joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c93f1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push 0x557088
lea ecx, [esp + 0x10]
call fcn.0044ca60
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
mov eax, esi
mov dword [esp + 0x54], ebx
call fcn.0046ea50
or dword [esp + 0x50], 0xffffffff
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1d0], eax
call fcn.00449460
push 0x557098
lea ecx, [esp + 0x10]
call fcn.0044ca60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], edi
call fcn.0046ea50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1d4], eax
call fcn.00449460
push 0x5570a4
lea ecx, [esp + 0x10]
call fcn.0044ca60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 2
call fcn.0046ea50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1d8], eax
call fcn.00449460
push 0x5570b4
lea ecx, [esp + 0x10]
call fcn.0044ca60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 3
call fcn.0046ea50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1f4], eax
call fcn.00449460
push 0x5570c4
lea ecx, [esp + 0x10]
call fcn.0044ca60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 4
call fcn.0046ea50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1dc], eax
call fcn.00449460
push 0x5570d4
lea ecx, [esp + 0x10]
call fcn.0044ca60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 5
call fcn.0046ea50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1e0], eax
call fcn.00449460
push 0x5570e4
lea ecx, [esp + 0x10]
call fcn.0044ca60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 6
call fcn.0046ea50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1e4], eax
call fcn.00449460
push 0x5570f4
lea ecx, [esp + 0x10]
call fcn.0044ca60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 7
call fcn.0046ea50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1f0], eax
call fcn.00449460
push 0x557104
lea ecx, [esp + 0x10]
call fcn.0044ca60
lea eax, [esp + 0xc]
push eax
mov eax, esi
mov dword [esp + 0x54], 8
call fcn.0046ea50
or dword [esp + 0x50], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x14]
mov dword [esi + 0x1ec], eax
call fcn.00449460
push 0x557114
lea ecx, [esp + 0x2c]
call fcn.0044ca60
lea eax, [esp + 0x28]
push eax
mov eax, esi
mov dword [esp + 0x54], 9
call fcn.0046ea50
push ebx
push edi
lea ecx, [esp + 0x30]
mov dword [esi + 0x1e8], eax
call fcn.00449460
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49bc30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d08e4
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
call fcn.0040b230
mov edi, dword [eax + 0x24]
call fcn.00482590
add eax, 0xc
mov dword [esp + 0x18], eax
call fcn.0049bbf0
and dword [esp + 0x14], 0
xor esi, esi
lea edi, [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.004a2a00
and dword [esp + 0x30], esi
and dword [esp + 0x10], esi
lea edi, [esp + 0x10]
call fcn.004a2a00
cmp dword [ebp + 0x10], esi
mov byte [esp + 0x30], 1
jle 0x49bd59
mov eax, dword [ebp + 0xc]
sub eax, esi
jne 0x4ef9e1
push 0x3c
call fcn.004aac98
pop ecx
mov dword [esp + 0x20], eax
test eax, eax
mov byte [esp + 0x30], 2
je 0x4efa56
push dword [ebp + 0x14]
mov esi, eax
push dword [ebp + 0x10]
push dword [esp + 0x20]
call fcn.004a4c90
mov esi, eax
lea edi, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.004a2a00
mov esi, dword [esp + 0x14]
mov eax, dword [ebx + 0x1b8]
push esi
push eax
call fcn.0041aad0
test eax, eax
jle 0x49bd59
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x1b8]
push esi
push eax
call fcn.0041a7c0
push dword [ebx + 0x1b8]
mov edx, dword [esp + 0x20]
call fcn.0041a5d0
mov bl, 1
lea eax, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.004a3230
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0x14]
call fcn.004a3230
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor bl, bl
jmp 0x49bd26
dec eax
jne 0x49bd59
push 0x3c
call fcn.004aac98
pop ecx
mov dword [esp + 0x20], eax
test eax, eax
mov byte [esp + 0x30], 3
je 0x4efa10
push dword [ebp + 0x14]
mov esi, eax
push dword [ebp + 0x10]
push dword [esp + 0x20]
call fcn.004a4c90
jmp 0x4efa12
xor eax, eax
mov esi, eax
lea edi, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.004a2a00
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 0x1bc]
push esi
push eax
call fcn.0041aad0
test eax, eax
jle 0x49bd59
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x1bc]
push esi
push eax
call fcn.0041a7c0
push dword [ebx + 0x1bc]
jmp 0x49bd1b
xor eax, eax
jmp 0x49bce0
Function at 0x49e710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cafad
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push edi
mov eax, dword [0x5920a4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x54de6c
lea ecx, [esp + 0x14]
call fcn.0044ca60
and dword [esp + 0x38], 0
mov eax, dword [esi + 0xd8]
lea ecx, [esp + 0x10]
push ecx
call fcn.00462930
or dword [esp + 0x38], 0xffffffff
push 0
push 1
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.00449460
fld dword [0x54ddf8]
test edi, edi
fstp dword [esp + 0xc]
je 0x49e790
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x20]
fdivr qword [0x566c18]
fstp dword [esp + 0xc]
fld dword [0x5668b0]
push 1
sub esp, 0xc
fstp dword [esp + 8]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
fld1
fstp dword [esp]
push esi
call fcn.00493070
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4fd10f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5920a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0x23
jne 0x4fd172
push esi
push edi
lea edi, [ebp - 0x14]
xor eax, eax
mov esi, ecx
sub edi, ecx
cmp byte [esi], 0x20
mov dl, byte [esi + 1]
mov byte [edi + esi], dl
je 0x4fd144
inc eax
inc esi
cmp eax, 0xf
jl 0x4fd132
lea edx, [eax - 2]
cmp edx, 0xc
pop edi
pop esi
ja 0x4fd172
add ecx, eax
mov byte [ebp + eax - 0x15], 0
push ecx
lea eax, [ebp - 0x14]
push eax
push 0x564f9c
call fcn.004b4be8
add eax, 0x40
push eax
call fcn.004bbcc7
add esp, 0x10
jmp 0x4fd189
push ecx
push 0x564fb8
call fcn.004b4be8
add eax, 0x40
push eax
call fcn.004bbcc7
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa882
leave
ret

Function at 0x4ff734
Capabilities:
Terminate process

Disassembly:
push ecx
cmp dword [esp + 0xc], 0
push esi
mov esi, dword [esp + 0xc]
jne 0x4ff745
mov eax, dword [esi]
jmp 0x4ff756
push dword [esp + 0x14]
call fcn.004fd3d0
pop ecx
call fcn.004fd3e1
mov dword [esi], eax
push 0x120
push 0
push eax
call fcn.004ae070
add esp, 0xc
pop esi
pop ecx
ret

Function at 0x4ff8bc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [0x54605c]
test eax, eax
jne 0x4ff8db
xor al, al
jmp 0x4ff93c
push edi
mov edi, dword [ebp - 0x18]
push 0x104
push dword [ebp + 0xc]
push edi
call dword [0x54612c]
test eax, eax
jne 0x4ff8f6
xor al, al
jmp 0x4ff93b
mov eax, dword [edi + 0x3c]
and dword [ebp + 8], 0
add eax, edi
movzx edx, word [eax + 6]
movzx ecx, word [eax + 0x14]
sub esi, edi
test edx, edx
push ebx
lea ecx, [ecx + eax + 0x18]
jbe 0x4ff938
lea eax, [ecx + 0x10]
mov edi, dword [eax]
mov ebx, dword [eax - 8]
cmp edi, ebx
mov ecx, dword [eax - 4]
ja 0x4ff923
mov edi, ebx
cmp esi, ecx
jb 0x4ff92d
add edi, ecx
cmp esi, edi
jbe 0x4ff941
inc dword [ebp + 8]
add eax, 0x28
cmp dword [ebp + 8], edx
jb 0x4ff915
xor al, al
pop ebx
pop edi
pop esi
leave
ret 0x10
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
inc eax
mov dword [edx], eax
mov eax, dword [ebp + 0x14]
sub esi, ecx
mov dword [eax], esi
mov al, 1
jmp 0x4ff93a
Function at 0x501727
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5920a4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 0xc]
jne 0x501749
cmp dword [ebp + 8], 0
jne 0x50177b
push eax
lea eax, [ebp - 0x404]
push 0x55f358
push eax
call fcn.004aba66
add esp, 0xc
push 0x10
push 0x55f338
lea eax, [ebp - 0x404]
push eax
push 0
call dword [0x546254]
push 0
call fcn.004ab9da
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa882
leave
ret
Function at 0x506e5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
xor edi, edi
cmp ecx, edi
je 0x506f3f
mov esi, dword [ecx + 0x1c]
cmp esi, edi
je 0x506f3f
cmp dword [ecx + 0x20], edi
je 0x506f3f
cmp dword [ecx + 0x24], edi
je 0x506f3f
push ebx
push 2
mov dword [ecx + 0x14], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0x18], edi
pop ebx
mov dword [ecx + 0x2c], ebx
cmp dword [esi + 0x18], edi
mov eax, dword [esi + 8]
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], eax
jge 0x506eaa
mov dword [esi + 0x18], edi
mov eax, dword [esi + 0x18]
neg eax
sbb eax, eax
and eax, 0x47
add eax, 0x2a
mov dword [esi + 4], eax
mov dword [ecx + 0x30], 1
push esi
mov dword [esi + 0x20], edi
call fcn.0050685b
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x3c]
add eax, eax
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x44]
mov word [ecx + eax*2 - 2], di
mov eax, dword [esi + 0x44]
lea eax, [eax + eax - 2]
push eax
push edi
push dword [esi + 0x3c]
call fcn.004ae070
mov eax, dword [esi + 0x7c]
imul eax, eax, 0xc
movzx ecx, word [eax + 0x549b6a]
mov dword [esi + 0x78], ecx
movzx ecx, word [eax + 0x549b68]
mov dword [esi + 0x84], ecx
movzx ecx, word [eax + 0x549b6c]
mov dword [esi + 0x88], ecx
movzx eax, word [eax + 0x549b6e]
add esp, 0x10
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x64], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x40], edi
xor eax, eax
pop ebx
jmp 0x506f42
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
ret
Function at 0x507eab
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x5920a4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 1
xor ecx, ecx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x70], 0x5021f5
mov dword [ebp - 0x6c], 0x51fb6d
mov dword [ebp - 0x64], str.DDERR_EXCLUSIVEMODEALREADYSET
call fcn.00464110
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
jne 0x507ef8
xor eax, eax
jmp 0x50802e
mov dword [eax + 0x23c], ebx
push ebx
mov byte [eax + 0x239], bl
push eax
mov byte [eax + 0x240], bl
call fcn.004c50bc
test eax, eax
pop ecx
pop ecx
je 0x507f35
mov edi, dword [ebp - 0x60]
lea esi, [edi + 0xac]
push dword [esi]
mov ecx, edi
call fcn.004733c0
pop ecx
push edi
mov dword [esi], ebx
call fcn.004fd3d0
pop ecx
jmp 0x507ef1
mov esi, dword [ebp - 0x60]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x64]
mov dword [esi + 0x244], eax
mov eax, dword [ebp - 0x68]
mov dword [esi + 0x248], eax
mov eax, dword [ebp - 0x74]
mov dword [esi + 0x24c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x6c]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0x70]
mov edi, 0x549064
mov dword [esi + 0x44], eax
mov eax, edi
sub ecx, edi
mov dl, byte [ecx + eax]
cmp dl, byte [eax]
je 0x507f7f
or dword [esi + 0x6c], 0x20000
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x507f71
test dword [esi + 0x6c], 0x20000
je 0x507fef
mov eax, dword [ebp - 0x64]
cmp eax, ebx
je 0x507fc3
cmp byte [eax], 0x31
jne 0x507fa1
cmp byte [eax + 2], 0x32
je 0x507fef
cmp eax, ebx
je 0x507fc3
push eax
lea eax, [ebp - 0x5c]
push 0x5633e0
push eax
call fcn.004aba66
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push esi
call fcn.004fd2ac
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x5c]
push 0x563418
push eax
call fcn.004aba66
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push esi
call fcn.004fd2ac
pop ecx
pop ecx
push 0x563450
push esi
mov dword [esi + 0x6c], ebx
call fcn.004fd2ea
mov eax, 0x2000
push eax
mov dword [esi + 0xb0], eax
call fcn.00467e50
pop ecx
push ebx
push ebx
push ebx
push esi
mov dword [esi + 0xac], eax
call fcn.00507e4c
push esi
call fcn.004ff53a
add esp, 0x14
push ebx
push esi
call fcn.004c50bc
test eax, eax
pop ecx
pop ecx
je 0x50802b
call fcn.004aeaa0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa882
leave
ret
Function at 0x40d2b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0xca
jne 0x40d2e6
push edi
call fcn.0040cce4
pop ecx
cmp byte [edi + 0x40], 0
je 0x40d2df
mov dword [edi + 0x14], 0xcf
xor eax, eax
inc eax
jmp 0x40d39b
mov dword [edi + 0x14], 0xcb
cmp dword [edi + 0x14], 0xcb
jne 0x40d36a
mov eax, dword [edi + 0x190]
cmp byte [eax + 0x10], 0
je 0x40d35f
cmp dword [edi + 8], 0
je 0x40d30d
push edi
mov ebx, dword [edi + 8]
call dword [ebx]
pop ecx
push edi
mov esi, dword [edi + 0x190]
call dword [esi]
pop ecx
mov dword [ebp - 4], eax
or eax, eax
je 0x40d39b
cmp dword [ebp - 4], 2
je 0x40d35f
cmp dword [edi + 8], 0
je 0x40d2fb
mov eax, dword [ebp - 4]
cmp eax, 3
je 0x40d33c
cmp eax, 1
jne 0x40d2fb
mov eax, dword [edi + 8]
add eax, 4
mov edx, dword [eax]
inc edx
mov dword [eax], edx
mov eax, dword [edi + 8]
cmp edx, dword [eax + 8]
jl 0x40d2fb
mov eax, dword [edi + 8]
add eax, 8
mov edx, dword [edi + 0x11c]
add dword [eax], edx
jmp 0x40d2fb
mov eax, dword [edi + 0x7c]
mov dword [edi + 0x84], eax
jmp 0x40d38f
cmp dword [edi + 0x14], 0xcc
je 0x40d38f
mov eax, dword [edi]
mov dword [eax + 0x14], 0x14
mov eax, dword [edi]
mov edx, dword [edi + 0x14]
mov dword [eax + 0x18], edx
push edi
mov ebx, dword [edi]
call dword [ebx]
pop ecx
push edi
call fcn.0040d3a0
pop ecx
and eax, 0xff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d3a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0xcc
je 0x40d3e2
push edi
mov ebx, dword [edi + 0x180]
call dword [ebx]
pop ecx
and dword [edi + 0x78], 0
mov dword [edi + 0x14], 0xcc
jmp 0x40d3e2
mov eax, dword [edi]
mov dword [eax + 0x14], 0x30
push edi
mov ebx, dword [edi]
call dword [ebx]
pop ecx
mov eax, dword [edi + 0x180]
cmp byte [eax + 8], 0
jne 0x40d3ce
xor eax, eax
cmp byte [edi + 0x41], 0
sete al
dec eax
and eax, 1
add eax, 0xcd
mov dword [edi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x75afdb96
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x75afdbbb
push esi
mov esi, eax
shr esi, 0x1b
shl eax, 5
or esi, eax
movzx eax, cl
mov cl, byte [edx + 1]
xor eax, esi
inc edx
test cl, cl
jne 0x75afdba3
pop esi
ret 4

Function at 0x75afdc04
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.75afdb8d
mov esi, dword [eax + 0xc]
add esi, 0x14
mov dword [ebp - 0xc], esi
mov ebx, dword [esi]
cmp ebx, esi
je 0x75afdd3b
cmp dword [ebp + 8], 0
je 0x75afdd2f
cmp dword [ebp + 0xc], 0xffffffff
je 0x75afdc47
lea eax, [ebx + 0x24]
push eax
call fcn.75afdbbe
cmp eax, dword [ebp + 8]
jne 0x75afdced
mov eax, dword [ebx + 0x10]
mov edi, dword [eax + 0x3c]
add edi, eax
cmp dword [edi], 0x4550
jne 0x75afdced
mov esi, dword [edi + 0x78]
add esi, eax
cmp dword [esi + 0x14], 0
jbe 0x75afdcea
mov eax, dword [ebp + 0xc]
or dword [ebp - 8], 0xffffffff
cmp eax, 0xffffffff
jne 0x75afdcc1
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 0
jbe 0x75afdcc4
mov ecx, dword [esi + 0x20]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10]
lea ecx, [ecx + edx*4]
mov ecx, dword [ecx + eax]
cmp ecx, dword [edi + 0x50]
jae 0x75afdca1
add eax, ecx
push eax
call fcn.75afdb96
cmp eax, dword [ebp + 8]
je 0x75afdcae
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x18]
jb 0x75afdc80
jmp 0x75afdcc4
mov eax, dword [esi + 0x24]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*2]
mov ecx, dword [ebx + 0x10]
movzx eax, word [eax + ecx]
add eax, dword [esi + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [esi + 0x10]
cmp dword [ebp - 8], 0xffffffff
je 0x75afdcea
test eax, eax
jl 0x75afdcea
cmp eax, dword [esi + 0x14]
jae 0x75afdcea
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov ecx, dword [ebx + 0x10]
mov ecx, dword [eax + ecx]
cmp ecx, dword [edi + 0x50]
jb 0x75afdcf4
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebx]
jmp 0x75afdc1d
mov eax, dword [edi + 0x78]
cmp ecx, eax
jb 0x75afdd34
mov edx, dword [edi + 0x7c]
add edx, eax
cmp ecx, edx
jae 0x75afdd34
mov eax, dword [ebx + 0x10]
add eax, ecx
mov cl, byte [eax]
test cl, cl
je 0x75afdd17
cmp cl, 0x2e
je 0x75afdd17
inc eax
jmp 0x75afdd09
cmp byte [eax], 0x2e
jne 0x75afdd3b
or dword [ebp + 0xc], 0xffffffff
inc eax
push eax
call fcn.75afdb96
mov dword [ebp + 8], eax
jmp 0x75afdc0d
mov eax, dword [ebx + 0x10]
jmp 0x75afdd3d
mov eax, dword [ebx + 0x10]
add eax, ecx
jmp 0x75afdd3d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x75afdd65
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
sub eax, dword [ebp + 8]
dec ecx
test ecx, ecx
push esi
jle 0x75afdda1
mov esi, dword [ebp + 0x14]
mov dl, byte [ebp + 0xc]
push ebx
mov bl, byte [ebp + 0x10]
sub bl, cl
dec bl
xor dl, bl
mov bl, byte [eax]
xor bl, dl
mov byte [esi], bl
mov bl, dl
shr bl, 3
shl dl, 5
inc esi
inc eax
or dl, bl
dec ecx
test ecx, ecx
jg 0x75afdd7e
pop ebx
jmp 0x75afdda4
mov esi, dword [ebp + 0x14]
and byte [esi], 0
pop esi
pop ebp
ret 0x14
Function at 0x75afe65a
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x75b0ef15
call fcn.75b0d378
sub esp, 0x28
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 8]
mov dword [ebp - 0x1c], esi
mov byte [ecx], al
mov al, byte [ebp - 0xd]
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.75affd69
push 4
lea eax, [esi + 0x24]
mov edi, 0x75af2848
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], edi
call fcn.75b0e7fa
push 4
lea eax, [esi + 0x30]
push ebx
push eax
mov dword [esi + 0x34], ebx
mov dword [esi + 0x2c], edi
call fcn.75b0e7fa
mov al, byte [ebp - 0xd]
add esp, 0x18
lea ecx, [esi + 0x38]
push ebx
mov byte [ecx], al
call fcn.75af3a2e
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x48]
push ebx
mov byte [ebp - 4], 1
mov byte [ecx], al
call fcn.75af3a2e
push 0x18
mov byte [ebp - 4], 2
mov dword [esi], 0x75af2844
call fcn.75b0cb79
pop ecx
mov dword [esi + 4], eax
push eax
call dword [fcn.75af1004]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ebx
call fcn.75af66e1
mov dword [ebp - 0x14], 0x75af1964
mov dword [esi + 0x5c], eax
sub dword [ebp - 0x14], 0x6897391f
mov dword [esi + 0x58], ebx
call fcn.75afba71
add eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push eax
call fcn.75aff797
mov dword [ebp - 0x18], eax
mov al, byte [ebp - 0xd]
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x20], esp
push ebx
mov ecx, edi
mov byte [ebp - 4], 3
mov byte [edi], al
call fcn.75af3a2e
push dword [ebp - 0x18]
call fcn.75b0e7ee
pop ecx
push eax
mov ecx, edi
push dword [ebp - 0x18]
call fcn.75af3918
lea ecx, [ebp - 0x34]
call fcn.75affc93
mov ecx, dword [eax + 4]
push 8
mov dword [esi + 0x24], ecx
mov eax, dword [eax + 8]
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 2
call fcn.75afb6c8
call fcn.75afba71
add eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push eax
call fcn.75aff797
mov dword [ebp - 0x18], eax
mov al, byte [ebp - 0xd]
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x20], esp
push ebx
mov ecx, edi
mov byte [ebp - 4], 4
mov byte [edi], al
call fcn.75af3a2e
push dword [ebp - 0x18]
call fcn.75b0e7ee
pop ecx
push eax
mov ecx, edi
push dword [ebp - 0x18]
call fcn.75af3918
lea ecx, [ebp - 0x34]
call fcn.75affc93
mov ecx, dword [eax + 4]
push 8
mov dword [esi + 0x30], ecx
mov eax, dword [eax + 8]
mov dword [esi + 0x34], eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 2
call fcn.75afb6c8
mov edi, 0x75b15504
push edi
call fcn.75b0e7ee
pop ecx
push eax
push edi
lea ecx, [esi + 0x38]
call fcn.75af3918
push edi
call fcn.75b0e7ee
pop ecx
push eax
push edi
lea ecx, [esi + 0x48]
call fcn.75af3918
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x75b04562
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x75b0458d
mov edx, dword [esp + 8]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0xc], edx
mov dword [ecx], eax
cmp word [eax], 0x5a4d
jne 0x75b0458d
mov edx, dword [eax + 0x3c]
add edx, eax
mov dword [ecx + 4], edx
cmp dword [edx], 0x4550
je 0x75b04591
xor al, al
jmp 0x75b045a0
mov edx, dword [eax + 0x3c]
lea eax, [edx + eax + 0xf8]
mov dword [ecx + 8], eax
mov al, 1
ret 8

Function at 0x75b19621
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
push ebx
push esi
push edi
mov dword [ebp - 0x104], 0
jmp 0x75b19648
mov eax, dword [ebp - 0x104]
add eax, 1
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x100
jge 0x75b19669
mov eax, dword [ebp - 0x104]
mov cl, byte [ebp - 0x104]
mov byte [ebp + eax - 0x100], cl
jmp 0x75b19639
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x110], 0
jmp 0x75b19698
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x100
jge 0x75b19741
mov eax, dword [ebp - 0x110]
movsx ecx, byte [ebp + eax - 0x100]
mov dword [ebp - 0x114], ecx
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x108]
movzx ecx, byte [eax]
add ecx, dword [ebp - 0x114]
add ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], ecx
mov eax, dword [ebp - 0x10c]
and eax, 0xff
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x10c]
mov dl, byte [ebp + ecx - 0x100]
mov byte [ebp + eax - 0x100], dl
mov eax, dword [ebp - 0x10c]
mov cl, byte [ebp - 0x114]
mov byte [ebp + eax - 0x100], cl
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [ebp + 0x14]
jl 0x75b1973c
mov dword [ebp - 0x108], 0
jmp 0x75b19689
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x75b19816
mov eax, dword [ebp - 0x118]
add eax, 1
and eax, 0xff
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
movsx ecx, byte [ebp + eax - 0x100]
mov dword [ebp - 0x120], ecx
mov eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0x120]
and eax, 0xff
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
movsx ecx, byte [ebp + eax - 0x100]
mov dword [ebp - 0x124], ecx
mov eax, dword [ebp - 0x118]
mov cl, byte [ebp - 0x124]
mov byte [ebp + eax - 0x100], cl
mov eax, dword [ebp - 0x11c]
mov cl, byte [ebp - 0x120]
mov byte [ebp + eax - 0x100], cl
mov eax, dword [ebp - 0x120]
add eax, dword [ebp - 0x124]
and eax, 0xff
movsx ecx, byte [ebp + eax - 0x100]
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x75b19755
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10