joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c772
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e97
add esp, 0xc
mov esi, esi
je 0x45c7a5
mov ebx, ebx
jl 0x45c793
lea edi, [edi + 0x22be]
lea edi, [edi - 0x22be]
je 0x45c7a1
jne 0x45c7a5
mov esi, 0xec45c6fd
inc esp
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
and ecx, ecx
jl 0x45c7de
jmp 0x45c7db
jge 0x45c7de
call 0x8132156c
jmp 0xec934fe8
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004423e4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45c853
xor eax, eax
jmp 0x45c8e9
dec eax
inc eax
jne 0x45c857
sub esp, 0
clc
jge 0x45c86c
pushf
jge 0x45c861
push edx
pop edx
popf
xchg esi, esi
js 0x45c869
jl 0x45c86c
add eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0044ec8a
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x45c896
xor eax, eax
jmp 0x45c8e9
mov esp, esp
push ecx
add ecx, 0x28e5
ror ecx, 2
pop ecx
and eax, eax
xor ecx, 0x3689
xor ecx, 0x3689
je 0x45c8bc
lea esi, [esi]
xchg edx, edx
mov esp, esp
jne 0x45c8bc
or dword [ebx - 0x17af03bb], 0xffff0458
mov eax, dword [ebp - 4]
push eax
call fcn.0044cd1d
add esp, 4
jl 0x45c8ca
jno 0x45c8cc
jbe 0x45c8e2
pushf
test edi, ebx
cmp esp, 0x1dab
xor esp, 0
popf
jmp 0x45c8df
ja 0x45c8e2
mov ecx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4617bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x437bd4], 1
jne 0x461939
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00464e97
add esp, 0xc
xor edx, ebx
xor edx, ebx
cmp ebx, 0x49ee
jns 0x4617ff
jge 0x4617f0
lea ecx, [ecx + 0x16e6]
lea ecx, [ecx - 0x16e6]
js 0x4617ff
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
nop
je 0x461832
jp 0x461834
jae 0x461849
pushf
xor edi, dword [esp + 4]
xor edi, dword [esp + 4]
popf
jge 0x461844
jl 0x461846
jb 0x461849
mov edx, 0x80e84d8a
jmp 0xe893a053
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.004423e4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4618be
xor eax, eax
jmp 0x4619ac
shr edi, 0
jge 0x4618d5
pushf
dec ebx
inc ebx
jle 0x4618c9
lea esp, [esp]
popf
mov esp, esp
mov eax, eax
jl 0x4618d5
ljmp 0x4d8b:0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0044ec8a
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00464e97
add esp, 0xc
cmp ecx, edi
or edi, 0
std
cld
and esp, 0xffffffff
jne 0x461923
pushf
ror esp, 0
mov edi, edi
add ecx, 0x7270
sub ecx, 0x7270
xor esi, edx
xor esi, edx
popf
jp 0x46191c
mov esp, esp
jne 0x461920
je 0x461923
add eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0x461933
mov eax, dword [ebp - 8]
mov dword [0x437bd4], eax
jmp 0x461937
xor eax, eax
jmp 0x4619ac
jmp 0x461942
mov ecx, dword [0x437bd4]
mov dword [ebp - 8], ecx
rol esp, 0
jae 0x461947
test esp, 0x1467
jmp 0x46194f
jns 0x46196a
pushf
js 0x461955
nop
nop
popf
lea edx, [edx + 0x23bd]
lea edx, [edx - 0x23bd]
xchg esi, esi
js 0x46196a
mov ebp, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
ja 0x461972
and esp, 0xffffffff
xor ecx, 0
test esp, 0x3ba1
jb 0x461995
pushf
shl esp, 0
sub esp, 0
jle 0x46198a
popf
jp 0x46198e
jno 0x461990
xchg ebx, ebx
jae 0x461995
mov esi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0044cd1d
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4633bf
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x437358
call fcn.0045c8f2
add esp, 0xc
mov byte [0x437358], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x464d08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e97
add esp, 0xc
and esp, 0xffffffff
sub esp, 0
cmp ecx, dword [esp + 8]
jne 0x464d3a
pushf
jno 0x464d31
test eax, edx
popf
jmp 0x464d37
je 0x464d3a
add eax, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
dec esi
inc esi
cmp esi, dword [esp + 0xc]
je 0x464d88
mov esp, esp
jne 0x464d88
xor eax, 0xec4d8a1f
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.00443028
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x464e1c
xor eax, eax
jmp 0x464e8e
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0044ec8a
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x464e8c
lea edi, [edi + 0x327a]
sub edi, 0x327a
nop
jae 0x464e51
ror edx, 0
je 0x464e5d
jne 0x464e58
lea ebx, [ebx]
jne 0x464e5d
mov ebx, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0044cd1d
add esp, 4
add ecx, 0
jb 0x464e83
jbe 0x464e70
mov esp, esp
lea esi, [esi + 0x6773]
lea esi, [esi - 0x6773]
xchg ebx, ebx
jae 0x464e83
mov edx, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x464e8e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d5c64
Capabilities:
Encode data using xor

Disassembly:
fiadd dword [esi + 0x6dfb0a2c]
mov dh, 0xe9
bound edx, qword [esp + ebx*8]
push 0xd7486900
movsb byte es:[edi], byte [esi]
ror byte [esi], 0x68
out dx, al
lea esp, [ecx + 0x3ffea227]
dec edi
mov word [ebp - 0x1ff91779], gs
invalid

Function at 0x511328
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, 0xf9967ee8
jl 0x51136a
add edx, edi
rcl dword [esi - 0x4e9f7a6b], 0x9c
or byte [ebx + 0x58], 0x42
movsb byte es:[edi], byte [esi]
in al, 0x94
and dword [edi + 0x1485f093], edx
push 0x31
lahf
jo 0x5113b6
mov word [ebx], es
cmpsb byte [esi], byte es:[edi]
adc edi, ebp
test al, 0x37
and byte [esi], bh
div dword [edi + 0x72]
cwde
sub al, bh
add ch, ah
wait
std
pushal
sahf
in al, dx
out 0x8b, al
out 0xd0, eax
jmp 0x5113c7
sbb ch, dl
xor bl, byte [ebp - 5]
sub dh, byte [ebp + 0x43451b76]
add eax, 0xcada5c32
xor bl, byte [edx + ebx*8 - 0x36]
sub bh, byte es:[0x33905b8e]
dec eax
push 0xa26264bb
or edx, dword [ecx]
imul eax, dword [edi + 0x61], 0xdfb290b8
jo 0x511376
wait
sbb esp, ebp
hlt
clc
fcmovbe st(0), st(3)
add al, 0xe
push esp
inc edx
into
xor ecx, ecx
sbb ch, byte [ebp - 0x44]
jecxz 0x51142a
das
or al, 0xc2
invalid
ret 0x9c7
and bh, byte [edx + 0x66]
in al, dx
or eax, 0xe079e0
mov ecx, dword [edi]
or esp, dword [esi]
dec esp
out 0x6a, eax
push esi
mov esi, 0x324a4349
sbb cl, byte [ebx - 0x33149cf]
mov word [ebx + 0x48be4d8a], gs
add ebx, dword [ebx + 1]
sahf
push cs
adc ebx, dword [ebx]
push ebp
invalid
Function at 0x520802
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x520816
jmp 0x520940
jne 0x52081b
je 0x52081b
call 0x895a4daa
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x51aab4], edx
jb 0x520831
jae 0x520831
adc cl, byte [ebx + 0x488bec45]
add al, 0x89
or eax, 0x51aa84
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x51aa84], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x51aa80], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x519248], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x51924c], ecx
jbe 0x520865
ja 0x520865
mov dl, 0xc6
inc ebp
invalid
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jne 0x52089e
je 0x52089e
call 0x81425e2c
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jl 0x52090b
jge 0x52090b
call 0xaad24692
push ecx
add byte [eax], al
cmp dword [0x51aa80], 0
je 0x520928
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x51aa80]
push eax
call fcn.005219b8
mov dword [0x51aab0], eax
cmp dword [esp + 8], 0x1740375
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0052576e
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x520bd6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0052576e
add esp, 0xc
cmp dword [esp + 4], 0x1770376
Function at 0x5218b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0052576e
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cmp dword [esp + 4], 0x1770376
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
jbe 0x521977
ja 0x521977
ljmp 0x8900:0xbd1de8
call fcn.0052d699
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x521989
xor eax, eax
jmp fcn.005219b1
jns 0x52198e

Function at 0x525d2b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0x40
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005276ab
add esp, 0xc
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x5a4d
je 0x525d59
mov eax, 1
jmp 0x525dd9
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x3c], 0
jne 0x525d69
mov eax, 1
jmp 0x525dd9
push 0xf8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.005276ab
add esp, 0xc
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0x4550
je 0x525d96
mov eax, 1
jmp 0x525dd9
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x14c
je 0x525dae
mov eax, 1
jmp 0x525dd9
mov edx, dword [ebp + 0x10]
xor eax, eax
mov ax, word [edx + 0x16]
and eax, 0x1000
test eax, eax
je 0x525dc7
mov eax, 1
jmp 0x525dd9
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x74], 0x10
jbe 0x525dd7
mov eax, 1
jmp 0x525dd9
xor eax, eax
pop ebp
ret
Function at 0x52d098
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dword [eax + 0x4d8aef45], ecx
hlt
invalid
les eax, [eax + esi*2]
add esi, dword [ecx + 1]
jmp 0x52d010
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0052576e
add esp, 0xc
jne 0x52d0b6
je 0x52d0b6
jbe 0x52d07d
mov byte [ebp - 0x14], 0x53
inc ebp
in al, dx
push ebx
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x62
mov byte [ebp - 0xd], 0x4e
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 9], 0x79
mov byte [ebp - 8], 0
jne 0x52d0ef
je 0x52d0ef
jmp 0x52d07a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
jp 0x52d15c
inc ebp
invalid
jnp 0x52d15c
call fcn.00580a48
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.0052d699
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x52d16e
xor eax, eax
jmp 0x52d1c4
jbe 0x52d173
ja 0x52d173
call 0x523f1f04
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005219b8
mov dword [ebp - 0x18], eax
jo 0x52d188
jno 0x52d188
call 0xbcdef6
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0052576e
add esp, 0xc
jne 0x52d19d
je 0x52d19d
jnp 0x52d121
cmp dword [ebp - 0x18], 0
jne 0x52d1a7
jge 0x52d188
add byte [ebp + 4], dh
xor eax, eax
jmp 0x52d1c4
jne 0x52d1ac
je 0x52d1ac
call 0x523b1f3b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00528ee2
add esp, 4
jle 0x52d1bd
jg 0x52d1bd
call 0x525b274c
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52d265
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0052576e
add esp, 0xc
jo 0x52d283
jno 0x52d283
call 0x453b184d
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
jne 0x52d2d4
je 0x52d2d4
call 0x813b2062
jmp 0xe8a05ade
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
jb 0x52d375
jae 0x52d375
aaa
call fcn.00520949
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x52d387
xor eax, eax
jmp 0x52d3d3
jl 0x52d38c
jge 0x52d38c
call 0x523b211d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005219b8
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0052576e
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x52d3b6
xor eax, eax
jmp 0x52d3d3
jb 0x52d3bb
jae 0x52d3bb
call 0x5237214a
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00528ee2
add esp, 4
jo 0x52d3cc
jno 0x52d3cc
mov edx, dword [ebp + 8]
push edx
Function at 0x52d564
Capabilities:
Contain obfuscated stackstrings

Disassembly:
les eax, [ecx + eax*4]
jl 0x52d56f
or byte [ebp + 3], dh
je 0x52d551
inc ebp
or al, 0x50
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0052576e
add esp, 0xc
jl 0x52d582
jge 0x52d582
call 0x583f1b4c
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 9], 0x64
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 8], 0
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xb], 0x6d
jne 0x52d5bb
je 0x52d5bb
jl 0x52d546
mov cl, byte [ebp - 0x14]
dec ebp
in al, dx
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0052d699
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x52d635
xor eax, eax
jmp 0x52d690
cmp dword [esp + 4], 0x1770376
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005219b8
mov dword [ebp - 0x18], eax
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0052576e
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x52d667
xor eax, eax
jmp 0x52d690
jl 0x52d66c
jge 0x52d66c
call 0x523b23fb
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00528ee2
add esp, 4
jne 0x52d67d
je 0x52d67d
call 0x52672c0c
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10