joyce8/EMBER2024-capa huggingface dataset:
Function at 0x726f34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00730860
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jb 0x726f8a
jae 0x726f8a
and eax, 0x80ec4d8a
jmp 0xecbff794
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl

Function at 0x72708c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
invalid
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00730860
add esp, 0xc
jb 0x7270aa
jae 0x7270aa
shufps xmm0, xmmword [ebp - 0x10], 0x57
mov byte [ebp - 0x10], 0x57
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x47
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x73
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], 0x66
jo 0x7270df
jno 0x7270df
jmp 0x72706a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0072f35a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x727151
xor eax, eax
jmp 0x7271b0
jbe 0x727156
ja 0x727156
call 0x5162b6e7
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00724e48
mov dword [ebp - 0x14], eax
cmp dword [esp + 4], 0x1730372
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00730860
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x727188
xor eax, eax
jmp 0x7271b0
jo 0x72718d
jno 0x72718d
call 0x515eb71c
mov eax, dword [ebp - 0x14]
push eax
call fcn.0072f7ce
add esp, 4
cmp dword [esp + 8], 0x1740375
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x72a9ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00730860
add esp, 0xc
jl 0x72a9ca
jge 0x72a9ca
call 0x5356ef94
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
jne 0x72aa1b
je 0x72aa1b
call 0x8156f7a9
jmp 0xe4c03225
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
push ebp
in al, dx
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
jns 0x72aabc
js 0x72aabc
call fcn.007316a8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 4], dh
call fcn.0072ab2c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x72aace
xor eax, eax
jmp 0x72ab23
jle 0x72aad3
jg 0x72aad3
call 0x5256f864
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00724e48
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00730860
add esp, 0xc
jbe 0x72aaf8
ja 0x72aaf8
mov eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x72ab02
xor eax, eax
jmp 0x72ab23
jne 0x72ab07
je 0x72ab07
jmp 0x72aa93
mov ecx, dword [ebp - 4]
push ecx
call fcn.0072f7ce
add esp, 4
jbe 0x72ab18
ja 0x72ab18
call 0x527f00a7
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x72acbe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [reloc.KERNEL32.dll_LoadLibraryA], 1
je 0x72acdf
jb 0x72acd5
jae 0x72acd5
push cs
mov eax, dword [reloc.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
jmp 0x72aceb
jb 0x72ace4
jae 0x72ace4
adc esi, dword [ebx]
shr cl, 0x2a
add dword [eax], eax
add byte [edx + 3], dh
xor eax, eax
jmp 0x72ae15
jb 0x72acf0
jae 0x72acf0
pop ss
mov ecx, dword [ebp - 4]
push ecx
call fcn.0072f7ce
add esp, 4
push 0xd
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00730860
add esp, 0xc
jb 0x72ad11
jae 0x72ad11
call 0x4e5af2db
mov byte [ebp - 0x18], 0x4d
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x7a
mov byte [ebp - 0x17], 0x70
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x16], 0x62
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x10], 0x62
mov byte [ebp - 0x14], 0x4d
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 0xc], 0
jb 0x72ad4a
jae 0x72ad4a
sub dword [edx + 0x12ce845], ecx
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
jb 0x72adb7
jae 0x72adb7
cmp dword ss:[0x7210fc], 0
cmp dword [0x7210fc], 0
je 0x72add8
jb 0x72adc5
jae 0x72adc5
cmp dword [ebp - 0x74af17bb], ecx
or eax, 0x7210fc
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x7210fc]
push ecx
call fcn.00724e48
mov dword [ebp - 8], eax
jne 0x72addd
je 0x72addd
jnp 0x72ae48
push 0xd
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00730860
or eax, 0x558d006a
call 0x5ae9963a
add byte [eax], al
add esp, 0xc
jb 0x72adf2
jae 0x72adf2
add al, 0x83
jge 0x72aded
cmp dword [ebp - 8], 0
je 0x72ae09
add byte [ecx + edx + 0x72], dh
add esi, dword [ebx + 1]
jb 0x72adfd
jae 0x72adfd
or byte [ebx - 0x17af07bb], cl
enter 0x49, 0
mov eax, dword [ebp - 8]
push eax
call fcn.0072f7ce
add esp, 4
jb 0x72ae0e
jae 0x72ae0e
or al, 0x8b
dec ebp
or byte [ecx - 1], dl
push ebp
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add dword [esi - 0x75], ebx
dec ebp
hlt
Function at 0x72b4e5
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x720fac
call fcn.0072d0aa
add esp, 0xc
mov byte [0x720fac], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x72e004
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00730860
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6d
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0xe], 0x66
jb 0x72e06e
jae 0x72e06e
call 0x81572dfc
jmp 0xe4c06878
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1a]
sub dl, 1
mov byte [ebp - 0x1a], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x19]
sub dl, 1
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
call 0x2d602676
add dword [eax + 0x4d8aed45], ecx
sub cl, 1
mov byte [ebp - 0xe], cl
jne 0x72e0fe
je 0x72e0fe
jg 0x72e0e7
call fcn.0072f35a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x72e113
push edi
adc al, byte [eax]
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 7], dh
xor eax, eax
jmp 0x72e2ac
jbe 0x72e118
ja 0x72e118
mov edi, 0x52e4558d
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]

Function at 0x72e2b5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00730860
add esp, 0xc
jo 0x72e2d3
jno 0x72e2d3
call 0x455b289d
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
Function at 0x7337f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00730860
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cmp dword [esp + 4], 0x1770376
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
jbe 0x7338b6
ja 0x7338b6
ljmp 0x89ff:0xffba9fe8
call fcn.0072f35a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x7338c8
xor eax, eax
jmp 0x7338f0
jns 0x7338cd
js 0x7338cd
or dword [ebp - 0x74af0fbb], 0xe851fc4d
outsb dx, byte [esi]
adc eax, 0x4589ffff
in al, dx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00724e48
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00730860
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7709a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
nop
mov esi, 0xe7e80076
xchg byte [eax], al
add byte [esi + 3], dh
ja 0x77099c
call 0x1655788
add byte [edi + 0x5e], bl
call fcn.0077f7ee
pop edi
pop esi
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.007791b2
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
jne 0x770a03
je 0x770a03
jne 0x77098e
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jp 0x770a68
dec ebp
invalid
jnp 0x770a68
xor eax, 0x4612e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.0077507f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x770a7a
xor eax, eax
jmp 0x770aa2
jo 0x770a7f
jno 0x770a7f
call 0x51675010
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0077dffa
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.007791b2
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7735eb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007791b2
add esp, 0xc
jle 0x773609
jg 0x773609
call 0x495f7bd3
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
jbe 0x773656
ja 0x773656
call 0x815f83e4
jmp 0xe8c4be60
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.0077e16f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x7736fc
xor eax, eax
jmp 0x77374c
jbe 0x773701
ja 0x773701
call 0x515f7c92
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0077dffa
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.007791b2
add esp, 0xc
jns 0x773726
js 0x773726
call 0x15bb4ad
cmp dword [ebp - 0x1c], 0
jne 0x773730
xor eax, eax
jmp 0x77374c
cmp dword [esp + 4], 0x1770376
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0077cd15
add esp, 4
jbe 0x773749
ja 0x773749
call 0x605b8d4c
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x774ed4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.007791b2
add esp, 0xc
jo 0x774ef2
jno 0x774ef2
call 0x476794bc
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
jl 0x774f27
jge 0x774f27
call 0x81679cb5
jmp 0xf0c4d731
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
add dword [eax + 0x558af74d], ecx
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0077e16f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x774f97
add dword [eax + 0x4d8af845], ecx
hlt
jmp 0x774fec
cmp dword [esp + 4], 0x1730372
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0077dffa
mov dword [ebp - 0x14], eax
cmp dword [esp + 8], 0x1740375
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.007791b2
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x774fcf
jmp 0x774fec
jne 0x774fd4
je 0x774fd4
je 0x774f60
mov eax, dword [ebp - 0x14]
inc ebp
in al, dx
push eax
call fcn.0077cd15
add esp, 4
jle 0x774fe5
jg 0x774fe5
jmp 0x774f71
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x77a710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007791b2
add esp, 0xc
jne 0x77a72e
je 0x77a72e
call 0x455fecf8
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x55
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0xf], 0x66
jbe 0x77a767
ja 0x77a767
mov esp, 0x80e84d8a
jmp 0xe8c52f71
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
out dx, eax
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jb 0x77a7d4
invalid
jae 0x77a7d4
jmp 0x77a7bd
call fcn.0077e16f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x77a7e6
xor eax, eax
jmp 0x77a849
jle 0x77a7eb
jg 0x77a7eb
call 0x525ff57c
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0077dffa
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007791b2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x77a815
xor eax, eax
jmp 0x77a849
jne 0x77a81a
je 0x77a81a
jmp 0x77a7a6
mov ecx, dword [ebp - 4]
push ecx
call fcn.0077cd15
add esp, 4
cmp dword [esp + 8], 0x1740375
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18