joyce8/EMBER2024-capa huggingface dataset:
Function at 0x206e159c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.206da33c
add esp, 0xc
jl 0x206e15ba
jge 0x206e15ba
call 0x73525b84
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
jne 0x206e160b
je 0x206e160b
call 0xa1526399
jmp 0x4bb9e15
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
push ebp
in al, dx
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
jns 0x206e16ac
js 0x206e16ac
call 0x2041ff98
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 4], dh
call fcn.206dea99
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x206e16be
xor eax, eax
jmp 0x206e1713
jle 0x206e16c3
jg 0x206e16c3
call 0x72526454
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.206ddb65
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.206da33c
add esp, 0xc
jbe 0x206e16e8
ja 0x206e16e8
mov eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x206e16f2
xor eax, eax
jmp 0x206e1713
jne 0x206e16f7
je 0x206e16f7
jmp 0x206e1683
mov ecx, dword [ebp - 4]
push ecx
call fcn.206e1d86
add esp, 4
jbe 0x206e1708
ja 0x206e1708
call 0x727a6c97
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x206e30d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x2c]
sub eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jl 0x206e30d0
jns 0x206e3081
js 0x206e3081
call 0x5c427e10
dec ebp
les esi, [esi + 0x76]
add esi, dword [edi + 1]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x3c]
je 0x206e30af
jbe 0x206e308e
ja 0x206e308e
call 0x20ee30fa
add byte [edx], ch
push 0x8000
push 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp + edx*4 - 0x2c]
push eax
call fcn.206dda38
test eax, eax
jne 0x206e30ad
mov eax, 1
jmp 0x206e30d2
jmp 0x206e30ce
jp 0x206e30b4
jnp 0x206e30b4
call 0xac427e43
push esp
invalid
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp + ecx*4 - 0x2c]
mov dword [0x206c9fe0], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x68]
mov dword [0x206c9fe4], ecx
jmp 0x206e306d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.206da33c
add esp, 0xc
jl 0x206e30f7
jge 0x206e30f7
call 0x785a76c1
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 9], 0x64
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 8], 0
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xb], 0x6d
jne 0x206e3130
je 0x206e3130
jl 0x206e30bb
mov cl, byte [ebp - 0x14]
dec ebp
in al, dx
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.206e14ea
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x206e31aa
xor eax, eax
jmp 0x206e3205
cmp dword [esp + 4], 0x1770376
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.206ddb65
mov dword [ebp - 0x18], eax
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.206da33c
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x206e31dc
xor eax, eax
jmp 0x206e3205
jl 0x206e31e1
jge 0x206e31e1
call 0x72567f70
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.206e1d86
add esp, 4
jne 0x206e31f2
je 0x206e31f2
call 0x72828781
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x206e3877
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov byte [ebp - 8], 0
jbe 0x206e3889
ja 0x206e3889
call 0x20d851f7
push 0x19
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.206da33c
add esp, 0xc
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x21], 0x62
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x6d
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x46
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x6a
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
jns 0x206e3902
js 0x206e3902
call 0xa14a8690
jmp 0xfcbbc10c
mov cl, byte [ebp - 0x24]
sub cl, 1
mov byte [ebp - 0x24], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x23]
sub al, 1
mov byte [ebp - 0x23], al
mov cl, byte [ebp - 0x1e]
sub cl, 1
mov byte [ebp - 0x1e], cl
mov dl, byte [ebp - 0x19]
sub dl, 1
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x22]
sub dl, 1
mov byte [ebp - 0x22], dl
mov al, byte [ebp - 0x1d]
sub al, 1
mov byte [ebp - 0x1d], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x21]
sub cl, 1
mov byte [ebp - 0x21], cl
mov dl, byte [ebp - 0x1c]
sub dl, 1
mov byte [ebp - 0x1c], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x20]
sub al, 1
mov byte [ebp - 0x20], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
jns 0x206e39d7
js 0x206e39d7
call 0x724a8768
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [0x206cce90]
push edx
call fcn.206ddb65
mov dword [ebp - 4], eax
jp 0x206e39ef
jnp 0x206e39ef
call 0x20d8535d
push 0x19
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.206da33c
add esp, 0xc
jle 0x206e3a04
jg 0x206e3a04
cmp dword [ebp - 4], 0

Function at 0x206e3a90
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x20738a08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2074778b
add esp, 0xc
jb 0x20738a26
jae 0x20738a26
shufps xmm0, xmmword [ebp - 0x10], 0x57
mov byte [ebp - 0x10], 0x57
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x47
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x73
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], 0x66
jo 0x20738a5b
jno 0x20738a5b
jmp 0x207389e6
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.207477ba
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20738acd
xor eax, eax
jmp 0x20738b2c
jbe 0x20738ad2
ja 0x20738ad2
call 0x7163d063
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2074f3b3
mov dword [ebp - 0x14], eax
cmp dword [esp + 4], 0x1730372
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x20738b04
xor eax, eax
jmp 0x20738b2c
jo 0x20738b09
jno 0x20738b09
call 0x715fd098
mov eax, dword [ebp - 0x14]
push eax
call fcn.2073b5c3
add esp, 4
cmp dword [esp + 8], 0x1740375
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x20738b69
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
jbe 0x20738bcf
ja 0x20738bcf
call 0xa15fd95d
jmp 0xcc113d9
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
cli
Function at 0x2073ab59
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
jbe 0x2073abaf
ja 0x2073abaf
call 0xa15ff93d
jmp 0xcc133b9
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.207477ba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2073ac21
xor eax, eax
jmp 0x2073ac70
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.2074f3b3
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x2073ac6e
jne 0x2073ac4c
je 0x2073ac4c
jl 0x2073abd8
mov eax, dword [ebp - 4]
inc ebp
cld
push eax
call fcn.2073b5c3
add esp, 4
jp 0x2073ac5d
jnp 0x2073ac5d
call 0x7183f9ec
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x2073ac70
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x2073afb7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
jbe 0x2073b005
ja 0x2073b005
call 0xa163fd93
jmp 0x10c1380f
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.2074c92c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2073b065
xor eax, eax
jmp 0x2073b0b0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.2074f3b3
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x2073b0ae
jne 0x2073b090
je 0x2073b090
jle 0x2073b01c
mov ecx, dword [ebp - 0x14]
dec ebp
in al, dx
push ecx
call fcn.2073b5c3
add esp, 4
jp 0x2073b0a1
jnp 0x2073b0a1
call 0x72800630
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x2073b0b0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2073df67
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
jbe 0x2073dfc9
ja 0x2073dfc9
call 0xa1602d57
jmp 0xcc167d3
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.207477ba
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2073e053
ljmp 0x458a:0xed558801
jmp fcn.2073e0a2
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2074f3b3
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 0x18], 0
je fcn.2073e0a2
jne 0x2073e07e
je 0x2073e07e
js 0x2073e00a
mov eax, dword [ebp - 0x18]
push eax
call fcn.2073b5c3
add esp, 4
jp 0x2073e08f
inc ebp
call 0xf5b0c8d5
invalid
jnp 0x2073e08f
call 0x71882e1e
mov ecx, dword [ebp + 0x14]
push ecx
Function at 0x2073ea43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
jbe 0x2073eaa1
ja 0x2073eaa1
call 0xa15c382f
jmp 0x8c172ab
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.2074c92c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2073eb24
xor eax, eax
jmp 0x2073eb77
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.2074f3b3
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x2073eb75
jne 0x2073eb4f
je 0x2073eb4f
jbe 0x2073eadb
mov edx, dword [ebp - 4]
push ebp
cld
push edx
call fcn.2073b5c3
add esp, 4
jp 0x2073eb60
jnp 0x2073eb60
call 0x708830ef
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x2073eb77
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2073f03b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jb 0x2073f091
jae 0x2073f091
and eax, 0x80ec4d8a
jmp 0xcc1789b
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.207477ba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2073f103
xor eax, eax
jmp 0x2073f152
cmp dword [esp + 4], 0x1770376
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.2074f3b3
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x2073f135
xor eax, eax
jmp 0x2073f152
jb 0x2073f13a
jae 0x2073f13a
add al, 0x8b
inc ebp
cld
mov eax, dword [ebp - 4]
push eax
call fcn.2073b5c3
add esp, 4
jne 0x2073f14b
je 0x2073f14b
jmp 0x2073f0d7
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20741bd1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2074778b
add esp, 0xc
jo 0x20741bef
jno 0x20741bef
call 0x676461b9
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
jl 0x20741c24
jge 0x20741c24
call 0xa16469b2
jmp 0x10c1a42e
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
add dword [eax + 0x558af74d], ecx
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.207477ba
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20741c94
add dword [eax + 0x4d8af845], ecx
hlt
jmp 0x20741ce9
cmp dword [esp + 4], 0x1730372
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2074f3b3
mov dword [ebp - 0x14], eax
cmp dword [esp + 8], 0x1740375
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x20741ccc
jmp 0x20741ce9
jne 0x20741cd1
je 0x20741cd1
je 0x20741c5d
mov eax, dword [ebp - 0x14]
inc ebp
in al, dx
push eax
call fcn.2073b5c3
add esp, 4
jle 0x20741ce2
jg 0x20741ce2
jmp 0x20741c6e
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4