joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7dec8f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x7dec9002
push esi
mov esi, dword [edx]
mov dword [ebp - 0x14], esi
mov esi, dword [edx + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [edx + 8]
mov edx, dword [edx + 0xc]
shr eax, 4
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edx
test eax, eax
je 0x7dec8fc9
mov edx, ebx
sub ecx, edx
lea esi, [edx + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x18], eax
jmp 0x7dec8f50
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.7decb210
mov eax, dword [edi]
xor dword [ebx], eax
mov ecx, dword [edi + 4]
xor dword [esi - 8], ecx
mov edx, dword [edi + 8]
xor dword [esi - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + esi]
xor dword [esi], ecx
movzx eax, byte [ebp - 8]
movzx edx, byte [ebp - 7]
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, edx
movzx edx, byte [ebp - 5]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
inc eax
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 8], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
add esp, 0x10
add edi, 0x10
add ebx, 0x10
add esi, 0x10
dec dword [ebp + 0x18]
mov byte [ebp - 7], dl
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
jne 0x7dec8f50
mov ecx, dword [ebp + 0x10]
sub ecx, edi
add ecx, dword [ebp + 0x14]
mov esi, ecx
je 0x7dec9001
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.7decb210
add esp, 0x10
xor eax, eax
test esi, esi
je 0x7dec9001
sub ebx, edi
mov cl, byte [ebp + eax - 0x24]
xor cl, byte [edi]
inc eax
mov byte [ebx + edi], cl
inc edi
cmp eax, esi
jb 0x7dec8ff2
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7decb2b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
xor al, al
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x14], al
mov byte [ebp - 4], al
mov byte [ebp - 0xc], al
push 2
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 0x18], 0x38
mov dword [ebp - 8], 0x3031
mov dword [ebp - 0x28], 0x32313032
mov word [ebp - 0x24], 0
mov dword [ebp - 0x30], 0x36313032
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0x37
mov dword [ebp - 0x20], 0x38303032
mov word [ebp - 0x1c], 0
call fcn.7dee3b20
add esp, 0xc
test eax, eax
je 0x7decb31e
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x64], 1
push 1
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.7dee3b20
add esp, 0xc
test eax, eax
jne 0x7decb39f
push 4
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.7dee3b20
add esp, 0xc
test eax, eax
jne 0x7decb39f
push 1
lea ecx, [ebp - 0x18]
push ecx
push esi
call fcn.7dee3b20
add esp, 0xc
test eax, eax
jne 0x7decb395
push 2
lea edx, [ebp - 8]
push edx
push esi
call fcn.7dee3b20
add esp, 0xc
test eax, eax
jne 0x7decb395
push 4
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.7dee3b20
add esp, 0xc
test eax, eax
jne 0x7decb395
push 4
lea ecx, [ebp - 0x30]
push ecx
push esi
call fcn.7dee3b20
add esp, 0xc
test eax, eax
jne 0x7decb395
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 7
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7decc390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x27e]
push ecx
mov word [ebp - 0x280], ax
call fcn.7dee3460
push 0x40
lea ecx, [ebp - 0x7c]
push 0
push ecx
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.7dee3460
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x10]
push ecx
xor edx, edx
push esi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], dx
call fcn.7ded2af0
push 0
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x280]
push eax
call fcn.7dee3840
mov ecx, dword [esi + 0xba0]
push 0xad0121ab
push 0
push 0
push ecx
add esi, 0x1c
push esi
call fcn.7dedca20
add esp, 0x44
pop esi
test eax, eax
je 0x7decc495
push 0
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x80]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x280]
push edx
push 0
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x7decdb40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ebx
xor ebx, ebx
push esi
push 0x1fe
lea eax, [ebp - 0x29e]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x5c], 0x18
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x2a0], dx
call fcn.7dee3460
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0x401
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.7dee1310
add esp, 0x20
test eax, eax
js 0x7decdca7
mov eax, dword [esi + 0xba0]
push edi
push 0xcc145ef7
push ebx
push ebx
push eax
lea edi, [esi + 0x1c]
push edi
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.7dedca20
add esp, 0x14
cmp eax, ebx
je 0x7decdc06
mov ecx, dword [ebp + 0xc]
push ebx
push ecx
call eax
push 0x40
lea edx, [ebp - 0x9c]
push ebx
push edx
call fcn.7dee3460
lea ecx, [ebp - 0x2a0]
push ecx
xor eax, eax
lea edx, [ebp - 0x10]
push edx
push esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xa0], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], ax
call fcn.7ded2af0
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.7dee3840
mov edx, dword [esi + 0xba0]
push 0xad0121ab
push ebx
push ebx
push edx
push edi
call fcn.7dedca20
add esp, 0x38
pop edi
cmp eax, ebx
je 0x7decdca7
push ebx
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0xa0]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2a0]
push ecx
push ebx
call eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7dece850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 4]
cmp dword [ecx + 0xcac], 5
jne 0x7dece877
push ecx
call fcn.7decbcf0
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [ecx + 0x1560], 0
je 0x7dece88e
push edi
call fcn.7dedfe90
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [ecx + 0x40], 0
mov eax, dword [edi + 0x20]
push ebx
mov ebx, dword [edi + 0x24]
push esi
mov esi, dword [edi + 0x14]
mov dword [ebp + 8], eax
je 0x7dece8af
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x10]
mov ebx, eax
mov dword [ebp + 8], edx
mov eax, edx
test eax, eax
je 0x7dece99a
lea edx, [ebx - 0xc]
cmp edx, 0x11f3
ja 0x7dece99a
push ebx
push eax
push ecx
call fcn.7dedea20
add esp, 0xc
test eax, eax
je 0x7dece99a
xor eax, eax
push 0x18e
push eax
lea ecx, [ebp - 0x1a6]
push ecx
mov dword [ebp - 0x14], 0xc8
mov word [ebp - 0x1a8], ax
call fcn.7dee3460
mov edx, dword [edi + 4]
mov edx, dword [edx + 0xcc8]
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push 0x22
push esi
call edx
test eax, eax
je 0x7dece99a
mov esi, dword [edi + 4]
push 7
lea eax, [ebp - 0x10]
push eax
add esi, 0x3e38
push esi
mov dword [ebp - 8], 0xa0d0a0d
mov byte [ebp - 4], 0
mov dword [ebp - 0x10], 0x74736f48
mov word [ebp - 0xc], 0x203a
mov byte [ebp - 0xa], 0
call fcn.7dee33e0
lea ecx, [ebp - 0x1a8]
push ecx
lea edx, [esi + 6]
push edx
call fcn.7dee3a80
push 5
lea eax, [ebp - 8]
push eax
push esi
call fcn.7dee37e0
push esi
call fcn.7dee36b0
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 0x18], eax
push ecx
add eax, esi
push eax
call fcn.7dee33e0
mov edi, dword [edi + 4]
mov edx, dword [edi + 0x1168]
xchg edi, eax
push 0x8b000011
inc ebp
call 0x80ee53e0
ret
push eax
push esi
push edi
call fcn.7deddfc0
add esp, 0x44
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x7decf2c0
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx + 0x5e5f0cc4], al
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x730
push esi
inc eax
nop
nop
nop
dec eax
and byte [edx - 0x508a444f], bh
in al, 0xb
or esi, dword [eax]
test eax, 0xea91d0b5
scasb al, byte es:[edi]
leave
movsb byte es:[edi], byte [esi]
xor dword [edx*8 + 0x75e27d4a], 0x51
jl 0x7decf293
cmp al, 0xc
repne movsb byte es:[edi], byte [esi]
dec edi
pop edi
xchg dword [edi - 0x2e], esi
xor byte [ebx], dl
ja 0x7decf2f0
test bl, cl
push edi
sub dword [edi - 0x44], edi
mov esi, 0xe1975c8e
invalid
Function at 0x7decf730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x40
push eax
call fcn.7dee36d0
add esp, 4
cmp eax, 0x1000
ja 0x7decf8ad
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x7d8]
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x7decf8ab
mov ecx, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
push edi
add ebx, 0x1fb434
push ebx
push ecx
call fcn.7dee36f0
add esp, 0xc
test eax, eax
jne 0x7decf8aa
mov edx, dword [ebp + 0xc]
push edi
push edx
push ebx
call fcn.7dee33e0
add esp, 0xc
xor ecx, ecx
xor eax, eax
push 0x104
mov word [ebp - 8], cx
mov ecx, dword [esi + 0xcc0]
lea edi, [esi + 0x11860]
push edi
mov dword [ebp - 0x10], 0xa000d
mov dword [ebp - 0xc], 0xa000d
mov dword [ebp - 0x40], 0x6c0043
mov dword [ebp - 0x3c], 0x700069
mov dword [ebp - 0x38], 0x6f0062
mov dword [ebp - 0x34], 0x720061
mov dword [ebp - 0x30], 0x64
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov word [ebp - 0x22], ax
call ecx
mov edx, dword [esi + 0xcbc]
push eax
call edx
cmp eax, 0x40
jbe 0x7decf805
xor eax, eax
mov word [esi + 0x118e0], ax
jmp 0x7decf834
test eax, eax
jne 0x7decf834
push 0x10
lea eax, [ebp - 0x20]
push eax
push edi
mov dword [ebp - 0x20], 0x6e0055
mov dword [ebp - 0x1c], 0x6e006b
mov dword [ebp - 0x18], 0x77006f
mov dword [ebp - 0x14], 0x6e
call fcn.7dee33e0
add esp, 0xc
push 0x14
lea ecx, [ebp - 0x40]
push ecx
add esi, 0x120e0
push esi
call fcn.7dee33e0
push 0
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.7dee3840
push 0
push edi
push esi
call fcn.7dee3840
push 0
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.7dee3840
mov ecx, dword [ebp + 0xc]
push 0
push ecx
push esi
call fcn.7dee3840
push esi
call fcn.7dee36d0
mov edi, dword [ebp - 4]
add esp, 0x40
add eax, eax
push esi
mov dword [edi + 0x2080], eax
call fcn.7dee36d0
add eax, eax
push eax
lea edx, [edi + 0x2088]
push esi
push edx
call fcn.7dee33e0
add esp, 0x10
mov dword [edi + 0x2084], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7ded14e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
rdtsc
xor ecx, ecx
add ecx, eax
rdtsc
sub eax, ecx
mov dword [ebp - 4], eax

Function at 0x7ded1690
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb eax, 0x984804f5
call dword [ebp - 0x75]
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push esi
xor bl, bl
call fcn.7decfa80
add esp, 8
test eax, eax
jne 0x7ded16b7
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x344]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.7decfc90
add esp, 8
push edi
jmp fcn.7ded16d0

Function at 0x7ded1950
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor ecx, ecx
mov edi, 0x100
nop
mov eax, ecx
shl eax, 0x18
mov esi, 8
lea ebx, [ebx]
test eax, eax
jns 0x7ded197d
add eax, eax
xor eax, 0x4c11db7
jmp 0x7ded197f
add eax, eax
dec esi
jne 0x7ded1970
mov dword [edx], eax
inc ecx
add edx, 4
dec edi
jne 0x7ded1960
pop edi
pop esi
pop ebp
ret
Function at 0x7ded1990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push 0x3fc
lea eax, [ebp - 0x3fc]
push 0
push eax
mov dword [ebp - 0x400], 0
call fcn.7dee3460
lea ecx, [ebp - 0x400]
push ecx
call fcn.7ded1950
mov esi, dword [ebp + 0xc]
add esp, 0x10
or eax, 0xffffffff
test esi, esi
je 0x7ded19f3
mov edx, dword [ebp + 8]
push edi
movzx edi, byte [edx]
mov ecx, eax
shr ecx, 0x18
xor ecx, edi
and ecx, 0xff
shl eax, 8
xor eax, dword [ebp + ecx*4 - 0x400]
inc edx
dec esi
jne 0x7ded19d4
pop edi
not eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x7ded1a00
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
pop ebp
ret
Function at 0x7ded25f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov edx, ecx
sub edx, eax
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x106], cl
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x7ded2602
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [ebp + eax - 0x208]
movzx edx, byte [ebp + eax - 0x106]
add ecx, esi
lea esi, [ecx + edx]
and esi, 0x800000ff
jns 0x7ded2665
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + eax - 0x106]
mov dl, byte [ebp + esi - 0x106]
mov byte [ebp + eax - 0x106], dl
inc eax
mov byte [ebp + esi - 0x106], cl
cmp eax, 0x100
jl 0x7ded2640
xor eax, eax
xor cl, cl
mov byte [ebp - 0x107], 0
cmp dword [ebp + 0xc], eax
jbe 0x7ded2711
mov edi, dword [ebp + 8]
push ebx
jmp 0x7ded26a6
mov cl, byte [ebp - 0x108]
mov dl, byte [eax + edi]
inc cl
mov byte [ebp - 0x108], cl
movzx esi, cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, byte [ebp - 0x107]
add ecx, ebx
mov byte [ebp - 0x107], cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x106]
mov byte [ebp - 1], bl
movzx ebx, byte [ecx]
mov byte [ebp + esi - 0x106], bl
movzx ebx, byte [ebp - 1]
mov byte [ecx], bl
movzx ebx, byte [ebp + esi - 0x106]
add bl, byte [ecx]
inc eax
movzx ecx, bl
mov cl, byte [ebp + ecx - 0x106]
xor cl, dl
mov byte [eax + edi - 1], cl
cmp eax, dword [ebp + 0xc]
jb 0x7ded26a0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x7ded3520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x77
push esi
mov dword [ebp - 0x20], 0x6f726863
mov dword [ebp - 0x1c], 0x635f656d
mov dword [ebp - 0x18], 0x646c6968
mov dword [ebp - 0x14], 0x6c6c642e
mov byte [ebp - 0x10], 0
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
call fcn.7ded17f0
add esp, 8
test eax, eax
jne 0x7ded3583
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x1c]
push ecx
call fcn.7ded28d0
add esp, 8
test eax, eax
je 0x7ded360e
push ebx
push edi
push eax
push esi
call fcn.7dece6f0
mov cl, 0xff
dec dword [ebx + 0xca096]
add byte [eax - 0x24], ch
sbb eax, 0x6a15db
Function at 0x7ded4670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x388
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x9f0], 0
jne 0x7ded4690
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x386]
push ecx
mov word [ebp - 0x388], ax
call fcn.7dee3460
push 0x7e
lea edx, [ebp - 0x17e]
push 0
push edx
call fcn.7dee3460
push 0x7e
lea eax, [ebp - 0xfe]
push 0
push eax
call fcn.7dee3460
mov ecx, 0x5c
xor eax, eax
mov edx, ecx
push 0x66
mov word [ebp - 0x180], cx
push eax
lea ecx, [ebp - 0x66]
push ecx
mov word [ebp - 0x100], dx
mov dword [ebp - 0x80], 0x720050
mov dword [ebp - 0x7c], 0x67006f
mov dword [ebp - 0x78], 0x610072
mov dword [ebp - 0x74], 0x46006d
mov dword [ebp - 0x70], 0x6c0069
mov dword [ebp - 0x6c], 0x730065
mov word [ebp - 0x68], ax
call fcn.7dee3460
lea edx, [ebp - 0x388]
push edx
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.7ded2af0
lea ecx, [ebp - 0x80]
push ecx
call fcn.7dee36d0
mov edi, dword [ebp + 0xc]
add esp, 0x40
add eax, eax
push eax
lea edx, [ebp - 0x388]
push edi
push edx
call fcn.7dee36f0
add esp, 0xc
test eax, eax
je 0x7ded475f
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 3
lea eax, [ebp - 0x388]
push eax
push esi
call fcn.7ded2c20
lea ecx, [ebp - 0x17e]
push edi
push ecx
call fcn.7dee3910
lea edx, [ebp - 0xfe]
push edi
push edx
call fcn.7decb260
push 0
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x388]
push ecx
call fcn.7dee3840
push 0
lea edx, [ebp - 0x180]
push edx
lea eax, [ebp - 0x388]
push eax
call fcn.7dee3840
push 0
push 0x15
lea ecx, [ebp - 0x388]
push ecx
push esi
call fcn.7dedc620
add esp, 0x48
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7ded5680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x25a]
push ecx
mov word [ebp - 0x25c], ax
call fcn.7dee3460
call fcn.7dee66ff
push eax
call fcn.7dee39f0
add byte [eax], al

Function at 0x7ded7440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push esi
push edi
push 0xadedab08
call fcn.7dee2c70
mov edi, dword [ebp + 8]
xor ecx, ecx
push 0x36
push ecx
lea edx, [ebp - 0x4a]
mov esi, eax
push edx
mov dword [edi + 0xa14], esi
mov dword [ebp - 0x54], 0x410050
mov dword [ebp - 0x50], 0x480054
mov word [ebp - 0x4c], cx
call fcn.7dee3460
xor edx, edx
add esp, 0x10
mov dword [ebp - 0x14], 0x690046
mov dword [ebp - 0x10], 0x650072
mov dword [ebp - 0xc], 0x6f0066
mov dword [ebp - 8], 0x5c0078
mov word [ebp - 4], dx
test esi, esi
jne 0x7ded74b1
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
xor eax, esi
push 0x1000
push edi
mov dword [edi + 0xa14], eax
call fcn.7dee3590
push 0x7374
push edi
mov dword [edi + 0xa04], eax
call fcn.7dee3590
mov esi, eax
add esp, 0x10
test esi, esi
je 0x7ded74a9
cmp dword [edi + 0xa04], 0
je 0x7ded74a9
push ebx
push 0x3f
lea ecx, [ebp - 0x93]
push 0
push ecx
mov byte [ebp - 0x94], 0
call fcn.7dee3460
lea edx, [ebp - 0x94]
push 0
push edx
call fcn.7dee4000
lea ecx, [ebp - 0x94]
lea eax, [edi + 0x1c]
push ecx
push eax
lea ebx, [esi + 0xc]
call fcn.7ded28d0
mov edx, dword [esi]
push edx
push ebx
push edi
mov dword [ebx], eax
call fcn.7dedff50
add esp, 0x28
cmp dword [esi + 0x10], 0
je 0x7ded7662
cmp dword [esi + 0x14], 0
je 0x7ded7662
cmp dword [esi + 0x18], 0
je 0x7ded7662
cmp dword [esi + 0x1c], 0
je 0x7ded7662
cmp dword [esi + 0x20], 0
je 0x7ded7662
cmp dword [esi + 0x24], 0
je 0x7ded7662
cmp dword [esi + 0x28], 0
je 0x7ded7662
cmp dword [esi + 0x2c], 0
je 0x7ded7662
cmp dword [esi + 0x30], 0
je 0x7ded7662
cmp dword [esi + 0x34], 0
je 0x7ded7662
push 0x3f
lea eax, [ebp - 0xd3]
push 0
push eax
mov byte [ebp - 0xd4], 0
call fcn.7dee3460
lea ecx, [ebp - 0xd4]
push 6
push ecx
call fcn.7dee4000
lea edx, [ebp - 0xd4]
push edx
lea ebx, [edi + 0x1c]
push ebx
call fcn.7ded28d0
add esp, 0x1c
test eax, eax
je 0x7ded7662
push 0x2430512b
push 0
push 0
push eax
push ebx
call fcn.7dedca20
add esp, 0x14
mov dword [esi + 0x44], eax
test eax, eax
je 0x7ded7662
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7ded75fc
mov dword [esi + 4], eax
jmp 0x7ded7603
mov dword [esi + 4], 0x20
push 8
lea eax, [ebp - 0x54]
push eax
lea ecx, [esi + 0x48]
push ecx
mov dword [esi], 0x32
call fcn.7dee33e0
lea ebx, [edi + 0x11460]
push ebx
call fcn.7dee36d0
add eax, eax
push eax
lea edx, [edi + 0x8f0]
push ebx
push edx
call fcn.7dee33e0
push esi
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.7ded8460
push esi
push edi
call fcn.7dee33c0
mov ecx, dword [edi + 0xa04]
push ecx
push edi
call fcn.7dee33c0
add esp, 0x38
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7ded7670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x2be]
push ecx
mov word [ebp - 0x2c0], ax
call fcn.7dee3460
xor eax, eax
push 0x36
push eax
lea ecx, [ebp - 0xb6]
push ecx
mov dword [ebp - 0xc0], 0x65002e
mov dword [ebp - 0xbc], 0x650078
mov word [ebp - 0xb8], ax
call fcn.7dee3460
xor ecx, ecx
push 0x2e
push ecx
lea edx, [ebp - 0x6e]
push edx
mov dword [ebp - 0x80], 0x460020
mov dword [ebp - 0x7c], 0x720069
mov dword [ebp - 0x78], 0x660065
mov dword [ebp - 0x74], 0x78006f
mov word [ebp - 0x70], cx
call fcn.7dee3460
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push 5
lea edx, [ebp - 0x2c0]
push edx
push esi
mov dword [ebp - 0x40], 0x720050
mov dword [ebp - 0x3c], 0x67006f
mov dword [ebp - 0x38], 0x610072
mov dword [ebp - 0x34], 0x20006d
mov dword [ebp - 0x30], 0x690046
mov dword [ebp - 0x2c], 0x65006c
mov dword [ebp - 0x28], 0x73
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.7ded2c20
add esp, 0x34
push 1
lea eax, [ebp - 0x2c0]
push 0x13
push eax
call fcn.7dee36d0
add esp, 4
lea ecx, [ebp + eax*2 - 0x2c0]
push ecx
push esi
call fcn.7ded2c20
push 0
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.7dee3840
push 0
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x2c0]
mov ecx, 0x5c
push eax
mov word [ebp - 0x80], cx
call fcn.7dee3840
push 0
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call fcn.7dee3840
push 0
push 0x15
lea eax, [ebp - 0x2c0]
push eax
push esi
call fcn.7dedc620
add esp, 0x44
test eax, eax
jne 0x7ded788d
lea ecx, [ebp - 0x2ba]
push 0x80
push ecx
call fcn.7dee3410
lea eax, [ebp - 0x40]
mov edx, 0x20
push eax
mov word [ebp - 0x80], dx
call fcn.7dee36d0
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x2ba]
push eax
call fcn.7dee33e0
add esp, 0x18
push 1
lea ecx, [ebp - 0x2c0]
push 0x13
push ecx
call fcn.7dee36d0
add esp, 4
lea edx, [ebp + eax*2 - 0x2c0]
push edx
push esi
call fcn.7ded2c20
push 0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.7dee3840
push 0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x2c0]
mov edx, 0x5c
push ecx
mov word [ebp - 0x80], dx
call fcn.7dee3840
push 0
lea edx, [ebp - 0xc0]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.7dee3840
push 0
push 0x15
lea ecx, [ebp - 0x2c0]
push ecx
push esi
call fcn.7dedc620
add esp, 0x44
test eax, eax
jne 0x7ded788d
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x7ded78b5
lea edx, [ebp - 0x2c0]
push edx
call fcn.7dee36d0
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
push esi
call fcn.7dee33e0
add esp, 0x10
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7ded8460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
mov ebx, dword [ebp + 8]
push esi
xor eax, eax
push edi
push 4
push 0x15
lea ecx, [ebp - 0x50]
push ecx
push ebx
mov dword [ebp - 0x14], 0x52550a0d
mov dword [ebp - 0x10], 0x203a4c
mov dword [ebp - 0x30], 0x720070
mov dword [ebp - 0x2c], 0x66006f
outsd dx, dword [esi]
add byte [esi], ah