joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fd205
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007fa7c8
and byte [ebp - 0xb], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x6c
call fcn.007fa7f7
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [fcn.008ef00c]
test eax, eax
jne 0x7fd259
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x7fd276
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007fa7c8
and byte [ebp - 0xa], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0xf], 0x41
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xb], 0x63
call fcn.007fa7f7
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [fcn.008ef00c]
test eax, eax
jne 0x7fd2ce
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x7fd2ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 4], 0
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 7], 0x65
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 9], 0x75
mov byte [ebp - 6], 0x78
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 8], 0x74
mov byte [ebp - 5], 0x41
call fcn.007fa7f7
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [fcn.008ef00c]
test eax, eax
jne 0x7fd33e
leave
ret
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x7fd361
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x53
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xe], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x70
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x72
call fcn.007fd416
lea eax, [ebp - 0x20]
push eax
push dword [0x7e93d0]
call dword [fcn.008ef00c]
test eax, eax
jne 0x7fd3f6
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x7fd46b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 7], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x53
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x63
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x79
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0x6c
call fcn.007fd416
lea eax, [ebp - 0x20]
push eax
push dword [0x7e93d0]
call dword [fcn.008ef00c]
test eax, eax
jne 0x7fd4f4
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x7fd51a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
cmp dword [0x7e93e8], edi
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x7fd596
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.007fc807
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x7e93e8], eax
jne 0x7fd596
mov eax, 0x7532
jmp 0x7fd64d
cmp dword [0x7e93d8], ebx
jne 0x7fd5f3
xor esi, esi
push dword [ebp + 0x10]
push 0x7e93e8
push dword [ebp + 8]
call fcn.007fd6af
add esp, 0xc
cmp eax, ebx
je 0x7fd5cf
cmp eax, 0x6688
jne 0x7fd5db
push 0x1f4
call fcn.007fd652
inc esi
pop ecx
cmp esi, 3
jl 0x7fd5a0
cmp esi, 3
jne 0x7fd5f3
mov esi, 0x4f1a
jmp 0x7fd5dd
mov esi, eax
push dword [0x7e93e8]
call fcn.007fc930
pop ecx
mov dword [0x7e93e8], edi
mov eax, esi
jmp 0x7fd64d
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.007fa85c
lea eax, [ebp - 4]
push ebx
push eax
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push dword [0x7e93e8]
call fcn.007fc892
add esp, 0x28
test eax, eax
je 0x7fd636
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.007fcb1f
pop ecx
pop ecx
jmp 0x7fd64d
push dword [0x7e93e8]
call fcn.007fc930
pop ecx
mov dword [0x7e93e8], edi
call fcn.007fc9a9
pop edi
pop esi
pop ebx
leave
ret

Function at 0x7fda23
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x7e93e8]
push ebx
xor ebx, ebx
cmp eax, 1
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x7fda99
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.007fc807
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x7e93e8], eax
jne 0x7fda99
mov eax, 0x7532
jmp 0x7fdae7
lea ecx, [ebp - 4]
push ebx
push ecx
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push eax
call fcn.007fc892
add esp, 0x20
test eax, eax
je 0x7fdacc
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.007fcb1f
pop ecx
pop ecx
jmp 0x7fdae7
push dword [0x7e93e8]
call fcn.007fc930
pop ecx
mov dword [0x7e93e8], 1
call fcn.007fc9a9
pop ebx
leave
ret
Function at 0x7fe555
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007fa7c8
and byte [ebp - 0xa], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x65
call fcn.007fa7f7
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [fcn.008ef00c]
test eax, eax
jne 0x7fe5ad
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x7fe5ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007fa7c8
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x6f
call fcn.007fa7f7
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [fcn.008ef00c]
test eax, eax
jne 0x7fe626
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x7fe646
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0x1d], 0x75
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 8], 0x4c
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 5], 0x74
call fcn.007fe6f9
test eax, eax
je 0x7fe6d8
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [fcn.008ef00c]
test eax, eax
jne 0x7fe6dc
xor eax, eax
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x7fe6f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007fa7c8
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x7e93c8], 1
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 9], 0x6c
jne 0x7fe75b
lea eax, [ebp - 0x14]
push eax
call dword [fcn.008ef008]
mov dword [0x7e93c8], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007fa7c8
mov eax, dword [0x7e93c8]
add esp, 0xc
leave
ret

Function at 0x7fe772
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and byte [ebp - 1], 0
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 4], 0x63
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0xb], 0x49
mov byte [ebp - 3], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 2], 0x73
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 7], 0x72
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 5], 0x61
call fcn.007fe6f9
test eax, eax
je 0x7fe800
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [fcn.008ef00c]
test eax, eax
jne 0x7fe804
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1c
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x7fe82d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and byte [ebp - 4], 0
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x11], 0x47
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 9], 0x44
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 7], 0x76
call fcn.007fe6f9
test eax, eax
je 0x7fe8a4
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [fcn.008ef00c]
mov ecx, fcn.007fe82d
test ecx, ecx
jne 0x7fe8a8
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x15
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x7fe965
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 4], 0
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 8], 0x61
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 6], 0x6c
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0xd], 0x63
call fcn.007fe6f9
test eax, eax
je 0x7fea07
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [fcn.008ef00c]
test eax, eax
jne 0x7fea0b
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x21
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.007fa7c8
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x879110
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x86c6d4
call dword [fcn.008ef004]
mov eax, dword [0x869cc0]
mov dword [0x877280], eax
mov ecx, dword [0x869cc4]
mov dword [0x877284], ecx
mov edx, dword [0x869cc8]
mov dword [0x877288], edx
mov eax, dword [0x869ccc]
mov dword [0x87728c], eax
mov ecx, dword [0x869cd0]
mov dword [0x877290], ecx
mov edx, dword [0x869cd4]
mov dword [0x877294], edx
mov eax, dword [0x869cd8]
mov dword [0x8772f4], eax
mov ecx, dword [0x869ce0]
mov dword [0x8772ec], ecx
mov edx, dword [0x869ce4]
mov dword [0x8772f0], edx
cmp dword [0x869cf8], 0
je 0x8791b0
mov eax, dword [0x869cf8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xcc
jne 0x8791b0
mov edx, dword [0x869cec]
add edx, 1
mov dword [0x869cec], edx
mov eax, dword [0x877280]
xor eax, dword [0x869ce8]
mov dword [0x877280], eax
mov ecx, dword [0x877284]
add ecx, dword [0x869cec]
mov dword [0x877284], ecx
mov edx, dword [0x877288]
sub edx, dword [0x869cf0]
mov dword [0x877288], edx
jmp 0x8791e7
mov dword [0x87886c], 0x8792b7
mov dword [0x878870], 0x8794d8
jmp 0x8791fe
mov dword [0x878874], 0x8792c4
mov dword [0x878878], 0x879326
mov dword [0x87887c], 0
push 0x886350
push dword fs:[0]
mov dword fs:[0], esp
cmp dword [0x8772f4], 0
jle 0x8794e5
mov dword [0x87887c], 0
jmp 0x879249
mov dword [0x877254], 0x87933d
mov dword [0x877258], 0x879351
jmp 0x879260
mov dword [0x87725c], 0x879365
mov dword [0x877260], 0x879379
jmp 0x879277
mov dword [0x877264], 0x155
mov dword [0x877278], 0x87938d
mov eax, dword [0x877254]
mov dword [0x877268], eax
mov ecx, dword [0x877258]
mov dword [0x87726c], ecx
mov edx, dword [0x87725c]
mov dword [0x877270], edx
mov eax, dword [0x877260]
mov dword [0x877274], eax
mov eax, eax
mov ebx, ebx
jmp 0x8792be
int3
pop dword fs:[0]
add esp, 4
mov dword [0x87887c], 0
push 0x878540
call fcn.0088c020
add esp, 4
mov ecx, dword [0x8772c4]
push ecx
mov edx, dword [0x877304]
push edx
push 0x878540
call fcn.0088e430
add esp, 0xc
push 0x878540
push 0x8772b4
call fcn.0088cf50
add esp, 8
mov dword [0x87730c], 0
jmp 0x87954c
mov eax, dword [0x87730c]
add eax, 1
mov dword [0x87730c], eax
cmp dword [0x87730c], 0x10
jae 0x879571
mov ecx, dword [0x87730c]
mov dl, byte [ecx + 0x8772b4]
xor dl, 0x22
mov eax, dword [0x87730c]
mov byte [eax + 0x8772b4], dl
jmp 0x87953f
mov ecx, dword [0x8772b8]
xor ecx, dword [0x878598]
mov edx, dword [0x8772ec]
add edx, ecx
mov dword [0x8772ec], edx
mov eax, dword [0x8772c0]
xor eax, dword [0x877308]
mov ecx, dword [0x8772f0]
sub ecx, eax
mov dword [0x8772f0], ecx
call fcn.00885250
push 0x86c6c4
call dword [fcn.008ef004]
call fcn.00889530
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x8795d0
Capabilities:
Encrypt data using tea
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi]
cmp dword [esp + 8], 0x1740375
mov eax, dword [edi + 4]
jbe 0x8795eb
ja 0x8795eb
mov edi, 0x3310558b
test byte [ebp - 0x7e82812e], 0x7c
and al, 4
jb 0x8795fd
mov edx, dword [ebp + 0x10]
xor esi, esi
test edx, edx
jle 0x879671
cmp dword [esp + 4], 0x1730372
jae 0x8795fd
imul edx, edx, 0x9e3779b9
test edx, edx
mov dword [ebp + 0x10], edx
je 0x8796d0
sar byte [ecx - 0x7a61c887], cl
ror byte [ecx - 0x7bf0efab], cl
ret
mov edx, dword [ebp + 8]
mov edi, eax
mov ebx, eax
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, esi
and ebx, 3
add edi, dword [edx + ebx*4]
mov ebx, esi
xor ebx, eax
add ebx, ecx
lea ecx, [ebx + edi]
jbe 0x879632
ja 0x879632
mov ecx, 0x8647ee81
enter 0x7261, 3
sub esi, 0x61c88647
jb 0x87963d
jae 0x87963d
and byte [ebx - 0x3e267407], cl
out dx, eax
add eax, 0x3304e3c1
sti
mov edi, ecx
mov ebx, ecx
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, esi
shr ebx, 0xb
and ebx, 3
add edi, dword [edx + ebx*4]
mov ebx, esi
xor ebx, ecx
add ebx, eax
lea eax, [ebx + edi]
mov edi, dword [ebp + 0x10]
cmp esi, edi
jne 0x879610
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebp
ret
imul edx, edx, 0x61c88647
test edx, edx
je 0x8796d0
mov esi, dword [ebp + 8]
mov edi, ecx
mov ebx, ecx
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, edx
shr ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, edx
xor ebx, ecx
add edx, 0x61c88647
add edi, ebx
sub eax, edi
mov edi, eax
mov ebx, eax
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, edx
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, edx
xor ebx, eax
add edi, ebx
sub ecx, edi
test edx, edx
jne 0x87967e
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebp
ret
mov dword [edi], ecx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x87ac20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0087f670
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov bl, 0x65
mov byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 5], 0x6d
mov byte [ebp - 0x13], bl
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 9], 0x6c
mov byte [ebp - 4], bl
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 8], bl
mov byte [ebp - 3], 0x41
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], 0x4e
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 6], 0x61
cmp dword [esp + 4], 0x1730372
call fcn.008883f0
test eax, eax
jne 0x87aca3
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0088f050
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.0087f670
add esp, 0xc
test esi, esi
jne 0x87accd
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
jbe 0x87acd3
ja 0x87acd3
mov esp, 0xcfc7e856
add byte [eax], al
push esi
call fcn.00887ca0
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0087f670
add esp, 0x10
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 5], 0x6d
mov byte [ebp - 0x13], bl
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 9], 0x6c
mov byte [ebp - 4], bl
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 8], bl
mov byte [ebp - 3], 0x57
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], 0x4e
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 6], 0x61
cmp dword [esp + 4], 0x1730372
mov eax, dword [0x86af28]
test eax, eax
je 0x87ad63
jb 0x87ad4f
jae 0x87ad4f
cmp dword [ebx - 0x7950d7eb], ecx
add byte [ebp + 0x5251ec4d], cl
mov edx, dword [0x86af28]
lea ecx, [ebp - 0x14]
push ecx
push edx
call fcn.0088f050
mov edi, eax
jmp 0x87ad66
mov edi, dword [ebp + 0x10]
jne 0x87ad6b
je 0x87ad6b
ja 0x87add6
push 0x13
lea eax, [ebp - 0x14]
push 0
adc ecx, dword [ebp + 0x6aec45]
push eax
call fcn.0087f670
add esp, 0xc
jb 0x87ad80
jae 0x87ad80
add al, 0x85
push dword [esi + ecx + 0x72]
add esi, dword [ebx + 1]
test edi, edi
je 0x87ad92
jb 0x87ad89
jae 0x87ad89
or byte [edi - 0x18], dl
adc edi, ecx
add byte [eax], al
push edi
call fcn.00887ca0
add esp, 4
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edx
push eax
call fcn.0088cf50
add esp, 0x18
xor eax, eax
mov cl, byte [esp + eax]
mov dl, byte [eax + 0x85c09c]
cmp cl, dl
jne 0x87adfc
inc eax
cmp eax, 0x10
jl 0x87ade2
xor eax, eax
add esp, 0x68
ret
mov eax, 1
add esp, 0x68
ret