joyce8/EMBER2024-capa huggingface dataset:
Function at 0x87ae10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0087f670
mov al, 0x75
mov cl, 0x73
add esp, 0xc
mov byte [ebp - 0x10], 0x57
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 5], 0x66
mov byte [ebp - 0xe], cl
mov byte [ebp - 9], 0x51
mov byte [ebp - 4], 0x64
mov byte [ebp - 0xd], al
mov byte [ebp - 8], cl
mov byte [ebp - 3], al
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], 0x70
mov byte [ebp - 2], 0
cmp dword [esp + 4], 0x1770376
mov al, byte [ebp - 0x10]
mov dl, byte [ebp - 0xb]
mov cl, byte [ebp - 6]
dec al
dec dl
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0xf]
mov byte [ebp - 0xb], dl
mov dl, byte [ebp - 0xa]
dec cl
dec al
mov byte [ebp - 6], cl
mov cl, byte [ebp - 5]
dec dl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xa], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 5], cl
mov cl, byte [ebp - 4]
dec dl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 8]
dec cl
dec al
mov byte [ebp - 4], cl
mov cl, byte [ebp - 3]
dec dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xc]
mov byte [ebp - 8], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec dl
mov byte [ebp - 3], cl
mov byte [ebp - 0xc], al
mov byte [ebp - 7], dl
call fcn.008883f0
test eax, eax
jne 0x87aeea
pop esi
mov esp, ebp
pop ebp
ret 0x10
jbe 0x87aeef
ja 0x87aeef
mov esi, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0088f050
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.0087f670
add esp, 0xc
test esi, esi
jne 0x87af18
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
jbe 0x87af1d
ja 0x87af1d
mov ch, 0x56
push esi
call fcn.00887ca0
add esp, 4
jb 0x87af2b
jae 0x87af2b
push es
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x87e0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor dword [eax + 1], edi
pop ebp
ret
cmp dword [esp + 8], 0x17d037c
call fcn.00888ee0
test al, al
jne 0x87e0cd
jle 0x87e0c6
jg 0x87e0c6
call 0x8810496c
add bl, ch
or al, 0x72
add esi, dword [ebx + 1]
mov byte [0x878868], al
jmp 0x87e0d9
jb 0x87e0d2
jae 0x87e0d2
shufps xmm0, xmmword [0x878868], 2
mov byte [0x878868], 2
cmp dword [esp + 4], 0x1730372
call fcn.00888ee0
test al, al
jne 0x87e11d
jne 0x87e0ef
je 0x87e0ef
jne 0x87e090
mov al, byte [0x878868]
test al, al
jne 0x87e10c
push 0x84008788
sal byte [ebp + 0x14], 0x81
jl 0x87e11f
cmp dword [esp + 8], 0x1740375
or byte [ebp + 3], dh
je 0x87e101
mov byte [0x86c661], 2
jmp 0x87e1a4
add eax, 0x86c661
add ch, cl
cwde
add byte [eax], al
add byte [esi + 3], dh
jbe 0x87e111
ja 0x87e111
mov edx, 0xc66105c6
xchg byte [eax], al
add cl, ch
xchg dword [eax], eax
add byte [eax], al
mov byte [0x86c661], 0
jmp 0x87e1a4
cmp dword [esp + 4], 0x1770376
and al, 4
jbe 0x87e126
ja 0x87e126
call fcn.00888ee0
mov dh, 0xad
add byte [eax], al
test al, al
jne 0x87e15b
jl 0x87e133
jge 0x87e133
salc
call fcn.00888ee0
test al, al
jne 0x87e14d
cmp dword [esp + 8], 0x17d037c
mov byte [0x86c661], 1
jmp 0x87e1a4
jle 0x87e152
jg 0x87e152
out 0xc6, eax
mov byte [0x86c661], 3
jmp 0x87e1a4
add eax, 0x86c661
add ebp, ebx
dec ecx
jb 0x87e160
jae 0x87e160
call fcn.0088f540
call fcn.0088f540
xor edx, edx
mov ecx, 3
div ecx
sub edx, 0
je 0x87e195
dec edx
je 0x87e187
cmp dword [esp + 8], 0x1740375
mov byte [0x86c661], 5
jmp 0x87e1a4
jne 0x87e18c
je 0x87e18c
jl 0x87e153
mov byte [0x86c661], 7
add eax, 0x86c661
pop es
jmp 0x87e1a4
cmp dword [esp + 4], 0x1730372
mov byte [0x86c661], 6
jbe 0x87e1a9
ja 0x87e1a9
shr cl, 0xe2
mov byte [0x90900000], al
jmp 0x888490
inc dword [ebp + 0x5e0775c0]
jb 0x888495
jae 0x888495
pop es
mov al, byte [0x878868]
mov byte [0x878869], al
cmp dword [esp + 4], 0x1730372
mov cl, byte [0x878869]
or cl, 4
mov byte [0x86c660], cl
jne 0x8884bb
je 0x8884bb
jnp 0x88843c
cmp byte [0x86c661], 4
jae 0x8884ea
cmp eax, 0x86c661
add al, 0x73
cmp dword es:[esp + 8], 0x1740375
cmp dword [esp + 8], 0x1740375
mov dl, byte [0x86c661]
mov byte [0x86c662], dl
jbe 0x8884dd
ja 0x8884dd
shl byte [eax + 0x86c662], 0xc
add al, 0xa2
arpl si, ax
xchg byte [eax], al
mov al, byte [0x86c662]
or al, 4
mov byte [0x86c663], al
ret
cmp dword [esp + 4], 0x1770376
mov al, 0xf
mov byte [0x86c662], al
jl 0x8884fe
jge 0x8884fe
xlatb
mov byte [0x86c663], al
ret
Function at 0x882580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 0x18
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0087f670
mov bl, 0x6e
add esp, 0xc
mov byte [ebp - 1], 0
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x13], 0x76
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0xc], bl
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x14], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xa], 0x56
mov byte [ebp - 9], 0x61
mov byte [ebp - 6], 0x61
mov byte [ebp - 3], 0x65
mov byte [ebp - 8], 0x72
mov byte [ebp - 5], 0x62
mov byte [ebp - 2], 0x41
mov byte [ebp - 7], 0x69
mov byte [ebp - 4], 0x6c
call fcn.008883f0
test eax, eax
jne 0x882608
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
jbe 0x88260d
ja 0x88260d
mov esp, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
push eax
call fcn.0088f050
push 0x18
lea edx, [ebp - 0x18]
push 0
push edx
mov esi, eax
call fcn.0087f670
add esp, 0xc
jb 0x88262e
jae 0x88262e
jne 0x5e929c29
test esi, esi
jne 0x88263c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push esi
call fcn.00887ca0
push 0x18
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0087f670
mov eax, dword [0x86af28]
add esp, 0x10
test eax, eax
mov byte [ebp - 1], 0
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x13], 0x76
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0xc], bl
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x14], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xa], 0x56
mov byte [ebp - 9], 0x61
mov byte [ebp - 6], 0x61
mov byte [ebp - 3], 0x65
mov byte [ebp - 8], 0x72
mov byte [ebp - 5], 0x62
mov byte [ebp - 2], 0x57
mov byte [ebp - 7], 0x69
mov byte [ebp - 4], 0x6c
je 0x8826d2
jb 0x8826be
jae 0x8826be
adc cl, byte [ebx - 0x7950d7eb]
add byte [ebp + 0x5251e84d], cl
mov edx, dword [0x86af28]
lea ecx, [ebp - 0x18]
push ecx
push edx
call fcn.0088f050
mov edi, eax
jmp 0x8826d5
mov edi, dword [ebp + 0xc]
jne 0x8826da
je 0x8826da
jl 0x882745
push 0x18
lea eax, [ebp - 0x18]
push 0
sbb byte [ebp + 0x6ae845], cl
push eax
call fcn.0087f670
add esp, 0xc
jb 0x8826ef
jae 0x8826ef
sbb dword [ebp + 0x720e74ff], eax
add esi, dword [ebx + 1]
test edi, edi
je 0x882701
jb 0x8826f8
jae 0x8826f8
sbb eax, 0x55a2e857
add byte [eax], al
push edi
call fcn.00887ca0
add esp, 4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cli
push ecx
Function at 0x882720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0087f670
mov cl, 0x73
mov al, 0x75
add esp, 0xc
mov byte [ebp - 0x10], 0x4a
mov byte [ebp - 0xb], 0x58
mov byte [ebp - 6], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], al
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 9], 0x6a
mov byte [ebp - 4], cl
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 8], al
mov byte [ebp - 3], 0
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x66
cmp dword [esp + 4], 0x1770376
mov dl, byte [ebp - 0x10]
mov cl, byte [ebp - 0xb]
mov al, byte [ebp - 6]
dec dl
mov byte [ebp - 0x10], dl
mov dl, byte [ebp - 0xf]
dec cl
dec al
mov byte [ebp - 0xb], cl
mov cl, byte [ebp - 0xa]
dec dl
mov byte [ebp - 6], al
mov al, byte [ebp - 5]
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 0xe]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 9]
dec dl
mov byte [ebp - 5], al
mov al, byte [ebp - 4]
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
dec dl
mov byte [ebp - 4], al
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec dl
mov byte [ebp - 8], cl
mov byte [ebp - 0xc], al
mov byte [ebp - 7], dl
call fcn.008883f0
test eax, eax
jne 0x8827ef
pop esi
mov esp, ebp
pop ebp
ret 8
jbe 0x8827f4
ja 0x8827f4
mov ecx, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0088f050
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.0087f670
add esp, 0xc
test esi, esi
jne 0x88281d
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
jbe 0x882822
ja 0x882822
mov dl, 0x56
push esi
call fcn.00887ca0
add esp, 4
jb 0x882830
jae 0x882830
add ecx, dword [ebx + 0x4d8b0c45]
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x885080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x11
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0087f670
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov bl, 0x65
mov byte [ebp - 4], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 5], 0x57
mov byte [ebp - 0x13], bl
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 9], 0x6e
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 8], 0x64
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x48
mov byte [ebp - 6], bl
jne 0x8850e8
je 0x8850e8
jo 0x8850d1
call fcn.008883f0
add esi, dword [ebx]
add byte [eax], al
test eax, eax
jne 0x8850f9
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
jbe 0x8850fe
ja 0x8850fe
ror byte [ebp + 0x5051ec4d], 0xe8
dec eax
lahf
add byte [eax], al
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0088f050
push 0x11
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.0087f670
add esp, 0xc
jbe 0x88511f
ja 0x88511f
mov cl, 0x85
div byte [ebp + 0xa]
test esi, esi
jne 0x88512d
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
cmp dword [esp + 4], 0x1770376
push esi
call fcn.00887ca0
push 0x11
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0087f670
add esp, 0x10
cmp dword [esp + 4], 0x1770376
mov eax, dword [0x86af28]
mov byte [ebp - 4], 0
test eax, eax
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x13], bl
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 9], 0x6e
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 8], 0x64
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], 0x6c
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x48
mov byte [ebp - 6], bl
je 0x8851b7
jb 0x8851a3
jae 0x8851a3
xor dword [ebx - 0x7950d7eb], ecx
add byte [ebp + 0x5251ec4d], cl
mov edx, dword [0x86af28]
lea ecx, [ebp - 0x14]
push ecx
push edx
call fcn.0088f050
mov edi, eax
jmp 0x8851ba
mov edi, dword [ebp + 8]
jne 0x8851bf
je 0x8851bf
jg 0x88522a
push 0x11
lea eax, [ebp - 0x14]
push 0
adc dword [ebp + 0x6aec45], ecx
push eax
call fcn.0087f670
add esp, 0xc
jb 0x8851d4
jae 0x8851d4
cmp byte [ebp + 0x720e74ff], al
add esi, dword [ebx + 1]
test edi, edi
je 0x8851e6
jb 0x8851dd
jae 0x8851dd
cmp al, 0x57
push edi
call fcn.00887ca0
add esp, 4
jbe 0x8851eb
ja 0x8851eb
mov eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x886bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0087f670
mov al, 0x65
mov dl, 0x74
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 0x12], al
mov cl, 0x75
mov al, 0x72
add esp, 0xc
mov byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 5], dl
mov byte [ebp - 0x13], cl
mov byte [ebp - 4], cl
mov byte [ebp - 0xd], al
mov byte [ebp - 8], 0x53
mov byte [ebp - 3], 0x73
mov byte [ebp - 0x11], al
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], dl
mov byte [ebp - 0x10], 0x79
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 6], 0x61
call fcn.0088f730
test eax, eax
jne 0x886c42
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0088f050
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.0087f670
add esp, 0xc
jbe 0x886c63
ja 0x886c63
mov eax, 0x975f685
test esi, esi
jne 0x886c70
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.00887ca0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
add esp, 4
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x888720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0087f670
mov bl, 0x6e
add esp, 0xc
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 6], 0x67
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 5], 0x65
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 9], 0x61
mov byte [ebp - 4], 0x72
mov byte [ebp - 0xd], bl
mov byte [ebp - 8], bl
mov byte [ebp - 3], 0x41
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x61
call fcn.0088f730
mov esi, eax
test esi, esi
jne 0x888789
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.0088f050
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov edi, eax
call fcn.0087f670
add esp, 0xc
test edi, edi
jne 0x8887b4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
jb 0x8887b9
jae 0x8887b9
pop es
push edi
call fcn.00887ca0
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0087f670
add esp, 0x10
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 6], 0x67
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 5], 0x65
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 9], 0x61
mov byte [ebp - 4], 0x72
mov byte [ebp - 0xd], bl
mov byte [ebp - 8], bl
mov byte [ebp - 3], 0x57
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x61
jb 0x88880e
jae 0x88880e
lea ecx, cs:[ebp - 0x10]
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.0088f050
mov esi, eax
jne 0x88881f
je 0x88881f
jl 0x88888a
push 0xf
lea edx, [ebp - 0x10]
push 0
jge 0xf3787b
push edx
call fcn.0087f670
add esp, 0xc
jb 0x888834
jae 0x888834
xor eax, 0xe74f685
test esi, esi
je 0x888846
jb 0x88883d
jae 0x88883d
cmp dword [esi - 0x18], edx
pop ebp
hlt
push esi
call fcn.00887ca0
add esp, 4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0xb8]
add ecx, 4
mov dword [eax + 0xb8], ecx
mov dword [0x86c620], 0
xor eax, eax
ret
Function at 0x888b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0087f670
mov cl, 0x6c
mov al, 0x65
add esp, 0xc
mov byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 5], 0x64
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 8], 0x48
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], 0x61
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 6], 0x6e
jb 0x888b76
jae 0x888b76
aaa
call fcn.0088f730
test eax, eax
jne 0x888b86
pop esi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0088f050
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.0087f670
add esp, 0xc
test esi, esi
jne 0x888baf
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.00887ca0
mov eax, dword [ebp + 8]
add esp, 4
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x888bd0
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esp + 4], 0x1770376
jmp 0x88ba40
add edi, dword [edi + 1]
in al, 0xc7
add eax, 0x8772cc
add dword [eax], eax
add byte [eax], al
cmp dword [esp + 4], 0x1730372
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call fcn.00882580
pop ebp
ret 8
cmp dword [esp + 4], 0x1730372
call fcn.0088f540
jne 0x88ba52
je 0x88ba52
js 0x88ba14
shr eax, 0xe
and al, 7
ret
call 0xc38fde66
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x88a0e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x86ca38
call dword [fcn.008ef004]
mov eax, dword [0x869cc0]
mov dword [0x877280], eax
mov ecx, dword [0x869cc4]
mov dword [0x877284], ecx
mov edx, dword [0x869cc8]
mov dword [0x877288], edx
mov eax, dword [0x869ccc]
mov dword [0x87728c], eax
mov ecx, dword [0x869cd0]
mov dword [0x877290], ecx
mov edx, dword [0x869cd4]
mov dword [0x877294], edx
mov eax, dword [0x869cd8]
mov dword [0x8772f4], eax
mov ecx, dword [0x869ce0]
mov dword [0x8772ec], ecx
mov edx, dword [0x869ce4]
mov dword [0x8772f0], edx
cmp dword [0x869cf8], 0
je 0x88a180
mov eax, dword [0x869cf8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xcc
jne 0x88a180
mov edx, dword [0x869cf0]
add edx, 1
mov dword [0x869cf0], edx
mov eax, dword [0x877280]
sub eax, dword [0x869ce8]
mov dword [0x877280], eax
mov ecx, dword [0x877284]
xor ecx, dword [0x869cec]
mov dword [0x877284], ecx
mov edx, dword [0x877288]
add edx, dword [0x869cf0]
mov dword [0x877288], edx
jmp 0x88a1b7
mov dword [0x87886c], 0x88a287
mov dword [0x878870], 0x88a4b9
jmp 0x88a1ce
mov dword [0x878874], 0x88a294
mov dword [0x878878], 0x88a303
mov dword [0x87887c], 0
push 0x87eef0
push dword fs:[0]
mov dword fs:[0], esp
cmp dword [0x8772f4], 0
jle 0x88a4c6
mov dword [0x87887c], 0
jmp 0x88a219
mov dword [0x877254], 0x88a31e
mov dword [0x877258], 0x88a332
jmp 0x88a230
mov dword [0x87725c], 0x88a346
mov dword [0x877260], 0x88a35a
jmp 0x88a247
mov dword [0x877264], 0x155
mov dword [0x877278], 0x88a36e
mov eax, dword [0x877254]
mov dword [0x877268], eax
mov ecx, dword [0x877258]
mov dword [0x87726c], ecx
mov edx, dword [0x87725c]
mov dword [0x877270], edx
mov eax, dword [0x877260]
mov dword [0x877274], eax
mov eax, eax
mov ebx, ebx
jmp 0x88a28e
int3
pop dword fs:[0]
add esp, 4
mov dword [0x87887c], 0
push 0x878540
call fcn.0088c020
add esp, 4
mov ecx, dword [0x8772c4]
push ecx
mov edx, dword [0x877304]
push edx
push 0x878540
call fcn.0088e430
add esp, 0xc
push 0x878540
push 0x8772b4
call fcn.0088cf50
add esp, 8
mov dword [0x87730c], 0
jmp 0x88a52d
mov eax, dword [0x87730c]
add eax, 1
mov dword [0x87730c], eax
cmp dword [0x87730c], 0x10
jae 0x88a552
mov ecx, dword [0x87730c]
mov dl, byte [ecx + 0x8772b4]
xor dl, 0x33
mov eax, dword [0x87730c]
mov byte [eax + 0x8772b4], dl
jmp 0x88a520
mov ecx, dword [0x8772b8]
xor ecx, dword [0x878598]
mov edx, dword [0x8772ec]
add edx, ecx
mov dword [0x8772ec], edx
mov eax, dword [0x8772c0]
xor eax, dword [0x877308]
mov ecx, dword [0x8772f0]
sub ecx, eax
mov dword [0x8772f0], ecx
call fcn.00885250
push 0x86ca28
call dword [fcn.008ef004]
call fcn.00889530
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x88a5a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x86ca58
call dword [fcn.008ef004]
mov eax, dword [0x869cc0]
mov dword [0x877280], eax
mov ecx, dword [0x869cc4]
mov dword [0x877284], ecx
mov edx, dword [0x869cc8]
mov dword [0x877288], edx
mov eax, dword [0x869ccc]
mov dword [0x87728c], eax
mov ecx, dword [0x869cd0]
mov dword [0x877290], ecx
mov edx, dword [0x869cd4]
mov dword [0x877294], edx
mov eax, dword [0x869cd8]
mov dword [0x8772f4], eax
mov ecx, dword [0x869ce0]
mov dword [0x8772ec], ecx
mov edx, dword [0x869ce4]
mov dword [0x8772f0], edx
cmp dword [0x869cf8], 0
je 0x88a640
mov eax, dword [0x869cf8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xcc
jne 0x88a640
mov edx, dword [0x869ce8]
add edx, 1
mov dword [0x869ce8], edx
mov eax, dword [0x877280]
add eax, dword [0x869ce8]
mov dword [0x877280], eax
mov ecx, dword [0x877284]
sub ecx, dword [0x869cec]
mov dword [0x877284], ecx
mov edx, dword [0x877288]
xor edx, dword [0x869cf0]
mov dword [0x877288], edx
jmp 0x88a677
mov dword [0x87886c], 0x88a747
mov dword [0x878870], 0x88a95f
jmp 0x88a68e
mov dword [0x878874], 0x88a754
mov dword [0x878878], 0x88a7b1
mov dword [0x87887c], 0
push 0x889860
push dword fs:[0]
mov dword fs:[0], esp
cmp dword [0x8772f4], 0
jle 0x88a96c
mov dword [0x87887c], 0
jmp 0x88a6d9
mov dword [0x877254], 0x88a7c8
mov dword [0x877258], 0x88a7dc
jmp 0x88a6f0
mov dword [0x87725c], 0x88a7f0
mov dword [0x877260], 0x88a804
jmp 0x88a707
mov dword [0x877264], 0x155
mov dword [0x877278], 0x88a818
mov eax, dword [0x877254]
mov dword [0x877268], eax
mov ecx, dword [0x877258]
mov dword [0x87726c], ecx
mov edx, dword [0x87725c]
mov dword [0x877270], edx
mov eax, dword [0x877260]
mov dword [0x877274], eax
mov eax, eax
mov ebx, ebx
jmp 0x88a74e
int3
pop dword fs:[0]
add esp, 4
mov dword [0x87887c], 0
push 0x878540
call fcn.0088c020
add esp, 4
mov ecx, dword [0x8772c4]
push ecx
mov edx, dword [0x877304]
push edx
push 0x878540
call fcn.0088e430
add esp, 0xc
push 0x878540
push 0x8772b4
call fcn.0088cf50
add esp, 8
mov dword [0x87730c], 0
jmp 0x88a9d3
mov eax, dword [0x87730c]
add eax, 1
mov dword [0x87730c], eax
cmp dword [0x87730c], 0x10
jae 0x88a9f8
mov ecx, dword [0x87730c]
mov dl, byte [ecx + 0x8772b4]
xor dl, 0x11
mov eax, dword [0x87730c]
mov byte [eax + 0x8772b4], dl
jmp 0x88a9c6
mov ecx, dword [0x8772b8]
xor ecx, dword [0x878598]
mov edx, dword [0x8772ec]
add edx, ecx
mov dword [0x8772ec], edx
mov eax, dword [0x8772c0]
xor eax, dword [0x877308]
mov ecx, dword [0x8772f0]
sub ecx, eax
mov dword [0x8772f0], ecx
call fcn.00885250
push 0x86ca48
call dword [fcn.008ef004]
call fcn.00889530
pop edi
pop esi
pop ebx
pop ebp
ret