joyce8/EMBER2024-capa huggingface dataset:
Function at 0x785a72
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], 0x5e03b0
mov dword [eax + 4], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ecx
mov edx, 0x6833c0
mov dword [eax + 0x14], edx
mov byte [eax + 0x2a], cl
mov dword [eax + 0x2c], edx
mov dword [eax + 0x30], 1
mov byte [eax + 0x24], cl
mov byte [eax + 0x28], cl
mov byte [eax + 0x29], cl
mov byte [eax + 0x27], cl
mov byte [eax + 0x26], cl
mov dword [eax + 0x2c], edx
mov edx, dword [0x7626d4]
mov dword [eax + 0x30], 4
push esi
mov esi, dword fs:[0x2c]
mov edx, dword [esi + edx*4]
mov dword [eax + 0x18], ecx
mov byte [eax + 0x25], cl
mov dword [eax + 0x20], ecx
mov edx, dword [edx + 0xc]
mov esi, dword [edx + 0x14]
mov dword [eax + 0x1c], esi
mov dword [edx + 0x14], eax
mov edx, dword [edx + 0x5bc]
mov esi, dword [edx + 0x234]
cmp esi, ecx
je 0x785b0b
mov esi, dword [esi + 0xfc]
cmp esi, 2
je 0x785aff
cmp esi, 1
jne 0x785b0b
mov edx, dword [edx + 0x234]
inc dword [edx + 0xf4]
pop esi
ret

Function at 0x786d02
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5d50b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x20]
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.00785b12
xor eax, eax
push edi
mov dword [esp + 0x18], eax
mov dword [esi], 0x5e44e0
mov dword [esi + 0x34], eax
call fcn.00785812
push edi
mov dword [esi + 0x38], eax
call fcn.007858b2
mov dword [esi + 0x20], eax
mov cl, byte [edi + 0x26]
mov byte [esi + 0x26], cl
mov edx, dword [edi + 0x2c]
add esp, 8
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
push edi
mov ecx, esi
mov dword [esi + 0x30], eax
call fcn.00785972
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x789532
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5d53d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 4], esi
mov byte [esi + 4], al
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov dword [esi], 0x5e5280
mov ecx, dword [eax + 0x58]
mov dword [esi + 0xc], ecx
mov edx, dword [ecx]
call dword [edx + 0x30]
push eax
mov dword [esi + 0x10], eax
call fcn.0083d822
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], eax
add esp, 4
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x789548
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5d53d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 4], esi
mov byte [esi + 4], al
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov dword [esi], 0x5e5280
mov ecx, dword [eax + 0x58]
mov dword [esi + 0xc], ecx
mov edx, dword [ecx]
call dword [edx + 0x30]
push eax
mov dword [esi + 0x10], eax
call fcn.0083d822
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], eax
add esp, 4
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x7895a9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d53d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov byte [esi + 4], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x5e5288
mov dword [esi + 8], eax
mov eax, dword [eax + 0x20]
mov ecx, dword [ecx + 0x954]
cmp eax, ecx
mov dword [esp + 0x18], ebx
jb 0x7895da
mov eax, ecx
lea edi, [esi + 0xc]
push eax
mov ecx, edi
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
call fcn.0081f852
mov ecx, dword [esp + 0x10]
mov eax, 0x6833c0
mov dword [edi + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x798bf2
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push eax
push ecx
push ebp
call fcn.008478a2
mov ebx, eax
xor edi, edi
add esp, 0xc
cmp ebx, edi
jne 0x798cb4
cmp dword [esp + 0x18], edi
je 0x798cb4
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0x18]
add eax, 0x31
cmp ecx, edi
je 0x798cad
push 0x10
push eax
call fcn.008415b2
mov ebx, eax
add esp, 8
cmp ebx, edi
je 0x798cad
mov ecx, dword [0x7626d4]
lea edx, [ebx + 0x30]
mov dword [ebx], edx
mov eax, dword [esi + 4]
mov edx, dword fs:[0x2c]
mov dword [ebx + 4], eax
mov eax, dword [edx + ecx*4]
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], 2
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x12c0]
mov dword [ebx + 0x18], edi
mov edi, dword [ebx]
mov dword [ebx + 0x14], edx
mov ecx, dword [esi + 4]
mov esi, dword [esi]
inc ecx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.00847202
add esp, 8
test al, al
je 0x798cb4
push ebx
call fcn.00841642
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x7a844a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d6293
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.007a7dc2
mov eax, dword [esp + 0x24]
xor edi, edi
mov dword [esi], 0x5ef340
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], 0x6833c0
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
cmp ebp, edi
mov dword [esi + 0x84], edx
mov edx, dword [0x7626d4]
lea eax, [esi + 0x88]
mov dword [esi + 0x1e0], eax
mov eax, dword fs:[0x2c]
mov eax, dword [eax + edx*4]
mov dword [esi + 0x1e8], edi
mov dword [esi + 0x1f8], edi
mov dword [esi + 0x1e4], edi
mov dword [esi + 0x1ec], edi
mov dword [esi + 0x1f4], edi
mov dword [esi + 0x200], edi
mov dword [esi + 0x208], edi
mov dword [esi + 0x48], edi
mov edx, dword [eax + 0xc]
mov edx, dword [edx + 0x5bc]
mov edx, dword [edx + 0x234]
mov ecx, 1
mov dword [edx + 0x100], ecx
mov byte [esi + 0x29], cl
mov dword [esi + 0x1e8], edi
mov eax, dword [eax + 0xc]
mov byte [esp + 0x1c], cl
mov ecx, dword [eax + 0x9c8]
mov dword [esi + 0x1f0], ecx
mov edx, dword [ebx + 8]
mov dword [esi + 0x1f8], edx
je 0x7a853a
mov eax, dword [ebp]
jmp 0x7a853c
xor eax, eax
mov ecx, dword [esi + 0x1f8]
add ecx, eax
mov dword [esi + 0x44], ecx
add ecx, eax
shl ecx, 2
push ecx
mov dword [esi + 0x1f4], eax
call fcn.0083d7f2
add esp, 4
cmp eax, edi
mov dword [esi + 0x38], eax
je 0x7a85ba
mov edx, dword [esi + 0x44]
lea ecx, [eax + edx*4]
mov dword [esi + 0x1e8], ecx
mov ecx, eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
cmp edx, edi
je 0x7a8587
mov dword [ecx], edx
mov eax, dword [eax]
mov edx, dword [eax + 4]
add ecx, 4
cmp edx, edi
jne 0x7a8579
cmp dword [esi + 0x1f4], edi
je 0x7a85ba
mov eax, dword [ebp + 4]
cmp eax, edi
mov edx, dword [esi + 0x1e8]
je 0x7a85ba
lea ebx, [ebx]
mov dword [edx], eax
mov ebx, dword [eax + 4]
mov ebx, dword [ebx]
mov dword [ecx], ebx
mov dword [eax + 4], ecx
mov eax, dword [eax]
add edx, 4
add ecx, 4
cmp eax, edi
jne 0x7a85a2
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x7b9c22
Capabilities:
Terminate process

Disassembly:
sub esp, 0x200
push 0
push 0x75cf58
push 0x75cf58
call fcn.00849532
push 0
push 0x75cf58
push 0x75cf58
call fcn.0084fdd2
push 0x75cf58
call fcn.00916ed2
mov cl, byte [eax - 1]
add esp, 0x1c
cmp cl, 0x5c
je 0x7b9c66
mov byte [eax], 0x5c
mov byte [eax + 1], 0
push esi
push 0
push 0x75d2d0
push 0x75d2d0
call fcn.00849532
push 0
push 0x75ca70
push 0x75ca70
call fcn.00849532
push 0x5df350
push 0x75cf58
push 0x75cf58
call fcn.0084fca2
push 0x75cf58
push 0x75d2d0
push 0x75d2d0
call fcn.0084fca2
push 0x75d2d0
push 0x75c510
push 0x75c510
call fcn.0084fca2
mov eax, 0x5f937c
call fcn.007b9b52
mov esi, eax
push esi
call fcn.0084fb62
add esp, 0x40
test eax, eax
je 0x7b9cf3
push 0x1ff
lea eax, [esp + 8]
push esi
push eax
call fcn.00916ea2
add esp, 0xc
jmp 0x7b9d0d
push 0
push esi
push 0x75cf58
lea ecx, [esp + 0x10]
push 0x1ff
push ecx
call fcn.00916e32
add esp, 0x14
lea edx, [esp + 4]
push 0
push edx
mov eax, edx
push eax
call fcn.00849532
lea ecx, [esp + 0x10]
push ecx
push 0x75ca70
push 0x75ca70
call fcn.0084fca2
mov eax, dword [0x75fa1c]
mov esi, 0x75c2f0
add esp, 0x18
cmp eax, esi
je 0x7b9d5b
push 0
push 0x5f9370
lea edx, [esp + 0xc]
push edx
push 0x1ff
push esi
call fcn.00916e32
add esp, 0x14
lea eax, [esp + 4]
push eax
push esi
push esi
call fcn.0084fca2
mov ecx, dword [0x75bef8]
push ecx
push 0x75d258
mov dword [0x75fa1c], esi
call fcn.00846442
add esp, 0x14
test al, al
pop esi
je 0x7b9d8d
push 1
call fcn.00924238
mov eax, dword [0x75f530]
test eax, eax
jne 0x7b9dbe
push 8
push 0x75d258
call fcn.00846562
add esp, 4
push eax
call fcn.008416a2
add esp, 8
test eax, eax
mov dword [0x75f530], eax
jne 0x7b9dbe
push 1
call fcn.00924238
add esp, 0x200
ret
Function at 0x7b9d96
Capabilities:
Terminate process

Disassembly:
sub esp, 0x200
push 0
push 0x75cf58
push 0x75cf58
call fcn.00849532
push 0
push 0x75cf58
push 0x75cf58
call fcn.0084fdd2
push 0x75cf58
call fcn.00916ed2
mov cl, byte [eax - 1]
add esp, 0x1c
cmp cl, 0x5c
je 0x7b9c66
mov byte [eax], 0x5c
mov byte [eax + 1], 0
push esi
push 0
push 0x75d2d0
push 0x75d2d0
call fcn.00849532
push 0
push 0x75ca70
push 0x75ca70
call fcn.00849532
push 0x5df350
push 0x75cf58
push 0x75cf58
call fcn.0084fca2
push 0x75cf58
push 0x75d2d0
push 0x75d2d0
call fcn.0084fca2
push 0x75d2d0
push 0x75c510
push 0x75c510
call fcn.0084fca2
mov eax, 0x5f937c
call fcn.007b9b52
mov esi, eax
push esi
call fcn.0084fb62
add esp, 0x40
test eax, eax
je 0x7b9cf3
push 0x1ff
lea eax, [esp + 8]
push esi
push eax
call fcn.00916ea2
add esp, 0xc
jmp 0x7b9d0d
push 0
push esi
push 0x75cf58
lea ecx, [esp + 0x10]
push 0x1ff
push ecx
call fcn.00916e32
add esp, 0x14
lea edx, [esp + 4]
push 0
push edx
mov eax, edx
push eax
call fcn.00849532
lea ecx, [esp + 0x10]
push ecx
push 0x75ca70
push 0x75ca70
call fcn.0084fca2
mov eax, dword [0x75fa1c]
mov esi, 0x75c2f0
add esp, 0x18
cmp eax, esi
je 0x7b9d5b
push 0
push 0x5f9370
lea edx, [esp + 0xc]
push edx
push 0x1ff
push esi
call fcn.00916e32
add esp, 0x14
lea eax, [esp + 4]
push eax
push esi
push esi
call fcn.0084fca2
mov ecx, dword [0x75bef8]
push ecx
push 0x75d258
mov dword [0x75fa1c], esi
call fcn.00846442
add esp, 0x14
test al, al
pop esi
je 0x7b9d8d
push 1
call fcn.00924238
mov eax, dword [0x75f530]
test eax, eax
jne 0x7b9dbe
push 8
push 0x75d258
call fcn.00846562
add esp, 4
push eax
call fcn.008416a2
add esp, 8
test eax, eax
mov dword [0x75f530], eax
jne 0x7b9dbe
push 1
call fcn.00924238
add esp, 0x200
ret

Function at 0x7b9fb2
Capabilities:
Terminate process

Disassembly:
sub esp, 0x18
push esi
push 0x10
push 0x201
push 0x1b4
push 0x75c510
call fcn.00844d82
mov esi, eax
add esp, 0x10
test esi, esi
jl 0x7ba01c
lea eax, [esp + 4]
push 0xa
push eax
call fcn.00938102
push eax
call fcn.00918022
lea ecx, [esp + 0x10]
mov byte [eax], 0xa
sub eax, ecx
push 0x14
inc eax
push eax
mov edx, ecx
push edx
push esi
call fcn.00844c12
add esp, 0x1c
test eax, eax
push 0
push esi
jne 0x7ba014
call fcn.00844022
add esp, 8
pop esi
add esp, 0x18
ret
call fcn.00844022
add esp, 8
push 0x5f93b8
call fcn.007b05f2
add esp, 4
push 1
call fcn.00924238
int3

Function at 0x7ba362
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x7ba3a9
push 0x5f93f4
call fcn.007b0932
add esp, 4
mov eax, 1
push eax
call fcn.007b8e92
call fcn.007b90a2
call fcn.007b90d2
mov eax, dword [0x75d6c4]
neg eax
sbb eax, eax
and eax, 3
push eax
call fcn.00843c92
add esp, 8
push esi
call fcn.00924238
pop esi
mov al, byte [0x75ca28]
test al, al
je 0x7ba378
xor eax, eax
jmp 0x7ba37d
Function at 0x7bb922
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x75d704]
push 0x10
push 0x20
push eax
call fcn.00843872
add esp, 0xc
test eax, eax
mov dword [0x67eb20], eax
jne 0x7bb944
push 1
call fcn.00924238
mov ecx, dword [0x75ca2c]
test ecx, ecx
jne 0x7bb957
mov ecx, dword [eax + 0x14]
mov dword [0x75ca2c], ecx
call fcn.007b9b02
mov edx, dword [0x75fa5c]
push 0x5f9b7c
push 0x5f9b74
push 0x5f9b6c
push 0x75ca34
push edx
push 0x5f9b4c
call fcn.00926cd6
push 0x5f9f00
call fcn.00926d3c
mov eax, dword [0x75fa5c]
push eax
push 0x5f9ee8
call fcn.00926cd6
mov eax, dword [0x75d7b4]
add esp, 0x24
test eax, eax
jne 0x7bb9b5
push 0x5f9ea0
call fcn.00926d3c
add esp, 4
ret
push 0x5f9c10
call fcn.00926d3c
push 0x5df350
call fcn.00926d3c
push 0x66fb30
push 0x5df5d4
call fcn.00841f12
push 0x5df350
call fcn.00926d3c
call fcn.007b9c22
call fcn.007b91c2
push 0x66fb48
call fcn.00850462
push 0x66fb48
call fcn.008506a2
push 0x5f9b98
call fcn.00926d3c
add esp, 0x20
ret
Function at 0x7bd022
Capabilities:
Terminate process

Disassembly:
push 0x455430
call fcn.008500f2
push 0xe
push 0x67ee8c
push 0x75d4dc
call fcn.00916ea2
push 0x4579d0
push 0x66fb48
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [0x67ed2c], 0x4554b0
call fcn.00850a32
add esp, 0x20
test eax, eax
je 0x7bd06d
push eax
call fcn.00924238
mov al, byte [0x75d6e8]
test al, al
je 0x7bd083
push 0x5fa47c
call fcn.007b0982
add esp, 4
mov al, byte [0x75c958]
test al, al
je 0x7bd099
push 0x5fa448
call fcn.007b0982
add esp, 4
mov al, byte [0x75d6c9]
test al, al
je 0x7bd0af
push 0x5fa418
call fcn.007b0982
add esp, 4
mov al, byte [0x75d7d4]
test al, al
jne 0x7bd0c1
mov al, byte [0x75d7d3]
test al, al
je 0x7bd0d7
mov eax, dword [0x75d4ec]
test eax, eax
jne 0x7bd0d7
push 0x5fa3a0
call fcn.007b0982
add esp, 4
mov edx, dword [0x75bff0]
push edx
call fcn.007804e2
add esp, 4
test al, al
jne 0x7bd11d
mov al, byte [0x75ca28]
test al, al
jne 0x7bd113
mov eax, dword [0x75bff0]
push eax
call fcn.007804b2
push eax
push 0x5fa370
call fcn.007b0932
add esp, 0xc
push 1
call fcn.00924238
mov dword [0x75bff0], 9
mov eax, dword [esp + 4]
test eax, eax
jle 0x7bd14b
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
mov eax, dword [0x75fa5c]
push edx
push eax
push 0x5fa310
push 0x75a7d0
call fcn.00924278
add esp, 0x10
push 1
call fcn.00924238
mov eax, dword [0x75d7b0]
test eax, eax
je 0x7bd160
call fcn.007bb922
push 0
call fcn.00924238
mov al, byte [0x75d7cb]
test al, al
mov byte [0x75fa54], 0
mov byte [0x7606fb], 1
mov dword [0x75c0cc], 1
je 0x7bd199
mov ecx, dword [0x75c9f0]
and ecx, 0xfffffeff
or ecx, 0x600
mov dword [0x75c9f0], ecx
push 2
push 0
call fcn.007c92e2
call fcn.007b9c22
mov al, byte [0x75d6c8]
mov ecx, dword [0x75bf84]
mov edx, dword [0x75bfe4]
test al, al
sete al
mov byte [0x7607aa], al
mov byte [0x7606f8], al
mov eax, dword [0x75bf80]
mov dword [0x67ee1c], ecx
mov ecx, dword [0x75bf58]
mov dword [0x67ebb4], edx
mov edx, dword [0x75bf78]
mov dword [0x67ee18], eax
mov eax, dword [0x75bf7c]
push ecx
mov dword [0x67ee10], edx
mov dword [0x67ee14], eax
call fcn.00849402
mov ecx, eax
mov al, byte [0x75d7d2]
mov edx, 1
shl edx, cl
add esp, 0xc
test al, al
mov dword [0x67ee04], edx
je 0x7bd224
or dword [0x75d750], 0x400
mov al, byte [0x75d7d3]
test al, al
je 0x7bd237
or dword [0x75d750], 0x1000
push 0x75c054
push 0
call fcn.007b9522
add esp, 8
test eax, eax
jne 0x7bd270
push 0x75c05c
push 2
call fcn.007b9522
add esp, 8
test eax, eax
jne 0x7bd270
push 0x75c058
push 1
call fcn.007b9522
add esp, 8
test eax, eax
je 0x7bd277
push 1
call fcn.00924238
ret
Function at 0x7c4b42
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
push edi
je 0x7c4c97
cmp byte [esi], 0
je 0x7c4c8a
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [edi + 8]
mov dword [esp + 0x10], eax
mov eax, esi
mov dword [esp + 0x14], ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x7c4b78
sub eax, ecx
push eax
lea ecx, [esp + 0x24]
push esi
push ecx
call fcn.007c4a72
push 8
lea edx, [esp + 0x28]
push edi
push edx
call fcn.007c4a72
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
xor eax, ecx
xor edx, edx
mov ecx, 0x3fffffff
div ecx
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
xor eax, edi
add esp, 0x18
mov esi, edx
xor edx, edx
div ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov edi, edx
jae 0x7c4c32
sub eax, ecx
mov dword [esp + 0x10], eax
lea eax, [edi + esi*2]
add eax, esi
xor edx, edx
mov ecx, 0x3fffffff
div ecx
mov esi, edx
lea eax, [edi + esi + 0x21]
xor edx, edx
div ecx
test esi, esi
mov dword [esp + 0x18], esi
fild dword [esp + 0x18]
mov edi, edx
jge 0x7c4bff
fadd qword [0x5e0280]
fmul qword [0x5fac58]
sub esp, 8
fmul qword [0x5fac50]
fstp qword [esp]
call fcn.009245f2
fadd qword [0x5fac48]
add esp, 8
call fcn.009247a2
mov byte [ebx], al
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
jne 0x7c4bd3
lea eax, [edi + esi*2]
add eax, esi
xor edx, edx
mov ecx, 0x3fffffff
div ecx
test edx, edx
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
jge 0x7c4c52
fadd qword [0x5e0280]
fmul qword [0x5fac58]
sub esp, 8
fmul qword [0x5fac50]
fstp qword [esp]
call fcn.009245f2
add esp, 8
call fcn.009247a2
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x7c4c80
xor byte [ecx], al
inc ecx
cmp ecx, ebx
jne 0x7c4c79
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7c50e2
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
lea eax, [esp + 0x28]
push esi
push eax
call fcn.0084ce32
mov edx, dword [esp + 0xa4]
mov eax, edx
add esp, 4
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7c5102
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x34]
push ecx
call fcn.0084d662
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.0084d602
lea ecx, [esp + 0x40]
push ecx
call fcn.0084ce32
push 0x14
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.0084d662
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.0084d602
lea eax, [esp + 0x58]
push eax
call fcn.0084ce32
mov ecx, dword [esp + 0xcc]
push 0x14
push ecx
lea edx, [esp + 0x64]
push edx
call fcn.0084d662
push 0x14
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x70]
push ecx
call fcn.0084d662
mov esi, dword [esp + 0xe0]
add esp, 0x48
lea edx, [esp + 0x2c]
push esi
push edx
call fcn.0084d602
lea ecx, [esi + 0x14]
add esp, 8
cmp esi, ecx
mov eax, esi
jae 0x7c51b8
push ebx
push edi
lea edi, [esp + 0xc]
sub edi, esi
mov bl, byte [eax]
mov dl, byte [edi + eax]
xor bl, dl
mov byte [eax], bl
inc eax
cmp eax, ecx
jb 0x7c51a8
pop edi
pop ebx
pop esi
add esp, 0x90
ret
Function at 0x7cc64a
Capabilities:
Terminate process

Disassembly:
push ecx
push 0
push 0x7d0
push 0
push 0x75f500
call fcn.0084efb2
add esp, 0x10
test al, al
je 0x7cc676
push 0x5fbe64
push 0x75a7d0
call fcn.00924278
add esp, 8
push 1
call fcn.00924238
mov ecx, dword [0x75d678]
push ebx
push esi
mov esi, dword [esp + 0x10]
mov dword [0x75f524], 1
mov eax, dword [ecx + 0x20]
push edi
movzx edi, byte [esi]
mov bl, byte [edi + eax + 1]
mov dl, 8
test dl, bl
je 0x7cc6af
jmp 0x7cc6a2
movzx edi, byte [esi + 1]
mov bl, byte [edi + eax + 1]
inc esi
test dl, bl
jne 0x7cc6a2
mov eax, dword [ecx + 0x60]
push 0
mov ebx, 4
push ebx
push 0x5fbe60
push ebx
push esi
push ecx
call dword [eax + 4]
add esp, 0x18
test eax, eax
jne 0x7cc6de
push 0x75f500
call fcn.0084f1d2
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
cmp byte [esi], 0
je 0x7cc748
lea ecx, [esp + 0xc]
push ecx
push 0x7fffffff
push 0
push 0xa
push esi
call fcn.0091a132
mov esi, eax
add esp, 0x14
test esi, esi
je 0x7cc748
mov eax, dword [esp + 0xc]
cmp eax, 0x7d0
jge 0x7cc719
push eax
push 0x75f500
call fcn.0084f052
add esp, 8
mov edx, dword [0x75d678]
mov ecx, dword [edx + 0x20]
mov al, byte [esi]
movzx edx, al
test byte [edx + ecx + 1], bl
jne 0x7cc743
jmp 0x7cc732
test al, al
je 0x7cc748
mov al, byte [esi + 1]
inc esi
movzx edx, al
test byte [edx + ecx + 1], bl
je 0x7cc732
cmp byte [esi], 0
jne 0x7cc6e3
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x7cca52
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x7cca65
push ebx
call dword [fcn.005df07c]
mov eax, dword [0x75d540]
test eax, eax
jne 0x7ccaa1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x7cca7f
push eax
call fcn.0084c2e2
add esp, 4
test ebx, ebx
je 0x7cca8a
push ebx
call dword [fcn.005df0b0]
push 0x5fbed8
call fcn.007b0932
add esp, 4
mov eax, 0x4b0
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x20]
cmp dword [eax], 0
je 0x7ccad0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x7ccabb
push eax
call fcn.0084c2e2
add esp, 4
test ebx, ebx
je 0x7ccac6
push ebx
call dword [fcn.005df0b0]
mov eax, 0x4ae
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
test eax, eax
mov edx, dword [ecx]
mov dword [esp + 4], edx
je 0x7ccaf1
push 0xffffffffffffffff
push 0x75cf38
call fcn.0084c332
add esp, 8
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x75cf38
push edx
call fcn.0084f7e2
add esp, 0x10
test eax, eax
je 0x7ccb26
test ebx, ebx
je 0x7ccb1c
push ebx
call dword [fcn.005df0b0]
mov eax, 0x4b2
pop ebx
add esp, 8
ret
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
push esi
push edi
je 0x7ccbb7
mov edi, dword [esp + 0x24]
test edi, edi
je 0x7ccbb7
mov eax, dword [0x7626d4]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov ecx, dword [esp + 0x30]
mov esi, dword [edx + 0xc]
mov eax, dword [esp + 0x10]
cmp eax, dword [ecx]
jne 0x7ccbb7
lea esp, [esp]
mov ebx, dword [esi + 0x10a8]
mov edx, dword [esi + 0x1114]
mov dword [edx + 0x24], edi
mov eax, dword [esi + 0x1114]
mov dword [eax + 0x28], ebp
push edi
push ebp
mov dword [esi + 0x10a8], 0x5fbeb4
call fcn.0084c1e2
add esp, 8
push ebx
mov ecx, esi
call fcn.007aeba2
push edi
call dword [fcn.005df07c]
mov al, byte [esi + 0x1398]
test al, al
jne 0x7ccbcc
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
cmp ecx, dword [edx]
je 0x7ccb62
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x7ccbc2
push ebx
call dword [fcn.005df0b0]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, 0x41d
pop ebx
add esp, 8
ret
Function at 0x7d7312
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5d6ce8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
lea eax, [esp + 8]
mov ebx, edx
mov dword [esp + 0xc], eax
mov eax, 2
push esi
xor edx, edx
push edi
xor ebp, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0x684398
mov eax, dword [ecx + 4]
mov ecx, dword [eax + ebx*4]
cmp ecx, edx
lea esi, [eax + ebx*4]
mov dword [esp + 0x30], edx
mov edi, 1
je 0x7d73b6
lea esp, [esp]
mov edx, dword [ecx]
call dword [edx + 0x54]
cmp eax, 0xf7
jne 0x7d73b4
mov ecx, dword [esi]
mov eax, dword [ecx + 0x64]
cmp dword [eax], 2
jne 0x7d73b4
mov edx, dword [ecx]
lea eax, [esp + 0x14]
push eax
push eax
call dword [edx + 0x1c]
mov ecx, dword [esp + 0x14]
movzx edx, byte [ecx]
mov eax, dword [0x6843c0]
cmp byte [edx + eax], 0x59
jne 0x7d73a7
or ebp, edi
mov ecx, dword [esi + 4]
add esi, 4
inc ebx
shl edi, 1
test ecx, ecx
jne 0x7d7372
xor edx, edx
mov eax, dword [esp + 0x38]
cmp eax, edx
je 0x7d73c0
mov dword [eax], ebx
cmp dword [esp + 0x20], edx
je 0x7d73db
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], edx
call fcn.00841642
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret