joyce8/EMBER2024-capa huggingface dataset:
Function at 0x712e13
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.007038d9
add esp, 0xc
add esp, 0
mov esp, esp
rol edx, 0
jae 0x712e4a
pushf
and eax, 0xffffffff
inc edx
dec edx
lea ebx, [ebx]
je 0x712e41
popf
jmp 0x712e45
jp 0x712e47
jb 0x712e4a
add eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
ror edi, 0x14
ror edi, 0xc
rol esp, 0
xchg ebx, ebx
ja 0x712e9a
pushf
ror eax, 5
rol eax, 5
popf
xchg esi, esi
mov edx, edx
jb 0x712e97
jbe 0x712e9a
mov ebx, 0x80f44d8a
jmp 0xf4beb6a4
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
inc eax
dec eax
jge 0x712f0f
pushf
rol ecx, 0xc
rol ecx, 0x14
popf
jp 0x712f0a
mov esp, esp
jl 0x712f0f
mov ebx, 0x2a0e8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call fcn.007131b4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x712f27
mov eax, 1
jmp 0x712fcf
xchg ecx, ecx
stc
or esi, 0
jg 0x712f42
pushf
and ebx, 0xffffffff
std
cld
jl 0x712f38
lea esp, [esp]
popf
xchg esp, esp
jle 0x712f42
mov ecx, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00702f41
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.007038d9
add esp, 0xc
xor ebx, 0x753c
xor ebx, 0x753c
ror eax, 0xd
rol eax, 0xd
test dword [esp], esi
je 0x712f7e
jo 0x712f7b
jne 0x712f7e
add eax, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x712f8b
mov eax, 1
jmp 0x712fcf
call 0x712f90
lea esp, [esp + 4]
test esp, 0x33e6
rol ecx, 0x13
rol ecx, 0xd
jle 0x712faa
je 0x712fa4
jg 0x712fa6
jg 0x712faa
add eax, 0xec458b67
mov eax, dword [ebp - 0x14]
push eax
call fcn.00723150
add esp, 4
or esp, 0
xor ebx, dword [esp + 4]
xor ebx, dword [esp + 4]
je 0x712fc8
jbe 0x712fc5
jne 0x712fc8
mov edx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7162cd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x6f83d4], 1
jne 0x716462
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007038d9
add esp, 0xc
and edi, 0xffffffff
shr eax, 0
push esi
pop esi
push ecx
add ecx, 0x4ef1
ror ecx, 0x19
pop ecx
je 0x716312
jne 0x71630a
xchg ecx, ecx
jp 0x71630e
jne 0x716312
mov edi, 0xe845c644
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
ror eax, 0xe
rol eax, 0xe
xor esi, 0
and ebx, 0xffffffff
js 0x71636f
pushf
jge 0x716354
cmp esp, 0x1b1d
call 0x71635f
lea esp, [esp + 4]
add esp, 0
popf
mov ecx, ecx
lea ebx, [ebx]
jns 0x71636f
mov ecx, 0x80e84d8a
jmp 0xe8beeb79
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.007116a4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x7163e4
xor eax, eax
jmp 0x7164b8
stc
cmp esp, 0x5bb7
xor edi, 0x25f5
xor edi, 0x25f5
jns 0x71640f
pushf
and esp, 0xffffffff
popf
lea esi, [esi + 0x6800]
lea esi, [esi - 0x6800]
js 0x71640f
mov edx, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00702f41
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.007038d9
add esp, 0xc
test esp, 0x1df9
je 0x71644c
jle 0x716439
lea ecx, [ecx + 0x1a8b]
lea ecx, [ecx - 0x1a8b]
jae 0x716447
jnp 0x716449
jne 0x71644c
xor eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0x71645c
mov eax, dword [ebp - 8]
mov dword [0x6f83d4], eax
jmp 0x716460
xor eax, eax
jmp 0x7164b8
jmp 0x71646b
mov ecx, dword [0x6f83d4]
mov dword [ebp - 8], ecx
jb 0x71646d
clc
jnp 0x71647b
mov edi, edi
jle 0x716474
lea edi, [edi]
nop
jp 0x71647b
mov edi, 0xf8558be2
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jp 0x716483
add ebx, 0
je 0x716488
lea edx, [edx + 0x5518]
lea edx, [edx - 0x5518]
jg 0x7164a1
pushf
js 0x71649a
popf
xchg esp, esp
jle 0x7164a1
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00723150
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x716718
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.007038d9
add esp, 0xc
jmp 0x716733
jns 0x716747
pushf
ror edx, 0
xor ebx, edi
xor ebx, edi
popf
jo 0x716742
mov esp, esp
js 0x716747
add eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jb 0x716779
or ecx, ecx
shr ecx, 0
add eax, 0
je 0x71679b
pushf
xchg esp, esp
rol ebx, 4
rol ebx, 0x1c
js 0x71678f
popf
lea esp, [esp]
xchg edx, edx
jge 0x716798
jne 0x71679b
xor eax, 0x80ec4d8a
jmp 0xecbeefa5
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.007116a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x716810
xor eax, eax
jmp 0x716894
inc ecx
dec ecx
dec esi
inc esi
jno 0x716816
jle 0x716818
jbe 0x71681f
jl 0x71681c
ja 0x71681f
call 0x515dadb0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00702f41
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x716849
xor eax, eax
jmp 0x716894
xor esi, dword [esp + 0x10]
xor esi, dword [esp + 0x10]
xor edi, 0
not edx
not edx
jne 0x716865
pushf
jmp 0x71685e
popf
jb 0x716862
je 0x716865
jmp 0x516dadf4
mov eax, dword [ebp - 4]
push eax
call fcn.00723150
add esp, 4
jns 0x716873
call 0x716878
add esp, 4
jo 0x71688d
pushf
or edi, edi
popf
nop
mov esi, esi
xchg edi, esi
xchg edi, esi
jno 0x71688d
mov edi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x71723c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007038d9
add esp, 0xc
test dword [esp + 8], esi
add eax, 0
jp 0x71725e
ror esp, 0
jp 0x71726c
jae 0x717265
jge 0x717267
xchg ecx, ecx
jnp 0x71726c
mov ebx, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
shr esp, 0
jno 0x7172d8
pushf
cmp esp, 0xa16
jg 0x7172c7
jmp 0x7172c9
push edx
pop edx
popf
jg 0x7172cf
jp 0x7172d1
xchg ebx, ecx
xchg ebx, ecx
jo 0x7172d8
jmp 0x8159c066
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
add esp, 0
cmp edi, dword [esp]
call fcn.0071737f
Function at 0x718a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x718aa4
jmp 0x718c37
rol esp, 0
jp 0x718ab2
lea edx, [edx]
jbe 0x718aad
xchg esp, esp
jnp 0x718ab2
mov eax, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x6f8b84], edx
je 0x718ac5
jp 0x718ad1
xchg esp, esp
je 0x718acb
jnp 0x718acd
jnp 0x718ad1
mov esp, 0xec458b56
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x6f8a5c], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x6f8a58], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x6f8620], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x6f8624], ecx
cmp edi, edx
jnp 0x718b20
pushf
ror eax, 0
mov ecx, ecx
jo 0x718b0d
popf
lea esi, [esi + 0x2adc]
lea esi, [esi - 0x2adc]
jne 0x718b1d
jp 0x718b20
xor eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jl 0x718b56
jbe 0x718b6d
pushf
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
popf
jo 0x718b66
jle 0x718b68
jg 0x718b6a
ja 0x718b6d
xor eax, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
xor esi, dword [esp + 0x10]
xor esi, dword [esp + 0x10]
clc
inc ecx
dec ecx
jge 0x718be2
jno 0x718c00
pushf
jbe 0x718be8
mov esp, esp
popf
lea ecx, [ecx + 0x7207]
lea ecx, [ecx - 0x7207]
js 0x718bfa
lea esp, [esp]
jo 0x718c00
ljmp 0x6f:0x8a583d83
cmp dword [0x6f8a58], 0
je 0x718c1d
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x6f8a58]
push eax
call fcn.00702f41
mov dword [0x6f8b80], eax
xchg esp, esp
jae 0x718c27
je 0x718c23
jb 0x718c27
ljmp 0x8d00:0x6a0d6a06
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.007038d9
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x71966c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.007038d9
add esp, 0xc
ror ebx, 0
je 0x7196a5
pushf
xor esi, 0
or esp, 0
nop
shr esp, 0
popf
jns 0x71969a
xchg edx, esi
xchg edx, esi
xchg ebx, edi
xchg ebx, edi
jne 0x7196a5
xor eax, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
js 0x7196d7
test dword [esp], eax
std
cld
je 0x7196ed
pushf
jo 0x7196e2
popf
jo 0x7196e6
jns 0x7196e8
jl 0x7196ea
jne 0x7196ed
add eax, 0x80ec4d8a
jmp 0xecbf1ef7
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
jns 0x71974f
or eax, 0
je 0x719766
pushf
clc
xor edx, dword [esp]
xor edx, dword [esp]
popf
jg 0x719761
xchg ebx, ebx
jne 0x719766
add eax, 0xff7f39e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.007116a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x71977b
xor eax, eax
jmp 0x719815
xchg edx, eax
xchg edx, eax
jno 0x719790
pushf
jb 0x719783
nop
clc
jbe 0x719787
popf
jmp 0x71978b
xchg esp, esp
jo 0x719790
lcall 0x4d8b, 0x50ec458d
clc
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00702f41
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x719804
lea ecx, [ecx + 0xf32]
sub ecx, 0xf32
je 0x7197d8
pushf
not edx
not edx
shl esp, 0
jne 0x7197cf
popf
xchg edx, ecx
xchg edx, ecx
jne 0x7197d8
or dword [ebx - 0x17af03bb], 0x996f
mov eax, dword [ebp - 4]
push eax
call fcn.00723150
add esp, 4
sub esi, 0
jle 0x7197e9
test edi, 0x68da
xor esp, 0
jnp 0x7197fb
lea edx, [edx]
js 0x7197f8
jp 0x7197fb
lcall 0x55ff, 0x51084d8b
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x719815
xor esp, 0
shl ecx, 0
jl 0x719813
ja 0x71980e
lea esi, [esi]
jge 0x719813
mov ecx, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x71a30a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.007038d9
add esp, 0xc
xor ebx, dword [esp + 8]
xor ebx, dword [esp + 8]
jbe 0x71a34c
pushf
add edx, dword [esp]
sub edx, dword [esp]
push ecx
pop ecx
rol eax, 0xe
rol eax, 0x12
jno 0x71a33f
popf
xchg edi, edi
xchg edx, ebx
xchg edx, ebx
jnp 0x71a349
ja 0x71a34c
add eax, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
std
cld
jp 0x71a391
pushf
test dword [esp + 0x10], eax
lea esp, [esp]
cmc
popf
jnp 0x71a38e
jnp 0x71a391
mov edi, 0x80ec4d8a
jmp 0xecbf2b9b
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.007116a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x71a403
xor eax, eax
jmp 0x71a480
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00702f41
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x71a47e
xor esi, 0x7532
xor esi, 0x7532
je 0x71a43e
mov esi, esi
xchg edx, edx
jne 0x71a43e
mov edx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00723150
add esp, 4
lea edi, [edi + 0x5a03]
lea edi, [edi - 0x5a03]
cmc
je 0x71a46d
pushf
push ebx
add ebx, 0x5b05
ror ebx, 0x14
pop ebx
popf
xchg esi, eax
xchg esi, eax
jne 0x71a46d
mov ecx, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x71a480
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x71ef12
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007038d9
add esp, 0xc
jnp 0x71ef2d
or edi, edi
jb 0x71ef38
jge 0x71ef33
mov ebx, ebx
jae 0x71ef38
add eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
and esp, 0xffffffff
and edi, edi
test edx, 0x3574
jp 0x71ef82
lea edi, [edi]
jnp 0x71ef82
mov ebx, 0x80f44d8a
jmp 0xf4bf778c
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
test eax, 0x3a93
or esp, 0
jae 0x71effd
jnp 0x71f00a
jae 0x71f001
mov ecx, ecx
jnp 0x71f005
jl 0x71f007
jp 0x71f00a
jmp 0xff9885f6
call fcn.007116a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x71f01d
jmp 0x71f0cd
jg 0x71f01f
inc eax
dec eax
js 0x71f02e
jnp 0x71f025
xchg edi, edi
js 0x71f029
mov edx, edx
jns 0x71f02e
mov ebx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00702f41
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.007038d9
add esp, 0xc
rol esi, 0x18
ror esi, 0x18
js 0x71f056
push edi
pop edi
lea eax, [eax]
jae 0x71f082
pushf
add eax, dword [esp]
sub eax, dword [esp]
lea eax, [eax + 0x6840]
lea eax, [eax - 0x6840]
call 0x71f075
lea esp, [esp + 4]
popf
jae 0x71f07d
mov ebx, ebx
jb 0x71f082
ljmp 0x275:0xfc7d83
cmp dword [ebp - 4], 0
jne 0x71f08a
jmp 0x71f0cd
test dword [esp + 4], edx
add edi, 0
lea esp, [esp]
je 0x71f09c
ja 0x71f098
nop
jne 0x71f09c
mov esi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00723150
add esp, 4
jae 0x71f0aa
jns 0x71f0c6
pushf
nop
rol edi, 0xb
rol edi, 0x15
ror ebx, 0xc
ror ebx, 0x14
popf
ja 0x71f0bf
jp 0x71f0c1
lea eax, [eax]
js 0x71f0c6
xor eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x71f551
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
jmp 0x71f559
xor edx, 0x5532
xor edx, 0x5532
xchg edx, edx
jae 0x71f589
pushf
mov esp, esp
shl edi, 0
jae 0x71f572
test edx, ebx
popf
lea edx, [edx + 0x4c86]
lea edx, [edx - 0x4c86]
mov esp, esp
jb 0x71f586
jb 0x71f589
sub dword [edx], 0x704aef68
add bh, bh
adc eax, sym.imp.USER32.dll_EnumWindows
push 0
push 0x704aef
call dword [sym.imp.USER32.dll_EnumWindows]
xor esi, dword [esp + 8]
xor esi, dword [esp + 8]
sub esp, 0
lea ecx, [ecx + 0x49bc]
sub ecx, 0x49bc
ja 0x71f5b8
ja 0x71f5b1
lea esi, [esi]
jo 0x71f5b5
jbe 0x71f5b8
mov ebx, 0x9f3c3d83
outsd dx, dword [esi]
add byte [eax], al
cmp dword [0x6f9f3c], 0
jle 0x71f5ef
and esp, 0xffffffff
jle 0x71f5cf
xchg ebx, ebx
jl 0x71f5ca
jg 0x71f5cf
sub edx, 0x17b80f
add byte [eax], al
mov eax, 0x17
jmp 0x71f5f4
mov eax, 0x45
pop edi
pop esi
pop ebx
pop ebp
ret