joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409904
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4099d7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099f0
push ebx
push 0x4099fc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040336c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409984
mov al, 0x69
call fcn.004095a8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004098d8
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40998d
call fcn.004098d8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4099de
lea eax, [ebp - 4]
call fcn.00403150
ret

Function at 0x409a70
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b24
jmp 0x409b19
cmp dword [esi + 0x10], 0x1000
jne 0x409b05
test byte [esi + 0x15], 1
jne 0x409b05
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409ac4
cmp eax, 2
je 0x409ac4
cmp eax, 0x10
je 0x409ac4
cmp eax, 0x20
jne 0x409ad9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ad9
mov bl, 1
xor ebp, ebp
jmp 0x409aea
mov eax, dword [esi]
add eax, ebp
call fcn.00409a68
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409add
test bl, bl
je 0x409b05
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b24
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a9c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x93d4ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [esp]
jmp 0x93d4de
sub esp, 0x1d
xchg byte [esp + 0x1d], dh
jmp 0x93d50e
shl dx, cl
jnp 0x93d4c8
sub esp, 0x1d
xchg byte [esp + 0x1d], dh
cmc
bswap edx
mov word [esp + 3], sp
jmp 0x93d51c
cmc
bswap edx
mov word [esp + 3], sp
jmp 0x93d51c
lea esp, [esp + 1]
lea esp, [esp + 0x20]
inc edi
xchg edx, eax
mov edx, 0xad64342e
jmp 0x93d565
lea ecx, [ebx*4]
lea eax, [ecx + esi]
mov ah, 0x1f
mov edx, ecx
lea edx, [eax*4]
pushal
jmp 0x93d54f

Function at 0x94471a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x94475e
push ax
mov eax, 0xc265057e
push bx
rdtsc
rol edx, cl
jge 0x944748
mov edx, dword [esp + 1]
cmc
jmp 0x944bbe
mov ch, dh
mov ebx, ebp
rdtsc
not cx
mov ecx, 0x77b7ce3a
rdtsc
jmp 0x94471c
neg al
jmp 0x944777
Function at 0x963751
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + 0x93ad08]
push si
lea esp, [esp + 2]
jmp 0x963864
add esp, 3
lea esp, [esp + 1]
jmp 0x96373b
shr edi, 0x18
call fcn.009637fd
Function at 0x9637fd
Capabilities:
Encrypt data using aes

Disassembly:
pushfd
lea edi, [eax + edx]
call fcn.0096376f
sub esp, 8
lea esp, [esp + 2]
xor ecx, edi
and edx, ebp
jmp 0x963785
movzx edi, byte [edi*4 + 0x93ad08]
cmc
sub esp, 0x1a
jmp 0x9637bc

Function at 0x9638d0
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp], ah
stc
jmp 0x9638da
lea esp, [esp + 8]
cmp ebx, 0x93c530
jmp 0x9638fd

Function at 0x963c09
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 0
jmp 0x963c35
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + 0x93b908]
mov ebx, dword [esp]
jmp 0x963ca6
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + 0x93ad08]
push sp
call fcn.00963c70
and edx, ecx
sub esp, 4
jmp 0x963cef
popal
jmp 0x963cfa
dec byte [edi + 0x68]
jmp 0x963d60
push esi
pushal
lea ebx, [edx + edx]
mov dword [esp + 4], edx
jmp 0x963cd9
lea esi, [esi*4]
lea esi, [esi + 0x93ad08]
mov edx, dword [esi]
pop esi
jmp 0x963d44
mov dx, word [esp]
push ebx
pushal
btc ax, bp
jmp 0x963d9f
and edx, ecx
push esp
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + 0x93bd08]
jmp 0x963d24
pop ebx
call fcn.00963d7a
push ss
xchg dword [edi], edx
jb 0x963ce0
dec esp
lodsb al, byte [esi]
cmp byte [esi - 0x6a77c737], ch
add al, 0xb7
sahf
lea esp, [esp + 2]
lea esp, [esp + 0x14]
popal
add ebx, 4
mov edx, dword [ebx]
jmp 0x963d54
push bp
lea esp, [esp + 2]
mov dword [esp + 0x10], esi
clc
stc
sub esp, 0x16
jmp 0x963d6a

Function at 0x963c70
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
push bx
stc
lea esp, [esp + 2]
jmp 0x963c8d
push word [esp + 5]
jmp 0x963c5a
push eax
jmp 0x963cce
lea esp, [esp + 8]
xor edi, dword [ebx*4 + 0x93b508]
pushal
jmp 0x963c77
mov eax, esi
add eax, 5
movzx ebx, byte [eax]
pop eax
jmp 0x963cb8

Function at 0x963d7a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 1
pushfd
lea esp, [esp + 3]
mov dword [esi], edi
jmp 0x963dc6
shr edi, 0x18
stc
clc
jmp 0x963db0
mov edi, dword [edi*4 + 0x93ad08]
pushfd
mov word [esp], si
clc
jmp 0x963dd7
mov ebx, dword [ebx*4 + 0x93ad08]
mov edi, ecx
mov di, 0x6370
mov edi, edx
jmp 0x963d86
and edi, ecx
sub esp, 0x1b
add esp, 6
pop dword [esp + 4]
push dword [esp + 2]
jmp 0x964105
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x93b908]
inc bx
mov bh, cl
movzx ebx, byte [esi + 6]
call fcn.00963e27
lea esp, [esp + 1]
jmp 0x963e8f
mov dword [esi + 4], edi
dec di
mov di, word [esp]
mov ebx, dword [ebx*4 + 0x93ad08]
jmp 0x963f05
shr edi, 0x18
jmp 0x963ee2
and ebx, ecx
sub esp, 0x1c
mov byte [esp + 0xf], ah
sub esp, 8
jmp 0x963f3b
mov edi, dword [edi*4 + 0x93ad08]
and edi, ecx
mov edi, dword [edi*4 + 0x93b108]
jmp 0x963ecc
lea edi, [eax*4]
pushal
bsf edi, eax
mov edi, edx
jmp 0x963ea1
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + 0x93b508]
movzx ebx, byte [esi + 0xd]
call fcn.00963f5f
popfd
pop ds
invalid
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + 0x93b908]
bsr bx, ax
movzx ebx, byte [esi + 0xa]
call fcn.00963f14
mov ebx, dword [ebx*4 + 0x93ad08]
pushal
and ebx, ecx
jmp 0x963f16
lea esp, [esp + 1]
mov edi, dword [edi*4 + 0x93b108]
and ebx, ecx
jmp 0x963e4e
Function at 0x963fe5
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [edx*4 + 0x93bd08]
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
sub esp, 0x12
jmp 0x963fc4
mov ebx, dword [ebx*4 + 0x93ad08]
mov edi, dword [esp]
mov di, 0xe915
jmp 0x964080
and edx, ecx
sub esp, 0x1e
pop word [esp + 0x12]
mov byte [esp + 0x17], bl
lea esp, [esp + 0x44]
jmp 0x963f88
lea edi, [ebp*4]
mov di, word [esp + 0x10]
lea esp, [esp + 2]
jmp 0x963f9a
mov edx, dword [edx*4 + 0x93ad08]
pushal
jmp 0x963fb0
clc
call fcn.00964019
sub esp, 0xe
lea esp, [esp + 2]
pushal
xchg di, ax
mov dword [esp], edx
jmp 0x964049

Function at 0x964019
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + 0x93ad08]
and edi, ecx
sub esp, 0xf
push word [esp + 0xb]
lea esp, [esp + 1]
jmp 0x964023
lea esp, [esp + 4]
popal
shr edi, 0x18
jmp 0x963fef
mov edi, dword [edi*4 + 0x93b108]
and ebx, ecx
clc
sub esp, 0x13
jmp 0x964065
push ebp
mov ebp, esi
jmp 0x96404f
add ebp, 0xe
movzx ebx, byte [ebp]
pop ebp
pushal
jmp 0x9640a5
lea esp, [esp + 3]
lea esp, [esp + 0x3c]
xor edi, dword [ebx*4 + 0x93b908]
bswap ebx
xor ebx, esi
jmp 0x964032
lea ebp, [ebp + 0x93ad08]
mov ebx, dword [ebp]
pop ebp
jmp 0x9640b1
push ebp
mov ebp, ebx
lea ebp, [ebp*4]
jmp 0x96408f
and edx, ecx
mov edx, dword [edx*4 + 0x93ad08]
push eax
jmp 0x9640e6
and ebx, ecx
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + 0x93b508]
jmp 0x9640d0

Function at 0x96416f
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
jne 0x9301a3
je 0x930161
jmp 0x96412d

Function at 0x9dc33f
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
rdtsc
not ah
pop ecx
jmp 0x9dc368
pop bx
mov ch, 0xc9
not ax
lea esi, [eax*4]
jmp 0x9dc39d
adc ecx, 0xd2e8b9e9
mov ebp, 0x8ccbb6b3
lea ecx, [ebx + ebp]
lea esp, [esp]
sbb al, bl
bt ebx, eax
jmp 0x9dc387

Function at 0x9dc4d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
not cx
pop cx
add esp, 4
xchg word [esp], bx
jmp 0x9dc4d2
jmp 0x9dc4ba
push bp
rdtsc
push dword [esp]
xchg dx, ax
not al
lea ecx, [ebx + ebp]
jmp 0x9dc4e6
mov bh, 0xe1
bt eax, eax
pushfd
mov bl, bh
cpuid
mov byte [esp + 8], cl
jmp 0x9dc52a
Function at 0x9de559
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.009dd023
mov eax, dword [eax + 0x1c]
jmp 0x9de53e
lea esp, [esp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x9de503
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x9dd01e
mov dword [esp + 8], edi
jmp 0x9de519

Function at 0x9de586
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov byte [esp], ah
push dword [esp]
push edx
mov dword [esp + 8], esi
call fcn.009de559
sbb eax, 0x9b680999
jo 0x9de61a
cli
push 0x5d1afa0f
fisttp word [edi + 0x2a]
invalid
dec ecx
rol dword [ecx + 0x20], 1
shl dword [ecx + ecx*8 + 0x52], cl
shl byte [edi - 0x35ac04ae], 0x65
xchg esp, eax
pop es
scasb al, byte es:[edi]
Function at 0x71546b
Capabilities:
Hash data using rshash

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
mov ecx, 0xf8c9
test edi, edi
jne 0x715487
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x18]
cdq
idiv edi
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x7154e7
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov dword [esp + 0x14], edx
mov edx, ebx
test edi, edi
jle 0x7154da
mov dword [esp + 0x10], edi
nop
test eax, eax
jle 0x7154d3
mov edi, eax
jmp 0x7154bb
movzx ebp, byte [edx]
imul esi, ecx
imul ecx, ecx, 0x5c6b7
add esi, ebp
inc edx
sub edi, 1
jne 0x7154bb
mov edi, dword [esp + 0x24]
sub dword [esp + 0x10], 1
jne 0x7154ab
add ebx, dword [esp + 0x20]
sub dword [esp + 0x14], 1
jne 0x7154a0
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x75ae1b
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
test ecx, ecx
je 0x75ae4f
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
cmp eax, 0x90
je 0x75ae4f
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
cmp edx, 0xcc
je 0x75ae4f
xor eax, eax
jmp 0x75ae87
mov dword [ebp - 4], 1
jmp 0x75ae61
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x75ae82
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
cmp eax, edx
je 0x75ae80
xor eax, eax
jmp 0x75ae87
jmp 0x75ae58
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x7d23b3
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10090148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x48]
push ebp
push eax
push ecx
lea ecx, [edi + 0x104]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.007cd313
test eax, eax
jne 0x7d241f
push ebp
push 0x100aae44
mov ecx, edi
call fcn.007d1633
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
mov edx, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x50]
push esi
push ebp
push ebp
push ebx
lea ecx, [edx + 0x14]
call fcn.007cce93
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.007c4d83
push ebx
mov dword [esp + 0x4c], ebp
call fcn.007cd4c3
add esp, 4
test eax, eax
je 0x7d24c2
add esi, 0x18
push esi
call fcn.007c5813
add esi, eax
push esi
call fcn.007c5813
mov ecx, dword [esp + 0x60]
add esp, 8
cmp ecx, 3
lea eax, [esi + eax + 8]
ja 0x7d27c5
jmp dword [ecx*4 + 0x10010e20]
mov eax, dword [esi]
push ebp
push eax
mov ecx, edi
call fcn.007d1773
mov ebx, dword [esp + 0x58]
mov ebp, eax
lea edi, [esi + 0x18]
mov edx, dword [ebp + 0x28]
lea ecx, [ebx + ebx*4]
mov esi, edi
lea eax, [edx + ecx*4]
push esi
mov dword [esp + 0x5c], eax
call fcn.007c5813
add esi, eax
push esi
call fcn.007c5813
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x7d2513
mov ecx, dword [esi + 0x1c]
push ecx
call dword [0x100933d4]
test eax, eax
je 0x7d2513
mov eax, 1
jmp 0x7d2515
xor eax, eax
cmp ebx, 8
jge 0x7d277a
cmp ebx, 7
ja 0x7d27c5
jmp dword [ebx*4 + 0x10010e30]
test eax, eax
jne 0x7d278d
mov ecx, dword [esp + 0x10]
push eax
push 0x100aae30
call fcn.007d1633
push 6
call dword [ebp + 0x2c]
lea edx, [esp + 0x1c]
xor ecx, ecx
add ebx, 0xfffffff8
push edx
mov dword [esp + 0x20], ecx
push ebx
push esi
mov dword [esp + 0x2c], ecx
call eax
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
call fcn.007d2cd3
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x2c], 0x10096138
call fcn.007c4f83
mov ecx, dword [esp + 0x40]
mov eax, esi
pop esi
mov edx, edi
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
Function at 0x7d9e33
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x100ca7a0]
xor edx, edx
cmp eax, edx
jne 0x7d9e59
xor eax, eax
mov byte [eax + 0x100ca6a0], al
inc eax
cmp eax, 0x100
jl 0x7d9e41
mov dword [0x100ca7a0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x100ca6a0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x7d9eea
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x7d9ebd
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x7d9e8b
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x7d9f63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x7d9fb6
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x7d9f9d
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7de3a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x7de5c4
cmp eax, 8
jg 0x7de5c4
cmp dword [esp + 0x8c], 2
jl 0x7de5c4
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x7de5c4
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x7de5c4
mov eax, dword [esp + 0x80]
test eax, eax
je 0x7de42a
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x7de5ad
mov ebp, dword [0x100935f0]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x7de45c
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x7de594
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x7de47c
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x100935dc]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x7de4bb
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x100935e4]
lea ecx, [esp + 0x28]
push ecx
call dword [0x10093410]
test eax, eax
jne 0x7de57b
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.007dd9b3
cmp eax, 1
jne 0x7de5a5
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.007de263
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x7de470
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x7de5ad
jmp 0x7de447
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.007dd543
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c
Function at 0x7e1003
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x7e119b
cmp ebp, ebx
jle 0x7e119b
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x7e1061
dec eax
or eax, 0xfffffff8
inc eax
je 0x7e1068
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, 0x80000001
jns 0x7e1077
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x7e107e
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.008464c3
add esp, 4
cmp eax, ebx
je 0x7e109f
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.008464c3
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x7e1191
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x7e1178
mov al, byte [edx]
cmp al, 0xc0
jbe 0x7e1164
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x7e1159
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x7e1167
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x7e1167
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x7e1103
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x7e10f4
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x7e8d23
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100913b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x74]
push edi
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.007e98a3
lea edx, [esp + 0x18]
push eax
push edx
call dword [0x100934ec]
mov eax, dword [esp + 0x18]
xor edi, edi
xor ecx, ecx
cmp eax, edi
setl cl
dec ecx
xor edx, edx
and ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, edi
mov dword [esp + 0x18], ecx
setl dl
dec edx
and edx, eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x20], edx
call dword [0x10093410]
test eax, eax
je 0x7e8dcc
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, eax
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.007e89b3
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call dword [0x100935f0]
push edi
lea ecx, [esp + 0x4c]
call fcn.0084d0f0
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], edi
call fcn.007ff4c3
mov edx, dword [esp + 0x5c]
add esp, 0xc
lea ecx, [esp + 0x18]
push 2
push ecx
push edx
call dword [0x100930f0]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [0x100933e8]
lea edx, [esp + 0x38]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [0x100935e4]
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, esi
mov dword [esp + 0x64], 0xffffffff
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x48]
call fcn.0084d162
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14