joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7dea664e
Capabilities:
Inspect section memory permissions

Disassembly:
mov dl, byte [ecx]
cmp dl, 8
ja 0x7dea6679
cmp dl, 4
je 0x7dea6679
test byte [ecx + 1], 0x10
je 0x7dea6679
push 0
push 0
push dword [ebp + 0xc]
push ecx
call fcn.7dea669d
test al, al
jne 0x7dead7eb
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 2]
inc dword [ebp - 8]
add ecx, edx
movzx edx, word [eax + 4]
dec edx
cmp dword [ebp - 8], edx
mov dword [ebp - 4], ecx
jl 0x7dea664c
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
push 0x10
pop edx
test ecx, 0x40000000
je 0x7deaa47b
push 0x20
jmp 0x7deaa47a
movzx ecx, word [eax + 0x14]
push esi
push edi
xor edx, edx
xor edi, edi
lea ecx, [ecx + eax + 0x18]
cmp dx, word [eax + 6]
jae 0x7deaa4c0
lea esi, [ecx + 0x24]
mov ecx, dword [esi]
test ecx, ecx
js 0x7deaa4b4
cmp dword [esi - 0x14], ebx
je 0x7deaa4b4
cmp byte [ebp + 0xc], bl
je 0x7deaa4c9
test ecx, 0x20000000
jne 0x7deaa408
push 2
pop edx
shr ecx, 0x11
and ecx, 0x200
or edx, ecx
mov ecx, dword [esi - 0x18]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [esi - 0x14]
mov dword [ebp - 8], ecx
cmp ecx, ebx
je 0x7deaa4b4
lea eax, [ebp - 0x14]
push eax
push edx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
call 0x7de56028
cmp eax, ebx
jl 0x7deaa4c2
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 6]
add esi, 0x28
inc edi
cmp edi, ecx
jb 0x7deaa460
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
push 0x40
pop edx
jmp 0x7deaa486
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 4]
mov cl, byte [ecx + 1]
test cl, 2
jne 0x7debe86d
test cl, 1
jne 0x7debe878
test cl, 8
jne 0x7dead80f
not eax
and esi, eax
mov eax, esi
or eax, edi
or eax, ebx
jne 0x7dea6673
mov al, 1
jmp 0x7dea6691
add byte [eax - 0x51d5817], al
cmpsd dword [esi], dword es:[edi]
loop 0x7deb7830
dec dword [ebp + 0x6a50f045]
sbb al, 0x8d
inc ebp
rcl byte [eax + 0x53]
push dword [ebp + 8]
push 0xffffffffffffffff
call 0x7de55bc8
test eax, eax
jl 0x7deb785c
cmp dword [ebp - 0x1c], 2
je 0x7deb786c
cmp dword [ebp - 0x1c], 0x20
je 0x7deb786c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7dedb3dc
jmp 0x7deaa4c4
mov eax, dword [ebp - 4]
jmp 0x7deaa449
push 0
push dword [edi + 0xc]
push 0
push dword [ebx]
push esi
call fcn.7debe894
sbb byte [eax], al
add byte [eax], al
mov dword [ebp - 0x98], eax
test eax, eax
jge 0x7deb7833
jmp 0x7defa436
mov eax, dword [esp + 0x30]
mov ebx, dword [eax + 8]
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx]
mov esi, dword [eax + 0xc]
cmp esi, 0xfffffffe
je 0x7defa491
mov edx, dword [esp + 0x34]
cmp edx, 0xfffffffe
je 0x7defa45c
cmp esi, edx
jbe 0x7defa491
lea esi, [esi + esi*2]
lea ebx, [ebx + esi*4 + 0x10]
mov ecx, dword [ebx]
mov dword [eax + 0xc], ecx
cmp dword [ebx + 4], 0
jne 0x7defa432
push 0x101
mov eax, dword [ebx + 8]
call fcn.7defa720
mov ecx, 1
mov eax, dword [ebx + 8]
call fcn.7defa740
jmp 0x7defa432
pop dword fs:[0]
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x7dea6799
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x7deb4168
test eax, eax
jne 0x7decf076
mov eax, dword [0x7df700b4]
mov edi, 0x7dec02f8
test eax, eax
jne 0x7decf0bd
test ebx, ebx
je 0x7decf13f
mov eax, dword [ebx + 0x50]
test eax, 0x30000
jne 0x7decf13f
cmp dword [ebx + 4], 0x7dea2878
jne 0x7decf13f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7decf13f
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decf0ea
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push ebx
call fcn.7de86324
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decf111
pop edi
pop esi
pop ebx
leave
ret 0xc
jmp [eax + 0x72]
je 0x7deb5862
add byte [eax], al
push 0x7de929da
call fcn.7ded5f80
add byte [eax - 0x26], ch
sub ecx, ebp
jge 0x7deb5851
adc eax, dword [edi]
add al, byte [eax]
add esp, 0x1c
jmp 0x7de7233a
mov ch, 0x7c
invalid
inc ecx
je 0x7deb73c8
jmp 0x7deb585f
push es
cmp ax, word [edi + 2]
ja 0x7defef30
movzx edx, word [esi]
shr edx, 1
mov dword [ebp - 0x24], edx
and dword [ebp - 4], 0
mov dword [ebp - 0x28], 1
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, edx
jae 0x7decf0fe
mov eax, dword [esi + 4]
movzx eax, word [eax + ecx*2]
dec eax
cmp ax, 0x61
jae 0x7decf132
movzx eax, ax
mov ebx, dword [edi + 4]
mov word [ebx + ecx*2], ax
inc ecx
jmp 0x7decf0dd
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x28], 0
call fcn.7decf126
mov ax, word [esi]
mov word [edi], ax
xor eax, eax
call fcn.7dea1af9
ret 0xc
cmp ax, 0x7a
ja 0x7defef3a
movzx eax, ax
sub eax, 0x20
jmp 0x7decf0f4
sub eax, 0x2a
je 0x7defef4b
sub eax, 0xc402
je 0x7defef4b
sub eax, 1
je 0x7defef4b
sub eax, 1
je 0x7defef4b
sub eax, 3
jne 0x7defef9d
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x7deaa1e3
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x7ded2d84
mov eax, dword [esi + 8]
test eax, eax
jne 0x7deaa217
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call 0x7de63f85
pop esi
pop ebp
ret 4
push 0
push eax
call 0x7de559b4
jmp 0x7deaa1fe
cmp ecx, eax
jge 0x7df11a5e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push edi
lea esi, [ecx + ecx]
sbb ecx, dword [ebp + 0x100003d]
adc edx, dword [eax]
adc dword [eax], edx
push ss

Function at 0x7deabf59
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
imul esi, esi, 0xc
add esi, 0x7df74724
push edi
push esi
lea ebx, [esi + 4]
call 0x7de689f1
mov edi, dword [ebx]
cmp edi, ebx
je 0x7deb90c5
cmp edi, dword [ebp + 8]
jne 0x7deb90be
dec dword [edi + 8]
jne 0x7deabfd7
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
cmp eax, ecx
jne 0x7deabfb3
mov ecx, dword fs:[0x18]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ecx + 0x30]
add eax, 2
add ecx, 0x28
lock btr dword [ecx], eax
push esi
call 0x7de689ab
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call 0x7de63f85
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
call 0x7de689ab
jmp 0x7deabfcd
mov edi, dword [edi]
jmp 0x7deabf78
push esi
call 0x7de689ab
xor eax, eax
jmp 0x7deabfd0
Function at 0x7dead0b1
Capabilities:
Get process heap force flags

Disassembly:
add byte [ebx - 0x740003b3], al
inc eax
xor byte [ebx + 0x56], dl
mov esi, 0x1000
add byte [eax], al
push esi
push 8
push dword [eax + 0x18]
call 0x7de64026
mov ebx, eax
test ebx, ebx
je 0x7deca43d
push dword [ebp + 8]
push 0x7dee71f0
push 0x7dee71dc
push esi
push ebx
call fcn.7deace7d
add esp, 0x14
test eax, eax
jl 0x7deca447
push edi
push ebx
lea eax, [ebp - 0x10]
push eax
call 0x7de64208
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
xor edi, edi
push 0x20019
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call 0x7de55a18
cmp eax, edi
mov dword [ebp + 8], eax
jl 0x7dead1a5
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x10
push 8
push dword [eax + 0x18]
call 0x7de64026
mov edi, eax
test edi, edi
je 0x7dead1c5
push 0x7dee71d0
push esi
push ebx
call fcn.7dead273
push ebx
lea eax, [ebp - 0x18]
push eax
call 0x7de64208
lea eax, [ebp - 8]
push eax
push 0x10
push edi
push 2
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call 0x7de55a98
mov dword [ebp + 8], eax
test eax, eax
jl 0x7dead189
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call 0x7de63f85
push dword [ebp - 4]
call 0x7de559d0
mov esi, dword [ebp + 8]
pop edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call 0x7de63f85
mov eax, esi
pop esi
pop ebx
leave
ret 8
mov dword [ebp + 8], 0xc0000017
jmp 0x7dead19d
add byte [ebx + 0xfff85f8], cl
mov word [edi - 0x80000000], ss
jge 0x7deca453
add byte [eax + 0xf00087d], al
add byte [edi], cl
test bh, ch
test eax, 0x758b0000
or al, 0x8d
adc dword [ecx + eax], 0
jne 0x7deca461
mov dword [ebp - 0x18], eax

Function at 0x7deae49b
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x50
push ebx
push esi
push edi
mov ebx, 0x7dee852c
mov esi, 0x7decc908
test eax, eax
jne 0x7decff9a
mov eax, dword [0x7df700b4]
mov edi, 0x7ded683c
test eax, eax
jne 0x7decffc7
mov eax, dword [ebp + 8]
test eax, eax
je 0x7ded0047
mov ecx, dword [eax + 0x50]
test ecx, 0x30000
jne 0x7ded0047
cmp dword [eax + 4], 0x7deb5770
jne 0x7ded0047
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7ded0047
invalid
mov eax, dword [0x7df700b4]
add byte [eax], al
shr cl, 0x6b
aaa
invalid
dec dword [ebp - 0x1c2fdba]
inc dword [eax]
add byte [edi], cl
xchg dword [ebx - 0x7cfffdd8], eax
mov byte [edx], 0x66
mov dword [ebp - 0xe], esi
Function at 0x7deaea92
Capabilities:
Access peb ldr_data

Disassembly:
push 0x7df72064
call 0x7de689f1
mov dword [ebp - 4], 1
cmp byte [0x7df700bc], bl
jne 0x7ded334f
push 0x7df72098
push ebx
push 0x7dee8642
push ebx
call fcn.7dea28a5
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x7deaea67
mov byte [0x7df700bc], 1
mov dword [ebp - 4], ebx
call fcn.7deaeb1d
cmp dword [ebp - 0x1c], ebx
jge 0x7deaead6
jmp 0x7deaeb01
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
cmp byte [ecx + 0x28], bl
jne 0x7deaeb10
cmp dword [ebp + 8], ebx
je 0x7deaeb28
cmp dword [ebp + 0x10], ebx
jne 0x7deaeb28
mov dword [ebp - 4], ebx
push ebx
lea eax, [ebp - 0x24]
push eax
call fcn.7de9d38f
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x7deaeb01
cmp byte [0x7df700bc], bl
je 0x7deaea2b
push dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.7deaeb34
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x7deaeb01
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf60]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x34], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.7deaea22
mov eax, dword [ebp - 0x1c]
call 0x7de63ef9
ret 0xc
mov eax, 0xc000000d
jmp 0x7deaeb10
push edx
inc ebp
push ebx
inc ebx
Function at 0x7deb072a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0x27c
push 0x7de9c2a8
call 0x7de64140
mov esi, dword [ebp + 8]
mov dword [ebp - 0x234], esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x230], eax
mov ebx, dword fs:[0x18]
mov dword [ebp - 0x220], ebx
cmp dword [ebp + 0xc], 0xffffffff
je 0x7debb9a8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [eax + 2], 0
jne 0x7debb99e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call 0x7de572c8
test eax, eax
jne 0x7debb9a8
xor eax, eax
call 0x7de64188
ret 0x18
cmp dword [ebp + 0xc], 0x65
jne 0x7deb077e
movzx eax, word [ebx + 0xfca]
test al, 2
jne 0x7deb0791
or eax, 2
mov word [ebx + 0xfca], ax
and dword [ebp - 4], 0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7debb9ca
sub eax, edx
mov esi, eax
mov edi, 0x1ff
cmp esi, edi
jbe 0x7debb9e0
mov esi, edi
push esi
push dword [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
call 0x7de58340
add esp, 0xc
push dword [ebp - 0x230]
push dword [ebp - 0x238]
mov eax, 0x200
sub eax, esi
push eax
lea eax, [ebp + esi - 0x21c]
push eax
call fcn.7dee33ee
mov dword [ebp - 0x23c], eax
push 0xfffffffffffffffe
pop esi
mov dword [ebp - 4], esi
test eax, eax
jge 0x7debba3a
cmp eax, 0x80000005
jne 0x7debba3a
mov byte [ebp - 0x1e], 0xa
mov byte [ebp - 0x1d], 0
mov eax, edi
jmp 0x7debba4c
lea eax, [ebp - 0x21c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7debba43
sub eax, edx
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x224], ecx
mov word [ebp - 0x228], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [eax + 2], 0
jne 0x7debbab0
call fcn.7df0459a
test al, al
je 0x7debbab0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x228]
push eax
call fcn.7df0467b
cmp byte [ebp + 0x1c], 1
jne 0x7debba9f
cmp eax, 0x80000003
jne 0x7debba9f
push 1
call 0x7de46000
xor eax, eax
mov ecx, 0xfffd
and word [ebx + 0xfca], cx
jmp 0x7deb0793
mov dword [ebp - 0x28c], 0x40010006
and dword [ebp - 0x284], 0
mov dword [ebp - 0x27c], 2
and dword [ebp - 0x288], 0
movzx eax, word [ebp - 0x228]
inc eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x274], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x28c]
push eax
call 0x7de7ce68
mov dword [ebp - 4], esi
jmp 0x7debbb18
mov eax, 0xfffd
and word [ebx + 0xfca], ax
jmp 0x7deb0791
Function at 0x7dec41d7
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x7deb4168
test eax, eax
jne 0x7df0cb46
mov eax, dword [0x7df700b4]
mov edi, 0x7dec02f8
test eax, eax
jne 0x7df0cb8d
test ebx, ebx
je 0x7df0cc0f
mov eax, dword [ebx + 0x50]
test eax, 0x30000
jne 0x7df0cc0f
cmp dword [ebx + 4], 0x7dea2878
jne 0x7df0cc0f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7df0cc0f
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7df0cbba
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.7dec3f24
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7df0cbe1
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7dec6c4e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xc0
push 0x7de9d6c8
call fcn.7dea1ab4
mov dword [ebp - 0x20], 0xc0000001
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7df0a42c
xor edi, edi
mov ecx, dword [ebp + 8]
cmp ecx, edi
je 0x7df0a620
cmp dword [ebp + 0xc], edi
jne 0x7df0a620
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7df0a620
mov dword [ecx], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call fcn.7dea6d64
cmp eax, edi
je 0x7df0a461
mov ecx, dword [eax + 0x60]
mov dword [ebp - 0x50], ecx
mov eax, dword [eax + 0x64]
mov dword [ebp + 0xc], eax
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x208]
cmp ecx, edi
jne 0x7df0a46b
mov eax, dword [0x7df700b0]
add eax, 0x100000
mov ecx, dword fs:[0x18]
push 0xc88
or eax, 8
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call fcn.7dea1c26
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], edi
xor ebx, ebx
inc ebx
mov dword [ebp - 0x3c], ebx
cmp esi, edi
je 0x7dec70a0
mov eax, dword [0x7df700b0]
add eax, 0x100000
mov dword [ebp - 0x64], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x74], eax
mov ecx, dword [0x7df700ac]
imul ecx, ecx, 0x48
push ecx
mov ecx, dword [ebp - 0x64]
or ecx, 8
push ecx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call fcn.7dea1c26
mov dword [ebp - 0x60], eax
cmp eax, edi
je 0x7df0a4bb
xor eax, eax
mov dword [ebp - 0x24], eax
cmp eax, 3
jae 0x7dec6d77
mov ecx, dword [0x7df700ac]
imul ecx, eax
imul ecx, ecx, 0x18
add ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x1c]
mov dword [edx + eax*4 + 0x10], ecx
inc eax
jmp 0x7dec6d56
ror byte [edi], 1
xlatb
aas
add byte [eax], al
add byte [eax], al
add bl, 0xd6
aas
add byte [eax], al
add byte [eax], al
add bl, 0xd6
aas
add byte [eax], al
add byte [eax], al
test al, 0x7a
salc
aas
add byte [eax], al
add byte [eax], al
test al, 0x7a
salc
aas
add byte [eax], al
add byte [eax], al
sal byte [ecx], 1
salc
aas
add byte [eax], al
add byte [eax], al
sal byte [ecx], 1
salc
aas
add byte [eax], al
add byte [eax], al
jo 0x7df0a452
add byte [eax], al
add byte [eax - 0x14], dh
aad 0x3f
add byte [eax], al
add byte [eax], al
jo 0x7df0a45a
add byte [eax - 0x14], dh
aad 0x3f
add byte [eax], al
add byte [eax], al
adc byte [edi + 0x3fd5], ah
add byte [eax], al
adc byte [edi + 0x3fd5], ah
add byte [eax - 0x5a], ah
add byte [eax], al
cmp byte [ecx + 0x3fd0], bl
add byte [eax], al
adc byte [ebx - 0x30], dh
aas
add byte [eax], al
add byte [eax], al
adc byte [ebx - 0x30], dh
aas
add byte [eax], al
add byte [eax], al
jo 0x7df0a66f
sar byte [edi], 1
add byte [eax], al
add byte [eax], al
jo 0x7df0a677
sar byte [edi], 1
add byte [eax], al
add byte [eax], al
shl byte [esi], 0xd0
aas
add byte [eax], al
add byte [eax], al
shl byte [esi], 0xd0
aas
add byte [eax], al
add byte [eax], al
cwde
add al, dl
aas
add byte [eax], al
add byte [eax], al
cwde
add al, dl
aas
add byte [eax], al
add byte [eax], al
loopne 0x7df0a60a
iretd
aas
add byte [eax], al
add byte [eax], al
and byte [edx], ch
iretd
aas
add byte [eax], al
add byte [eax], al
and byte [edx], ch
iretd
Function at 0x7dec7bd9
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x64
push 8
push dword [eax + 0x18]
call fcn.7dea1c26
test eax, eax
je 0x7df059a6
or dword [eax], 0x400
ret
Function at 0x7deca328
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
xor eax, eax
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov word [ebp - 0x20], ax
lea edi, [ebp - 0x1e]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ebp - 0x26]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
mov dword [ebp - 0x10], edi
cmp esi, edi
je 0x7ded4e65
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x7ded4e65
cmp dword [eax], edi
je 0x7ded4e65
cmp dword [ebp + 0xc], edi
je 0x7ded4e65
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x1fe
push 8
push dword [eax + 0x18]
call fcn.7dea1c26
mov ebx, eax
test ebx, ebx
je 0x7df00b9a
push dword [ebp + 0xc]
lea eax, [ebx + 0xaa]
mov dword [ebp - 0x24], eax
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, 0xaa
mov word [ebp - 0x26], ax
lea eax, [ebp - 8]
push eax
call fcn.7deca09d
test eax, eax
jl 0x7ded4e5b
lea eax, [ebp - 0x28]
push eax
movzx eax, word [ebp - 8]
push eax
call fcn.7dec3aff
test al, al
je 0x7ded4e5b
and dword [ebp - 0xc], edi
xor eax, eax
cmp ax, word [esi + 4]
jae 0x7deca4df
and dword [ebp - 8], eax
add byte [eax], al
Function at 0x7decb3b0
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], 0x7dec7d9c
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov edx, dword [eax + 0x30]
mov dword [ebp - 0xc], edi
je 0x7def951b
mov ecx, dword [ebp + 0x14]
cmp ecx, edi
je 0x7decb3e4
mov dword [ecx], edi
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test eax, 0xfffffffc
jne 0x7def9571
cmp ebx, 1
jb 0x7def9571
cmp ecx, edi
je 0x7def9571
cmp dword [ebp + 0x18], edi
je 0x7def9571
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
and eax, 3
push edx
push eax
call fcn.7decb842
mov esi, eax
cmp esi, edi
jl 0x7def953a
cmp dword [ebp - 8], edi
je 0x7decb482
mov eax, dword [ebp - 0xc]
cmp eax, edi
je 0x7decb48d
cmp dword [ebp - 4], edi
je 0x7decb48d
mov eax, dword [eax + 8]
cmp ebx, eax
jae 0x7def9542
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.7decb499
mov esi, eax
cmp esi, edi
jl 0x7def955b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
lea eax, [eax + ebx*4]
cmp dword [eax], edi
je 0x7decb48d
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
add eax, 4
mov dword [ecx], eax
xor esi, esi
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0x18
mov esi, 0xc00000e5
jmp 0x7decb484
add byte [ebp - 0x75], dl
in al, dx
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x7def9557
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x7def9550
dec edx
or al, 0x72
or cl, byte [ebx + 0x42030842]
or al, 0x3b
enter 0xc72, 0xffffffffffffff83
ret 0x3b28
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x7def955c
add edx, 0x28
cmp edx, esi
jne 0x7def9541
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x7def9559
add al, 0x59
inc ecx
add byte [ebx + 0x4eb0450], cl
cmp edx, eax
je 0x7def958e
xor eax, eax
mov ecx, edx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x7def957a
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x7decbb39
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x7decbc2c
Function at 0x7decd357
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword [0x7df76754]
test eax, eax
jne 0x7df0f340
mov eax, dword [0x7df700b0]
mov ecx, dword fs:[0x18]
add eax, 0xc0000
push 0x10
or eax, 8
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call fcn.7dea1c26
ret
or ch, byte [eax]
jbe 0x7df0f344
add byte [edx], cl
sub byte [ecx], dh
add byte [eax], al
push es
add ch, byte [eax]
cmp al, 0
add byte [edx], cl
outsd dx, dword [esi]
ja 0x7df0f354
add byte [edx], cl
sub byte [edx + 0x28060002], dl
xor al, byte [eax]
add byte [esi], al
sub byte [ebx + 0x28060002], dl
das
add byte [eax], al
push es
fisub word [eax + 0x28]
inc eax
add byte [eax], al
or al, byte [esi]
sbb eax, 0x1f8d
add dword [0x1f7e1609], ecx
add byte [eax], al
add al, 0xa2
or dword [edi], edx
sub byte [edx + eax + 0x9a20600], dl
sbb byte [eax], ch
daa
add byte [eax], al
or cl, byte [edx + edx]
add bh, byte [esi + 0x1c]
add byte [eax], al
add al, 0x28
jno 0x7df0f39b
add byte [edx], cl
mov byte [0x95281909], al
add al, byte [eax]
push es
mov byte [0x1f7e1a09], al
add byte [eax], al
add al, 0xa2
or dword [ebx], ebx
add ah, byte [edx + 0x1f7e1c09]
add byte [eax], al
add al, 0xa2
or dword [eax], ebp
jb 0x7df0f3be
add byte [edx], cl
sub byte [ecx], ah
add byte [edx], cl
sub byte [ecx], al
add byte [edx], cl
fiadd word [eax]
sub al, byte [eax]
add byte [eax], al
inc ecx
sbb al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [edx + eax], ch
add byte [edx + eax], bh
add byte [eax], ah
add byte [eax], al
sub eax, 0x13010000
xor byte [edx], al
add byte [ebp + 0x17000000], ch
add byte [eax], al
adc dword [esi], edx
or edi, dword [eax]
mov al, byte [pe_dos_header]
pop es
sbb esi, edi
add dword [ebx + ecx], ebp
push es
outsd dx, dword [esi]
js 0x7df0f40a
add byte [edx], cl
push ss
xor dword [ecx], ecx
sbb cl, byte [ebx]
add byte [edi], al
push ds
inc byte [ecx]
sub al, 0xd
jle 0x7df0f427
add byte [eax], al
add al, 0x39
add byte [eax], 0
add byte [edi], bl
or dword [ebx], ecx
add byte [edi], al
sbb dh, bh
add dword [ecx + 0x16a28], ebp
push es
je 0x7df0f43b
add byte [eax], al
sbb ecx, dword [edx]
sbb dword [ebx], ecx
add byte [edi], al
pop ss
inc byte [ecx]
sub al, 2
sbb byte [ebx], cl
add byte [edi], al
sbb edi, esi
add dword [eax + ecx], ebp
push es
sub byte [edi], ah
add byte [eax], al
push es
sbb al, 0xb
add byte [edi], al
sbb eax, 0x82c01fe
push es
sub byte [eax], ch
add byte [eax], al
push es
push ds
or eax, dword [eax]
pop es
sbb al, 0xfe
add dword [esp + eax], ebp
sub ebp, dword [edi + 0x7000b1d]
pop ds
or esi, edi
add dword [eax + ecx], ebp
sub byte [ecx], ch
add byte [eax], al
push es
pop ds
or cl, byte [ebx]
add byte [edi], al
sbb bh, dh
add dword [edx + ecx], ebp
jle 0x7df0f497
add byte [eax], al
add al, 0x16
xor ecx, esi
sbb ecx, dword [ebx]
add byte [edi], al
push ss
inc byte [ecx]
sub al, 2
pop ss
or eax, dword [eax]
pop es
pop ds
or bh, dh
add dword [edx + eax], ebp
sub eax, dword [0xffff5b38]
jmp [edx]