joyce8/EMBER2024-capa huggingface dataset:
Function at 0x77b497
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007791b2
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0x18], 0x54
mov byte [ebp - 0x17], 0x76
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x71
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x55
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0
jb 0x77b4f5
jae 0x77b4f5
jmp 0x77b480
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
jmp 0x88799e96
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jle 0x77b56b
jg 0x77b56b
call 0xa3b557
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.0077e16f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x77b57e
or eax, 0xffffffff
jmp 0x77b5d3
jb 0x77b583
jae 0x77b583
jmp 0x77b511
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0077dffa
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.007791b2
add esp, 0xc
jl 0x77b5a8
jge 0x77b5a8
call 0x174332f
cmp dword [ebp - 4], 0
jne 0x77b5b3
or eax, 0xffffffff
jmp 0x77b5d3
cmp dword [esp + 4], 0x1730372
mov edx, dword [ebp - 4]
push edx
call fcn.0077cd15
add esp, 4
jb 0x77b5cc
jae 0x77b5cc
jmp 0x77b558
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x77d312
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007791b2
add esp, 0xc
jo 0x77d330
jno 0x77d330
call 0x456018fa
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
jne 0x77d381
je 0x77d381
call 0x8160210f
jmp 0xe8c55b8b
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
jb 0x77d422
jae 0x77d422
aaa
call fcn.0077ba78
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x77d434
xor eax, eax
jmp 0x77d480
jl 0x77d439
jge 0x77d439
call 0x526021ca
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0077dffa
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007791b2
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x77d463
xor eax, eax
jmp 0x77d480
jb 0x77d468
jae 0x77d468
call 0x525c21f7
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0077cd15
add esp, 4
jo 0x77d479
jno 0x77d479
call 0x52802a08
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x77ec2c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x77ec40
jmp 0x77ed6a
jne 0x77ec45
je 0x77ec45
call 0x898031d4
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [reloc.KERNEL32.dll_GetModuleHandleA], edx
jb 0x77ec5b
jae 0x77ec5b
adc cl, byte [ebx + 0x488bec45]
add al, 0x89
or eax, 0x766508
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x766508], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x766504], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x76604c], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x766050], ecx
jbe 0x77ec8f
ja 0x77ec8f
mov dl, 0xc6
inc ebp
invalid
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jne 0x77ecc8
je 0x77ecc8
call 0x81684256
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jl 0x77ed35
jge 0x77ed35
call 0x657c2abc
jbe 0x77ed3b
cmp dword [0x766504], 0
je 0x77ed52
add byte [esp + edx - 0x73], dh
push ebp
invalid
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x766504]
push eax
call fcn.0077dffa
mov dword [reloc.KERNEL32.dll_LoadLibraryA], eax
cmp dword [esp + 8], 0x1740375
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.007791b2
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x77eebd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.007791b2
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
Function at 0x77f677
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007791b2
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 9], 0x62
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x55
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0x14], 0x79
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x66
jl 0x77f6e5
jge 0x77f6e5
call 0x81604473
jmp 0xe8c57eef
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
in al, dx
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
jne 0x77f77e
je 0x77f77e
call 0x61e46a
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.0077e16f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x77f790
xor eax, eax
jmp 0x77f7e5
jns 0x77f795
js 0x77f795
call 0x51603d26
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0077dffa
mov dword [ebp - 0x1c], eax
jle 0x77f7aa
jg 0x77f7aa
jmp fcn.0077f815
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.007791b2
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x77f7c4
xor eax, eax
jmp 0x77f7e5
jb 0x77f7c9
jae 0x77f7c9
call 0x515c3d58
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0077cd15
add esp, 4
jb 0x77f7da
jae 0x77f7da
jmp 0x77f766
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x77f82b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.007791b2
add esp, 0xc
jl 0x77f849
jge 0x77f849
call 0x535c3e13
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
jne 0x77f89a
je 0x77f89a
call 0x815c4628
jmp 0xe4c580a4
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
push ebp
in al, dx
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
jns 0x77f93b
js 0x77f93b
call 0x393227
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 4], dh
call fcn.0077ba78
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x77f94d
xor eax, eax
jmp 0x77f9a2
jle 0x77f952
jg 0x77f952
call 0x525c46e3
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0077dffa
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.007791b2
add esp, 0xc
jbe 0x77f977
ja 0x77f977
mov eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x77f981
xor eax, eax
jmp 0x77f9a2
jne 0x77f986
je 0x77f986
jmp 0x77f912
mov ecx, dword [ebp - 4]
push ecx
call fcn.0077cd15
add esp, 4
jbe 0x77f997
ja 0x77f997
call 0x52844f26
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x781e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.007791b2
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jb 0x781ee6
jae 0x781ee6
and eax, 0x80ec4d8a
jmp 0xecc5a6f0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0077e16f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x781f58
xor eax, eax
jmp 0x781fa7
cmp dword [esp + 4], 0x1770376
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0077dffa
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.007791b2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x781f8a
xor eax, eax
jmp 0x781fa7
jb 0x781f8f
jae 0x781f8f
add al, 0x8b
inc ebp
cld
mov eax, dword [ebp - 4]
push eax
call fcn.0077cd15
add esp, 4
jne 0x781fa0
je 0x781fa0
jmp 0x781f2c
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x7824d6
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x765cc4
call fcn.0077964c
add esp, 0xc
mov byte [0x765cc4], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x784780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
push ebx
push ebp
mov ebp, dword [fcn.008c9260]
push esi
mov esi, dword [esp + 0x70]
push edi
xor ebx, ebx
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
rep stosd dword es:[edi], eax
mov edi, dword [fcn.008c925c]
mov dword [esp + 0x44], 7
mov dword [esp + 0x3c], 6
mov dword [esp + 0x40], ebx
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x74]
push eax
call edi
lea ecx, [esp + 0x78]
push ecx
call ebp
add esp, 8
cmp eax, ebx
je 0x784855
mov dl, byte [eax + 0x14]
sub dl, 0x64
mov byte [esp + 0x68], dl
mov cl, byte [eax + 0x10]
mov byte [esp + 0x69], cl
mov dl, byte [eax + 0xc]
dec dl
mov byte [esp + 0x6a], dl
mov cl, byte [eax + 8]
mov byte [esp + 0x6b], cl
mov dl, byte [eax + 4]
mov byte [esp + 0x6c], dl
mov al, byte [eax]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
mov byte [esp + 0x71], al
push 0x20
push edx
lea eax, [esp + 0x48]
push 0x34
push eax
push 0x220008
push esi
call fcn.00787b60
cmp eax, ebx
jne 0x78485a
mov ecx, dword [esp + 0x36]
push ecx
call fcn.00784540
cmp eax, ebx
je 0x78485a
mov ecx, dword [esp + 0x10]
inc ecx
cmp ecx, 0x64
mov dword [esp + 0x10], ecx
jb 0x7847c6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 4
mov eax, 0x26
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 4

Function at 0x786830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc0
mov eax, dword [esp + 0xc4]
push ebx
push ebp
push esi
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00788aa0
mov esi, dword [esp + 0xdc]
lea ebx, [esi + 0x20]
mov edx, ebx
mov eax, dword [edx]
mov dword [esp + 0x14], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x18], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x28], ecx
call fcn.00788b80
add esp, 0x10
xor eax, eax
lea ebp, [esi + 0x10]
mov cl, byte [eax + ebp]
mov dl, byte [esp + eax + 0xc]
xor dl, cl
mov byte [esp + eax + 0xc], dl
inc eax
cmp eax, 0x10
jl 0x786889
lea edx, [esp + 0xc]
push edi
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00788b80
mov edi, esi
lea edx, [esp + 0x18]
add esp, 8
xor ecx, ecx
sub edi, edx
lea eax, [esp + ecx + 0x10]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, 0x10
jl 0x7868b9
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00788b80
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push esi
mov dword [esi + 0x30], edx
push ecx
mov dword [esi + 0x34], eax
call fcn.00788b80
add esp, 0x10
mov ecx, 0xfffffff0
mov eax, ebp
sub ecx, esi
pop edi
mov dl, byte [eax - 0x10]
xor byte [eax], dl
inc eax
lea edx, [ecx + eax]
cmp edx, 0x10
jl 0x7868fd
lea eax, [esp + 0x1c]
push ebp
push eax
call fcn.00788b80
mov ecx, 0xffffffe0
add esp, 8
mov eax, ebx
sub ecx, esi
mov dl, byte [eax - 0x10]
xor byte [eax], dl
inc eax
lea edx, [ecx + eax]
cmp edx, 0x10
jl 0x786922
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.00788b80
add esp, 8
pop esi
pop ebp
pop ebx
add esp, 0xc0
ret
Function at 0x787270
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
xor eax, eax
push ebx
mov dword [esp + 9], eax
push ebp
mov dword [esp + 0x11], eax
push esi
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x1d], eax
mov dword [esp + 0x10], 0
mov word [esp + 0x21], ax
mov byte [esp + 0x14], 0
test edi, edi
mov byte [esp + 0x23], al
jne 0x7872b2
pop edi
pop esi
pop ebp
mov eax, 0xc
pop ebx
add esp, 0x14
ret 8
mov eax, dword [edi + 4]
test eax, eax
je 0x7872d9
mov edx, dword [edi + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
mov eax, dword [edi]
push eax
call fcn.007863f0
test eax, eax
je 0x787300
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
mov eax, dword [edi + 8]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x787304
mov ecx, dword [esp + 0x2c]
mov edx, dword [edi]
push ecx
push edx
call fcn.00786830
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
push 0x10
lea ecx, [esi + 0x20]
push ecx
push eax
mov eax, dword [edi]
push 0
push eax
mov dword [esp + 0x44], ecx
call fcn.00785c50
test eax, eax
jne 0x787424
lea ebx, [esi + 0x10]
mov cl, byte [ebx + eax]
mov dl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x10
jb 0x78732d
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
mov edx, dword [edi]
lea eax, [esp + 0x18]
push 0x10
push eax
push ecx
push 0
push edx
call fcn.00785c50
test eax, eax
jne 0x787424
mov ebp, esi
lea eax, [esp + 0x14]
xor ecx, ecx
sub ebp, eax
lea eax, [esp + ecx + 0x14]
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc ecx
cmp ecx, 0x10
jb 0x78736d
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi]
lea ecx, [esp + 0x18]
push 0x10
push ecx
push edx
push 0
push eax
call fcn.00785c50
test eax, eax
jne 0x787424
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push esi
mov dword [esi + 0x30], ecx
push 0x10
mov dword [esi + 0x34], edx
mov ecx, dword [edi]
push esi
push eax
push 0
push ecx
call fcn.00785c50
test eax, eax
jne 0x787424
mov ecx, 0xfffffff0
mov eax, ebx
sub ecx, esi
mov dl, byte [eax - 0x10]
xor byte [eax], dl
inc eax
lea edx, [ecx + eax]
cmp edx, 0x10
jb 0x7873cd
mov eax, dword [esp + 0x10]
mov ecx, dword [edi]
push ebx
push 0x10
push ebx
push eax
push 0
push ecx
call fcn.00785c50
test eax, eax
jne 0x787424
mov ebp, dword [esp + 0x2c]
mov ecx, 0xffffffe0
mov eax, ebp
sub ecx, esi
mov dl, byte [eax - 0x10]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
lea edx, [ecx + eax]
cmp edx, 0x10
jb 0x7873ff
mov eax, dword [esp + 0x10]
mov ecx, dword [edi]
push ebp
push 0x10
push ebp
push eax
push 0
push ecx
call fcn.00785c50
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8