joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2074559a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cmp dword [esp + 4], 0x1770376
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
jbe 0x20745658
ja 0x20745658
ljmp 0x8900:0x215de8
call fcn.207477ba
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2074566a
xor eax, eax
jmp 0x20745692
jns 0x2074566f
js 0x2074566f
or dword [ebp - 0x74af0fbb], 0xe851fc4d
aaa
popfd
add byte [eax], al
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2074f3b3
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2074778b
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x20745db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
js 0x20745d9b
call 0x7258ab2c
lea ecx, [ebp - 0x1c]
push ecx
call fcn.2073dd3f
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
jne 0x20745e0d
je 0x20745e0d
jne 0x20745d98
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jp 0x20745e72
dec ebp
invalid
jnp 0x20745e72
xor eax, 0x6ab5e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.2074c92c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20745e84
xor eax, eax
jmp 0x20745eac
jo 0x20745e89
jno 0x20745e89
call 0x7164a41a
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2074f3b3
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2074778b
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
Function at 0x20746efb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jo 0x20746f58
and al, ch
ret
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0x18], 0x54
mov byte [ebp - 0x17], 0x76
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x71
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x55
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0
jb 0x20746f59
jae 0x20746f59
jmp 0x20746ee4
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
jmp 0xa87658fa
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jle 0x20746fcf
jg 0x20746fcf
call fcn.207c56bb
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.207477ba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20746fe2
or eax, 0xffffffff
jmp 0x20747037
jb 0x20746fe7
jae 0x20746fe7
jmp 0x20746f75
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.2074f3b3
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2074778b
add esp, 0xc
jl 0x2074700c
jge 0x2074700c
call 0x2170ed93
cmp dword [ebp - 4], 0
jne 0x20747017
or eax, 0xffffffff
jmp 0x20747037
cmp dword [esp + 4], 0x1730372
mov edx, dword [ebp - 4]
push edx
call fcn.2073b5c3
add esp, 4
jb 0x20747030
jae 0x20747030
jmp 0x20746fbc
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x2074921e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2074778b
add esp, 0xc
jb 0x2074923c
jae 0x2074923c
call 0x765cd806
mov byte [ebp - 0x18], 0x55
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x15], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x34
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x4f
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0xc], 0
jb 0x20749275
jae 0x20749275
jmp 0x20749200
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x13]
inc ebp
in eax, dx
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
push ebp
out dx, eax
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
dec ebp
int1
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
jo 0x207492e2
jno 0x207492e2
jmp 0x207492cb
call fcn.207477ba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x207492f4
xor eax, eax
jmp 0x20749349
jb 0x207492f9
jae 0x207492f9
call 0x725ce08a
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.2074f3b3
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2074778b
add esp, 0xc
jo 0x2074931e
jno 0x2074931e
jmp 0x207492a2
cmp dword [ebp - 4], 0
jne 0x20749328
xor eax, eax
jmp 0x20749349
jne 0x2074932d
je 0x2074932d
jmp 0x207492b9
mov ecx, dword [ebp - 4]
push ecx
call fcn.2073b5c3
add esp, 4
jo 0x2074933e
jno 0x2074933e
jmp 0x207492ca
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x207493d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jb 0x207493ce
jae 0x207493ce
and esi, dword [ebx]
rcr byte [edi + 0x5e], 0x5b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x20714e2c], 1
jne 0x207494da
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2074778b
add esp, 0xc
jne 0x20749402
je 0x20749402
jp 0x207493c9
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
inc ebp
call 0xdba5a51
insd dword es:[edi], dx
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
jb 0x20749433
jae 0x20749433
sub byte [edx - 0x167f17b3], cl
add dword [eax + 0x558ae84d], ecx
in eax, dx
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.207477ba
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x2074949d
mov eax, dword [ebp + 8]
jmp 0x2074950a
jns 0x207494a2
js 0x207494a2
call 0x735cea33
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.2074f3b3
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x207494d3
mov edx, dword [ebp - 8]
mov dword [0x20714e2c], edx
jmp 0x207494d8
mov eax, dword [ebp + 8]
jmp 0x2074950a
jmp 0x207494e2
mov eax, dword [0x20714e2c]
mov dword [ebp - 8], eax
jns 0x207494e7
js 0x207494e7
call 0xaa6ce276
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jle 0x207494f2
jg 0x207494f2
call 0x7370ea81
mov edx, dword [ebp - 4]
push edx
call fcn.2073b5c3
add esp, 4
jbe 0x20749503
ja 0x20749503
mov cl, 0x8b
inc ebp
or byte [eax - 1], dl
push ebp
cld
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x2074bc33
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ecx - 0x4613580e], al
std
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2074778b
add esp, 0xc
jl 0x2074bc51
jge 0x2074bc51
call 0x7861021b
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 9], 0x64
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 8], 0
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xb], 0x6d
jne 0x2074bc8a
je 0x2074bc8a
jl 0x2074bc15
mov cl, byte [ebp - 0x14]
dec ebp
in al, dx
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.207477ba
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2074bd04
xor eax, eax
jmp 0x2074bd5f
cmp dword [esp + 4], 0x1770376
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.2074f3b3
mov dword [ebp - 0x18], eax
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x2074bd36
xor eax, eax
jmp 0x2074bd5f
jl 0x2074bd3b
jge 0x2074bd3b
call 0x725d0aca
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.2073b5c3
add esp, 4
jne 0x2074bd4c
je 0x2074bd4c
call 0x728912db
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2074bd68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x2074bd7c
jmp 0x2074bea6
jne 0x2074bd81
je 0x2074bd81
call 0xa97d0310
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x20715fa8], edx
jb 0x2074bd97
jae 0x2074bd97
adc cl, byte [ebx + 0x488bec45]
add al, 0x89
or eax, 0x20716124
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x20716124], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x20716120], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x207152c0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x207152c4], ecx
jbe 0x2074bdcb
ja 0x2074bdcb
mov dl, 0xc6
inc ebp
invalid
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jne 0x2074be04
je 0x2074be04
call 0xa1651392
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jl 0x2074be71
jge 0x2074be71
call 0x8194fbf8
jno 0x2074be97
cmp dword [0x20716120], 0
je 0x2074be8e
add byte [esp + edx - 0x73], dh
push ebp
invalid
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x20716120]
push eax
call fcn.2074f3b3
mov dword [0x20715fa4], eax
cmp dword [esp + 8], 0x1740375
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.2074778b
add esp, 0xc
or eax, 0x4d8d006a
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x2074d12f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2074778b
add esp, 0xc
jne 0x2074d14d
je 0x2074d14d
call 0x655d1717
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x55
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0xf], 0x66
jbe 0x2074d186
ja 0x2074d186
mov esp, 0x80e84d8a
jmp 0x8c25990
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
out dx, eax
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jb 0x2074d1f3
invalid
jae 0x2074d1f3
jmp 0x2074d1dc
call fcn.207477ba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2074d205
xor eax, eax
jmp 0x2074d268
jle 0x2074d20a
jg 0x2074d20a
call 0x725d1f9b
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.2074f3b3
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x2074d234
xor eax, eax
jmp 0x2074d268
jne 0x2074d239
je 0x2074d239
jmp 0x2074d1c5
mov ecx, dword [ebp - 4]
push ecx
call fcn.2073b5c3
add esp, 4
cmp dword [esp + 8], 0x1740375
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x2074d76a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2074778b
add esp, 0xc
jo 0x2074d788
jno 0x2074d788
call 0x655d1d52
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
jne 0x2074d7d9
je 0x2074d7d9
call 0xa15d2567
jmp 0x8c25fe3
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
jb 0x2074d87a
jae 0x2074d87a
aaa
call fcn.20750d09
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2074d88c
xor eax, eax
jmp 0x2074d8d8
jl 0x2074d891
jge 0x2074d891
call 0x725d2622
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.2074f3b3
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x2074d8bb
xor eax, eax
jmp 0x2074d8d8
jb 0x2074d8c0
jae 0x2074d8c0
call 0x7259264f
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.2073b5c3
add esp, 4
jo 0x2074d8d1
jno 0x2074d8d1
call 0x727d2e60
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x2074e0e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2074778b
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x4e
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 9], 0x6d
mov byte [ebp - 0x12], 0x71
mov byte [ebp - 0xd], 0x50
mov byte [ebp - 8], 0x66
mov byte [ebp - 0x11], 0x57
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 7], 0
mov byte [ebp - 0x10], 0x6a
mov byte [ebp - 0xb], 0x47
jbe 0x2074e140
ja 0x2074e140
call 0xa1612ece
jmp 0xcc2694a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
push ebp
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
call fcn.207477ba
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2074e1c3
xor eax, eax
jmp 0x2074e21a
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.2074f3b3
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.2074778b
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x2074e1ed
xor eax, eax
jmp 0x2074e21a
jne 0x2074e1f2
je 0x2074e1f2
jle 0x2074e17e
mov edx, dword [ebp - 0x18]
push edx
call fcn.2073b5c3
add esp, 4
jp 0x2074e203
push ebp
call 0xf43dca4b
invalid
jnp 0x2074e203
call 0x708d2792
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14