joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56549c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00569ce1
add esp, 0xc
test dword [esp + 0x10], ebx
lea eax, [eax]
rol edi, 0x1d
ror edi, 0x1d
dec edx
inc edx
jns 0x5654e7
pushf
lea ebx, [ebx + 0x6dbb]
lea ebx, [ebx - 0x6dbb]
shr esp, 0
shl esi, 0
and eax, 0xffffffff
popf
jb 0x5654e0
jp 0x5654e2
jle 0x5654e4
js 0x5654e7
call 0x453e9ab1
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0
jle 0x56551d
jb 0x565523
nop
jae 0x565523
mov ebx, 0x80e84d8a
jmp 0xe8a3dd2d
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
xor ecx, dword [esp]
xor ecx, dword [esp]
add eax, 0x143f
sub eax, 0x143f
stc
jb 0x5655a3
jbe 0x5655a0
jae 0x5655a3
mov esi, 0xa6a0e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0056fc48
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5655b8
xor eax, eax
jmp 0x565831
sub esp, 0
add esi, 0x7d01
sub esi, 0x7d01
add edx, dword [esp]
sub edx, dword [esp]
js 0x5655cf
jnp 0x5655dc
jb 0x5655d3
jae 0x5655d5
jae 0x5655d7
lea edx, [edx]
jp 0x5655dc
lcall 0x558b, 0x51e84d8d
clc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0056fc6b
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00569ce1
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x565609
xor eax, eax
jmp 0x565831
ror esp, 0
jg 0x56560e
jae 0x565610
jbe 0x565620
pushf
jns 0x565616
xor esp, 0
popf
ja 0x56561d
ja 0x565620
ljmp 0xece8:0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00568715
add esp, 4
push 0xd
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00569ce1
add esp, 0xc
rol ecx, 0x11
rol ecx, 0xf
call fcn.00565647
Function at 0x56879c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00569ce1
add esp, 0xc
not edx
not edx
jbe 0x5687cf
pushf
rol ecx, 0
cmp edx, dword [esp]
rol ecx, 0xb
ror ecx, 0xb
popf
nop
ja 0x5687cf
mov edx, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
jne 0x568809
shl eax, 0
lea ebx, [ebx]
jo 0x568817
je 0x568812
lea ecx, [ecx]
jno 0x568817
lcall 0x1e9, 0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
shl ecx, 0
rol edx, 0xb
rol edx, 0x15
lea edx, [edx]
jno 0x5688a7
pushf
jnp 0x568899
test eax, 0x1190
popf
xchg ecx, ebx
xchg ecx, ebx
jo 0x5688a7
jmp 0xca2593
call fcn.0056fc48
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5688ba
jmp 0x568942
and esp, 0xffffffff
shr ecx, 0
cmp esi, dword [esp + 8]
jle 0x5688d1
mov esp, esp
lea esp, [esp]
jne 0x5688cd
jg 0x5688d1
xor eax, 0xe8558d9a
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0056fc6b
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00569ce1
add esp, 0xc
test ecx, edx
jmp 0x5688f5
call fcn.005688fa
Function at 0x568c87
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00569ce1
add esp, 0xc
push esi
pop esi
xchg ecx, ecx
jnp 0x568cc3
pushf
add ecx, 0x669c
sub ecx, 0x669c
dec edi
inc edi
xchg esi, esi
popf
jne 0x568cbc
lea eax, [eax]
xchg ebx, ebx
jp 0x568cc3
mov esp, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
mov ebx, ebx
je 0x568d3a
pushf
cmp edi, 0x7fab
jl 0x568d19
xor esi, 0x4086
xor esi, 0x4086
popf
jmp 0x568d29
lea eax, [eax + 0x59de]
lea eax, [eax - 0x59de]
lea esi, [esi]
jne 0x568d3a
sub eax, 0x80e44d8a
jmp 0xe4a41544
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0056fc48
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x568de8
xor eax, eax
jmp 0x568e58
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0056fc6b
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00569ce1
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x568e56
nop
xchg ecx, ecx
lea esp, [esp]
js 0x568e1d
mov ecx, ecx
jge 0x568e1a
jns 0x568e1d
sub eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00568715
add esp, 4
shl ebx, 0
jbe 0x568e2e
jb 0x568e30
or esi, 0
js 0x568e3d
jl 0x568e37
js 0x568e39
jns 0x568e3d
xor eax, 0x18558b9b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x568e58
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x5690a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00569ce1
add esp, 0xc
inc ecx
dec ecx
add esp, 0
and esp, 0xffffffff
jp 0x5690df
pushf
shr esi, 0
test ecx, 0x734d
cmp edx, ecx
xchg esp, esp
popf
nop
jnp 0x5690df
mov edx, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0056fc48
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5691a7
xor eax, eax
jmp 0x569226
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0056fc6b
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00569ce1
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x5691d1
xor eax, eax
jmp 0x569226
xor esi, dword [esp + 8]
xor esi, dword [esp + 8]
lea ecx, [ecx]
or eax, 0
ja 0x5691fa
pushf
rol ebx, 0x1f
rol ebx, 1
xchg edx, ecx
xchg edx, ecx
test dword [esp + 0x10], ebx
popf
mov esp, esp
mov esp, esp
ja 0x5691f7
jbe 0x5691fa
mov edx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00568715
add esp, 4
jno 0x569208
lea esp, [esp]
cmp ecx, dword [esp]
jo 0x56921b
xchg edi, eax
xchg edi, eax
jge 0x569214
mov esi, esi
jg 0x569218
jno 0x56921b
add eax, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x569262
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00569ce1
add esp, 0xc
shl esp, 0
cmp esi, dword [esp + 0xc]
jmp 0x569284
jp 0x569286
jb 0x56928d
jmp 0x56928a
jae 0x56928d
mov edx, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
not edi
not edi
ror esi, 9
ror esi, 0x17
cmc
jbe 0x5692e2
jbe 0x5692dc
xchg esi, esi
ja 0x5692e2
add eax, 0xec4d8a19
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.005775b8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x569376
xor eax, eax
jmp 0x5693d6
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0056fc6b
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00569ce1
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x5693d4
shr esp, 0
ror edi, 0x14
ror edi, 0xc
lea ecx, [ecx]
ja 0x5693b2
jnp 0x5693ab
lea ebx, [ebx]
jo 0x5693af
jbe 0x5693b2
mov ecx, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00568715
add esp, 4
xchg ebx, ebx
or esp, 0
jg 0x5693cb
ja 0x5693c7
jle 0x5693cb
mov ecx, 0x8558b9a
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x5693d6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x56d1aa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00569ce1
add esp, 0xc
cmp ecx, esi
xor edx, 0
jge 0x56d1e3
pushf
nop
je 0x56d1d6
jp 0x56d1d8
popf
mov ebx, ebx
jns 0x56d1de
xchg esi, eax
xchg esi, eax
jl 0x56d1e3
mov ebp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
xor ecx, 0
and edx, 0xffffffff
jne 0x56d2a2
pushf
jo 0x56d298
or esp, 0
popf
jg 0x56d29f
je 0x56d2a2
mov esp, 0x29a1e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0056fc48
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x56d2b7
xor eax, eax
jmp 0x56d344
stc
lea ecx, [ecx + 0x4a25]
sub ecx, 0x4a25
shl edi, 0
xchg ebx, edi
xchg ebx, edi
je 0x56d2d6
xchg ecx, ecx
jp 0x56d2d1
mov esi, esi
jne 0x56d2d6
mov ebp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0056fc6b
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00569ce1
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x56d300
xor eax, eax
jmp 0x56d344
push eax
add eax, 0x44a1
ror eax, 0xe
pop eax
shr ebx, 0
je 0x56d31b
nop
ja 0x56d312
jl 0x56d314
jae 0x56d316
jne 0x56d31b
mov edi, 0x558b8e62
cld
mov edx, dword [ebp - 4]
push edx
call fcn.00568715
add esp, 4
test esp, 0x1bb4
and esp, 0xffffffff
push eax
pop eax
jge 0x56d339
jb 0x56d336
jl 0x56d339
call 0x506318c8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x56e1d1
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x55eb80
call fcn.0058cb0e
add esp, 0xc
mov byte [0x55eb80], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x56e521
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x55f184], 1
je 0x56e55f
test ecx, 0x6a4b
test eax, edi
xor ecx, 0x6092
xor ecx, 0x6092
cmp esi, ecx
jb 0x56e555
xchg ecx, ecx
xchg ecx, eax
xchg ecx, eax
jo 0x56e551
jae 0x56e555
call 0xf1db8677
push ebp
add byte [ecx + 0x1bebfc45], cl
mov eax, dword [0x55f184]
mov dword [ebp - 4], eax
jmp 0x56e57a
or eax, 0
jno 0x56e573
pushf
xchg edi, edi
jb 0x56e56a
popf
jb 0x56e56e
lea eax, [eax]
jo 0x56e573
mov esp, 0x3e9c033
add al, byte [eax]
add ch, dh
xor eax, eax
jmp 0x56e77d
cmc
rol edi, 0x1a
rol edi, 6
clc
js 0x56e59a
pushf
push edi
add edi, 0x342c
ror edi, 9
pop edi
popf
lea edx, [edx]
jne 0x56e597
jns 0x56e59a
sub eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00568715
add esp, 4
push 0xd
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00569ce1
add esp, 0xc
ja 0x56e5b8
shr esp, 0
cmc
jns 0x56e5be
jp 0x56e5c9
xchg esp, esp
js 0x56e5c4
mov eax, eax
jnp 0x56e5c9
sub eax, 0x4de845c6
mov byte [ebp - 0x18], 0x4d
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x7a
mov byte [ebp - 0x17], 0x70
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x16], 0x62
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x10], 0x62
mov byte [ebp - 0x14], 0x4d
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 0xc], 0
add ebx, 0x5de0
sub ebx, 0x5de0
jg 0x56e60b
cmp eax, 0xf32
ja 0x56e62b
pushf
ror edx, 0x1f
rol edx, 0x1f
rol esi, 0
and eax, 0xffffffff
popf
jg 0x56e624
ja 0x56e626
jmp 0x56e628
jbe 0x56e62b
call 0x2d3f2bb9
add dword [eax + 0x4d8ae845], ecx
in eax, dx
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
jbe 0x56e695
call fcn.0056e69a
Function at 0x56fa2e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00569ce1
add esp, 0xc
jle 0x56fa49
and ecx, 0xffffffff
mov edi, edi
jbe 0x56fa59
mov eax, eax
lea ecx, [ecx]
ja 0x56fa59
sub eax, 0x45c6605d
in al, dx
push ebx
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
xor ebx, dword [esp + 0xc]
xor ebx, dword [esp + 0xc]
cmp edx, 0xa1d
jns 0x56faa5
jbe 0x56faa7
je 0x56fab2
jb 0x56faab
xchg esp, esp
jne 0x56fab2
mov eax, 0x4d8aaf91
in al, dx
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0056fc48
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x56fb3f
jmp 0x56fbcb
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0056fc6b
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00569ce1
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x56fbcb
shr esp, 0
shl esi, 0
jne 0x56fb76
jge 0x56fb6f
jp 0x56fb71
je 0x56fb76
mov edx, 0x458b55a6
call 0x8bede3cd
invalid
mov eax, dword [ebp - 0x18]
push eax
call fcn.00568715
add esp, 4
inc esi
dec esi
js 0x56fbb8
pushf
add esi, 0x15c2
sub esi, 0x15c2
lea edx, [edx + 0x21d4]
sub edx, 0x21d4
xor edi, 0x2fa3
xor edi, 0x2fa3
ja 0x56fbae
popf
xchg edx, edx
nop
jge 0x56fbb5
jns 0x56fbb8
add eax, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5706f3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00569ce1
add esp, 0xc
cmp edi, dword [esp + 0xc]
dec edx
inc edx
clc
jo 0x570737
pushf
jno 0x570720
xor eax, 0
ja 0x570725
push ecx
add ecx, 0x3bb6
ror ecx, 0x1f
pop ecx
popf
mov esp, esp
jno 0x570737
mov esp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
and eax, eax
mov esp, esp
rol eax, 0x1d
ror eax, 0x1d
je 0x570784
pushf
lea eax, [eax]
mov esi, esi
popf
lea eax, [eax]
jp 0x57077f
mov ecx, ecx
jne 0x570784
mov ebx, 0x80f04d8a
jmp 0xf0a48f8e
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jo 0x5707e6
jp 0x5707ed
jnp 0x5707ea
jnp 0x5707ed
sub eax, 0x6dc6e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.005775b8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5707ff
xor eax, eax
jmp 0x570837
cmp esi, ecx
xchg esp, esp
jo 0x570814
pushf
je 0x570809
xchg ebx, ecx
xchg ebx, ecx
popf
jmp 0x570811
jno 0x570814
add eax, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0056fc6b
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00569ce1
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret