joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7daab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push esi
cmp ebx, 0x10
push edi
jae 0x7dab12
mov al, bl
lea edx, [ebp - 0x10]
mov cl, al
push edx
mov ch, cl
mov eax, ecx
shl eax, 0x10
mov ax, cx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.007da610
add esp, 8
test ebx, ebx
jbe 0x7dab65
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
sub ecx, edx
mov esi, ebx
lea eax, [edx + ebx]
mov dl, byte [ecx + eax - 1]
mov bl, byte [eax - 1]
dec eax
xor bl, dl
dec esi
mov byte [eax], bl
jne 0x7daafc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx - 4]
xor edx, edx
mov ecx, 0xc
mov edi, dword [ebp + 8]
div ecx
mov esi, edx
test esi, esi
jle 0x7dab3a
mov edx, dword [ebp + 0xc]
lea eax, [edx + ebx - 0x10]
push eax
push edi
call fcn.007da820
add esp, 8
sub ebx, esi
cmp ebx, 0x10
jb 0x7dab65
mov ecx, dword [ebp + 0xc]
mov eax, 0xaaaaaaab
lea esi, [ecx + ebx - 0x10]
add ebx, 0xfffffffc
mul ebx
mov ebx, edx
shr ebx, 3
push esi
push edi
call fcn.007da820
add esp, 8
sub esi, 0xc
dec ebx
jne 0x7dab55
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7dab70
Capabilities:
Check for peb beingdebugged flag
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0
call dword [0x7e8174]
cmp eax, 1
jne 0x7dab94
push 0
call dword [0x7e8178]
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
test al, al
je 0x7dabbc
push 0x75eee0
call fcn.007df440
add esp, 4
push 0
call dword [0x7e8178]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
mov dword [ebp - 8], eax
test byte [ebp - 8], 0x70
je 0x7dabe3
push 0x75eec4
call fcn.007df440
add esp, 4
push 0
call dword [0x7e8178]
mov esp, ebp
pop ebp
ret

Function at 0x7dabf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [0x7dac32]
lea ecx, [0x7dac3a]
sub ecx, eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x7dac56
mov edi, dword [ebp + 8]
lea esi, [0x7dac32]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
jmp 0x7dac51
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7dac60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov cl, 0x65
mov al, 0x6d
mov byte [ebp - 0xa], cl
mov byte [ebp - 9], al
mov byte [ebp - 8], al
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
mov byte [ebp - 4], al
mov cl, 0x6a
mov al, 0x66
push esi
mov dl, 0x75
push edi
mov byte [ebp - 0x1c], cl
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x16], al
mov byte [ebp - 0x13], al
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xb], dl
mov byte [ebp - 0x17], dl
lea edi, [ebp - 0xc]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], 0x2f
mov byte [ebp - 3], 0
xor edx, edx
mov byte [ebp - 0x20], 0x45
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x56
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x15], 0x43
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0
je 0x7dad06
mov cl, byte [ebp + edx - 0xc]
lea edi, [ebp - 0xc]
dec cl
xor eax, eax
mov byte [ebp + edx - 0xc], cl
or ecx, 0xffffffff
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jb 0x7dacea
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x7dad1c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x20]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x7dad49
mov al, byte [ebp + edx - 0x20]
lea edi, [ebp - 0x20]
dec al
or ecx, 0xffffffff
mov byte [ebp + edx - 0x20], al
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jb 0x7dad2d
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x7dad61
push eax
call fcn.007dabf0
add esp, 4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7dbc30
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
mov ebx, dword [0x7e8160]
push edi
xor esi, esi
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x208]
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x40c], esi
rep stosd dword es:[edi], eax
mov ecx, 0x7f
lea edi, [ebp - 0x408]
rep stosd dword es:[edi], eax
mov ecx, dword [0x75e154]
mov eax, ebx
sub eax, ecx
mov dword [ebp - 0xc], eax
je 0x7dbd95
mov eax, dword [ebx + 0x3c]
xor edi, edi
add eax, ebx
mov cx, word [eax + 6]
mov dx, word [eax + 0x14]
and edx, 0xffff
and ecx, 0xffff
dec ecx
lea edx, [edx + eax + 0x18]
cmp ecx, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
jle 0x7dbcdf
xor eax, eax
lea esi, [edx + 0xc]
mov edx, dword [esi]
mov ecx, dword [esi - 4]
lea eax, [ebp + eax*4 - 0x20c]
add edx, ebx
push eax
push 4
push ecx
push edx
call dword [0x7e817c]
mov ecx, dword [ebp - 4]
add esi, 0x28
mov ebx, dword [0x7e8160]
inc edi
mov eax, edi
and eax, 0xffff
cmp eax, ecx
jl 0x7dbcae
mov eax, dword [0x75e13c]
lea ecx, [eax + ebx]
mov eax, dword [eax + ebx]
test eax, eax
jbe 0x7dbd4b
lea edi, [eax + ebx]
mov eax, dword [ecx + 4]
sub eax, 8
xor edx, edx
test eax, 0xfffffffe
lea esi, [ecx + 8]
jbe 0x7dbd42
xor eax, eax
mov ax, word [esi]
mov ebx, eax
and ebx, 0xfffff000
cmp ebx, 0x3000
jne 0x7dbd24
mov ebx, dword [ebp - 0xc]
and eax, 0xfff
add eax, edi
add dword [eax], ebx
mov eax, dword [ecx + 4]
inc edx
sub eax, 8
mov ebx, edx
shr eax, 1
and ebx, 0xffff
add esi, 2
cmp ebx, eax
jb 0x7dbd03
mov ebx, dword [0x7e8160]
add ecx, dword [ecx + 4]
mov eax, dword [ecx]
test eax, eax
ja 0x7dbcee
mov eax, dword [ebp - 4]
xor edi, edi
test eax, eax
jle 0x7dbd95
mov ecx, dword [ebp - 8]
xor eax, eax
lea esi, [ecx + 0xc]
jmp 0x7dbd64
mov ebx, dword [0x7e8160]
mov ecx, dword [esi - 4]
lea edx, [ebp + eax*4 - 0x40c]
mov eax, dword [ebp + eax*4 - 0x20c]
push edx
mov edx, dword [esi]
push eax
add edx, ebx
push ecx
push edx
call dword [0x7e817c]
mov ecx, dword [ebp - 4]
add esi, 0x28
inc edi
mov eax, edi
and eax, 0xffff
cmp eax, ecx
jl 0x7dbd5e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7de2d0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x10
lea edi, [ebp - 0x44]
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0xc3d2e1f0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x4c]
mov ebx, eax
add eax, ecx
and ebx, 0x3f
cmp eax, ecx
mov dword [ebp - 0x4c], eax
jae 0x7de32b
inc dword [ebp - 0x48]
add ecx, ebx
cmp ecx, 0x40
mov dword [ebp + 0x14], ecx
jb 0x7de389
shr ecx, 6
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 0x10]
mov ecx, 0x40
sub ecx, ebx
lea edi, [ebp + ebx - 0x44]
mov edx, ecx
lea eax, [ebp - 0x60]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.007dcde0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov ecx, 0x40
add esp, 4
sub ecx, ebx
xor ebx, ebx
add edx, ecx
mov ecx, dword [ebp + 0x14]
sub ecx, 0x40
dec eax
mov dword [ebp + 0x10], edx
mov dword [ebp + 0x14], ecx
mov dword [ebp - 4], eax
jne 0x7de33b
mov eax, dword [ebp - 0x4c]
cmp ecx, ebx
jbe 0x7de3a7
mov esi, dword [ebp + 0x10]
sub ecx, ebx
mov edx, ecx
lea edi, [ebp + ebx - 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp + 8]
mov ebx, eax
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp + 0xc]
add eax, ecx
and ebx, 0x3f
cmp eax, ecx
mov dword [ebp - 0x4c], eax
jae 0x7de3c1
inc dword [ebp - 0x48]
add ecx, ebx
cmp ecx, 0x40
mov dword [ebp + 0x14], ecx
jb 0x7de41c
shr ecx, 6
mov dword [ebp + 8], ecx
mov esi, dword [ebp + 0x10]
mov ecx, 0x40
sub ecx, ebx
lea edi, [ebp + ebx - 0x44]
mov edx, ecx
lea eax, [ebp - 0x60]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.007dcde0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, 0x40
add esp, 4
sub ecx, ebx
xor ebx, ebx
add edx, ecx
mov ecx, dword [ebp + 0x14]
sub ecx, 0x40
dec eax
mov dword [ebp + 0x10], edx
mov dword [ebp + 0x14], ecx
mov dword [ebp + 8], eax
jne 0x7de3d1
cmp ecx, ebx
jbe 0x7de437
mov esi, dword [ebp + 0x10]
sub ecx, ebx
mov edx, ecx
lea edi, [ebp + ebx - 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0x60]
push eax
push esi
call fcn.007de1e0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x7e2880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push ebx
mov dword [ebp - 0xf], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov byte [ebp - 0xf], 0x10
mov word [ebp - 3], ax
mov byte [ebp - 0x10], 1
mov byte [ebp - 1], al
call esi
sub al, 0x10
mov byte [ebp - 4], al
call esi
shr eax, 4
sub al, 0x33
mov byte [ebp - 3], al
call esi
shr eax, 8
sub al, 0x55
mov byte [ebp - 2], al
call esi
shr eax, 0xc
add al, 0x12
mov ecx, 0xa
mov byte [ebp - 1], al
xor eax, eax
mov bl, byte [eax + 0x75f3e0]
mov edx, eax
shr edx, 2
mov dl, byte [ebp + edx - 4]
xor dl, bl
mov byte [ebp + eax - 0xe], dl
inc eax
dec ecx
jne 0x7e28d4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
pop ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov esp, ebp
pop ebp
ret

Function at 0x7e2910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x17], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x13], ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xf], ecx
xor ebx, ebx
mov dword [ebp - 0x20], eax
mov word [ebp - 0xb], cx
cmp esi, 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], bl
mov byte [ebp - 9], cl
jne 0x7e2953
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x2c]
lea eax, [ebp - 8]
push edx
push eax
lea ecx, [ebp - 0x18]
push 0x10
push ecx
push esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.007df690
test eax, eax
jne 0x7e2989
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x7e2989
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 8]
push 1
lea eax, [ebp - 0x2c]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp - 8], 0x10
je 0x7e29ab
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 4], edx
mov ecx, 0xa
mov esi, eax
shr esi, 2
mov bl, byte [ebp + esi - 0xc]
xor byte [ebp + eax - 0x16], bl
inc eax
dec ecx
jne 0x7e29b8
push edi
mov ecx, 0xa
mov edi, 0x75f3e0
lea esi, [ebp - 0x16]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
je 0x7e29e3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x7e29f1
mov ecx, dword [ebp + 0x10]
mov word [ecx], 0x10
jmp 0x7e2a3b
mov al, byte [ebp + 0xc]
xor esi, esi
cmp al, 1
jne 0x7e2a1a
cmp dl, 0xca
jne 0x7e2a10
cmp dh, 0xfe
jne 0x7e2a10
cmp byte [ebp - 2], 0xba
jne 0x7e2a10
cmp byte [ebp - 1], 0xbe
je 0x7e2a40
mov edx, dword [ebp + 0x10]
mov word [edx], 0
jmp 0x7e2a3b
cmp al, 2
jne 0x7e2a40
cmp byte [ebp - 2], 0x53
jne 0x7e2a33
cmp dh, 0x57
jne 0x7e2a33
cmp dl, 0x46
je 0x7e2a40
cmp dl, 0x43
je 0x7e2a40
mov eax, dword [ebp + 0x10]
mov word [eax], 0
mov esi, 1
mov ecx, dword [ebp + 8]
push 0
push 0
push 0
push ecx
call fcn.007df750
xor eax, eax
cmp esi, 1
pop esi
pop ebx
setne al
mov esp, ebp
pop ebp
ret
Function at 0x7e3210
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
test eax, eax
je 0x7e32bb
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7e32bb
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x7e32bb
xor eax, eax
lea ecx, [edx + 8]
mov byte [ecx + eax], al
inc eax
cmp eax, 0x100
jl 0x7e323d
mov eax, 0xfffffff8
push ebx
sub eax, edx
push esi
mov dword [ebp - 4], eax
add eax, ecx
mov esi, dword [ebp + 8]
cdq
idiv dword [ebp + 0xc]
mov bl, byte [ecx]
xor eax, eax
mov al, byte [edx + esi]
mov edx, ebx
and edx, 0xff
add edi, eax
add edi, edx
and edi, 0x800000ff
jns 0x7e3280
dec edi
or edi, 0xffffff00
inc edi
mov eax, dword [ebp + 0x10]
inc ecx
mov dl, byte [eax + edi + 8]
lea esi, [eax + 8]
mov eax, dword [ebp - 4]
mov byte [ecx - 1], dl
mov byte [esi + edi], bl
lea edx, [eax + ecx]
cmp edx, 0x100
jl 0x7e3254
mov eax, dword [ebp + 0x10]
mov ecx, 0x40
lea edi, [eax + 0x108]
mov dword [eax + 0x208], 0
rep movsd dword es:[edi], dword [esi]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x7e32c0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
test eax, eax
je 0x7e3423
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x7e3423
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x7e3423
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebx + 0x208]
push esi
cmp ecx, eax
push edi
je 0x7e335d
lea edi, [ebx + 8]
lea esi, [ebx + 0x108]
mov ecx, 0x40
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xffff
mov dword [ebx + 0x208], eax
div ecx
mov dword [ebx], 0
mov dword [ebx + 4], 0
test edx, edx
jbe 0x7e335a
mov edi, edx
mov eax, dword [ebx]
mov esi, dword [ebx + 4]
inc eax
xor ecx, ecx
and eax, 0xff
mov dword [ebx], eax
mov dl, byte [eax + ebx + 8]
add esi, edx
and esi, 0xff
dec edi
mov dword [ebx + 4], esi
mov cl, byte [eax + ebx + 8]
mov dl, byte [esi + ebx + 8]
mov byte [eax + ebx + 8], dl
mov eax, dword [ebx + 4]
mov byte [ebx + eax + 8], cl
jne 0x7e3326
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
test edx, edx
jbe 0x7e3410
mov ecx, dword [ebp + 0xc]
lea edi, [ebx + 8]
sub eax, ecx
mov dword [ebp + 0x14], ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
jmp 0x7e337e
mov eax, dword [ebp + 8]
add eax, ecx
xor edx, edx
mov ecx, 0xffff
div ecx
test edx, edx
jne 0x7e339f
lea esi, [ebx + 0x108]
mov ecx, 0x40
mov dword [ebx], edx
mov dword [ebx + 4], edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx]
mov esi, dword [ebx + 4]
inc eax
lea edi, [ebx + 8]
and eax, 0xff
mov dword [ebx], eax
mov dl, byte [eax + edi]
add esi, edx
xor edx, edx
and esi, 0xff
mov dword [ebx + 4], esi
mov dl, byte [eax + edi]
mov cl, byte [esi + edi]
mov byte [eax + edi], cl
mov eax, dword [ebx + 4]
mov byte [ebx + eax + 8], dl
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
xor edx, edx
mov dl, byte [ecx + ebx + 8]
xor ecx, ecx
mov cl, byte [ebx + eax + 8]
add edx, ecx
and edx, 0x800000ff
jns 0x7e33f2
dec edx
or edx, 0xffffff00
inc edx
mov ecx, dword [ebp + 0x14]
mov dl, byte [edx + ebx + 8]
mov al, byte [ecx]
xor al, dl
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
inc ecx
dec eax
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0xc], eax
jne 0x7e337b
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x208]
add ecx, eax
pop edi
mov dword [ebx + 0x208], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x7e3a00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7e70f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x7e7112
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x7e7104
pop ebx
pop esi
ret

Function at 0x7e7120
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
mov esi, dword [esp + 0x1c]
xor eax, eax
push edi
xor ecx, esi
mov esi, dword [esp + 0x1c]
mov edi, 0x20
mov ebx, edx
mov ebp, edx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, eax
and ebp, 3
add ebx, edx
mov ebp, dword [esi + ebp*4]
add ebp, eax
sub eax, 0x61c88647
xor ebx, ebp
add ecx, ebx
mov ebx, ecx
mov ebp, ecx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
add ebx, ecx
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
add edx, ebx
dec edi
jne 0x7e713e
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret

Function at 0x7e7190
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov esi, dword [esp + 0x18]
push edi
mov eax, 0xc6ef3720
mov edi, 0x20
mov ebx, ecx
mov ebp, ecx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
add ebx, ecx
mov ebp, dword [esi + ebp*4]
add ebp, eax
add eax, 0x61c88647
xor ebx, ebp
sub edx, ebx
mov ebx, edx
mov ebp, edx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, eax
and ebp, 3
add ebx, edx
mov ebp, dword [esi + ebp*4]
add ebp, eax
xor ebx, ebp
sub ecx, ebx
dec edi
jne 0x7e71ab
mov eax, dword [esp + 0x20]
pop edi
xor ecx, eax
mov eax, dword [esp + 0x14]
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret
Function at 0x7e7960
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
cmp word [ebp], 0x5a4d
je 0x7e7977
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], 0x4550
je 0x7e798b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x3000
push eax
push ecx
call esi
mov edi, eax
test edi, edi
jne 0x7e79c1
mov edx, dword [ebx + 0x50]
push 4
push 0x3000
push edx
push eax
call esi
mov edi, eax
test edi, edi
jne 0x7e79c1
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
push 4
push 0x1000
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x50]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx + 0x54]
push 4
push 0x1000
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebp + 0x3c]
mov ecx, dword [ebx + 0x54]
add edx, ecx
mov dword [esp + 0x14], eax
push edx
push ebp
push eax
call fcn.007e6d00
mov eax, dword [ebp + 0x3c]
mov ecx, dword [esp + 0x20]
add eax, ecx
push esi
push ebx
mov dword [esi], eax
push ebp
mov dword [eax + 0x34], edi
call fcn.007e7aa0
mov ecx, dword [ebx + 0x34]
mov eax, edi
add esp, 0x18
sub eax, ecx
je 0x7e7a46
push eax
push esi
call fcn.007e7cc0
add esp, 8
push esi
call fcn.007e7d40
add esp, 4
test eax, eax
je 0x7e7a76
push esi
call fcn.007e7b60
mov edx, dword [esi]
add esp, 4
mov eax, dword [edx + 0x28]
test eax, eax
je 0x7e7a8d
add eax, edi
test eax, eax
je 0x7e7a76
push 0
push 1
push edi
call eax
test eax, eax
jne 0x7e7a86
push esi
call fcn.007e7430
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x10], 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x7e7aa0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
xor ecx, ecx
push esi
mov ebx, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x7e7b50
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
add esi, 0x10
cmp dword [esi], 0
jne 0x7e7b05
mov edx, dword [esp + 0x1c]
mov edi, dword [edx + 0x38]
test edi, edi
jle 0x7e7b32
mov eax, dword [esi - 4]
push 4
push 0x1000
add eax, ebx
push edi
push eax
call ebp
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.007e6d20
add esp, 0xc
jmp 0x7e7b32
mov edx, dword [esi - 4]
mov ecx, dword [esi]
push 4
push 0x1000
add edx, ebx
push ecx
push edx
call ebp
mov ecx, dword [esi + 4]
mov edi, eax
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x1c]
add ecx, eax
push ecx
push edi
call fcn.007e6d00
add esp, 0xc
mov dword [esi - 8], edi
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add esi, 0x28
mov ecx, dword [edx]
xor edx, edx
mov dword [esp + 0x10], eax
mov dx, word [ecx + 6]
cmp eax, edx
jl 0x7e7ad4
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x7e7b60
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
xor ecx, ecx
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0x1b], 0x4b
mov eax, dword [eax]
mov byte [ebp - 0x1a], 0x41
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 7
mov byte [ebp - 0x16], 0x1b
mov byte [ebp - 0x15], 0xd8
mov byte [ebp - 0x14], 0xeb
mov byte [ebp - 0x13], 0xc5
mov byte [ebp - 0x12], 0xcf
mov byte [ebp - 0x11], 0xa9
mov byte [ebp - 0x10], 0xbe
mov byte [ebp - 0xf], 0x9a
mov byte [ebp - 0xe], 0xff
mov byte [ebp - 0xd], 0
mov cx, word [eax + 0x14]
push ebx
push esi
lea edx, [ecx + eax + 0x18]
push edi
mov dword [ebp - 8], edx
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
popal
xor ecx, ecx
mov al, cl
mov dl, 0x11
inc al
mov bl, byte [ebp + ecx - 0x1c]
imul dl
xor bl, al
mov byte [ebp + ecx - 0x1c], bl
inc ecx
cmp ecx, 0x10
jb 0x7e7bd3
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov ebx, dword [edx]
cmp word [ebx + 6], 0
jbe 0x7e7cad
mov eax, dword [ebp - 8]
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x7e7c4c
mov ecx, dword [edi - 0x14]
mov edx, dword [edi - 0x1c]
push 0x4000
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x7e7c90
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov esi, dword [edx*4 + 0x7d9380]
je 0x7e7c66
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x7e7c81
test al, 0x40
je 0x7e7c78
mov ecx, dword [ebx + 0x20]
jmp 0x7e7c7f
test al, 0x80
je 0x7e7c90
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x7e7c90
mov ecx, dword [edi - 0x1c]
lea eax, [ebp - 8]
push eax
push esi
push edx
push ecx
call dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
inc eax
mov ebx, dword [edx]
add edi, 0x28
mov dword [ebp - 4], eax
mov cx, word [ebx + 6]
cmp eax, ecx
jl 0x7e7c19
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret