joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa7d3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xf
stosb byte es:[edi], al
call fcn.00a7c070
mov cl, byte [eax]
xor ebx, ebx
add esp, 4
xor edi, edi
cmp cl, bl
mov byte [esp + 0xc], cl
je 0xa7d414
lea esi, [esp + 0xc]
sub esi, eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
cmp cl, bl
mov byte [esi + eax], dl
jne 0xa7d400
lea eax, [esp + 0xc]
mov byte [esp + edi + 0xc], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xa7d420
sub eax, edx
mov byte [esp + eax + 0xb], bl
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esp + 0x28]
call fcn.00a7c390
mov eax, dword [ebp + 8]
mov edx, ebx
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00a7ce60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xa7d460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x21
stosb byte es:[edi], al
call fcn.00a7c070
mov cl, byte [eax]
xor ebx, ebx
add esp, 4
xor edi, edi
cmp cl, bl
mov byte [esp + 0xc], cl
je 0xa7d4b4
lea esi, [esp + 0xc]
sub esi, eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
cmp cl, bl
mov byte [esi + eax], dl
jne 0xa7d4a0
lea eax, [esp + 0xc]
mov byte [esp + edi + 0xc], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xa7d4c0
sub eax, edx
mov byte [esp + eax + 0xb], bl
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esp + 0x28]
call fcn.00a7c390
mov eax, dword [ebp + 8]
mov edx, ebx
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00a7ce60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xa7d500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x29
stosb byte es:[edi], al
call fcn.00a7c070
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
mov byte [esp + 0xc], cl
je 0xa7d555
lea esi, [esp + 0xc]
sub esi, eax
jmp 0xa7d540
mov cl, byte [eax + 1]
mov bl, byte [esi + eax]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, bl
test cl, cl
mov byte [esi + eax], dl
jne 0xa7d540
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea ebx, [esp + 0x28]
mov byte [esp + edi + 0x14], 0
call fcn.00a7c390
mov eax, dword [ebp + 8]
mov edx, ebx
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00a7ce60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa7d590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x31
stosb byte es:[edi], al
call fcn.00a7c070
mov cl, byte [eax]
xor ebx, ebx
add esp, 4
xor edi, edi
cmp cl, bl
mov byte [esp + 0xc], cl
je 0xa7d5e4
lea esi, [esp + 0xc]
sub esi, eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
cmp cl, bl
mov byte [esi + eax], dl
jne 0xa7d5d0
lea eax, [esp + 0xc]
mov byte [esp + edi + 0xc], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xa7d5f0
sub eax, edx
mov byte [esp + eax + 0xb], bl
push ebx
lea eax, [esp + 0x10]
push eax
lea ebx, [esp + 0x28]
call fcn.00a7c390
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
push ecx
push edx
call fcn.00a7ce60
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa7d960
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x118
mov eax, dword [esp + 0x120]
push ebx
mov ebx, dword [eax]
push ebp
mov ebp, dword [esp + 0x12c]
push esi
push edi
push 0x16
call fcn.00a7c070
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
mov byte [esp + 0x10], cl
je 0xa7d9aa
lea esi, [esp + 0x10]
sub esi, eax
mov cl, byte [eax + 1]
inc edi
inc eax
mov dl, cl
dec dl
xor dl, byte [esi + eax - 1]
test cl, cl
mov byte [esi + eax], dl
jne 0xa7d996
mov byte [esp + edi + 0x10], 0
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x24]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xa7d9c4
mov al, byte [esp + 0x24]
mov ebp, dword [ebx + 0x8c]
xor edi, edi
test al, al
lea esi, [esp + 0x24]
je 0xa7d9ff
xor eax, eax
mov al, byte [esi]
push eax
call ebp
test eax, eax
je 0xa7d9f2
add esi, 2
jmp 0xa7d9fa
cmp byte [esi], 0x5c
jne 0xa7d9f9
mov edi, esi
inc esi
cmp byte [esi], 0
jne 0xa7d9e2
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7da06
sub eax, edx
lea ecx, [esp + eax + 0x23]
cmp edi, ecx
je 0xa7da2e
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7da20
sub eax, edx
mov byte [esp + eax + 0x24], 0x5c
mov eax, dword [esp + 0x138]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7da37
lea edi, [esp + 0x24]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xa7da45
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x24]
mov ebp, dword [ebx + 0x8c]
xor edi, edi
test al, al
lea esi, [esp + 0x24]
je 0xa7da8d
nop
xor edx, edx
mov dl, byte [esi]
push edx
call ebp
test eax, eax
je 0xa7da80
add esi, 2
jmp 0xa7da88
cmp byte [esi], 0x5c
jne 0xa7da87
mov edi, esi
inc esi
cmp byte [esi], 0
jne 0xa7da70
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7da94
sub eax, edx
lea eax, [esp + eax + 0x23]
cmp edi, eax
je 0xa7dabe
lea eax, [esp + 0x24]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7dab0
sub eax, edx
mov byte [esp + eax + 0x24], 0x5c
lea eax, [esp + 0x10]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xa7dac4
lea edi, [esp + 0x24]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xa7dad2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0x10000000
push 2
push 0
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0xc0000000
lea ecx, [esp + 0x3c]
push ecx
call dword [ebx + 0x10]
cmp eax, 0xffffffff
mov edx, dword [esp + 0x12c]
mov dword [edx + 0x2c], eax
jne 0xa7db38
lea eax, [esp + 0x24]
push eax
call dword [ebx + 0x78]
mov ecx, dword [esp + 0x134]
push eax
push ecx
call fcn.00a7d0d0
add esp, 0xc
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x118
ret
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0x118
ret
Function at 0xa7ebe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov ebx, dword [ebp]
push esi
push edi
push 0x33
xor esi, esi
call fcn.00a7c070
mov dl, byte [eax]
mov byte [esp + 0x14], dl
mov dl, byte [eax]
add esp, 4
xor ecx, ecx
test dl, dl
je 0xa7ec23
lea edi, [esp + 0x10]
sub edi, eax
mov edi, edi
mov dl, byte [eax + 1]
inc ecx
inc eax
dec dl
xor dl, byte [edi + eax - 1]
mov byte [edi + eax], dl
cmp byte [eax], 0
jne 0xa7ec10
lea eax, [esp + 0x10]
push eax
push 0
push 0
mov byte [esp + ecx + 0x1c], 0
call dword [ebx + 0x50]
mov edi, eax
test edi, edi
jne 0xa7ec52
call dword [ebx + 0x78]
push eax
push ebp
call fcn.00a7d590
add esp, 8
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x14
ret
push 0xffffffffffffffff
push edi
call dword [ebx + 0x74]
test eax, eax
je 0xa7ec81
cmp eax, 0xffffffff
jne 0xa7ecca
call dword [ebx + 0x78]
push eax
push ebp
call fcn.00a7d590
add esp, 8
push edi
call dword [ebx + 0x60]
push edi
call dword [ebx + 0x1c]
pop edi
mov ax, si
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
mov edx, dword [esp + 0x3c]
mov eax, ebp
call fcn.00a7ead0
add esp, 0x14
mov esi, eax
cmp si, 1
jne 0xa7ecca
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push ebp
push edx
call fcn.00a7db50
add esp, 0x10
mov esi, eax
push edi
call dword [ebx + 0x60]
push edi
call dword [ebx + 0x1c]
pop edi
mov ax, si
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0xad761c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0xad764a
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0xad7651
cmp ebx, dword [eax + 4]
jae 0xad7651
xor eax, eax
jmp 0xad7841
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0xad7662
xor eax, eax
inc eax
jmp 0xad7840
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0xad7678
cmp ecx, edx
jae 0xad77bd
cmp dword [eax + 4], 0
je 0xad7681
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0xad7669
cmp dword [ebp + 8], 0
je 0xad76a3
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0xad77bd
cmp eax, esi
jae 0xad77bd
mov eax, dword [0x412f70]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0xad76c8
cmp dword [esi*4 + 0x412f78], edi
je 0xad77c1
inc esi
cmp esi, eax
jl 0xad76b6
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x40f170]
test eax, eax
je 0xad783d
cmp dword [ebp - 8], 0x1000000
jne 0xad783d
test byte [ebp - 0xc], 0xcc
je 0xad7746
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0xad783d
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0xad783d
cmp word [eax + 0x18], 0x10b
jne 0xad783d
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0xad783d
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0xad7746
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0xad7746
test byte [ecx + 0x27], 0x80
jne 0xad77bd
push 1
push 0x412fb8
call dword [0x40f0ac]
test eax, eax
jne 0xad765a
mov ecx, dword [0x412f70]
test ecx, ecx
mov edx, ecx
jle 0xad777a
lea eax, [ecx*4 + 0x412f74]
cmp dword [eax], edi
je 0xad777a
dec edx
sub eax, 4
test edx, edx
jg 0xad776e
test edx, edx
jne 0xad77ab
push 0xf
pop ebx
cmp ecx, ebx
jg 0xad7787
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0xad779f
lea eax, [edx*4 + 0x412f78]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0xad778d
cmp ecx, 0x10
jge 0xad77ab
inc ecx
mov dword [0x412f70], ecx
push 0
push 0x412fb8
call dword [0x40f0ac]
jmp 0xad765a
xor eax, eax
jmp 0xad7840
test esi, esi
jle 0xad765a
mov ebx, dword [0x40f0ac]
push 1
push 0x412fb8
call ebx
test eax, eax
jne 0xad765a
cmp dword [esi*4 + 0x412f78], edi
je 0xad7817
mov eax, dword [0x412f70]
lea esi, [eax - 1]
test esi, esi
jl 0xad7805
cmp dword [esi*4 + 0x412f78], edi
je 0xad7801
dec esi
jns 0xad77f5
test esi, esi
jge 0xad7815
cmp eax, 0x10
jge 0xad7810
inc eax
mov dword [0x412f70], eax
lea esi, [eax - 1]
jmp 0xad7817
je 0xad782f
xor ecx, ecx
test esi, esi
jl 0xad782f
lea eax, [ecx*4 + 0x412f78]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0xad781d
push 0
push 0x412fb8
call ebx
jmp 0xad765a
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0xaedfc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
xor esi, esi
call fcn.00b1ce0f
cmp eax, esi
je 0xaee08b
cmp word [eax], 0x5a4d
jne 0xaee08b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xaee08b
xor eax, eax
mov ax, word [ecx + 0x16]
shr eax, 0xd
and eax, 1
cmp ax, si
je 0xaee08b
push 0x104
lea eax, [ebp - 0x114]
push eax
push esi
call dword [0x667891c4]
push esi
push esi
push 3
push esi
push 1
push 0x80000000
lea eax, [ebp - 0x114]
push eax
call dword [0x667891c8]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0xaee046
call dword [0x667891b0]
jmp 0xaee08b
lea eax, [ebp - 0x10]
push 0x65
push eax
mov dword [ebp - 0xc], esi
call fcn.00b1d228
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00b1ce47
add esp, 0x10
test ax, ax
je 0xaee082
lea eax, [ebp - 0x10]
push 0x66789214
push eax
call fcn.00aedf7e
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.00b1cf84
add esp, 0xc
push dword [ebp - 0x10]
call dword [0x667891d0]
mov ax, si
pop esi
leave
ret
Function at 0xaef7fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
xor ebx, ebx
or edi, 0xffffffff
cmp dword [ebp + 8], edi
mov dword [ebp - 8], 0x82
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
jne 0xaef865
call fcn.00b1ce0f
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push eax
call dword [0x667891c4]
test eax, eax
jbe 0xaef865
push ebx
push 0x80
push 3
push ebx
xor esi, esi
inc esi
push esi
push 0x80000000
lea eax, [ebp - 0x118]
push eax
call dword [0x667891c8]
cmp eax, edi
mov dword [ebp + 8], eax
je 0xaef865
mov dword [ebp - 4], esi
push 0x121
call fcn.00b58f02
mov esi, eax
cmp esi, ebx
pop ecx
jne 0xaef890
cmp word [ebp - 4], 1
jne 0xaef886
push dword [ebp + 8]
call dword [0x667891d0]
mov eax, 0x84
jmp 0xaef9f6
cmp dword [ebp + 0xc], ebx
jne 0xaef8d6
push 0x11
push 0x667898fc
push ebx
push dword [ebp + 8]
call fcn.00b07fb8
add esp, 0x10
cmp eax, edi
jne 0xaef8c6
cmp word [ebp - 4], 1
jne 0xaef8bc
push dword [ebp + 8]
call dword [0x667891d0]
mov eax, 0x82
jmp 0xaef9f6
push dword [ebp + 8]
call fcn.00aef433
cmp eax, edi
pop ecx
mov dword [ebp + 0xc], eax
je 0xaef8e7
push ebx
push dword [ebp + 8]
call dword [0x66789054]
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0xaef901
cmp word [ebp - 4], 1
jne 0xaef8f7
push dword [ebp + 8]
call dword [0x667891d0]
mov eax, 0x1f5
jmp 0xaef9f6
push ebx
push ebx
jmp 0xaef99d
xor edi, edi
push edi
lea eax, [ebp - 0x14]
push eax
push 0x121
push esi
push dword [ebp + 8]
call dword [0x66789040]
test eax, eax
je 0xaef9b6
cmp dword [ebp - 0x14], edi
jbe 0xaef958
imul ebx, ebx, 0x13c6a5
sub ebx, 0x27bcf213
mov eax, ebx
shr eax, 0x18
mov ecx, ebx
shr ecx, 0x10
xor al, cl
mov ecx, ebx
shr ecx, 8
xor al, cl
xor al, byte [edi + esi]
xor al, bl
mov byte [edi + esi], al
inc edi
cmp edi, dword [ebp - 0x14]
jb 0xaef92b
cmp dword [esi], 0xa8726b03
jne 0xaef9bf
cmp dword [esi + 4], 0xef01996c
jne 0xaef9bf
mov eax, dword [esi + 8]
cmp eax, dword [ebp + 0x10]
jne 0xaef990
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push dword [ebp + 8]
mov eax, esi
call fcn.00aef711
cmp eax, 0x82
pop ecx
pop ecx
mov dword [ebp - 8], eax
jne 0xaef9c6
inc dword [ebp - 0xc]
mov eax, dword [esi + 0x10]
add eax, dword [esi + 0xc]
push 0
add dword [ebp + 0xc], eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x66789044]
mov ebx, eax
cmp ebx, dword [ebp - 0x10]
jb 0xaef908
jmp 0xaef9c6
mov dword [ebp - 8], 0x1f5
jmp 0xaef9c6
mov dword [ebp - 8], 0x82
push esi
call fcn.00b58bb9
cmp dword [ebp - 8], 0x82
pop ecx
jne 0xaef9e3
cmp dword [ebp - 0xc], 0
jne 0xaef9e3
mov dword [ebp - 8], 0x1fd
cmp word [ebp - 4], 1
jne 0xaef9f3
push dword [ebp + 8]
call dword [0x667891d0]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0xaf1e5f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push 0x40
push 0
push dword [ebp + 8]
call fcn.00b1d587
add esp, 0x10
test ax, ax
jne 0xaf1e9e
mov edi, 0xff
push 0x40
push edi
push esi
call fcn.00b58dbe
invalid
clc
invalid
Function at 0xaf1e8e
Capabilities:
Parse pe header

Disassembly:
add byte [eax], al
xor ax, ax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xaf2d5e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66781ec8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, ecx
mov dword [esp + 8], 0x6678b720
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
lea eax, [esp + 8]
push ecx
push edi
mov ecx, eax
mov dword [esp + 0x30], 0
mov dword [esi], eax
call dword [0x6678b720]
mov esi, dword [esi]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push 0
push 2
push edx
push eax
call fcn.00b59e1e
add eax, dword [esi + 0x10]
adc edx, dword [esi + 0x14]
push 0
sub eax, 0x604652df
push 4
sbb edx, 0
push edx
push eax
call fcn.00b595be
mov edx, dword [edi + 8]
mov esi, eax
lea ecx, [edi + 8]
xor eax, 0xd9875cdd
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8

Function at 0xaf36a6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66782018
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00af297e
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x58], 0
call fcn.00af333e
mov dword [esp + 0x14], 0x6678b73c
mov cl, byte [eax + 4]
mov byte [esp + 0x18], cl
mov dword [esp + 0x1c], 0x6678b69c
mov edx, dword [eax + 0xc]
mov dword [esp + 0x20], edx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x28], edx
mov al, byte [eax + 0x18]
mov byte [esp + 0x2c], al
lea ecx, [esp + 0x14]
push ecx
push esi
lea ecx, [esi + 0x10]
mov byte [esp + 0x5c], 2
call fcn.00af2d5e
mov ecx, dword [esp + 0x4c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret
Function at 0xaf77de
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x94
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [0x667891a8]
test eax, eax
jne 0xaf7805
mov ax, 1
add esp, 0x94
ret
cmp dword [esp + 0x10], 2
push edi
mov edi, dword [esp + 0x9c]
je 0xaf782e
and dword [edi], 0x178025ed
mov ecx, dword [edi]
xor eax, eax
and ecx, 0x178025ed
mov dword [edi], ecx
pop edi
add esp, 0x94
ret
mov eax, dword [0x667ebdd0]
test eax, eax
je 0xaf7841
mov edx, dword [0x667ebdd4]
test edx, edx
jne 0xaf788c
call fcn.00b1c68a
test eax, eax
mov dword [0x667ebdd0], eax
je 0xaf7886
push 0x667ebcc8
push 0x667ebdc0
mov dword [0x667ebdc4], eax
mov dword [0x667ebdc8], 0x67
call fcn.00af1e45
mov eax, dword [0x667ebdd0]
mov ecx, dword [0x667ebd40]
lea edx, [ecx + eax]
add esp, 8
mov dword [0x667ebdd4], edx
jmp 0xaf788c
mov edx, dword [0x667ebdd4]
test eax, eax
push esi
mov esi, 0xff
je 0xaf78be
test edx, edx
je 0xaf78be
mov ecx, dword [edx + 0x1c]
mov edx, dword [edx + 0x14]
add ecx, eax
xor esi, esi
test edx, edx
jbe 0xaf78be
push ebx
jmp 0xaf78ae
mov ebx, dword [ecx]
cmp byte [eax + ebx], 0xcc
jne 0xaf78b7
inc esi
add ecx, 4
dec edx
jne 0xaf78ae
pop ebx
xor edx, edx
cmp edx, esi
sbb eax, eax
neg eax
test ax, ax
pop esi
jne 0xaf78da
and dword [edi], 0x178025ed
pop edi
add esp, 0x94
ret
mov ecx, dword [esp + 0x9c]
and dword [ecx], 0x2670e163
pop edi
add esp, 0x94
ret

Function at 0xaf7abe
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [0x667891a8]
test eax, eax
jne 0xaf7af0
mov ax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x88], 2
je 0xaf7b15
mov ecx, dword [ebp + 8]
and dword [ecx], 0x970560ef
mov edx, dword [ecx]
xor eax, eax
and edx, 0x970560ef
mov dword [ecx], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 1
pushal
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
movzx eax, byte [ecx + 2]
test eax, eax
jne 0xaf7b33
xor eax, eax
mov dword [ebp - 4], eax
popal
mov esi, dword [ebp - 4]
xor ecx, ecx
cmp ecx, esi
sbb eax, eax
neg eax
test ax, ax
je 0xaf7b54
call fcn.00aedfc0
neg ax
sbb eax, eax
inc eax
test ax, ax
jne 0xaf7b64
mov ecx, dword [ebp + 8]
and dword [ecx], 0x970560ef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
pop edi
and edx, 0x68ecd011
pop esi
mov dword [ecx], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb1c8e5
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
mov dl, byte [ecx]
xor eax, eax
xor edi, edi
mov byte [esi], dl
cmp byte [ecx], al
je 0xb1c913
mov edx, esi
push ebx
sub edx, ecx
mov bl, byte [ecx + 1]
inc edi
inc ecx
dec bl
xor bl, byte [edx + ecx - 1]
mov byte [edx + ecx], bl
cmp byte [ecx], al
jne 0xb1c900
pop ebx
mov byte [edi + esi], al
mov eax, esi
pop edi
pop esi
ret

Function at 0xb22523
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
jbe 0xb2257c
mov ecx, dword [ebp + 8]
push ebx
mov bl, byte [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
shl bl, 1
sub edi, ecx
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0x1c]
mov esi, edx
test esi, esi
jne 0xb22550
inc esi
mov al, byte [edi + ecx]
xor al, bl
mov byte [ecx], al
xor eax, eax
test esi, esi
jbe 0xb2256a
mov edx, dword [ebp + 0x18]
mov dl, byte [eax + edx]
xor byte [ecx], dl
inc eax
cmp eax, esi
jb 0xb2255d
mov eax, dword [ebp - 4]
xor byte [ecx], al
inc eax
inc ecx
cmp eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
jb 0xb22541
pop edi
pop esi
pop ebx
mov ax, 1
leave
ret 0x18

Function at 0xb24c25
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x14]
call fcn.00b24b96
pop ecx
pop ecx
xor ecx, ecx
cmp dword [ebp + 8], ecx
jbe 0xb24c60
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
sub esi, edi
mov edx, ecx
and edx, 3
mov dl, byte [ebp + edx + 0x14]
lea eax, [ecx + edi]
xor dl, byte [esi + eax]
inc ecx
cmp ecx, dword [ebp + 8]
mov byte [eax], dl
jb 0xb24c47
pop edi
pop esi
pop ebp
ret 0x10

Function at 0xb27a38
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x6677edf6
call fcn.00b58e26
sub esp, 0x1c
push esi
mov dword [ebp - 0x20], 0x6678ae00
mov byte [ebp - 0x14], 0x3f
mov dword [ebp - 0x28], 0x6678ae84
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
jbe 0xb27a96
mov ecx, dword [ebp + 0x10]
push esi
call fcn.00b2772c
mov al, byte [eax]
mov byte [ebp - 0x10], al
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
call dword [eax + 4]
lea ecx, [ebp - 0x28]
call fcn.00b261bb
xor al, byte [ebp + 0x18]
mov ecx, dword [ebp + 8]
xor al, byte [ebp + 0x14]
mov byte [esi + ecx], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0xb27a62
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x18