joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75df3b0b
Capabilities:
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, ecx
mov ecx, 0x61c8864f
push ebx
push esi
push edi
lea esi, reloc.ntdll.dll_NtClose
mov edi, 0x24234428
lea eax, [esi - 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], eax
mov ebx, 0x85ebca77
xor esi, esi
imul eax, dword [edx], reloc.ntdll.dll_NtClose
sub edi, eax
imul eax, dword [edx + 4], 0x7a143589
rol edi, 0xd
imul edi, edi, 0x9e3779b1
sub ebx, eax
imul eax, dword [edx + 8], 0x7a143589
add edx, 0xc
rol ebx, 0xd
mov dword [ebp - 8], edx
imul ebx, ebx, 0x9e3779b1
sub esi, eax
imul eax, dword [edx], reloc.ntdll.dll_NtClose
rol esi, 0xd
add edx, 4
imul esi, esi, 0x9e3779b1
sub ecx, eax
rol ecx, 0xd
imul ecx, ecx, 0x9e3779b1
cmp edx, dword [ebp - 4]
jbe 0x75df3b38
mov eax, dword [ebp - 8]
rol esi, 0xc
rol ecx, 0x12
add esi, 0x208
add ecx, esi
rol ebx, 7
mov esi, dword [ebp - 0xc]
add ecx, ebx
rol edi, 1
add ecx, edi
add eax, 8
jmp 0x75df3bc5
imul eax, dword [edx], reloc.ntdll.dll_NtClose
sub ecx, eax
rol ecx, 0x11
imul ecx, ecx, 0x27d4eb2f
add edx, 4
lea eax, [edx + 4]
cmp eax, esi
jbe 0x75df3bae
jmp 0x75df3be0
movzx eax, byte [edx]
imul eax, eax, 0x165667b1
add eax, ecx
rol eax, 0xb
imul ecx, eax, 0x9e3779b1
inc edx
cmp edx, esi
jb 0x75df3bcb
mov eax, ecx
shr eax, 0xf
xor eax, ecx
imul ecx, eax, 0x85ebca77
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
leave
ret 4

Function at 0x75df4870
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
and dword [esp], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x75df4952
cmp dword [ebp + 0xc], 0
jne 0x75df4952
mov ecx, edi
call fcn.75e1b0ee
test eax, eax
je 0x75df4952
push edi
mov edx, str.AlternateComputerNames
mov ecx, str.RegistryMachineSystemCurrentControlSetServicesDnsCacheParameters
call fcn.75df4964
push eax
call dword [0x75e21e90]
mov esi, eax
test esi, esi
jne 0x75df494e
lea eax, [esp + 0xc]
push eax
push esi
push edi
call sym.KERNEL32.dll_DnsHostnameToComputerNameW
test eax, eax
jne 0x75df494e
call dword [0x75e210b4]
mov esi, eax
cmp esi, 0xea
jne 0x75df494e
mov esi, dword [esp + 0xc]
inc esi
mov dword [esp + 0xc], esi
call dword [0x75e20cf0]
mov ecx, dword [eax]
lea eax, [esi + esi]
push eax
mov eax, dword fs:[0x30]
push ecx
push dword [eax + 0x18]
call dword [0x75e221e0]
mov ebx, eax
test ebx, ebx
jne 0x75df4915
push 8
pop esi
jmp 0x75df494e
lea eax, [esp + 0xc]
push eax
push ebx
push edi
call sym.KERNEL32.dll_DnsHostnameToComputerNameW
test eax, eax
je 0x75df4930
mov ecx, ebx
call fcn.75df5290
test eax, eax
jne 0x75df493a
call dword [0x75e210b4]
mov esi, eax
jmp 0x75df493c
xor esi, esi
mov eax, dword fs:[0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [0x75e221d0]
mov eax, esi
jmp 0x75df4955
push 0x57
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x75df6240
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
and dword [esp], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
jne 0x75df6322
mov edi, dword [ebp + 8]
test edi, edi
je 0x75df6322
push edi
mov edx, str.AlternateComputerNames
mov ecx, str.RegistryMachineSystemCurrentControlSetServicesDnsCacheParameters
call fcn.75df50c0
push eax
call dword [0x75e21e90]
mov esi, eax
test esi, esi
jne 0x75df631e
lea eax, [esp + 0xc]
push eax
push esi
push edi
call sym.KERNEL32.dll_DnsHostnameToComputerNameW
test eax, eax
jne 0x75df631e
call dword [0x75e210b4]
mov esi, eax
cmp esi, 0xea
jne 0x75df631e
mov esi, dword [esp + 0xc]
inc esi
mov dword [esp + 0xc], esi
call dword [0x75e20cf0]
mov ecx, dword [eax]
lea eax, [esi + esi]
push eax
mov eax, dword fs:[0x30]
push ecx
push dword [eax + 0x18]
call dword [0x75e221e0]
mov ebx, eax
test ebx, ebx
jne 0x75df62da
push 8
pop esi
jmp 0x75df631e
lea eax, [esp + 0xc]
push eax
push ebx
push edi
call sym.KERNEL32.dll_DnsHostnameToComputerNameW
test eax, eax
je 0x75df6300
mov ecx, ebx
call fcn.75df4da2
test eax, eax
jne 0x75df630a
mov ecx, ebx
call fcn.75df5094
test eax, eax
jne 0x75df630a
call dword [0x75e210b4]
mov esi, eax
jmp 0x75df630c
xor esi, esi
mov eax, dword fs:[0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [0x75e221d0]
mov eax, esi
jmp 0x75df6325
push 0x57
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x75e03e70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
call dword [0x75e20cf0]
push 0x1e
push dword [eax]
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x75e221e0]
mov ebx, eax
test ebx, ebx
jne 0x75e03ead
push 8
call dword [0x75e21ebc]
xor eax, eax
jmp 0x75e03ff6
mov eax, dword [ebp - 4]
push esi
push edi
push 6
pop ecx
mov esi, str.DosDevices_
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movzx eax, word [eax]
push eax
call dword [0x75e21d68]
pop ecx
push 0x3a
mov word [ebx + 0x18], ax
pop eax
push dword [ebp - 8]
mov word [ebx + 0x1a], ax
xor eax, eax
mov word [ebx + 0x1c], ax
lea eax, [ebp - 0x14]
push eax
call dword [0x75e21ed4]
mov ax, word [ebp - 0x14]
mov ecx, 0xfffe
add ax, cx
push 0x24
movzx esi, ax
pop edi
add esi, edi
mov word [ebp - 0x14], ax
mov dword [ebp - 4], esi
call dword [0x75e20cf0]
push esi
push dword [eax]
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x75e221e0]
mov edx, eax
mov dword [ebp - 8], edx
test edx, edx
jne 0x75e03f43
push ebx
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [0x75e221d0]
push 8
call dword [0x75e21ebc]
xor eax, eax
jmp 0x75e03ff4
push 8
pop eax
mov word [edx], ax
mov esi, ebx
push 0x1c
pop eax
mov word [edx + 2], ax
mov word [edx + 4], di
lea edi, [edx + 8]
mov ax, word [ebp - 0x14]
mov word [edx + 6], ax
movzx eax, word [ebp - 0x14]
push 7
pop ecx
push eax
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x10]
lea eax, [edx + 0x24]
push eax
call fcn.75dc7421
mov esi, dword [ebp - 8]
add esp, 0xc
xor edi, edi
movzx eax, word [esi + 4]
push 0x3f
pop ecx
push ebx
mov word [eax + esi + 2], cx
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [0x75e221d0]
push 0xffffffffffffffff
push 0x80
push 3
push edi
push 3
push 0xc0000000
push str..MountPointManager
call dword [0x75e21198]
mov ebx, eax
cmp ebx, reloc.ntdll.dll_NtClose
je 0x75e03fdf
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push dword [ebp - 4]
push esi
push 0x6dc000
push ebx
call dword [0x75e21350]
push ebx
mov edi, eax
call dword [0x75e212d8]
mov ecx, dword fs:[0x30]
push esi
push 0
push dword [ecx + 0x18]
call dword [0x75e221d0]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x75e0e6eb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
not ecx
cmp dword [ebp + 8], esi
jbe 0x75e0e713
movzx eax, byte [esi + edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + reloc.ntdll.dll_NtClose]
inc esi
cmp esi, dword [ebp + 8]
jb 0x75e0e6fa
not ecx
mov eax, ecx
pop esi
pop ebp
ret 4

Function at 0x75e0eab0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push str.RegistryMachine
lea eax, [ebp - 8]
xor edi, edi
push eax
mov ebx, edx
mov dword [ebp - 8], edi
mov esi, ecx
mov dword [ebp - 4], edi
call dword [0x75e21ed4]
mov ecx, ebx
xor eax, eax
mov word [esi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x75e0eadf
mov eax, dword [ebp - 8]
sub ecx, edx
add eax, 2
sar ecx, 1
lea edx, [eax + ecx*2]
mov eax, dword fs:[0x30]
mov word [esi + 2], dx
mov ecx, dword [eax + 0x18]
movzx eax, dx
push eax
push 8
push ecx
call dword [0x75e221e0]
mov dword [esi + 4], eax
test eax, eax
jne 0x75e0eb3d
movzx eax, word [esi + 2]
mov edi, 0xc0000017
push eax
push str.Failed_to_allocate__d_bytes_for_user_key_buffer
push 0x58c
push str.AslRegistryBuildMachinePath
push 1
call fcn.75e0e6b8
add esp, 0x14
jmp 0x75e0eb66
lea eax, [ebp - 8]
push eax
push esi
call dword [0x75e21e0c]
test ebx, ebx
je 0x75e0eb5e
cmp word [ebx], 0x5c
je 0x75e0eb5e
push 0x75e2a638
push esi
call dword [0x75e21df8]
push ebx
push esi
call dword [0x75e21df8]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x75e10aa8
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push edi
mov edi, ecx
test edi, edi
je 0x75e10b14
push ebx
mov ebx, dword [edi]
cmp ebx, edi
je 0x75e10ae7
push esi
cmp dword [ebx + 0x10], 0
je 0x75e10acc
push dword [ebx + 0x10]
call dword [0x75e22180]
and dword [ebx + 0x10], 0
mov eax, dword fs:[0x30]
mov esi, dword [ebx]
push ebx
push 0
push dword [eax + 0x18]
call dword [0x75e221d0]
mov ebx, esi
cmp esi, edi
jne 0x75e10ab9
pop esi
cmp dword [edi + 0xc], 0
pop ebx
je 0x75e10b02
push dword [edi + 0xc]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [0x75e221d0]
mov eax, dword fs:[0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [0x75e221d0]
pop edi
ret
Function at 0x75e10ce8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
xor eax, eax
mov edi, ebx
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
jmp 0x75e10d0a
add eax, 2
mov dword [ebx + 8], eax
cmp word [eax], cx
jne 0x75e10d07
add eax, 2
mov dword [ebx + 8], eax
cmp word [eax], cx
jne 0x75e10d35
mov esi, dword [ebp + 0xc]
neg esi
sbb esi, esi
and esi, 0xfffffe47
add esi, 0xc0000273
jmp 0x75e10e95
cmp dword [ebp + 0xc], ecx
jne 0x75e10d44
mov esi, 0xc0000103
jmp 0x75e10e95
mov cx, word [edx]
lea eax, [ebp - 4]
mov edi, dword [ebp + 0x14]
mov edx, edi
push eax
mov word [ebp - 4], cx
call fcn.75e11322
mov esi, eax
test esi, esi
jns 0x75e10d6f
push esi
push str.RtlUShortAdd_failed___x_
push 0xb4a
jmp 0x75e10e86
mov cx, word [ebp - 4]
lea eax, [ebp - 4]
push eax
push 4
pop edx
call fcn.75e11322
mov esi, eax
test esi, esi
jns 0x75e10d95
push esi
push str.RtlUShortAdd_failed___x_
push 0xb50
jmp 0x75e10e86
mov ax, word [ebp - 4]
mov word [ebx + 2], ax
xor eax, eax
mov word [ebx], ax
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0x18]
movzx eax, word [ebp - 4]
push eax
push 8
push ecx
call dword [0x75e221e0]
mov dword [ebx + 4], eax
test eax, eax
jne 0x75e10dca
mov esi, 0xc0000017
jmp 0x75e10e95
mov edx, dword [ebp - 8]
mov ecx, ebx
call fcn.75e1142c
mov esi, eax
test esi, esi
jns 0x75e10dea
push esi
push str.RtlUnicodeStringCopy_failed___x_
push 0xb5f
jmp 0x75e10e86
movzx ecx, word [ebx]
mov eax, dword [ebx + 4]
shr ecx, 1
cmp word [eax + ecx*2 - 2], 0x5c
je 0x75e10e14
mov ecx, ebx
call fcn.75e1135b
mov esi, eax
test esi, esi
jns 0x75e10e14
push esi
push str.RtlUnicodeStringCatString_failed___x_
push 0xb6f
jmp 0x75e10e86
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x75e10e3e
test di, di
je 0x75e10e3e
movzx eax, di
mov ecx, ebx
push eax
call fcn.75e113bc
mov esi, eax
test esi, esi
jns 0x75e10e3e
push esi
push str.RtlUnicodeStringCbCatStringN_failed___x_
push 0xb77
jmp 0x75e10e86
xor eax, eax
mov dword [ebp - 0x28], 0x18
push 0x21
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push 1
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1c], 0x40
push eax
push 0x100001
lea eax, [ebx + 0xc]
mov dword [ebp - 0x20], ebx
push eax
call dword [0x75e22184]
mov esi, eax
test esi, esi
jns 0x75e10e9c
push esi
push str.Failed_to_open_dir___x_
push 0xb85
push str.AslpPathWildcardAllocMatchNode
push 1
call fcn.75e0e6b8
add esp, 0x14
mov ecx, ebx
call fcn.75e10f5f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x75e11705
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x4c
pop eax
mov ebx, ecx
mov esi, edx
push 0x4e
pop ecx
push ecx
mov word [ebx], ax
mov eax, dword fs:[0x30]
push 8
mov word [ebx + 2], cx
push dword [eax + 0x18]
call dword [0x75e221e0]
mov edi, eax
test edi, edi
jne 0x75e11756
push str.Out_of_memory
push 0xf6
push str.AslGuidToString_UStr
push 1
call fcn.75e0e6b8
add esp, 0x10
mov esi, 0xc0000017
jmp 0x75e117d8
movzx eax, byte [esi + 0xf]
push eax
movzx eax, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push eax
movzx eax, byte [esi + 0xb]
push eax
movzx eax, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
movzx eax, word [esi + 6]
push eax
movzx eax, word [esi + 4]
push eax
push dword [esi]
movzx eax, word [ebx + 2]
push str._08lx__04hx__04hx__02hx_02hx__02hx_02hx_02hx_02hx_02hx_02hx
shr eax, 1
push eax
push edi
call fcn.75dcf04d
mov esi, eax
add esp, 0x38
test esi, esi
jns 0x75e117d3
push esi
push str.RtlStringCchPrintfW_failed___x_
push 0x10a
push str.AslGuidToString_UStr
push 1
call fcn.75e0e6b8
add esp, 0x14
mov eax, dword fs:[0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [0x75e221d0]
jmp 0x75e117d8
mov dword [ebx + 4], edi
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x75e12cf1
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x75e337f8
call fcn.75dc7310
mov dword [ebp - 0x24], edx
mov eax, dword [ecx + 8]
or eax, dword [ecx + 0xc]
je 0x75e12e16
xor esi, esi
cmp dword [ecx + 0x14], esi
je 0x75e12e16
cmp dword [ecx + 0xc], esi
ja 0x75e12d31
jb 0x75e12d24
cmp dword [ecx + 8], 0x40
jae 0x75e12d31
mov eax, edx
mov dword [eax], 3
jmp 0x75e12e1e
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x1c], 3
test eax, eax
je 0x75e12deb
cmp eax, reloc.ntdll.dll_NtClose
je 0x75e12deb
mov dword [ebp - 4], esi
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x75e12d9c
mov dword [ebp - 0x1c], 4
mov edx, dword [eax + 0x3c]
mov dword [ebp - 0x30], edx
lea edi, [edx + 4]
cmp dword [ecx + 0xc], esi
ja 0x75e12d75
jb 0x75e12d9c
cmp dword [ecx + 8], edi
jb 0x75e12d9c
add eax, edx
mov dword [ebp - 0x34], eax
cmp dword [eax], reloc.ntdll.dll_NtClose
jne 0x75e12d8b
mov dword [ebp - 0x1c], 6
jmp 0x75e12d9c
mov ecx, 0x454e
cmp word [eax], cx
jne 0x75e12d9c
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], ?
jmp 0x75e12e0a
mov esi, 0xc000000d
push esi
push str.File_mapping_invalid___x_
push 0x4e8
push str.AslpFileMappingGetFileKind
push 1
call fcn.75e0e6b8
add esp, 0x14
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov eax, esi
jmp 0x75e12e20
mov eax, edx
mov dword [eax], 1
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x75e1596b
Capabilities:
Enumerate pe sections

Disassembly:
mov ax, word [ecx + 0x14]
push esi
lea esi, [ecx + 0x18]
movzx eax, ax
movzx ecx, word [ecx + 6]
add esi, eax
push edi
mov edi, edx
xor edx, edx
test ecx, ecx
je 0x75e1599c
cmp edi, dword [esi + 0xc]
jb 0x75e15994
mov eax, dword [esi + 0x10]
add eax, dword [esi + 0xc]
cmp edi, eax
jb 0x75e159a1
add esi, 0x28
inc edx
cmp edx, ecx
jb 0x75e15985
xor eax, eax
pop edi
pop esi
ret
mov eax, esi
jmp 0x75e1599e

Function at 0x75e15a3e
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
test edx, edx
je 0x75e15a90
mov esi, dword [edx]
test esi, esi
je 0x75e15a90
mov eax, dword [esi + 4]
xor ecx, ecx
mov dword [edi + 0xc], eax
mov byte [edi + 0x21], 1
mov eax, dword [esi + 8]
mov dword [esi + 4], ecx
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
mov word [edi + 0x22], 1
mov dword [edi + 0x34], 1
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov ecx, edx
call fcn.75e16094
lea edx, [edi + 0x28]
lea ecx, [edi + 8]
pop edi
pop esi
jmp fcn.75e12cf1
pop edi
mov eax, 0xc00000f0
pop esi
ret

Function at 0x75e17553
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + reloc.ntdll.dll_NtClose]
test eax, eax
je 0x75e175b9
cmp dword [eax + 8], 1
jne 0x75e175b9
cmp dword [eax + 4], edi
je 0x75e17583
push dword [eax + 4]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [0x75e221d0]
mov eax, dword [esi + reloc.ntdll.dll_NtClose]
test eax, eax
je 0x75e1759e
push eax
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [0x75e221d0]
mov ecx, dword [esi + reloc.ntdll.dll_NtClose]
mov dword [esi + reloc.ntdll.dll_NtClose], edi
test ecx, ecx
je 0x75e175b9
call fcn.75e1b8c6
mov dword [esi + reloc.ntdll.dll_NtClose], edi
test byte [esi + 0x10], 8
je 0x75e175e3
test byte [esi + 0x10], 1
je 0x75e175e3
cmp dword [esi + 4], edi
je 0x75e175e3
push dword [esi + 4]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [0x75e221d0]
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
mov ecx, dword [esi]
call fcn.75e1284a
mov eax, dword fs:[0x30]
push esi
push edi
push dword [eax + 0x18]
call dword [0x75e221d0]
pop edi
pop esi
ret
Function at 0x75e19e0a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov ecx, dword [ebp + 8]
mov eax, edx
push 0x6001
mov dword [ebp - 4], eax
mov ebx, esi
mov dword [ecx], esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp + 0x14]
mov dword [ecx], esi
mov ecx, dword [ebp + 0x18]
mov dword [ecx], reloc.ntdll.dll_NtClose
mov ecx, edi
call fcn.75e16b91
test eax, eax
jne 0x75e19e6b
push str.Failed_to_get_MATCHING_TEXT_file_path
push 0x6f7
push str.SdbpGetMatchingTextAttributes
push 1
call fcn.75e0e6b8
add esp, 0x10
jmp 0x75e19fcc
mov edx, eax
mov ecx, edi
call fcn.75e16e93
mov dword [ebp - 0x10], eax
test eax, eax
je 0x75e19f9b
cmp word [eax], si
je 0x75e19f9b
mov edx, dword [ebp - 4]
mov ecx, edi
push 0x9013
call fcn.75e16b91
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x75e19eaa
push str.Failed_to_read_text_to_match
push 0x706
jmp 0x75e19e57
mov edx, eax
mov ecx, edi
call fcn.75e16f1b
mov edx, eax
mov dword [ebp - 8], edx
test edx, edx
jne 0x75e19ec8
push str.Failed_to_get_text_to_match_blob
push 0x70c
jmp 0x75e19e57
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0x18]
lea eax, [edx + 2]
push eax
push 8
push ecx
call dword [0x75e221e0]
mov ebx, eax
test ebx, ebx
jne 0x75e19ef3
push str.Failed_to_allocate_memory_for_text_blob
push 0x712
jmp 0x75e19e57
push dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ecx, edi
push ebx
call fcn.75e16fe8
test eax, eax
jne 0x75e19f14
mov eax, 0x717
mov ecx, str.Failed_to_read_matching_text_blob
jmp 0x75e19fa5
mov edx, dword [ebp - 4]
mov ecx, edi
push 0x4053
call fcn.75e16b91
test eax, eax
jne 0x75e19f33
mov eax, 0x720
mov ecx, str.Failed_to_read_text_encoding
jmp 0x75e19fa5
push esi
mov edx, eax
mov ecx, edi
call fcn.75e1706e
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x75e19f50
mov eax, 0x726
mov ecx, str.Failed_to_read_encoding_type
jmp 0x75e19fa5
mov edx, dword [ebp - 4]
mov ecx, edi
push 0x4001
call fcn.75e16b91
mov ecx, 0x2000
test eax, eax
je 0x75e19f74
push ecx
mov edx, eax
mov ecx, edi
call fcn.75e1706e
mov ecx, eax
mov edx, dword [ebp + 8]
xor esi, esi
mov eax, dword [ebp - 0x10]
inc esi
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
jmp 0x75e19fcc
mov eax, 0x6fd
mov ecx, str.Failed_to_read_MATCHING_TEXT_file_path
push ecx
push eax
push str.SdbpGetMatchingTextAttributes
push 1
call fcn.75e0e6b8
add esp, 0x10
test ebx, ebx
je 0x75e19fcc
mov ecx, dword fs:[0x30]
push ebx
push esi
push dword [ecx + 0x18]
call dword [0x75e221d0]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x75e1a2d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
xor edx, edx
cmp dword [edi + 0x24], edx
je 0x75e1a2ea
xor eax, eax
inc eax
jmp 0x75e1a3d2
mov ebx, dword [edi + 0x20]
push esi
test ebx, ebx
jne 0x75e1a3bd
test byte [edi], 2
jne 0x75e1a323
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x75e1a323
push dword [edi + 0x14]
mov edx, dword [edi + 0x10]
call fcn.75e1a873
mov ebx, eax
test ebx, ebx
jne 0x75e1a3bd
push str.Failed_to_retrieve_process_history
push 0x239
jmp 0x75e1a380
mov esi, dword [edi + 0x10]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x75e1a329
mov edx, dword [edi + 0x14]
sub esi, ecx
sar esi, 1
xor ebx, ebx
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x75e1a340
mov eax, dword fs:[0x30]
sub edx, ecx
sar edx, 1
mov dword [ebp - 4], edx
mov ecx, dword [eax + 0x18]
lea eax, [edx + esi]
add eax, eax
mov dword [ebp - 8], eax
add eax, 2
push eax
push 8
push ecx
call dword [0x75e221e0]
mov ebx, eax
test ebx, ebx
jne 0x75e1a393
push str.Failed_to_allocate_process_history_buffer
push 0x22a
push str.SdbpInitializeSearchDBContext
push 1
call fcn.75e0e6b8
add esp, 0x10
xor eax, eax
jmp 0x75e1a3d1
add esi, esi
push esi
push dword [edi + 0x10]
push ebx
call fcn.75dc742d
mov eax, dword [ebp - 4]
add eax, eax
push eax
push dword [edi + 0x14]
lea eax, [esi + ebx]
push eax
call fcn.75dc742d
mov eax, dword [ebp - 8]
add esp, 0x18
xor ecx, ecx
mov word [eax + ebx], cx
lea edx, [edi + 0x24]
mov dword [edi + 0x20], ebx
mov ecx, ebx
call fcn.75e17b31
test eax, eax
je 0x75e1a3d1
or dword [edi], 1
pop esi
pop edi
pop ebx
leave
ret
Function at 0x75e1b26c
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
xor eax, eax
mov dword [esp + 4], eax
mov ebx, eax
push esi
push edi
mov edi, eax
cmp ecx, 7
ja case.default.0x75e1b294
movzx eax, byte [ecx + 0x75e1b3f4]
jmp dword [eax*4 + 0x75e1b3ec]
call fcn.75e1b402
jmp 0x75e1b2c2
xor ecx, ecx
inc ecx
call fcn.75e1b26c
push 2
mov edi, eax
pop ecx
mov dword [esp + 0x10], edi
call fcn.75e1b26c
mov esi, eax
test edi, edi
jne 0x75e1b2dd
test esi, esi
jne 0x75e1b2c9
mov edi, eax
jmp case.default.0x75e1b294
xor ecx, ecx
inc ecx
call fcn.75e1b1ed
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x75e1b309
jmp 0x75e1b2eb
test esi, esi
jne 0x75e1b2eb
push 2
pop ecx
call fcn.75e1b1ed
mov esi, eax
mov ebx, edi
xor edx, edx
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x75e1b2f2
sub ebx, ecx
sar ebx, 1
test esi, esi
je 0x75e1b3cc
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0xc]
jne 0x75e1b30e
sub ecx, edx
sar ecx, 1
je 0x75e1b3cc
test ebx, ebx
je 0x75e1b3cc
cmp ecx, 1
jne 0x75e1b34f
cmp word [esi], 0x2e
jne 0x75e1b34f
mov eax, dword fs:[0x30]
xor edi, edi
push esi
push edi
push dword [eax + 0x18]
call dword [0x75e221d0]
mov esi, edi
mov ecx, edi
add ecx, 2
add ebx, ecx
mov dword [esp + 0xc], ebx
call dword [0x75e20cf0]
mov ecx, dword [eax]
lea eax, [ebx + ebx]
push eax
mov eax, dword fs:[0x30]
push ecx
push dword [eax + 0x18]
call dword [0x75e221e0]
mov ebx, dword [esp + 0x10]
mov edi, eax
test edi, edi
je 0x75e1b3b3
push ebx
push dword [esp + 0x10]
push edi
call dword [0x75e21e84]
add esp, 0xc
push 0x75e24acc
push dword [esp + 0x10]
push edi
call dword [0x75e22104]
add esp, 0xc
test esi, esi
je 0x75e1b3b3
push esi
push dword [esp + 0x10]
push edi
call dword [0x75e22104]
add esp, 0xc
test ebx, ebx
je 0x75e1b3cc
mov eax, dword fs:[0x30]
push ebx
xor ebx, ebx
push ebx
push dword [eax + 0x18]
call dword [0x75e221d0]
jmp 0x75e1b3ce
xor ebx, ebx
test esi, esi
je case.default.0x75e1b294
mov eax, dword fs:[0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [0x75e221d0]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret