joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7de865d7
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x7deb4168
test eax, eax
jne 0x7decef46
mov eax, dword [0x7df700b4]
mov edi, 0x7dec02f8
test eax, eax
jne 0x7decef8d
test ebx, ebx
je 0x7decf00f
mov eax, dword [ebx + 0x50]
test eax, 0x30000
jne 0x7decf00f
cmp dword [ebx + 4], 0x7dea2878
jne 0x7decf00f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x7decf00f
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decefba
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.7de86324
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decefe1
pop edi
pop esi
pop ebx
leave
ret 0xc
or cl, byte [eax]
invalid
add byte [edi + 0x5b], bl
jmp fcn.7deaf754
lea eax, [ecx + 1]
mov edi, eax
clc
mov ebx, edx
mov eax, ecx
lock cmpxchg dword [ebx], edi
cmp eax, ecx
jne 0x7decefcf
pop edi
pop ebx
pop esi
jmp fcn.7dea3232
mov ecx, dword [edx]
cmp ecx, esi
je 0x7decefc7
jmp 0x7decefb6
inc eax
std
call dword [eax - 0x6f6f6f70]
mov edi, edi
push ebp
mov ebp, esp
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7deae915
mov eax, dword [ebp + 0x14]
pop ebp
ret 0x10
fld dword [eax - 0x47f8f1d]
and byte [ebx + 0xf], bl
test dword [ecx - 0x9fffd71], eax
ror dword [eax], 0xf
test byte [ebx], ch
jg 0x7decf025
add bh, bh
jbe 0x7decf02d
call fcn.7dea3222
mov eax, dword [esi + 4]
mov dword [edi], eax
dec dword [ebx + 0x7890446]
jmp fcn.7deaf9b7
Function at 0x7de89fd9
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x64
push 8
push dword [eax + 0x18]
call 0x7de64026
test eax, eax
je 0x7dec7da6
or dword [eax], 0x400
ret
cmp ebx, esi
jne 0x7dec7dc4
jmp 0x7df003d2
xor edi, edi
jmp 0x7dec7dc6
test eax, eax
jl 0x7dec7e14
cmp dword [ebp + 0x14], 0
je 0x7dec7e0d
test ebx, ebx
je 0x7dec7e0d
mov eax, dword [esi + 8]
cmp eax, dword [ebx]
ja 0x7df003e8
cmp eax, edi
ja 0x7dec7e0d
push eax
lea eax, [esi + 0xc]
push eax
push dword [ebp + 0x14]
call fcn.7de95f40
add esp, 0xc
jmp 0x7dec7e0d
call dword [ebp - 0x75]
in al, dx
push ecx
push ebx
mov ebx, dword [ebp + 0x18]
push esi
xor esi, esi
push edi
cmp dword [ebp + 0x14], esi
jne 0x7dec76e1
cmp ebx, esi
je 0x7dec76ee
mov edi, dword [ebx]
add edi, 0xc
mov dword [ebp - 4], esi
je 0x7dec7de4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 8
push dword [eax + 0x18]
call fcn.7dea1c26
mov esi, eax
test esi, esi
je 0x7df003dc
lea eax, [ebp - 4]
push eax
push edi
push esi
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7de93698
mov dword [ebp + 0x18], eax
cmp eax, 0xc0000034
jne 0x7dec7d65
mov eax, dword [ebp + 0x18]
test eax, eax
jge 0x7dec7e39
cmp eax, 0x80000005
je 0x7dec7e39
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call fcn.7dea1b85
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x18
test ebx, ebx
je 0x7dec7e42
mov eax, dword [esi + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x7dec7e1b
mov ecx, dword [esi + 4]
mov dword [eax], ecx
jmp 0x7dec7e1b
salc
neg eax
pop ecx
sbb eax, eax
neg eax
jmp 0x7df003de
xor eax, eax
pop esi
pop ebp
ret
call fcn.7def9ae0
and dword [ebp - 0x1c], 0
push 0
call fcn.7deff196
pop ecx
and dword [ebp - 4], 0
push dword [0x4163f0]
call fcn.7defc9a0
pop ecx
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.7df0042f
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7de8b179
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xffffffe0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x7df72088]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x248], 0xffffffff
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x224], edi
cmp esi, edi
je 0x7dec84a1
call 0x7de56db4
test eax, eax
jl 0x7de8b22e
lea edi, [esi + 4]
push edi
call 0x7de57404
mov dword [ebp - 0x230], eax
test eax, eax
jl 0x7dec84c6
movzx eax, word [edi]
mov ecx, 0x1000
cmp ax, cx
je 0x7dec84c6
mov ecx, 0x1400
cmp ax, cx
je 0x7dec84c6
lea eax, [esi + 8]
je 0x7dec8545
Function at 0x7de8b482
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x7df72088]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0xd8], 0xffffffff
or dword [ebp - 0xe4], 0xffffffff
push ebx
push edi
xor edi, edi
xor eax, eax
push 0xa8
mov word [ebp - 0xb0], ax
lea eax, [ebp - 0xae]
push edi
push eax
mov dword [ebp - 0xdc], edi
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xe0], edi
call 0x7de63f20
add esp, 0xc
call 0x7de56db4
mov ebx, eax
movzx eax, word [esi + 4]
neg ebx
sbb bl, bl
inc bl
cmp ax, di
jbe 0x7dec82a1
movzx eax, ax
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0xe4]
push eax
push edi
push dword [ebp - 0xdc]
push esi
call fcn.7de85f5d
cmp eax, 0xc0000034
je 0x7dec82b2
cmp eax, 0xc00000bb
je 0x7dec82b2
cmp eax, edi
jl 0x7de8b595
movsx eax, word [ebp - 0xe4]
mov dword [ebp - 0xd8], eax
cmp eax, 0xffffffff
je 0x7de8b595
mov edi, dword [ebp - 0xd8]
lea eax, [ebp - 0xb0]
imul edi, edi, 0x1c
mov dword [ebp - 0xe8], eax
mov eax, 0xaa
mov word [ebp - 0xea], ax
lea eax, [ebp - 0xec]
push eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
add eax, edi
push eax
push esi
call fcn.7de89b78
test eax, eax
jl 0x7de8b595
push dword [ebp - 0xe8]
push esi
call fcn.7de8a0b7
test eax, eax
jl 0x7dec83a5
mov dword [ebp - 0xd4], 1
test bl, bl
je 0x7de8b67e
mov eax, dword [ebp - 0xd8]
push eax
push esi
call fcn.7de8b68b
mov eax, dword [esi + 0x14]
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0xd0], edi
cmp cx, word [eax + 6]
jae 0x7de8b5e4
mov eax, dword [eax + 0xc]
movzx eax, word [edi + eax]
test al, 2
jne 0x7dec83ca
mov eax, dword [esi + 0x14]
movzx ecx, word [eax + 6]
inc dword [ebp - 0xd0]
add edi, 0x1c
cmp dword [ebp - 0xd0], ecx
jl 0x7de8b5bd
mov eax, dword [esi + 0x14]
xor ecx, ecx
xor edx, edx
cmp cx, word [eax + 6]
jae 0x7de8b62c
mov eax, dword [eax + 0xc]
movzx eax, word [ecx + eax]
test al, 1
je 0x7de8b61d
test al, 0x20
je 0x7de8b61d
test eax, 0x1000
jne 0x7de8b60d
inc dword [ebp - 0xd4]
test bl, bl
je 0x7de8b61d
cmp edx, dword [ebp - 0xd8]
jne 0x7dec8443
mov eax, dword [esi + 0x14]
movzx edi, word [eax + 6]
inc edx
add ecx, 0x1c
cmp edx, edi
jl 0x7de8b5f1
mov eax, dword [esi + 0x14]
xor ecx, ecx
xor edi, edi
cmp cx, word [eax + 6]
jae 0x7de8b657
xor ebx, ebx
mov eax, dword [eax + 0xc]
test byte [ebx + eax], 4
jne 0x7dec8477
mov eax, dword [esi + 0x14]
movzx ecx, word [eax + 6]
inc edi
add ebx, 0x1c
cmp edi, ecx
jl 0x7de8b63b
cmp dword [ebp - 0xe0], 0
jne 0x7dec8483
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call 0x7de64114
leave
ret
or eax, 0xffffffff
jmp 0x7de8b5a3
add byte [eax], al
add ch, al
invalid
invalid
jo 0x7dec83bf
xchg edi, eax
std
inc dword [ebx + 0x7400f47d]
or al, 0xff
jne 0x7dec83a9
mov dl, 0xfc
inc dword [ebx - 0x7cff0b9b]
jge 0x7dec83b1
add byte [esp + ecx - 1], dh
jne 0x7dec83b7
cld
inc dword [ebx - 0x7cff0f9b]
jge 0x7dec83bf
add byte [edi], cl
test eax, edx
fild word [ebx]
add byte [ebx + 0x5b5e5fc7], cl
dec dword [edi]
test al, cl
invalid
nop
nop
nop
nop
nop
Function at 0x7de8b9b1
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x7de8ba22
mov ebx, dword [edi]
test ebx, ebx
je 0x7de8ba22
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x7de8ba22
cmp word [esi + 4], 0
je 0x7dec7bc5
push esi
push ebx
call fcn.7de8ba2e
movzx eax, ax
test ax, ax
jge 0x7de8ba0f
mov ax, word [ebx + 6]
cmp ax, word [ebx + 4]
jae 0x7dec7bd5
movzx ecx, word [ebx + 6]
movzx eax, cx
movsx edi, ax
imul edi, edi, 0x1c
inc ecx
add edi, dword [ebx + 0xc]
mov word [ebx + 6], cx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x7de8ba19
mov word [ecx], ax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, 0xc000000d
jmp 0x7de8ba1b
add byte [ebx + ebx*8 + 0x6410840f], al
add byte [eax], al
nop
nop
nop
nop
Function at 0x7de8c36e
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0xc
test eax, eax
jne 0x7ded28e1
mov eax, dword [ebp + 8]
mov ecx, dword fs:[0x18]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [0x7df700b0]
push esi
add eax, 0x1c0000
push 0x230
or eax, 8
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call 0x7de64026
mov esi, eax
cmp esi, ebx
je 0x7ded2916
push edi
xor eax, eax
inc eax
push eax
push ebx
mov dword [esi], eax
push 0x1f0003
lea edi, [esi + 0x30]
mov dword [esi + 0x18], 0x3f
push edi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x130], ebx
call 0x7de568ac
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x7ded2922
lea eax, [ebp - 0xc]
push eax
lea edi, [esi + 0x10]
push edi
push esi
push 0x7deb41f3
push ebx
push ebx
push ebx
push ebx
push 3
push ebx
push 0xffffffffffffffff
call fcn.7de8c221
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x7ded2922
push 6
push ebx
push ebx
lea eax, [esi + 0x14]
push eax
push 0xffffffffffffffff
push dword [edi]
push 0xffffffffffffffff
call 0x7de55e34
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x7ded2926
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
mov eax, dword [0x7df7018c]
lea edi, [esi + 4]
mov dword [edi], 0x7df70188
mov dword [edi + 4], eax
mov dword [eax], edi
push ebx
mov dword [0x7df7018c], edi
push dword [esi + 0x10]
call 0x7de56058
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x7ded292b
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
pop edi
jl 0x7de8c482
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7ded298d
mov eax, dword [0x7df700b4]
pop esi
pop ebx
test eax, eax
jne 0x7ded29c0
mov eax, dword [ebp - 4]
leave
ret 4
push esi
push 0x7df72078
call fcn.7deabc76
push esi
call fcn.7de95eb0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [0x7df70130]
cmp dword [ebp - 0x1c], eax
jb 0x7ded7f6e
cmp dword [0x7df70148], ebx
je 0x7ded2a18
cmp eax, dword [0x7df70144]
jae 0x7def9936
idiv dword [ebp + 0xf]
sbb dword [eax], 0x70
add al, byte [eax]
or al, 0x3b
ret
dec esp
mov edx, dword [eax]
or eax, 0x7df70148
mov eax, dword fs:[0x18]
push 0x300
push 8
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call fcn.7dea1c26
cmp eax, ebx
je 0x7def992a
mov dword [0x7df70148], eax
mov dword [0x7df70144], 0x20
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0x18
mov ecx, dword [0x7df70148]
cmp dword [eax + ecx], edi
je 0x7def991c
inc dword [ebp - 0x1c]
jmp 0x7ded28f8
inc ebp
add al, 0x89
test dword [eax - 0x38000003], esp
test esp, ebx
cld
invalid
std
invalid
Function at 0x7de8d7b0
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], 0x7dec7d9c
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov edx, dword [eax + 0x30]
mov dword [ebp - 0xc], edi
je 0x7debb91b
mov ecx, dword [ebp + 0x14]
cmp ecx, edi
je 0x7de8d7e4
mov dword [ecx], edi
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test eax, 0xfffffffc
jne 0x7debb971
cmp ebx, 1
jb 0x7debb971
cmp ecx, edi
je 0x7debb971
cmp dword [ebp + 0x18], edi
je 0x7debb971
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
and eax, 3
push edx
push eax
call fcn.7de8dc42
mov esi, eax
cmp esi, edi
jl 0x7debb93a
cmp dword [ebp - 8], edi
je 0x7de8d882
mov eax, dword [ebp - 0xc]
cmp eax, edi
je 0x7de8d88d
cmp dword [ebp - 4], edi
je 0x7de8d88d
mov eax, dword [eax + 8]
cmp ebx, eax
jae 0x7debb942
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.7de8d899
mov esi, eax
cmp esi, edi
jl 0x7debb95b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
lea eax, [eax + ebx*4]
cmp dword [eax], edi
je 0x7de8d88d
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
add eax, 4
mov dword [ecx], eax
xor esi, esi
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0x18
mov esi, 0xc00000e5
jmp 0x7de8d884
push 0x7de9864e
push 0x7de980f6
push edi
push 0x33
call fcn.7deabaf3
add esp, 0x10
mov esi, 0xc000000d
jmp 0x7de8d885
push esi
push 0x7de985ca
jmp 0x7debb961
push eax
push ebx
push 0x7de9864e
push 0x7de9856a
push edi
push 0x33
call fcn.7deabaf3
add esp, 0x18
jmp 0x7debb98c
push esi
push 0x7de98510
push edi
push 0x33
call fcn.7deabaf3
add esp, 0x10
jmp 0x7de8d884
push dword [ebp + 0x18]
push ecx
push ebx
push eax
push 0x7de9864e
push 0x7de9846e
push edi
push 0x33
call fcn.7deabaf3
add esp, 0x20
mov esi, 0xc000000d
jmp 0x7de8d884
Function at 0x7de8f757
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword [0x7df76754]
test eax, eax
jne 0x7ded1740
mov eax, dword [0x7df700b0]
mov ecx, dword fs:[0x18]
add eax, 0xc0000
push 0x10
or eax, 8
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call 0x7de64026
ret
movzx eax, word [ecx + 6]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
test edx, edx
jl 0x7dec9696
jg 0x7df051b9
test eax, eax
ja 0x7df051b9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 8
jl 0x7ded174a
cmp ebx, eax
jae 0x7dec9671
mov ax, bx
jmp 0x7dec9699
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x7de8f7b8
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov dword [ebp - 0x20], ebx
push ebx
lea eax, [ebp - 0x20]
push eax
call fcn.7de8904e
mov dword [ebp - 0x24], eax
cmp eax, ebx
jl 0x7deccb07
push dword [ebp + 0xc]
call 0x7de689f1
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov eax, dword [esi]
cmp eax, ebx
jne 0x7dea312f
cmp esi, 0x7df72090
jne 0x7dea30dd
mov eax, dword [0x7df76760]
cmp eax, 0x200
jne 0x7deccb49
mov eax, dword [0x7df76764]
cmp eax, ebx
jne 0x7deccb57
mov eax, dword [ebp - 0x20]
mov dword [esi], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.7de895ce
cmp dword [ebp - 0x20], ebx
jne 0x7deccb65
cmp dword [ebp - 0x24], ebx
jl 0x7de895b4
mov eax, dword [esi]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7deccb72
mov eax, dword [ebp - 0x24]
jmp 0x7de8f856
push 0x64
push 0x7de9d738
call 0x7de63eb4
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decca98
xor ebx, ebx
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x7deccb9f
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x7deccb9f
cmp dword [ebp + 0xc], ebx
je 0x7deccb9f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], bl
jne 0x7deccb9f
cmp dword [esi], ebx
je 0x7de89532
mov byte [ebp - 0x19], bl
push dword [ebp + 0xc]
call 0x7de68560
mov dword [ebp - 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x7de8f832
xor ecx, ecx
inc ecx
lock xadd dword [eax], ecx
mov eax, dword [esi]
mov dword [edi], eax
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.7de8f863
cmp byte [ebp - 0x19], bl
je 0x7de89532
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7deccaca
xor eax, eax
invalid
sahf

Function at 0x7de8f89b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
call 0x7de8992b
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jge 0x7de8f8d4
jmp 0x7de8fa4c
push 0x1c
push 0x7de9d9e0
call 0x7de63eb4
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7ded1261
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp dword [0x7df72050], ebx
and bh, dh
jge 0x7de8f8db
test byte [edi], bh
invalid
invalid
invalid
mov dword [ebp - 0x1c], ebx
mov dword [esi], 1
mov edx, dword [eax]
test edx, edx
je 0x7ded4483
mov eax, edx
jmp 0x7ded12c3
loopne 0x7ded1272
add byte [eax], al
add byte [edi], cl
test dword [ecx + 0x6c], ecx
add byte [eax], al
ret
push ss
mov eax, dword [ebx + 0x50]
xor dword [esi], eax
mov al, byte [esi + 1]
xor al, byte [esi + 2]
xor al, byte [esi]
cmp byte [esi + 3], al
jne 0x7defe216
mov edx, dword [esi + 0xc]
lea eax, [esi + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
mov edx, dword [edx]
cmp edx, ecx
jne 0x7defe233
cmp edx, eax
jne 0x7defe233
movzx eax, word [esi]
sub dword [ebx + 0x78], eax
mov eax, dword [ebx + 0xb8]
test eax, eax
je 0x7ded1372
movzx ecx, word [esi]
cmp ecx, dword [eax + 4]
jae 0x7ded0674
mov edi, ecx
mov dword [ebp + 0xc], ecx
mov ecx, edi
sub ecx, dword [eax + 0x14]
nop
nop
inc ebx
xor eax, eax
jmp 0x7defe241
Function at 0x7de8ff47
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x7df700b4]
sub esp, 0x50
push ebx
push esi
push edi
mov edi, 0x7dec9ff4
mov esi, 0x7dea2798
test eax, eax
jne 0x7decdd83
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x7de92db3
mov eax, dword [eax + 0x1c]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x7decde0f
cmp dword [ebp + 0xc], 0
je 0x7decde0f
test eax, 0xfffffffc
jne 0x7decde0f
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
cmp byte [ecx + 0x28], 0
jne 0x7decde0f
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.7de90006
mov dword [ebp + 0x14], eax
test eax, eax
jl 0x7de8ffda
mov eax, dword [ebp + 4]
mov ecx, dword [ebx]
mov dword [ecx + 0x54], eax
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decddb6
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decdde2
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x7de8ff77
add byte [edi - 0x18], dl
not byte [ebx]
add byte [eax], al
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jl 0x7decdd9f
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
inc dword [esi + 0x48]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xfffffffe
call 0x7decddbb
mov eax, dword [ebp - 0x1c]
call fcn.7dea1af9
ret 8
nop
nop
nop
nop
nop
add esi, 0x44
push esi
call fcn.7dea65ab
ret
nop
nop
call dword [ebp - 0x75]
in al, dx
sub esp, 8
push ebx
push esi
push edi
push 0x7df74230
call fcn.7dea8370
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x7decde52
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0x18]
cmp eax, ebx
je 0x7def6808
push 0x20
push ebx
push eax
call fcn.7dea1c26
mov edi, eax
cmp edi, ebx
je 0x7def6808
push 0x7fffffff
push ebx
push ebx
push 0x100003
lea edx, [ebp - 4]
push edx
mov dword [edi + 0x14], ebx
call fcn.7de94464
mov esi, eax
cmp esi, ebx
jl 0x7def6812
push 0x7fffffff
push ebx
push ebx
push 0x100003
lea eax, [ebp - 8]
push eax
call fcn.7de94464
mov esi, eax
cmp esi, ebx
jl 0x7def681e
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push ebx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
push ebx
mov dword [esi + 0x24], ebx
push esi
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edi
call fcn.7dea83a6
mov esi, dword [esi]
cmp esi, 0xffffffff
je 0x7decdecb
mov ecx, 1
mov word [esi], cx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xc0000017
call fcn.7debaaa5
push edi
call fcn.7dea82ec
push esi
call fcn.7debaaa5
mov ecx, dword [ebp - 4]
push ecx
call fcn.7de935d0
push edi
call fcn.7dea82ec
push esi
call fcn.7debaaa5
int3
Function at 0x7de91580
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [0x7df700b0]
add eax, 0x180000
mov ecx, dword fs:[0x18]
push 0x68
or eax, 8
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call 0x7de64026
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], edi
cmp esi, ebx
je 0x7decdb29
mov dword [esi], edi
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
lea eax, [esi + 4]
push eax
call 0x7de68c42
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x7de8c0a1
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], edi
lea eax, [esi + 0x20]
push eax
push edi
call fcn.7de8c0e8
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x7de8c092
mov dword [ebp - 4], 2
mov dword [ebp - 0x24], edi
lea eax, [esi + 0x40]
push eax
push ebx
call fcn.7de8c0e8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], 0
call fcn.7de8c1d1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], 0
call fcn.7de8c211
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x2c], 0
call fcn.7de8c1e1
cmp dword [ebp - 0x1c], ebx
jl 0x7de8c0ce
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decdb35
mov dword [ebp - 0x1c], ebx
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decdb6a
mov eax, dword [ebp - 0x1c]
jmp 0x7de915c8
push 0x20
push 0x7de9d788
call 0x7de63eb4
mov dword [ebp - 0x1c], 0xc0000001
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decdabd
xor ebx, ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
xor edi, edi
inc edi
cmp dword [0x7df7206c], edi
jne 0x7de8c008
mov eax, dword [0x7df700b4]
test eax, eax
jne 0x7decdaf2
mov eax, 0xc0000194
call 0x7de63ef9
ret 4
sahf
nop
nop
nop
nop
nop
adc al, 0x8d
inc ebp
call 0xaef454a
inc ebp
loopne 0x7decdb4d
mov ah, 0
idiv dword [ebp - 0x7d]
in al, dx
push eax
push ebx
push esi
push edi
mov edi, 0x7dec9ff4
mov esi, 0x7dea2798
test eax, eax
jne 0x7df0b983
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x7ded09b3
inc ebp
adc al, 0x85
ror byte [edi], 0x84
aas
add byte cs:[eax], al
mov eax, dword [eax + 0x1c]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x7df0ba0f
cmp dword [ebp + 0xc], 0
je 0x7df0ba0f
test eax, 0xfffffffc
jne 0x7df0ba0f
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
cmp byte [ecx + 0x28], 0
jne 0x7df0ba0f
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.7decdc06
mov dword [ebp + 0x14], eax
test eax, eax
xor eax, eax
jmp 0x7decdb77
je 0x7df0b9fa
jo 0x7df0b9d0