joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2060d0f2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.20603ead
add esp, 0xc
cmp ebx, edi
test ecx, eax
xchg esi, esi
xchg esp, esp
je 0x2060d11c
jg 0x2060d117
jne 0x2060d11c
mov edi, 0x45c6847e
in al, dx
dec edx
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
jp 0x2060d15e
dec edx
inc edx
je 0x2060d16f
jp 0x2060d164
jb 0x2060d166
mov esp, esp
jle 0x2060d16a
jne 0x2060d16f
xor eax, 0x4d8a7a0f
in al, dx
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.20607308
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2060d203
xor eax, eax
jmp 0x2060d261
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.205f03e1
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.20603ead
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x2060d25f
test dword [esp], edx
jl 0x2060d235
xchg ecx, eax
xchg ecx, eax
jge 0x2060d235
mov edi, 0x4d8b9385
call 0xa0cba8d
std
inc dword [ebx - 0x1f3efb3c]
add byte [ebp], bh
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.205ebbe9
add esp, 4
shl eax, 0
jge 0x2060d246
je 0x2060d256
lea esp, [esp]
jne 0x2060d24d
jbe 0x2060d24f
xchg ecx, edi
xchg ecx, edi
jne 0x2060d256
mov edi, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x2060d261
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20610640
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x206cdd81
Capabilities:
Encode data using xor

Disassembly:
push ecx
pop edi
xor dl, cl
rcr byte [ebx - 0x433e702b], 0xf2
xor eax, 0x78344111
jnp 0x206cddb9
pushal
pushfd
sub ah, byte [eax - 0x5d]
call 0x8c88bd96
arpl word [edi], bx
ret 0x12b4
scasw ax, word es:[edi]
adc eax, 0xe0cad181
xchg ebp, eax
and ebp, dword [ebx - 0x1f]
xchg edx, eax
xor esp, dword ds:[edx + 0xb]
and al, 0x3b
or esp, dword [ebx + edi]
and bh, byte [ecx - 0x5df11142]
mov dl, 0x85
cdq
or eax, 0xc8ce6ba
jb 0x206cddaa
sub bh, dh
mov byte [0x1278452d], al
sar ch, 1
xchg esp, eax
mov bh, 0x95
bound ecx, qword [eax]
jge 0x206cde40
invalid
mov byte [edi], ch
adc edi, dword [ebx + 0x515bad24]
mov edi, 0xeb7b9479
salc
cmp esi, dword [esi - 0x4d]
cmp dword cs:[edi], esi
jns 0x206cdeaf
adc esp, ecx
xchg edi, eax
loop 0x206cde81
sub byte [0xa7f42e31], 0xad
inc edx
push 0xc66a2b3b
int3
adc byte [ebx + 0x1a], ch
cli
in eax, dx
retf 0xd811
in al, dx
or al, 0xd9
sub ch, dl
stosd dword es:[edi], eax
aad 0x4e
scasd eax, dword es:[di]
pop edi
test al, 0x86
fimul dword [eax - 0x1414017]
ret
push edi
cmp byte [ebp + ebx*4 - 0xf083f7a], 0xf8
jnp 0x206cdf33
pushal
dec ebp
pushal
add esp, dword [eax + 0x46]
cmp ebp, 0xffffffd1
mov al, 0x1f
cmp dh, dh
add al, 0xae
inc ebp
ja 0x206cde99
cld
xlatb
xor ebp, dword [ebx + 0x42]
xor dword [ecx - 0x55], 0x1e
lock xchg dword [ecx - 0x80], eax
mov al, 0x5f
pop esi
add byte [esi + edi*4], bh
push edi
mov al, byte [0xe8ae2477]
mov ebp, 0x55464299
popal
pop eax
mov edi, 0x4e58f48f
mov byte [0x38f2ddfd], al
out dx, eax
invalid
cmp bh, ch
je 0x206cdef0
ret 0x89bd
mov ecx, 0xbb8205d0
dec eax
bound ebp, qword [eax + 0x74a99e11]
jne 0x206cdef7
sbb dword [edi - 0x49], edi
or esp, ebx
test eax, 0x2d09a1e0
xor ax, word [esi + 0x32]
les eax, [edx]
pop ds
pop edx
call 0x2a5d9de4
and eax, 0x104a99a0
invalid
Function at 0x206d0000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.206da33c
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cmp dword [esp + 4], 0x1770376
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
jbe 0x206d00be
ja 0x206d00be
ljmp 0x8900:0x11427e8
call fcn.206e14ea
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x206d00d0
xor eax, eax
jmp 0x206d00f8
jns 0x206d00d5
js 0x206d00d5
or dword [ebp - 0x74af0fbb], 0xe851fc4d
sbb edx, 0
add byte [ecx + 0xc6aec45], cl
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.206ddb65
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.206da33c
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x206d392e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0x40
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.206d4ca0
add esp, 0xc
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x5a4d
je 0x206d395c
mov eax, 1
jmp 0x206d39dc
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x3c], 0
jne 0x206d396c
mov eax, 1
jmp 0x206d39dc
push 0xf8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.206d4ca0
add esp, 0xc
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0x4550
je 0x206d3999
mov eax, 1
jmp 0x206d39dc
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x14c
je 0x206d39b1
mov eax, 1
jmp 0x206d39dc
mov edx, dword [ebp + 0x10]
xor eax, eax
mov ax, word [edx + 0x16]
and eax, 0x1000
test eax, eax
je 0x206d39ca
mov eax, 1
jmp 0x206d39dc
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x74], 0x10
jbe 0x206d39da
mov eax, 1
jmp 0x206d39dc
xor eax, eax
pop ebp
ret
Function at 0x206d45ff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.206da33c
add esp, 0xc
jo 0x206d461d
jno 0x206d461d
call 0x65558be7
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
jne 0x206d466e
je 0x206d466e
call 0xa15593fc
jmp 0x8bace78
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
jb 0x206d470f
jae 0x206d470f
aaa
call fcn.206dea99
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x206d4721
xor eax, eax
jmp 0x206d476d
jl 0x206d4726
jge 0x206d4726
call 0x725594b7
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.206ddb65
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.206da33c
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x206d4750
xor eax, eax
jmp 0x206d476d
jb 0x206d4755
jae 0x206d4755
call 0x725194e4
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.206e1d86
add esp, 4
jo 0x206d4766
jno 0x206d4766
call 0x72759cf5
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x206d8824
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x206d8838
jmp 0x206d8962
jne 0x206d883d
je 0x206d883d
call 0xa975cdcc
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x206ccea4], edx
jb 0x206d8853
jae 0x206d8853
adc cl, byte [ebx + 0x488bec45]
add al, 0x89
or eax, 0x206ccfcc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x206ccfcc], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x206ccfc8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x206ccfb4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x206ccfb8], ecx
jbe 0x206d8887
ja 0x206d8887
mov dl, 0xc6
inc ebp
invalid
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jne 0x206d88c0
je 0x206d88c0
call 0xa15dde4e
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jl 0x206d892d
jge 0x206d892d
call 0xf035c6b4
insb byte es:[edi], dx
and byte [eax], al
cmp dword [0x206ccfc8], 0
je 0x206d894a
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x206ccfc8]
push eax
call fcn.206ddb65
mov dword [0x206ccea0], eax
cmp dword [esp + 8], 0x1740375
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.206da33c
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x206d8ecb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor byte [ebp + 7], 0xb8
add dword [eax], eax
add byte [eax], al
jmp 0x206d8ec9
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x206cd378], 1
jne 0x206d8fce
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.206da33c
add esp, 0xc
jne 0x206d8ef6
je 0x206d8ef6
jp 0x206d8ebd
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
inc ebp
call 0xdb35545
insd dword es:[edi], dx
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
jb 0x206d8f27
jae 0x206d8f27
sub byte [edx - 0x167f17b3], cl
add dword [eax + 0x558ae84d], ecx
in eax, dx
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.206e14ea
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x206d8f91
mov eax, dword [ebp + 8]
jmp 0x206d8ffe
jns 0x206d8f96
js 0x206d8f96
call 0x7355e527
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.206ddb65
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.206da33c
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x206d8fc7
mov edx, dword [ebp - 8]
mov dword [0x206cd378], edx
jmp 0x206d8fcc
mov eax, dword [ebp + 8]
jmp 0x206d8ffe
jmp 0x206d8fd6
mov eax, dword [0x206cd378]
mov dword [ebp - 8], eax
jns 0x206d8fdb
js 0x206d8fdb
call 0xaa65dd6a
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jle 0x206d8fe6
jg 0x206d8fe6
call 0x7369e575
mov edx, dword [ebp - 4]
push edx
call fcn.206e1d86
add esp, 4
jbe 0x206d8ff7
ja 0x206d8ff7
mov cl, 0x8b
inc ebp
or byte [eax - 1], dl
push ebp
cld
mov eax, dword [ebp + 8]
push eax
Function at 0x206d9bfe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x206ccea0], 1
je 0x206d9c1f
jb 0x206d9c24
jae 0x206d9c24
adc esi, dword [ebx]
shr cl, 0x2a
add dword [eax], eax
add byte [edx + 3], dh
xor eax, eax
jmp 0x206d9d55

Function at 0x206db01f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.206da33c
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jb 0x206db075
jae 0x206db075
and eax, 0x80ec4d8a
jmp 0xcbb387f
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.206e14ea
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x206db0e7
xor eax, eax
jmp 0x206db136
cmp dword [esp + 4], 0x1770376
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.206ddb65
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.206da33c
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x206db119
xor eax, eax
jmp 0x206db136
jb 0x206db11e
jae 0x206db11e
add al, 0x8b
inc ebp
cld
mov eax, dword [ebp - 4]
push eax
call fcn.206e1d86
add esp, 4
jne 0x206db12f
je 0x206db12f
jmp 0x206db0bb
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x206dc067
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.206da33c
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
jne 0x206dc0c4
je 0x206dc0c4
jne 0x206dc04f
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jp 0x206dc129
dec ebp
invalid
jnp 0x206dc129
xor eax, 0x55eee8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.206e171c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x206dc13b
xor eax, eax
jmp 0x206dc163
jo 0x206dc140
jno 0x206dc140
call 0x715e06d1
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.206ddb65
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.206da33c
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x206dda38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.206da33c
add esp, 0xc
jb 0x206dda56
jae 0x206dda56
shufps xmm0, xmmword [ebp - 0x10], 0x57
mov byte [ebp - 0x10], 0x57
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x47
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x73
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 7], 0x66
jo 0x206dda8b
jno 0x206dda8b
jmp 0x206dda16
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.206e14ea
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x206ddafd
xor eax, eax
jmp 0x206ddb5c
jbe 0x206ddb02
ja 0x206ddb02
call 0x715e2093
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.206ddb65
mov dword [ebp - 0x14], eax
cmp dword [esp + 4], 0x1730372
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.206da33c
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x206ddb34
xor eax, eax
jmp 0x206ddb5c
jo 0x206ddb39
jno 0x206ddb39
mov eax, dword [ebp - 0x14]
push eax
Function at 0x206ddd15
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call 0x2c6a5a7d
jge 0x206ddcf5
or esi, dword [ebp + 0xf]
jne 0x206ddd0b
jns 0x206ddd01
js 0x206ddd01
call 0xf0b1e2cc
insb byte es:[edi], dx
and byte [eax], al
add byte [eax], al
add byte [ebx + 0x5e5ffc45], cl
mov dword [0x206cd044], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.206da33c
add esp, 0xc
jne 0x206ddd33
je 0x206ddd33
jbe 0x206ddcfa
mov byte [ebp - 0x14], 0x53
inc ebp
in al, dx
push ebx
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x62
mov byte [ebp - 0xd], 0x4e
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 9], 0x79
mov byte [ebp - 8], 0
jne 0x206ddd6c
je 0x206ddd6c
jmp 0x206ddcf7
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
jp 0x206dddd9
inc ebp
invalid
jnp 0x206dddd9
call fcn.20a4eac5
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.206e14ea
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x206dddeb
xor eax, eax
jmp 0x206dde41
jbe 0x206dddf0
ja 0x206dddf0
call 0x725a2b81
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.206ddb65
mov dword [ebp - 0x18], eax
jo 0x206dde05
jno 0x206dde05
call 0x20d7eb73
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.206da33c
add esp, 0xc
jne 0x206dde1a
je 0x206dde1a
jnp 0x206ddd9e
cmp dword [ebp - 0x18], 0
jne 0x206dde24
jge 0x206dde05
add byte [ebp + 4], dh
xor eax, eax
jmp 0x206dde41
jne 0x206dde29
je 0x206dde29
call 0x72562bb8
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.206e1d86
add esp, 4
jle 0x206dde3a
jg 0x206dde3a
call 0x727633c9
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4