joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x5530ff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0056bf6f
add esp, 0xc
rol ecx, 0x19
ror ecx, 0x19
jbe 0x553120
xchg esp, esp
jp 0x553142
pushf
jns 0x553128
ror ebx, 5
ror ebx, 0x1b
xor eax, dword [esp]
xor eax, dword [esp]
or ecx, 0
popf
jne 0x55313b
xchg esp, esp
jp 0x55313f
jnp 0x553142
call 0x493d770c
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
cmp ecx, dword [esp]
mov ecx, ecx
jo 0x553198
jae 0x553193
je 0x553195
jno 0x553198
add eax, 0x80e84d8a
jmp 0xe8a2b9a2
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.0056bf9e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x553241
xor eax, eax
jmp 0x5532d0
js 0x553243
jge 0x55324f
js 0x553247
xchg edi, eax
xchg edi, eax
jle 0x55324b
jl 0x55324f
mov edx, 0xe8458d9e
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0055bb1d
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0056bf6f
add esp, 0xc
xchg ecx, ecx
jnp 0x553285
lea edi, [edi + 0x5974]
lea edi, [edi - 0x5974]
jae 0x553281
nop
jp 0x553285
ljmp 0x475:0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x55328f
xor eax, eax
jmp 0x5532d0
jle 0x553291
ror ebx, 0x1c
rol ebx, 0x1c
xor ebx, esi
xor ebx, esi
jb 0x5532ab
pushf
add ebx, 0
popf
xchg edi, edi
js 0x5532a8
jae 0x5532ab
xor eax, 0x50e4458b
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00554323
add esp, 4
jo 0x5532b9
ja 0x5532cd
mov edi, edi
lea edi, [edi + 0x611d]
lea edi, [edi - 0x611d]
jbe 0x5532cd
mov ecx, 0xe455ff87
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55c477
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0056bf6f
add esp, 0xc
call 0x55c495
add esp, 4
call 0x55c49d
add esp, 4
je 0x55c4a8
jle 0x55c4a4
jne 0x55c4a8
xor eax, 0xf445c6af
push ebx
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
xor ecx, 0x3899
xor ecx, 0x3899
lea ebx, [ebx]
mov ebx, ebx
jae 0x55c4fd
xchg esp, esp
lea ecx, [ecx + 0x7bc3]
lea ecx, [ecx - 0x7bc3]
jb 0x55c4fa
jb 0x55c4fd
jmp 0x814a128b
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
nop
cmp esi, dword [esp + 8]
shl esi, 0
jl 0x55c57a
pushf
jle 0x55c56b
xor edi, 0
shl edi, 0
mov ebx, ebx
popf
jae 0x55c577
jge 0x55c57a
mov ebx, 0xfa7fe8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x56bffe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x55c592
mov eax, 1
jmp 0x55c62c
dec esi
inc esi
jb 0x55c596
je 0x55c5aa
pushf
jge 0x55c59c
test dword [esp], ecx
popf
jb 0x55c5a3
mov edx, edx
jle 0x55c5a7
jne 0x55c5aa
or dword [ebp - 0x74af0bbb], 0xe851f04d
cmc
invalid
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0055bb1d
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0056bf6f
add esp, 0xc
add ebx, 0
call 0x55c5d2
lea esp, [esp + 4]
jp 0x55c5d8
xor ebx, ecx
xor ebx, ecx
jle 0x55c5e6
jae 0x55c5e0
jns 0x55c5e2
jg 0x55c5e6
ljmp 0x7500:0xec7d83ee
cmp dword [ebp - 0x14], 0
jne 0x55c5f3
mov eax, 1
jmp 0x55c62c
nop
jg 0x55c609
pushf
xor ecx, dword [esp]
xor ecx, dword [esp]
je 0x55c600
popf
js 0x55c604
lea esi, [esi]
jle 0x55c609
mov edx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00554323
add esp, 4
jb 0x55c617
nop
xor esp, 0
js 0x55c61d
jle 0x55c625
je 0x55c621
jg 0x55c625
call 0x8a35186
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x55e078
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0056bf6f
add esp, 0xc
test dword [esp], ebx
cmp eax, 0x1cbf
jae 0x55e0b4
pushf
jnp 0x55e09f
xor edx, dword [esp]
xor edx, dword [esp]
jp 0x55e0a7
popf
ja 0x55e0ab
jge 0x55e0ad
xchg ecx, esi
xchg ecx, esi
jb 0x55e0b4
mov ebp, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
dec edi
inc edi
lea edx, [edx + 0x5a1c]
sub edx, 0x5a1c
shl edi, 0
jo 0x55e104
jmp 0x55e101
jno 0x55e104
add eax, 0x80f44d8a
jmp 0xf4a3690e
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
xor edi, 0x2dcc
xor edi, 0x2dcc
jnp 0x55e190
xchg ecx, esi
xchg ecx, esi
mov ecx, ecx
jge 0x55e18b
lea ebx, [ebx]
jp 0x55e190
mov esi, 0xde09e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.0056bf9e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x55e1a3
jmp 0x55e261
shr ecx, 0
not edi
not edi
cmp eax, esi
jo 0x55e1ae
je 0x55e1c1
lea esi, [esi + 0x60cc]
lea esi, [esi - 0x60cc]
jmp 0x55e1be
jne 0x55e1c1
mov eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0055bb1d
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0056bf6f
add esp, 0xc
xchg ebx, ebx
cmp eax, dword [esp]
jne 0x55e1f9
pushf
jbe 0x55e1ec
xor edi, 0
cmp edx, dword [esp]
popf
xchg esp, esp
je 0x55e1f9
add eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x55e201
jmp 0x55e261
neg ebx
neg ebx
je 0x55e207
shl eax, 0
cmp esi, ebx
jbe 0x55e231
pushf
jno 0x55e212
ror ecx, 0x15
ror ecx, 0xb
and eax, eax
lea esi, [esi + 0x3be2]
lea esi, [esi - 0x3be2]
popf
jo 0x55e22a
xchg edx, eax
xchg edx, eax
mov ecx, ecx
ja 0x55e231
ljmp 0xe9e8:0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00554323
add esp, 4
xor eax, edi
xor eax, edi
jge 0x55e243
add esi, 0
ja 0x55e25a
pushf
jge 0x55e24c
jae 0x55e24e
or ebx, ebx
rol ecx, 1
ror ecx, 1
popf
nop
jbe 0x55e25a
mov edx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x55e506
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0056bf6f
add esp, 0xc
mov esp, esp
ror esp, 0
jle 0x55e526
jae 0x55e542
pushf
cmp ebx, dword [esp]
lea eax, [eax + 0x5f00]
lea eax, [eax - 0x5f00]
popf
jmp 0x55e53d
xchg edi, edi
jb 0x55e542
add eax, 0x52e445c6
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
xor edx, ebx
xor edx, ebx
inc ecx
dec ecx
add esi, 0x11de
sub esi, 0x11de
jbe 0x55e5a7
xchg edx, edx
ja 0x55e5a7
mov esi, 0x80e44d8a
jmp 0xe4a36db1
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
rol edi, 0xa
rol edi, 0x16
and eax, 0xffffffff
mov esi, esi
jge 0x55e65c
lea eax, [eax]
jae 0x55e654
ja 0x55e656
xchg edx, eax
xchg edx, eax
jl 0x55e65c
add eax, 0xd99de8ba
add byte [eax], al
call 0x56bffe
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x55e671
xor eax, eax
jmp 0x55e728
add esi, dword [esp]
sub esi, dword [esp]
dec ebx
inc ebx
xor ebx, dword [esp]
xor ebx, dword [esp]
jno 0x55e69e
pushf
jbe 0x55e685
call fcn.0055e68a
Function at 0x55f0ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0056bf6f
add esp, 0xc
xor esi, 0x7d68
xor esi, 0x7d68
jnp 0x55f11f
jle 0x55f11a
jmp 0x55f11c
jp 0x55f11f
lcall 0x45c6, 0x4ef045c6
cmc
push 0x66f145c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
jge 0x55f151
add ecx, 0
jl 0x55f164
lea esp, [esp]
jg 0x55f15b
xchg edx, edx
xchg esi, esi
jge 0x55f164
jmp 0x4de0cf9e
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jo 0x55f1c6
cmp esp, 0x4521
xor edi, eax
xor edi, eax
jno 0x55f1d2
jns 0x55f1e1
xchg edi, ecx
xchg edi, ecx
jo 0x55f1da
xchg edx, esi
xchg edx, esi
js 0x55f1e1
sub eax, 0x2d88
call fcn.00561f6e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x55f1f3
xor eax, eax
jmp 0x55f22f
std
cld
jb 0x55f20c
pushf
add ecx, dword [esp]
sub ecx, dword [esp]
rol edi, 0
shl esp, 0
popf
jo 0x55f209
jae 0x55f20c
mov esi, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0055bb1d
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0056bf6f
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x569b88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xb
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0056bf6f
add esp, 0xc
std
cld
jg 0x569ba5
shr eax, 0
je 0x569baf
ja 0x569bac
jne 0x569baf
mov eax, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x6a
mov byte [ebp - 0x11], 0x57
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6f
jne 0x569bdd
test dword [esp], eax
jge 0x569bef
jnp 0x569be4
jbe 0x569be6
xchg ecx, edx
xchg ecx, edx
jl 0x569bec
jl 0x569bef
add eax, 0x80ec4d8a
jmp 0xeca423f9
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
ror ebx, 7
ror ebx, 0x19
jbe 0x569c5e
pushf
cmp edi, esi
cmp edx, eax
popf
xchg ecx, edi
xchg ecx, edi
nop
ja 0x569c5e
mov edx, 0x233be8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0056bf9e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x569c73
xor eax, eax
jmp 0x569d23
xchg esi, ebx
xchg esi, ebx
jmp 0x569c79
jp 0x569c8f
pushf
mov ebx, ebx
shr edx, 0
jne 0x569c84
popf
jns 0x569c88
mov ebx, ebx
js 0x569c8c
jnp 0x569c8f
mov esi, 0x52ec558d
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0055bb1d
mov dword [ebp - 4], eax
push 0xb
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0056bf6f
add esp, 0xc
xchg edx, edi
xchg edx, edi
push edx
pop edx
rol esi, 7
rol esi, 0x19
jle 0x569cdb
pushf
jge 0x569cc1
sub esp, 0
cmp esp, 0x36fa
popf
lea edx, [edx + 0x31f2]
lea edx, [edx - 0x31f2]
jg 0x569cdb
ljmp 0x475:0xfc7d83
cmp dword [ebp - 4], 0
jne 0x569ce5
xor eax, eax
jmp 0x569d23
dec eax
inc eax
shr esp, 0
nop
jbe 0x569cf4
jo 0x569cef
lea ecx, [ecx]
ja 0x569cf4
or dword [ebx - 0x17ad03ab], 0xfffea626
mov edx, dword [ebp - 4]
push edx
call fcn.00554323
add esp, 4
test edi, 0x42f0
jle 0x569d08
ja 0x569d0a
lea esi, [esi + 0x2975]
lea esi, [esi - 0x2975]
jnp 0x569d20
xchg edx, edx
xchg esp, esp
jp 0x569d20
mov esp, 0xfc55ff6f
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56f0c1
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x54f8b0
call fcn.00561c3c
add esp, 0xc
mov byte [0x54f8b0], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x56f656
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0056bf6f
add esp, 0xc
cmc
stc
jl 0x56f685
pushf
shr ebx, 0
xor eax, edx
xor eax, edx
popf
jp 0x56f680
xchg edi, edi
jge 0x56f685
mov edx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
xchg esp, esp
dec edi
inc edi
test eax, 0x60d0
sub edx, 0
jns 0x56f6d2
jnp 0x56f6c9
je 0x56f6cb
lea esi, [esi]
js 0x56f6d2
ljmp 0x80e8:0x4d8a40e0
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
cmc
xor ebx, dword [esp + 4]
xor ebx, dword [esp + 4]
or ecx, ecx
jne 0x56f756
lea edi, [edi + 0x5acc]
lea edi, [edi - 0x5acc]
je 0x56f756
call 0x1f3b42
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.0056bf9e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x56f76b
xor eax, eax
jmp 0x56f7f3
lea esi, [esi]
nop
call 0x56f773
lea esp, [esp + 4]
js 0x56f77e
lea ecx, [ecx]
jns 0x56f77e
mov esp, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0055bb1d
mov dword [ebp - 4], eax
cmc
or esi, esi
js 0x56f79a
lea esp, [esp]
jns 0x56f79a
add eax, 0x6a0d6a49
add byte [ebp - 0x17af17bb], cl
enter 0xffffffffffffffc7, 0xffffffffffffffff
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0056bf6f
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x56f7b4
xor eax, eax
jmp 0x56f7f3
xor esp, 0
jnp 0x56f7c4
mov ebx, ebx
mov edi, edi
mov edi, edi
xchg ebx, eax
xchg ebx, eax
jp 0x56f7c4
add eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00554323
add esp, 4
shl ebx, 0
mov ebx, ebx
sub esp, 0
neg edi
neg edi
jne 0x56f7f0
nop
lea esi, [esi]
lea esi, [esi + 0x636d]
lea esi, [esi - 0x636d]
je 0x56f7f0
mov eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret