi
je 0x7df78efc
push ebx
movzx ebx, word [esi + 4]
dec ebx
js 0x7df3cb94
mov edi, ebx
imul edi, edi, 6
xor eax, eax
inc eax
xor edx, edx
mov ecx, ebx
call fcn.7df1a140
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x10]
add eax, edi
xor ecx, ecx
mov dword [ebp - 0x10], edx
cmp cx, word [eax]
je 0x7df3cb88
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
xor ecx, ecx
mov word [ebp - 0xc], cx
mov ecx, 0xaa
mov word [ebp - 0xa], cx
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [0x7df7208c]
call fcn.7df3dcc0
test eax, eax
jl 0x7df3cb88
mov eax, dword [0x7df7208c]
cmp dword [eax + 0x48], 0x3e8
jb 0x7df78f06
push dword [ebp - 8]
push eax
call fcn.7df3b0b7
test eax, eax
jge 0x7df3cb7c
push dword [ebp - 8]
push dword [0x7df7208c]
call fcn.7df3cbb8
test eax, eax
jl 0x7df3cb88
mov eax, dword [ebp - 0x14]
or dword [esi + 0x18], eax
mov eax, dword [ebp - 0x10]
or dword [esi + 0x1c], eax
dec ebx
sub edi, 6
test ebx, ebx
jge 0x7df3cb04
push dword [ebp + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call fcn.7df14f85
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x7df3e7b0
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], 0x7dec7d9c
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov edx, dword [eax + 0x30]
mov dword [ebp - 0xc], edi
je 0x7df6c91b
mov ecx, dword [ebp + 0x14]
cmp ecx, edi
je 0x7df3e7e4
mov dword [ecx], edi
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test eax, 0xfffffffc
jne 0x7df6c971
cmp ebx, 1
jb 0x7df6c971
cmp ecx, edi
je 0x7df6c971
cmp dword [ebp + 0x18], edi
je 0x7df6c971
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
and eax, 3
push edx
push eax
call fcn.7df3ec42
mov esi, eax
cmp esi, edi
jl 0x7df6c93a
cmp dword [ebp - 8], edi
je 0x7df3e882
mov eax, dword [ebp - 0xc]
cmp eax, edi
je 0x7df3e88d
cmp dword [ebp - 4], edi
je 0x7df3e88d
mov eax, dword [eax + 8]
cmp ebx, eax
jae 0x7df6c942
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.7df3e899
mov esi, eax
cmp esi, edi
jl 0x7df6c95b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
lea eax, [eax + ebx*4]
cmp dword [eax], edi
je 0x7df3e88d
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
add eax, 4
mov dword [ecx], eax
xor esi, esi
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0x18
mov esi, 0xc00000e5
jmp 0x7df3e884
Function at 0x7df3ef39
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x7df3f02c
mov eax, dword [ebp + 0xc]
cmp eax, 1
jb 0x7df3f02c
cmp eax, dword [ebx + 4]
ja 0x7df3f02c
cmp edi, esi
je 0x7df6c3bb
movzx eax, word [edi]
cmp ax, 2
jb 0x7df3f02c
cmp dword [edi + 4], esi
je 0x7df3f02c
cmp dword [ebp + 0x14], esi
je 0x7df3f02c
movzx ecx, ax
lea eax, [ecx + 2]
cmp eax, 0xfffe
ja 0x7df6c3a2
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add ecx, 0x12
push ecx
push esi
push dword [eax + 0x18]
call fcn.7df15026
mov esi, eax
test esi, esi
je 0x7df6c3ac
and dword [esi], 0
mov ax, word [edi]
mov word [esi + 4], ax
lea eax, [esi + 0x10]
mov dword [esi + 8], eax
mov cx, word [edi]
add cx, 2
mov word [esi + 6], cx
movzx ecx, word [edi]
push ecx
push dword [edi + 4]
push eax
call fcn.7df09340
movzx eax, word [esi + 4]
mov ecx, dword [esi + 8]
mov edi, dword [ebp + 0xc]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 8]
lea edi, [eax + edi*4]
add esp, 0xc
mov edx, esi
xor eax, eax
lock cmpxchg dword [edi], edx
test eax, eax
jne 0x7df3f019
xor esi, esi
mov dword [ecx], esi
xor edi, edi
test esi, esi
jne 0x7df6c3fe
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
cmp edi, esi
jne 0x7df6c3b6
jmp 0x7df6c3bb

Function at 0x7df40757
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword [0x7df76754]
test eax, eax
jne 0x7df82740
mov eax, dword [0x7df700b0]
mov ecx, dword fs:[0x18]
add eax, 0xc0000
push 0x10
or eax, 8
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call fcn.7df15026
ret

Function at 0x7df44531
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
push ebx
mov ebx, dword [eax + 0x24]
mov eax, dword fs:[0x18]
sbb byte [eax], al
add byte [eax], al

Function at 0x7df4615f
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x7df84e57
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x104
cmp word [edx], 0
je 0x7df46185
inc ecx
inc edx
inc edx
cmp ecx, eax
jl 0x7df46178
cmp ecx, eax
jge 0x7df84e5e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push edi
lea esi, [ecx + ecx]
lea ecx, [esi + 2]
push ecx
push 0
push dword [eax + 0x18]
call fcn.7df15026
mov edi, eax
test edi, edi
je 0x7df461c4
push esi
push dword [ebp + 8]
push edi
call fcn.7df09340
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x7df4a621
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0x10
push 0
push dword [eax + 0x18]
call fcn.7df15026
mov esi, eax
test esi, esi
je 0x7df4a6a4
push ebx
push edi
push dword [ebp + 0xc]
mov dword [esi + 8], 1
call fcn.7df27fcb
mov ebx, dword [ebp + 0x10]
imul ebx, ebx, 0xc
add ebx, 0x7df74724
push ebx
mov dword [esi + 0xc], eax
lea edi, [ebx + 4]
call fcn.7df199f1
cmp dword [edi], edi
jne 0x7df4a686
mov ecx, dword fs:[0x18]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ecx + 0x30]
add eax, 2
add ecx, 0x28
lock bts dword [ecx], eax
cmp dword [ebp + 8], 0
je 0x7df5e414
mov eax, dword [edi]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [eax + 4], esi
mov dword [edi], esi
push ebx
call fcn.7df199ab
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x7df4ca35
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x5c
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, 0x7ded5ae4
mov esi, 0x7dec9788
test eax, eax
jne 0x7df7d043
cmp dword [ebp + 8], 0
je 0x7df7d0a1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7df7d0a1
test ebx, ebx
je 0x7df7d0a1
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
cmp byte [ecx + 0x28], 0
jne 0x7df7d0a1
mov ecx, dword [ebx + 0x2c]
push 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call fcn.7df07558
mov dword [ebp + 8], eax
test eax, eax
jl 0x7df4cacd
push 4
lea eax, [ebp - 4]
push eax
push 3
push ebx
mov dword [ebp - 4], 1
call fcn.7df19a4e
push eax
call fcn.7df08ac0
and dword [ebp + 8], 0
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7df7d074
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x7df4e127
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x7df72034
push edi
call fcn.7df199f1
push dword [ebp + 8]
call fcn.7df4d3f2
mov esi, eax
test esi, esi
je 0x7df77e9e
dec dword [esi + 0x10]
jne 0x7df4e191
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
push 1
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 8]
push eax
push 0xffffffffffffffff
call fcn.7df08ec0
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call fcn.7df14f85
push edi
call fcn.7df199ab
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
xor ebx, ebx
jmp 0x7df4e182

Function at 0x7df4f7ab
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
test ecx, ecx
je 0x7df4f819
test eax, eax
jne 0x7df4f7cd
mov ax, word [ecx + 0x14]
movzx eax, ax
lea eax, [eax + ecx + 0x18]
test eax, eax
je 0x7df4f819
movzx edx, word [ecx + 6]
push esi
xor esi, esi
push edi
test edx, edx
jle 0x7df4f81d
xor eax, eax
jmp 0x7df4f7ff
Function at 0x487625
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x487649
cmp dword [edi + 0x74], 0
jne 0x487649
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00439647
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004875e6
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4c5a9b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4c5ab5
call fcn.00439647
mov esi, dword [eax + 0xc]
push dword [0x5ced84]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4c5ad3
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4c5acb
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4c5b00
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x4c5acd
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004c59c9
mov esi, eax
jmp 0x4c5af2