joyce8/EMBER2024-capa huggingface dataset:
Function at 0x774a27d6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
push dword [ebp + 0x20]
mov eax, dword [esi]
mov dword [ebp + 0x18], eax
mov eax, ebx
and al, 8
movzx eax, al
neg eax
sbb eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
dec dword [eax]
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
push eax
call fcn.774a2b9a
mov edi, dword [ebp + 0x24]
pop ecx
pop ecx
mov ecx, ebx
and ecx, 0x10
mov dword [ebp + 8], ecx
jne 0x774a281e
dec edi
mov ecx, ebx
and ecx, 1
mov dword [ebp + 0x24], ecx
test ecx, ecx
je 0x774a283b
mov ecx, dword [ebp + 0x1c]
mov eax, ecx
dec ecx
mov dword [ebp + 0x1c], ecx
test eax, eax
je 0x774a2961
mov eax, dword [ebp + 0x14]
push dword [ebp + 0x20]
inc dword [eax]
call fcn.774a340a
pop ecx
movzx ecx, ax
mov edx, 0xffff
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov word [eax], cx
cmp dx, cx
je 0x774a294b
cmp dword [ebp + 8], 0
jne 0x774a28b9
test bl, 0x20
je 0x774a287d
cmp ecx, 9
jb 0x774a2878
cmp ecx, 0xd
jbe 0x774a287d
cmp ecx, 0x20
jne 0x774a28b9
test bl, 0x40
je 0x774a294b
mov ax, cx
shr ax, 3
movzx eax, ax
cmp cx, ax
jb 0x774a294b
xor edx, edx
and ecx, 7
inc edx
shl edx, cl
mov ecx, dword [ebp + 0xc]
movsx eax, byte [eax + ecx]
xor eax, dword [ebp - 4]
test eax, edx
je 0x774a294b
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
test bl, 4
jne 0x774a2923
test edi, edi
je 0x774a292f
test bl, 2
je 0x774a28d2
mov eax, dword [esi]
mov word [eax], cx
add dword [esi], 2
dec edi
jmp 0x774a2927
mov al, byte [eax]
cmp edi, dword [0x77535854]
jb 0x774a28e7
mov ecx, dword [esi]
mov byte [ecx], al
mov eax, dword [esi]
movsx eax, byte [eax]
jmp 0x774a290f
mov byte [ebp - 0x10], al
movsx eax, al
mov dword [ebp - 8], eax
test eax, eax
jle 0x774a28f8
cmp eax, edi
ja 0x774a292f
cmp eax, 5
ja 0x774a292f
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call fcn.774987e0
mov eax, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [ebp + 0x24]
test eax, eax
jle 0x774a2826
add dword [esi], eax
sub edi, eax
jmp 0x774a2826
add dword [ebp + 0x18], 2
mov ecx, dword [ebp + 0x24]
jmp 0x774a2826
mov eax, dword [ebp + 0x18]
test bl, 2
je 0x774a2946
xor ecx, ecx
mov word [eax], cx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax], 0
jmp 0x774a293c
mov eax, dword [ebp + 0x14]
push dword [ebp + 0x20]
dec dword [eax]
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
push eax
call fcn.774a2b9a
pop ecx
pop ecx
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi]
je 0x774a293c
test bl, 4
jne 0x774a2989
mov eax, dword [ebp + 0x28]
inc dword [eax]
cmp dword [ebp + 8], 0
jne 0x774a2989
mov eax, dword [esi]
test bl, 2
je 0x774a2986
xor ecx, ecx
mov word [eax], cx
jmp 0x774a2989
mov byte [eax], 0
xor eax, eax
jmp 0x774a293f
Function at 0x774ca119
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
push 0x3d
push esi
mov dword [ebp - 0x14], edi
call fcn.7749a580
pop ecx
pop ecx
test eax, eax
je 0x774ca28e
xor ecx, ecx
mov word [eax], cx
movzx ecx, word [esi]
cmp ecx, 0x53
jne 0x774ca15f
add eax, 2
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.77494f40
xor bl, bl
jmp 0x774ca187
cmp ecx, 0x4f
jne 0x774ca28e
push 0x10
lea ecx, [ebp - 0x1c]
add eax, 2
push ecx
push eax
call fcn.7749ab40
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
je 0x774ca28e
mov bl, 1
mov ecx, edi
call fcn.774ca2fa
mov edi, eax
test edi, edi
je 0x774ca28e
movzx esi, word [edi + 0x14]
xor eax, eax
add esi, 0x18
xor ecx, ecx
add esi, edi
cmp ax, word [edi + 6]
mov dword [ebp - 4], ecx
jae 0x774ca28a
cmp dword [esi + 0xc], 0
push 8
pop edx
je 0x774ca27b
cmp dword [esi + 8], 0
je 0x774ca27b
test bl, bl
jne 0x774ca21a
xor ecx, ecx
mov dword [ebp - 0x20], esi
mov word [ebp - 0x22], dx
mov word [ebp - 0x24], cx
movzx eax, cx
cmp byte [eax + esi], 0
je 0x774ca1ee
inc cx
mov word [ebp - 0x24], cx
cmp cx, dx
jb 0x774ca1da
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.7745f750
test eax, eax
js 0x774ca28e
push 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.7746f2e0
test eax, eax
je 0x774ca222
jmp 0x774ca26f
lea eax, [ecx + 1]
cmp dword [ebp - 8], eax
jne 0x774ca26b
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
call fcn.77492e60
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
push 0x7742cb48
push 3
push 0x55
call fcn.77445380
add esp, 0x1c
test bl, bl
jne 0x774ca28a
mov ecx, dword [ebp - 4]
test bl, bl
jne 0x774ca27b
lea eax, [ebp - 0x2c]
push eax
call fcn.77461410
mov ecx, dword [ebp - 4]
movzx eax, word [edi + 6]
inc ecx
add esi, 0x28
cmp ecx, eax
jmp 0x774ca1a9
mov al, 1
jmp 0x774ca290
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x774ca2fa
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x775204b8
call fcn.774a611c
xor edx, edx
test ecx, ecx
je 0x774ca356
cmp ecx, 0xffffffff
je 0x774ca356
mov dword [ebp - 4], edx
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x774ca34f
mov eax, dword [ecx + 0x3c]
test eax, eax
js 0x774ca34f
cmp eax, 0x10000000
jae 0x774ca34f
add eax, ecx
mov dword [ebp - 0x1c], eax
mov edx, dword [eax]
sub edx, 0x4550
neg edx
sbb edx, edx
not edx
and edx, eax
jmp 0x774ca34c
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xfffffffe
mov eax, edx
call fcn.774a6161
ret
Function at 0x774cd713
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x7753d344]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push dword [0x77537bb8]
mov edi, dword [ebp + 8]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebx
call fcn.77482b10
mov esi, eax
lea eax, [esp + 0x18]
test esi, esi
je 0x774cd762
push eax
mov ecx, esi
call dword [0x775391d0]
call esi
jmp 0x774cd76d
push 0x77424bee
push eax
call fcn.774fc450
cmp eax, 0xffffffff
je 0x774cd840
lea eax, [esp + 0x10]
xor esi, esi
push eax
push esi
push esi
push 0x7742c920
call fcn.77472510
test eax, eax
jne 0x774cd80a
mov eax, dword fs:[0x30]
push 2
mov edx, dword [eax + 0x10]
mov ax, word [edx + 0x38]
and dword [esp + 0x80], 0
shr ax, 1
mov word [esp + 0x10], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x78], esi
pop esi
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], esi
mov eax, dword [edx + 0x3c]
movzx ecx, word [edx + 0x38]
and dword [esp + 0x84], 0
and dword [esp + 0x8c], 0
mov dword [esp + 0x80], eax
lea eax, [esp + 0x70]
push eax
push esi
push 0x7742c8f0
push dword [esp + 0x20]
mov dword [esp + 0x98], ecx
push dword [esp + 0x20]
call fcn.7747fef0
xor esi, esi
push esi
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.77478380
mov eax, dword [ebx + 0xb8]
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 4]
or eax, 1
mov dword [esp + 0x20], 0xc000041d
push esi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push ebx
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], esi
call fcn.77493ef0
push eax
call fcn.774a6fb0
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.77494a40
mov esp, ebp
pop ebp
ret 8

Function at 0x774ce812
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
xor ecx, ecx
mov dword [0x7753861c], ecx
mov dword [0x77538620], ecx
mov byte [eax], cl
cmp byte [eax + 2], cl
je 0x774ce832
call fcn.774ce7d0
xor eax, eax
ret
Function at 0x774cf4a6
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x7753d344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 4
push 0x774280a0
mov edi, dword [ebx + 4]
push edi
call fcn.7749a6d0
add esp, 0xc
test eax, eax
jne 0x774cf618
mov esi, 0x7ffe0030
add edi, 8
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x774cf4e8
sub esi, ecx
sar esi, 1
push esi
push 0x7ffe0030
push edi
call fcn.774979e0
add esp, 0xc
test eax, eax
jne 0x774cf618
push 0xa
lea edi, [edi + esi*2]
push 0x7742dea8
push edi
call fcn.774979e0
add esp, 0xc
xor esi, esi
test eax, eax
jne 0x774cf52a
inc esi
jmp 0x774cf542
push 0xa
push 0x7742dec0
push edi
call fcn.774979e0
add esp, 0xc
test eax, eax
jne 0x774cf618
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 0x1000000
mov dword [ebp - 0x10c], eax
lea ecx, [ebp - 0x110]
xor eax, eax
mov edx, ebx
mov word [ebp - 0x108], ax
call fcn.7745df44
test eax, eax
js 0x774cf61a
neg esi
lea eax, [ebp - 0x110]
push 1
sbb esi, esi
mov edi, 0x3a64
and esi, 0xfffffeb5
add esi, 0x14c
push edi
movzx esi, si
push esi
push eax
call fcn.77485f50
xor ecx, ecx
mov dword [ebp - 0x150], 0x18
push 0x40
mov dword [ebp - 0x14c], ecx
pop eax
cmp byte [0x77537bd4], cl
jne 0x774cf5c0
mov eax, 0x840
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x140], ecx
push eax
mov dword [ebp - 0x13c], ecx
call fcn.77492d30
test eax, eax
js 0x774cf5ff
push 1
push edi
push esi
push ebx
call fcn.77485f50
lea eax, [ebp - 0x108]
cmp eax, dword [ebp - 0x10c]
je 0x774cf618
push dword [ebp - 0x10c]
call fcn.77447800
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.77494a40
mov esp, ebp
pop ebp
ret

Function at 0x774cfaf0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
push ebx
add edx, eax
xor ebx, ebx
movzx eax, word [ecx + 6]
mov dword [ebp - 4], eax
push esi
mov esi, ebx
push edi
mov edi, dword [ecx + 0x28]
test eax, eax
je 0x774cfb3e
mov eax, dword [edx + 8]
test eax, eax
je 0x774cfb28
mov ecx, dword [edx + 0xc]
cmp edi, ecx
jb 0x774cfb28
add eax, ecx
cmp edi, eax
jb 0x774cfb33
add edx, 0x28
inc esi
cmp esi, dword [ebp - 4]
jb 0x774cfb14
jmp 0x774cfb3e
test dword [edx + 0x24], 0x20000000
je 0x774cfb3e
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x774d3fac
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
jne 0x774d3fc1
cmp byte [0x7ffe02d4], 0
je 0x774d3fd9
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0x68]
mov eax, dword fs:[0x30]
or ecx, 0x10000
mov dword [eax + 0x68], ecx
mov al, 1
ret
Function at 0x774d8110
Capabilities:
Get process heap flags

Disassembly:
push 0x68
push 0x775207a0
call fcn.774a6178
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
movzx eax, byte [0x775358c0]
shr eax, 2
and eax, 1
je 0x774d82d2
push dword [ebx + 4]
call fcn.774867c0
test eax, eax
je 0x774d82d2
cmp eax, 3
je 0x774d82d2
cmp eax, 5
je 0x774d82d2
xor edi, edi
push edi
push edi
push edi
lea eax, [ebp - 0x5c]
push eax
push edi
push ebx
xor dl, dl
xor cl, cl
call fcn.77463420
mov esi, eax
test esi, esi
js 0x774d81b5
mov dword [ebp - 0x74], 0x18
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], 0x40
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.77492d30
mov esi, eax
push dword [ebp - 0x58]
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.77461440
mov eax, esi
not eax
test eax, eax
js 0x774d81c4
mov eax, esi
jmp 0x774d82d7
movzx eax, word [ebx]
add eax, 0xa
push eax
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.77463940
mov esi, eax
mov dword [ebp - 0x54], esi
test esi, esi
jne 0x774d81ed
mov eax, 0xc0000017
jmp 0x774d82d7
movzx eax, word [ebx]
push eax
push dword [ebx + 4]
lea eax, [esi + 0xa]
push eax
call fcn.774987e0
add esp, 0xc
mov ax, word [ebx]
mov word [esi + 8], ax
push 0x77538630
call fcn.77466460
mov dword [ebp - 4], edi
movzx ecx, word [ebx]
movzx eax, word [0x77535740]
add eax, 2
add eax, ecx
mov dword [ebp - 0x78], eax
cmp eax, 0xfffe
jbe 0x774d824a
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x7753d344
call fcn.77496e10
add esp, 0xc
mov eax, 0xc0000106
jmp 0x774d82d7
mov word [0x77535740], ax
mov eax, dword [0x77535738]
mov ecx, 0x77535738
cmp dword [eax + 4], ecx
je 0x774d8264
push 3
pop ecx
int 0x29
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [eax + 4], esi
mov dword [0x77535738], esi
mov dword [ebp - 4], 0xfffffffe
mov ebx, dword [ebp - 0x50]
call fcn.774d82c7
push 0x77538628
call fcn.77466460
mov ecx, 0x77536e48
call fcn.77483522
mov dword [ebp - 0x4c], eax
push 0x77538628
call fcn.77468f20
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x774d82b9
push eax
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.77461440
mov dword [ebx], esi
xor eax, eax
jmp 0x774d82d7
mov eax, 0xc000000d
call fcn.774a61c0
ret 8
Function at 0x774daee9
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x30]
push ebx
push esi
movzx esi, word [ebp + 8]
push edi
push esi
push 8
push dword [eax + 0x18]
mov dword [ebp - 8], edx
mov edi, ecx
call fcn.77463940
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x774db02f
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 2
push edi
push 0xffffffffffffffff
call fcn.77492b90
mov edi, eax
test edi, edi
js 0x774daf7e
mov ecx, dword [ebx + 4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x774daf39
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0xc], ecx
cmp ecx, esi
jae 0x774db025
mov esi, dword [ebp - 8]
push ecx
push dword [ebx + 4]
push esi
call fcn.774987e0
push 0x5c
push esi
call fcn.7749a7e0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x774daf9f
mov edi, 0xc0000039
xor eax, eax
test ebx, ebx
je 0x774daf94
push ebx
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call fcn.77461440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
add esi, 2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x774dafa7
sub ecx, edx
sar ecx, 1
add ecx, ecx
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
je 0x774daffa
lea eax, [ecx + 2]
push eax
mov eax, dword fs:[0x30]
push 8
push dword [eax + 0x18]
call fcn.77463940
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x774dafe6
mov edi, 0xc0000017
jmp 0x774daf7e
mov ecx, dword [ebp - 4]
add ecx, 2
push ecx
push esi
push eax
call fcn.774987e0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x774db003
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x774db012
sub esi, dword [ebp - 8]
and esi, 0xfffffffe
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x774daf7e
mov byte [eax], 1
jmp 0x774daf7e
mov edi, 0x80000005
jmp 0x774daf7e
mov edi, 0xc0000017
jmp 0x774daf80
Function at 0x774dce1b
Capabilities:
Get process heap flags

Disassembly:
push 0x6c
push 0x77520860
call fcn.774a6178
mov esi, ecx
push 0x3a
pop ecx
mov word [ebp - 0x50], cx
push 0x3c
pop eax
mov word [ebp - 0x4e], ax
mov dword [ebp - 0x4c], 0x77431edc
push 0x38
pop eax
mov word [ebp - 0x58], ax
mov word [ebp - 0x56], cx
mov dword [ebp - 0x54], 0x77431f18
call fcn.77461a00
test eax, eax
je 0x774dce6a
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0x50]
add ecx, 0x22b
jmp 0x774dce6f
mov ecx, 0x7ffe0385
test byte [ecx], 1
je 0x774dcea1
call fcn.77461a00
mov ebx, 0x7ffe0384
test eax, eax
je 0x774dce92
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x50]
add eax, 0x22a
jmp 0x774dce94
mov eax, ebx
movzx edx, byte [eax]
lea ecx, [ebp - 0x50]
call fcn.774db2a0
jmp 0x774dcea6
mov ebx, 0x7ffe0384
test esi, esi
jne 0x774dceb4
mov edi, 0xc000000d
jmp 0x774dcf68
xor edi, edi
mov dword [ebp - 4], edi
push esi
call fcn.774867c0
mov dword [ebp - 0x7c], eax
mov dword [ebp - 4], 0xfffffffe
cmp eax, 1
je 0x774dced8
cmp eax, 2
je 0x774dced8
cmp eax, 6
jne 0x774dceaa
push edi
push edi
lea eax, [ebp - 0x60]
push eax
push esi
call fcn.77475b70
test al, al
jne 0x774dceef
mov edi, 0xc000003a
jmp 0x774dcf68
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0x78], 0x18
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x6c], 0x40
lea eax, [ebp - 0x60]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.77492d30
mov edi, eax
push esi
push 0
mov ecx, dword fs:[0x30]
push dword [ecx + 0x18]
call fcn.77461440
test edi, edi
js 0x774dcf68
mov al, byte [ebp - 0x24]
and al, 0x10
movzx edi, al
neg edi
sbb edi, edi
and edi, 0xc000000d
jmp 0x774dcf68
mov esi, 0x7ffe0385
call fcn.77461a00
test eax, eax
je 0x774dcf85
mov eax, dword fs:[0x30]
mov esi, dword [eax + 0x50]
add esi, 0x22b
test byte [esi], 1
je 0x774dcfad
call fcn.77461a00
test eax, eax
je 0x774dcfa2
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0x50]
add ebx, 0x22a
movzx edx, byte [ebx]
lea ecx, [ebp - 0x58]
call fcn.774db2a0
mov eax, edi
call fcn.774a61c0
ret
Function at 0x774df620
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 1
je 0x774df640
cmp ebx, 2
je 0x774df640
mov eax, 0xc000000d
jmp 0x774df7ac
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x24]
push esi
push edi
movzx ecx, word [eax]
add edx, 3
mov eax, dword [ebp + 0x18]
add ecx, 3
mov edi, dword [ebp + 8]
push 0xfffffffffffffffc
pop esi
movzx eax, word [eax]
and ecx, esi
add eax, 3
and edx, esi
and eax, esi
mov dword [ebp - 0xc], edx
add eax, 0x2b
add ecx, edx
add ecx, eax
and ecx, esi
mov esi, dword [edi + 0xc]
mov dword [ebp - 8], ecx
mov eax, dword [esi + 8]
add eax, ecx
cmp eax, ecx
jb 0x774df6a5
mov esi, dword [esi + 4]
cmp eax, esi
jbe 0x774df6db
add esi, esi
cmp esi, eax
jb 0x774df688
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call fcn.77463940
mov ebx, eax
test ebx, ebx
jne 0x774df6af
mov eax, 0xc0000017
jmp 0x774df7aa
mov eax, dword [edi + 0xc]
push dword [eax + 8]
push eax
push ebx
call fcn.774987e0
mov eax, dword fs:[0x30]
add esp, 0xc
push dword [edi + 0xc]
push 0
push dword [eax + 0x18]
call fcn.77461440
mov dword [edi + 0xc], ebx
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 0xc]
mov eax, dword [edi + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov ecx, dword [eax + 8]
add ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ecx], eax
mov dword [ecx + 4], ebx
mov eax, dword [edx]
mov dword [ecx + 8], eax
mov eax, dword [edx + 4]
mov dword [ecx + 0xc], eax
mov eax, dword [esi]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 4]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x18], eax
mov ecx, dword [edi + 0xc]
movzx eax, word [edx]
push eax
push dword [edx + 4]
mov esi, dword [ecx + 8]
add esi, 0x28
lea eax, [ecx + esi]
push eax
call fcn.77498b20
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0xc], esi
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
add eax, 3
and eax, 0xfffffffc
add esi, eax
movzx eax, word [ecx]
push eax
mov eax, dword [edi + 0xc]
push dword [ecx + 4]
add eax, esi
push eax
call fcn.77498b20
mov eax, dword [ebp - 4]
add esp, 0x18
mov dword [eax + 0x14], esi
mov eax, dword [ebp + 0x18]
movzx eax, word [eax]
add eax, 3
and eax, 0xfffffffc
add esi, eax
cmp ebx, 2
jne 0x774df797
push dword [ebp + 0x24]
mov eax, dword [edi + 0xc]
push dword [ebp + 0x20]
add eax, esi
push eax
call fcn.77498b20
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [eax + 0x24], esi
add esi, dword [ebp - 0xc]
mov eax, dword [edi + 0xc]
lea ecx, [esi + 3]
and ecx, 0xfffffffc
mov dword [eax + 8], ecx
mov eax, dword [edi + 0xc]
inc dword [eax]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x774e3e80
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0x14
push 0x77520880
call fcn.774a6178
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
je 0x774e3eb3
cmp dword [ebp + 8], 0x775353b8
jne 0x774e3f21
mov ecx, dword fs:[0x18]
mov eax, dword [eax + 0x2c]
cmp eax, dword [ecx + 0x24]
je 0x774e3f21
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x774e3ee2
mov ecx, dword fs:[0x18]
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
push eax
push dword [ecx + 0x24]
push 0x77432458
push 0
push 0x65
call fcn.77445380
add esp, 0x18
int3
push dword [0x77537bb8]
call fcn.77482b10
mov dword [ebp - 0x20], eax
and dword [ebp - 4], 0
push 0xc0000264
call fcn.774a6fb0
cmp dword [ebp - 0x20], 0
je 0x774e3f14
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
call dword [0x775391d0]
call dword [ebp - 0x20]
ret
xor eax, eax
ret
call fcn.774a61c0
ret 4

Function at 0x774e6590
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov ax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
movzx edi, word [ecx + 6]
movzx eax, ax
add edx, eax
test edi, edi
je 0x774e65ca
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [edx + 0xc]
jb 0x774e65c2
mov eax, dword [edx + 0x10]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x774e65d2
add edx, 0x28
inc esi
cmp esi, edi
jb 0x774e65b3
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
mov eax, edx
jmp 0x774e65cc
Function at 0x774ef551
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword fs:[0x30]
push edi
push 0x77536600
mov dword [esp + 0x18], esi
call fcn.7746be50
test byte [0x77536250], 4
jne 0x774ef587
push 0x77536220
call fcn.77466460
xor edi, edi
mov ebx, edi
cmp dword [esi + 0x88], edi
jbe 0x774ef61f
mov eax, dword [esi + 0x90]
mov esi, dword [eax + ebx*4]
cmp dword [esi + 8], 0xddeeddee
jne 0x774ef5d2
test byte [esi + 0xc], 1
jne 0x774ef645
mov ecx, esi
call fcn.7750446e
lea eax, [esi + 0x50]
push eax
call fcn.77466460
lea ecx, [esi + 0x98]
xor edx, edx
call 0x7750eec9
jmp 0x774ef645
test byte [esi + 0x40], 1
jne 0x774ef645
or dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], 0xfffc2f70
push dword [esi + 0xc8]
call fcn.7747b660
test eax, eax
jne 0x774ef628
lea eax, [esp + 0x18]
push eax
push edi
call fcn.77492ca0
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x64
jb 0x774ef5e9
mov edx, ebx
xor ecx, ecx
mov edi, 0xc0000194
call fcn.774f1218
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0xda], 2
jne 0x774ef639
mov eax, dword [esi + 0xd4]
jmp 0x774ef63b
mov eax, edi
test eax, eax
je 0x774ef645
push eax
call fcn.77466460
mov esi, dword [esp + 0x14]
inc ebx
cmp ebx, dword [esi + 0x88]
jb 0x774ef597
jmp 0x774ef61f