joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49fd7a
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4c69c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x525014
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.004b7390
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.004b7390
mov edi, dword [fcn.004c866c]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0x525000
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [fcn.004c85b8]
lea ecx, [esp + 0xb0]
push ecx
call dword [0x4c81ac]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.004a089a
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x56dba8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jg 0x56dbd7
push 0x596
push 0x1005d4a0
push 0x10060bd4
call dword [0x1005d2e0]
mov ecx, dword [esi + 0xbc]
add esp, 0xc
mov eax, dword [esi + 0xc4]
mov edi, 4
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10060dc0]
sub edi, 1
jne 0x56dbeb
mov ecx, dword [0x10091850]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a2c], eax
jne 0x56dc1d
mov dword [ecx + 0x1a30], eax
cmp dword [ecx + 0x1a64], eax
jne 0x56dc2c
mov byte [ecx + 0x1a68], 1
pop ebp
ret 4

Function at 0x56dc38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0xbc]
test edx, edx
jg 0x56dc6a
push 0x596
push 0x1005d4a0
push 0x10060bd4
call dword [0x1005d2e0]
mov edx, dword [esi + 0xbc]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [esi + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 8], eax
cvttss2si eax, xmm0
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc4]
lea esi, [ebp - 0x10]
mov edx, dword [eax + edx*4 - 4]
not edx
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10060dc0]
sub edi, 1
jne 0x56dcc8
mov eax, dword [0x10091850]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a2c], edx
jne 0x56dcf9
mov dword [eax + 0x1a30], edx
cmp dword [eax + 0x1a64], edx
jne 0x56dd08
mov byte [eax + 0x1a68], 1
mov eax, edx
mov esp, ebp
pop ebp
ret 4

Function at 0x577e48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10091850]
push ebx
push esi
push edi
mov esi, dword [eax + 0x19f8]
mov eax, dword [esi + 0xbc]
add esi, 0xbc
mov dword [ebp - 4], ecx
test eax, eax
jg 0x577e87
push 0x596
push 0x1005d4a0
push 0x10060bd4
call dword [0x1005d2e0]
mov eax, dword [esi]
add esp, 0xc
mov ebx, dword [esi + 8]
lea edx, [ebp - 4]
mov edi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10060dc0]
sub edi, 1
jne 0x577e98
mov edi, dword [esi + 4]
not ebx
mov ecx, dword [esi]
cmp ecx, edi
jne 0x577ee1
inc ecx
test edi, edi
je 0x577ecd
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x577ed2
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0057f958
mov ecx, dword [esi]
mov eax, dword [esi + 8]
pop edi
mov dword [eax + ecx*4], ebx
inc dword [esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x607f1b
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x607f68
mov al, cl
cmp al, 0x61
jb 0x607f43
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x607f68
mov al, cl
cmp al, 0x61
jb 0x607f5b
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x607f34
cmp edx, dword [esp + 0x18]
je 0x607f78
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x607f2d
xor eax, eax
jmp 0x607f7b
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x607f83
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x60806a
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x608070
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x607fcf
cmp al, 0x61
jb 0x607fc7
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x607fba
cmp edx, dword [esp + 0x14]
je 0x607fdf
dec ecx
jne 0x607faf
xor eax, eax
jmp 0x60806a
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x60806a
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x60806a
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x60801b
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x60802a
jmp 0x608012
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.00607f1b
test eax, eax
je 0x60806a
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x608065
cmp al, 0x61
jb 0x60805d
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x608050
call fcn.00607f83
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x608088
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x608088
sub edx, ecx
mov ecx, edx
jmp 0x607fdf
xor eax, eax
jmp 0x60806a

Function at 0x60c710
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x60c72e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x60c723
pop esi
ret

Function at 0x61f4f4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x46503c], 0x8088405
inc edx
mov dword [0x46503c], edx
mul edx
mov eax, edx
ret

Function at 0x631b78
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x631b7e
ret
Function at 0x66d444
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00620918
xor eax, eax
push ebp
push 0x450ba4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0066f1cc
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0062521c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0066dcc8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.006250f8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0066dd3c
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450bab
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00620508
ret
Function at 0x66d544
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00620918
xor eax, eax
push ebp
push 0x450cb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0066f1cc
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 4], 0
je 0x66d60a
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0062521c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0066dcc8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.006250f8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0066dd3c
jmp 0x66d61c
xor edx, edx
mov eax, ebx
call fcn.0066dcc8
xor edx, edx
mov eax, ebx
call fcn.0066dd3c
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450cbb
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00620508
ret

Function at 0x675214
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x164]
mov edx, ebx
mov eax, edi
call fcn.00675438
mov esi, eax
mov dword [edi + 0x164], esi
and esi, 0xff
add dword [edi + 0x168], esi
imul esi, dword [edi + 0x168], 0x8088405
inc esi
mov dword [edi + 0x168], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x16c]
mov eax, edi
call fcn.00675438
mov dword [edi + 0x16c], eax
pop edi
pop esi
pop ebx
ret

Function at 0x675288
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x6752ad
inc esi
mov eax, edi
call fcn.0067526c
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.00675214
inc ebx
dec esi
jne 0x675297
pop edi
pop esi
pop ebx
ret
Function at 0x67533c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00620918
xor eax, eax
push ebp
push 0x458a21
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.006752b4
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0067526c
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00675214
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x67537c
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458a28
lea eax, [ebp - 4]
call fcn.006204e4
ret
Function at 0x675e28
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45963f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x675f8b
mov eax, dword [ebp - 4]
call fcn.006774a8
cmp ebx, eax
jge 0x675f8b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xe8]
mov edx, ebx
call fcn.0066ca24
mov edx, dword [0x4505c4]
call fcn.0061f978
mov esi, eax
mov eax, esi
call fcn.0066dc34
test al, al
je 0x675f81
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x675f75
xor eax, eax
push ebp
push 0x4595de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00676350
mov edx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0x37]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 4]
movzx edx, word [ebp - 0x1b]
movzx eax, word [ebp - 0x19]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100]
mov cx, 1
mov esi, dword [eax]
call dword [esi + 0xc]
movzx esi, word [ebp - 0x17]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00620a98
mov eax, dword [ebp - 8]
call fcn.00620934
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x154]
mov al, byte [eax + 0x24]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0067613c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x154]
mov dl, byte [ebp - 9]
mov byte [eax + 0x24], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459629
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x675f6d
mov eax, dword [ebp - 4]
call fcn.006763d4
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.006256cc
jmp 0x675fb9
mov eax, dword [ebp - 8]
call fcn.006204e4
jmp 0x675fb9
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x40]
push eax
push 0
lea edx, [ebp - 0x44]
mov eax, 0xb3
call fcn.00624c58
mov ecx, dword [ebp - 0x44]
mov dl, 1
mov eax, dword [0x40cee4]
call fcn.006269bc
call fcn.0061ff40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459646
lea eax, [ebp - 0x44]
call fcn.006204e4
ret
Function at 0x679938
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
add esi, 0xfffffbf4
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0x1a58], 0
jne 0x679978
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 1
mov eax, dword [ebp + 8]
mov dword [eax - 0x1a58], 0x10000
mov eax, 0x7fff
mov edx, dword [esi]
mov edx, dword [edx + 0xb74]
mov word [edx + eax*2], 0
mov eax, edx
xor ecx, ecx
mov edx, 0xfffe
call fcn.006237dc
mov eax, dword [esi]
mov eax, dword [eax + 0x1a0]
mov ax, word [eax*8 + 0x46459e]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a62], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x1a0]
mov ax, word [eax*8 + 0x46459c]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a64], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x1a0]
movzx eax, word [eax*8 + 0x4645a0]
mov edx, dword [ebp + 8]
mov dword [edx - 0x1a68], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x1a0]
mov ax, word [eax*8 + 0x4645a2]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6a], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x1a0]
cmp eax, 2
jg 0x679a1c
mov eax, dword [esi]
mov eax, dword [eax + 0x24c]
or word [eax + 8], 4
jmp 0x679a2e
cmp eax, 8
jl 0x679a2e
mov eax, dword [esi]
mov eax, dword [eax + 0x24c]
or word [eax + 8], 2
mov eax, dword [ebp + 8]
mov word [eax - 0x10fe], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x1104], edx
mov bx, 0x8000
mov eax, dword [ebp + 8]
lea edi, [eax - 0x420]
mov eax, dword [esi]
mov edx, dword [eax + 0xb6c]
mov ecx, ebx
mov eax, dword [edi + 4]
call dword [edi]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a5a], ax
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0
je 0x679a86
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0xffff
jne 0x679a9e
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 1
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5a], 0
jmp 0x679b02
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 0
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0x106
jae 0x679ac0
mov eax, dword [ebp + 8]
push eax
call fcn.0067978c
pop ecx
mov eax, dword [ebp + 8]
mov word [eax - 0x1a6c], 0
xor ebx, ebx
movzx eax, bx
mov edx, dword [esi]
mov edx, dword [edx + 0xb6c]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 8]
mov dx, word [edx - 0x1a6c]
shl edx, 5
xor ax, dx
and ax, 0x7fff
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6c], ax
inc ebx
cmp bx, 2
jne 0x679ace
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x7d9203
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x7d9248
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x7d924e
add eax, 4
pop esi
dec esi
push esi
jne 0x7d9230
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8

Function at 0x7da9df
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x7da9e8
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x7daa0b
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x7daa0b
mov eax, ebx
jmp 0x7daa20
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x7da9f7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret

Function at 0x7daa32
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
add ecx, 0x14
mov dword [ebp - 8], ecx
mov ecx, dword [ecx]
cmp ecx, dword [ebp - 8]
je 0x7daa81
mov eax, dword [ecx + 0x10]
cmp eax, dword [ebp + 8]
je 0x7daa79
mov ecx, dword [ecx]
jmp 0x7daa68
lea eax, [ecx + 0x10]
mov dword [ebp - 4], eax
jmp 0x7daa85
xor eax, eax
jmp 0x7daa7c
mov eax, dword [ebp - 4]
jmp 0x7daa8d
mov esp, ebp
pop ebp
ret 4
Function at 0x7f007c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x40
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
lea eax, [ebp + 0x18]
cmp ecx, edi
ja 0x7f0097
cmp esi, edi
jbe 0x7f00b4
mov edx, dword [ebp + 0x18]
add esi, 0xffffffff
mov dword [ebp - 0x28], edx
mov edx, dword [ebp + 0x1c]
adc ecx, 0xffffffff
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], edx
jmp 0x7f00ba
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
cmp ecx, edi
ja 0x7f00c2
cmp esi, edi
jbe 0x7f00df
add esi, 0xffffffff
adc ecx, 0xffffffff
add eax, 8
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x20], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x1c], edx
jmp 0x7f00e5
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
cmp ecx, edi
ja 0x7f00ed
cmp esi, edi
jbe 0x7f010a
add esi, 0xffffffff
adc ecx, 0xffffffff
add eax, 8
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x18], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0x14], edx
jmp 0x7f0110
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
cmp ecx, edi
ja 0x7f0118
cmp esi, edi
jbe 0x7f0135
add esi, 0xffffffff
adc ecx, 0xffffffff
add eax, 8
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
mov edx, dword [eax - 8]
mov dword [ebp - 0x10], edx
mov edx, dword [eax - 4]
mov dword [ebp - 0xc], edx
jmp 0x7f013b
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
cdq
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp + 0xc], edi
mov dword [ebp + 0xc], esp
and esp, 0xfffffff8
push 0x33
call 0x7f016a
add dword [esp], 5
retf
Function at 0x804fed
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x80503a
mov al, cl
cmp al, 0x61
jb 0x805015
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x80503a
mov al, cl
cmp al, 0x61
jb 0x80502d
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x805006
cmp edx, dword [esp + 0x18]
je 0x80504a
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x804fff
xor eax, eax
jmp 0x80504d
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x805055
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x80513c
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x805142
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x8050a1
cmp al, 0x61
jb 0x805099
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x80508c
cmp edx, dword [esp + 0x14]
je 0x8050b1
dec ecx
jne 0x805081
xor eax, eax
jmp 0x80513c
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x80513c
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x80513c
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x8050ed
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x8050fc
jmp 0x8050e4
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.00804fed
test eax, eax
je 0x80513c
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x805137
cmp al, 0x61
jb 0x80512f
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x805122
call fcn.00805055
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x80515a
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x80515a
sub edx, ecx
mov ecx, edx
jmp 0x8050b1
xor eax, eax
jmp 0x80513c