joyce8/EMBER2024-capa huggingface dataset:
Function at 0x751d40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0x8c]
cmp eax, 1
je 0x751d53
cmp eax, 2
jne 0x751d5a
mov eax, esi
call fcn.00751950
push edi
mov ecx, esi
call fcn.00751be0
mov eax, dword [esi + 0x8c]
mov edi, 3
cmp eax, edi
jne 0x751de5
mov eax, dword [esi + 0xb4]
cmp eax, dword [esi + 0xb8]
jne 0x751d9e
call fcn.0074b470
mov ecx, dword [esi + 0xc0]
add ecx, 0x1388
cmp eax, ecx
jbe 0x751d9e
push 0x13
call fcn.007518e0
add esp, 4
cmp dword [esi + 0x8c], edi
jne 0x751de5
mov eax, dword [esi + 0xb8]
cmp dword [esi + 0xb4], eax
je 0x751de5
push ebx
mov ebx, dword [esi + 0xbc]
add ebx, eax
cmp dword [ebx], 0
je 0x751dd0
call fcn.0074b470
sub eax, dword [ebx]
cmp eax, 0xfa
jb 0x751de4
mov eax, ebx
mov edi, esi
call fcn.00751890
test eax, eax
jl 0x751de4
call fcn.0074b470
mov dword [ebx], eax
pop ebx
mov eax, dword [esi + 0x20c]
test eax, eax
pop edi
jne 0x751e2f
mov ecx, dword [esi + 0x210]
test ecx, ecx
je 0x751e2f
mov edx, dword [esi + 0x20c]
mov eax, dword [esi + 0x214]
inc edx
test eax, eax
mov dword [esi + 0x20c], edx
je 0x751e18
push ecx
push esi
call eax
add esp, 8
mov eax, dword [esi + 0x20c]
dec eax
mov dword [esi + 0x20c], eax
mov dword [esi + 0x210], 0
pop esi
ret

Function at 0x752620
Capabilities:
Encode data using xor

Disassembly:
push 0x23
push eax
call fcn.0075cc30
add esp, 8
test eax, eax
je 0x75265a
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
je 0x752650
push esi
mov esi, ecx
shl ecx, 5
sar esi, 0x1b
xor esi, ecx
movsx ecx, dl
mov dl, byte [eax + 1]
xor ecx, esi
inc eax
test dl, dl
jne 0x752638
pop esi
mov edx, dword [esp + 4]
mov dword [edx + 0x90], ecx
ret
Function at 0x753f70
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x81a1d0]
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 2
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x753fa6
xor eax, eax
mov ecx, dword [esp + 0x190]
call fcn.00760e8e
add esp, 0x194
ret
mov eax, dword [0x8b82b0]
test eax, eax
jne 0x753fb9
call fcn.0074b470
mov dword [0x8b82b0], eax
push 0x2f0
call fcn.00582f80
mov edx, eax
add esp, 4
test edx, edx
je 0x753fe5
push edi
xor eax, eax
mov ecx, 0xbc
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], eax
mov dword [edx + 0x5c], eax
mov word [edx + 0x8e], ax
pop edi
mov ecx, dword [esp + 0x190]
mov eax, edx
call fcn.00760e8e
add esp, 0x194
ret
Function at 0x754850
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x7c]
test eax, eax
push edi
mov edi, dword [esp + 0x18]
je 0x754873
mov eax, dword [esi + 0x74]
cmp dword [esi + 0x78], eax
je 0x75489b
test edi, edi
jne 0x754883
test ebp, ebp
jne 0x754883
test ebx, ebx
je 0x754903
push esi
call fcn.007541d0
mov eax, dword [esi + 0x7c]
add esp, 4
test eax, eax
je 0x754903
mov eax, dword [esi + 0x74]
cmp dword [esi + 0x78], eax
jne 0x754903
mov ecx, dword [esi + 0x7c]
add eax, 0xfffffff4
cmp eax, 1
lea esi, [ecx + 0xc]
jge 0x7548b0
mov esi, 0x783fe5
jmp 0x7548b4
mov byte [esi + eax], 0
test edi, edi
je 0x7548d7
movzx ebx, byte [ecx + 2]
xor edx, edx
mov dh, byte [ecx]
mov dl, byte [ecx + 1]
shl edx, 8
or edx, ebx
movzx ebx, byte [ecx + 3]
shl edx, 8
or edx, ebx
mov ebx, dword [esp + 0x20]
mov dword [edi], edx
test ebp, ebp
je 0x7548f8
movzx edi, byte [ecx + 6]
xor edx, edx
mov dh, byte [ecx + 4]
mov dl, byte [ecx + 5]
movzx ecx, byte [ecx + 7]
shl edx, 8
or edx, edi
shl edx, 8
or edx, ecx
mov dword [ebp], edx
test ebx, ebx
je 0x754906
pop edi
mov dword [ebx], esi
pop esi
pop ebp
pop ebx
ret
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x754f60
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Hash data with crc32

Disassembly:
mov eax, dword [0x8b83c0]
push ebx
xor ebx, ebx
cmp eax, ebx
push ebp
jne 0x754f8d
push 0xa
push 0xffffffffffffffff
push 0x7d34e0
push 0x8b82b8
mov dword [0x8b83c0], 1
call fcn.00754f60
add esp, 0x10
mov edx, dword [esp + 0x18]
cmp edx, ebx
mov ebp, dword [esp + 0xc]
jge 0x754f9d
neg edx
jmp 0x754fb7
xor eax, eax
nop
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x754fa0
mov byte [ebp + 0x100], bl
mov dword [ebp + 0x104], ebx
cmp dword [esp + 0x14], ebx
jge 0x754fdc
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp byte [ecx], bl
je 0x755056
jmp 0x754fd0
inc eax
cmp byte [ecx + eax], bl
jne 0x754fd0
mov dword [esp + 0x14], eax
cmp eax, ebx
jle 0x755056
push esi
shl edx, 8
mov eax, edx
push edi
xor edi, edi
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x20], eax
jle 0x755054
xor ecx, ecx
mov eax, esi
cdq
idiv dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
movzx edx, byte [edx + eax]
xor edx, ecx
mov ecx, dword [edx*4 + 0x7d30e0]
mov eax, edi
shr eax, 8
xor eax, ecx
mov ecx, esi
and ecx, 0xff
mov bl, byte [ecx + ebp]
lea edx, [ecx + ebp]
mov ecx, eax
and ecx, 0xff
movzx edi, bl
xor ecx, edi
mov edi, dword [ecx*4 + 0x7d30e0]
shr eax, 8
xor eax, edi
mov edi, eax
mov ecx, edi
and ecx, 0xff
mov al, byte [ecx + ebp]
mov byte [edx], al
mov eax, dword [esp + 0x20]
inc esi
cmp esi, eax
mov byte [ecx + ebp], bl
jl 0x754ff3
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x755060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
push ebp
push esi
mov esi, dword [esp + 0xc]
mov al, byte [esi + 0x100]
mov ebp, dword [esi + 0x104]
jle 0x7550e3
movzx ecx, al
push ebx
mov ebx, dword [esp + 0x14]
push edi
lea edi, [ecx + esi]
mov ecx, ebp
and ecx, 0xff
mov dword [esp + 0x1c], edx
movzx edx, byte [edi]
xor edx, ecx
mov ecx, dword [edx*4 + 0x7d30e0]
shr ebp, 8
xor ebp, ecx
inc al
mov byte [esp + 0x14], al
movzx eax, al
lea edi, [eax + esi]
xor eax, eax
mov al, byte [edi]
xor edx, edx
mov ecx, ebp
and ecx, 0xff
mov dl, byte [ecx + esi]
mov byte [edi], dl
mov byte [ecx + esi], al
sub eax, edx
and eax, 0xff
mov dl, byte [eax + esi]
xor byte [ebx], dl
mov eax, dword [esp + 0x1c]
inc ebx
dec eax
mov dword [esp + 0x1c], eax
mov al, byte [esp + 0x14]
jne 0x755092
pop edi
pop ebx
mov dword [esi + 0x104], ebp
mov byte [esi + 0x100], al
pop esi
pop ebp
ret
Function at 0x756b90
Capabilities:
Write file on windows

Disassembly:
push ebp
push esi
mov esi, eax
test esi, esi
je 0x756c56
mov ebp, dword [esi]
mov eax, dword [ebx + 0x190c]
mov ecx, dword [ebx + 0x1908]
add ebp, 8
sub ecx, eax
lea edx, [ebp + 8]
cmp ecx, edx
jge 0x756bbc
pop esi
or eax, 0xffffffff
pop ebp
ret
mov ecx, dword [ebx + 0x1910]
shl ecx, 0xb
add ecx, eax
lea eax, [ecx + ebx + 0x908]
mov byte [eax], 0x47
mov byte [eax + 1], 0x53
mov dl, byte [esi]
mov byte [eax + 2], dl
mov cl, byte [esi]
not cl
mov byte [eax + 3], cl
mov ecx, ebp
mov edx, ecx
shr ecx, 2
push edi
add esi, 8
lea edi, [eax + 4]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
test ebp, ebp
lea edx, [eax + 4]
jle 0x756c10
mov esi, ebp
movzx di, byte [edx]
imul ecx, ecx, 0xd
add ecx, edi
inc edx
dec esi
jne 0x756c03
mov byte [eax + ebp + 4], cl
mov byte [eax + ebp + 5], ch
mov byte [eax + ebp + 6], 0xd
mov byte [eax + ebp + 7], 0xa
mov eax, dword [ebx + 0x190c]
test eax, eax
pop edi
jne 0x756c39
mov eax, dword [ebx + 0x78]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetCommMask]
mov eax, dword [ebx + 0x190c]
add ebp, 8
add eax, ebp
mov dword [ebx + 0x190c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x1914], eax
mov eax, dword [ebx + 0x190c]
test eax, eax
je 0x756cb7
mov ecx, dword [ebx + 0xb4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x756cb7
mov ecx, dword [ebx + 0x190c]
lea edx, [ebx + 0xa4]
push edx
mov edx, dword [ebx + 0x1910]
lea eax, [ebx + 0xc0]
push eax
push ecx
mov ecx, dword [ebx + 0x78]
shl edx, 0xb
lea eax, [edx + ebx + 0x908]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor dword [ebx + 0x1910], 1
mov dword [ebx + 0x190c], 0
pop esi
xor eax, eax
pop ebp
ret

Function at 0x756da0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x814
mov eax, dword [0x81a1d0]
push ebx
mov ebx, ecx
mov dword [esp + 0x814], eax
mov eax, dword [ebx + 0xcc]
test eax, eax
jne 0x756dd5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor eax, ebx
test eax, eax
mov dword [ebx + 0xcc], eax
je 0x756dc6
pop esi
mov eax, dword [ebx + 0xcc]
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0
mov dword [esp + 0xc], 1
call fcn.00756b90
mov ecx, dword [esp + 0x814]
pop ebx
call fcn.00760e8e
add esp, 0x814
ret
Function at 0x757da0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
push 0x1940
call fcn.00582f80
mov esi, eax
xor ebx, ebx
add esp, 4
xor eax, eax
cmp esi, ebx
je 0x757f3e
push edi
mov ecx, 0x650
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esi], fcn.00757da0
mov dword [esi + 4], fcn.00757430
mov dword [esi + 8], 0x7574f0
mov dword [esi + 0xc], fcn.00744740
mov dword [esi + 0x10], fcn.007579f0
mov dword [esi + 0x14], 0x757a50
mov dword [esi + 0x18], fcn.00757ad0
mov dword [esi + 0x1c], fcn.00757b30
mov dword [esi + 0x20], fcn.00744740
mov dword [esi + 0x24], fcn.00757b40
mov dword [esi + 0x28], fcn.00757b80
mov dword [esi + 0x2c], 0x757b90
mov dword [esi + 0x30], fcn.00757cd0
mov dword [esi + 0x34], 0x757d50
mov ecx, dword [str.SERIAL]
lea eax, [esi + 0x48]
mov dword [eax], ecx
mov dx, word [0x7d35a8]
mov word [eax + 4], dx
mov cl, byte [0x7d35aa]
lea edx, [esi + 0x191c]
push edx
mov byte [eax + 6], cl
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [esp + 0x14]
add edi, 0x10
mov eax, edi
imul eax, dword [esp + 0x18]
push eax
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], eax
call fcn.00582f80
mov dword [esi + 0xe8], edi
imul edi, dword [esp + 0x20]
push edi
mov dword [esi + 0xe0], eax
mov dword [esi + 0xec], edi
call fcn.00582f80
add esp, 8
mov dword [esi + 0xfc], eax
mov dword [esi + 0x904], ebx
mov dword [esi + 0x1910], ebx
mov dword [esi + 0x190c], ebx
mov dword [esi + 0x1908], 0x800
mov dword [esi + 0xc8], 1
mov dword [esi + 0xcc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push 1
push 1
push ebx
mov dword [esi + 0xc4], eax
mov dword [esi + 0x78], 0xffffffff
call edi
push ebx
push 1
push 1
push ebx
mov dword [esi + 0x8c], eax
call edi
push ebx
push 1
push 1
push ebx
mov dword [esi + 0xa0], eax
call edi
mov dword [esi + 0xb4], eax
lea eax, [esp + 0xc]
push eax
push ebx
push esi
push 0x7570c0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, ebx
jne 0x757f2b
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x75a140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax], 0
je 0x75a157
add eax, 0x10a
mov dword [esp + 4], eax
jmp fcn.0075a2c0
ret

Function at 0x75a160
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov ecx, dword [esp + 0x10]
sub esp, 0xc
cmp ecx, 1
jge 0x75a171
mov ecx, 1
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, dword [esp + 0x1c]
mov byte [esi], bl
mov byte [esi + 1], bl
xor eax, eax
mov byte [esi + eax + 2], al
inc eax
cmp eax, 0x100
jb 0x75a181
mov ebp, dword [esp + 0x24]
cmp ebp, ebx
jle 0x75a2b4
cmp ecx, ebx
jle 0x75a2b4
or eax, 0xffffffff
sub eax, esi
mov dword [esp + 0xc], eax
mov eax, 1
sub eax, esi
mov dword [esp + 0x10], eax
mov eax, 0xfffffffe
sub eax, esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], ecx
lea esp, [esp]
mov dword [esp + 0x20], 2
lea ecx, [esi + 2]
jmp 0x75a1e0
mov dl, byte [ecx]
mov byte [esp + 0x2c], dl
add eax, ecx
xor edx, edx
div ebp
mov al, byte [edx + edi]
add al, byte [esp + 0x2c]
add bl, al
movzx edx, bl
lea eax, [edx + esi + 2]
mov dl, byte [eax]
mov byte [ecx], dl
mov dl, byte [esp + 0x2c]
mov byte [eax], dl
mov al, byte [ecx + 1]
mov edx, dword [esp + 0x10]
mov byte [esp + 0x2c], al
lea eax, [edx + ecx]
xor edx, edx
div ebp
mov al, byte [edx + edi]
add al, byte [esp + 0x2c]
add bl, al
movzx edx, bl
lea eax, [edx + esi + 2]
mov dl, byte [eax]
mov byte [ecx + 1], dl
mov dl, byte [esp + 0x2c]
mov byte [eax], dl
mov al, byte [ecx + 2]
mov byte [esp + 0x2c], al
mov eax, dword [esp + 0x20]
xor edx, edx
div ebp
mov al, byte [esp + 0x2c]
mov dl, byte [edx + edi]
add dl, al
add bl, dl
movzx eax, bl
mov dl, byte [eax + esi + 2]
lea eax, [eax + esi + 2]
mov byte [ecx + 2], dl
mov dl, byte [esp + 0x2c]
mov byte [eax], dl
mov al, byte [ecx + 3]
mov edx, dword [esp + 0x14]
mov byte [esp + 0x2c], al
lea eax, [edx + ecx]
xor edx, edx
div ebp
add ecx, 4
mov al, byte [edx + edi]
add al, byte [esp + 0x2c]
add bl, al
movzx edx, bl
lea eax, [edx + esi + 2]
mov dl, byte [eax]
mov byte [ecx - 1], dl
mov dl, byte [esp + 0x2c]
mov byte [eax], dl
add dword [esp + 0x20], 4
mov eax, dword [esp + 0x18]
lea edx, [eax + ecx]
cmp edx, 0x100
jb 0x75a1e0
dec dword [esp + 0x28]
jne 0x75a1d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x75a2c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0xc]
test ecx, ecx
mov al, byte [edx + 1]
push ebx
mov bl, byte [edx]
jle 0x75a321
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov dword [esp + 0x1c], ecx
lea ecx, [ecx]
inc bl
movzx ecx, bl
lea esi, [ecx + edx + 2]
mov cl, byte [esi]
add al, cl
mov byte [esp + 0x14], al
movzx eax, al
lea edi, [eax + edx + 2]
xor eax, eax
mov al, byte [edi]
mov byte [esi], al
mov byte [edi], cl
add eax, ecx
and eax, 0xff
mov cl, byte [eax + edx + 2]
xor byte [ebp], cl
mov eax, dword [esp + 0x1c]
inc ebp
dec eax
mov dword [esp + 0x1c], eax
mov al, byte [esp + 0x14]
jne 0x75a2e0
pop edi
pop esi
pop ebp
mov byte [edx], bl
mov byte [edx + 1], al
pop ebx
ret
Function at 0x75abe0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
ret
Function at 0x75ada0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x148
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x15c]
xor ecx, ecx
add eax, 2
movzx esi, byte [eax]
xor edx, edx
mov dh, byte [eax - 2]
add eax, 4
mov dl, byte [eax - 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax - 3]
shl edx, 8
or edx, esi
mov dword [esp + ecx*4 + 0x18], edx
inc ecx
cmp ecx, 0x10
jne 0x75adb6
lea ecx, [esp + 0x20]
mov edx, 0x40
mov eax, dword [ecx + 0x2c]
mov ebp, dword [ecx + 0x18]
mov ebx, dword [ecx - 8]
mov esi, dword [ecx]
xor eax, ebp
xor eax, ebx
xor eax, esi
mov esi, eax
shr esi, 0x1f
add eax, eax
or esi, eax
mov dword [ecx + 0x38], esi
add ecx, 4
dec edx
jne 0x75ade5
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 0x10]
mov esi, dword [edi + 0x14]
mov edi, dword [edi + 0x18]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov ebx, eax
not ebx
and ebx, esi
mov edi, edx
and edi, eax
or ebx, edi
mov edi, ecx
shr edi, 0x1b
mov ebp, ecx
shl ebp, 5
or edi, ebp
add ebx, edi
mov edi, dword [esp + 0x10]
add ebx, dword [esp + edi*4 + 0x18]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov esi, edx
mov edx, eax
shr eax, 2
shl edx, 0x1e
or edx, eax
inc edi
cmp edi, 0x14
lea ebx, [ebx + ebp + 0x5a827999]
mov eax, ecx
mov ecx, ebx
mov dword [esp + 0x10], edi
jne 0x75ae23
mov edi, edi
mov ebx, ecx
shr ebx, 0x1b
mov ebp, ecx
shl ebp, 5
or ebx, ebp
mov ebp, esi
xor ebp, edx
xor ebp, eax
add ebx, ebp
add ebx, dword [esp + edi*4 + 0x18]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov esi, edx
mov edx, eax
shr eax, 2
shl edx, 0x1e
or edx, eax
inc edi
cmp edi, 0x28
lea ebx, [ebx + ebp + 0x6ed9eba1]
mov eax, ecx
mov ecx, ebx
jne 0x75ae70
mov dword [esp + 0x10], edi
mov edi, edx
or edi, eax
and edi, esi
mov ebx, edx
and ebx, eax
or edi, ebx
mov ebx, ecx
shr ebx, 0x1b
mov ebp, ecx
shl ebp, 5
or ebx, ebp
add edi, ebx
mov ebx, dword [esp + 0x10]
add edi, dword [esp + ebx*4 + 0x18]
mov ebp, dword [esp + 0x14]
lea ebp, [edi + ebp - 0x70e44324]
mov edi, esi
mov esi, edx
mov edx, eax
shr eax, 2
shl edx, 0x1e
or edx, eax
inc ebx
cmp ebx, 0x3c
mov eax, ecx
mov dword [esp + 0x14], edi
mov ecx, ebp
mov dword [esp + 0x10], ebx
jne 0x75aeb1
mov dword [esp + 0x10], ebx
mov ebx, ecx
shr ebx, 0x1b
mov ebp, ecx
shl ebp, 5
or ebx, ebp
mov ebp, esi
xor ebp, edx
xor ebp, eax
add ebx, ebp
mov ebp, dword [esp + 0x10]
add ebx, dword [esp + ebp*4 + 0x18]
lea ebx, [ebx + edi - 0x359d3e2a]
mov edi, esi
mov esi, edx
mov edx, eax
shr eax, 2
shl edx, 0x1e
or edx, eax
inc ebp
cmp ebp, 0x50
mov eax, ecx
mov ecx, ebx
mov dword [esp + 0x10], ebp
jne 0x75af02
mov ecx, dword [esp + 0x15c]
mov ebp, dword [ecx + 8]
add ebp, ebx
mov ebx, dword [ecx + 0xc]
add ebx, eax
mov eax, dword [ecx + 0x10]
add eax, edx
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 0x14]
add eax, esi
mov dword [ecx + 0x14], eax
mov eax, dword [ecx + 0x18]
add eax, edi
pop edi
pop esi
mov dword [ecx + 8], ebp
pop ebp
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x18], eax
pop ebx
add esp, 0x148
ret
Function at 0x75b840
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
call fcn.0074b470
mov edx, dword [esp + 0xc]
mov ecx, dword [edx + 0x400]
xor esi, esi
test ecx, ecx
jle 0x75b87f
jmp 0x75b860
mov ecx, esi
and ecx, 0x1f
mov edi, 1
shl edi, cl
test eax, edi
setne cl
mov byte [esi + edx], cl
mov ecx, dword [edx + 0x400]
inc esi
cmp esi, ecx
jl 0x75b860
mov ecx, dword [edx + 0x400]
xor esi, esi
test ecx, ecx
jle 0x75b8ac
jmp 0x75b890
mov cl, byte [esi + edx]
inc eax
imul eax, eax, 0x10dcd
xor cl, al
je 0x75b893
mov byte [esi + edx], cl
mov ecx, dword [edx + 0x400]
inc esi
cmp esi, ecx
jl 0x75b890
mov eax, dword [edx + 0x400]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
sub eax, ecx
mov byte [edx], 0
mov byte [edx + 1], 2
lea edi, [eax + edx]
mov edx, ecx
shr ecx, 2
mov byte [edi - 1], 0
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x75b9f1
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x18
push 0x7d3998
call fcn.00760ad0
mov edi, 0x94
mov eax, edi
call fcn.0075c1f0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x8b8430], ecx
mov eax, dword [esi + 4]
mov dword [0x8b843c], eax
mov edx, dword [esi + 8]
mov dword [0x8b8440], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x8b8434], esi
cmp ecx, 2
je 0x75ba51
or esi, 0x8000
mov dword [0x8b8434], esi
shl eax, 8
add eax, edx
mov dword [0x8b8438], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x75ba8a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x75ba8a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x75baa2
cmp eax, 0x20b
je 0x75ba8f
mov dword [ebp - 0x1c], edi
jmp 0x75bab6
cmp dword [ecx + 0x84], 0xe
jbe 0x75ba8a
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x75bab0
cmp dword [ecx + 0x74], 0xe
jbe 0x75ba8a
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00761dd1
pop ecx
test eax, eax
jne 0x75baca
push 0x1c
call fcn.0075b9cd
pop ecx
call fcn.00761d48
test eax, eax
jne 0x75badb
push 0x10
call fcn.0075b9cd
pop ecx
call fcn.00761ab3
mov dword [ebp - 4], edi
call fcn.007618b5
test eax, eax
jge 0x75baf4
push 0x1b
call fcn.0075b9a8
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x8bb5f4], eax
call fcn.00761793
mov dword [0x8b8418], eax
call fcn.007616f1
test eax, eax
jge 0x75bb1a
push 8
call fcn.0075b9a8
pop ecx
call fcn.007614be
test eax, eax
jge 0x75bb2b
push 9
call fcn.0075b9a8
pop ecx
call fcn.0075d17b
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x75bb3e
push eax
call fcn.0075b9a8
pop ecx
mov eax, dword [0x8b8450]
mov dword [0x8b8454], eax
push eax
push dword [0x8b8448]
push dword [0x8b8444]
call fcn.00580a90
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x1c], edi
jne 0x75bb6d
push esi
call fcn.0075d2b3
call fcn.0075d2d5
jmp 0x75bb9f
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.00760b0b
ret
Function at 0x75d1e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
call fcn.00762f21
xor esi, esi
inc esi
cmp dword [0x8b8470], esi
pop ecx
jne 0x75d208
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x8b846c], esi
mov byte [0x8b8468], al
jne 0x75d26e
mov ecx, dword [0x8bb5ec]
test ecx, ecx
je 0x75d24f
mov eax, dword [0x8bb5e8]
sub eax, 4
cmp eax, ecx
jmp 0x75d248
mov eax, dword [eax]
test eax, eax
je 0x75d23a
call eax
mov eax, dword [0x8bb5e8]
sub eax, 4
cmp eax, dword [0x8bb5ec]
mov dword [0x8bb5e8], eax
jae 0x75d232
mov eax, 0x7e8cf4
mov esi, 0x7e8d00
cmp eax, esi
mov edi, eax
jae 0x75d26e
mov eax, dword [edi]
test eax, eax
je 0x75d267
call eax
add edi, 4
cmp edi, esi
jb 0x75d25f
mov eax, 0x7e8d04
mov esi, 0x7e8d0c
cmp eax, esi
mov edi, eax
jae 0x75d28d
mov eax, dword [edi]
test eax, eax
je 0x75d286
call eax
add edi, 4
cmp edi, esi
jb 0x75d27e
cmp dword [ebp + 0x10], 0
pop edi
pop esi
je 0x75d29e
push 8
call fcn.00762e8d
jmp 0x75d2b0
push dword [ebp + 8]
mov dword [0x8b8470], 1
call fcn.0075d139
pop ecx
pop ebp
ret

Function at 0x75f3eb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x75f408
call fcn.00765eea
mov dword [eax], 0x16
xor eax, eax
jmp 0x75f472
push esi
push 0x88
push 1
call fcn.0076aa10
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x75f45d
push esi
call fcn.00761b59
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x75f43b
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x75f347
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x75f471
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0075c3fa
test ebx, ebx
pop ecx
je 0x75f46f
push ebx
call fcn.00765efc
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x75fb4f
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x75fb5d
xor ecx, ecx
jmp 0x75fb7b
cmp eax, 0x1a
jbe 0x75fb67
push 0x57
pop eax
pop ebp
ret
add al, 0x40
and byte [ebp + 0xb], 0
lea ecx, [ebp + 8]
mov byte [ebp + 8], al
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov eax, dword [ebp + 0xc]
push eax
lea edx, [eax + 4]
push edx
lea edx, [eax + 0xc]
push edx
add eax, 8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x75fb9d
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop ebp
ret