joyce8/EMBER2024-capa huggingface dataset:
Function at 0x730180
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x72d4dc
call dword [fcn.008ef004]
mov eax, dword [0x72acc0]
mov dword [0x72dc6c], eax
mov ecx, dword [0x72acc4]
mov dword [0x72dc70], ecx
mov edx, dword [0x72acc8]
mov dword [0x72dc74], edx
mov eax, dword [0x72accc]
mov dword [0x72dc78], eax
mov ecx, dword [0x72acd0]
mov dword [0x72dc7c], ecx
mov edx, dword [0x72acd4]
mov dword [0x72dc80], edx
mov eax, dword [0x72acd8]
mov dword [0x72d924], eax
mov ecx, dword [0x72ace0]
mov dword [0x72d91c], ecx
mov edx, dword [0x72ace4]
mov dword [0x72d920], edx
cmp dword [0x72acf8], 0
je 0x730220
mov eax, dword [0x72acf8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xcc
jne 0x730220
mov edx, dword [0x72acf0]
add edx, 1
mov dword [0x72acf0], edx
mov eax, dword [0x72dc6c]
sub eax, dword [0x72ace8]
mov dword [0x72dc6c], eax
mov ecx, dword [0x72dc70]
xor ecx, dword [0x72acec]
mov dword [0x72dc70], ecx
mov edx, dword [0x72dc74]
add edx, dword [0x72acf0]
mov dword [0x72dc74], edx
jmp 0x730257
mov dword [0x72daf8], 0x730327
mov dword [0x72dafc], 0x730559
jmp 0x73026e
mov dword [0x72db00], 0x730334
mov dword [0x72db04], 0x7303a3
mov dword [0x72db08], 0
push 0x739770
push dword fs:[0]
mov dword fs:[0], esp
cmp dword [0x72d924], 0
jle 0x730566
mov dword [0x72db08], 0
jmp 0x7302b9
mov dword [0x72d844], 0x7303be
mov dword [0x72d848], 0x7303d2
jmp 0x7302d0
mov dword [0x72d84c], 0x7303e6
mov dword [0x72d850], 0x7303fa
jmp 0x7302e7
mov dword [0x72d854], 0x155
mov dword [0x72d868], 0x73040e
mov eax, dword [0x72d844]
mov dword [0x72d858], eax
mov ecx, dword [0x72d848]
mov dword [0x72d85c], ecx
mov edx, dword [0x72d84c]
mov dword [0x72d860], edx
mov eax, dword [0x72d850]
mov dword [0x72d864], eax
mov eax, eax
mov ebx, ebx
jmp 0x73032e
int3
pop dword fs:[0]
add esp, 4
mov dword [0x72db08], 0
push 0x72d8b8
call fcn.0073a180
add esp, 4
mov ecx, dword [0x72ed00]
push ecx
mov edx, dword [fcn.0072f000]
push edx
push 0x72d8b8
call fcn.0073bf20
add esp, 0xc
push 0x72d8b8
push 0x72ecf0
call fcn.00734960
add esp, 8
mov dword [0x72d950], 0
jmp 0x7305cd
mov eax, dword [0x72d950]
add eax, 1
mov dword [0x72d950], eax
cmp dword [0x72d950], 0x10
jae 0x7305f2
mov ecx, dword [0x72d950]
mov dl, byte [ecx + 0x72ecf0]
xor dl, 0x33
mov eax, dword [0x72d950]
mov byte [eax + 0x72ecf0], dl
jmp 0x7305c0
mov ecx, dword [0x72ecf4]
xor ecx, dword [0x72d910]
mov edx, dword [0x72d91c]
add edx, ecx
mov dword [0x72d91c], edx
mov eax, dword [0x72ecfc]
xor eax, dword [0x72d94c]
mov ecx, dword [0x72d920]
sub ecx, eax
mov dword [0x72d920], ecx
call fcn.00730ca0
push 0x72d4cc
call dword [fcn.008ef004]
call fcn.00735650
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x731cc0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x72d55c
call dword [fcn.008ef004]
mov eax, dword [0x72acc0]
mov dword [0x72dc6c], eax
mov ecx, dword [0x72acc4]
mov dword [0x72dc70], ecx
mov edx, dword [0x72acc8]
mov dword [0x72dc74], edx
mov eax, dword [0x72accc]
mov dword [0x72dc78], eax
mov ecx, dword [0x72acd0]
mov dword [0x72dc7c], ecx
mov edx, dword [0x72acd4]
mov dword [0x72dc80], edx
mov eax, dword [0x72acd8]
mov dword [0x72d924], eax
mov ecx, dword [0x72ace0]
mov dword [0x72d91c], ecx
mov edx, dword [0x72ace4]
mov dword [0x72d920], edx
cmp dword [0x72acf8], 0
je 0x731d60
mov eax, dword [0x72acf8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xcc
jne 0x731d60
mov edx, dword [0x72ace8]
add edx, 1
mov dword [0x72ace8], edx
mov eax, dword [0x72dc6c]
add eax, dword [0x72ace8]
mov dword [0x72dc6c], eax
mov ecx, dword [0x72dc70]
sub ecx, dword [0x72acec]
mov dword [0x72dc70], ecx
mov edx, dword [0x72dc74]
xor edx, dword [0x72acf0]
mov dword [0x72dc74], edx
jmp 0x731d97
mov dword [0x72daf8], 0x731e67
mov dword [0x72dafc], 0x73207f
jmp 0x731dae
mov dword [0x72db00], 0x731e74
mov dword [0x72db04], 0x731ed1
mov dword [0x72db08], 0
push 0x731050
push dword fs:[0]
mov dword fs:[0], esp
cmp dword [0x72d924], 0
jle 0x73208c
mov dword [0x72db08], 0
jmp 0x731df9
mov dword [0x72d844], 0x731ee8
mov dword [0x72d848], 0x731efc
jmp 0x731e10
mov dword [0x72d84c], 0x731f10
mov dword [0x72d850], 0x731f24
jmp 0x731e27
mov dword [0x72d854], 0x155
mov dword [0x72d868], 0x731f38
mov eax, dword [0x72d844]
mov dword [0x72d858], eax
mov ecx, dword [0x72d848]
mov dword [0x72d85c], ecx
mov edx, dword [0x72d84c]
mov dword [0x72d860], edx
mov eax, dword [0x72d850]
mov dword [0x72d864], eax
mov eax, eax
mov ebx, ebx
jmp 0x731e6e
int3
pop dword fs:[0]
add esp, 4
mov dword [0x72db08], 0
push 0x72d8b8
call fcn.0073a180
add esp, 4
mov ecx, dword [0x72ed00]
push ecx
mov edx, dword [fcn.0072f000]
push edx
push 0x72d8b8
call fcn.0073bf20
add esp, 0xc
push 0x72d8b8
push 0x72ecf0
call fcn.00734960
add esp, 8
mov dword [0x72d950], 0
jmp 0x7320f3
mov eax, dword [0x72d950]
add eax, 1
mov dword [0x72d950], eax
cmp dword [0x72d950], 0x10
jae 0x732118
mov ecx, dword [0x72d950]
mov dl, byte [ecx + 0x72ecf0]
xor dl, 0x11
mov eax, dword [0x72d950]
mov byte [eax + 0x72ecf0], dl
jmp 0x7320e6
mov ecx, dword [0x72ecf4]
xor ecx, dword [0x72d910]
mov edx, dword [0x72d91c]
add edx, ecx
mov dword [0x72d91c], edx
mov eax, dword [0x72ecfc]
xor eax, dword [0x72d94c]
mov ecx, dword [0x72d920]
sub ecx, eax
mov dword [0x72d920], ecx
call fcn.00730ca0
push 0x72d54c
call dword [fcn.008ef004]
call fcn.00735650
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x735680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xc
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00735760
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov al, 0x74
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 7], 0x73
mov byte [ebp - 2], al
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 6], 0x70
mov byte [ebp - 1], 0
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 5], 0x64
mov byte [ebp - 9], 0x75
mov byte [ebp - 4], 0x66
mov byte [ebp - 8], 0x51
mov byte [ebp - 3], al
cmp dword [esp + 4], 0x1770376
mov al, byte [ebp - 0xc]
mov dl, byte [ebp - 7]
mov cl, byte [ebp - 2]
dec al
dec dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0xb]
mov byte [ebp - 7], dl
mov dl, byte [ebp - 6]
dec cl
dec al
mov byte [ebp - 2], cl
mov cl, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
mov byte [ebp - 6], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 4]
dec dl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 3]
dec cl
dec al
dec dl
mov byte [ebp - 4], cl
mov byte [ebp - 8], al
mov byte [ebp - 3], dl
call fcn.007344e0
test eax, eax
jne 0x73573b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
push esi
push ecx
push eax
call fcn.0072f630
push 0xc
lea edx, [ebp - 0xc]
push 0
push edx
mov esi, eax
call fcn.00735760
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x735ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [fcn.008ef004]
push 0x72d6bc
call edi
push 0x19
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00735760
mov cl, 0x6e
mov dl, 0x74
add esp, 0xc
mov al, 0x6c
mov byte [ebp - 0x1b], cl
mov byte [ebp - 0xb], cl
mov byte [ebp - 0x18], cl
mov byte [ebp - 7], dl
mov byte [ebp - 0xe], dl
mov edx, dword [0x72bf80]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 8], al
mov byte [ebp - 0x16], al
mov al, 0x65
push ecx
push edx
mov byte [ebp - 4], 0
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x12], 0x78
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x15], al
mov byte [ebp - 0x10], al
mov byte [ebp - 6], al
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x46
mov byte [ebp - 5], 0x72
mov byte [ebp - 0x13], 0x45
mov byte [ebp - 9], 0x69
call fcn.0072f630
mov esi, eax
push 0x19
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00735760
add esp, 0xc
test esi, esi
jne 0x735c5d
jne 0x735c52
je 0x735c52
jbe 0x735cb2
pop edi
mov eax, 6
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0xcc
jne 0x735c6d
pop edi
mov eax, 6
pop esi
mov esp, ebp
pop ebp
ret
push 0x72d6ac
call edi
pop edi
mov eax, 7
pop esi
mov esp, ebp
pop ebp
ret
je 0x735cb9
cmp ecx, 5
jne 0x735cc5
jb 0x735cbe
jae 0x735cbe
and dword [eax + 1], edi
mov eax, 1
pop ebp
ret
jb 0x735cca
jae 0x735cca
mov cl, byte es:[eax]
mov cl, byte [eax]
cmp cl, 0x70
jb 0x735ce2
cmp cl, 0x7f
ja 0x735ce2
jb 0x735cdb
jae 0x735cdb
sub bh, byte [eax + 1]
mov eax, 1
pop ebp
ret
jb 0x735ce7
jae 0x735ce7
cmp byte cs:[eax], 0xe3
cmp byte [eax], 0xe3
jne 0x735cf8
jb 0x735cf1
jae 0x735cf1
xor dword [eax + 1], edi
mov eax, 1
pop ebp
ret
jb 0x735cfd
jae 0x735cfd
xor eax, 0xc35dc033
jb 0x735d06
xor eax, eax
pop ebp
ret
jae 0x735d06
pop ss
mov eax, 1
pop ebp
ret

Function at 0x735e90
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, dword [fcn.008ef004]
push esi
push edi
push 0x72d6dc
call ebx
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
push 0x40
push edi
push esi
call fcn.00737e90
add esp, 0xc
cmp word [esi], 0x5a4d
je 0x735ec4
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov esi, dword [esi + 0x3c]
test esi, esi
jne 0x735ed4
pop edi
pop esi
mov eax, 1
pop ebx
ret
add esi, edi
push 0xf8
push esi
mov esi, dword [esp + 0x20]
push esi
call fcn.00737e90
mov eax, dword [esi]
add esp, 0xc
cmp eax, 0x4550
je 0x735efb
pop edi
pop esi
mov eax, 1
pop ebx
ret
cmp word [esi + 4], 0x14c
je 0x735f0c
pop edi
pop esi
mov eax, 1
pop ebx
ret
test byte [esi + 0x17], 0x10
je 0x735f1b
pop edi
pop esi
mov eax, 1
pop ebx
ret
cmp dword [esi + 0x74], 0x10
jbe 0x735f2a
pop edi
pop esi
mov eax, 1
pop ebx
ret
push 0x72d6cc
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x735fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00735760
mov bl, 0x6e
add esp, 0xc
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 6], 0x67
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 5], 0x65
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 9], 0x61
mov byte [ebp - 4], 0x72
mov byte [ebp - 0xd], bl
mov byte [ebp - 8], bl
mov byte [ebp - 3], 0x41
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x61
call fcn.00734530
mov esi, eax
test esi, esi
jne 0x736029
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.0072f630
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov edi, eax
call fcn.00735760
add esp, 0xc
test edi, edi
jne 0x736054
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
jb 0x736059
jae 0x736059
pop es
push edi
call fcn.0073a120
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00735760
add esp, 0x10
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 6], 0x67
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 5], 0x65
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 9], 0x61
mov byte [ebp - 4], 0x72
mov byte [ebp - 0xd], bl
mov byte [ebp - 8], bl
mov byte [ebp - 3], 0x57
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x61
jb 0x7360ae
jae 0x7360ae
lea ecx, cs:[ebp - 0x10]
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.0072f630
mov esi, eax
jne 0x7360bf
je 0x7360bf
jl 0x73612a
push 0xf
lea edx, [ebp - 0x10]
push 0
jge 0xde511b
push edx
call fcn.00735760
add esp, 0xc
jb 0x7360d4
jae 0x7360d4
xor eax, 0xe74f685
test esi, esi
je 0x7360e6
jb 0x7360dd
jae 0x7360dd
cmp dword [esi - 0x18], edx
cmp eax, 0x83000040
les eax, [ebx + ecx*4]
inc ebp
adc byte [ebx + 0x558b0c4d], cl
or byte [eax + 0x51], dl
push esi
call fcn.0073a120
add esp, 4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
sbb al, 0x97
mov edi, dword [esp + 0x24]
xor edx, edx
add eax, ebx
mov dl, ch
mov ebx, dword [edi + edx*4]
mov edi, dword [esp + 0x28]
mov edx, ecx
xor eax, ebx
and edx, 0xff
mov ebx, dword [edi + edx*4]
mov edx, dword [esp + 0x14]
add eax, ebx
mov edi, dword [edx]
mov dword [esi], ecx
xor eax, edi
pop edi
pop esi
mov dword [edx], eax
pop ebx
ret
Function at 0x736a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00735760
mov cl, 0x6c
mov al, 0x65
add esp, 0xc
mov byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 5], 0x64
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 8], 0x48
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], 0x61
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 6], 0x6e
jb 0x736aa6
jae 0x736aa6
aaa
call fcn.00734530
test eax, eax
jne 0x736ab6
pop esi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0072f630
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.00735760
add esp, 0xc
test esi, esi
jne 0x736adf
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.0073a120
mov eax, dword [ebp + 8]
add esp, 4
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x736d70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x72dc90]
push esi
push edi
push eax
push 0x72db85
mov byte [0x72db84], 0x45
call fcn.007322e0
mov edx, dword [0x72dc90]
mov al, 0x2d
mov byte [0x72db8a], al
mov byte [0x72db8b], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x72db89], cl
mov byte [0x72db8c], cl
mov esi, 0x72db8d
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x71da69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x736dbf
mov byte [esi], 0
pop edi
mov eax, 0x72db84
pop esi
ret

Function at 0x73a180
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x72c1c0
call fcn.0072f1a0
add esp, 0xc
mov byte [0x72c1c0], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x73a1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00735760
mov bl, 0x65
add esp, 0xc
mov byte [ebp - 4], 0
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xb], bl
mov byte [ebp - 6], bl
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 5], 0x41
mov byte [ebp - 0xe], bl
mov byte [ebp - 9], 0x76
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 8], 0x69
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x63
cmp dword [esp + 4], 0x1770376
call fcn.00734530
mov esi, eax
test esi, esi
jne 0x73a248
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esp + 8], 0x1740375
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.0072f630
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov edi, eax
call fcn.00735760
add esp, 0xc
test edi, edi
jne 0x73a27b
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
jb 0x73a280
jae 0x73a280
add al, 0x57
push edi
call fcn.0073a120
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00735760
add esp, 0x10
mov byte [ebp - 4], 0
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xb], bl
mov byte [ebp - 6], bl
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 5], 0x57
mov byte [ebp - 0xe], bl
mov byte [ebp - 9], 0x76
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 8], 0x69
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x63
cmp dword [esp + 4], 0x1770376
jb 0x73a2d4
jae 0x73a2d4
daa
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.0072f630
mov esi, eax
jne 0x73a2e5
je 0x73a2e5
jne 0x73a350
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
call fcn.00735760
add esp, 0xc
jb 0x73a2fa
or eax, 0x6af0558d
add byte [edx - 0x18], dl
outsb dx, byte [esi]
mov ah, 0xff
inc dword [ebx + 0x3720cc4]
jae 0x73a2fa
test esi, esi
test esi, esi
je 0x73a30c
jb 0x73a303
jae 0x73a303
xor dl, byte [esi - 0x18]
pop ss
invalid
push esi
call fcn.0073a120
add esp, 4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
out dx, al
mov cl, 0x75
mov al, 0x72
add esp, 0xc
mov byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 5], dl
mov byte [ebp - 0x13], cl
mov byte [ebp - 4], cl
mov byte [ebp - 0xd], al
mov byte [ebp - 8], 0x53
mov byte [ebp - 3], 0x73
mov byte [ebp - 0x11], al
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], dl
mov byte [ebp - 0x10], 0x79
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 6], 0x61
call fcn.00734530
test eax, eax
jne 0x73a3a2
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0072f630
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.00735760
add esp, 0xc
jbe 0x73a3c3
ja 0x73a3c3
mov eax, 0x975f685
test esi, esi
jne 0x73a3d0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.0073a120
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
add esp, 4
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x73a330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00735760
mov al, 0x65
mov dl, 0x74
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 0x12], al
Function at 0x73c2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or byte [ebx], cl
or dword [edx], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00735760
mov al, 0x6d
add esp, 0xc
mov byte [ebp - 0x10], 0x57
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0x70
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], al
mov byte [ebp - 5], 0x64
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x42
mov byte [ebp - 4], 0
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], al
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], al
jne 0x73c31f
je 0x73c31f
jl 0x73c2aa
mov cl, byte [ebp - 0x10]
mov al, byte [ebp - 0xb]
mov dl, byte [ebp - 6]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xf]
dec dl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 0xa]
mov byte [ebp - 6], dl
mov dl, byte [ebp - 5]
dec cl
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0xe]
dec dl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 9]
mov byte [ebp - 5], dl
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 8]
dec dl
mov byte [ebp - 9], al
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec dl
mov byte [ebp - 8], cl
mov byte [ebp - 0xc], al
mov byte [ebp - 7], dl
call fcn.007344e0
test eax, eax
jne 0x73c38f
dec ebp
invalid
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 4], 0x1770376
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0072f630
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.00735760
add esp, 0xc
test esi, esi
jne 0x73c3c0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
push esi
call fcn.0073a120
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add esp, 4
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x7ec730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007f0870
mov al, 0x65
mov dl, 0x74
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 0x12], al
mov cl, 0x75
mov al, 0x72
add esp, 0xc
mov byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 5], dl
mov byte [ebp - 0x13], cl
mov byte [ebp - 4], cl
mov byte [ebp - 0xd], al
mov byte [ebp - 8], 0x53
mov byte [ebp - 3], 0x73
mov byte [ebp - 0x11], al
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], dl
mov byte [ebp - 0x10], 0x79
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 6], 0x61
call fcn.007f5360
test eax, eax
jne 0x7ec7a2
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.007f0ad0
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.007f0870
add esp, 0xc
jbe 0x7ec7c3
ja 0x7ec7c3
mov eax, 0x975f685
test esi, esi
jne 0x7ec7d0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.007f8380
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
add esp, 4
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x7edd50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007f0870
mov al, 0x75
mov cl, 0x73
add esp, 0xc
mov byte [ebp - 0x10], 0x57
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 5], 0x66
mov byte [ebp - 0xe], cl
mov byte [ebp - 9], 0x51
mov byte [ebp - 4], 0x64
mov byte [ebp - 0xd], al
mov byte [ebp - 8], cl
mov byte [ebp - 3], al
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], 0x70
mov byte [ebp - 2], 0
cmp dword [esp + 4], 0x1770376
mov al, byte [ebp - 0x10]
mov dl, byte [ebp - 0xb]
mov cl, byte [ebp - 6]
dec al
dec dl
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0xf]
mov byte [ebp - 0xb], dl
mov dl, byte [ebp - 0xa]
dec cl
dec al
mov byte [ebp - 6], cl
mov cl, byte [ebp - 5]
dec dl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xa], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 5], cl
mov cl, byte [ebp - 4]
dec dl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 8]
dec cl
dec al
mov byte [ebp - 4], cl
mov cl, byte [ebp - 3]
dec dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xc]
mov byte [ebp - 8], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec dl
mov byte [ebp - 3], cl
mov byte [ebp - 0xc], al
mov byte [ebp - 7], dl
call fcn.007eb0e0
test eax, eax
jne 0x7ede2a
pop esi
mov esp, ebp
pop ebp
ret 0x10
jbe 0x7ede2f
ja 0x7ede2f
mov esi, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.007f0ad0
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.007f0870
add esp, 0xc
test esi, esi
jne 0x7ede58
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
jbe 0x7ede5d
ja 0x7ede5d
mov ch, 0x56
push esi
call fcn.007f8380
add esp, 4
jb 0x7ede6b
jae 0x7ede6b
push es
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 0x10