joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7de91fa4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x7de9200a
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x7de9200a
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x7dec28d8
xor edx, edx
mov word [esi], dx
movzx edx, word [ecx]
dec edx
je 0x7dec2940
dec edx
jne 0x7dec28e2
movsx edx, word [ecx + 4]
imul edx, edx, 0x1c
push ebx
mov ebx, dword [eax + 0x14]
mov ebx, dword [ebx + 0xc]
movzx edx, word [edx + ebx + 4]
mov word [esi], dx
pop ebx
test dx, dx
je 0x7dec28f1
mov eax, edi
pop edi
pop esi
leave
ret 0xc
mov eax, 0xc000000d
jmp 0x7de92004
add dh, al
inc ebp
inc dword [ecx]
nop
nop
nop
nop
and dword [ebp - 0x6c], 0
mov dword [ebp - 0x28], 4

Function at 0x7de93531
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
push ebx
mov ebx, dword [eax + 0x24]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
invalid

Function at 0x7de94050
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
push edi
test ebx, ebx
je 0x7dea4a93
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x7dea4a93
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x7dea4a93
mov edi, dword [eax + 0x58]
mov eax, dword [eax + 0x48]
cmp edi, eax
jge 0x7dea4a93
mov edx, dword [ebp + 0xc]
or edx, dword [ebp + 0x10]
je 0x7ded3d1a
test edi, edi
jl 0x7dea4a9a
push esi
mov esi, edi
imul esi, esi, 0x30
add esi, ecx
mov dword [ebp + 8], eax
je 0x7de940f0
cmp dword [ebp + 8], 0
je 0x7de940f0
push esi
lea eax, [ebp + 0xc]
push eax
call fcn.7de940ff
test eax, eax
jl 0x7de94146
jle 0x7de94682
mov edi, dword [esi + 0x28]
test edi, edi
jl 0x7dea4a8c
mov eax, dword [ebx + 0xc]
cmp edi, dword [eax + 0x48]
jge 0x7dea4a8c
mov esi, edi
imul esi, esi, 0x30
add esi, dword [ebx + 0x18]
dec dword [ebp + 8]
test esi, esi
jne 0x7de940ac
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
leave
ret 0x14
mov edi, dword [esi + 0x20]
jmp 0x7de940cd
mov dword [ebp - 4], edi
jmp 0x7de940f0
xor esi, esi
jmp 0x7de940e9
push 0x57
call 0x7de582ef
or eax, 0xffffffff
jmp 0x7de940f4

Function at 0x7de948c6
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x7de948ea
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x7de948ea
mov edx, dword [ebp + 0xc]
cmp edx, dword [eax + 0x1c]
jae 0x7de948ea
mov eax, dword [ecx + 0x14]
add eax, edx
pop ebp
ret 8
push 0x57
call 0x7de582ef
jmp fcn.7ded3d13
Function at 0x7de94982
Capabilities:
Access peb ldr_data

Disassembly:
push 0x14
push 0x7de9c3e0
call 0x7de63eb4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push 1
call 0x7de6cb95
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
cmp edi, ebx
je 0x7de94a1e
mov esi, dword [edi + 0x24]
cmp esi, ebx
jne 0x7debc168
lea ebx, [edi + 0x14]
mov edi, dword [ebx]
mov dword [ebp - 0x24], edi
cmp edi, ebx
je 0x7de94a1e
lea esi, [edi - 8]
push dword [esi + 0x18]
call 0x7de69164
test eax, eax
je 0x7de949ea
mov ecx, dword [esi + 0x18]
mov eax, dword [eax + 0x50]
add eax, ecx
cmp dword [ebp + 8], ecx
jb 0x7de949ea
cmp dword [ebp + 8], eax
jb 0x7de949ee
mov edi, dword [edi]
jmp 0x7de949c2
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
call fcn.7de94a13
mov eax, dword [ebp - 0x1c]
call 0x7de63ef9
ret 8
mov dword [ebp - 0x1c], 0x8000001a
jmp 0x7de949f7
push dword [esi + 0x18]
call 0x7de69164
cmp eax, ebx
je 0x7de949bd
mov ecx, dword [esi + 0x18]
mov eax, dword [eax + 0x50]
add eax, ecx
cmp dword [ebp + 8], ecx
jb 0x7de949bd
cmp dword [ebp + 8], eax
jae 0x7de949bd
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [ebp - 0x1c], ebx
jmp 0x7de949f7

Function at 0x7de94d10
Capabilities:
Check for peb beingdebugged flag

Disassembly:
add byte [eax], al
cmp eax, dword [0x7df70144]
jae 0x7debbd36
xor esi, esi
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x7de94d73
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x7de94d2a
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x24], eax
mov eax, dword fs:[0x18]
mov edi, dword [ebp - 0x24]
push edi
push 8
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call 0x7de64026
mov esi, eax
cmp esi, ebx
je 0x7debbd2a
add edi, 0xfffffffe
push edi
push dword [ebp + 0xc]
push esi
call 0x7de58340
add esp, 0xc
mov edi, dword [ebp + 8]
mov eax, dword [0x7df70130]
imul eax, eax, 0x18
mov ecx, dword [0x7df70148]
mov dword [eax + ecx], edi
mov eax, dword [0x7df70130]
imul eax, eax, 0x18
mov ecx, dword [0x7df70148]
mov dword [eax + ecx + 4], esi
mov eax, dword [0x7df70130]
imul eax, eax, 0x18
mov ecx, dword [0x7df70148]
mov edx, dword [ebp + 0x10]
mov dword [eax + ecx + 8], edx
mov eax, dword [0x7df70130]
imul eax, eax, 0x18
mov ecx, dword [0x7df70148]
mov edx, dword [ebp + 0x14]
mov dword [eax + ecx + 0xc], edx
mov eax, dword [0x7df70130]
imul eax, eax, 0x18
mov ecx, dword [0x7df70148]
mov dword [eax + ecx + 0x10], 1
mov eax, dword [0x7df70130]
imul eax, eax, 0x18
mov ecx, dword [ebp + 0x18]
mov edx, dword [0x7df70148]
mov dword [eax + edx + 0x14], ecx
inc dword [0x7df70130]
mov dword [ebp - 4], 0xfffffffe
call fcn.7de94e0d
mov eax, dword [ebp - 0x20]
call 0x7de63ef9
ret 0x14
mov dword [ebp - 0x20], 0xc0000017
jmp 0x7de94df1
mov eax, dword fs:[0x18]
mov ecx, dword [0x7df70144]
add ecx, 0x20
imul ecx, ecx, 0x18
push ecx
push dword [0x7df70148]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call 0x7de77f6e
cmp eax, ebx
je 0x7debbd2a
mov dword [0x7df70148], eax
add dword [0x7df70144], 0x20
jmp 0x7de94d1e
Function at 0x7de95054
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x7df72088]
xor eax, ebp
mov dword [ebp - 4], eax
cld
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 0x210], edi
call 0x7de63f20
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
xor ebx, ebx
call fcn.7de95477
dec eax
cmp eax, 0x102
ja 0x7de9509f
lea ebx, [ebp - 0x20c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x1c
push 8
push dword [eax + 0x18]
call 0x7de64026
mov esi, eax
cmp esi, edi
je 0x7ded3bce
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
mov dword [esi + 8], edi
call fcn.7de95321
mov dword [esi + 0xc], eax
cmp eax, edi
je 0x7ded3bf7
mov eax, dword [eax + 0xc]
cmp dword [eax + 0x44], 1
jb 0x7ded3be0
push 1
call fcn.7de951cf
mov ecx, dword [esi + 0xc]
mov dword [ecx + 0x20], eax
mov eax, dword fs:[0x18]
mov ecx, dword [esi + 0xc]
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x34]
mov eax, dword [eax + 0x30]
shl ecx, 2
push ecx
push 8
push dword [eax + 0x18]
call 0x7de64026
mov dword [esi + 0x10], eax
cmp eax, edi
je 0x7ded3be7
cmp ebx, edi
je 0x7de95156
push ebx
call fcn.7de9515f
or dword [esi], 0x80
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], edi
mov eax, dword [ebp - 0x210]
and eax, 7
or dword [esi + 4], eax
mov eax, esi
invalid

Function at 0x7de9515f
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x7ded3e57
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x104
cmp word [edx], 0
je 0x7de95185
inc ecx
inc edx
inc edx
cmp ecx, eax
jl 0x7de95178
cmp ecx, eax
jge 0x7ded3e5e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push edi
lea esi, [ecx + ecx]
lea ecx, [esi + 2]
push ecx
push 0
push dword [eax + 0x18]
call 0x7de64026
mov edi, eax
test edi, edi
je 0x7de951c4
push esi
push dword [ebp + 8]
push edi
call 0x7de58340
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x7de95321
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
push 0x10
mov dword [ebp - 8], esi
pop edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
jne 0x7ded3d62
cmp dword [ebp + 0x10], esi
jne 0x7ded3d71
cmp dword [ebp + 0x14], esi
jne 0x7ded3d79
cmp dword [ebp + 0x18], esi
jne 0x7ded3d81
mov ebx, dword [ebp + 0x1c]
cmp ebx, esi
je 0x7de9536e
mov eax, dword [ebx]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push edi
call fcn.7de94a2c
idiv bh
dec dword [ecx - 0x21c4f3bb]
je 0x7de95395
mov ecx, dword [ebp - 4]
and ecx, 0xffe8ffff
mov dword [ebx], ecx
cmp eax, esi
je 0x7ded3d89
mov ecx, dword [ebp + 8]
cmp ecx, esi
jge 0x7ded3d90
push dword [ebp - 0xc]
push dword [ebp - 8]
push eax
call fcn.7de953d9
mov ebx, eax
cmp ebx, esi
je 0x7ded3da1
test dword [ebp - 4], 0x1c0000
je 0x7ded3dae
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x18
add al, 0
nop
nop
nop
nop
nop
xchg ecx, eax
stc
call [ecx + 0x59]
test byte [edi + 1], cl
add byte [eax], al
inc ebp
aam 0x50
Function at 0x7de9586d
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edx, edx
je 0x7de95812
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0xc], 0
je 0x7de95812
movzx ecx, word [esi]
mov edx, dword [0x7df70084]
movzx ecx, word [edx + ecx*2]
inc esi
mov dx, cx
shr dx, 8
inc esi
test dl, dl
je 0x7de95807
mov edi, dword [ebp + 0xc]
dec dword [ebp + 0xc]
cmp edi, 2
jb 0x7de95812
mov byte [eax], dl
inc eax
mov byte [eax], cl
inc eax
dec dword [ebp + 0xc]
dec dword [ebp + 0x18]
jne 0x7de957d9
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x7de95972
sub eax, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x7de95972
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x18]
shr edx, 1
cmp byte [0x7df70004], 0
push esi
push edi
mov dword [ebp + 0x18], edx
jne 0x7de957cc
cmp edx, dword [ebp + 0xc]
jb 0x7de95891
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x7dea173c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov esi, dword [0x7df70080]
mov edi, edx
and edi, 0xf
add ecx, edi
lea eax, [eax + edi*2]
add ecx, 0xfffffff1
add eax, 0xffffffe2
push ebx
cmp edi, 0xf
jbe 0x7de95985
movzx ebx, word [eax + 0x1e]
mov bl, byte [ebx + esi]
add eax, 0x20
add ecx, 0x10
mov byte [ecx - 1], bl
movzx ebx, word [eax]
mov bl, byte [ebx + esi]
mov byte [ecx], bl
movzx ebx, word [eax + 2]
mov bl, byte [ebx + esi]
mov byte [ecx + 1], bl
movzx ebx, word [eax + 4]
mov bl, byte [ebx + esi]
mov byte [ecx + 2], bl
movzx ebx, word [eax + 6]
mov bl, byte [ebx + esi]
mov byte [ecx + 3], bl
movzx ebx, word [eax + 8]
mov bl, byte [ebx + esi]
mov byte [ecx + 4], bl
movzx ebx, word [eax + 0xa]
mov bl, byte [ebx + esi]
mov byte [ecx + 5], bl
movzx ebx, word [eax + 0xc]
mov bl, byte [ebx + esi]
mov byte [ecx + 6], bl
movzx ebx, word [eax + 0xe]
mov bl, byte [ebx + esi]
mov byte [ecx + 7], bl
movzx ebx, word [eax + 0x10]
mov bl, byte [ebx + esi]
mov byte [ecx + 8], bl
movzx ebx, word [eax + 0x12]
mov bl, byte [ebx + esi]
mov byte [ecx + 9], bl
movzx ebx, word [eax + 0x14]
mov bl, byte [ebx + esi]
mov byte [ecx + 0xa], bl
movzx ebx, word [eax + 0x16]
mov bl, byte [ebx + esi]
mov byte [ecx + 0xb], bl
movzx ebx, word [eax + 0x18]
mov bl, byte [ebx + esi]
mov byte [ecx + 0xc], bl
movzx ebx, word [eax + 0x1a]
mov bl, byte [ebx + esi]
mov byte [ecx + 0xd], bl
movzx ebx, word [eax + 0x1c]
mov bl, byte [ebx + esi]
mov byte [ecx + 0xe], bl
push 0x10
sub edx, edi
pop edi
jne 0x7de958b9
pop ebx
mov eax, dword [ebp + 0x18]
cmp dword [ebp + 0xc], eax
pop edi
sbb eax, eax
and eax, 0x80000005
pop esi
pop ebp
ret 0x14
jmp dword [edi*4 + 0x7decf828]
mov dword [eax], edx
jmp 0x7de9589c
Function at 0x7de96a93
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x7df72088]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x84], eax
mov eax, dword [ebx + 0x28]
push esi
mov esi, dword [ebx + 0x10]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebx + 0x30]
xor edx, edx
push edi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x88], eax
cmp esi, edx
je 0x7dec9f6a
mov ecx, dword [ebx + 8]
lea edi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp cx, dx
je 0x7de96c39
mov eax, dword [ebx + 0xc]
cmp eax, 0x400
jae 0x7de96c39
mov esi, dword [eax*4 + 0x7df756c0]
cmp esi, edx
je 0x7de96c43
cmp ecx, dword [esi + 0x14]
jne 0x7de96c43
mov dword [ebp - 0x80], esi
cmp esi, edx
je 0x7de96c43
cmp byte [esi + 0xcc], dl
jne 0x7dec9f72
mov byte [ebp - 0x79], dl
cmp byte [esi + 0x54], 0
je 0x7de96c16
mov al, byte [esi + 0x55]
cmp byte [ebp - 0x4c], al
ja 0x7de96c4a
mov eax, dword [ebp - 0x48]
or eax, dword [ebp - 0x44]
je 0x7de96b8f
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
and eax, dword [ebp - 0x48]
and ecx, dword [ebp - 0x44]
or eax, ecx
je 0x7de96c16
mov edi, dword [esi + 0x40]
mov esi, dword [esi + 0x44]
mov eax, edi
and eax, dword [ebp - 0x48]
mov ecx, esi
and ecx, dword [ebp - 0x44]
cmp eax, edi
jne 0x7de96c16
cmp ecx, esi
jne 0x7de96c16
mov esi, dword [ebp - 0x84]
and dword [ebp - 0x1c], 0
xor eax, eax
mov word [ebp - 0x74], ax
mov ax, word [ebx + 0x20]
mov word [ebp - 0x72], ax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x20], eax
lea edi, [ebp - 0x38]
test esi, esi
jne 0x7de96bca
mov esi, dword fs:[0x18]
add esi, 0xf50
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x8c]
test esi, esi
jne 0x7deca003
mov byte [ebp - 0x28], 0
mov ax, word [ebx + 0x14]
mov word [ebp - 0x26], ax
push 0x70
mov eax, 0xc012
mov word [ebp - 0x76], ax
pop eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x80]
push 0x70
push 0x300
push dword [eax + 0x10]
call 0x7de56184
test eax, eax
jne 0x7deca013
xor edi, edi
cmp byte [ebp - 0x79], 1
je 0x7deca020
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call 0x7de64114
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
mov dword [ebp - 0x80], edx
mov esi, edx
jmp 0x7de96b26
push 6
jmp 0x7dec9f6c
test al, al
je 0x7de96b53
jmp 0x7de96c16
nop
nop
nop
nop
in al, dx
add al, 0
Function at 0x7de98767
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
push eax
push eax
push eax
push eax
call int.7dee2c84
add esp, 0x14
or eax, 0xffffffff
jmp 0x7de9889d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call int.7dee2c84
add esp, 0x14
or eax, 0xffffffff
jmp 0x7de9889c
mov edx, dword [ebp + 0xc]
jmp 0x7de98874
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x7df72088]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x428], eax
cmp esi, eax
je 0x7de97f79
mov ecx, dword [ebp + 0xc]
cmp ecx, eax
je 0x7de97f79
movzx esi, word [ecx]
push edi
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x438], eax
cmp si, ax
je 0x7de98896
mov edx, ecx
push 2
pop edi
add edx, edi
xor eax, eax
cmp dword [ebp - 0x41c], eax
mov dword [ebp + 0xc], edx
jl 0x7de98880
lea ecx, [esi - 0x20]
cmp cx, 0x58
ja 0x7de98818
movzx eax, si
movzx eax, byte [eax + 0x7ded1eb8]
and eax, 0xf
mov ecx, dword [ebp - 0x438]
imul eax, eax, 9
movzx eax, byte [eax + ecx + 0x7ded1ed8]
push 8
shr eax, 4
pop ecx
mov dword [ebp - 0x438], eax
cmp eax, ecx
je 0x7de984b4
cmp eax, 7
ja 0x7de9875a
jmp dword [eax*4 + 0x7ded24cb]
movzx esi, word [edx]
test si, si
jne 0x7de987f0
cmp dword [ebp - 0x438], 0
je 0x7de98896
cmp dword [ebp - 0x438], 7
jne 0x7de984b4
mov eax, dword [ebp - 0x41c]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call 0x7de64114
leave
ret

Function at 0x7de98f65
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dl, byte [eax - 2]
test dl, dl
je 0x7dec9247
cmp dl, byte [ecx - 2]
jne 0x7dec9247
mov dl, byte [eax - 1]
test dl, dl
je 0x7dec923a
cmp dl, byte [ecx - 1]
jne 0x7dec923a
add dword [ebp - 4], 4
cmp dword [ebp - 4], edi
jae 0x7de80f12
jmp 0x7de98f96
cmp dword [ebp - 4], ebx
jae 0x7de80f28
mov dl, byte [eax]
test dl, dl
je 0x7de80f37
cmp dl, byte [ecx]
jne 0x7de80f37
inc eax
inc ecx
inc dword [ebp - 4]
jmp 0x7de80f12
xor eax, eax
jmp 0x7de98fc9
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
jmp 0x7de80f12
movzx eax, byte [eax]
movzx ecx, byte [ecx]
jmp 0x7de98fc7
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x7dec9233
push edi
cmp ebx, 4
jb 0x7de80f2f
lea edi, [ebx - 4]
test edi, edi
jbe 0x7de80f2f
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [eax]
add eax, 4
add ecx, 4
test dl, dl
je 0x7de9a738
cmp dl, byte [ecx - 4]
jne 0x7de9a738
mov dl, byte [eax - 3]
test dl, dl
je 0x7de98fbf
cmp dl, byte [ecx - 3]
je 0x7de80edc
movzx eax, byte [eax - 3]
movzx ecx, byte [ecx - 3]
sub eax, ecx
pop edi
pop ebx
leave
ret
movzx eax, byte [eax - 4]
movzx ecx, byte [ecx - 4]
jmp 0x7de98fc7
fisttp dword [ebx + 0x4f60c40]
add eax, dword [edi + ecx]
test dword [edi], ebp
into
add eax, dword [eax]
add byte [ebx - 0x48f0ebba], cl
dec eax
push es
Function at 0x7de98fd2
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x7df72088]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push eax
mov dword [ebp - 0x40c], ecx
mov ecx, dword [ebp + 0x1c]
lea eax, [ebp - 0x418]
push eax
mov dword [ebp - 0x41c], ecx
call 0x7de6dd73
test eax, eax
jl 0x7de9905e
push esi
push edi
mov edi, dword [ebp + 0x18]
cmp edi, 0x3f4
jae 0x7debcbd1
lea eax, [ebp - 0x408]
push eax
push 0x400
lea esi, [ebp - 0x404]
mov eax, esi
push eax
push 2
lea eax, [ebp - 0x418]
push eax
push ebx
call 0x7de55a98
mov edi, eax
test edi, edi
jge 0x7deabb13
cmp edi, 0x80000005
je 0x7debcc44
and dword [ebp - 0x410], 0
mov eax, dword [esi + 4]
add al, 0x83
clc
invalid
je 0x7deabb88
cmp eax, 7
je 0x7deabb88
push 4
pop ecx
cmp eax, ecx
jne 0x7debcc60
cmp dword [ebp + 0x10], ecx
jne 0x7deabb91
cmp dword [ebp + 0x18], ecx
jne 0x7debcc56
cmp dword [esi + 8], ecx
jne 0x7debcc56
add dword [eax], eax
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x408], ecx
test eax, eax
je 0x7deabb98
mov ecx, dword [esi + 0xc]
mov dword [eax], ecx
cmp dword [ebp + 0x10], eax
je 0x7debcce4
mov edi, 0xc0000024
jmp 0x7deabb74
mov edi, 0x80000005
jmp fcn.7deabb5e
add edi, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x7debcc4c
mov eax, dword [0x7df70058]
push edi
add eax, 0x180000
push eax
push ecx
call 0x7de64026
mov dword [ebp - 0x410], eax
test eax, eax
je 0x7debcc4c
mov eax, dword cs:[0x7df7005c]
movzx edx, si
mov edi, edx
shr edi, 8
movzx edi, word [eax + edi*2]
mov ebx, edx
shr ebx, 4
and ebx, 0xf
add edi, ebx
movzx edi, word [eax + edi*2]
mov ebx, dword [ebp - 4]
and edx, 0xf
add edi, edx
add si, word [eax + edi*2]
mov edi, dword [ebp + 8]
movzx eax, si
movzx eax, word [ecx + eax*2]
mov cx, ax
shr cx, 8
test cl, cl
je 0x7debcc4f
mov edx, dword [ebp + 0xc]
dec dword [ebp + 0xc]
cmp edx, 2
jb 0x7debcc62
mov byte [edi], cl
inc edi
mov byte [edi], al
inc edi
dec dword [ebp + 0xc]
dec ebx
mov dword [ebp + 8], edi
mov dword [ebp - 4], ebx
jne 0x7debcb8a
invalid
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x7debcd59
sub edi, dword [ebp - 8]
mov dword [eax], edi
jmp 0x7debcd59
out dx, al
add al, byte [eax]
mov ecx, ebx
mov dword [ebp + 0xc], ebx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x7debccf5
mov dword [eax], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [0x7df70070]
and ecx, 0xf
add dword [ebp + 8], ecx
mov dword [ebp + 0x10], ecx
lea edx, [edx + ecx*2]

Function at 0x7de99191
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [edi + 0x18]
push 3
call 0x7de65495
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x14]
and dword [ebp + 8], 0
mov ebx, dword [edi + 0x1c]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
cmp cx, word [eax + 6]
jae 0x7de9922b
Function at 0x7de99621
Capabilities:
Check for peb beingdebugged flag
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0x10
push 0
push dword [eax + 0x18]
call 0x7de64026
mov esi, eax
test esi, esi
je 0x7de996a4
push ebx
push edi
push dword [ebp + 0xc]
mov dword [esi + 8], 1
call 0x7de76fcb
mov ebx, dword [ebp + 0x10]
imul ebx, ebx, 0xc
add ebx, 0x7df74724
push ebx
mov dword [esi + 0xc], eax
lea edi, [ebx + 4]
call 0x7de689f1
cmp dword [edi], edi
jne 0x7de99686
mov ecx, dword fs:[0x18]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ecx + 0x30]
add eax, 2
add ecx, 0x28
lock bts dword [ecx], eax
cmp dword [ebp + 8], 0
je 0x7dead414
mov eax, dword [edi]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [eax + 4], esi
mov dword [edi], esi
push ebx
call 0x7de689ab
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 0xc
mov eax, dword [edi + 4]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [eax], esi
mov dword [edi + 4], esi
jmp 0x7de9969c
Function at 0x7de998a9
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push 0x30
push 0x7de9bd18
call 0x7de63eb4
mov byte [ebp - 0x19], 1
call 0x7de6df47
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 0x13
push 0x7ded3a2c
push ebx
call 0x7de6f6ef
mov esi, 0xc0000023
cmp eax, esi
je 0x7deb59fd
mov dword [ebp - 4], 0xfffffffe
call fcn.7de99a71
cmp byte [ebp - 0x19], bl
je 0x7deb5a42
push 0x7ffe0030
lea eax, [ebp - 0x40]
push eax
call 0x7de6dd73
movzx eax, word [0x7dec148c]
movzx ecx, word [ebp - 0x40]
lea esi, [ecx + eax + 0x18]
cmp esi, 0xfffe
ja 0x7deb5a20
mov eax, dword [0x7df70058]
add eax, 0x180000
push esi
push eax
push dword [0x7df70104]
call 0x7de64026
mov dword [ebp - 0x34], eax
cmp eax, ebx
je 0x7deb5a31
xor eax, eax
mov word [ebp - 0x38], ax
mov word [ebp - 0x36], si
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
call 0x7de6e55f
push 0x7dec148c
lea eax, [ebp - 0x38]
push eax
call 0x7de6e55f
push 0x7ded3848
lea eax, [ebp - 0x38]
push eax
call 0x7de6e55f
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
call 0x7de7243a
mov esi, eax
push dword [ebp - 0x34]
push ebx
push dword [0x7df70104]
call 0x7de63f85
cmp esi, ebx
jl 0x7deb5a3b
lea eax, [ebp - 0x28]
push eax
push ebx
push 0x7ded3a54
push dword [ebp - 0x20]
call 0x7de661aa
mov esi, eax
cmp esi, ebx
jl 0x7de99a81
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x7ded3a5c
push dword [ebp - 0x20]
call 0x7de661aa
mov esi, eax
cmp esi, ebx
jl 0x7de99a81
lea eax, [ebp - 0x30]
push eax
push ebx
push 0x7ded3a64
push dword [ebp - 0x20]
call 0x7de661aa
mov esi, eax
cmp esi, ebx
jl 0x7de99a81
push dword [ebp - 0x28]
call 0x7de74058
mov dword [0x7df70118], eax
push dword [ebp - 0x2c]
call 0x7de74058
mov dword [0x7df7011c], eax
push dword [ebp - 0x30]
call 0x7de74058
mov dword [0x7df70114], eax
mov eax, dword [ebp - 0x20]
mov dword [0x7df70044], eax
xor eax, eax
call 0x7de63ef9
ret
cmp eax, ebx
jge 0x7de9999e
jmp 0x7de99a23
push dword [ebp - 0x20]
call 0x7de771d7
jmp 0x7deb5a3b
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 0xf
push 0x7deefa58
push ebx
call 0x7de6f6ef
cmp eax, esi
jne 0x7de998e3
mov byte [ebp - 0x19], bl
jmp 0x7de998e3
mov eax, 0xc0000106
jmp 0x7de99a23
mov eax, 0xc0000017
jmp 0x7de99a23
mov eax, esi
jmp 0x7de99a23
lea eax, [ebp - 0x20]
push eax
push 0x7ded3848
push ebx
push ebx
call 0x7de7243a
jmp 0x7de99a77