joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56dbb6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
jbe 0x56dc24
ja 0x56dc24
call 0x813b29b2
jmp 0xe4a4642e
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0057f472
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x56dcd2
xor eax, eax
jmp 0x56dd29
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0057a424
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x56dd27
jne 0x56dcfd
je 0x56dcfd
jge 0x56dc89
mov ecx, dword [ebp - 4]
dec ebp
cld
push ecx
call fcn.005762d0
add esp, 4
jp 0x56dd0e
jnp 0x56dd0e
call 0x526f329d
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x56dd29
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x56dfc5
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x55ff08
call fcn.00570186
add esp, 0xc
mov byte [0x55ff08], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x56e57e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f8d8]
mov byte [edx], al
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 4]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x55f8d8]
mov byte [eax + 4], cl
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 8]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x55f8d8]
mov byte [ecx + 8], dl
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0xc]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f8d8]
mov byte [edx + 0xc], al
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 1]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x55f8d8]
mov byte [eax + 5], cl
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0xd]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x55f8d8]
mov byte [ecx + 1], dl
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 9]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f8d8]
mov byte [edx + 0xd], al
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 5]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x55f8d8]
mov byte [eax + 9], cl
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 2]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x55f8d8]
mov byte [ecx + 0xa], dl
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0xa]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f8d8]
mov byte [edx + 2], al
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 6]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x55f8d8]
mov byte [eax + 0xe], cl
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0xe]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x55f8d8]
mov byte [ecx + 6], dl
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 3]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f8d8]
mov byte [edx + 0xf], al
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 7]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x55f8d8]
mov byte [eax + 3], cl
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0xb]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x55f8d8]
mov byte [ecx + 7], dl
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0xf]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f8d8]
mov byte [edx + 0xb], al
pop ebp
ret
Function at 0x56e7c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov byte [ebp - 8], 0
jbe 0x56e7d2
ja 0x56e7d2
call 0xc10140
push 0x19
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.005725aa
add esp, 0xc
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x21], 0x62
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x6d
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x46
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x6a
jmp 0x56e88c
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x47
out dx, al
inc edi

Function at 0x56fd90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc dword [ebx], ebp
ret 0xdeb
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
jne 0x56fded
je 0x56fded
jne 0x56fd78
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jp 0x56fe52
dec ebp
invalid
jnp 0x56fe52
xor eax, 0xff8c33e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.00568a8a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x56fe64
xor eax, eax
jmp 0x56fe8c
jo 0x56fe69
jno 0x56fe69
call 0x514743fa
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0057a424
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.005725aa
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5702e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
jbe 0x57034a
ja 0x57034a
call 0x814350d8
jmp 0xeca48b54
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0057f472
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5703d4
ljmp 0x458a:0xed558801
jmp 0x570423
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0057a424
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005725aa
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x570423
jne 0x5703ff
je 0x5703ff
js 0x57038b
mov eax, dword [ebp - 0x18]
push eax
call fcn.005762d0
inc ebp
call 0x5f1fec56
add byte [eax], al
add esp, 4
jp 0x570410
jnp 0x570410
call 0x516b519f
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x570618
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f7d8]
mov byte [edx], al
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 4]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x55f7d8]
mov byte [eax + 4], cl
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 8]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x55f7d8]
mov byte [ecx + 8], dl
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0xc]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f7d8]
mov byte [edx + 0xc], al
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 1]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x55f7d8]
mov byte [eax + 0xd], cl
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 5]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x55f7d8]
mov byte [ecx + 1], dl
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 9]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f7d8]
mov byte [edx + 5], al
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0xd]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x55f7d8]
mov byte [eax + 9], cl
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 2]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x55f7d8]
mov byte [ecx + 0xa], dl
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0xa]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f7d8]
mov byte [edx + 2], al
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 6]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x55f7d8]
mov byte [eax + 0xe], cl
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0xe]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x55f7d8]
mov byte [ecx + 6], dl
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 3]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f7d8]
mov byte [edx + 7], al
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0xf]
mov eax, dword [ebp + 8]
mov cl, byte [edx + 0x55f7d8]
mov byte [eax + 3], cl
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0xb]
mov ecx, dword [ebp + 8]
mov dl, byte [eax + 0x55f7d8]
mov byte [ecx + 0xf], dl
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 7]
mov edx, dword [ebp + 8]
mov al, byte [ecx + 0x55f7d8]
mov byte [edx + 0xb], al
pop ebp
ret
Function at 0x570fdf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax + 0xc], ecx
mov dword [ebp - 0x18], 0
jmp 0x571043
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xa
jge 0x5710fa
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 3]
and ecx, 0xff
xor edx, edx
mov dl, byte [ecx + 0x55f7d8]
mov eax, dword [ebp - 0x18]
xor edx, dword [eax*4 + 0x55fdd8]
mov cl, byte [ebp - 0x10]
xor cl, dl
mov byte [ebp - 0x10], cl
mov edx, dword [ebp - 2]
and edx, 0xff
mov al, byte [ebp - 0xf]
xor al, byte [edx + 0x55f7d8]
mov byte [ebp - 0xf], al
mov ecx, dword [ebp - 1]
and ecx, 0xff
mov dl, byte [ebp - 0xe]
xor dl, byte [ecx + 0x55f7d8]
mov byte [ebp - 0xe], dl
mov eax, dword [ebp - 4]
and eax, 0xff
mov cl, byte [ebp - 0xd]
xor cl, byte [eax + 0x55f7d8]
mov byte [ebp - 0xd], cl
mov edx, dword [ebp - 0xc]
xor edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
jmp 0x57103a
mov esp, ebp
pop ebp
ret
Function at 0x5710fe
Capabilities:
Contain obfuscated stackstrings
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005725aa
add esp, 0xc
jl 0x57111c
jge 0x57111c
call 0x584356e6
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 9], 0x64
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 8], 0
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xb], 0x6d
jne 0x571155
je 0x571155
jl 0x5710e0
mov cl, byte [ebp - 0x14]
dec ebp
in al, dx
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0057f472
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5711cf
xor eax, eax
jmp 0x57122a
cmp dword [esp + 4], 0x1770376
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0057a424
mov dword [ebp - 0x18], eax
push 0xd
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x571201
xor eax, eax
jmp 0x57122a
jl 0x571206
jge 0x571206
call 0x523f5f95
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.005762d0
add esp, 4
jne 0x571217
je 0x571217
call 0x526b67a6
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x571bad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005725aa
add esp, 0xc
jo 0x571bcb
jno 0x571bcb
call 0x453f6195
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
jne 0x571c1c
je 0x571c1c
call 0x813f69aa
jmp 0xe8a4a426
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
jb 0x571cbd
jae 0x571cbd
aaa
call fcn.0056bab8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x571ccf
xor eax, eax
jmp 0x571d1b
jl 0x571cd4
jge 0x571cd4
call 0x523f6a65
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0057a424
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x571cfe
xor eax, eax
jmp 0x571d1b
jb 0x571d03
jae 0x571d03
call 0x523b6a92
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005762d0
add esp, 4
jo 0x571d14
jno 0x571d14
call 0x525f72a3
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x574011
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005725aa
add esp, 0xc
jbe 0x57402f
ja 0x57402f
mov ah, 0xc6
inc ebp
call 0xe99d067e
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xe], 0x55
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x4a
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0
cmp dword [esp + 8], 0x1740375
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
call fcn.0057f472
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x574131
add dword [eax + 0x558aeb4d], ecx
invalid
xor eax, eax
jmp 0x57417c
jne 0x574136
je 0x574136
call 0x523f8ec7
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0057a424
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005725aa
add esp, 0xc
mov ecx, fcn.00574011
test ecx, ecx
je 0x57417a
jle 0x574164
jg 0x574164
jmp 0x5740f0
mov edx, dword [ebp - 0x1c]
push edx
call fcn.005762d0
add esp, 4
jo 0x574175
jno 0x574175
call 0xec3b9778
add dh, byte [ebx]
rcr byte [edi + 0x5e], 0x5b
call dword [ebp - 0x1c]
jmp 0x57417c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret