joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c9c0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4356c6
mov eax, dword fs:[0]
push eax
sub esp, 0x408
mov eax, dword [0x440b60]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
push esi
mov eax, dword [0x440b60]
xor eax, esp
push eax
lea eax, [esp + 0x414]
mov dword fs:[0], eax
push str.MiniDumpProcessId
call fcn.0041854a
mov esi, eax
add esp, 4
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
add ecx, 1
cmp al, bl
jne 0x40ca20
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x28]
call fcn.004031a0
push 1
push 1
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x428], ebx
call fcn.004082e0
cmp dword [esp + 0x38], 0x10
mov byte [esp + 0x41c], 2
jb 0x40ca6b
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00417000
add esp, 4
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x40]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.0040ab00
mov eax, dword [esp + 0xc]
push eax
call fcn.00413860
movzx eax, al
add esp, 4
cmp eax, ebx
jne 0x40cbb7
push str.32_bit_dump_tool_called_for_64_bit_target__running_64_bit_dump_tool_n
call fcn.00418404
add esp, 4
push 0x104
lea ecx, [esp + 0x108]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x104]
push 0x2e
push edx
call fcn.00417010
mov ecx, dword [str.64.exe]
mov dword [eax], ecx
mov dx, word [0x4376ac]
mov word [eax + 4], dx
mov cl, byte [0x4376ae]
push 0x40
lea edx, [esp + 0xd0]
push ebx
push edx
mov byte [eax + 6], cl
call fcn.00417120
xor eax, eax
add esp, 0x14
push 0x208
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0xc4], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [esp + 0x210]
push eax
call fcn.004182e0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc4]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x128]
push ecx
mov byte [esp + 0x437], bl
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
je 0x40cb81
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
lea ecx, [esp + 0x8c]
mov dword [esp + 0x41c], 0xffffffff
call fcn.00402390
lea ecx, [esp + 0x8c]
push ecx
mov dword [esp + 0x90], vtable.std::ios_base.0
call fcn.00415c9e
add esp, 4
xor al, al
jmp 0x40cbeb
lea ecx, [esp + 0x8c]
mov dword [esp + 0x41c], 0xffffffff
call fcn.00402390
lea edx, [esp + 0x8c]
push edx
mov dword [esp + 0x90], vtable.std::ios_base.0
call fcn.00415c9e
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x414]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0041760b
add esp, 0x414
ret
Function at 0x40d640
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x4357f1
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x440b60]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x440b60]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov edi, dword [esp + 0x278]
cmp dword [edi + 0x18], 0x10
mov ebp, ecx
lea esi, [edi + 4]
jb 0x40d691
mov eax, dword [esi]
jmp 0x40d693
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d6a3
test al, 0x10
je 0x40d6d5
xor ebx, ebx
push ebx
lea esi, [ebp + 0x14]
push 0x43761d
mov ecx, esi
call fcn.004031a0
push 0x10
push str.File_not_found:
mov ecx, esi
call fcn.00402c90
push 0xffffffffffffffff
push ebx
push edi
mov ecx, esi
call fcn.00402b90
xor al, al
jmp 0x40d820
xor ebx, ebx
cmp dword [edi + 0x18], 0x10
mov dword [esp + 0x18], ebx
jb 0x40d6e3
mov esi, dword [esi]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x160]
push ecx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov edi, 0xf
lea eax, [esp + 0x15c]
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40d717
sub eax, edx
push eax
lea edx, [esp + 0x160]
push edx
lea ecx, [esp + 0x40]
call fcn.004031a0
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x54]
push ecx
push 0x104
mov dword [esp + 0x278], ebx
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea edx, [esp + 0x15c]
push edx
call esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, ebp
mov byte [esp + 0x278], 2
call fcn.00407e20
test al, al
jne 0x40d7cc
mov ebp, 0x10
cmp dword [esp + 0x34], ebp
jb 0x40d7a2
mov edx, dword [esp + 0x20]
push edx
call fcn.00417000
add esp, 4
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call esi
cmp dword [esp + 0x50], ebp
jb 0x40d7c8
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00417000
add esp, 4
xor al, al
jmp 0x40d820
push ebx
push ebx
lea edx, [esp + 0x24]
push edx
mov ecx, ebp
call fcn.0040d390
mov ebp, 0x10
cmp dword [esp + 0x34], ebp
mov byte [esp + 0x17], al
jb 0x40d7f6
mov eax, dword [esp + 0x20]
push eax
call fcn.00417000
add esp, 4
lea ecx, [esp + 0x54]
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call esi
cmp dword [esp + 0x50], ebp
jb 0x40d81c
mov edx, dword [esp + 0x3c]
push edx
call fcn.00417000
add esp, 4
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.0041760b
add esp, 0x260
ret 4
Function at 0x412420
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4361b8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push esi
mov eax, dword [0x440b60]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, dword [esp + 0x88]
push esi
call fcn.00412360
add esp, 4
test al, al
jne 0x4124c5
cmp dword [esi + 0x18], 0x10
jb 0x412463
mov eax, dword [esi + 4]
jmp 0x412466
lea eax, [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4124c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4124c5
push esi
lea eax, [esp + 0xc]
push str.Failed_to_create_directory
push eax
call fcn.00403b90
add esp, 0xc
push 0
push 0
push 2
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x90], 0
call fcn.00411c00
push 0x43e0cc
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], vtable.win32::CErrorException.0
call fcn.004177be
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x7c
ret

Function at 0x413520
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x28]
mov dx, word [esp]
mov eax, dword [esp + 0x2c]
mov word [ecx], dx
mov cx, word [esp + 0x20]
mov word [eax], cx
add esp, 0x24
ret
Function at 0x413630
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x440b60]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
mov ebx, dword [esp + 0xa8]
push esi
push edi
push 0x94
xor esi, esi
lea eax, [esp + 0x10]
push esi
push eax
or edi, 0xffffffff
call fcn.00417120
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
jne 0x413691
or edi, edi
mov esi, str.unknown
jmp 0x413734
mov eax, dword [esp + 0x1c]
sub eax, 0
je 0x41372d
sub eax, 1
je 0x4136fd
sub eax, 1
jne 0x413734
cmp edx, 4
ja 0x4136b9
lea edi, [eax + 1]
mov esi, 0x4381a8
cmp edx, 5
jne 0x4136ea
test ecx, ecx
jne 0x4136cc
lea edi, [edx - 3]
mov esi, str.2000
jmp 0x413734
cmp ecx, 1
jne 0x4136db
lea edi, [ecx + 2]
mov esi, 0x43819c
jmp 0x413734
cmp ecx, 2
jne 0x413734
lea edi, [ecx + 5]
mov esi, str.2003
jmp 0x413734
cmp edx, 6
jne 0x413734
test ecx, ecx
jne 0x413734
lea edi, [edx + 2]
mov esi, 0x438190
jmp 0x413734
cmp edx, 4
jne 0x413734
test ecx, ecx
jne 0x41370f
mov edi, edx
mov esi, 0x43818c
jmp 0x413734
cmp ecx, 0xa
jne 0x41371e
lea edi, [ecx - 5]
mov esi, 0x438188
jmp 0x413734
cmp ecx, 0x5a
jne 0x413734
lea edi, [ecx - 0x54]
mov esi, 0x438184
jmp 0x413734
xor edi, edi
mov esi, 0x438180
test ebx, ebx
je 0x41379b
test esi, esi
je 0x413750
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x413741
sub eax, edx
push eax
push esi
jmp 0x413794
movzx eax, cl
push eax
movzx ecx, dl
movzx edx, byte [esp + 0x20]
push ecx
push edx
push str._.2x_.2x_.2x
lea eax, [esp + 0xb0]
push 7
push eax
call fcn.00413440
lea eax, [esp + 0xb8]
add esp, 0x18
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x413780
sub eax, edx
push eax
lea ecx, [esp + 0xa4]
push ecx
mov ecx, ebx
call fcn.004031a0
mov ecx, dword [esp + 0xa8]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041760b
add esp, 0xa0
ret

Function at 0x41760b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x440b60]
jne 0x417615
repz ret
jmp fcn.0042035d
Function at 0x421daf
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x441780]
je 0x421dca
inc edi
cmp edi, 0x17
jb 0x421dbb
cmp edi, 0x17
jae 0x421f4a
push ebp
push 3
call fcn.0043058f
cmp eax, 1
pop ecx
je 0x421f16
push 3
call fcn.0043058f
test eax, eax
pop ecx
jne 0x421dfe
cmp dword [0x440d40], 1
je 0x421f16
cmp ebx, 0xfc
je 0x421f49
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x442c10
push ebp
call fcn.0041e271
add esp, 0xc
test eax, eax
je 0x421e34
push esi
push esi
push esi
push esi
push esi
call fcn.00417624
add esp, 0x14
push 0x104
mov esi, 0x442c29
push esi
push 0
mov byte [0x442d2d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x421e78
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0041e271
add esp, 0xc
test eax, eax
je 0x421e78
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00417624
add esp, 0x14
push esi
call fcn.0041b8c0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x421ebd
push esi
call fcn.0041b8c0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x442f24
push 0x437afc
sub ecx, eax
push ecx
push eax
call fcn.00422ae1
add esp, 0x14
test eax, eax
je 0x421ebd
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00417624
add esp, 0x14
jmp 0x421ebf
xor esi, esi
push 0x437ae8
push ebx
push ebp
call fcn.00427686
add esp, 0xc
test eax, eax
je 0x421edf
push esi
push esi
push esi
push esi
push esi
call fcn.00417624
add esp, 0x14
push dword [edi*8 + 0x441784]
push ebx
push ebp
call fcn.00427686
add esp, 0xc
test eax, eax
je 0x421f01
push esi
push esi
push esi
push esi
push esi
call fcn.00417624
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004303d2
add esp, 0xc
jmp 0x421f49
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x421f49
cmp ebp, 0xffffffff
je 0x421f49
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x441784]
push dword [esi]
call fcn.0041b8c0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4303d2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0041f0c6
xor ebx, ebx
cmp dword [0x443098], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4304a8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x430588
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43b0ec
push edi
call esi
cmp eax, ebx
je 0x430588
push eax
call fcn.0041f058
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x443098], eax
call esi
push eax
call fcn.0041f058
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44309c], eax
call esi
push eax
call fcn.0041f058
mov dword [0x4430a0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00418804
test eax, eax
pop ecx
pop ecx
je 0x430476
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00417624
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4304a8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0041f058
cmp eax, ebx
pop ecx
mov dword [0x4430a8], eax
je 0x4304a8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041f058
pop ecx
mov dword [0x4430a4], eax
mov eax, dword [0x4430a4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43052d
cmp dword [0x4430a8], ecx
je 0x43052d
push eax
call fcn.0041f0cf
push dword [0x4430a8]
mov esi, eax
call fcn.0041f0cf
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43052d
cmp edi, ebx
je 0x43052d
call esi
cmp eax, ebx
je 0x4304fa
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4304fa
test byte [ebp - 0x18], 1
jne 0x43052d
lea eax, [ebp - 0x10]
push eax
call fcn.0041883b
test eax, eax
pop ecx
je 0x430515
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00417624
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x430524
or dword [ebp + 0x10], 0x200000
jmp 0x430568
or dword [ebp + 0x10], 0x40000
jmp 0x430568
mov eax, dword [0x44309c]
cmp eax, dword [ebp - 8]
je 0x430568
push eax
call fcn.0041f0cf
cmp eax, ebx
pop ecx
je 0x430568
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x430568
mov eax, dword [0x4430a0]
cmp eax, dword [ebp - 8]
je 0x430568
push eax
call fcn.0041f0cf
cmp eax, ebx
pop ecx
je 0x430568
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x443098]
call fcn.0041f0cf
cmp eax, ebx
pop ecx
je 0x430588
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43058a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7881a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
jl 0x7881d9
lea esp, [esp + 3]
mov dword [esp + 0x24], edi
jmp 0x7881de
jmp 0x78834a
lea esp, [esp + 0x24]
jmp 0x788356
lea esp, [esp + 3]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
pushfd
jmp 0x7880ca

Function at 0x78cc85
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
je 0x78ccbb
jne 0x78ccbb
xchg byte [0xe027d48d], bl
invalid
lea edx, [ecx + ebx]
mov ax, 0xadc6
jmp 0x78ccc2
mov dword [edi], edx
neg dx
jmp 0x78ccdc
js 0x78cca5
lea edx, [ecx + ebx]
mov ax, 0xadc6
jmp 0x78ccc2

Function at 0x7bad4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
pop word [esp]
lea esp, [esp + 2]
jmp 0x7bae92
inc bx
movzx edx, byte [eax + 1]
jmp 0x7bab7a
mov bx, sp
lea ebx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x7badb3
lea esp, [esp + 4]
mov byte [eax + esi + 0x18], cl
jmp 0x7bad64
jmp 0x7bad36
jne 0x77b7f1
mov ah, 0xbe
pushfd
jmp 0x7bad6d
inc eax
inc dword [ebp + 8]
cmp eax, 0x40
jmp 0x7bad4e
xor ecx, ecx
mov eax, 0xc2973c88
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x7bae0a
shl edx, 8
or edx, ebx
lea ebx, [eax + edi]
jmp 0x7badd9
movzx ebx, byte [eax]
push esi
push word [esp + 1]
pop word [esp + 1]
jmp 0x7bad9a
movzx ebx, byte [ecx]
pop ecx
jmp 0x7bade4
push ecx
mov ecx, eax
add ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x7badc3
shl edx, 8
or edx, ebx
lea ebx, [eax + esi]
jmp 0x7bae33
push eax
mov eax, ecx
lea eax, [eax*4]
jmp 0x7bae16
lea esp, [esp + 0x20]
lea eax, [esi + 0x1a]
jmp 0x7bab6e
lea eax, [eax + ebp]
add eax, 0xffffffc0
mov dword [eax], edx
pop eax
jmp 0x7bae64
movzx ebx, byte [eax - 2]
shl edx, 8
or edx, ebx
pushfd
jmp 0x7badee
cmp ecx, 0x10
jb 0x7bab6e
not eax
jmp 0x7bae85
call fcn.00796346
mov al, byte [esp]
lea eax, [edx - 0xb7]
jmp 0x7bae6f
lea esp, [esp + 8]
inc ecx
add eax, 4
stc
jmp 0x7bae3f
lea eax, [ecx*4]
jmp 0x7baea8
lea ecx, [esi + 8]
not ax
mov ah, 0xe1
lea eax, [ebp - 0x40]
jmp 0x7bae4c
test edi, edi
jmp 0x7baeaf
xor eax, eax
jmp 0x77b7f1
jne 0x7bab9f
je 0x7baeec
or edx, dword [edi + reloc.RASAPI32.dll_RasHangUpA]
xchg ebx, eax
or byte [esi + 0x3fb708f9], bl
movsd dword es:[edi], dword [esi]
xor eax, 0x541caf5c
pop ebx
jmp 0x77b807

Function at 0x7bad8b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esp + 1], dx
lea esp, [esp + 4]
dec edi
call fcn.007bad4c
Function at 0x7cc0e4
Capabilities:
Encode data using xor

Disassembly:
jae 0x7cbe14
bsr edx, eax
not dl
bsf dx, di
jmp 0x7cc108
mov eax, dword [ebp + 0xc]
lea esp, [esp + 4]
cmp eax, 0x10000
jmp 0x7cc0c9
mov edx, dword [eax]
pop eax
jmp 0x7cc110
push eax
mov eax, esi
add eax, 0x10
jmp 0x7cc0f2
cmp eax, edx
push ebp
lea esp, [esp + 4]
jb 0x7cbfd1
jae 0x7cc123
rol dword [eax - reloc.RASAPI32.dll_RasHangUpA], 0xb3
mov ecx, dword [ebp - reloc.RASAPI32.dll_RasHangUpA]
mov bl, bh
mov bl, 0x8b
lea ebx, [esp + eax]
mov ebx, ecx
jmp 0x7cc189
pushfd
lea esp, [esp + 1]
jmp 0x7cc16a
mov ebx, dword [ebp]
pop ebp
add ebx, edx
sub esp, 1
clc
jmp 0x7cc148
cmp eax, ebx
pushfd
pop word [esp]
lea esp, [esp + 2]
jmp 0x7cc1a7
push ebp
mov ebp, esi
add ebp, 0x14
jmp 0x7cc15e
sub eax, edx
cmp di, 0x117e
cmc
not edx
jmp 0x7cc1b5
lea esp, [esp + 4]
jae 0x7cbfd1
pushal
pushfd
jmp 0x7cc191
push ecx
mov ecx, esi
add ecx, 0x1c
jmp 0x7cc251
mov edx, dword [ecx]
pop ecx
lea edi, reloc.RASAPI32.dll_RasHangUpA
call fcn.007cc210

Function at 0x86ea71
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ebx, ecx
add esp, 2
mov bp, dx
xchg word [esp + 1], di
add esp, 1
jmp 0x86ea54
mov byte [esp + 2], dh
push dword [esp + 3]
bts ecx, eax
rdtsc
xchg word [esp + 5], si
mov bx, 0x7379
jmp 0x86ea10
mov word [esp], ax
cmp bl, 0x83
push dword [esp + 1]
pop ebx
rdtsc
jmp 0x86eac8
not ebx
xchg si, cx
rdtsc
rdtsc
xchg dword [esp], edx
mov ebp, esp
jmp 0x86ea3e
mov word [esp + 1], cx
mov word [esp], dx
xchg ebx, esi
mov bx, 0x7bd2
bswap ebx
jmp 0x86ea26
mov bx, 0x4846
sbb ebx, ebp
mov di, 0x5bcc
xchg ch, cl
lea eax, [edx + edi]
jmp 0x86eaae
rdtsc
lea ecx, reloc.RASAPI32.dll_RasHangUpA
add esp, 0
mov bl, 0x9c
lea ebx, [eax + ebp]
neg dl
jmp 0x86ea84
mov bp, 0x4040
pushfd
mov ebp, ebx
rdtsc
inc bl
pop ax
jmp 0x86eaff
shl ebp, 0x1e
lea ebp, reloc.RASAPI32.dll_RasHangUpA
add esp, 4
mov byte [esp], dh
dec cl
mov esi, 0x9b483f27
jmp 0x86ea9a
add esp, 0
mov al, 0x7d
mov byte [esp], dl
mov bh, 0xe7
cpuid
mov si, word [esp]
jmp 0x86eb17
mov bp, word [esp + 1]
mov ebp, 0x5dec539d
add esp, 1
add esp, 1
rol esi, 0xd
add esp, 0
jmp 0x86eae0
mov ch, bh
neg cl
mov ax, word [esp]
xchg ecx, eax
add ax, 0xc67e
mov edx, dword [esp]
jmp 0x86eb58
mov bl, dl
xchg dx, bx
pushal
pop edi
lea ebp, [ebx*4]
mov cx, 0x5dc8
jmp 0x86eb42

Function at 0x86fa50
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
xchg di, ax
setnp al
jmp 0x86fa79

Function at 0x8742f6
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x20], ecx
call fcn.008742b6
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x48], esi
call 0x87431d
jae 0x874373
test dword [edi], esi
mov byte [esp + 8], bh
lea esp, [esp + 2]
mov dword [esp + 0x4c], ebp
call 0x8742f6
call fcn.008745b1
mov word [esp + 1], dx
call fcn.00874521

Function at 0x87431d
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x20], ecx
call fcn.008742b6
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x48], esi
call 0x87431d
jae 0x874373
test dword [edi], esi
mov byte [esp + 8], bh
lea esp, [esp + 2]
mov dword [esp + 0x4c], ebp
call 0x8742f6
call fcn.008745b1
mov word [esp + 1], dx
call fcn.00874521
Function at 0x87432c
Capabilities:
Parse pe header

Disassembly:
call fcn.00873ffe
lea esp, [esp + 2]
mov dword [esp + 0x50], edi
lea esp, [esp + 0x50]
jmp 0x87442e
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x873ff9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x874383
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x66e91ec1
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x4e186a94
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x30691a6
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0xc]
jb 0x30691e0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 8], ecx
jb 0x3069205
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jle 0x30691f1
mov eax, dword [ebp + 8]
jmp 0x306921a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0x30691c4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
sub edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x14]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x307b6e6
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
xorpd xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov eax, dword [0x10095fa0]
or eax, dword [0x10095fa4]
jne 0x307b74d
push 0x33
call fcn.0307b713
mov eax, dword [0x10095fa0]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10095fa4]
mov dword [ebp - 8], ecx
push 0x33
call fcn.0307b765