joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7de9aa50
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x7de9c070
push 0x7dee1ecd
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x7df72088]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edi, edi
xor eax, eax
mov dword [ebp - 0x8e], eax
mov dword [ebp - 0x8a], eax
mov dword [ebp - 0x86], eax
mov dword [ebp - 0x82], eax
mov dword [ebp - 0x7e], eax
mov dword [ebp - 0x7a], eax
mov dword [ebp - 0x76], eax
mov word [ebp - 0x72], ax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
cmp byte [0x7df76898], al
jne 0x7deb8921
cmp byte [0x7df77358], al
jne 0x7de9aacf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xc]
cmp byte [ecx + 0x28], 0
jne 0x7de9aacf
mov esi, dword [ebp + 8]
cmp esi, 0xfffffffe
jne 0x7deb8969
mov eax, dword fs:[0x18]
cmp dword [eax + 0x38], edi
je 0x7de9aacf
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x24]
mov dword [ebp + 8], eax
jmp 0x7deb89b9
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x38], 0x38
push edi
push 0xc
lea edx, [ebp - 0x3c]
push edx
push 0x1a
push esi
call 0x7de55bf8
test eax, eax
jl 0x7de9aacf
cmp dword [ebp - 0x2c], edi
je 0x7de9aacf
push edi
push 0x1c
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call 0x7de55bf8
cmp eax, edi
jl 0x7de9aacf
mov ecx, dword [ebp - 0x64]
mov dword [ebp + 8], ecx
push 0x7df720d8
call 0x7de582b0
mov dword [ebp - 4], edi

Function at 0x7de9ba35
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x5c
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, 0x7ded5ae4
mov esi, 0x7dec9788
test eax, eax
jne 0x7decc043
cmp dword [ebp + 8], 0
je 0x7decc0a1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7decc0a1
test ebx, ebx
je 0x7decc0a1
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
cmp byte [ecx + 0x28], 0
jne 0x7decc0a1
mov ecx, dword [ebx + 0x2c]
push 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call 0x7de56558
mov dword [ebp + 8], eax
test eax, eax
jl 0x7de9bacd
push 4
lea eax, [ebp - 4]
push eax
push 3
push ebx
mov dword [ebp - 4], 1
call 0x7de68a4e
push eax
call 0x7de57ac0
and dword [ebp + 8], 0
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decc074
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
test dword [eax + 0x66fffffd], esi
add esi, dword [ebx]
Function at 0x7de9d127
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x7df72034
push edi
call 0x7de689f1
push dword [ebp + 8]
call fcn.7de9c3f2
mov esi, eax
test esi, esi
je 0x7dec6e9e
dec dword [esi + 0x10]
jne 0x7de9d191
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
push 1
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 8]
push eax
push 0xffffffffffffffff
call 0x7de57ec0
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call 0x7de63f85
push edi
call 0x7de689ab
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
xor ebx, ebx
jmp 0x7de9d182

Function at 0x7de9e7ab
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
test ecx, ecx
je 0x7de9e819
test eax, eax
jne 0x7de9e7cd
mov ax, word [ecx + 0x14]
movzx eax, ax
lea eax, [eax + ecx + 0x18]
test eax, eax
je 0x7de9e819
movzx edx, word [ecx + 6]
push esi
xor esi, esi
push edi
test edx, edx
jle 0x7de9e81d
cmp dword [ebp + 0x14], 0
jne 0x7de9e7f5
cmp byte [ebp + 0x1c], 0
je 0x7de9e7f5
mov ecx, dword [ebp + 8]
and ecx, 0xfffffffc
add ecx, dword [ebp + 0xc]
lea edi, [eax + 0x28]
cmp edi, ecx
ja 0x7de9e81d
mov ecx, dword [eax + 0xc]
cmp dword [ebp + 0x18], ecx
jne 0x7de9e803
pop edi
pop esi
pop ebp
ret 0x18
jbe 0x7de9e80f
mov edi, dword [eax + 0x10]
add edi, ecx
cmp dword [ebp + 0x18], edi
jb 0x7de9e7fd
add eax, 0x28
inc esi
cmp esi, edx
jl 0x7de9e7d9
jmp 0x7de9e81d
xor eax, eax
jmp 0x7de9e7ff
xor eax, eax
jmp 0x7de9e7fd

Function at 0x7de9ed84
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x7df700a8], 0
push ebx
je 0x7dea1034
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x7dea1095
cmp dword [ebp - 8], 0x660
jb 0x7dec9a83
mov eax, dword [eax*4 + 0x7df768a0]
mov dword [0x7df700a8], eax
jmp 0x7de9ed9a
test dword [eax + 0x50fffffd], esi
Function at 0x7dea2385
Capabilities:
Access peb ldr_data

Disassembly:
in al, dx
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x7dea2798
test eax, eax
jne 0x7dece7a6
mov eax, dword [0x7df700b4]
mov edi, 0x7dea27c4
test eax, eax
jne 0x7dece7d5
test ebx, ebx
je 0x7dece857
mov eax, dword [ebx + 0x50]
test eax, 0x10000
jne 0x7dece857
cmp dword [ebx + 4], 0x7dea2788
jne 0x7dece857
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7dece857
mov eax, dword [0x7df700b4]
test eax, eax
add byte [eax], al
push edi
pop ebp
int1
jge 0x7dece7ad
add byte [eax], al
add ch, bl
and eax, 0x7dea
add byte [eax], al
insd dword es:[edi], dx
pop ebp
int1
jge 0x7dece7bd
add byte [eax], al
add byte [ebx + 0x7df15d], al
add byte [eax], al
add ch, bl
and eax, 0x7dea
add byte [eax], al
frstor dword [0x7dea]
add byte [eax], al
cdq
pop ebp
int1
jge 0x7dece7dd
add byte [eax], al
add byte [ecx + 0x7df15d], bl
add byte [eax], al
add byte [ebp + ebx*2 + 0x7df1], ah
add byte [eax], al
scasd eax, dword es:[edi]
pop ebp
int1
jge 0x7dece7ed
add byte [eax], al
add ah, al
cmpsb byte [esi], byte es:[edi]
out dx, al
jge 0x7dece7f5
add byte [eax], al
add byte [eax], al
inc ecx
in eax, dx
jge 0x7dece7fd
add byte [eax], al
add ch, al
pop ebp
add byte [esi], bh
pop esi

Function at 0x7dea250e
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x7dea2798
test eax, eax
jne 0x7dece5f8
mov eax, dword [0x7df700b4]
mov edi, 0x7dea27c4
test eax, eax
jne 0x7dece637
test ebx, ebx
je 0x7dece6e1
mov eax, dword [ebx + 0x50]
test eax, 0x30000
jne 0x7dece6e1
cmp dword [ebx + 4], 0x7dea2788
jne 0x7dece6e1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7dece6e1
rol dword [edx], 0
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7dece664
mov eax, dword [ebx + 0x50]
test eax, 0x1000000
je 0x7dece68b
push dword [ebp + 0xc]
push ebx
call fcn.7dea21fa
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7dece6b3
pop edi
pop esi
pop ebx
leave
ret 8
nop
nop
nop
jmp 0x7dead270
invalid
add dword [edi], ecx
test edx, ebx
aad 2
add byte [edx + 0x558b0248], cl
or al, 0x80
loope 0x7dece678
cmp cl, 4
sete cl
mov byte [edx], cl
test cl, cl
je 0x7dece6ae
xchg esp, eax
ror dword [eax + 0x74c9840a], 0x2e
movzx ecx, word [eax + 2]
test cl, 4
je 0x7dece6b4
test ecx, 0x8000
mov ecx, dword [eax + 0x10]
je 0x7dece69a
add byte [eax + 0x488b0000], al
adc byte [esi + eax - 0x7b], dh
leave
test ecx, ecx
je 0x7dece6b4
add ecx, eax
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov al, byte [eax + 2]
mov ecx, dword [ebp + 0x14]
and al, 8
cmp al, 8
sete al
mov byte [ecx], al
xor eax, eax
pop ebp
ret 0x10
add byte [ebx], dh
leave
xor ecx, ecx
jmp 0x7dece69a
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x7decac60
xor eax, eax
pop ebp
ret 0xc
Function at 0x7dea27f8
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, 0x7dedc890
mov esi, 0x7deb4168
test eax, eax
jne 0x7dececa8
xor ecx, ecx
cmp ebx, ecx
je 0x7dea289c
mov eax, dword [ebx + 0x1c]
cmp dword [ebp + 8], ecx
je 0x7dececf9
cmp dword [ebp + 0xc], ecx
je 0x7dececf9
test eax, 0xfffffffc
jne 0x7dececf9
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0xc]
cmp byte [edx + 0x28], cl
jne 0x7dececf9
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7de866ba
mov ebx, eax
test ebx, ebx
jl 0x7dea287a
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 4]
mov ecx, dword [ecx]
mov dword [ecx + 0x54], eax
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7dececdc
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x7dea2826
push es
add byte [eax], al
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.7de93618
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.7dea1d26
cmp dword [ebp - 4], 0xc0000034
je 0x7deffb33
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 8
nop
adc byte [ebx - 0x221600f8], al
sub esi, edi
call dword [eax - 0x6f6f6f70]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
push esi
mov eax, dword [esp + 0x18]
or eax, eax
jne 0x7deced62
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword [esp + 0xc]
div ecx
mov edx, ebx
jmp 0x7deceda3
mov ecx, eax
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 0x7deced70
div ebx
mov esi, eax
mul dword [esp + 0x18]
mov ecx, eax
mov eax, dword [esp + 0x14]
mul esi
add edx, ecx
jb 0x7deced9e
cmp edx, dword [esp + 0x10]
ja 0x7deced9e
jb 0x7deced9f
cmp eax, dword [esp + 0xc]
inc dword [ecx]
mov ecx, dword [eax + 0x8c]
test ecx, ecx
je 0x7deffb42
lock inc dword [ecx]
push esi
push 6
lea ecx, [eax + 0x28]
pop esi
cmp dword [ecx - 8], 0x415660
je 0x7deffb5b
mov edx, dword [ecx]
test edx, edx
je 0x7deffb5b
lock inc dword [edx]
cmp dword [ecx - 0xc], 0
je 0x7deffb6b
mov edx, dword [ecx - 4]
test edx, edx
je 0x7deffb6b
lock inc dword [edx]
add ecx, 0x10
sub esi, 1
jne 0x7deffb49
push dword [eax + 0x9c]
call fcn.7deffcca
pop ecx
pop esi
pop ebp
ret
Function at 0x7dea2c13
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x7dea2798
test eax, eax
jne 0x7dece47a
mov eax, dword [0x7df700b4]
mov edi, 0x7dea27c4
test eax, eax
jne 0x7dece4a9
test ebx, ebx
je 0x7dece553
mov eax, dword [ebx + 0x50]
test eax, 0x30000
jne 0x7dece553
cmp dword [ebx + 4], 0x7dea2788
jne 0x7dece553
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7dece553
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7dece4d6
mov eax, dword [ebx + 0x50]
test eax, 0x1000000
je 0x7dece4fd
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x24]
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7dece525
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
add edi, edi
jbe 0x7dea2ee7
call fcn.7dea2985
push 1
push dword [esi + 0x58]
call fcn.7dea2985
lea eax, [esi + 0x20]
push eax
call fcn.7dea2f0e
lea eax, [esi + 0x40]
push eax
call fcn.7dea2f0e
lea eax, [esi + 4]
push eax
call 0x7de6a5f5
mov eax, dword [0x7df700b0]
add eax, 0x180000
push esi
push eax
mov eax, dword fs:[0x18]
sbb byte [eax], al
add byte [eax], al
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call 0x7de63f85
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7deccf16
pop esi
pop ebx
pop ebp
ret 4
add byte [eax], al
nop
nop
nop
nop
nop
ret 0xfa03
add byte [ebx + 0x84d8b03], cl
mov word [esi + 2], di
add edi, 0xfffffffe
xor ebx, ebx
mov word [esi], di
mov dword [esi + 4], eax
mov dword [ebp + 8], ecx
cmp dword [ebp + 0xc], ebx
je 0x7dece4f4
mov eax, dword [ebp + 0x10]
lea edi, [eax + ebx*8]
movzx edx, word [edi]
push edx
push dword [eax + ebx*8 + 4]
mov eax, dword [esi + 4]
shr ecx, 1
lea eax, [eax + ecx*2]
push eax
call fcn.7deacb50
movzx eax, word [edi]
add dword [ebp + 8], eax
mov ecx, dword [ebp + 8]
add esp, 0xc
inc ebx
cmp ebx, dword [ebp + 0xc]
jne 0x7dece4c6
add al, 0xd1
jmp 0xce34e96a
mov eax, dword [esi + 4]
shr ecx, 1
xor edx, edx
mov word [eax + ecx*2], dx
adc al, 0x48
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
inc ebp
in al, dx
mov eax, dword [esi + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x14]
push ecx
push 2
push eax
call fcn.7dece458
test eax, eax
jl 0x7dea2ead
dec dword [ebx + 0xc60c45]
add ecx, ebp
dec esp
dec ecx
std
dec dword [ebx - 0xc77b]
dec dword [ecx - 0x10b7b]
dec dword [ebx - 0xc37b]
dec dword [ecx - 0x1077b]
invalid
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
jmp 0x7dea2eab

Function at 0x7dea2e76
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x7dea2798
test eax, eax
jne 0x7deccee7
push 0
push 0
push dword [esi + 0x38]
call int.7de865d7
push 0
push 0
push dword [esi + 0x58]
call int.7de865d7
push 1
push dword [esi + 0x38]
jno 0x7decceed
or al, 0x38
Function at 0x7dea2f79
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
push esi
push edi
mov edi, 0x7dedd000
mov esi, 0x7dec9788
test eax, eax
jne 0x7decbbb2
xor eax, eax
cmp dword [ebp + 8], eax
je 0x7decbc25
cmp dword [ebp + 0xc], eax
jl 0x7decbc25
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
cmp byte [ecx + 0x28], al
jne 0x7decbc25
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push dword [ebp + 8]
call 0x7de68a4e
push eax
call 0x7de57ac0
mov ebx, eax
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decbbe2
cmp byte [0x7ffe0384], 0
jne 0x7decbc0d
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
std
dec dword [ebx + 0xff685f0]
test dh, ch
rol dword [edx], cl
add byte [ebx - 0x7499ffda], al
pop es
pop edx
mov dword [0xb70ffffc], eax
inc esi
add al, 0x8b
dec esi
or byte [ebx - 0x172ef383], cl

Function at 0x7dea3019
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0x7dedd09c
mov esi, 0x7dec9788
test eax, eax
jne 0x7decbca0
test ebx, ebx
je 0x7decbd06
cmp dword [ebp + 0xc], 0
jl 0x7decbd06
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7decbd06
push 4
lea eax, [ebp + 0xc]
push eax
push 5
push ebx
call 0x7de68a4e
push eax
call 0x7de57ac0
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decbcce
cmp byte [0x7ffe0384], 0
jne 0x7decbcf8
pop edi
adc byte [ecx - 0x2277b], cl
invalid
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x10]
test byte [ecx + 8], 1
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
je 0x7def8df2
mov esi, dword [ebx + 0x10]
push edi
push eax
push esi
call fcn.7de95f40
mov eax, dword [ebp - 0x228]
add edi, esi
mov esi, 0x7dec8130
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor byte [ecx - 0x5a5a8214], al
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push dword [ebx + 0x10]
add eax, 0xfffffffe
mov word [ebx + 0xc], ax
call fcn.7decbacd
test al, al
jne 0x7decbd1c
xor eax, eax
mov word [ebx + 0xc], ax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7dea1d14
leave
ret 0xc
inc eax
add byte [eax - 1], dl
adc eax, 0x40e148

Function at 0x7dea3571
Capabilities:
Access peb ldr_data

Disassembly:
jb 0x7dea35ed
add al, byte [eax]
xor ecx, ecx
cmp ebx, ecx
je 0x7decb07d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], cl
jne 0x7decb07d
xor eax, eax
inc eax
lea edx, [ebx + 4]
xchg dword [edx], eax
cmp eax, ecx
jne 0x7decb012
mov eax, ebx
or ecx, 0xffffffff
lock xadd dword [eax], ecx
mov ah, 0
idiv dword [ebp + 0x56]
adc byte [esi - 0x77], dl
inc ebp
aam 0xe8
salc
scasb al, byte es:[edi]
cld
call dword [ebx + 0x6a]
sbb edi, edi
jne 0x7decaf98
jge 0x7decb087
call dword [esi + 0x6a]
add byte [edx], ch
Function at 0x7dea41ef
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x50
test eax, eax
je 0x7decc7ae
cmp eax, dword [0x7df72090]
jne 0x7decc7ae
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7decc7ae
push 0x7df72044
push 0x7df72090
call fcn.7de924e4
leave
ret 4
or al, 0x85
ror byte [edi], 0x8c
jl 0x7decc76c
add al, byte [eax]
Function at 0x7dea5d4e
Capabilities:
Encode data using base64
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], ebx
jne 0x7dea5ff7
cmp dword [ebp + 8], ebx
jne 0x7dea5ff7
mov eax, dword [ebp + 0x44]
mov ecx, dword [ebp + 0x48]
mov byte [eax], bl
movzx eax, byte [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x400
mov dword [ecx], eax
mov eax, dword [ebp + 0x40]
mov dword [eax], ebx
mov eax, 0x8000000b
pop ebx
leave
ret 0x44
push esi
mov esi, dword [ebp + 0x40]
mov dword [ebp - 8], 0xc8
mov dword [ebp - 4], ebx
push edi
mov eax, dword [0x7df70058]
push dword [ebp - 8]
add eax, 0x140000
push eax
push dword [ebp - 0xc]
call 0x7de64026
mov dword [esi], eax
cmp eax, ebx
je 0x7dea75d6
push dword [ebp + 0x48]
push dword [ebp + 0x44]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7dea6081
mov edi, eax
cmp edi, ebx
jl 0x7dea75ab
cmp dword [ebp - 8], ebx
je 0x7debe9fb
mov eax, edi
pop edi
pop esi
jmp 0x7dea5d9b
push dword [esi]
push ebx
push dword [ebp - 0xc]
call 0x7de63f85
mov dword [esi], ebx
cmp edi, 0xc0000023
jne 0x7dea6073
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jae 0x7dea6073
jmp 0x7dea6006
mov eax, 0xc0000017
jmp 0x7dea6075
Function at 0x7dea6081
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 0x44]
push edi
push 2
pop eax
push eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x40]
push dword [eax]
xor ebx, ebx
push esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 1], bl
mov byte [ebp - 2], bl
mov byte [ebp - 3], 1
call 0x7de78d21
mov eax, dword [ebp + 0x48]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x4c]
mov byte [eax], bl
movzx eax, byte [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x400
and edx, 8
mov dword [ecx], eax
mov dword [ebp - 0x20], edx
jne 0x7dea6188
mov edx, dword [ebp + 0x10]
mov edi, 0x1000
and edx, edi
jne 0x7debe90c
mov eax, dword [ebp + 0x10]
and eax, 0x1004
je 0x7dea6188
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x7dea7576
test byte [ecx + 0x14], dh
add byte [eax], al
movzx eax, byte [ecx]
cmp eax, 2
jb 0x7dea6110
mov dword [ebp - 0xc], eax
mov byte [ebp - 3], bl
cmp byte [ebp + 0x18], bl
je 0x7debe919
mov byte [ebp + 0x44], 1
cmp edx, ebx
jne 0x7debe924
xor eax, eax
inc eax
mov byte [ebp + 0x4c], bl
push esi
lea edx, [ebp - 8]
push edx
push dword [ebp + 0x34]
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x44]
push dword [ebp + 0x4c]
push eax
push dword [ebp + 0x30]
push ecx
call fcn.7dea6258
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
invalid
and eax, dword [eax]
invalid

Function at 0x7dea65e0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx]
push ebx
push esi
push edi
cmp al, 8

Function at 0x7dea65f1
Capabilities:
Inspect section memory permissions

Disassembly:
ja 0x7dea668f
cmp al, 4
je 0x7dea668f
mov al, byte [ecx + 1]
test al, 0x10
je 0x7dea668f
mov ecx, dword [ecx + 4]
mov dl, al
and dl, 2
movzx ebx, dl
neg ebx
sbb ebx, ebx
mov dl, al
and dl, 1
movzx edi, dl
and ebx, ecx
neg edi
sbb edi, edi
and al, 8
movzx esi, al
mov eax, dword [ebp + 8]
movzx edx, word [eax + 4]
and edi, ecx
neg esi
sbb esi, esi
and dword [ebp - 8], 0
not esi
and esi, ecx
dec edx
lea ecx, [eax + 8]
mov dword [ebp - 4], ecx
test edx, edx
jle 0x7dea668f