joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d5297
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x5c8d9c], 1
jne 0x5d53f2
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005e7b89
add esp, 0xc
test dword [esp], edi
jno 0x5d52c2
jmp 0x5d52c4
jne 0x5d52cb
mov esp, esp
je 0x5d52cb
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
lea eax, [eax]
jp 0x5d52ff
ror esi, 0x1d
rol esi, 0x1d
jns 0x5d530f
lea esp, [esp]
jno 0x5d530c
js 0x5d530f
mov edx, 0x80e84d8a
jmp 0xe8aadb19
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.005e0be7
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5d5384
xor eax, eax
jmp 0x5d5469
mov esi, esi
mov edx, edx
test esp, 0x77f5
cmp eax, ecx
jbe 0x5d53a4
lea esi, [esi + 0x7bf0]
lea esi, [esi - 0x7bf0]
jbe 0x5d53a0
ja 0x5d53a4
jmp 0xe8a2e108
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005ec07c
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005e7b89
add esp, 0xc
test dword [esp], edi
jp 0x5d53dc
pushf
xor edi, dword [esp]
xor edi, dword [esp]
cmp edx, ebx
std
cld
popf
jbe 0x5d53d9
jnp 0x5d53dc
ljmp 0xa74:0xf87d83
cmp dword [ebp - 8], 0
je 0x5d53ec
mov eax, dword [ebp - 8]
mov dword [0x5c8d9c], eax
jmp 0x5d53f0
xor eax, eax
jmp 0x5d5469
jmp 0x5d53fb
mov ecx, dword [0x5c8d9c]
mov dword [ebp - 8], ecx
xchg esp, esp
ror edi, 0x19
ror edi, 7
lea eax, [eax + 0x3b8d]
lea eax, [eax - 0x3b8d]
lea ebx, [ebx]
jp 0x5d5429
js 0x5d5415
xchg edx, eax
xchg edx, eax
lea edx, [edx + 0x5452]
lea edx, [edx - 0x5452]
jnp 0x5d5425
jnp 0x5d5429
mov ebx, 0xf8558b70
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
js 0x5d5431
and edx, 0xffffffff
xor esi, 0
jns 0x5d5452
pushf
and eax, eax
call 0x5d5442
lea esp, [esp + 4]
nop
and esi, esi
popf
xchg esp, esp
xchg esp, esp
js 0x5d5452
xor eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.005dabe3
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5d62cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
rol esi, 0xc
rol esi, 0x14
add ebx, dword [esp]
sub ebx, dword [esp]
cmp ecx, dword [esp + 4]
jge 0x5d62f1
jle 0x5d62e8
xchg edx, eax
xchg edx, eax
mov edi, edi
jp 0x5d62ee
jl 0x5d62f1
mov eax, 0x6a126a
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.005e7b89
add esp, 0xc
mov byte [ebp - 0x1c], 0x4a
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x45
mov byte [ebp - 0x19], 0x66
mov byte [ebp - 0x18], 0x63
mov byte [ebp - 0x17], 0x76
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x68
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x51
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0
cmp esp, 0x64bf
xchg esi, edx
xchg esi, edx
xchg esp, esp
add ecx, 0x3718
sub ecx, 0x3718
je 0x5d6368
jo 0x5d6365
jne 0x5d6368
mov edx, 0x80e44d8a
jmp 0xe4aaeb72
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x19]
sub al, 1
mov byte [ebp - 0x19], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
jle 0x5d63fe
call fcn.005d6403
Function at 0x5d6e93
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005e7b89
add esp, 0xc
cmp esi, dword [esp]
jl 0x5d6ec1
lea esi, [esi + 0x5808]
lea esi, [esi - 0x5808]
jge 0x5d6ec1
mov eax, 0xec45c610
jp 0x5d6e8c
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0xe9a33514
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
jbe 0x5d6efb
jb 0x5d6efd
je 0x5d6f05
jae 0x5d6f01
jne 0x5d6f05
lcall 0xe980, 0xf44d8ace
add dword [eax + 0x558af44d], ecx
in eax, dx
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
lea esp, [esp]
test dword [esp], edx
jg 0x5d6f90
je 0x5d6f80
lea edi, [edi + 0x606a]
lea edi, [edi - 0x606a]
jle 0x5d6f90
add eax, 0x9c52e82b
add byte [eax], al
call fcn.005e0be7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5d6fa3
jmp 0x5d7042
sub edi, 0
jno 0x5d6fa8
jne 0x5d6faa
xor esi, 0
jno 0x5d6fc2
pushf
jle 0x5d6fb3
jle 0x5d6fb5
popf
jg 0x5d6fb9
xchg ecx, esi
xchg ecx, esi
jp 0x5d6fbf
jo 0x5d6fc2
lcall 0x458b, 0x52e8558d
clc
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005ec07c
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.005e7b89
add esp, 0xc
mov eax, eax
jge 0x5d6ff8
pushf
jle 0x5d6fea
cmp esi, ebx
dec ecx
inc ecx
xchg esi, esi
popf
lea esi, [esi]
nop
jl 0x5d6ff8
mov edx, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x5d7000
jmp 0x5d7042
test ecx, 0x1fe2
ror esi, 8
ror esi, 0x18
or esp, 0
je 0x5d701c
pushf
std
cld
popf
je 0x5d7019
jne 0x5d701c
ljmp 0xbee8:0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.005dabe3
add esp, 4
inc esi
dec esi
ror eax, 0x10
rol eax, 0x10
jne 0x5d703b
mov esp, esp
jnp 0x5d7036
xchg esp, esp
je 0x5d703b
mov ecx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5d95f2
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x5c8c80
call fcn.005ecc48
add esp, 0xc
mov byte [0x5c8c80], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x5dac78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005e7b89
add esp, 0xc
lea esi, [esi]
rol eax, 0
jo 0x5dacb0
pushf
ror edx, 0x10
ror edx, 0x10
popf
je 0x5dacab
jns 0x5dacad
jno 0x5dacb0
mov ebx, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x42
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xb], 0x78
push esi
pop esi
cld
jns 0x5daced
ja 0x5dace7
jo 0x5dace9
js 0x5daced
xor eax, 0xec4d8a23
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.005d95c7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5dad62
xor eax, eax
jmp 0x5dafb5
ja 0x5dad64
jmp 0x5dad66
je 0x5dad8b
pushf
push ebx
add ebx, 0x66b1
ror ebx, 0x13
pop ebx
rol esp, 0
xor esi, 0x2de7
xor esi, 0x2de7
popf
jne 0x5dad88
jne 0x5dad8b
mov ebx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005ec07c
mov dword [ebp - 0x18], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005e7b89
add esp, 0xc
js 0x5dadad
call fcn.005dadb2
Function at 0x5dffab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.005e7b89
add esp, 0xc
add esi, 0
lea ecx, [ecx]
cmp edi, dword [esp]
jge 0x5dffd4
mov esp, esp
jl 0x5dffd4
mov esp, 0xf445c673
push ebx
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
rol esi, 0
sub esp, 0
or edi, edi
jnp 0x5e0017
jp 0x5e0010
xchg ebx, ebx
jne 0x5e0014
jp 0x5e0017
mov esi, 0x80f44d8a
jmp 0xf4ab8821
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
mov esp, esp
test esp, 0x32aa
rol edi, 0x16
rol edi, 0xa
lea esi, [esi + 0x1bf3]
sub esi, 0x1bf3
jne 0x5e00b3
pushf
add esi, 0
shr esi, 0

Function at 0x5e0197
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.005e7b89
add esp, 0xc
test dword [esp + 0x10], edi
jge 0x5e01c0
nop
xchg esi, esi
jbe 0x5e01bb
jo 0x5e01bd
jl 0x5e01c0
xor eax, 0x48e045c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
call fcn.005e0211
Function at 0x5e6f34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e7b89
add esp, 0xc
ror ecx, 0x1a
rol ecx, 0x1a
and esp, 0xffffffff
lea esi, [esi + 0x1fbb]
lea esi, [esi - 0x1fbb]
ja 0x5e6f8c
pushf
call 0x5e6f72
lea esp, [esp + 4]
mov ecx, ecx
push ecx
add ecx, 0x2929
ror ecx, 6
pop ecx
popf
jb 0x5e6f87
mov esp, esp
jbe 0x5e6f8c
mov ebp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
ror ecx, 0x19
rol ecx, 0x19
jo 0x5e6fd9
pushf
cmp edi, ecx
rol ecx, 7
ror ecx, 7
or ebx, ebx
push ecx
pop ecx
popf
xchg edx, eax
xchg edx, eax
jno 0x5e6fd9
lcall 0x1e9, 0x80f04d8a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
xor ecx, 0
lea eax, [eax]
rol ebx, 7
rol ebx, 0x19
jg 0x5e7062
pushf
add edx, 0x2b93
sub edx, 0x2b93
or esp, 0
lea edi, [edi]
popf
xchg edi, edi
mov esp, esp
jle 0x5e7062
mov edi, 0xff2560e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.005d95c7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5e7074
xor eax, eax
jmp 0x5e70b2
std
cld
xchg ebx, ebx
xor eax, edx
xor eax, edx
jge 0x5e708f
pushf
nop
cmp edi, dword [esp]
jne 0x5e7086
popf
lea esi, [esi]
jbe 0x5e708c
jl 0x5e708f
lcall 0x4d8b, 0x50f0458d
cld
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005ec07c
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.005e7b89
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ed002
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005e7b89
add esp, 0xc
ror esi, 0x1f
rol esi, 0x1f
jl 0x5ed023
jae 0x5ed025
cmp ebx, 0x76f7
jg 0x5ed03c
lea eax, [eax + 0x20be]
lea eax, [eax - 0x20be]
jle 0x5ed03c
mov edx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
cmc
jp 0x5ed073
std
cld
dec ebx
inc ebx
jg 0x5ed088
pushf
xor edx, edi
xor edx, edi
jo 0x5ed081
popf
xchg esp, esp
jle 0x5ed088
mov esp, 0x80e84d8a
jmp 0xe8ac5892
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
shr esi, 0
je 0x5ed110
pushf
lea edx, [edx + 0x156b]
lea edx, [edx - 0x156b]
test esp, 0x5aa2
popf
xchg edi, eax
xchg edi, eax
jne 0x5ed110
mov edx, 0xff3ad2e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.005e0be7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5ed125
xor eax, eax
jmp 0x5ed1b9
cld
jnp 0x5ed128
je 0x5ed132
jne 0x5ed12c
nop
mov esp, esp
jne 0x5ed132
call 0x52471ec3
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005ec07c
mov dword [ebp - 4], eax
jb 0x5ed144
test ebx, edi
jo 0x5ed148
cmp esp, 0x43bf
jo 0x5ed15d
jge 0x5ed152
js 0x5ed154
xchg ebx, ebx
lea ebx, [ebx]
jno 0x5ed15d
mov ebp, 0xd6a2ed3
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005e7b89
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5ed177
xor eax, eax
jmp 0x5ed1b9
ror esi, 2
rol esi, 2
jns 0x5ed197
pushf
call 0x5ed186
add esp, 4
test dword [esp], esi
popf
jle 0x5ed190
xchg edi, edi
jo 0x5ed194
js 0x5ed197
mov ebp, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.005dabe3
add esp, 4
std
cld
mov esp, esp
and ecx, ecx
rol esp, 0
jle 0x5ed1b6
mov ebx, ebx
jbe 0x5ed1b2
jg 0x5ed1b6
jmp 0xfcb4d157
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ed2d2
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
and eax, eax
jb 0x5ed2f6
jnp 0x5ed2ef
xchg ecx, edi
xchg ecx, edi
jae 0x5ed2f6
jmp 0x15b507d
cmp dword [ebp - 4], 0
je 0x5ed336
xor esi, dword [esp + 0x10]
xor esi, dword [esp + 0x10]
add eax, 0x1597
sub eax, 0x1597
jl 0x5ed310
xor ecx, 0
jae 0x5ed32f
pushf
test edx, 0x244
not ebx
not ebx
add edx, 0
popf
jge 0x5ed328
mov ecx, ecx
jp 0x5ed32c
jb 0x5ed32f
mov esi, 0xfb8
add bl, ch
xor eax, 0x3904f47
add al, 0x24
mov eax, 0xf
jmp 0x5ed36b
inc edi
dec edi
nop
add eax, dword [esp]
sub eax, dword [esp]
je 0x5ed366
pushf
add edi, dword [esp]
sub edi, dword [esp]
popf
lea ecx, [ecx + 0x32e2]
lea ecx, [ecx - 0x32e2]
lea esi, [esi + 0xaeb]
lea esi, [esi - 0xaeb]
jne 0x5ed366
cmp dword [eax + 0x14], 0x8b5b5e5f
in eax, 0x5d
mov eax, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5efb9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005e7b89
add esp, 0xc
shr ebx, 0
jae 0x5efbb8
jp 0x5efbd9
pushf
jne 0x5efbbe
xor edi, 0x57db
xor edi, 0x57db
push eax
pop eax
add ecx, dword [esp]
sub ecx, dword [esp]
popf
jo 0x5efbd6
jnp 0x5efbd9
mov eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
mov ecx, ecx
jge 0x5efc26
pushf
lea ecx, [ecx]
popf
lea ecx, [ecx + 0x6ad9]
lea ecx, [ecx - 0x6ad9]
jnp 0x5efc21
jge 0x5efc23
jl 0x5efc26
sub eax, 0x80ec4d8a
jmp 0xecac8430
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.005e0be7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5efc9b
xor eax, eax
jmp 0x5efd1c
or esi, 0
xor esp, 0
nop
inc edx
dec edx
jl 0x5efcbc
pushf
not eax
not eax
xchg esp, esp
cmp eax, dword [esp]
mov edi, edi
popf
lea ecx, [ecx]
jp 0x5efcb9
jge 0x5efcbc
xor eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005ec07c
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005e7b89
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5efce6
xor eax, eax
jmp 0x5efd1c
js 0x5efce8
stc
jp 0x5efcf0
xchg esp, esp
jnp 0x5efcf0
mov edi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.005dabe3
add esp, 4
add esi, dword [esp]
sub esi, dword [esp]
jmp 0x5efd04
add ebx, dword [esp]
sub ebx, dword [esp]
std
cld
jge 0x5efd15
jnp 0x5efd10
jl 0x5efd15
add eax, 0x4d8b0794
or byte [ecx - 1], dl
push ebp
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10499058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104991a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1049907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049906a
add dl, dl
jne 0x10499089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104990dc
xor eax, eax
add dl, dl
jne 0x10499096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049917d
add dl, dl
jne 0x104990a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104990b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104990bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104990c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104990d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10499075
mov eax, 1
add dl, dl
jne 0x104990ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104990f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104990e1
sub eax, ebx
mov ebx, 1
jne 0x10499128
mov ecx, 1
add dl, dl
jne 0x1049910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10499119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10499105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10499075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1049913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1049914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10499136
cmp eax, 0x7d00
jae 0x1049916d
cmp eax, 0x500
jb 0x10499168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10499075
cmp eax, 0x7f
ja 0x10499170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10499075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1049919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10499075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10