joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a5a50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x7a5c3a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x7a5c3a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x7a5c3a
cmp dword [ecx], 0
jne 0x7a5c3a
push esi
call fcn.007acaa0
add esp, 4
test eax, eax
je 0x7a5aba
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x7a5ac1
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x7a5aa0
jmp 0x7a5ac3
mov edi, 0x1505
jmp 0x7a5ac3
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x7a5b94
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x7a5b21
call fcn.007a5d00
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x7a5c3a
push esi
call fcn.007acaa0
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.007a5c50
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.007acaa0
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x7ef008]
add esp, 4
test eax, eax
je 0x7a5c35
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.007ac9c0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x7a5c3a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x7a5bb8
inc ebx
dec edx
je 0x7a5adc
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x7a5ae1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x7a5bb0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.007acaa0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x7a5bb0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.007acad0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x7a5bb0
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.007a4bc0
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x7a5b89
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7a6cc0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x7a6e66
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x7a6e5f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x7a6d55
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x7a6e5f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x7a6dce
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x7a6d70
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x7a6d1d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x7a6e10
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x7a6df0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x7a6d10
jmp 0x7a6e1f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x7a6d10
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x7a6e30
jmp 0x7a6d10
shl ecx, 0x10
or ecx, edi
jmp 0x7a6e6b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7a6e80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x7a6eae
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x7a6f4c
not eax
test bl, 1
jne 0x7a6eb5
mov edx, ebx
cmp ebx, 1
jne 0x7a6ee6
jmp 0x7a6f4a
xor eax, eax
jmp 0x7a6f4c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x7ecc50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x7ecc50]
cmp ebx, 1
je 0x7a6f4a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x7ecc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x7ecc50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x7ecc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x7ecc50]
add esi, 2
cmp edx, esi
jne 0x7a6ef0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x7ad0e0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.007e5780
test al, al
je 0x7ad2be
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.007dc8c0
test al, al
je 0x7ad2b9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0xd2eda0a5
mov dword [esp + 8], 0x8e88f28e
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x7ad166
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.007ad2d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x7ad140
mov dword [esp + 4], 0x36c99353
mov dword [esp + 8], 0xdcd17249
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x7ad1b6
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.007ad350
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x7ad190
test esi, esi
je 0x7ad256
mov dword [esp + 4], 0xb9babba3
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x7ad206
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.007ad3c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x7ad1e0
mov dword [esp + 4], 0x69ff45a3
mov dword [esp + 8], 0x3328047a
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x7ad256
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.007ad450
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x7ad230
mov dword [esp + 4], 0x16151413
mov dword [esp + 8], 0xeae9e817
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x7ad2a6
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.007ad4e0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x7ad280
call fcn.007aec60
test al, al
je 0x7ad2b9
call fcn.007b2270
call fcn.007b0310
call fcn.007e6680
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x7ad5b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x7ad6da
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x7ad5ec
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x7ad615
cmp cx, 0x7f
jbe 0x7ad5e0
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x7ad610
mov ecx, ebx
and ecx, 2
xor ebx, 2
lea ebx, [ebx + ecx*2]
jmp 0x7ad5e1
add ebx, 3
jmp 0x7ad5e1
lea esi, [ebx + 1]
push esi
call fcn.007ac990
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x7ad6e8
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x7ad658
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x7ad6ea
movzx edx, word [edi]
test dx, dx
je 0x7ad6ea
cmp dx, 0x7f
jbe 0x7ad640
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x7ad6a0
cmp esi, 0x7ff
ja 0x7ad6a0
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x7ad647
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x7ad647
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x7ad647
push 1
call fcn.007ac990
add esp, 4
mov ebp, eax
jmp 0x7ad6ea
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x7ad705
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x7ad700
test eax, eax
je 0x7ad719
mov ebx, eax
jmp 0x7ad700
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.007a8fa0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x7afc40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x7f4ba4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x7afcee
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x7efbd0]
Function at 0x7b0c00
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov esi, dword [0x7f4b98]
mov dword [esp + 0x3c], 0x832d81cd
mov dword [esp + 0x40], 0x872f853e
mov dword [esp + 0x44], 0x8b268924
mov dword [esp + 0x48], 0x8fe18d2d
mov dword [esp + 0x4c], 0x93fc91e5
mov dword [esp + 0x50], 0x97f695e4
mov dword [esp + 0x54], 0x9bcd99f0
mov dword [esp + 0x58], 0x9f309d35
mov dword [esp + 0x5c], 0xe34de144
mov dword [esp + 0x60], 0xe755e553
mov dword [esp + 0x64], 0xeba4e988
mov dword [esp + 0x68], 0xef8eedb8
mov dword [esp + 0x6c], 0xf382f181
mov dword [esp + 0x70], 0xf786f59a
mov dword [esp + 0x74], 0xfb9af983
mov dword [esp + 0x78], 0xff57fdab
mov dword [esp + 0x7c], 0xc3b4c16e
mov dword [esp + 0x80], 0xc7bdc5b0
mov dword [esp + 0x84], 0xcb72c9a8
mov dword [esp + 0x88], 0xcfbacdba
mov dword [esp + 0x8c], 0xd3b2d1b9
mov dword [esp + 0x90], 0xd766d595
mov dword [esp + 0x94], 0xdb76d968
mov dword [esp + 0x98], 0xdf89dd79
mov dword [esp + 0x9c], 0x23802185
mov dword [esp + 0xa0], 0x278f256f
mov dword [esp + 0xa4], 0x2b45299c
mov dword [esp + 0xa8], 0x2f5d2d59
mov dword [esp + 0xac], 0x335c3147
mov dword [esp + 0xb0], 0x37403547
mov dword [esp + 0xb4], 0x3b523958
mov dword [esp + 0xb8], 0x3f763d77
mov dword [esp + 0xbc], 0x34f0154
mov dword [esp + 0xc0], 0x76a0548
mov dword [esp + 0xc4], 0xba60968
mov dword [esp + 0xc8], 0xfa50da5
mov dword [esp + 0xcc], 0x137211b5
mov dword [esp + 0xd0], 0x17b31553
mov dword [esp + 0xd4], 0x1bb119bb
mov dword [esp + 0xd8], 0x1f771db3
mov dword [esp + 0xdc], 0x63216100
mov dword [esp + 0xe0], 0x67d465cc
mov dword [esp + 0xe4], 0x6bc769c7
mov dword [esp + 0xe8], 0x6f016dc9
mov dword [esp + 0xec], 0x73037101
mov dword [esp + 0xf0], 0x7718750d
mov dword [esp + 0xf4], 0x7b147908
mov dword [esp + 0xf8], 0x7f107d0c
mov dword [esp + 0xfc], 0x43224130
mov dword [esp + 0x100], 0x47e74517
mov dword [esp + 0x104], 0x4beb49ee
mov dword [esp + 0x108], 0x4fe74dfe
mov dword [esp + 0x10c], 0x5327513f
mov dword [esp + 0x110], 0x57215527
mov dword [esp + 0x114], 0x5b295936
mov dword [esp + 0x118], 0x5f5e5d2a
mov dword [esp + 0x11c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xe3
ja 0x7b0e9d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x3c]
push dword [esp + 4]
push eax
call fcn.007b1e00
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x3c], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xe4
jb 0x7b0e70
lea ebx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebx
call esi
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp dword [eax*4 + 0x7efd48]

Function at 0x7b2270
Capabilities:
Contain obfuscated stackstrings
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x7f051c]
Function at 0x7be560
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb40
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x7be580
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x7f5edc]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x7be5b4
mov eax, 0xffffffff
jmp 0x7be5b7
lea eax, [ebx + ebx]
push eax
call fcn.007ac990
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x34], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x7f5edc]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x7be5ec
lea edi, [eax*2 + 0x1a]
push edi
call fcn.007ac990
add esp, 4
mov esi, eax
mov dword [esp + 0x68], 0x59065be8
mov dword [esp + 0x6c], 0x5deb5fff
mov dword [esp + 0x70], 0x513253e8
mov dword [esp + 0x74], 0x55ed57fa
mov dword [esp + 0x78], 0xa91fabe2
mov dword [esp + 0x7c], 0xad1faf17
mov dword [esp + 0x80], 0xa1a2a31e
mov dword [esp + 0x4a8], 0
mov eax, dword [esp + 0x4a8]
cmp eax, 0x1b
ja 0x7be68a
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x4a8]
movzx eax, byte [esp + eax + 0x68]
push dword [esp + 0x4a8]
push eax
call fcn.007c2f40
add esp, 8
mov ecx, dword [esp + 0x4a8]
mov byte [esp + ecx + 0x68], al
inc dword [esp + 0x4a8]
mov eax, dword [esp + 0x4a8]
cmp eax, 0x1c
jb 0x7be650
mov edx, dword [esp + 0x2c]
movzx ecx, word [edx]
mov eax, esi
test cx, cx
je 0x7be6b1
add edx, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x7be6a0
mov word [eax], 0
movzx ecx, word [esp + 0x68]
test cx, cx
je 0x7be6e1
lea edx, [esp + 0x6a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x7be6d0
mov word [eax], 0
lea eax, [esp + 0x830]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.007ea0d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x7f0f3c]
Function at 0x7c4f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x7c4f40
cmp eax, 0xffffffdd
jge 0x7c4f57
mov eax, 0xffffffff
jmp 0x7c4f5a
add eax, 0x22
push eax
call fcn.007ac990
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x9719993c
mov dword [esp + 0x1c], 0x93019518
mov dword [esp + 0x20], 0x8f2f911e
mov dword [esp + 0x24], 0x8b178d17
mov dword [esp + 0x28], 0x871a892c
mov dword [esp + 0x2c], 0x83188519
mov dword [esp + 0x30], 0x7ff38121
mov dword [esp + 0x34], 0x7bf67de8
mov word [esp + 0x38], 0x7978
mov dword [esp + 0x3a], 0
mov word [esp + 0x3e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x27
ja 0x7c4ffb
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.007c5db0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x28
jb 0x7c4fd0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x7c5021
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x7c5010
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x7c5051
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x7c5040
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x3fad3995
mov dword [esp + 0x1c], 0x23cf3da2
mov dword [esp + 0x20], 0x27be2185
mov dword [esp + 0x24], 0x2b8f25b0
mov dword [esp + 0x28], 0x2fb929ba
mov dword [esp + 0x2c], 0x13812d85
mov dword [esp + 0x30], 0x17f91182
mov dword [esp + 0x34], 0x1bf515fb
mov dword [esp + 0x38], 0x1fbc19f6
mov dword [esp + 0x3c], 0x3951d89
mov dword [esp + 0x40], 0x79001a5
mov dword [esp + 0x44], 0xb9905c3
mov dword [esp + 0x48], 0xf9a099a
mov dword [esp + 0x4c], 0xf36a0da9
mov dword [esp + 0x50], 0xf73ff164
mov dword [esp + 0x54], 0xfb27f550
mov dword [esp + 0x58], 0xfffef916
mov dword [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x47
ja 0x7c5136
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.007c5e30
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x48
jb 0x7c5110
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x7c5450
push ecx
push esi
call fcn.007c62c0
add esp, 0x10
mov ebx, eax
jmp dword [0x7f1348]
Function at 0x7c8c80
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x74
mov edi, dword [0x7f5edc]
mov dword [esp + 0x14], 0x37623905
mov dword [esp + 0x18], 0x334d3547
mov dword [esp + 0x1c], 0x4f3a3151
mov dword [esp + 0x20], 0x4b3a4d0d
mov dword [esp + 0x24], 0x471a4938
mov dword [esp + 0x28], 0x43ce4525
mov dword [esp + 0x2c], 0x5f634121
mov dword [esp + 0x30], 0x5d5c
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1f
ja 0x7c8d0b
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.007cb3e0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x20
jb 0x7c8ce0
lea esi, [esp + 0x68]
lea eax, [esp + 0x14]
push esi
push 0
push 0
push 0xe
push eax
push 0
call edi
mov edi, dword [esp + 0x68]
test edi, edi
jns 0x7c8d2e
mov eax, 0xffffffff
jmp 0x7c8d31
lea eax, [edi + edi]
push eax
call fcn.007ac990
add esp, 4
mov ebp, eax
mov ebx, dword [0x7f5edc]
mov dword [esp + 0x14], 0xb7c289a5
mov dword [esp + 0x18], 0xb3ddb527
mov dword [esp + 0x1c], 0xbf2ab1d1
mov dword [esp + 0x20], 0xbb2abdfd
mov dword [esp + 0x24], 0xa7eab928
mov dword [esp + 0x28], 0xa33ea5c5
mov dword [esp + 0x2c], 0xaf83a1c1
mov dword [esp + 0x30], 0xadac
mov byte [esp + 0x34], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x20
ja 0x7c8dcb
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.007cb460
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x21
jb 0x7c8da0
push esi
push edi
push ebp
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebx
mov eax, dword [esp + 0x68]
mov ecx, eax
add ecx, 9
jns 0x7c8deb
mov eax, 0xffffffff
jmp 0x7c8df2
lea eax, [eax*2 + 0x12]
push eax
call fcn.007ac990
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0xf1aeff50
mov dword [esp + 0x18], 0xf557f353
mov dword [esp + 0x1c], 0xc955f749
mov dword [esp + 0x20], 0xcd6dcb71
mov dword [esp + 0x24], 0xc1cecf79
mov byte [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x14
ja 0x7c8e6b
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.007cb4d0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x15
jb 0x7c8e40
movzx ecx, word [ebp]
mov eax, edi
test cx, cx
je 0x7c8e91
lea edx, [ebp + 2]
mov eax, edi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x7c8e80
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x7c8ec1
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x7c8eb0
mov esi, dword [esp + 0x88]
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push edi
call fcn.007ea280
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x64], ebp
jmp dword [eax*4 + 0x7f198c]