joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ab731
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0069ebcf
add esp, 0xc
jle 0x6ab74c
ja 0x6ab757
nop
jne 0x6ab751
jnp 0x6ab753
jbe 0x6ab757
add eax, 0xe445c680
push edx
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
nop
ror esp, 0
rol edi, 1
rol edi, 0x1f
jnp 0x6ab7b6
jg 0x6ab7b0
ja 0x6ab7b2
jp 0x6ab7b6
xor eax, 0xe44d8a6e
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
ror ecx, 0
add edi, dword [esp]
sub edi, dword [esp]
jl 0x6ab868
xchg ebx, ebx
ja 0x6ab861
xchg esp, esp
mov edx, edx
jge 0x6ab868
mov ecx, 0x7185e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call 0x6b29f2
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x6ab87d
xor eax, eax
jmp 0x6ab93e
test esp, 0x2bf9
lea ecx, [ecx + 0x73db]
lea ecx, [ecx - 0x73db]
cmp esp, 0x1529
xchg edi, edi
jb 0x6ab8a8
lea edx, [edx + 0x77e4]
lea edx, [edx - 0x77e4]
jae 0x6ab8a8
or dword [ebp - 0x74ae1bb3], 0xe852f855
rol byte [edi + 0x4589ffff], 0xfc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.006a4075
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0069ebcf
add esp, 0xc
rol esi, 7
ror esi, 7
jns 0x6ab8e1
pushf
ja 0x6ab8d4
popf
jno 0x6ab8d8
jp 0x6ab8da
xchg edi, ebx
xchg edi, ebx
js 0x6ab8e1
sub eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x6ab8eb
xor eax, eax
jmp 0x6ab93e
or esp, 0
call fcn.006ab8f3
Function at 0x6ab947
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0069ebcf
add esp, 0xc
mov ecx, ecx
je 0x6ab969
mov edx, edx
jne 0x6ab969
mov ecx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
jg 0x6ab99b
jnp 0x6ab9a8
jmp 0x6ab99f
xchg edx, edx
nop
jae 0x6ab9a4
jp 0x6ab9a8
xor eax, 0xf44d8aeb
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
and eax, eax
ror esi, 0
jne 0x6aba0f
or esp, 0
jg 0x6aba20
pushf
add esp, 0
popf
mov esi, esi
jle 0x6aba20
xor eax, 0x6fcde8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x6b29f2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6aba38
mov eax, 1
jmp 0x6abae7
call 0x6aba3d
add esp, 4
neg eax
neg eax
ja 0x6aba59
pushf
js 0x6aba4a
jbe 0x6aba4c
jmp 0x6aba4e
jmp 0x6aba50
popf
jo 0x6aba54
jo 0x6aba56
jbe 0x6aba59
mov esp, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.006a4075
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0069ebcf
add esp, 0xc
jg 0x6aba7b
mov edx, edx
or esp, 0
jb 0x6aba8d
jo 0x6aba84
jg 0x6aba86
jns 0x6aba88
nop
jae 0x6aba8d
ljmp 0x7500:0xec7d835e
cmp dword [ebp - 0x14], 0
jne 0x6aba9a
mov eax, 1
jmp 0x6abae7
cmp eax, dword [esp + 8]
std
cld
jg 0x6abab2
pushf
xor eax, 0
popf
jns 0x6abaab
jbe 0x6abaad
jne 0x6abaaf
jle 0x6abab2
mov edx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.006ab3b1
add esp, 4
jg 0x6abac0
lea esi, [esi + 0x5856]
sub esi, 0x5856
jo 0x6abae0
pushf
cmp edi, 0x51c7
add edi, 0
popf
jb 0x6abadd
jno 0x6abae0
mov esi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6abb36
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0069ebcf
add esp, 0xc
cmp edi, esi
rol ebx, 0x17
rol ebx, 9
jl 0x6abb64
mov esi, esi
je 0x6abb5d
ja 0x6abb5f
jae 0x6abb61
jge 0x6abb64
mov esp, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
xor edi, 0
jo 0x6abb99
or esp, 0
jl 0x6abbb9
pushf
lea edx, [edx + 0x78e4]
lea edx, [edx - 0x78e4]
lea edx, [edx]
jne 0x6abbb0
xchg esp, esp
popf
xchg ebx, ebx
jge 0x6abbb9
jmp 0x81570947
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.006baff8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x6abc2e
xor eax, eax
jmp 0x6abcb5
inc ebx
dec ebx
xchg edi, edx
xchg edi, edx
cmp ecx, ebx
mov ecx, ecx
jns 0x6abc41
jle 0x6abc3c
jb 0x6abc3e
js 0x6abc41
mov edi, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.006a4075
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0069ebcf
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x6abc6b
xor eax, eax
jmp 0x6abcb5
jge 0x6abc6d
xor esi, edx
xor esi, edx
jb 0x6abc91
pushf
add ebx, 0
lea esp, [esp]
rol ebx, 0
popf
ja 0x6abc82
lea ecx, [ecx + 0x35d8]
lea ecx, [ecx - 0x35d8]
jae 0x6abc91
jmp 0x51670220
mov eax, dword [ebp - 4]
push eax
call fcn.006ab3b1
add esp, 4
cmc
jb 0x6abcae
jg 0x6abca2
jl 0x6abca4
lea esp, [esp]
jb 0x6abca9
jae 0x6abcae
mov esp, 0x4d8b7a49
or byte [ecx - 1], dl
push ebp
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6abfc6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0069ebcf
add esp, 0xc
add esp, 0
lea esi, [esi]
cmp eax, dword [esp]
je 0x6abff0
jno 0x6abfeb
jno 0x6abfed
jne 0x6abff0
mov edi, 0x50e845c6
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0
or ecx, ecx
xchg edx, edx
rol esp, 0
je 0x6ac035
js 0x6ac040
jg 0x6ac039
jns 0x6ac03b
jns 0x6ac040
sbb dword [esi - 0x49], 0x80e84d8a
jmp 0xe8b8484a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
shr esp, 0
cmp esp, 0x1682
jge 0x6ac0cf
lea ebx, [ebx]
lea esp, [esp]
jb 0x6ac0cc
jl 0x6ac0cf
mov eax, 0x691ee8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 7], dh
call 0x6b29f2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6ac0e4
xor eax, eax
jmp 0x6ac362
inc esi
dec esi
xor ebx, dword [esp]
xor ebx, dword [esp]
lea eax, [eax + 0x6e24]
lea eax, [eax - 0x6e24]
jp 0x6ac0ff
jl 0x6ac0fc
jnp 0x6ac0ff
or dword [ebp - 0x74af17bb], 0xe851fc4d
imul edi, dword [edi - 1], 0xe44589ff
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.006a4075
mov dword [ebp - 0x1c], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0069ebcf
add esp, 0xc
cld
push eax
add eax, 0xc05
ror eax, 0x17
pop eax
call fcn.006ac12f
Function at 0x6ade94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0069ebcf
add esp, 0xc
test dword [esp + 0xc], esi
jno 0x6adedc
pushf
lea ecx, [ecx + 0x23f1]
sub ecx, 0x23f1
add edx, 0x5509
sub edx, 0x5509
je 0x6adecf
jg 0x6aded1
popf
mov esp, esp
xchg ecx, ecx
jmp 0x6aded9
jo 0x6adedc
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0
push edi
add edi, 0x44c1
ror edi, 9
pop edi
nop
jne 0x6adf1e
jge 0x6adf2b
ja 0x6adf22
xchg esp, esp
jle 0x6adf26
mov eax, eax
jl 0x6adf2b
mov eax, 0x80e84d8a
jmp 0xe8b86735
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
xor eax, 0x7d01
xor eax, 0x7d01
jns 0x6adfa6
mov ecx, ecx
lea esi, [esi]
js 0x6adfa6
sub eax, 0xd04d
call fcn.006baff8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x6adfbb
xor eax, eax
jmp 0x6ae06b
xor esp, 0
jo 0x6adfc0
lea edx, [edx]
jle 0x6adfd1
jg 0x6adfc6
nop
xchg edi, ebx
xchg edi, ebx
jno 0x6adfcd
jg 0x6adfd1
mov ebp, 0xe84d8d54
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.006a4075
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0069ebcf
add esp, 0xc
push ecx
pop ecx
cmp edi, dword [esp]
ror esp, 0
jl 0x6ae008
jae 0x6adffd
xchg esi, edi
xchg esi, edi
jg 0x6ae003
jae 0x6ae005
jge 0x6ae008
mov esp, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x6ae012
xor eax, eax
jmp 0x6ae06b
cmp esp, 0x7e18
jns 0x6ae02d
jo 0x6ae01c
lea edx, [edx + 0x5f9a]
lea edx, [edx - 0x5f9a]
jns 0x6ae02a
js 0x6ae02d
mov ebx, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.006ab3b1
add esp, 4
push edi
pop edi
jg 0x6ae03d
jg 0x6ae03f
lea edx, [edx]
jbe 0x6ae064
pushf
xor ecx, dword [esp]
xor ecx, dword [esp]
jb 0x6ae04d
rol edx, 0xf
rol edx, 0x11
xor ebx, dword [esp]
xor ebx, dword [esp]
popf
jg 0x6ae05d
je 0x6ae05f
mov esp, esp
ja 0x6ae064
mov ebp, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6afc47
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0069ebcf
add esp, 0xc
jae 0x6afc69
jmp 0x6afc6b
push ebx
add ebx, 0x14a
ror ebx, 2
pop ebx
jg 0x6afc97
pushf
lea edx, [edx + 0x93c]
lea edx, [edx - 0x93c]
xchg esi, eax
xchg esi, eax
test dword [esp], esi
nop
popf
jle 0x6afc90
jp 0x6afc92
jo 0x6afc94
jle 0x6afc97
mov edi, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.006baff8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6afd5f
xor eax, eax
jmp 0x6afdc4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.006a4075
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0069ebcf
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x6afd89
xor eax, eax
jmp 0x6afdc4
stc
jle 0x6afd8c
jae 0x6afd99
jno 0x6afd90
je 0x6afd92
jo 0x6afd94
jle 0x6afd96
jb 0x6afd99
mov ebx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.006ab3b1
add esp, 4
stc
jge 0x6afda8
jb 0x6afdb9
jle 0x6afdac
xchg edi, ecx
xchg edi, ecx
jo 0x6afdb2
lea eax, [eax]
jae 0x6afdb9
call 0x4df625ab
or al, 0x51
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6b8bc4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0069ebcf
add esp, 0xc
nop
jge 0x6b8be0
rol ecx, 8
rol ecx, 0x18
jp 0x6b8bfa
pushf
add edx, dword [esp]
sub edx, dword [esp]
je 0x6b8bf2
nop
popf
jp 0x6b8bf7
jnp 0x6b8bfa
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
shr esp, 0
cmp esi, ebx
jo 0x6b8c3f
jo 0x6b8c37
jle 0x6b8c39
nop
xchg esi, esi
jno 0x6b8c3f
call 0x8153d9cd
jmp 0xe8b91449
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
xor eax, edi
xor eax, edi
rol edi, 0
jae 0x6b8cc5
pushf
or esp, 0
test eax, 0x51a9
ror edx, 0
cmc
popf
mov edi, edi
jb 0x6b8cc5
mov ebp, 0x232ee8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.006baff8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x6b8cda
xor eax, eax
jmp 0x6b8d84
or esp, 0
jne 0x6b8cdf
jno 0x6b8cf7
pushf
xchg edx, edx
std
cld
push edx
pop edx
and esp, 0xffffffff
popf
jne 0x6b8cf0
jbe 0x6b8cf2
jp 0x6b8cf4
jo 0x6b8cf7
add eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.006a4075
mov dword [ebp - 4], eax
js 0x6b8d09
jl 0x6b8d0b
stc
jb 0x6b8d1a
jns 0x6b8d10
jnp 0x6b8d12
xchg edi, eax
xchg edi, eax
mov esi, esi
jae 0x6b8d1a
mov esp, 0x6a0d6a26
add byte [ebp - 0x17af17bb], cl
test al, 0x5e
invalid
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0069ebcf
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x6b8d34
xor eax, eax
jmp 0x6b8d84
add ecx, dword [esp]
sub ecx, dword [esp]
xchg edx, ebx
xchg edx, ebx
ror ecx, 0
or edi, 0
jp 0x6b8d51
jno 0x6b8d48
nop
lea edi, [edi]
jp 0x6b8d4d
jnp 0x6b8d51
sub eax, 0xfc4d8b36
mov ecx, dword [ebp - 4]
push ecx
call fcn.006ab3b1
add esp, 4
rol esi, 0x19
rol esi, 7
ror edi, 0
jl 0x6b8d81
pushf
xchg esp, esp
popf
jg 0x6b8d70
lea eax, [eax + 0x78f9]
lea eax, [eax - 0x78f9]
mov esp, esp
jge 0x6b8d81
add eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6ba97e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0069ebcf
add esp, 0xc
ror eax, 2
rol eax, 2
jnp 0x6ba9b2
pushf
jle 0x6ba9a3
jno 0x6ba9a5
jbe 0x6ba9a7
jp 0x6ba9a9
popf
xchg esp, esp
jg 0x6ba9af
jp 0x6ba9b2
mov esi, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
js 0x6ba9e4
sub esp, 0
shr esp, 0
xor ecx, 0
jnp 0x6ba9f9
jne 0x6ba9f1
ja 0x6ba9f3
mov edx, edx
jp 0x6ba9f9
mov edx, 0xf04d8a55
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
jg 0x6baa5b
cld
test dword [esp + 8], ecx
js 0x6baa6d
jae 0x6baa64
jne 0x6baa66
je 0x6baa68
mov edx, edx
jns 0x6baa6d
mov esp, 0x586e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.006baff8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6baa7f
xor eax, eax
jmp 0x6baab8
test dword [esp], eax
jp 0x6baa84
cmp esi, dword [esp + 4]
jl 0x6baa95
pushf
jl 0x6baa8e
popf
je 0x6baa92
jge 0x6baa95
mov esi, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.006a4075
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0069ebcf
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6bc600
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret