joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c82f0f1
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x7c845d13
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlGetActiveActivationContext]
cmp eax, esi
jl 0x7c845d1a
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 4
inc edx
push ebx
jge 0x7c845d8b
outsb dx, byte [esi]
mov dl, 0x70
push esi
pushal
adc al, 0x14
invalid

Function at 0x7c82f6ef
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
ret

Function at 0x7c82f8f6
Capabilities:
Get process heap flags

Disassembly:
push 0x18
push 0x7c82f980
call fcn.7c8024d6
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x30]
call dword [sym.imp.ntdll.dll_RtlAcquirePebLock]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp eax, 0x40
jae 0x7c84510a
mov esi, dword [esi + 0x40]
mov dword [ebp - 0x20], esi
mov edi, eax
mov dword [ebp - 0x24], edi
push 1
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlAreBitsSet]
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], bl
je 0x7c84514f
push 4
lea eax, [ebp + 8]
push eax
push 0xa
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
mov dword [ebp - 0x28], eax
cmp eax, ebx
jl 0x7c845131
push 1
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_RtlClearBits]
or dword [ebp - 4], 0xffffffff
call fcn.7c82f991
movzx eax, byte [ebp - 0x19]
call fcn.7c802511
ret 4
int3
mov dl, 0x89
pop edi
dec ecx
cmp cl, bl
mov ecx, dword [ebp + 0x34]
sub dword [esp + esi*8 + 0x48], ebp
sub byte [edi + 0x65], dh
and dl, 0xb5
pop ss
or ebx, dword [edi + 0x49]
xchg edx, esi
xchg ebx, eax
mov edx, 0x17b205d0
invalid
pop esp
sahf
sub byte [edi + 0xa], dl
dec esi
jbe 0x7c8450fc
xchg ebx, eax
cmp al, 0x6c
outsd dx, dword [esi]
and eax, 0x6a158aa1
Function at 0x7c83004f
Capabilities:
Access pe header

Disassembly:
push edi
call sym.KERNEL32.dll_UnmapViewOfFile
mov edi, 0xc000007b
jmp 0x7c8301f4
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x7c8856cc]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x238], eax
xor esi, esi
mov word [ebp - 0x220], si
xor eax, eax
lea edi, [ebp - 0x21e]
stosd dword es:[edi], eax
mov dword [ebp - 0x214], ecx
stosw word es:[edi], ax
mov word [ebp - 0x228], 8
mov word [ebp - 0x226], 0xa
mov dword [ebp - 0x224], 0x7c830214
mov dword [ebp - 0x210], esi
mov eax, dword fs:[0x18]
push esi
mov dword [ebp - 0x218], eax
push esi
push esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x228]
push eax
push ecx
push 1
mov dword [ebx], esi
mov word [ebp - 0x22e], 0x208
mov word [ebp - 0x230], si
call dword [sym.imp.ntdll.dll_RtlDosApplyFileIsolationRedirection_Ustr]
mov edi, eax
mov eax, 0xc0000000
mov ecx, edi
and ecx, eax
cmp ecx, eax
jne 0x7c83015e
cmp edi, 0xc0150008
jne 0x7c8301f4
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x214]
push 0x104
push dword [ebp - 0x224]
push dword [eax + 4]
push dword [ebp - 0x238]
call sym.KERNEL32.dll_SearchPathW
test eax, eax
je 0x7c840e6f
lea eax, [ebp - 0x230]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
push esi
push esi
push 3
push esi
push 5
push 0x80000000
push dword [eax + 4]
call sym.KERNEL32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
je 0x7c840e6f
push esi
push esi
push esi
push 2
push esi
push edi
call sym.KERNEL32.dll_CreateFileMappingW
push edi
mov dword [ebp - 0x214], eax
call sym.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x214], esi
je 0x7c840e6f
push esi
push esi
push esi
push esi
push 4
push dword [ebp - 0x214]
call sym.KERNEL32.dll_MapViewOfFileEx
push dword [ebp - 0x214]
mov edi, eax
call sym.KERNEL32.dll_CloseHandle
cmp edi, esi
je 0x7c840e6f
push edi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x7c815fff
mov ecx, dword [ebp - 0x210]
mov eax, edi
or eax, 1
mov dword [ebx], eax
push dword [ecx + 4]
push eax
call sub.ntdll.dll_LdrLoadAlternateResourceModule
xor edi, edi
cmp dword [ebp - 0x21c], esi
jne 0x7c840e80
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.7c8097aa
leave
ret 0xc
mov ecx, 0xe7d4d715
sbb eax, 0xb7864026
pop edx
sub eax, 0x52bd188e
Function at 0x7c830420
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x7c819e98
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x7c819e7b
push esi
lea eax, [ebp - 0x20]
push eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push 2
push 0x7c819e90
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
push dword [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
pop esi
jge 0x7c841f2a
and dword [0x7c8857a0], 0
jmp 0x7c830449
mov eax, edi
jmp 0x7c83044b
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x7c8856cc]
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov eax, dword [0x7c8857a0]
inc edi
cmp eax, edi
je 0x7c819e87
test eax, eax
jne 0x7c819e38
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
call fcn.7c8097aa
leave
ret

Function at 0x7c83045b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x7c848e3f
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [esi]
mov edx, ecx
mov ebx, dword [sym.imp.ntdll.dll_NtQueryValueKey]
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp + 0xc]
push eax
push edx
push dword [esi]
lea eax, [ebp - 8]
push 1
push eax
push dword [ebp + 8]
call ebx
mov edi, eax
cmp edi, 0x80000005
je 0x7c848e47
mov eax, dword [ebp + 0x18]
xor ecx, ecx
cmp edi, ecx
jne 0x7c8397f3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
retf
dec edx
retf 0x3f54
jns 0x7c848e63
xor dh, ch
in al, dx
xrelease xchg dword [eax - 0x2be4bbc2], ebp
mov eax, 0x72091da5
cmp dword [edx - 0x78fff441], ecx
ror byte [edi], 1
stc
inc ecx
sub al, 0x67
invalid
invalid

Function at 0x7c83116a
Capabilities:
Encode data using xor

Disassembly:
clc
mov ebx, 0x36839cad
mov eax, 0xe161faa4
mov esi, 0xf6657faa
pop ebp
into
mov esi, 0x655f85da
int1
arpl word [edx + 0x36], bp
mov ch, 0xe0
mov ch, 0xe0
xchg edx, eax
push edx
adc dword [ecx], edx
int1
xor eax, 0x308518f8
pushal
mov bl, dl
retf 0xc8c6
invalid
enter 0xb64, 0x6c
rol byte [ebp - 0x65], 0xd
xor cl, byte [ebx*2 + 0x2d1dee3a]
aaa
jl 0x7c83113d
insd dword es:[edi], dx
push es
idiv dword [ebp - 0x21e1f039]
sub dword [eax + 0x618377cc], edx
stosb byte es:[edi], al
pop esp
sub eax, 0xdb550b37
scasd eax, dword es:[edi]
inc esp
xor bl, byte [edi + 0x1e]
stosd dword es:[edi], eax
dec edi
xchg dword [ecx - 0x56b560eb], esi
lodsd eax, dword [esi]
cmp byte [eax + 0xd], al
loopne 0x7c831157
or al, 0x54
sahf
mov dh, 0xda
fisttp word [ecx + 0x33805c9a]
adc esi, dword [edi - 0x19d9ffd9]
inc ecx
and byte es:[edx + edi - 0x5d], al
xor dl, cl
and bh, byte [ebx + eax*8]
inc ebp
sal dword [ebx], 0x68
or dl, dh
pop es
dec edi
or byte [eax], al
sbb eax, 0x20e39088
loopne 0x7c8311b5
stosd dword es:[edi], eax
and dword [ecx], esp
sbb byte [ebp + 0x46], ch
xor byte [edi], dl
push edi
jmp 0x7c8311d8
Function at 0x7c8316a7
Capabilities:
Encode data using xor

Disassembly:
pop ss
mov ebx, 0xa9de26be
jns 0x7c8316e7
dec esp
fistp qword [0xcc88735f]
add dword [edx], edi
push es
inc edx
xchg edi, eax
mov ah, 0x61
out dx, eax
invalid

Function at 0x7c834a78
Capabilities:
Encode data using xor

Disassembly:
pushal
inc ebx
invalid
loope 0x7c83494f
mov cl, 0x99
ljmp 0xf3b6
pop esp
dec edi
stc
daa
cmp al, 0x7e
jbe 0x7c834961
imul edi, eax, 0xffffffde
inc ecx
jo 0x7c834a59
xor al, 0x7f
mov bh, 0xc8
xor al, 0xaf
movsd dword es:[edi], dword [esi]
lodsb al, byte [esi]
mov ecx, 0x11904a9f
salc
mov word [edx], cs
jno 0x7c8349f0
or dh, bl
jno 0x7c8349f0
in eax, dx
adc al, 0x3d
pop edx
fldcw word [ecx - 0x61]
cmp dword [edi + 0x3b], 0x48
scasd eax, dword es:[edi]
hlt
xchg ebp, eax
pushal
push 9
aam 0x4f
xchg esi, eax
xchg ebx, eax
cwde
push esi
daa
dec eax
and edi, edi
push eax
fnsave dword [ecx]
xchg dword [edi - 0x73], ebx
sahf
jo 0x7c834a5d
cmp byte [edi - 0x14de0d47], bl
mov ah, byte [ecx - 0x1f]
loope 0x7c834a1b
mov byte [edi - 0x56], bh
dec esp
leave
out dx, al
pop edi
ror dword [ebx + edi], 1
call 0x4015e3d3
cmc
loop 0x7c834ac1
pop ds
invalid
dec edi
and byte [edi - 9], dl
cmp ch, byte [edi]
imul esi, dword [ebx + 0x15], 0x25
xor ebp, dword [eax]
or al, 0x32
xor eax, 0x983d6dc7
in al, 0xe5
xchg esp, eax
scasd eax, dword es:[edi]
sbb edi, dword [edi]
adc ch, ch
sub byte [esi], bl
rol dword [ebx - 1], cl
imul ebp, dword [edx + eax*2 - 1], 0xee479c09
sbb dword [ebx - 0x5f], edi
jo 0x7c834aa4
mov dword [ebp - 0x68], edx
pop ds
xlatb
cdq
jge 0x7c834af9
mov dh, 0x2f
js 0x7c834a5f
ja 0x7c834ad9
sub ebp, dword [edx + 0x43]
and ebx, eax
lds ecx, [eax + 0x12]
dec edi
in eax, dx
aas
xchg esi, eax
jns 0x7c834b59
sub al, byte [ebp - 0x9f66fd1]
test dword [edi], ebp
nop
or esi, esi
push esp
jbe 0x7c834b67
std
adc eax, 0x364f2d5b
aad 0xf2
and bh, dl
movsb byte es:[edi], byte [esi]
aad 0x67
push es
xor al, 0xda
push cs
sbb byte [edi + 0x65], dh
mul dword [ecx - 0x682671]
jo 0x7c834b92
invalid
adc byte [edi - 0x423d348], 0xd4
out dx, al
lodsb al, byte [esi]
add dword [ebp - 0x59], 0x52a7ee57
loop 0x7c834ad9
sal dh, cl
mov eax, dword [0x7e1ad157]
mov esp, 0xace53c02
mov edx, 0x1a9eda53
pop esp
inc esp
jg 0x7c834b0f
cmp eax, 0x6fd22fe5
cli
js 0x7c834b55
jge 0x7c834b52
invalid
cmp bl, 0x44
inc esp
xchg edi, eax
aaa
mov edi, 0x8ce75c23
and ebx, dword [edi - 0x74]
in al, 0x77
mov al, 0xc4
salc
adc ebp, ecx
jmp 0x7c834af0
in eax, 0x6b
invalid
popfd
lodsb al, byte [esi]
sbb bl, dl
xor ecx, edi
sal dword [ecx], cl
stc
jo 0x7c834b80
dec ecx
adc dh, byte [eax]
stosb byte es:[edi], al
div dword [ebx - 0x7ed3466]
ja 0x7c834b83
popfd
pop ebx
xor byte [esi + 0x43], bh
pop edi
pop ecx
lodsd eax, dword [esi]
lea ebx, [edi + 0x6a]
retf
Function at 0x7c83895e
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
sal ebp, 0xe
add dword [ebp + 0x4a], edx
mov dword [0x68720a77], eax
dec edx
fnstsw word [eax + ebp*4 + 0x60]
in eax, dx
xor al, 0x75
out 0xc4, al
jle 0x7c8389ba
push esp
cmp dl, 0x73
push ds
pop es
out 0xd7, al
stosb byte es:[edi], al
invalid
cmpsd dword [esi], dword es:[edi]
cmp dword [esi - 0x4f], edx
in al, dx
xor al, 0xf3
cmp ebp, ebx
add al, 0x64
push edi
sub al, 0xfb
je 0x7c8389b2
invalid

Function at 0x7c858c3f
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xa8136cbc
cmp dword [eax - 0x264847cc], eax
cli
rol byte [esi + ebx*8], cl
or eax, 0xbe1d78f9
in eax, 0x39
and bl, byte [edi + 0x61721098]
cwde
adc byte [edx + 0x61], dh
mov dword [ebx + 0x57], 0x47620bc0
sbb ecx, dword [edi + 0x4ecc1155]
sub dword [edx + 0x2d], eax
xor al, 0x9e
or dword [ebx], edi
jecxz 0x7c858c09
push ss
add al, 0x10
loop 0x7c858c81
out 0xac, eax
loop 0x7c858ca3
push es
lodsd eax, dword [esi]
mov al, byte [ebp - 0x712aa45f]
or ebp, dword [edx - 0x39]
loope 0x7c858c80
mov ebx, 0x11ce6da5
jge 0x7c858c3a
cli
movsd dword es:[edi], dword [esi]
insd dword es:[edi], dx
into
adc dword [ebp - 6], edi
cli
cli
xchg edx, eax
js 0x7c858c42
invalid
inc bh
xor al, 0x7d
push edi
and al, 0x87
pushfd
ja 0x7c858bf1
loop 0x7c858c57
salc
push 0x16
test byte [esi - 0x31], dh
xchg ecx, eax
iretd
iretd
cmpsb byte [esi], byte es:[edi]
and dword [ecx], edi
leave
push esi
jne 0x7c858c45
cli
sahf
xlatb
shl byte [edx - 0x10], 1
cmpsb byte [esi], byte es:[edi]
xchg ecx, eax
sar dword [ebx], 0x33
neg byte [ebx + eax*4 + 0x14]
mov edi, 0xcf211b53
jg 0x7c858d1a
test dh, bh
xchg ecx, eax
push esi
test al, 0x3e
sbb dword es:[esi - 0x5a], 0xffffffd1
sbb dword es:[esi - 0x5a], 0xffffffd1
inc eax
lahf
mov cl, dh
pop esp
mov bl, 0x8b
mov ah, 0x5d
cli
cmp dword [ebx - 0x7840a576], esp
xchg dword [esi + 0x475a8d87], edi
jmp fcn.7c858d8b

Function at 0x7c858d33
Capabilities:
Encode data using xor

Disassembly:
cdq
in al, 0x59
cmp byte [eax], ch
daa
sub byte [edi], ah
clc
jl 0x7c858d56
fidivr dword [0xa379b27]
add dh, 0xd8
push 0x6c
sahf
sahf
loopne 0x7c858d38
pop ebp
or eax, 0x3ad18044
add esi, dword [edx + 0x379488c3]
Function at 0x7c85e082
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jne 0x7c85e0a3
pop ss
inc ecx
inc edx
shr byte [eax + 0x49], cl
inc edx
xor al, 0x30
les edi, [ebx - 0x72]
add al, 0xa5
xchg edx, eax
pushal
movsd dword es:[edi], dword [esi]
rcr ebp, cl
sbb ebx, dword [edx + 0x60]
test byte [esi], 0xc8
sbb eax, 0xd1a103a6
fsubr st(0), st(0)
push esp
rcr esp, 1
loopne 0x7c85e0fb
out dx, al
ja 0x7c85e0d2
mov ch, 0xcf
and eax, dword [edx - 0x48]
add esp, dword [ecx + esi - 0x196f2df6]
pop ecx
fld qword [ebx]
xor dword [edx], ecx
rcl byte [eax + 0x3dd59e6], cl
jne 0x7c85e08d
dec edi
test al, 0x83
sal dword [eax - 0x33537dd], 0x91
sub cl, byte [ebp - 0x636219c4]
cmp al, 0x4c
xchg esp, eax
cli
not dword [esi + 0x3b59d90b]
fstp dword [ecx + 0x3b]
loope 0x7c85e0b1
dec esp
std
pop esp
outsb dx, byte [esi]
fdivr qword cs:[edx - 0x794f9de5]
pop ebx
fadd dword [ebp + eax*4 - 0x7767a368]
lahf
and dword [ebp - 0x56], ecx
mov edx, 0x63dcaab7
cmp al, byte [eax]
mov bh, al
cmp al, 3
add byte [esi + 0x24ff0004], ch
and byte [eax + 0x40], al
out 0x22, al
or dword [ecx - 0x5109b385], esi
inc esp
fcom qword [edi - 0x39]
iretd
add al, 0
jmp dword [eax]

Function at 0x7c864c80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
std
in eax, dx
add dword [esi], esi
out 0x2e, al
xor dl, ch
nop
cmp byte [eax - 0x37], bl
pop ebx
sub byte [eax - 0x6c], dl
xor ebp, ecx
mov bh, 0x18
mov ebx, eax
dec ecx
loopne 0x7c864c7e
ljmp 0xbb88:0xc5fe7bf4

Function at 0x7c865b84
Capabilities:
Encode data using xor

Disassembly:
lea esp, [edi + 0x11]
iretd
das
push ebp
add al, 0x53
mov byte [0x5ae57403], al
in eax, 0x5a
jno 0x7c865ade
sub al, 0x4b
fdivr dword [ecx]
dec edx
pop eax
xor eax, 0x647768cb
mov ah, 0x9b
scasb al, byte es:[edi]
push eax
pop ebx
mov dl, 0x42
inc ebp
inc esi
mov ebx, 0xe9dc5251
in al, dx
dec esp
xlatb
rcr dword [edi], 1
xor al, 0x11
test eax, 0xb6cc849a
je 0x7c865a95
bound ebp, qword [ecx - 0x67]
leave
invalid
jnp 0x7c865b42
add ecx, dword [ebx + 0x1257814d]
add ecx, dword [ebx + 0x12]
std
adc bh, ch
ljmp 0x37a6:0x6345814c
mov cl, byte [eax + edi*2 - 0x18]
dec esp
js 0x7c865b2e
sub eax, 0x989b4b1f
insd dword es:[edi], dx
popal
xchg byte [edx - 0x697a8eda], cl
jno 0x7c865ad7
xchg esi, eax
jl 0x7c865b38
imul esp, esi, 0xffffff83
jle 0x7c865bcf
xor al, 0x26
pop eax
pop esp
jle 0x7c865b50
mov ebx, 0x1523ae62
stc
movsb byte es:[edi], byte [esi]
das
add edx, edi
ljmp 0x818c
jge 0x7c865b92
stosd dword es:[edi], eax
adc ebx, eax
dec esi
inc edi
push edx
cmpsd dword [esi], dword es:[edi]
clc
sar byte [ebp - 0x61b2598f], cl
dec ebp
sahf
mov esi, 0x5962d37
xchg ebp, eax
fisubr word [0x54fe060d]
jbe 0x7c865c21
loop 0x7c865b46
pushfd
push ss
js 0x7c865b43
fstp dword [eax + 0x1d]
mov sp, 0xe7db
pop esp
push 0xe2427462
mov esp, 0xf109c4d8
out 0xef, al
imul ebx, dword [esi + 0x36], 0x44e5ff38
mov edi, 0xa166e8e4
in al, 0xe8
mov ax, word [0x8ae9cfe6]
cld
int1
invalid
rcl ebx, 0x2d
popal
invalid
mov byte [0xed646927], al
popfd
push edi
shl dword [eax], 1
retf
Function at 0x7c866adc
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x9379c14c
mov dl, 0x6b
xor eax, 0x3a3c49ef
invalid

Function at 0x7c86d563
Capabilities:
Encode data using xor

Disassembly:
invalid
loop 0x7c86d542
push ecx
mov byte [0x73b614ff], al
sal dword [ecx - 0x31], 1
and dl, dl
invalid

Function at 0x7c86da0a
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xe1ff628a], al
aas
cld
pop es
invalid
or al, 0xaa
test byte [edx + edx], dl
stosd dword es:[edi], eax
jbe 0x7c86da62
mov bh, byte [edx + 0x67f9bf15]
lahf
cmp eax, 0x32c65fd3
sti
jle 0x7c86d9b1
cmp eax, 0x1b689f50
inc edx
mov esi, 0x280cd807
xor bh, byte [eax + 0x4ac1984b]
push es
and byte [esi + 0x1f8ef8ad], cl
sub dword [edi], edi
aaa
daa
cli
and byte [esi - 0x589b5c72], dh
test eax, 0x3c20aee8
sbb ecx, 0xffffffda
dec esi
sub esi, dword [esi - 0x4133ec8a]
or al, ah
invalid
int 0x6c
mov dword [0xa97666ad], eax
mov esp, 0x3b134b18
lodsd eax, dword [esi]
and eax, 0xcfb2f09e
lodsb al, byte [esi]
pop edx
jp 0x7c86daf2
sti
mov ah, 0x6a
ffree st(6)
xlatb
iretd
adc byte [edx], ah
lea edx, [ebp + 0x6ee2485f]
mov ebx, 0x56a6cf70
cmpsb byte [esi], byte es:[edi]
push esi
pop ecx
aaa
or byte [esi - 0x38a833c6], bh
sal dword [ebx], cl
aas
xor ebp, ecx
cmp eax, 0xf5e7f392
loop 0x7c86dae6
lodsd eax, dword [esi]
hlt

Function at 0x7c872079
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x7c8856cc]
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
push 0xc
mov dword [ebp - 0x7c], eax
mov al, byte [ebp + 8]
push 0x20237
mov byte [ebp - 0x74], al
push 0
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
cmp dword [ebp - 0x84], 0
jl 0x7c8720c8
mov eax, dword [ebp - 0x78]
jmp 0x7c8720dc
push dword [ebp - 0x84]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.7c80935e
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.7c8097aa
leave
ret 4

Function at 0x7c873ac1
Capabilities:
Get process heap force flags

Disassembly:
push 0xac
push 0x7c873b80
call fcn.7c8024d6
mov eax, dword [0x7c8856cc]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
push 0x10
push 0x20231
xor ebx, ebx
push ebx
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
cmp dword [ebp - 0x9c], ebx
jge 0x7c873b2f
push dword [ebp - 0x9c]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.7c80935e
jmp 0x7c873b67
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x8c]
mov dword [esi], eax
mov eax, dword [ebp - 0x88]
mov dword [edi], eax
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x7c873b69
xor eax, eax
mov ecx, dword [ebp - 0x1c]
call fcn.7c8097aa
call fcn.7c802511
ret 0xc
Function at 0x7c873b91
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x7c8856cc]
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
push 0x10
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x10]
push 0x20232
mov dword [ebp - 0x70], eax
push 0
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
cmp dword [ebp - 0x84], 0
jge 0x7c873bfd
push dword [ebp - 0x84]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.7c80935e
xor eax, eax
jmp 0x7c873c00
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.7c8097aa
leave
ret 0xc

Function at 0x7c873d92
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x7c8856cc]
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 8]
push 0xc
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
push 0x2022b
mov dword [ebp - 0x74], eax
push 0
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
cmp dword [ebp - 0x84], 0
jge 0x7c873df8
push dword [ebp - 0x84]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.7c80935e
xor eax, eax
jmp 0x7c873dfb
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.7c8097aa
leave
ret 8

Function at 0x7c873e0c
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x7c8856cc]
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 8]
push 0x10
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
push 0x2022c
mov dword [ebp - 0x74], eax
push 0
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x70]
call fcn.7c8097aa
leave
ret 8

Function at 0x7c873e67
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x7c8856cc]
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
push 0x14
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x10]
push 0x2022d
mov dword [ebp - 0x70], eax
push 0
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x6c]
call fcn.7c8097aa
leave
ret 0xc
Function at 0x7c873ec8
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x7c8856cc]
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
push 0x10
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x10]
push 0x2022e
mov dword [ebp - 0x70], eax
push 0
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
cmp dword [ebp - 0x84], 0
jge 0x7c873f34
push dword [ebp - 0x84]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.7c80935e
xor eax, eax
jmp 0x7c873f37
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.7c8097aa
leave
ret 0xc

Function at 0x7c8750bd
Capabilities:
Get process heap force flags

Disassembly:
push 0xac
push 0x7c875178
call fcn.7c8024d6
mov eax, dword [0x7c8856cc]
mov dword [ebp - 0x1c], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x8c], ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x88], eax
or dword [ebp - 4], 0xffffffff
push 0x10
push 0x20229
push esi
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
cmp dword [ebp - 0x9c], esi
jl 0x7c875131
xor eax, eax
inc eax
jmp 0x7c875166
push dword [ebp - 0x9c]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.7c80935e
xor eax, eax
jmp 0x7c875166
mov ecx, dword [ebp - 0x1c]
call fcn.7c8097aa
call fcn.7c802511
ret 8

Function at 0x7c875409
Capabilities:
Get process heap force flags

Disassembly:
push 0xac
push 0x7c8754c0
call fcn.7c8024d6
mov eax, dword [0x7c8856cc]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
push 0x10
push 0x2020c
xor edi, edi
push edi
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
cmp dword [ebp - 0x9c], edi
jl 0x7c87549c
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x8c]
mov dword [esi], eax
movzx eax, byte [ebp - 0x88]
mov dword [esi + 4], eax
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x7c8754b0
push dword [ebp - 0x9c]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.7c80935e
xor eax, eax
mov ecx, dword [ebp - 0x1c]
call fcn.7c8097aa
call fcn.7c802511
ret 8