joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53f28e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0054182e
add esp, 0xc
jbe 0x53f2a9
cld
xchg ebx, ebx
jg 0x53f2c7
pushf
jno 0x53f2b2
add eax, 0x12c9
sub eax, 0x12c9
popf
jle 0x53f2c0
xchg ecx, ecx
xchg edx, edx
jle 0x53f2c7
mov esi, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jne 0x53f2f9
test esp, 0x612b
call 0x53f304
lea esp, [esp + 4]
jg 0x53f30a
jp 0x53f322
pushf
mov edx, edx
push ebx
add ebx, 0x74b
ror ebx, 0x13
pop ebx
popf
jns 0x53f31f
jnp 0x53f322
jmp 0x814040b0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0053d4ba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x53f397
xor eax, eax
jmp 0x53f435
add esp, 0
and edi, edi
test ebx, 0x2da6
and esi, 0xffffffff
jle 0x53f3b4
jge 0x53f3a9
js 0x53f3ab
mov ebx, ebx
xchg edx, edx
jg 0x53f3b4
mov ebp, 0x458d1b55
in al, dx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00537202
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0054182e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x53f3de
xor eax, eax
jmp 0x53f435
push edx
pop edx
jne 0x53f3e2
add ecx, 0x412a
sub ecx, 0x412a
jbe 0x53f3fb
mov edx, edx
mov esp, esp
jl 0x53f3f6
jae 0x53f3f8
ja 0x53f3fb
sub eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00537dee
add esp, 4
dec edx
inc edx
add edi, 0x5750
sub edi, 0x5750
je 0x53f417
jnp 0x53f42e
pushf
inc ecx
dec ecx
ror edi, 0xa
ror edi, 0x16
popf
jb 0x53f427
mov edx, edx
jns 0x53f42b
jp 0x53f42e
mov ebp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x543a85
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0054182e
add esp, 0xc
lea esi, [esi + 0x5d34]
lea esi, [esi - 0x5d34]
jo 0x543aca
pushf
push ecx
add ecx, 0x5100
ror ecx, 0x13
pop ecx
jnp 0x543abb
js 0x543abd
or ecx, 0
popf
lea ecx, [ecx]
nop
mov edi, edi
jno 0x543aca
add eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
sub esp, 0
std
cld
cmp esp, 0x5128
xchg esp, esp
jle 0x543b0f
js 0x543b0b
jg 0x543b0f
call 0xf4a1c58b
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
rol esi, 0x15
rol esi, 0xb
test edi, edx
ja 0x543b8d
lea edx, [edx + 0x5f45]
lea edx, [edx - 0x5f45]
jmp 0x543b87
jle 0x543b89
jbe 0x543b8d
call 0xfbdb23f6
invalid
call 0x543718
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x543ba5
mov eax, 1
jmp 0x543c5c
xchg edi, eax
xchg edi, eax
push esi
add esi, 0x403a
ror esi, 0xb
pop esi
and edx, 0xffffffff
xchg edi, edi
jp 0x543bc0
xchg edi, edi
mov esi, esi
jnp 0x543bc0
add eax, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00537202
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0054182e
add esp, 0xc
stc
rol edx, 0
xor ecx, dword [esp]
xor ecx, dword [esp]
jns 0x543bec
je 0x543bfc
mov edi, edi
jb 0x543bf2
je 0x543bf4
lea esp, [esp]
jne 0x543bfc
lcall 0xec, 0x7d832026
cmp dword [ebp - 0x14], 0
jne 0x543c09
mov eax, 1
jmp 0x543c5c
ror esp, 0
jne 0x543c0e
jns 0x543c10
test eax, esi
jo 0x543c31
pushf
test edi, 0x32b2
jg 0x543c1e
xor edx, dword [esp]
xor edx, dword [esp]
cmp esi, 0x762c
popf
jmp 0x543c2e
jno 0x543c31
sub eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00537dee
add esp, 4
shr ecx, 0
jae 0x543c55
pushf
jp 0x543c46
rol ebx, 0x12
ror ebx, 0x12
je 0x543c4e
popf
mov ecx, ecx
jb 0x543c55
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x547b94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0054182e
add esp, 0xc
jns 0x547bb6
test esp, 0x7e9e
dec ecx
inc ecx
add eax, 0x1f0b
sub eax, 0x1f0b
js 0x547bd8
pushf
xor esp, 0
popf
jl 0x547bd3
jne 0x547bd5
jns 0x547bd8
sub eax, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0053d4ba
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x547ca0
xor eax, eax
jmp 0x547d05
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00537202
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0054182e
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x547cca
xor eax, eax
jmp 0x547d05
rol ebx, 0
test dword [esp], esi
cmp eax, dword [esp + 0xc]
jae 0x547cdc
mov esi, esi
nop
jb 0x547cdc
mov ebp, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00537dee
add esp, 4
cmp esp, 0x1230
je 0x547cf0
jle 0x547cfa
jno 0x547cf4
jbe 0x547cf6
jg 0x547cfa
lcall 0x8b51, 0xc4d8bed
push ebp
or byte [edx - 1], dl
push ebp
call 0x8bafdb68
in eax, 0x5d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x54dc05
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0054182e
add esp, 0xc
xor edi, dword [esp + 8]
xor edi, dword [esp + 8]
jb 0x54dc2f
add eax, 0x5db1
sub eax, 0x5db1
jne 0x54dc45
jp 0x54dc3d
lea esp, [esp]
ja 0x54dc42
je 0x54dc45
mov esi, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
xchg ecx, ecx
jo 0x54dd0e
pushf
xor esp, 0
not ebx
not ebx
xor edi, dword [esp + 4]
xor edi, dword [esp + 4]
popf
ja 0x54dd07
jne 0x54dd09
xchg edi, edi
jno 0x54dd0e
mov esp, 0xfef7a7e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.0053d4ba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x54dd23
xor eax, eax
jmp 0x54ddbf
mov esp, esp
dec eax
inc eax
test dword [esp + 8], edx
jle 0x54dd45
pushf
call 0x54dd34
lea esp, [esp + 4]
popf
xchg edx, ecx
xchg edx, ecx
js 0x54dd40
jle 0x54dd42
jg 0x54dd45
jmp 0x533d32d6
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00537202
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0054182e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x54dd6f
xor eax, eax
jmp 0x54ddbf
xchg edi, edi
shr esi, 0
xchg ebx, ebx
or ebx, ebx
jo 0x54dd95
pushf
test dword [esp], ecx
ror esi, 0x17
rol esi, 0x17
lea esp, [esp]
jp 0x54dd8a
popf
jge 0x54dd8e
jmp 0x54dd90
mov eax, eax
jno 0x54dd95
mov ecx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00537dee
add esp, 4
or esp, 0
js 0x54ddb4
pushf
or esi, 0
popf
jae 0x54ddaf
jnp 0x54ddb1
jns 0x54ddb4
mov esi, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x723000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00730860
add esp, 0xc
jle 0x72301e
jg 0x72301e
call 0x495a75e8
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
jbe 0x72306b
ja 0x72306b
call 0x815a7df9
jmp 0xe8bfb875
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.0072f35a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x723111
xor eax, eax
jmp 0x723161
jbe 0x723116
ja 0x723116
call 0x515a76a7
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00724e48
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00730860
add esp, 0xc
jns 0x72313b
js 0x72313b
call 0x156aec2
cmp dword [ebp - 0x1c], 0
jne 0x723145
xor eax, eax
jmp 0x723161
cmp dword [esp + 4], 0x1770376
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0072f7ce
add esp, 4
jbe 0x72315e
ja 0x72315e
call 0x60568761
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7247a5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc dh, al
add al, 0x4a
add byte [eax + 1], bh
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x721230], 1
jne 0x7248a8
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00730860
add esp, 0xc
jne 0x7247d0
je 0x7247d0
jp 0x724797
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
inc ebp
call 0xedb80e1f
insd dword es:[edi], dx
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
jb 0x724801
jae 0x724801
sub byte [edx - 0x167f17b3], cl
add dword [eax + 0x558ae84d], ecx
in eax, dx
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0072f35a
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x72486b
mov eax, dword [ebp + 8]
jmp 0x7248d8
jns 0x724870
js 0x724870
call 0x535a9e01
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00724e48
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00730860
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x7248a1
mov edx, dword [ebp - 8]
mov dword [0x721230], edx
jmp 0x7248a6
mov eax, dword [ebp + 8]
jmp 0x7248d8
jmp 0x7248b0
mov eax, dword [0x721230]
mov dword [ebp - 8], eax
jns 0x7248b5
js 0x7248b5
call 0x8a6a9644
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jle 0x7248c0
jg 0x7248c0
call 0x536e9e4f
mov edx, dword [ebp - 4]
push edx
call fcn.0072f7ce
add esp, 4
jbe 0x7248d1
ja 0x7248d1
mov cl, 0x8b
inc ebp
or byte [eax - 1], dl
push ebp
cld
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x724d45
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00730860
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
jne 0x724da2
je 0x724da2
jne 0x724d2d
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jp 0x724e07
dec ebp
invalid
Function at 0x725a59
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x725a6d
jmp 0x725b97
jne 0x725a72
je 0x725a72
call 0x897aa001
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [reloc.KERNEL32.dll_GetModuleHandleA], edx
jb 0x725a88
jae 0x725a88
adc cl, byte [ebx + 0x488bec45]
add al, 0x89
or eax, 0x721100
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x721100], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x7210fc], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x7211a0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x7211a4], ecx
jbe 0x725abc
ja 0x725abc
mov dl, 0xc6
inc ebp
invalid
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jne 0x725af5
je 0x725af5
call 0x8162b083
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jl 0x725b62
jge 0x725b62
call 0x116e98e9
jb 0x725b68
cmp dword [0x7210fc], 0
je 0x725b7f
add byte [esp + edx - 0x73], dh
push ebp
invalid
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x7210fc]
push eax
call fcn.00724e48
mov dword [reloc.KERNEL32.dll_LoadLibraryA], eax
cmp dword [esp + 8], 0x1740375
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00730860
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x726991
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00730860
add esp, 0xc
jl 0x7269af
jge 0x7269af
call 0x585eaf79
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 9], 0x64
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 8], 0
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xb], 0x6d
jne 0x7269e8
je 0x7269e8
jl 0x726973
mov cl, byte [ebp - 0x14]
dec ebp
in al, dx
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0072f35a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x726a62
xor eax, eax
jmp 0x726abd
cmp dword [esp + 4], 0x1770376
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00724e48
mov dword [ebp - 0x18], eax
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00730860
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x726a94
xor eax, eax
jmp 0x726abd
jl 0x726a99
jge 0x726a99
call 0x525ab828
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0072f7ce
add esp, 4
jne 0x726aaa
je 0x726aaa
call 0x5286c039
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x726dff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dword [esi], eax
dec ebp
adc al, 0x51
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00730860
add esp, 0xc
jne 0x726e1d
je 0x726e1d
jbe 0x726de4
mov byte [ebp - 0x14], 0x53
inc ebp
in al, dx
push ebx
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x62
mov byte [ebp - 0xd], 0x4e
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 9], 0x79
mov byte [ebp - 8], 0
jne 0x726e56
je 0x726e56
jmp 0x726de1
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
jp 0x726ec3
inc ebp
invalid
jnp 0x726ec3
call 0xf701af
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.0072f35a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x726ed5
xor eax, eax
jmp 0x726f2b
jbe 0x726eda
ja 0x726eda
call 0x525ebc6b
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00724e48
mov dword [ebp - 0x18], eax
jo 0x726eef
jno 0x726eef
call 0xdc7c5d
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00730860
add esp, 0xc
jne 0x726f04
je 0x726f04
jnp 0x726e88
cmp dword [ebp - 0x18], 0
jne 0x726f0e
jge 0x726eef
add byte [ebp + 4], dh
xor eax, eax
jmp 0x726f2b
jne 0x726f13
je 0x726f13
call 0x525abca2
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0072f7ce
add esp, 4
jle 0x726f24
jg 0x726f24
call 0x527ac4b3
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4