joyce8/EMBER2024-capa huggingface dataset:
Function at 0x774503e0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x7753d344]
xor eax, esp
mov dword [esp + 0x30], eax
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test ecx, 0xe0000000
jne 0x77450414
mov edx, 0x11000000
mov eax, ecx
and eax, edx
cmp eax, edx
jne 0x7745042d
mov eax, 0xc00000f1
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.77494a40
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0xc]
test edi, 0xff000000
jne 0x774a783f
test ecx, 0x4000000
jne 0x774504bf
mov eax, dword fs:[0x30]
xor edx, edx
or dword [esi + 4], 0xffffffff
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
cmp dword [eax + 0x64], 1
jbe 0x774a7849
test ecx, 0x2000000
jne 0x774504c6
test edi, edi
je 0x774504c6
and edi, 0xffffff
mov dword [esi + 0x14], edi
mov eax, ecx
and eax, 0x9000000
or dword [esi + 0x14], eax
test ecx, 0x10000000
jne 0x774504cf
cmp byte [0x775367c0], dl
jne 0x774504cf
or dword [esi], 0xffffffff
test dl, dl
jne 0x774504d3
mov eax, dword fs:[0x30]
mov edi, 0x7ffe0382
mov ebx, 0x228
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x774a785d
mov eax, edi
cmp byte [eax], 0
jne 0x774a7876
xor eax, eax
jmp 0x77450419
mov dword [esi + 0x14], 0x20007d0
jmp 0x77450478
mov dl, 1
jmp 0x77450492
mov ecx, esi
call fcn.774504e4
cmp dword [esi], 0xffffffff
jne 0x77450499
jmp 0x774a7851
mov eax, 0xc00000f0
jmp 0x77450419
mov dword [esi + 0x14], edx
jmp 0x77450478
or dword [esi + 0x14], 0x1000000
jmp 0x77450499
cmp dword [eax], 0
je 0x774504b4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, ebx
jmp 0x774504b6
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 2
je 0x774504bf
mov eax, 0x1723
mov dword [esp + 0x34], esi
mov word [esp + 0x16], ax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x30], eax
call fcn.77461a00
test eax, eax
je 0x774a78b2
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x50]
add edi, ebx
lea eax, [esp + 0x10]
push eax
movzx eax, byte [edi]
push 8
push 0x10402
push eax
call fcn.77492f40
jmp 0x774504bf

Function at 0x774509f7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, edx
xor edx, edx
push 0xc
lea eax, [esi + 4]
mov dword [esi], edx
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [esi + 0x48]
mov dword [esi + 0xc], ecx
pop ecx
mov dword [eax - 4], edx
mov dword [eax], 6
lea eax, [eax + 0x20]
sub ecx, 1
jne 0x77450a14
lea ecx, [esi + 0x1bf]
mov ax, word [edx*2 + 0x7742b330]
shr ax, 3
inc ax
mov byte [ecx - 1], dl
mov word [ecx - 3], ax
mov al, byte [0x77536688]
add al, al
xor al, byte [ecx]
and al, 6
xor byte [ecx], al
inc edx
lea ecx, [ecx + 4]
cmp edx, 0x81
jb 0x77450a2b
test byte [ebp + 8], 1
jne 0x77450a7d
mov eax, dword [0x77536100]
test eax, eax
je 0x77450a78
lea ecx, [esi + 0x7dc]
mov dword [ecx], esi
lea ecx, [ecx + 0x18]
sub eax, 1
jne 0x77450a6e
pop esi
pop ebp
ret 4
xor eax, eax
inc eax
jmp 0x77450a68
Function at 0x77450b70
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
push edi
mov edi, dword fs:[0x30]
mov eax, dword [edi + 0xa4]
mov dword [esi + 4], eax
mov eax, dword [edi + 0xa8]
mov dword [esi + 8], eax
movzx eax, word [edi + 0xac]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0xb0]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x1f4]
test eax, eax
je 0x77450bbe
cmp word [eax], cx
jne 0x774af0da
xor eax, eax
mov word [esi + 0x14], ax
cmp dword [esi], 0x11c
mov ebx, 0x124
jne 0x77450c42
movzx eax, byte [edi + 0xaf]
mov ecx, 0xff
mov word [esi + 0x114], ax
mov ax, word [edi + 0xae]
and ax, cx
mov word [esi + 0x116], ax
call fcn.77451270
mov word [esi + 0x118], ax
cmp dword [esi], ebx
je 0x77450c48
lea eax, [ebp - 4]
mov byte [esi + 0x11a], 0
push eax
call fcn.77451230
test al, al
je 0x77450c37
mov eax, dword [ebp - 4]
mov byte [esi + 0x11a], al
cmp eax, 1
jne 0x77450c37
mov eax, 0xffef
and word [esi + 0x118], ax
cmp dword [esi], ebx
je 0x77450c5a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi], ebx
jne 0x77450c37
jmp 0x77450bd1
call fcn.77451270
and eax, 0x1ffff
mov dword [esi + 0x11c], eax
jmp 0x77450c05
and dword [esi + 0x11c], 0x1ffef
jmp 0x77450c37
push eax
mov edx, 0x100
lea ecx, [esi + 0x14]
call fcn.77455c4e
test eax, eax
jns 0x77450bc4
jmp 0x77450bbe
Function at 0x774510a4
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x7753d344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
mov ecx, dword fs:[0x30]
mov ebx, dword [0x775384a8]
mov dword [ebp - 8], ecx
push edi
mov eax, dword [ecx + 0xa4]
mov edi, edx
mov dword [esi + 4], eax
mov eax, dword [ecx + 0xa8]
mov dword [esi + 8], eax
movzx eax, word [ecx + 0xac]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0xb0]
mov dword [esi + 0x10], eax
test ebx, ebx
je 0x774511fb
cmp ebx, 0x77450690
jne 0x774511d2
call fcn.77451290
mov edi, eax
sub edi, 1
je 0x774511e1
sub edi, 1
je 0x774af211
mov edi, dword [ebp - 8]
mov eax, dword [edi + 0x1f4]
test eax, eax
je 0x77451139
xor ecx, ecx
cmp word [eax], cx
jne 0x774af224
xor eax, eax
mov word [esi + 0x14], ax
cmp dword [esi], 0x11c
mov ebx, 0x124
jne 0x774af23f
movzx eax, byte [edi + 0xaf]
mov ecx, 0xff
mov word [esi + 0x114], ax
mov ax, word [edi + 0xae]
and ax, cx
mov word [esi + 0x116], ax
call fcn.77451270
mov word [esi + 0x118], ax
cmp dword [esi], ebx
je 0x774af24c
xor eax, eax
mov byte [esi + 0x11a], al
lea eax, [ebp - 0xc]
push eax
call fcn.77451230
test al, al
je 0x774511bf
mov eax, dword [ebp - 0xc]
mov byte [esi + 0x11a], al
cmp eax, 1
jne 0x774511bf
mov eax, 0xffef
and word [esi + 0x118], ax
cmp dword [esi], ebx
je 0x774af261
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77494a40
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call dword [0x775391d0]
call ebx
jmp 0x7745110d
mov dword [esi + 8], 2
mov dword [esi + 0xc], 0x23f0
mov dword [esi + 4], 6
jmp 0x77451121
push edx
push 0x77421204
push edx
push 0xabababab
call fcn.774799e0
mov ebx, eax
mov dword [0x775384a8], ebx
test ebx, ebx
jne 0x774510fc
jmp 0x7745110f
mov dword [esi + 8], 3
mov dword [esi + 0xc], 0x2580
jmp 0x774511ef
push eax
mov edx, 0x100
lea ecx, [esi + 0x14]
call fcn.77455c4e
test eax, eax
jns 0x7745113f
jmp 0x77451139
cmp dword [esi], ebx
jne 0x774511bf
jmp 0x77451150
call fcn.77451270
and eax, 0x1ffff
mov dword [esi + 0x11c], eax
jmp 0x77451188
and dword [esi + 0x11c], 0x1ffef
jmp 0x774511bf

Function at 0x77451620
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x77451678
cmp dword [ebp + 0xc], 0
jl 0x77451678
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x77451678
push 4
lea eax, [ebp + 0xc]
push eax
push 5
push dword [esi + 0x24]
call fcn.77494280
call fcn.77461a00
test eax, eax
jne 0x774af335
mov eax, 0x7ffe0386
cmp byte [eax], 0
jne 0x774af348
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.77515c15
jmp 0x77451671
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22c
jmp 0x77451668
mov edx, dword [ebp + 0xc]
mov ecx, esi
call fcn.77515f30
jmp 0x77451671
Function at 0x77451690
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x774516cf
cmp dword [ebp + 0x10], 0
jl 0x774516ab
jg 0x774516cf
cmp dword [ebp + 0xc], 0
jae 0x774516cf
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x774516cf
push 8
lea eax, [ebp + 0xc]
push eax
push 2
push dword [ecx + 0x24]
call fcn.77494280
pop ecx
pop ebp
ret 0xc
call fcn.77515c15
mov eax, 0xc000000d
jmp 0x774516ca

Function at 0x774516e0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x7745170c
cmp dword [ebp + 0xc], 0
jne 0x7745170c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7745170c
xor edx, edx
call fcn.77451718
pop ebp
ret 8
call fcn.77515c15
mov eax, 0xc000000d
jmp 0x77451708
Function at 0x77452090
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x7753d344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x2c], esi
cmp dword [esi + 8], 0xddeeddee
je 0x774afa3f
test dword [esi + 0x44], 0x1000000
jne 0x774afa4d
cmp dword [esi + 0x60], 0xeeffeeff
jne 0x774afa63
test byte [esi + 0x40], 1
jne 0x7745210c
mov edi, dword [esi + 0xc8]
mov eax, 0xffff
add word [esi + 0xd8], ax
sub dword [edi + 8], 1
jne 0x7745210c
and dword [edi + 0xc], 0
lea edx, [edi + 4]
push 0xfffffffffffffffe
or ecx, 0xffffffff
pop eax
lock cmpxchg dword [edx], ecx
mov ebx, eax
cmp ebx, 0xfffffffe
jne 0x774afae0
mov eax, dword fs:[0x30]
mov edi, 0x7ffe0380
mov ebx, 0x226
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x774afb1e
mov eax, edi
cmp byte [eax], 0
jne 0x774afb37
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77494a40
mov esp, ebp
pop ebp
ret 4
xor edx, edx
mov ecx, esi
call fcn.775044e6
jmp 0x7745210c
push esi
mov esi, dword [0x7753530c]
mov ecx, esi
call dword [0x775391d0]
call esi
jmp 0x77452134
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x774afa8c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x77424db0
call fcn.7744afb0
pop ecx
jmp 0x774afa96
push 0x77424dbc
call fcn.7744afb0
pop ecx
push esi
push 0x774275e0
call fcn.7744afb0
push 0x774275d0
push 0x77427608
call fcn.7744afb0
push 0x77427618
call fcn.7744afb0
mov eax, dword fs:[0x30]
add esp, 0x14
cmp byte [eax + 2], 0
je 0x774afad9
mov byte [0x77536255], 1
int3
xor al, al
jmp 0x77452134
test byte [edx], 1
je 0x774afaeb
push edi
call fcn.774e3e80
lea esi, [edi + 4]
mov edx, ebx
mov eax, ebx
and edx, 2
or edx, 1
lea ecx, [edx + ebx]
lock cmpxchg dword [esi], ecx
cmp eax, ebx
je 0x774afb07
mov ebx, eax
jmp 0x774afaee
mov esi, dword [ebp - 0x2c]
test dl, 2
je 0x7745210c
push edi
call fcn.7744c520
jmp 0x7745210c
cmp dword [eax], 0
je 0x77452127
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, ebx
jmp 0x77452129
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 1
je 0x77452132
mov eax, 0x102c
mov dword [ebp - 8], esi
mov word [ebp - 0x22], ax
call fcn.77461a00
test eax, eax
je 0x774afb6a
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x50]
add edi, ebx
lea ecx, [ebp - 0x28]
push ecx
movzx ecx, byte [edi]
push 4
push 0x402
push ecx
call fcn.77492f40
jmp 0x77452132
Function at 0x77452150
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7753d344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 8], 0xddeeddee
je 0x774afb83
test dword [esi + 0x44], 0x1000000
jne 0x774afb8f
cmp dword [esi + 0x60], 0xeeffeeff
jne 0x774afba5
test byte [esi + 0x40], 1
jne 0x774521c0
mov ecx, dword [esi + 0xc8]
mov edx, dword fs:[0x18]
lea eax, [ecx + 4]
lock btr dword [eax], 0
jae 0x774521fb
mov eax, dword [edx + 0x24]
mov dword [ecx + 0xc], eax
mov dword [ecx + 8], 1
inc word [esi + 0xd8]
mov eax, dword fs:[0x30]
mov edi, 0x7ffe0380
mov ebx, 0x226
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x774afc22
mov eax, edi
cmp byte [eax], 0
jne 0x774afc3b
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77494a40
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ecx + 0xc]
cmp eax, dword [edx + 0x24]
je 0x7745220a
call fcn.7746bea0
jmp 0x774521b9
inc dword [ecx + 8]
jmp 0x774521b9
mov ecx, esi
call fcn.7750446e
jmp 0x774521c0
push esi
mov esi, dword [0x77535308]
mov ecx, esi
call dword [0x775391d0]
call esi
jmp 0x774521e8
mov eax, dword fs:[0x30]
cmp dword [eax + 0xc], 0
je 0x774afbce
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x77424db0
call fcn.7744afb0
pop ecx
jmp 0x774afbd8
push 0x77424dbc
call fcn.7744afb0
pop ecx
push esi
push 0x774275e0
call fcn.7744afb0
push 0x774275c4
push 0x77427608
call fcn.7744afb0
push 0x77427618
call fcn.7744afb0
mov eax, dword fs:[0x30]
add esp, 0x14
cmp byte [eax + 2], 0
je 0x774afc1b
mov byte [0x77536255], 1
int3
xor al, al
jmp 0x774521e8
cmp dword [eax], 0
je 0x774521db
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, ebx
jmp 0x774521dd
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 1
je 0x774521e6
mov eax, 0x102b
mov dword [ebp - 8], esi
mov word [ebp - 0x22], ax
call fcn.77461a00
test eax, eax
je 0x774afc6e
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x50]
add edi, ebx
lea ecx, [ebp - 0x28]
push ecx
movzx ecx, byte [edi]
push 4
push 0x402
push ecx
call fcn.77492f40
jmp 0x774521e6
Function at 0x7745642d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edi
test edi, edi
je 0x774b1c3d
cmp dword [edi + 0x24], 0
jne 0x774b1c3d
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x774b1c2b
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
test eax, eax
je 0x774b1c42
cmp dword [0x775386dc], eax
je 0x774b1c33
or ecx, 0xffffffff
lock xadd dword [eax + 0xf8], ecx
dec ecx
mov dword [ebp - 0x18], ecx
xor ecx, ecx
inc ecx
lock xadd dword [eax + 0xfc], ecx
inc ecx
add eax, 8
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov edx, eax
mov esi, ecx
lea eax, [ecx + 1]
mov dword [ebp - 0xc], edx
xor eax, ecx
movzx ebx, ax
mov eax, esi
xor ebx, ecx
mov ecx, dword [ebp - 4]
lock cmpxchg8b qword [edi]
mov ecx, eax
mov eax, edx
mov dword [ebp - 4], eax
cmp ecx, esi
jne 0x774564a6
cmp eax, dword [ebp - 0xc]
jne 0x774564a6
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
or dword [edi + 0x50], 0x10
mov ecx, dword [edi + 0x4c]
mov dword [edi + 0x24], eax
test ecx, ecx
je 0x774564e9
call fcn.774565d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x48]
jmp 0x77456460
mov eax, 0xc00000bb
jmp 0x77456503
call fcn.77515c15
mov eax, 0xc000000d
jmp 0x77456503
Function at 0x77458b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0x14
push 0x7751f4e0
call fcn.774a611c
mov dword [ebp - 0x1c], 0xc0000001
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], bl
jne 0x77458c9a
cmp dword [ebp + 8], ebx
je 0x774b2941
test esi, esi
je 0x774b294b
mov dword [ebp - 4], ebx
xor edx, edx
lea ecx, [ebp - 0x20]
call fcn.77458f34
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
js 0x77458ca3
mov eax, dword [esi + 0x1c]
add eax, 4
push eax
call fcn.77466460
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp dword [ecx + 4], esi
jne 0x77458c9e
cmp dword [eax], esi
jne 0x77458c9e
mov dword [eax], ecx
mov dword [ecx + 4], eax
mov dword [ebp - 4], ebx
call fcn.77458c84
lea eax, [esi + 0x18]
mov dword [ebp - 0x24], eax
lock or dword [eax], edi
push ebx
push ebx
push ebx
push dword [esi + 0x20]
call fcn.7746c5e0
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
jne 0x77458c7b
push edi
push dword [esi + 0x20]
call fcn.7746c3c0
push dword [esi + 0x20]
call fcn.774725d0
mov edi, eax
push dword [esi + 0x20]
call fcn.7746c2c0
push 0xfffffffffffffffe
pop ecx
mov esi, dword [ebp - 0x24]
mov eax, dword [esi]
mov edx, eax
and edx, ecx
lock cmpxchg dword [esi], edx
jne 0x77458c3f
test al, 2
mov esi, dword [ebp + 0xc]
je 0x77458c5c
mov ecx, esi
call fcn.77458b24
mov edi, ebx
push 0xfffffffffffffffe
pop ecx
neg edi
sbb edi, edi
and edi, 0x103
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ecx
call fcn.77458c91
mov eax, edi
call fcn.774a6161
ret 0xc
test eax, eax
je 0x77458c25
mov dword [esi + 0x24], eax
jmp 0x77458c25
xor eax, eax
jmp 0x77458c73
push 3
pop ecx
int 0x29
push 0xfffffffffffffffe
pop ecx
jmp 0x77458c69
mov eax, 0xc00000ef
jmp 0x77458c73
mov eax, 0xc00000f0
jmp 0x77458c73
Function at 0x7745ce10
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x774a7aa6
mov eax, 0x7ffe0030
ret
cmp dword [eax], 0
je 0x7745ce21
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x1e
ret

Function at 0x7745dfaf
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
lea eax, [esp + 4]
push ebx
push esi
push edi
push eax
lea eax, [esp + 0x18]
mov ebx, edx
push eax
mov esi, ecx
call fcn.77485877
xor edx, edx
mov ecx, esi
inc edx
call fcn.7744f147
push eax
push 0x1000
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
call fcn.77492ac0
mov edi, eax
test edi, edi
js 0x7745e0dc
call fcn.77461a00
mov edi, 0x7ffe0380
test eax, eax
jne 0x774a7db5
mov eax, edi
cmp byte [eax], 0
jne 0x7745e074
mov eax, dword [esp + 0x10]
dec dword [esi + 0x230]
sub dword [esi + 0x234], eax
call fcn.77461a00
test eax, eax
jne 0x774a7dc8
mov eax, edi
cmp byte [eax], 0
jne 0x7745e096
call fcn.77461a00
mov edi, 0x7ffe038a
test eax, eax
jne 0x7745e12c
mov eax, edi
cmp byte [eax], 0
jne 0x7745e13f
inc dword [esi + 0x20c]
test byte [ebx + 2], 4
jne 0x7745e176
and byte [ebx + 2], 0x17
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 1
je 0x7745e016
mov edx, dword [esp + 0x14]
mov ecx, esi
push 8
push dword [esp + 0x14]
call fcn.77502d69
jmp 0x7745e016
mov eax, dword fs:[0x30]
test byte [eax + 0x240], 1
je 0x7745e03a
call fcn.77461a00
test eax, eax
je 0x7745e0bd
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x50]
add edi, 0x226
movzx eax, byte [edi]
mov ecx, esi
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x74]
shl eax, 3
push eax
push dword [esp + 0x18]
call fcn.77502f61
jmp 0x7745e03a
mov eax, dword fs:[0x30]
inc dword [esi + 0x218]
cmp dword [eax + 0xc], 0
je 0x7745e18d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add eax, 0x2c
push eax
push 0x77424db0
call fcn.7744afb0
pop ecx
pop ecx
push dword [esp + 0x10]
push dword [esp + 0x18]
push esi
push edi
push 0x77424e40
call fcn.7744afb0
add esp, 0x14
xor al, al
jmp 0x7745e06d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x230
jmp 0x7745e04e
call fcn.77461a00
test eax, eax
je 0x7745e157
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x50]
add edi, 0x230
movzx eax, byte [edi]
mov ecx, esi
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x74]
shl eax, 3
push eax
push dword [esp + 0x18]
call fcn.77502f61
jmp 0x7745e057
push 0xfeeefeee
push dword [esp + 0x14]
push dword [esp + 0x1c]
call fcn.774a6650
jmp 0x7745e067
push 0x77424dbc
call fcn.7744afb0
jmp 0x7745e10d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x226
jmp 0x7745e011
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x226
jmp 0x7745e035
Function at 0x7746a246
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword fs:[0x30]
and dword [esp + 0xc], 0
and dword [esp + 4], 0
push ebx
mov eax, dword [eax + 0x50]
push esi
push edi
test eax, eax
jne 0x774b8ee4
mov eax, 0x7ffe0385
test byte [eax], 1
mov ebx, 0x7ffe0384
jne 0x774b8f00
mov esi, dword [ebp + 8]
test esi, esi
je 0x774b8fa2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x774b8fa2
mov eax, dword fs:[0x18]
cmp dword [eax + 0xfe0], 0
je 0x7746a312
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xfe0]
cmp dword [eax], esi
jne 0x7746a312
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xfe0]
cmp dword [eax + 4], edi
jne 0x7746a312
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xfe0]
mov esi, dword [eax + 8]
push dword [ebp + 0x14]
mov edx, edi
mov ecx, esi
push dword [ebp + 0x10]
call fcn.7746ab80
mov esi, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x774b8f5c
mov eax, 0x7ffe0385
test byte [eax], 1
jne 0x774b8f78
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, esi
and eax, 0xfffffffc
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
push 2
push 1
push esi
call fcn.77459a20
test eax, eax
je 0x774b8f2d
cmp edi, eax
jb 0x774b8f37
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.77447b65
mov ecx, eax
mov dword [esp + 0x1c], ecx
cmp ecx, 0xc000007b
je 0x7746a37a
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x7746a2d7
mov eax, dword [esp + 0x14]
cmp edi, eax
jb 0x774b8f37
add eax, ecx
cmp edi, eax
jb 0x7746a2d7
jmp 0x774b8f37
mov esi, dword [esp + 0x1c]
jmp 0x7746a2e8
cmp dword [eax], 0
je 0x7746a26f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22b
jmp 0x7746a274
call fcn.77461a00
test eax, eax
je 0x774b8f19
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22a
jmp 0x774b8f1b
mov eax, ebx
movzx edx, byte [eax]
mov ecx, 0x77421b08
call fcn.774db2a0
jmp 0x7746a282
mov esi, 0xc0000089
jmp 0x7746a2e8
lea eax, [esp + 0x18]
mov ecx, esi
push eax
push edi
call fcn.774dad23
test eax, eax
je 0x7746a2d7
cmp eax, 0xffffffff
je 0x7746a2d7
mov esi, eax
jmp 0x7746a2d7
cmp dword [eax], 0
je 0x7746a2f9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22b
jmp 0x7746a2fe
call fcn.77461a00
test eax, eax
je 0x774b8f90
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0x50]
add ebx, 0x22a
movzx edx, byte [ebx]
mov ecx, 0x77421b18
call fcn.774db2a0
jmp 0x7746a307
mov eax, 0xc000000d
jmp 0x7746a309
Function at 0x7746ba70
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x7751fa00
push 0x7749a000
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x7753d344]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x774b9775
mov dword [esi], ecx
mov edx, dword [ebp + 8]
test edx, 0xfffffffc
jne 0x774b9775
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x774b9775
cmp eax, 0xffffffff
je 0x774b9775
not dl
and dl, 1
mov ebx, dword [ebp + 0x14]
jne 0x7746bb4d
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov esi, 0x5a4d
cmp word [eax], si
jne 0x7746bb93
mov ecx, dword [eax + 0x3c]
test dl, dl
jne 0x7746bb62
cmp ecx, 0x10000000
jae 0x774b9721
add ecx, eax
mov dword [ebp - 0x20], ecx
cmp ecx, eax
jb 0x774b9731
cmp dword [ecx], 0x4550
jne 0x774b973b
xor eax, eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0x18]
mov dword [ebp - 4], 0xfffffffe
test eax, eax
js 0x7746bb39
mov dword [esi], ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test ebx, ebx
ja 0x7746bae4
jb 0x7746bb5b
mov edi, dword [ebp + 0x10]
cmp edi, 0x40
jae 0x7746bae7
mov eax, 0xc000007b
jmp 0x7746bb39
xor edx, edx
cmp edx, ebx
jb 0x7746bb6e
ja 0x7746bb86
cmp ecx, edi
jae 0x7746bb86
cmp ecx, 0xffffffe7
jae 0x7746bb86
lea edx, [ecx + 0x18]
xor esi, esi
cmp esi, ebx
jb 0x7746baff
ja 0x7746bb86
cmp edx, edi
jb 0x7746baff
mov eax, 0xc000007b
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
jmp 0x7746bb29
mov eax, 0xc000007b
jmp 0x7746bb26
mov eax, 0xc000007b
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
jmp 0x7746bb29
mov eax, 0xc000007b
jmp 0x7746bb26
mov eax, 0xc000007b
jmp 0x7746bb26
mov eax, 0xc000000d
jmp 0x7746bb39