joyce8/EMBER2024-capa huggingface dataset:
Function at 0x620880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00632000
add esp, 0xc
lea edi, [edi + 0x1878]
lea edi, [edi - 0x1878]
jae 0x6208b2
pushf
mov edx, edx
popf
jl 0x6208af
jb 0x6208b2
mov edi, 0x66b06db1
mov cl, 0x6d
mov al, 0x66
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x49
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], 0x62
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x6f
push eax
pop eax
je 0x620900
nop
jnp 0x620903
je 0x620915
pushf
ja 0x620909
add ecx, 0
dec edi
inc edi
popf
xchg esp, esp
jne 0x620915
mov eax, 0x8aec5d8a
push ebp
int1
mov bl, byte [ebp - 0x14]
mov dl, byte [ebp - 0xf]
mov cl, byte [ebp - 0xa]
mov al, byte [ebp - 5]
dec bl
dec dl
mov byte [ebp - 0x14], bl
mov bl, byte [ebp - 0x13]
dec cl
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 0xe]
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 9]
mov byte [ebp - 5], al
mov al, byte [ebp - 4]
dec bl
dec dl
mov byte [ebp - 0x13], bl
mov bl, byte [ebp - 0x12]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
dec al
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
mov byte [ebp - 4], al
mov al, byte [ebp - 3]
dec bl
dec dl
mov byte [ebp - 0x12], bl
mov bl, byte [ebp - 0x11]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0xc]
dec al
mov byte [ebp - 8], cl
mov cl, byte [ebp - 7]
mov byte [ebp - 3], al
mov al, byte [ebp - 0x10]
dec bl
dec dl
dec cl
dec al
mov byte [ebp - 0x11], bl
mov bl, byte [ebp - 0xb]
mov byte [ebp - 0xc], dl
mov byte [ebp - 7], cl
mov byte [ebp - 0x10], al
mov dl, byte [ebp - 6]
dec bl
dec dl
mov byte [ebp - 0xb], bl
mov byte [ebp - 6], dl
ror ebx, 5
rol ebx, 5
je 0x6209c2
pushf
and esi, 0xffffffff
add eax, 0
popf
jae 0x6209b9
xchg ecx, ebx
xchg ecx, ebx
mov ebx, ebx
jne 0x6209c2
mov eax, 0xff8e99e8
inc dword [ebp + 0x5f0975c0]
call 0x619860
test eax, eax
jne 0x6209d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add ebx, 0
xchg edi, edi
std
cld
ja 0x6209eb
pushf
jo 0x6209e1
and edi, 0xffffffff
popf
jb 0x6209e8
jbe 0x6209eb
mov esi, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0062b190
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.00632000
add esp, 0xc
test esi, esi
jne 0x620a16
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
ja 0x620a18
and ecx, ecx
jo 0x620a27
pushf
std
cld
popf
jb 0x620a24
jno 0x620a27
call 0xaed5f281
invalid
push esi
call fcn.0061b8a0
add esp, 4
lea eax, [eax + 0x78d5]
lea eax, [eax - 0x78d5]
jl 0x620a5c
pushf
cmp eax, dword [esp]
add edx, 0x19f6
sub edx, 0x19f6
jl 0x620a51
popf
jb 0x620a55
xchg esp, esp
js 0x620a59
jge 0x620a5c
mov esp, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6211e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00632000
add esp, 0xc
sub ebx, 0
xchg ebx, eax
xchg ebx, eax
jp 0x621209
jb 0x621202
jg 0x621204
mov esp, esp
jnp 0x621209
mov ecx, 0x72b173b0
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], al
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xa], al
mov byte [ebp - 5], cl
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], al
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x46
mov byte [ebp - 3], 0x74
call fcn.00625cc0
test eax, eax
jne 0x621256
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0062b190
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.00632000
add esp, 0xc
test esi, esi
jne 0x621281
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
jl 0x621283
je 0x621285
xchg ecx, edi
xchg ecx, edi
jge 0x62129c
pushf
jae 0x62128f
lea esp, [esp]
add ebx, 0
popf
jle 0x621299
jl 0x62129c
call 0xa660faf6
invalid
push esi
call fcn.0061b8a0
add esp, 4
lea ebx, [ebx + 0x64c0]
lea ebx, [ebx - 0x64c0]
jnp 0x6212b3
je 0x6212c0
pushf
js 0x6212b9
popf
jge 0x6212bd
jne 0x6212c0
sub eax, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x62b190
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
je 0x62b26c
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x62b26c
shr edx, 0
lea ecx, [ecx]
jb 0x62b1ce
pushf
lea ecx, [ecx + 0x4f5e]
lea ecx, [ecx - 0x4f5e]
popf
mov esp, esp
xchg ecx, edx
xchg ecx, edx
jbe 0x62b1cb
jae 0x62b1ce
xor eax, 0xff81
add dword [eax], eax
cmp edi, 0x10000
jae 0x62b20d
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
cmp esi, dword [esp + 0xc]
jge 0x62b201
pushf
xchg edx, eax
xchg edx, eax
add ebx, 0x71af
sub ebx, 0x71af
add esi, dword [esp]
sub esi, dword [esp]
popf
js 0x62b1fe
jl 0x62b201
lcall 0xe850, 0x5708458b
inc ebp
ret
mov eax, dword [ebp + 8]
push edi
push eax
call 0x637550
jmp 0x62b228
sub esp, 0
jae 0x62b221
pushf
lea esp, [esp]
cld
popf
jo 0x62b21c
jbe 0x62b21e
jb 0x62b221
sub eax, 0x68e85057
push edi
push eax
call fcn.00619290
loopne 0x62b225
dec dword [ebx + 0x8c483d0]
mov edx, eax
add esp, 8
test edx, edx
je 0x62b277
lea ecx, [ecx + 0xa3f]
lea ecx, [ecx - 0xa3f]
std
cld
cmp eax, esi
jl 0x62b243
ja 0x62b263
pushf
push eax
add eax, 0x6bd6
ror eax, 0x16
pop eax
add ebx, 0
test esp, 0x28b1
jns 0x62b25c
popf
jns 0x62b260
jbe 0x62b263
mov edx, 0x5e5fc28b
mov eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0x614764
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x632b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00632000
add esp, 0xc
stc
cmp edi, ebx
jo 0x632b2d
call 0x632b32
add esp, 4
jb 0x632b50
pushf
lea edx, [edx + 0x2941]
lea edx, [edx - 0x2941]
popf
lea esi, [esi]
jbe 0x632b4b
jo 0x632b4d
jae 0x632b50
mov ecx, 0x65b073b1
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4e
and esp, 0xffffffff
jnp 0x632b8d
jle 0x632b98
xchg edx, esi
xchg edx, esi
jl 0x632b95
jg 0x632b98
mov esp, 0xff3123e8
dec dword [ebx + 0x75c985c8]
or byte [edi + 0x5e], bl
call fcn.00625cc0
mov ecx, eax
test ecx, ecx
jne 0x632bab
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
add eax, 0x28fe
sub eax, 0x28fe
clc
jno 0x632bca
pushf
cmp edx, dword [esp]
jmp 0x632bbf
popf
xchg esi, edi
xchg esi, edi
ja 0x632bc7
jo 0x632bca
mov edx, 0x52f0558d
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.0062b190
mov edi, eax
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00632000
add esp, 0xc
test edi, edi
jne 0x632bf4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea edx, [edx]
ror ecx, 3
ror ecx, 0x1d
jl 0x632c0f
lea esi, [esi + 0x2093]
lea esi, [esi - 0x2093]
jl 0x632c0c
jge 0x632c0f
adc dword [edi - 0x18], 0xfffe8c8b
push edi
call fcn.0061b8a0
add esp, 4
xchg edx, ecx
xchg edx, ecx
rol esi, 0x1b
ror esi, 0x1b
jb 0x632c24
cmc
jnp 0x632c32
jae 0x632c29
xchg esp, esp
lea edx, [edx]
jns 0x632c2f
jp 0x632c32
mov ecx, 0x8b0c4d8b
push ebp
or byte [ecx + 0x52], dl
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x637040
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x614e00]
push esi
push edi
push eax
push 0x614e75
mov byte [0x614e74], 0x45
call fcn.00629310
mov edx, dword [0x614e00]
mov al, 0x2d
mov byte [0x614e7a], al
mov byte [0x614e7b], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x614e79], cl
mov byte [0x614e7c], cl
mov esi, 0x614e7d
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x604a69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x63708f
mov byte [esi], 0
pop edi
mov eax, 0x614e74
pop esi
ret
Function at 0x639ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00632000
add esp, 0xc
jb 0x639acb
test dword [esp], ecx
cmp eax, esi
jno 0x639ae5
pushf
push eax
pop eax
cmp edx, ebx
add edi, dword [esp]
sub edi, dword [esp]
popf
jmp 0x639ae2
jo 0x639ae5
xor eax, 0x45c666b0
invalid
mov al, 0x66
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
mov edx, edx
inc ebx
dec ebx
or edi, edi
sub ecx, 0
ja 0x639b33
pushf
test esp, 0x113e
popf
jmp 0x639b30
jbe 0x639b33
sub eax, 0x8af04d8a
inc ebp
cmc
mov cl, byte [ebp - 0x10]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 6]
mov dl, byte [ebp - 0xf]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
dec dl
mov byte [ebp - 6], bl
mov bl, byte [ebp - 0xe]
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
dec dl
mov byte [ebp - 0xe], bl
mov bl, byte [ebp - 0xc]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0xd], cl
mov byte [ebp - 8], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], dl
call fcn.00625cc0
test eax, eax
je 0x639c30
rol esp, 0
xor esp, 0
je 0x639bb2
jae 0x639baa
jae 0x639bac
jns 0x639bae
jne 0x639bb2
mov eax, 0xf04d8d26
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0062b190
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov ebx, eax
call fcn.00632000
add esp, 0xc
test ebx, ebx
je 0x639c30
cmp esp, 0x2ac2
or eax, eax
lea edi, [edi + 0x6576]
lea edi, [edi - 0x6576]
jg 0x639bfd
pushf
cmp edi, esi
xor eax, 0x194a
xor eax, 0x194a
popf
jg 0x639bfa
jle 0x639bfd
jmp 0x1d018454
push ebx
call fcn.0061b8a0
add esp, 4
nop
add esi, 0x1fab
sub esi, 0x1fab
jae 0x639c2a
pushf
and edx, 0xffffffff
ror eax, 0xd
rol eax, 0xd
or edx, edx
cld
popf
jne 0x639c27
jb 0x639c2a
mov edx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x63a1c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x612c8c
call fcn.0062e850
add esp, 0xc
mov byte [0x612c8c], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x77a120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0077b860
add esp, 0xc
jl 0x77a13c
jge 0x77a13c
call 0x762a07f0
mov al, 0x66
mov dl, 0x75
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 0x12], al
mov cl, 0x76
mov al, 0x73
mov byte [ebp - 0x14], 0x52
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], dl
mov byte [ebp - 0x13], cl
mov byte [ebp - 4], cl
mov byte [ebp - 0xd], al
mov byte [ebp - 8], 0x54
mov byte [ebp - 3], 0x74
mov byte [ebp - 0x11], al
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], dl
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x7a
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x62
jne 0x77a18c
je 0x77a18c
call 0x8b63ef1a
inc ebp
int1
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 0xf]
mov dl, byte [ebp - 0xa]
dec cl
mov byte [ebp - 0x14], cl
mov cl, byte [ebp - 5]
dec al
dec dl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x13]
dec cl
mov byte [ebp - 0xa], dl
mov dl, byte [ebp - 0xe]
mov byte [ebp - 5], cl
mov cl, byte [ebp - 9]
dec al
dec dl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 4]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0x12]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 0xd]
dec al
dec dl
mov byte [ebp - 4], al
mov al, byte [ebp - 8]
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 3]
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0x11]
dec al
dec dl
mov byte [ebp - 8], al
mov al, byte [ebp - 0xc]
dec cl
mov byte [ebp - 3], dl
mov dl, byte [ebp - 7]
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 0x10]
dec al
dec dl
dec cl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0xb]
mov byte [ebp - 7], dl
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 6]
dec al
dec dl
mov byte [ebp - 0xb], al
mov byte [ebp - 6], dl
jns 0x77a221
js 0x77a221
call 0x1561d0d
add byte [ebp + 0x5e0775c0], al
call fcn.007880a0
test eax, eax
jne 0x77a231
pop esi
mov esp, ebp
pop ebp
ret 8
jle 0x77a236
jg 0x77a236
call 0x5263efc7
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00785620
push 0x13
lea edx, [ebp - 0x14]
Function at 0x77d7f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x776f80
call fcn.0077d320
add esp, 0xc
mov byte [0x776f80], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
adc al, 0
add byte [eax], al
add byte [ebx + 0x41c7084d], cl
adc byte [eax], al
add byte [eax], al
add byte [ebx + 0x2c70855], cl
add dword [ebx], esp
inc ebp
mov eax, dword [di + 8]

Function at 0x77f4e0
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, dword [fcn.009c6004]
push esi
push edi
push 0x7785bc
call ebx
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
push 0x40
push edi
push esi
call fcn.0077ff60
add esp, 0xc
cmp word [esi], 0x5a4d
je 0x77f514
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov esi, dword [esi + 0x3c]
test esi, esi
jne 0x77f524
pop edi
pop esi
mov eax, 1
pop ebx
ret
add esi, edi
push 0xf8
push esi
mov esi, dword [esp + 0x20]
push esi
call fcn.0077ff60
mov eax, dword [esi]
add esp, 0xc
cmp eax, 0x4550
je 0x77f54b
pop edi
pop esi
mov eax, 1
pop ebx
ret
cmp word [esi + 4], 0x14c
je 0x77f55c
pop edi
pop esi
mov eax, 1
pop ebx
ret
test byte [esi + 0x17], 0x10
je 0x77f56b
pop edi
pop esi
mov eax, 1
pop ebx
ret
cmp dword [esi + 0x74], 0x10
jbe 0x77f57a
pop edi
pop esi
mov eax, 1
pop ebx
ret
push 0x7785ac
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x784150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0077b860
add esp, 0xc
jo 0x78416c
jno 0x78416c
call 0x6728af21
mov cl, 0x6d
mov al, 0x66
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x49
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], 0x62
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x6f
jne 0x7841bb
je 0x7841bb
call 0x8b648f49
inc ebp
int1
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 0xf]
mov dl, byte [ebp - 0xa]
dec cl
dec al
mov byte [ebp - 0x14], cl
mov cl, byte [ebp - 5]
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x13]
dec dl
dec cl
mov byte [ebp - 0xa], dl
mov dl, byte [ebp - 0xe]
dec al
mov byte [ebp - 5], cl
mov cl, byte [ebp - 9]
mov byte [ebp - 0x13], al
mov al, byte [ebp - 4]
dec dl
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0x12]
dec al
mov byte [ebp - 9], cl
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], al
mov al, byte [ebp - 8]
dec dl
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 3]
dec al
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0x11]
mov byte [ebp - 8], al
mov al, byte [ebp - 0xc]
dec dl
dec cl
mov byte [ebp - 3], dl
mov dl, byte [ebp - 7]
dec al
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0xb]
dec dl
dec cl
dec al
mov byte [ebp - 7], dl
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xb], al
dec byte [ebp - 6]
jb 0x78424b
jae 0x78424b
aaa
call fcn.007880a0
test eax, eax
jne 0x78425b
pop esi
mov esp, ebp
pop ebp
ret 4
jl 0x784260
jge 0x784260
call 0x52648ff1
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00785620
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.0077b860
add esp, 0xc
test esi, esi
jne 0x784289
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
jb 0x78428e
jae 0x78428e
call 0x8f52ae8
add byte [eax], al
push esi
call fcn.00784b10
add esp, 4
jo 0x78429c
jno 0x78429c
call 0x5080882b
mov eax, dword [ebp + 8]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x785900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
jo 0x7858e6
jno 0x7858e6
lcall 0x8111, 0x8b104d8b
retf 1
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
or edx, 0x10001
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0077b860
add esp, 0xc
jl 0x78591c
jge 0x78591c
call 0x463ec6d0
invalid
mov al, 0x6d
mov byte [ebp - 0x10], 0x57
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0x70
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], al
mov byte [ebp - 5], 0x64
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x42
mov byte [ebp - 4], 0
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], al
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], al
jne 0x785954
je 0x785954
jl 0x7858df
mov cl, byte [ebp - 0x10]
mov al, byte [ebp - 0xb]
mov dl, byte [ebp - 6]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xf]
dec dl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 0xa]
mov byte [ebp - 6], dl
mov dl, byte [ebp - 5]
dec cl
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0xe]
dec dl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 9]
mov byte [ebp - 5], dl
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 8]
clc
dec ebp
invalid
dec dl
mov byte [ebp - 9], al
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec dl
mov byte [ebp - 8], cl
mov byte [ebp - 0xc], al
mov byte [ebp - 7], dl
call fcn.007861d0
test eax, eax
jne 0x7859c4
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 4], 0x1770376
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00785620
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.0077b860
add esp, 0xc
test esi, esi
jne 0x7859f5
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
jl 0x7859fa
jge 0x7859fa
call 0xf1894254
invalid
push esi
call fcn.00784b10
add esp, 4
jne 0x785a08
je 0x785a08
call 0x8b8c9f97
dec ebp
adc byte [ebx - 0x74aff3ab], cl
inc ebp
or byte [ecx + 0x52], dl
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x787550
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x778a68]
push esi
push edi
push eax
push 0x778a89
mov byte [0x778a88], 0x45
call fcn.0077c3e0
mov edx, dword [0x778a68]
mov al, 0x2d
mov byte [0x778a8e], al
mov byte [0x778a8f], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x778a8d], cl
mov byte [0x778a90], cl
mov esi, 0x778a91
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x768a69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x78759f
mov byte [esi], 0
pop edi
mov eax, 0x778a88
pop esi
ret
Function at 0x7880d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xc
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.0077b860
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov al, 0x74
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 7], 0x73
mov byte [ebp - 2], al
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 6], 0x70
mov byte [ebp - 1], 0
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 5], 0x64
mov byte [ebp - 9], 0x75
mov byte [ebp - 4], 0x66
mov byte [ebp - 8], 0x51
mov byte [ebp - 3], al
cmp dword [esp + 4], 0x1770376
mov al, byte [ebp - 0xc]
mov dl, byte [ebp - 7]
mov cl, byte [ebp - 2]
dec al
dec dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0xb]
mov byte [ebp - 7], dl
mov dl, byte [ebp - 6]
dec cl
dec al
mov byte [ebp - 2], cl
mov cl, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
mov byte [ebp - 6], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 4]
dec dl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
Function at 0x7c3650
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x7b9ec0
call fcn.007cc790
add esp, 0xc
mov byte [0x7b9ec0], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret