joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6daf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, eax
mov ecx, dword [esi + 0x3c]
push 0x8da
xor bl, bl
call fcn.00049640
mov dword [ebp - 0xc], eax
test eax, eax
je 0x6dcf6
mov eax, 0x50425355
push edi
mov edi, dword [ecx + esi + 0x34]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
push ecx
xor edx, edx
mov eax, esi
mov dword [ebp - 0x28], 0x5f54524f
mov dword [ebp - 0x24], 0x69676552
mov dword [ebp - 0x20], 0x72657473
mov dword [ebp - 0x18], 0x4474726f
mov dword [ebp - 0x14], 0x65766972
mov dword [ebp - 0x10], 0x72
call fcn.00015090
test eax, eax
je 0x6dcf5
mov edx, dword [ebp + 8]
cmp eax, edx
jae 0x6dcf5
test edx, edx
je 0x6dcf5
lea ecx, [eax + esi]
add esi, edx
lea eax, [ecx + 0x1000]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
cmp esi, eax
jbe 0x6db94
mov dword [ebp - 4], eax
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
cmp ecx, esi
jae 0x6dcf5
jmp 0x6dbbe
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push esi
lea esi, [ebp - 0x50]
call fcn.00032c70
test al, al
je 0x6dcf5
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
lea ecx, [eax - 0x10ab]
cmp ecx, 7
ja 0x6dc0b
mov ecx, dword [ebp - 0x40]
test ecx, ecx
jle 0x6dce3
cmp ecx, edi
jbe 0x6dce3
mov edx, ecx
sub edx, edi
cmp dword [ebp + 8], edx
jbe 0x6dce3
mov dword [ebp + eax*4 - 0x42d8], ecx
jmp 0x6dce3
cmp eax, 0x107c
jne 0x6dc73
mov eax, dword [ebp - 0x44]
lea ecx, [eax - 0x38]
cmp ecx, 0x6c
ja 0x6dce3
test al, 3
jne 0x6dce3
lea ecx, [eax - 0x38]
shr ecx, 2
cmp ecx, 0x1b
ja 0x6dce3
movzx edx, byte [ebp - 0x48]
shr edx, 3
and edx, 7
mov eax, dword [ebp + edx*4 - 0x2c]
test eax, eax
je 0x6dce3
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + edx*4 + 4], 0
lea ecx, [ecx + edx*4]
jne 0x6dce3
sub eax, edi
mov dword [ecx + 4], eax
add eax, dword [ebp - 0xc]
mov bl, 1
mov dword [ecx + 8], eax
jmp 0x6dce3
cmp eax, 0x10b8
jne 0x6dcc9
mov ecx, dword [ebp - 0x40]
test ecx, ecx
jle 0x6dce3
cmp ecx, edi
jbe 0x6dce3
sub ecx, edi
cmp dword [ebp + 8], ecx
jbe 0x6dce3
mov eax, dword [ebp - 0x44]
lea edx, [eax - 0x38]
cmp edx, 0x6c
ja 0x6dce3
test al, 3
jne 0x6dce3
add eax, 0xffffffc8
shr eax, 2
cmp eax, 0x1b
ja 0x6dcc5
lea edx, [eax*8]
sub edx, eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + edx*4 + 4], 0
lea eax, [eax + edx*4]
jne 0x6dcc5
mov dword [eax + 4], ecx
add ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov bl, 1
jmp 0x6dce3
cmp eax, 0x11b2
je 0x6dcde
cmp eax, 0x11b3
je 0x6dcde
cmp eax, 0x10cd
jne 0x6dce3
cmp bl, 1
je 0x6dcf5
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 4]
jb 0x6dbb8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6df20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
lea eax, [ebp - 0x20]
push eax
xor bl, bl
mov dword [ebp - 0x20], 0x44005c
mov dword [ebp - 0x1c], 0x690072
mov dword [ebp - 0x18], 0x650076
mov dword [ebp - 0x14], 0x5c0072
mov dword [ebp - 0x10], 0x730075
mov dword [ebp - 0xc], 0x650062
mov dword [ebp - 8], 0x630068
mov dword [ebp - 4], 0x69
call fcn.0008b990
test eax, eax
je 0x6dfc8
lea edx, [eax + 0x3c]
mov eax, dword [ebp + 8]
mov ecx, 2
add eax, 0x24
push esi
lea ecx, [ecx]
lea esi, [ecx - 2]
mov dword [eax - 0x24], esi
mov esi, dword [edx - 4]
mov dword [eax - 0x18], esi
lea esi, [ecx - 1]
mov dword [eax], esi
mov esi, dword [edx]
mov dword [eax + 0xc], esi
mov dword [eax + 0x24], ecx
mov esi, dword [edx + 4]
mov dword [eax + 0x30], esi
lea esi, [ecx + 1]
mov dword [eax + 0x48], esi
mov esi, dword [edx + 8]
add ecx, 4
mov dword [eax + 0x54], esi
lea esi, [ecx - 2]
add edx, 0x10
add eax, 0x90
cmp esi, 0x1b
jbe 0x6df80
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6e1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
lea eax, [ebp - 0x30]
push eax
xor ebx, ebx
mov dword [ebp - 0x30], 0x44005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x5c0072
mov dword [ebp - 0x20], 0x730075
mov dword [ebp - 0x1c], 0x650062
mov dword [ebp - 0x18], 0x630068
mov dword [ebp - 0x14], 0x69
call fcn.0008b990
cmp eax, ebx
je 0x6e272
mov ecx, dword [esi]
cmp ecx, 0x1b
ja 0x6e272
mov edx, dword [esi + 8]
lea eax, [eax + ecx*4 + 0x38]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
push eax
cli
mov eax, cr0
mov dword [ebp - 4], eax
and eax, 0xfffeffff
mov cr0, eax
push ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
lock xchg dword [eax], ebx
mov dword [ebp - 8], ebx
pop ebx
mov eax, dword [ebp - 4]
mov cr0, eax
sti
pop eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6e430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x8fb
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x7355744e
mov dword [ebp - 0x10], 0x65537265
mov dword [ebp - 0xc], 0x6d695474
mov dword [ebp - 8], 0x7265
call fcn.00049640
test eax, eax
jne 0x6e48f
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edi
call fcn.00014f40
cmp al, 1
jne 0x6e48f
mov eax, dword [ebp - 4]
test eax, eax
je 0x6e48f
cmp eax, edi
jae 0x6e48f
push eax
push 0x2dd
call fcn.00049620
mov esp, ebp
pop ebp
ret
Function at 0x70540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
movzx ebx, word [edx]
push esi
push edi
xor edi, edi
xor ecx, ecx
mov esi, eax
mov eax, 0xc0000001
cmp di, bx
je 0x706f9
inc ecx
xor edi, edi
cmp di, word [edx + ecx*2]
jne 0x70560
cmp ecx, 2
jbe 0x706f9
cmp word [edx + 2], 0x3a
mov dword [ebp - 0x60], 0x3f005c
mov dword [ebp - 0x5c], 0x5c003f
mov dword [ebp - 0x56], 0x3a
jne 0x705ef
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x58], bx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x100
push edi
push edi
push edi
push edi
push edi
push 1
push 3
push 0x80
push edi
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x30]
push eax
push 0xc0000000
lea ecx, [ebp - 0x10]
push esi
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, edi
jge 0x706f9
jmp 0x705f1
xor edi, edi
mov edx, dword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov eax, dword [edx]
push edi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
push edi
push eax
push edi
push ecx
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
js 0x706f4
mov ecx, dword [ebp - 8]
cmp ecx, edi
je 0x706f4
mov ebx, dword [ecx + 4]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov edi, 0xffdf0030
push edi
mov dword [ebp + 8], 0xc0000001
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x7066e
mov edx, 0x3a
cmp dx, word [0xffdf0032]
jne 0x7066e
mov eax, 0x5c
cmp ax, word [0xffdf0034]
jne 0x7066e
mov cx, word [edi]
push ebx
lea eax, [ebp - 0x60]
mov word [ebp - 0x58], cx
call fcn.00070480
cmp al, 1
je 0x706e9
xor edi, edi
lea eax, [edi + 0x30]
mov word [ebp - 0x34], ax
xor ecx, ecx
push ebx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x44005c
mov dword [ebp - 0x5c], 0x760065
mov dword [ebp - 0x58], 0x630069
mov dword [ebp - 0x54], 0x5c0065
mov dword [ebp - 0x50], 0x610048
mov dword [ebp - 0x4c], 0x640072
mov dword [ebp - 0x48], 0x690064
mov dword [ebp - 0x44], 0x6b0073
mov dword [ebp - 0x40], 0x6f0056
mov dword [ebp - 0x3c], 0x75006c
mov dword [ebp - 0x38], 0x65006d
mov word [ebp - 0x32], cx
call fcn.00070480
cmp al, 1
je 0x706e9
inc edi
cmp edi, 0x1a
jb 0x70670
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x76b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, 0x790073
push ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x54]
xor bl, bl
mov dword [ebp - 0x54], 0x53005c
mov dword [ebp - 0x50], 0x730079
mov dword [ebp - 0x4c], 0x650074
mov dword [ebp - 0x48], 0x52006d
mov dword [ebp - 0x44], 0x6f006f
mov dword [ebp - 0x40], 0x5c0074
mov dword [ebp - 0x38], 0x740073
mov dword [ebp - 0x34], 0x6d0065
mov dword [ebp - 0x30], 0x320033
mov dword [ebp - 0x2c], 0x64005c
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x730072
mov dword [ebp - 0x1c], 0x6e005c
mov dword [ebp - 0x18], 0x690064
mov dword [ebp - 0x14], 0x2e0073
mov dword [ebp - 0xc], 0x73
call fcn.0004d700
test eax, eax
jne 0x76c4f
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push esi
mov esi, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x76c3c
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x76d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push 0x361
mov esi, eax
mov dword [ebp - 4], ebx
call fcn.00049640
test eax, eax
je 0x76e13
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [ebp - 0x14], 0x7369644e
mov dword [ebp - 0x10], 0x56746547
mov dword [ebp - 0xc], 0x69737265
mov dword [ebp - 8], 0x6e6f
call fcn.00014f40
cmp al, 1
jne 0x76e13
mov eax, dword [ebp - 4]
test eax, eax
je 0x76e13
cmp eax, edi
jae 0x76e13
lea edx, [eax + 5]
cmp edx, edi
jae 0x76e13
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov ecx, 0x3fab
cmp word [edx], cx
jae 0x76e04
mov eax, dword [eax + esi + 1]
push eax
push 0x363
call fcn.00049620
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, edi
mov ecx, esi
call fcn.00076c60
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x76e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0x361
mov dword [ebp - 4], ebx
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x76eaa
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push edx
mov dword [ebp - 0x1c], 0x7369644e
mov dword [ebp - 0x18], 0x65726544
mov dword [ebp - 0x14], 0x74736967
mov dword [ebp - 0x10], 0x72507265
mov dword [ebp - 0xc], 0x636f746f
mov dword [ebp - 8], 0x6c6f
call fcn.00014f40
cmp al, 1
jne 0x76eaa
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x76eaa
cmp ecx, dword [ebp + 8]
jae 0x76eaa
push ecx
push 0x364
call fcn.00049620
add edi, ecx
push edi
push 0x365
call fcn.00049620
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x76ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
xor ebx, ebx
push 0x361
mov dword [ebp - 4], ebx
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x76f51
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edx
mov dword [ebp - 0x20], 0x7369644e
mov dword [ebp - 0x1c], 0x67655246
mov dword [ebp - 0x18], 0x65747369
mov dword [ebp - 0x14], 0x6c694672
mov dword [ebp - 0x10], 0x44726574
mov dword [ebp - 0xc], 0x65766972
mov dword [ebp - 8], 0x72
call fcn.00014f40
cmp al, 1
jne 0x76f51
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x76f51
cmp ecx, dword [ebp + 8]
jae 0x76f51
push ecx
push 0x367
call fcn.00049620
add edi, ecx
push edi
push 0x368
call fcn.00049620
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x76f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0x361
mov dword [ebp - 4], ebx
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x76fea
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push edx
mov dword [ebp - 0x1c], 0x7369644e
mov dword [ebp - 0x18], 0x6765524d
mov dword [ebp - 0x14], 0x65747369
mov dword [ebp - 0x10], 0x6e694d72
mov dword [ebp - 0xc], 0x726f7069
mov dword [ebp - 8], 0x74
call fcn.00014f40
cmp al, 1
jne 0x76fea
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x76fea
cmp ecx, dword [ebp + 8]
jae 0x76fea
push ecx
push 0x36d
call fcn.00049620
add edi, ecx
push edi
push 0x36e
call fcn.00049620
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x770d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push 0x361
mov esi, eax
xor cl, cl
mov dword [ebp - 4], 0
call fcn.00049640
mov ebx, eax
test ebx, ebx
je 0x77198
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
mov dword [ebp - 0x20], 0x7369644e
mov dword [ebp - 0x1c], 0x6765524d
mov dword [ebp - 0x18], 0x65747369
mov dword [ebp - 0x14], 0x6e694d72
mov dword [ebp - 0x10], 0x726f7069
mov dword [ebp - 0xc], 0x69724474
mov dword [ebp - 8], 0x726576
call fcn.00014f40
cmp al, 1
jne 0x77165
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x77190
cmp ecx, edi
jae 0x77190
push ecx
push 0x36f
call fcn.00049620
add ebx, ecx
push ebx
push 0x370
call fcn.00049620
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 0x36d
call fcn.00049640
test eax, eax
jne 0x77187
push edi
call fcn.00076f60
push 0x36d
call fcn.00049640
test eax, eax
je 0x77190
push edi
push esi
mov ecx, eax
call fcn.00077000
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x771a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push edi
xor edx, edx
push 0x361
xor cl, cl
mov dword [ebp - 4], edx
call fcn.00049640
mov edi, eax
cmp edi, edx
je 0x7723c
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x28]
push ecx
push ebx
mov dword [ebp - 0x28], 0x7369644e
mov dword [ebp - 0x24], 0x6e494d49
mov dword [ebp - 0x20], 0x61697469
mov dword [ebp - 0x1c], 0x657a696c
mov dword [ebp - 0x18], 0x69766544
mov dword [ebp - 0x14], 0x6e496563
mov dword [ebp - 0x10], 0x6e617473
mov dword [ebp - 0xc], 0x78456563
mov dword [ebp - 8], edx
call fcn.00014f40
cmp al, 1
jne 0x77235
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x77235
cmp ecx, ebx
jae 0x77235
push ecx
push 0x36a
call fcn.00049620
add edi, ecx
push edi
push 0x36b
call fcn.00049620
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov al, cl
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x77250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0x361
mov dword [ebp - 4], ebx
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x772da
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push edx
mov dword [ebp - 0x1c], 0x7369644e
mov dword [ebp - 0x18], 0x69676552
mov dword [ebp - 0x14], 0x72657473
mov dword [ebp - 0x10], 0x43696454
mov dword [ebp - 0xc], 0x426c6c61
mov dword [ebp - 8], 0x6b6361
call fcn.00014f40
cmp al, 1
jne 0x772da
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x772da
cmp ecx, dword [ebp + 8]
jae 0x772da
push ecx
push 0x372
call fcn.00049620
add edi, ecx
push edi
push 0x373
call fcn.00049620
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x772f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0x361
mov dword [ebp - 4], ebx
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x7737a
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push edx
mov dword [ebp - 0x1c], 0x7369644e
mov dword [ebp - 0x18], 0x65526649
mov dword [ebp - 0x14], 0x74736967
mov dword [ebp - 0x10], 0x72507265
mov dword [ebp - 0xc], 0x6469766f
mov dword [ebp - 8], 0x7265
call fcn.00014f40
cmp al, 1
jne 0x7737a
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x7737a
cmp ecx, dword [ebp + 8]
jae 0x7737a
push ecx
push 0x376
call fcn.00049620
add edi, ecx
push edi
push 0x377
call fcn.00049620
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x77390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor edx, edx
push 0x361
xor cl, cl
mov dword [ebp - 4], edx
call fcn.00049640
mov edi, eax
cmp edi, edx
je 0x7741e
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
push ebx
mov dword [ebp - 0x20], 0x7369644e
mov dword [ebp - 0x1c], 0x65446649
mov dword [ebp - 0x18], 0x69676572
mov dword [ebp - 0x14], 0x72657473
mov dword [ebp - 0x10], 0x766f7250
mov dword [ebp - 0xc], 0x72656469
mov dword [ebp - 8], edx
call fcn.00014f40
cmp al, 1
jne 0x77417
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x77417
cmp ecx, ebx
jae 0x77417
push ecx
push 0x37a
call fcn.00049620
add edi, ecx
push edi
push 0x37b
call fcn.00049620
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov al, cl
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x77430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0x361
mov dword [ebp - 4], ebx
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x774ba
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push edx
mov dword [ebp - 0x1c], 0x7369644e
mov dword [ebp - 0x18], 0x65526649
mov dword [ebp - 0x14], 0x74736967
mov dword [ebp - 0x10], 0x6e497265
mov dword [ebp - 0xc], 0x66726574
mov dword [ebp - 8], 0x656361
call fcn.00014f40
cmp al, 1
jne 0x774ba
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x774ba
cmp ecx, dword [ebp + 8]
jae 0x774ba
push ecx
push 0x37c
call fcn.00049620
add edi, ecx
push edi
push 0x37d
call fcn.00049620
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x774d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
xor ebx, ebx
push 0x361
mov dword [ebp - 4], ebx
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x77561
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edx
mov dword [ebp - 0x20], 0x7369644e
mov dword [ebp - 0x1c], 0x65446649
mov dword [ebp - 0x18], 0x69676572
mov dword [ebp - 0x14], 0x72657473
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x63616672
mov dword [ebp - 8], 0x65
call fcn.00014f40
cmp al, 1
jne 0x77561
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x77561
cmp ecx, dword [ebp + 8]
jae 0x77561
push ecx
push 0x380
call fcn.00049620
add edi, ecx
push edi
push 0x381
call fcn.00049620
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x77570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push edi
xor ebx, ebx
push 0x361
mov dword [ebp - 4], ebx
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x77613
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x28]
push ecx
push edx
mov dword [ebp - 0x28], 0x7369644e
mov dword [ebp - 0x24], 0x65476649
mov dword [ebp - 0x20], 0x74654e74
mov dword [ebp - 0x1c], 0x6469754c
mov dword [ebp - 0x18], 0x6d6f7246
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x63616672
mov dword [ebp - 0xc], 0x646e4965
mov dword [ebp - 8], 0x7865
call fcn.00014f40
cmp al, 1
jne 0x77613
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x77613
cmp ecx, dword [ebp + 8]
jae 0x77613
push ecx
push 0x8fe
call fcn.00049620
add edi, ecx
push edi
push 0x8ff
call fcn.00049620
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x77620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0x361
mov dword [ebp - 4], ebx
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x776aa
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push edx
mov dword [ebp - 0x1c], 0x7369644e
mov dword [ebp - 0x18], 0x7465474d
mov dword [ebp - 0x14], 0x6c66664f
mov dword [ebp - 0x10], 0x4864616f
mov dword [ebp - 0xc], 0x6c646e61
mov dword [ebp - 8], 0x737265
call fcn.00014f40
cmp al, 1
jne 0x776aa
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x776aa
cmp ecx, dword [ebp + 8]
jae 0x776aa
push ecx
push 0x382
call fcn.00049620
add edi, ecx
push edi
push 0x383
call fcn.00049620
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x7b170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push eax
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x44005c
mov dword [ebp - 0x20], 0x690072
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x5c0072
mov dword [ebp - 0x14], 0x62004b
mov dword [ebp - 0x10], 0x430064
mov dword [ebp - 0xc], 0x61006c
mov dword [ebp - 8], 0x730073
mov dword [ebp - 4], 0
call fcn.0007afc0
mov esp, ebp
pop ebp
ret
Function at 0x7e150
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
push edi
push 0x61
call fcn.00049640
mov esi, eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, esi
jne 0x7e17d
mov dword [esp + 0x1c], 0
jmp 0x7e18d
test esi, esi
je 0x7e18d
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call fcn.0007e090
push 0x20
call fcn.00049640
mov esi, eax
push 0x21
mov dword [esp + 0x18], esi
call fcn.00049640
mov edi, eax
xor eax, eax
cmp esi, eax
je 0x7e308
cmp edi, eax
je 0x7e308
lea ecx, [esp + 0x30]
push ecx
push edi
mov edx, esi
mov dword [esp + 0x38], 0x54494e49
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], 0x45474150
mov dword [esp + 0x34], eax
call fcn.00015460
lea edx, [esp + 0x28]
push edx
mov ebx, eax
push edi
mov edx, esi
mov dword [esp + 0x18], ebx
call fcn.00015460
cmp ebx, eax
jbe 0x7e1fc
mov dword [esp + 0x10], eax
mov ebx, eax
cmp ebx, edi
jb 0x7e208
mov dword [esp + 0x10], 0
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0xa4]
mov dword [esp + 0x30], ecx
test ecx, ecx
je 0x7e308
mov ebx, dword [eax + esi + 0xa0]
mov dword [esp + 0x18], ebx
cmp ebx, edi
jae 0x7e308
lea eax, [ebx + 8]
cmp eax, edi
jae 0x7e308
cmp ecx, edi
jae 0x7e308
lea eax, [ebx + ecx]
cmp eax, edi
ja 0x7e308
xor edx, edx
add ebx, esi
test ecx, ecx
je 0x7e308
jmp 0x7e260
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
add edx, eax
mov dword [esp + 0x28], edx
cmp ecx, edi
jae 0x7e308
cmp eax, edi
ja 0x7e308
cmp eax, 8
jbe 0x7e308
mov esi, dword [esp + 0x18]
add esi, edx
cmp esi, edi
jae 0x7e308
cmp ecx, dword [esp + 0x10]
jb 0x7e2ee
add ecx, dword [esp + 0x14]
add eax, 0xfffffff8
shr eax, 1
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov esi, 0
je 0x7e2ee
lea esp, [esp]
movzx ecx, word [ebx + esi*2 + 8]
mov eax, ecx
and ecx, 0xf000
mov edx, 0x3000
and eax, 0xfff
cmp dx, cx
jne 0x7e2e3
mov ecx, dword [ebx]
lea edx, [ecx + eax + 4]
cmp edx, edi
jae 0x7e2e3
add eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
call fcn.0007de70
inc esi
cmp esi, dword [esp + 0x24]
jb 0x7e2b0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
add eax, 8
add eax, edx
cmp eax, edi
jae 0x7e308
add ebx, dword [ebx + 4]
cmp edx, dword [esp + 0x30]
jb 0x7e260
cmp dword [esp + 0x1c], 0
je 0x7e31a
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
push 1
push 0x1cb
call fcn.00049620
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret