joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a5200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.007b4640
add esp, 0xc
jnp 0x7a521b
xor ebx, dword [esp + 0xc]
xor ebx, dword [esp + 0xc]
jmp 0x7a5225
push edx
pop edx
jne 0x7a5234
lea eax, [eax]
jp 0x7a522d
je 0x7a522f
js 0x7a5231
je 0x7a5234
call 0x4640b8eb
call 0xedc01885
mov byte gs:[ebp - 0xe], 0x6a
mov bl, 0x66
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x6e
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xc], bl
mov byte [ebp - 8], bl
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0xd], 0x6d
mov byte [ebp - 7], 0x42
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xb], 0x4f
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xf], 0x47
mov byte [ebp - 0xa], 0x62
xchg edx, ecx
xchg edx, ecx
xor edi, ecx
xor edi, ecx
jge 0x7a52a3
pushf
mov esp, esp
ror eax, 2
ror eax, 0x1e
xor esi, dword [esp + 0x10]
xor esi, dword [esp + 0x10]
or ecx, ecx
popf
jl 0x7a52a0
jl 0x7a52a3
jmp 0x8b62a031
mov cl, byte [ebp - 0x18]
mov al, byte [ebp - 0x13]
mov dl, byte [ebp - 0xe]
dec cl
mov byte [ebp - 0x18], cl
mov cl, byte [ebp - 9]
dec al
dec dl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x17]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0x12]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 0xd]
dec al
mov byte [ebp - 0x17], al
mov al, byte [ebp - 8]
dec dl
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0x16]
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0x11]
dec al
dec dl
mov byte [ebp - 8], al
mov al, byte [ebp - 0xc]
dec cl
mov byte [ebp - 0x16], dl
mov dl, byte [ebp - 7]
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 0x15]
dec al
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0x10]
dec dl
dec cl
mov byte [ebp - 7], dl
mov dl, byte [ebp - 0xb]
mov byte [ebp - 0x15], cl
mov cl, byte [ebp - 0x14]
dec al
dec dl
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0xf]
dec cl
mov byte [ebp - 0xb], dl
mov byte [ebp - 0x14], cl
dec al
mov dl, byte [ebp - 0xa]
mov byte [ebp - 0xf], al
dec dl
mov byte [ebp - 0xa], dl
add edi, 0
call fcn.007a533b
Function at 0x7a6040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xe
push cs
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.007b4640
add esp, 0xc
xor eax, ebx
xor eax, ebx
add eax, 0
js 0x7a6079
pushf
rol edx, 0
cmp eax, 0x485
cmp eax, dword [esp + 0xc]
mov esi, esi
popf
jb 0x7a6076
jns 0x7a6079
xor dword [eax - 0x13ba399a], 0xf145c648
jae 0x7a604a
mov al, 0x66
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x46
mov byte [ebp - 0x13], al
inc ebp
test byte [esi - 0x78], 0x45
in eax, dx
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x6a
mov byte [ebp - 0x11], 0x57
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 7], 0
mov byte [ebp - 9], 0x79
mov byte [ebp - 8], 0x58
dec edx
inc edx
jno 0x7a60c1
jbe 0x7a60b7
jo 0x7a60b9
lea esi, [esi]
jnp 0x7a60bd
jo 0x7a60c1
ljmp 0x4d8a:0xec558a2d
mov dl, byte [ebp - 0x14]
mov cl, byte [ebp - 0xf]
mov al, byte [ebp - 0x13]
mov bl, byte [ebp - 0xe]
dec dl
dec cl
mov byte [ebp - 0x14], dl
mov dl, byte [ebp - 0x12]
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x11]
dec dl
mov byte [ebp - 0xe], bl
mov bl, byte [ebp - 0xc]
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0x10]
dec cl
dec al
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0xb]
dec bl
mov byte [ebp - 0x11], al
mov al, byte [ebp - 9]
dec dl
mov byte [ebp - 0xc], bl
mov bl, byte [ebp - 8]
mov byte [ebp - 0x10], dl
mov dl, byte [ebp - 0xa]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0xb], cl
mov byte [ebp - 9], al
mov byte [ebp - 8], bl
mov byte [ebp - 0xa], dl
jl 0x7a612b
jbe 0x7a613d
pushf
add ecx, 0
clc
shl edx, 0
popf
jb 0x7a613a
ja 0x7a613d
lcall 0x8500, 0x9b3ee8
sal byte [ebp + 9], 0x5f
call fcn.007afc80
test eax, eax
jne 0x7a614f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
neg ebx
neg ebx
nop
cmp ebx, dword [esp]
push ecx
pop ecx
jnp 0x7a617f
pushf
rol edi, 9
ror edi, 9
call fcn.007a6168
Function at 0x7a6242
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg ebx, eax
lea edi, [edi]
ja 0x7a6248
mov esp, 0x45c666b0
in al, dx
dec eax
mov al, 0x66
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x46
mov byte [ebp - 0x13], al
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x6a
mov byte [ebp - 0x11], 0x57
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 7], 0
mov byte [ebp - 9], 0x79
mov byte [ebp - 8], 0x42
js 0x7a6282
std
cld
clc
je 0x7a6291
jno 0x7a6289
jle 0x7a628b
ja 0x7a628d
jne 0x7a6291
mov esi, 0xec4d8a58
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 0xf]
mov bl, byte [ebp - 0x13]
mov dl, byte [ebp - 0xe]
dec cl
dec al
mov byte [ebp - 0x14], cl
mov cl, byte [ebp - 0x12]
dec bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0xd]
dec dl
mov byte [ebp - 0x13], bl
mov bl, byte [ebp - 0x11]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xc]
mov byte [ebp - 0x12], cl
mov cl, byte [ebp - 0x10]
dec al
dec bl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xb]
dec dl
mov byte [ebp - 0x11], bl
mov bl, byte [ebp - 9]
dec cl
mov byte [ebp - 0xc], dl
mov dl, byte [ebp - 8]
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0xb], al
mov byte [ebp - 9], bl
mov byte [ebp - 8], dl
mov byte [ebp - 0xa], cl
shl eax, 0
cmp eax, dword [esp]
and esp, 0xffffffff
jne 0x7a630b
ja 0x7a6306
je 0x7a630b
jmp 0xfd1c015f
mov eax, dword [0x797bfc]
test eax, eax
je 0x7a6347
test dword [esp], edx
stc
cmp ecx, dword [esp]
jb 0x7a6334
pushf
add eax, dword [esp]
sub eax, dword [esp]
cmp esp, 0x13a4
popf
jno 0x7a632f
lea ebx, [ebx]
jae 0x7a6334
call 0x79f65fd9
add byte [ebp + 0x5052ec55], cl
mov eax, dword [0x797bfc]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.007b1c80
mov esi, eax
jmp 0x7a634a
mov esi, dword [ebp + 8]
jnp 0x7a634c
jns 0x7a6364
jge 0x7a6350
nop
lea edi, [edi + 0x4fae]
lea edi, [edi - 0x4fae]
lea ebx, [ebx]
js 0x7a6364
cmp dword [eax + ebp + 0x6a], 0xec4d8d0e
push 0xe
lea ecx, [ebp - 0x14]
push 0
push ecx
call fcn.007b4640
add esp, 0xc
jo 0x7a6376
cld
jno 0x7a6385
jmp 0x7a637b
lea edx, [edx]
jl 0x7a637f
xchg edx, edx
jo 0x7a6385
xor eax, 0x74f685d6
pop ds
test esi, esi
je 0x7a63a8
test esp, 0x2b85
jnp 0x7a639f
pushf
add esp, 0
popf
jmp 0x7a639a
jne 0x7a639c
jp 0x7a639f
mov edi, 0xb82be856
add byte [eax], al
push esi
call fcn.007b1bd0
add esp, 4
or esi, esi
sub ebx, 0
je 0x7a63bc
lea eax, [eax]
lea esp, [esp]
jl 0x7a63b6
jo 0x7a63b8
jne 0x7a63bc
mov ecx, 0x8558b46
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7b0a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [0x798e68]
cmp edi, 1
jne 0x7b0b7c
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007b4640
add esp, 0xc
mov esp, esp
mov eax, eax
jb 0x7b0a44
jp 0x7b0a40
jae 0x7b0a44
mov eax, 0xc675b084
inc ebp
invalid
mov al, 0x75
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 6], 0x6f
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 5], al
mov byte [ebp - 0xe], al
mov byte [ebp - 9], 0x44
mov byte [ebp - 4], 0
mov byte [ebp - 0xd], 0x55
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 7], 0x76
inc ebx
dec ebx
ja 0x7b0a7c
jb 0x7b0a7e
jb 0x7b0a94
jl 0x7b0a82
jl 0x7b0a84
lea ecx, [ecx + 0x1f59]
lea ecx, [ecx - 0x1f59]
jae 0x7b0a94
jmp 0xf0c094c3
mov al, byte [ebp - 0x10]
mov bl, byte [ebp - 0xb]
mov dl, byte [ebp - 6]
mov cl, byte [ebp - 0xf]
dec al
dec bl
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xb], bl
mov bl, byte [ebp - 5]
dec cl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 0xe]
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 9]
dec al
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xd]
dec dl
mov byte [ebp - 5], bl
mov bl, byte [ebp - 8]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xc]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 7]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0xd], al
mov byte [ebp - 8], bl
mov byte [ebp - 0xc], dl
mov byte [ebp - 7], cl
lea esp, [esp]
jae 0x7b0af9
cmp esi, dword [esp + 0xc]
push edi
add edi, 0x6e6f
ror edi, 1
pop edi
js 0x7b0b28
pushf
add esp, 0
not edx
not edx
and ebx, 0xffffffff
xor ecx, 0x57ad
xor ecx, 0x57ad
popf
xchg edx, eax
xchg edx, eax
jns 0x7b0b28
lcall 0x8bff, 0xfff153e8
enter 0xffffffffffffc985, 0x75
or dword [ebx], esi
rcr byte [edi + 0x5e], 0x5b
call fcn.007afc80
mov ecx, eax
test ecx, ecx
jne 0x7b0b3c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add ebx, dword [esp]
sub ebx, dword [esp]
mov esp, esp
xor eax, dword [esp]
xor eax, dword [esp]
shr eax, 0
ja 0x7b0b56
jg 0x7b0b51
jo 0x7b0b53
jbe 0x7b0b56
mov edx, 0x52f0558d
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.007b1c80
mov edi, eax
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007b4640
add esp, 0xc
test edi, edi
je 0x7b0b33
mov dword [0x798e68], edi
neg esi
neg esi
jae 0x7b0b88
mov esp, esp
jb 0x7b0b88
mov ebx, 0x42e857b9
adc byte [eax], al
add byte [ebx + 0x3bf904c4], al
retf
push edi
call fcn.007b1bd0
add esp, 4
stc
cmp ecx, ebx
call fcn.007b0b99
Function at 0x7b1bd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor edx, 0x1dbd
xor edx, 0x1dbd
add esp, 0
jl 0x7b1bef
mov esp, esp
jmp 0x7b1bea
ja 0x7b1bec
jge 0x7b1bef
mov ebx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call fcn.007a7840
add esp, 4
cmp eax, 2
jne 0x7b1c55
jg 0x7b1c02
xor esp, 0
jns 0x7b1c07
jle 0x7b1c09
jne 0x7b1c25
pushf
add esp, 0
popf
jnp 0x7b1c14
jb 0x7b1c16
lea ecx, [ecx + 0x43d9]
lea ecx, [ecx - 0x43d9]
je 0x7b1c25
add eax, 0x79986468
add byte [ebx + 0x798e74], ah
push 0x799864
mov dword [0x798e74], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
rol esp, 0
test esp, 0x2640
js 0x7b1c4c
xchg ebx, ebx
jmp 0x7b1c44
xchg ecx, esi
xchg ecx, esi
jns 0x7b1c4c
mov ebx, 0x1b8cc
add byte [eax], al
mov eax, 1
pop esi
pop ebx
pop ebp
ret
jg 0x7b1c57
jp 0x7b1c59
add esp, 0
jns 0x7b1c71
pushf
je 0x7b1c62
rol esp, 0
popf
lea esp, [esp]
mov ebx, ebx
lea ecx, [ecx]
js 0x7b1c71
xor eax, 0x5bc0335e
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x7b1c80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x7b1d30
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7b1d30
lea esp, [esp]
stc
lea ebx, [ebx + 0x7236]
lea ebx, [ebx - 0x7236]
jb 0x7b1cb3
lea edx, [edx]
jae 0x7b1cb3
mov edx, 0x100003d
add byte [ebx + 0x34], dh
cmp eax, 0x10000
jae 0x7b1cee
and edi, edi
jae 0x7b1ce2
pushf
test esi, 0x532e
nop
xchg edx, ecx
xchg edx, ecx
js 0x7b1ccd
popf
lea esi, [esi]
mov esp, esp
lea edi, [edi + 0x37f2]
lea edi, [edi - 0x37f2]
jb 0x7b1ce2
mov eax, 0x8458b50
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.007a5950
jmp 0x7b1d08
xchg ecx, ecx
je 0x7b1d01
pushf
lea ecx, [ecx]
popf
xchg ecx, ecx
jp 0x7b1cfc
jno 0x7b1cfe
jne 0x7b1d01
mov edi, 0x88e85650
pop eax
invalid
push eax
push esi
call fcn.007a7590
add esp, 8
test eax, eax
je 0x7b1d3b
neg edi
neg edi
jbe 0x7b1d29
pushf
jl 0x7b1d19
je 0x7b1d1b
jne 0x7b1d1d
popf
je 0x7b1d21
je 0x7b1d23
lea esp, [esp]
ja 0x7b1d29
ljmp 0x8c2:0x5d5b5e5f
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0x799874
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x7b25f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x7993fc
call fcn.007b4360
add esp, 0xc
mov byte [0x7993fc], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x7b45b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x7999e0]
push esi
push edi
push eax
push 0x799b9d
mov byte [0x799b9c], 0x45
call fcn.007ab6f0
mov edx, dword [0x7999e0]
mov al, 0x2d
mov byte [0x799ba2], al
mov byte [0x799ba3], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x799ba1], cl
mov byte [0x799ba4], cl
mov esi, 0x799ba5
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x789a69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x7b45ff
mov byte [esi], 0
pop edi
mov eax, 0x799b9c
pop esi
ret

Function at 0x7b9110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007b4640
add esp, 0xc
xor ecx, dword [esp + 4]
xor ecx, dword [esp + 4]
shr eax, 0
jne 0x7b913f
jmp 0x7b9138
jbe 0x7b913a
je 0x7b913c
je 0x7b913f
mov esp, 0x45c666b0
invalid
mov al, 0x66
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
or eax, 0
nop
jb 0x7b9192
pushf
jg 0x7b917d
add esi, 0x42e
sub esi, 0x42e
jle 0x7b918b
popf
je 0x7b918f
jae 0x7b9192
add eax, 0x8af04d8a
inc ebp
cmc
mov cl, byte [ebp - 0x10]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 6]
mov dl, byte [ebp - 0xf]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
dec dl
mov byte [ebp - 6], bl
mov bl, byte [ebp - 0xe]
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
dec dl
mov byte [ebp - 0xe], bl
mov bl, byte [ebp - 0xc]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0xd], cl
mov byte [ebp - 8], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], dl
call fcn.007afc80
test eax, eax
je 0x7b9281
lea esp, [esp]
jl 0x7b9204
rol esi, 0
call 0x7b920c
add esp, 4
jp 0x7b9219
jge 0x7b9213
jb 0x7b9215
jnp 0x7b9219
xor dword [ebp + 0x51f04d8d], 0x8a5de850
invalid
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.007b1c80
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.007b4640
add esp, 0xc
test esi, esi
je 0x7b9281
lea ebx, [ebx + 0x23c9]
lea ebx, [ebx - 0x23c9]
jl 0x7b9254
pushf
cmp edx, dword [esp + 0x10]
popf
jbe 0x7b9251
jge 0x7b9254
mov edi, 0x8976e856
invalid
push esi
call fcn.007b1bd0
add esp, 4
xchg ecx, eax
xchg ecx, eax
lea edi, [edi + 0x2525]
sub edi, 0x2525
jns 0x7b926d
dec ebx
inc ebx
jae 0x7b927b
jno 0x7b9273
jg 0x7b9275
nop
js 0x7b9278
jb 0x7b927b
or dword [ebx - 0xaff7bb], 0x5b5e5fd6
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7bdd00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.007b4640
add esp, 0xc
add eax, 0x642f
sub eax, 0x642f
or ebx, ebx
std
cld
jb 0x7bdd40
lea ecx, [ecx]
xchg ecx, edx
xchg ecx, edx
lea esi, [esi + 0x6b40]
lea esi, [esi - 0x6b40]
jmp 0x7bdd3d
jae 0x7bdd40
call 0x762c43f5
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 7], 0x4a
mov byte [ebp - 8], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 0xa], al
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], al
mov byte [ebp - 4], 0x70
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 9], cl
mov byte [ebp - 6], 0x6f
cmp ebx, 0x568c
xchg ecx, ecx
jae 0x7bdd95
lea edi, [edi + 0x156d]
lea edi, [edi - 0x156d]
jne 0x7bdd90
lea esi, [esi]
jb 0x7bdd95
mov eax, 0x8afc4d8a
inc ebp
cmc
mov cl, byte [ebp - 4]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 0xf]
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 4], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0xf], bl
mov bl, byte [ebp - 0xa]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 6]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
dec al
dec bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 7]
dec cl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 5]
mov byte [ebp - 8], cl
mov cl, byte [ebp - 0xe]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0x10], al
mov byte [ebp - 7], bl
mov byte [ebp - 5], dl
mov byte [ebp - 0xe], cl
xor edx, 0
test dword [esp], ebx
or esp, 0
jge 0x7bde14
pushf
cmp eax, dword [esp]
popf
jb 0x7bde11
jl 0x7bde14
mov edx, 0xff1e67e8
dec dword [ebx + 0xfd285d0]
test byte [ebx - 0x73000000], ch
add byte [edi + 0x70007de4], al
adc dword [esi - 0x64], esp
call fcn.007afc80
mov edx, eax
test edx, edx
je 0x7bdece
lea eax, [eax]
xchg esp, esp
jge 0x7bde29
jo 0x7bde3c
pushf
xchg ecx, esi
xchg ecx, esi
popf
jmp 0x7bde35
jns 0x7bde37
jl 0x7bde39
jno 0x7bde3c
add eax, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push edx
call fcn.007b1c80
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.007b4640
add esp, 0xc
add ebx, 0xf5
sub ebx, 0xf5
jns 0x7bde6b
jo 0x7bde68
js 0x7bde6b
ljmp 0x1b8d:0x5f74f685
test esi, esi
je 0x7bdece
lea ebx, [ebx]
test edx, eax
test dword [esp + 4], eax
jnp 0x7bde98
pushf
xor edx, 0
xchg esp, esp
or edi, 0
popf
jne 0x7bde87
jge 0x7bde89
lea edx, [edx + 0x3626]
lea edx, [edx - 0x3626]
jp 0x7bde98
add eax, 0x3d32e856
invalid
push esi
call fcn.007b1bd0
add esp, 4
lea edi, [edi + 0x714b]
sub edi, 0x714b
cmp esi, eax
jmp 0x7bdeb1
xchg edx, eax
xchg edx, eax
jne 0x7bdec8
lea ecx, [ecx + 0x3062]
lea ecx, [ecx - 0x3062]
lea edx, [edx]
jle 0x7bdec5
je 0x7bdec8
add eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40bcd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4bbdb8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4e51e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.00403040
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40bd24
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.004021a0
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.00403040
cmp dword [esp + 0x24], 8
jb 0x40bd6a
mov eax, dword [esp + 0x10]
push eax
call fcn.0048a8f9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x4235c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4ba1ab
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4e51e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable._.1.0
call fcn.00489909
push 4
mov dword [esp + 0x20], 0
call fcn.0048abee
mov edi, eax
add esp, 4
test edi, edi
je 0x423640
call fcn.00489c1e
mov dword [edi], eax
call fcn.00489a28
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0048a38b
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x423635
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0048a3ac
jmp 0x423642
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x42d2b0
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x4bd3a8
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x4e51e0]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e51e0]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x13c]
mov ebp, dword [esp + 0x140]
xor ebx, ebx
cmp eax, ebx
je 0x42d44b
cmp byte [eax], bl
je 0x42d44b
cmp ebp, ebx
je 0x42d44b
cmp ecx, ebx
mov dword [esp + 0x30], 0x67452301
mov dword [esp + 0x34], 0xefcdab89
mov dword [esp + 0x38], 0x98badcfe
mov dword [esp + 0x3c], 0x10325476
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
jle 0x42d351
push ecx
push eax
lea edi, [esp + 0x38]
call fcn.00436240
add esp, 8
xor eax, eax
mov dword [esp + 0xcd], eax
mov dword [esp + 0xd1], eax
mov dword [esp + 0xd5], eax
mov word [esp + 0xd9], ax
mov byte [esp + 0xdb], al
lea eax, [esp + 0xcc]
push eax
lea esi, [esp + 0x34]
mov byte [esp + 0xd0], bl
call fcn.00436300
push 0x3f
lea ecx, [esp + 0xf1]
push ebx
push ecx
mov byte [esp + 0xf8], bl
call fcn.0048ffc0
add esp, 0x10
lea ecx, [esp + 0xe8]
lea eax, [esp + 0xcc]
call fcn.00436440
lea edx, [esp + 0xe8]
push edx
lea ecx, [esp + 0xd0]
call fcn.00402df0
lea eax, [esp + 0xcc]
push 0xfde9
push eax
lea esi, [esp + 0x1c]
mov dword [esp + 0x13c], ebx
call fcn.0042c170
add esp, 8
cmp dword [esp + 0xe4], 0x10
jb 0x42d40a
mov ecx, dword [esp + 0xd0]
push ecx
call fcn.0048a8f9
add esp, 4
mov eax, dword [esp + 0x18]
mov esi, 8
cmp dword [esp + 0x2c], esi
jae 0x42d41d
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x28]
push edx
push eax
push 0x100
push ebp
call fcn.0048b7e0
add esp, 0x10
cmp dword [esp + 0x2c], esi
jb 0x42d444
mov eax, dword [esp + 0x18]
push eax
call fcn.0048a8f9
add esp, 4
mov eax, 1
jmp 0x42d44d
xor eax, eax
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0048a8fe
add esp, 0x124
ret