joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7dee61f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xf48]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x2de8]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.7dee67c0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x7dee6256
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x7dee6260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xf48]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x2dec]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.7dee67c0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x7dee62c2
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x7dee62d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xf48]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x2df0]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.7dee67c0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x7dee6329
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x7dee6bc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x7dee6c26
cmp dword [esi + 0x18], 0
je 0x7dee6c41
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.7dee85e0
add esp, 8
test eax, eax
jne 0x7dee6c1e
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x7dee6c00
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x7dee6c41
mov eax, dword [esi + 0x18]
test eax, eax
je 0x7dee6c41
cmp eax, ecx
je 0x7dee6c1e
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x7dee6c34
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7dee6c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x7dee6ca8
cmp dword [esi + 0x18], 0
je 0x7dee6ca8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.7dee85e0
add esp, 8
test eax, eax
jne 0x7dee6cb0
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x7dee6c90
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x7dee6cc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x7dee6d18
cmp dword [esi + 0x18], 0
je 0x7dee6d18
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.7dee85e0
add esp, 8
test eax, eax
jne 0x7dee6d20
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x7dee6d00
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x7dee6dd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x7dee6e14
cmp dword [eax + 0x18], 0
je 0x7dee6e14
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x7dee6e07
mov esp, ebp
pop ebp
ret

Function at 0x7dee6e20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.7dee76e0
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x7dee6eab
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.7dee7d00
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.7dee0c30
add esp, 0x10
test eax, eax
jne 0x7dee6eb3
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x7dee6e80
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7dee7390
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x7dee739e
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x7dee739a
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x7dee739a
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x7dee7410
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x7dee7434
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x7dee7434
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x7dee743c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.7dee7810
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.7dee7690
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.7dee7660
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x7dee74ce
mov dword [ebp + 0xc], edx
jmp 0x7dee7479
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x7dee7490
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x7dee74a6
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x7dee74b3
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.7dee7660
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x7dee7477
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7dee74e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x7dee7500
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x7dee7500
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x7dee7504
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x7dee7580
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x7dee75a0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x7dee75a0
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x7dee75a4
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x7dee75a0
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x7dee82c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x7dee84fc
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.7dee76e0
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x7dee848c
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x7dee8482
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.7ded4f50
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x7dee84ad
inc eax
cmp byte [esi + eax], 0
jne 0x7dee84a6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.7dee7660
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x7dee84ca
inc edi
cmp byte [edi + ebx], 0
jne 0x7dee84c3
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x7dee84da
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x7dee84d2
test esi, esi
je 0x7dee84ef
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.7dee76b0
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7df17495
Capabilities:
Parse pe header

Disassembly:
push 0x1c
push 0x7de9cec8
call fcn.7df15eb4
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], edx
mov edi, dword [ebp + 0x18]
cmp edi, edx
je 0x7df785e7
mov dword [edi], edx
mov eax, dword [ebp + 8]
test eax, 0xfffffffc
jne 0x7df785e7
mov esi, dword [ebp + 0xc]
cmp esi, edx
je 0x7df23d41
cmp esi, 0xffffffff
je 0x7df23d41
not al
and al, 1
mov cl, al
jne 0x7df23d23
mov dword [ebp - 4], edx
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x7df23d75
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x24], eax
cmp cl, dl
jne 0x7df23d4b
cmp dword [ebp + 0x14], edx
ja 0x7df174e7
jb 0x7df785dd
cmp dword [ebp + 0x10], 0x40
jae 0x7df174e7
jmp 0x7df785dd
mov eax, 0xc000000d
jmp 0x7df17530
xor ecx, ecx
cmp ecx, dword [ebp + 0x14]
ja 0x7df23d75
jb 0x7df23d59
cmp eax, dword [ebp + 0x10]
jae 0x7df23d75
cmp eax, 0xffffffe7

Function at 0x7df17a7b
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
xor ecx, ecx
push edi
cmp eax, ebx
je 0x7df17a93
lea ecx, [eax + 0x2c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea edx, [ebp - 8]
push edx
lea edx, [ebp + 0xb]
push edx
push ecx
push dword [ebp + 0xc]
push dword [eax + 0x38]
call fcn.7df17aea
cmp eax, ebx
jl 0x7df17ade
cmp byte [ebp + 0xb], bl
jne 0x7df26656
push ebx
push ebx
push ebx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
invalid

Function at 0x7df1a560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0xc], 0
mov edx, dword [ebx + 8]
push esi
push edi
push 0x11
pop ecx
xor eax, eax
lock cmpxchg dword [edx], ecx
mov ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x7df4980a
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
or eax, 0xfc6b70f
mov dh, 0x80
mov eax, 0x837ded1e
loopne 0x7df49827
in eax, dx
jge 0x7df49894
or cl, al
call 0x37df135
enter 0xfffffffffffffffb, 0xffffffffffffffff
invalid
Function at 0x7df1c7a6
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x28
test eax, 0xf8000000
jne 0x7df6a87d
mov ecx, dword [ebp + 0xc]
test ecx, 0xff000000
jne 0x7df6a888
test eax, 0x4000000
jne 0x7df1c894
mov edx, dword fs:[0x18]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 4], 0xffffffff
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov edx, dword [edx + 0x30]
cmp dword [edx + 0x64], 1
jbe 0x7df1c89c
test eax, 0x2000000
jne 0x7df6a893
and ecx, 0xffffff
mov dword [edi + 0x14], ecx
and eax, 0x1000000
mov dword [ebp + 0x10], eax
jne 0x7df6a8a2
call fcn.7df1c8a9
mov esi, eax
cmp esi, ebx
je 0x7df6a89f
mov dword [edi], esi
xor eax, eax
push 1
mov word [esi], ax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], edi
mov dword [esi + 0x18], ebx
call fcn.7df1c786
mov word [esi + 2], ax
shr eax, 0x10
push 0x7df720d8
mov word [esi + 0x1c], ax
call fcn.7df0a2b0
mov ecx, dword [0x7df7016c]
lea eax, [esi + 8]
mov dword [eax], 0x7df70168
mov dword [eax + 4], ecx
mov dword [ecx], eax
push 0x7df720d8
mov dword [0x7df7016c], eax
call fcn.7df0a270
cmp byte [0x7ffe0382], bl
jne 0x7df6a8c3
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov dword [edi + 0x14], ebx
jmp 0x7df1c816

Function at 0x7df1efdd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [eax + 0x1c]
mov edx, ecx
shr edx, 5
lea eax, [eax + edx*4]
xor edx, edx
inc edx
and ecx, 0x1f
shl edx, cl
or dword [eax], edx
mov edx, dword [ebp + 8]
jmp 0x7df1f2ae
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0x10], 0
je 0x7df1f301
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ax, word [esi + 4]
push edi
mov edi, dword [ebp + 8]
xor ax, word [edi + 0x54]
movzx ebx, ax
test bx, bx
je 0x7df4ed46
mov al, byte [esi + 6]
test al, al
je 0x7df1f31b
movzx ecx, al
mov eax, esi
shl ecx, 0x10
and eax, 0xffff0000
sub eax, ecx
add eax, 0x10000
mov dword [ebp - 0x18], eax
mov al, byte [esi + 2]
mov byte [ebp + 0xf], al
mov eax, 0xfe00
cmp dword [ebp + 0x10], eax
ja 0x7df4f7c0
movzx eax, word [ebp + 0x10]
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xf]
mov byte [esi + 2], al
mov edi, dword [ebp + 8]
mov ax, word [edi + 0x54]
xor ax, bx
mov word [esi + 4], ax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
cmp ecx, eax
je 0x7df1f323
mov ebx, esi
sub ebx, eax
shr ebx, 0x10
inc ebx
test ebx, ebx
invalid
Function at 0x7df1f0b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ebx, dword [eax + 4]
jb 0x7df234c2
mov ecx, dword [eax]
test ecx, ecx
jne 0x7df1f30d
mov ecx, dword [eax + 4]
dec ecx
mov dword [ebp - 0x14], ecx
lea ebx, [eax + 0x14]
mov edx, dword [eax + 0x18]
sub ecx, dword [ebx]
mov dword [ebp - 8], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], edx
cmp edx, eax
je 0x7df28b1c
mov edx, dword [edi + 0x4c]
mov dword [ebp - 0x1c], edx
push ebp
in al, 0x85
ror byte [edi], cl
test bh, dl
cld
add al, byte [eax]
mov eax, dword [eax - 8]
mov edx, dword [edi + 0x4c]
mov dword [ebp - 0x1c], edx
test eax, edx
je 0x7df1f108
xor eax, dword [edi + 0x50]
movzx eax, ax
movzx edx, ax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x20], eax
sub eax, edx
test eax, eax
mov eax, dword [ebp - 0x10]
jg 0x7df1f305
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
sub eax, 8
test edx, edx
je 0x7df4edd8
mov eax, dword [eax]
mov edx, dword [edi + 0x4c]
test eax, edx
je 0x7df1f13e
xor eax, dword [edi + 0x50]
movzx eax, ax
mov edi, dword [ebp - 0x20]
movzx eax, ax
sub edi, eax
test edi, edi
invalid

Function at 0x7df1f0ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ebx, dword [eax + 4]
jb 0x7df234c2
mov ecx, dword [eax]
test ecx, ecx
jne 0x7df1f30d
mov ecx, dword [eax + 4]
dec ecx
mov dword [ebp - 0x14], ecx
lea ebx, [eax + 0x14]
mov edx, dword [eax + 0x18]
sub ecx, dword [ebx]
mov dword [ebp - 8], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], edx
cmp edx, eax
je 0x7df28b1c
mov edx, dword [edi + 0x4c]
mov dword [ebp - 0x1c], edx
push ebp
in al, 0x85
ror byte [edi], cl
test bh, dl
cld
add al, byte [eax]
mov eax, dword [eax - 8]
mov edx, dword [edi + 0x4c]
mov dword [ebp - 0x1c], edx
test eax, edx
je 0x7df1f108
xor eax, dword [edi + 0x50]
movzx eax, ax
movzx edx, ax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x20], eax
sub eax, edx
test eax, eax
mov eax, dword [ebp - 0x10]
jg 0x7df1f305
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
sub eax, 8
test edx, edx
je 0x7df4edd8
mov eax, dword [eax]
mov edx, dword [edi + 0x4c]
test eax, edx
je 0x7df1f13e
xor eax, dword [edi + 0x50]
movzx eax, ax
mov edi, dword [ebp - 0x20]
movzx eax, ax
sub edi, eax
test edi, edi
invalid
Function at 0x7df1f200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test edx, edx
je 0x7df4ede0
mov ecx, dword [eax - 8]
mov edx, dword [edi + 0x4c]
test ecx, edx
je 0x7df1f195
xor ecx, dword [edi + 0x50]
movzx ecx, cx
movzx ebx, cx
movzx ecx, word [ebp - 4]
sub ecx, ebx
test ecx, ecx
jle 0x7df1f305
pop esp
add dword [eax], eax
invalid
pop esp
add dword [eax], eax
add byte [ebx - 0xfbac700], cl
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jne 0x7df1f180
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x7df4edba
mov edx, dword [ebp + 8]
lea ecx, [edx + 0xc4]
cmp ecx, eax
je 0x7df1f1f2
mov edi, dword [edx + 0x4c]
test edi, edi
je 0x7df4ede9
mov ecx, dword [eax - 8]
mov edi, dword [edx + 0x4c]
test ecx, edi
je 0x7df1f1e0
xor ecx, dword [edx + 0x50]
movzx ecx, cx
movzx ebx, cx
movzx ecx, word [ebp - 4]
cmp ecx, ebx
ja 0x7df660f3
mov ecx, dword [eax + 4]
mov ebx, dword [ecx]
lea edi, [esi + 8]
cmp ebx, eax
jne 0x7df66108
add al, 0
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [eax + 4], edi
movzx eax, word [esi]
add dword [edx + 0x78], eax
mov eax, dword [edx + 0xb8]
test eax, eax
je 0x7df1f2ae
movzx ecx, word [esi]
cmp ecx, dword [eax + 4]
jb 0x7df1f236
mov edi, dword [eax]
test edi, edi
jne 0x7df1f314
mov ecx, dword [eax + 4]
dec ecx
mov dword [ebp - 0x1c], ecx
sub ecx, dword [eax + 0x14]
cmp dword [eax + 8], 0
invalid
dec ebp
Function at 0x7df22639
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
push 0x5c
pop edx
cmp cx, dx
je 0x7df48fac
cmp cx, 0x2f
je 0x7df48fac
test cx, cx
je 0x7df354b1
cmp word [eax + 2], 0x3a
jne 0x7df354b1
movzx eax, word [eax + 4]
cmp ax, dx
jne 0x7df66664
push 2
pop eax
pop ebp
ret 4
or byte [edi + 0x6a], dl
add bl, byte [edi + 0x66]
cmp dword [eax], esi
cmp word [eax], si
je 0x7df354c0
add eax, edi
dec ebx
jne 0x7df354b6
cmp ebx, esi
je 0x7df7a910
cmp ecx, 0xffffffff
je 0x7df7a92f
cmp ecx, esi
jbe 0x7df354ec
movzx ecx, word [edx]
mov word [eax], cx
add eax, edi
add edx, edi
cmp cx, si
je 0x7df354ec
dec ebx
je 0x7df354ec
dec dword [ebp + 0x14]
jne 0x7df354d5
cmp dword [ebp + 0x14], esi
jne 0x7df354f6
xor ecx, ecx
mov word [eax], cx
cmp ebx, esi
je 0x7df7a94b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
add byte [eax], 0
add cl, ch
mov edi, 0x9000008
mov ebp, 0xfffffbf8
jmp fcn.7df49874

Function at 0x7df2284f
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x18]
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x238]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
cmp eax, edx
je 0x7df2288f
push esi
mov esi, dword [ebp + 8]
cmp esi, edx
je 0x7df22885
mov dword [esi], edx
mov dword [esi + 4], edx
cmp dword [eax + 0xc], edx
jne 0x7df855d5
pop esi
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x7df25c05
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
lea esi, [edi - 0x10]
test dword [esi + 0x34], ebx
je 0x7df25c86
mov edi, dword [edi]
cmp edi, 0x7df7021c
jne 0x7df25782
cmp dword [ebp + 8], 0
jne 0x7df3a059
xor ebx, ebx
inc ebx
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x7df258ef
mov ecx, dword [0x7df70040]
mov dword [ebp - 0x38], ecx
mov ecx, dword fs:[0x18]
mov dword [0x7df70040], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x20]
cmp edi, dword [ebp - 0x34]
jae 0x7df25936
mov eax, dword [ebp - 0x28]
mov esi, dword [eax + edi*4]
mov dword [ebp - 0x24], esi
cmp byte [0x7df7000b], 0
jne 0x7df257fc
test dword [esi + 0x34], 0x80000000
jne 0x7df257fc
push esi
call fcn.7df26567
inc edi
mov dword [ebp - 0x20], edi
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x7de9f6e0]
or ecx, ebx
test dword [0x7df76730], ecx
jne 0x7df65914
mov eax, dword [0x7df76730]
test dword [0x7de9f6e4], eax
jne 0x7df6593c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [eax + 2], 0
jne 0x7df65942
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [eax + 1], 0
jne 0x7df65942
mov esi, dword [ebp - 0x24]
mov eax, dword [0x7df70120]
mov dword [ebp - 0x44], eax
mov dword [0x7df70120], esi
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x68], 0x24
mov dword [ebp - 0x64], ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
mov edx, dword [esi + 0x48]
lea ecx, [ebp - 0x68]
call fcn.7df0a1f1
mov dword [ebp - 4], 2
cmp word [esi + 0x3a], 0
jne 0x7df53e1e
push dword [ebp + 8]
push ebx
push dword [esi + 0x18]
push dword [ebp - 0x30]
call fcn.7df2191c
mov byte [ebp - 0x19], al
mov dword [ebp - 4], ebx
call fcn.7df258fc
and dword [ebp - 4], 0
call fcn.7df2590a
or dword [esi + 0x34], 0x80000
cmp byte [ebp - 0x19], 0
jne 0x7df257cf
jmp 0x7df6597d
call fcn.7df2193e
test eax, eax
jne 0x7df49d6c
mov dword [ebp - 4], 0xfffffffe
call fcn.7df2591e
mov eax, dword [ebp - 0x2c]
call fcn.7df15ef9
ret 4
mov edi, 0x7df7021c
mov esi, dword [0x7df7021c]
mov dword [ebp - 0x40], esi
cmp esi, edi
je 0x7df258d3
lea eax, [esi - 0x10]
mov dword [ebp - 0x24], eax
cmp byte [0x7df7000b], 0
jne 0x7df25964
test dword [eax + 0x34], 0x80000000
je 0x7df2695d
mov esi, dword [esi]
jmp 0x7df25941
push 0xbc
push 0x7de9bea0
call fcn.7df15eb4
call fcn.7df25c5a
call fcn.7df23cab
mov edx, eax
mov dword [ebp - 0x34], edx
cmp edx, 0x10
ja 0x7df49134
invalid
invalid