joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7edfd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007f0870
mov al, 0x65
mov cl, 0x69
mov byte [ebp - 4], al
mov byte [ebp - 8], al
mov al, 0x74
add esp, 0xc
mov byte [ebp - 1], 0
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xa], 0x67
mov byte [ebp - 5], 0x6a
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x12], cl
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 3], 0x63
mov byte [ebp - 0x11], al
mov byte [ebp - 0xc], cl
mov byte [ebp - 7], 0x4f
mov byte [ebp - 2], al
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 6], 0x62
call fcn.007eb0e0
test eax, eax
jne 0x7ee04a
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.007f0ad0
push 0x14
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.007f0870
add esp, 0xc
test esi, esi
jne 0x7ee074
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.007f8380
add esp, 4
cmp dword [esp + 8], 0x1740375
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x7ee280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007f0870
mov cl, 0x6c
mov al, 0x65
add esp, 0xc
mov byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 5], 0x64
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 8], 0x48
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], 0x61
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 6], 0x6e
jb 0x7ee2e6
jae 0x7ee2e6
aaa
call fcn.007f5360
test eax, eax
jne 0x7ee2f6
pop esi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.007f0ad0
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.007f0870
add esp, 0xc
test esi, esi
jne 0x7ee31f
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.007f8380
mov eax, dword [ebp + 8]
add esp, 4
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x7ee6a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007f0870
mov bl, 0x6e
add esp, 0xc
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 6], 0x67
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 5], 0x65
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 9], 0x61
mov byte [ebp - 4], 0x72
mov byte [ebp - 0xd], bl
mov byte [ebp - 8], bl
mov byte [ebp - 3], 0x41
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x61
call fcn.007f5360
mov esi, eax
test esi, esi
jne 0x7ee709
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.007f0ad0
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov edi, eax
call fcn.007f0870
add esp, 0xc
test edi, edi
jne 0x7ee734
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
jb 0x7ee739
jae 0x7ee739
pop es
push edi
call fcn.007f8380
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007f0870
add esp, 0x10
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 6], 0x67
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 5], 0x65
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 9], 0x61
mov byte [ebp - 4], 0x72
mov byte [ebp - 0xd], bl
mov byte [ebp - 8], bl
mov byte [ebp - 3], 0x57
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x61
jb 0x7ee78e
jae 0x7ee78e
lea ecx, cs:[ebp - 0x10]
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.007f0ad0
mov esi, eax
jne 0x7ee79f
je 0x7ee79f
jl 0x7ee80a
push 0xf
lea edx, [ebp - 0x10]
push 0
jge 0xe9d7fb
push edx
call fcn.007f0870
add esp, 0xc
jb 0x7ee7b4
jae 0x7ee7b4
xor eax, 0xe74f685
test esi, esi
je 0x7ee7c6
jb 0x7ee7bd
jae 0x7ee7bd
cmp dword [esi - 0x18], edx
mov ebp, 0x8300009b
les eax, [ebx + ecx*4]
inc ebp
adc byte [ebx + 0x558b0c4d], cl
or byte [eax + 0x51], dl
push esi
call fcn.007f8380
add esp, 4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor al, 0xc7
add eax, 0x7e9988
add eax, dword [eax]
add byte [eax], al
ret
Function at 0x7eee50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xc
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.007f0870
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov al, 0x74
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 7], 0x73
mov byte [ebp - 2], al
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 6], 0x70
mov byte [ebp - 1], 0
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 5], 0x64
mov byte [ebp - 9], 0x75
mov byte [ebp - 4], 0x66
mov byte [ebp - 8], 0x51
mov byte [ebp - 3], al
cmp dword [esp + 4], 0x1770376
mov al, byte [ebp - 0xc]
mov dl, byte [ebp - 7]
mov cl, byte [ebp - 2]
dec al
dec dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0xb]
mov byte [ebp - 7], dl
mov dl, byte [ebp - 6]
dec cl
dec al
mov byte [ebp - 2], cl
mov cl, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
mov byte [ebp - 6], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 4]
dec dl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 3]
dec cl
dec al
dec dl
mov byte [ebp - 4], cl
mov byte [ebp - 8], al
mov byte [ebp - 3], dl
call fcn.007eb0e0
test eax, eax
jne 0x7eef0b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
push esi
push ecx
push eax
call fcn.007f0ad0
push 0xc
lea edx, [ebp - 0xc]
push 0
push edx
mov esi, eax
call fcn.007f0870
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7ef0b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x7e85a8
call dword [fcn.008ef004]
mov eax, dword [0x7e5cc0]
mov dword [0x7eabdc], eax
mov ecx, dword [0x7e5cc4]
mov dword [0x7eabe0], ecx
mov edx, dword [0x7e5cc8]
mov dword [0x7eabe4], edx
mov eax, dword [0x7e5ccc]
mov dword [0x7eabe8], eax
mov ecx, dword [0x7e5cd0]
mov dword [0x7eabec], ecx
mov edx, dword [0x7e5cd4]
mov dword [0x7eabf0], edx
mov eax, dword [0x7e5cd8]
mov dword [0x7eaa10], eax
mov ecx, dword [0x7e5ce0]
mov dword [0x7eaa08], ecx
mov edx, dword [0x7e5ce4]
mov dword [0x7eaa0c], edx
cmp dword [0x7e5cf8], 0
je 0x7ef150
mov eax, dword [0x7e5cf8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xcc
jne 0x7ef150
mov edx, dword [0x7e5ce8]
add edx, 1
mov dword [0x7e5ce8], edx
mov eax, dword [0x7eabdc]
add eax, dword [0x7e5ce8]
mov dword [0x7eabdc], eax
mov ecx, dword [0x7eabe0]
sub ecx, dword [0x7e5cec]
mov dword [0x7eabe0], ecx
mov edx, dword [0x7eabe4]
xor edx, dword [0x7e5cf0]
mov dword [0x7eabe4], edx
jmp 0x7ef187
mov dword [0x7eaa2c], 0x7ef257
mov dword [0x7eaa30], 0x7ef46f
jmp 0x7ef19e
mov dword [0x7eaa34], 0x7ef264
mov dword [0x7eaa38], 0x7ef2c1
mov dword [0x7eaa3c], 0
push 0x7ebda0
push dword fs:[0]
mov dword fs:[0], esp
cmp dword [0x7eaa10], 0
jle 0x7ef47c
mov dword [0x7eaa3c], 0
jmp 0x7ef1e9
mov dword [0x7e98e8], 0x7ef2d8
mov dword [0x7e98ec], 0x7ef2ec
jmp 0x7ef200
mov dword [0x7e98f0], 0x7ef300
mov dword [0x7e98f4], 0x7ef314
jmp 0x7ef217
mov dword [0x7e98f8], 0x155
mov dword [0x7e990c], 0x7ef328
mov eax, dword [0x7e98e8]
mov dword [0x7e98fc], eax
mov ecx, dword [0x7e98ec]
mov dword [0x7e9900], ecx
mov edx, dword [0x7e98f0]
mov dword [0x7e9904], edx
mov eax, dword [0x7e98f4]
mov dword [0x7e9908], eax
mov eax, eax
mov ebx, ebx
jmp 0x7ef25e
int3
pop dword fs:[0]
add esp, 4
mov dword [0x7eaa3c], 0
push 0x7e9920
call fcn.007f82f0
add esp, 4
mov ecx, dword [0x7e98e4]
push ecx
mov edx, dword [fcn.007eb000]
push edx
push 0x7e9920
call fcn.007f6e50
add esp, 0xc
push 0x7e9920
push 0x7e98d4
call fcn.007f6cf0
add esp, 8
mov dword [0x7e9784], 0
jmp 0x7ef4e3
mov eax, dword [0x7e9784]
add eax, 1
mov dword [0x7e9784], eax
cmp dword [0x7e9784], 0x10
jae 0x7ef508
mov ecx, dword [0x7e9784]
mov dl, byte [ecx + 0x7e98d4]
xor dl, 0x11
mov eax, dword [0x7e9784]
mov byte [eax + 0x7e98d4], dl
jmp 0x7ef4d6
mov ecx, dword [0x7e98d8]
xor ecx, dword [0x7e9978]
mov edx, dword [0x7eaa08]
add edx, ecx
mov dword [0x7eaa08], edx
mov eax, dword [0x7e98e0]
xor eax, dword [0x7e9780]
mov ecx, dword [0x7eaa0c]
sub ecx, eax
mov dword [0x7eaa0c], ecx
call fcn.007f3450
push 0x7e8598
call dword [fcn.008ef004]
call fcn.007eee20
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x7ef560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0xc
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.007f0870
mov al, 0x73
add esp, 0xc
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x45
mov byte [ebp - 7], 0x72
mov byte [ebp - 2], al
mov byte [ebp - 0xb], 0x78
mov byte [ebp - 6], 0x6f
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 5], 0x63
mov byte [ebp - 9], 0x74
mov byte [ebp - 4], 0x65
mov byte [ebp - 8], 0x50
mov byte [ebp - 3], al
call fcn.007eb0e0
test eax, eax
je 0x7ef5f4
cmp dword [esp + 4], 0x1730372
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.007f0ad0
mov esi, eax
cmp dword [esp + 8], 0x1740375
push 0xc
lea edx, [ebp - 0xc]
push 0
push edx
call fcn.007f0870
add esp, 0xc
test esi, esi
je 0x7ef5f4
jne 0x7ef5e5
je 0x7ef5e5
je 0x7ef63c
push esi
call fcn.007f8380
mov eax, dword [ebp + 8]
add esp, 4
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 4
or byte [edi + 0x33], bl
rcr byte [esi - 0x75], 0xe5

Function at 0x7ef6f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [0x7e8450]
cmp esi, 1
jne 0x7ef781
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007f0870
mov al, 0x74
add esp, 0xc
mov byte [ebp - 4], 0
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 6], 0x6e
Function at 0x7f0610
Capabilities:
Encrypt data using tea
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi]
cmp dword [esp + 8], 0x1740375
mov eax, dword [edi + 4]
jbe 0x7f062b
ja 0x7f062b
mov edi, 0x3310558b
mov edx, dword [ebp + 0x10]
xor esi, esi
test edx, edx
jle 0x7f06b1
test byte [ebp - 0x7e82812e], 0x7c
and al, 4
jb 0x7f063d
cmp dword [esp + 4], 0x1730372
jae 0x7f063d
imul edx, edx, 0x9e3779b9
test edx, edx
mov dword [ebp + 0x10], edx
je 0x7f0710
sar byte [ecx - 0x7a61c887], cl
ror byte [ecx - 0x7bf0efab], cl
ret
mov edx, dword [ebp + 8]
mov edi, eax
mov ebx, eax
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, esi
and ebx, 3
add edi, dword [edx + ebx*4]
mov ebx, esi
xor ebx, eax
add ebx, ecx
lea ecx, [ebx + edi]
jbe 0x7f0672
ja 0x7f0672
mov ecx, 0x8647ee81
enter 0x7261, 3
sub esi, 0x61c88647
jb 0x7f067d
jae 0x7f067d
and byte [ebx - 0x3e267407], cl
out dx, eax
add eax, 0x3304e3c1
sti
mov edi, ecx
mov ebx, ecx
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, esi
shr ebx, 0xb
and ebx, 3
add edi, dword [edx + ebx*4]
mov ebx, esi
xor ebx, ecx
add ebx, eax
lea eax, [ebx + edi]
mov edi, dword [ebp + 0x10]
cmp esi, edi
jne 0x7f0650
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebp
ret
imul edx, edx, 0x61c88647
test edx, edx
je 0x7f0710
mov esi, dword [ebp + 8]
mov edi, ecx
mov ebx, ecx
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, edx
shr ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, edx
xor ebx, ecx
add edx, 0x61c88647
add edi, ebx
sub eax, edi
mov edi, eax
mov ebx, eax
shr edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, edx
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, edx
xor ebx, eax
add edi, ebx
sub ecx, edi
test edx, edx
jne 0x7f06be
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebp
ret
mov dword [edi], ecx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x7f1f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [fcn.008ef004]
push 0x7e8684
call edi
push 0x19
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.007f0870
mov cl, 0x6e
mov dl, 0x74
add esp, 0xc
mov al, 0x6c
mov byte [ebp - 0x1b], cl
mov byte [ebp - 0xb], cl
mov byte [ebp - 0x18], cl
mov byte [ebp - 7], dl
mov byte [ebp - 0xe], dl
mov edx, dword [0x7e6e08]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 8], al
mov byte [ebp - 0x16], al
mov al, 0x65
push ecx
push edx
mov byte [ebp - 4], 0
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x12], 0x78
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x15], al
mov byte [ebp - 0x10], al
mov byte [ebp - 6], al
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x46
mov byte [ebp - 5], 0x72
mov byte [ebp - 0x13], 0x45
mov byte [ebp - 9], 0x69
call fcn.007f0ad0
mov esi, eax
push 0x19
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.007f0870
add esp, 0xc
test esi, esi
jne 0x7f201d
jne 0x7f2012
je 0x7f2012
jbe 0x7f2072
pop edi
mov eax, 6
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0xcc
jne 0x7f202d
pop edi
mov eax, 6
pop esi
mov esp, ebp
pop ebp
ret
push 0x7e8674
call edi
pop edi
mov eax, 7
pop esi
mov esp, ebp
pop ebp
ret
add byte [0xffff], ah
and ebx, 0xffff
sub eax, ebx
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
push 0x7e8694
sub esi, 0x1e
neg esi
sbb esi, esi
and esi, 2
add esi, 2
call edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7f2cf0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x7e86c4
call dword [fcn.008ef004]
mov eax, dword [0x7e5cc0]
mov dword [0x7eabdc], eax
mov ecx, dword [0x7e5cc4]
mov dword [0x7eabe0], ecx
mov edx, dword [0x7e5cc8]
mov dword [0x7eabe4], edx
mov eax, dword [0x7e5ccc]
mov dword [0x7eabe8], eax
mov ecx, dword [0x7e5cd0]
mov dword [0x7eabec], ecx
mov edx, dword [0x7e5cd4]
mov dword [0x7eabf0], edx
mov eax, dword [0x7e5cd8]
mov dword [0x7eaa10], eax
mov ecx, dword [0x7e5ce0]
mov dword [0x7eaa08], ecx
mov edx, dword [0x7e5ce4]
mov dword [0x7eaa0c], edx
cmp dword [0x7e5cf8], 0
je 0x7f2d90
mov eax, dword [0x7e5cf8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xcc
jne 0x7f2d90
mov edx, dword [0x7e5cf0]
add edx, 1
mov dword [0x7e5cf0], edx
mov eax, dword [0x7eabdc]
sub eax, dword [0x7e5ce8]
mov dword [0x7eabdc], eax
mov ecx, dword [0x7eabe0]
xor ecx, dword [0x7e5cec]
mov dword [0x7eabe0], ecx
mov edx, dword [0x7eabe4]
add edx, dword [0x7e5cf0]
mov dword [0x7eabe4], edx
jmp 0x7f2dc7
mov dword [0x7eaa2c], 0x7f2e97
mov dword [0x7eaa30], 0x7f30c9
jmp 0x7f2dde
mov dword [0x7eaa34], 0x7f2ea4
mov dword [0x7eaa38], 0x7f2f13
mov dword [0x7eaa3c], 0
push 0x7f2440
push dword fs:[0]
mov dword fs:[0], esp
cmp dword [0x7eaa10], 0
jle 0x7f30d6
mov dword [0x7eaa3c], 0
jmp 0x7f2e29
mov dword [0x7e98e8], 0x7f2f2e
mov dword [0x7e98ec], 0x7f2f42
jmp 0x7f2e40
mov dword [0x7e98f0], 0x7f2f56
mov dword [0x7e98f4], 0x7f2f6a
jmp 0x7f2e57
mov dword [0x7e98f8], 0x155
mov dword [0x7e990c], 0x7f2f7e
mov eax, dword [0x7e98e8]
mov dword [0x7e98fc], eax
mov ecx, dword [0x7e98ec]
mov dword [0x7e9900], ecx
mov edx, dword [0x7e98f0]
mov dword [0x7e9904], edx
mov eax, dword [0x7e98f4]
mov dword [0x7e9908], eax
mov eax, eax
mov ebx, ebx
jmp 0x7f2e9e
int3
pop dword fs:[0]
add esp, 4
mov dword [0x7eaa3c], 0
push 0x7e9920
call fcn.007f82f0
add esp, 4
mov ecx, dword [0x7e98e4]
push ecx
mov edx, dword [fcn.007eb000]
push edx
push 0x7e9920
call fcn.007f6e50
add esp, 0xc
push 0x7e9920
push 0x7e98d4
call fcn.007f6cf0
add esp, 8
mov dword [0x7e9784], 0
jmp 0x7f313d
mov eax, dword [0x7e9784]
add eax, 1
mov dword [0x7e9784], eax
cmp dword [0x7e9784], 0x10
jae 0x7f3162
mov ecx, dword [0x7e9784]
mov dl, byte [ecx + 0x7e98d4]
xor dl, 0x33
mov eax, dword [0x7e9784]
mov byte [eax + 0x7e98d4], dl
jmp 0x7f3130
mov ecx, dword [0x7e98d8]
xor ecx, dword [0x7e9978]
mov edx, dword [0x7eaa08]
add edx, ecx
mov dword [0x7eaa08], edx
mov eax, dword [0x7e98e0]
xor eax, dword [0x7e9780]
mov ecx, dword [0x7eaa0c]
sub ecx, eax
mov dword [0x7eaa0c], ecx
call fcn.007f3450
push 0x7e86b4
call dword [fcn.008ef004]
call fcn.007eee20
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x7f5ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007f0870
mov bl, 0x65
add esp, 0xc
mov byte [ebp - 4], 0
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xb], bl
mov byte [ebp - 6], bl
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 5], 0x41
mov byte [ebp - 0xe], bl
mov byte [ebp - 9], 0x76
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 8], 0x69
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x63
cmp dword [esp + 4], 0x1770376
call fcn.007f5360
mov esi, eax
test esi, esi
jne 0x7f5f38
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esp + 8], 0x1740375
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.007f0ad0
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov edi, eax
call fcn.007f0870
add esp, 0xc
test edi, edi
jne 0x7f5f6b
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
jb 0x7f5f70
jae 0x7f5f70
add al, 0x57
push edi
call fcn.007f8380
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007f0870
add esp, 0x10
mov byte [ebp - 4], 0
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xb], bl
mov byte [ebp - 6], bl
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 5], 0x57
mov byte [ebp - 0xe], bl
mov byte [ebp - 9], 0x76
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 8], 0x69
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 7], 0x63
cmp dword [esp + 4], 0x1770376
jb 0x7f5fc4
jae 0x7f5fc4
daa
lea ecx, [ebp - 0x10]
push ecx
push esi
call fcn.007f0ad0
mov esi, eax
jne 0x7f5fd5
je 0x7f5fd5
jne 0x7f6040
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
call fcn.007f0870
add esp, 0xc
jb 0x7f5fea
or eax, 0x6af0558d
add byte [edx - 0x18], dl
mov gs, word [eax - 0x3b7c0001]
or al, 0x72
add esi, dword [ebx + 1]
jae 0x7f5fea
test esi, esi
test esi, esi
je 0x7f5ffc
jb 0x7f5ff3
jae 0x7f5ff3
xor dl, byte [esi - 0x18]
xchg dword [ebx], esp
add byte [eax], al
push esi
call fcn.007f8380
add esp, 4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov al, 0x64
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 6], cl
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], al
mov byte [ebp - 5], 0x61
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x54
mov byte [ebp - 4], al
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 8], 0x68
mov byte [ebp - 0xc], cl
mov byte [ebp - 7], 0x72
call fcn.007eb0e0
test eax, eax
jne 0x7f608a
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.007f0ad0
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.007f0870
add esp, 0xc
test esi, esi
jne 0x7f60b4
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 4], 0x1730372
push esi
call fcn.007f8380
mov eax, dword [ebp + 8]
add esp, 4
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x7f7290
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x7e8754
call dword [fcn.008ef004]
mov eax, dword [0x7e5cc0]
mov dword [0x7eabdc], eax
mov ecx, dword [0x7e5cc4]
mov dword [0x7eabe0], ecx
mov edx, dword [0x7e5cc8]
mov dword [0x7eabe4], edx
mov eax, dword [0x7e5ccc]
mov dword [0x7eabe8], eax
mov ecx, dword [0x7e5cd0]
mov dword [0x7eabec], ecx
mov edx, dword [0x7e5cd4]
mov dword [0x7eabf0], edx
mov eax, dword [0x7e5cd8]
mov dword [0x7eaa10], eax
mov ecx, dword [0x7e5ce0]
mov dword [0x7eaa08], ecx
mov edx, dword [0x7e5ce4]
mov dword [0x7eaa0c], edx
cmp dword [0x7e5cf8], 0
je 0x7f7330
mov eax, dword [0x7e5cf8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xcc
jne 0x7f7330
mov edx, dword [0x7e5cec]
add edx, 1
mov dword [0x7e5cec], edx
mov eax, dword [0x7eabdc]
xor eax, dword [0x7e5ce8]
mov dword [0x7eabdc], eax
mov ecx, dword [0x7eabe0]
add ecx, dword [0x7e5cec]
mov dword [0x7eabe0], ecx
mov edx, dword [0x7eabe4]
sub edx, dword [0x7e5cf0]
mov dword [0x7eabe4], edx
jmp 0x7f7367
mov dword [0x7eaa2c], 0x7f7437
mov dword [0x7eaa30], 0x7f7658
jmp 0x7f737e
mov dword [0x7eaa34], 0x7f7444
mov dword [0x7eaa38], 0x7f74a6
mov dword [0x7eaa3c], 0
push 0x7f6490
push dword fs:[0]
mov dword fs:[0], esp
cmp dword [0x7eaa10], 0
jle 0x7f7665
mov dword [0x7eaa3c], 0
jmp 0x7f73c9
mov dword [0x7e98e8], 0x7f74bd
mov dword [0x7e98ec], 0x7f74d1
jmp 0x7f73e0
mov dword [0x7e98f0], 0x7f74e5
mov dword [0x7e98f4], 0x7f74f9
jmp 0x7f73f7
mov dword [0x7e98f8], 0x155
mov dword [0x7e990c], 0x7f750d
mov eax, dword [0x7e98e8]
mov dword [0x7e98fc], eax
mov ecx, dword [0x7e98ec]
mov dword [0x7e9900], ecx
mov edx, dword [0x7e98f0]
mov dword [0x7e9904], edx
mov eax, dword [0x7e98f4]
mov dword [0x7e9908], eax
mov eax, eax
mov ebx, ebx
jmp 0x7f743e
int3
pop dword fs:[0]
add esp, 4
mov dword [0x7eaa3c], 0
push 0x7e9920
call fcn.007f82f0
add esp, 4
mov ecx, dword [0x7e98e4]
push ecx
mov edx, dword [fcn.007eb000]
push edx
push 0x7e9920
call fcn.007f6e50
add esp, 0xc
push 0x7e9920
push 0x7e98d4
call fcn.007f6cf0
add esp, 8
mov dword [0x7e9784], 0
jmp 0x7f76cc
mov eax, dword [0x7e9784]
add eax, 1
mov dword [0x7e9784], eax
cmp dword [0x7e9784], 0x10
jae 0x7f76f1
mov ecx, dword [0x7e9784]
mov dl, byte [ecx + 0x7e98d4]
xor dl, 0x22
mov eax, dword [0x7e9784]
mov byte [eax + 0x7e98d4], dl
jmp 0x7f76bf
mov ecx, dword [0x7e98d8]
xor ecx, dword [0x7e9978]
mov edx, dword [0x7eaa08]
add edx, ecx
mov dword [0x7eaa08], edx
mov eax, dword [0x7e98e0]
xor eax, dword [0x7e9780]
mov ecx, dword [0x7eaa0c]
sub ecx, eax
mov dword [0x7eaa0c], ecx
call fcn.007f3450
push 0x7e8744
call dword [fcn.008ef004]
call fcn.007eee20
pop edi
pop esi
pop ebx
pop ebp
ret