joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d8c5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40d962
push ebx
push esi
call fcn.0040d88e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040d7d7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40d90f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40d961
push edi
push eax
call fcn.0040e161
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40d92f
call fcn.0040c3e7
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40d960
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040d7d7
add esp, 0x20
test eax, eax
jne 0x40d94e
push edi
call fcn.0040c3e7
jmp 0x40d956
push ebx
call fcn.0040c3e7
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40eb45
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41aee0
push 0x41aed8
push str.FlsAlloc
push 0x1e
call fcn.0040ea63
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40eb79
push dword [ebp + 8]
mov ecx, esi
call dword [0x4191a0]
call esi
jmp 0x40eb7f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ebc3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41aef0
push 0x41aee8
push str.FlsGetValue
push 0x20
call fcn.0040ea63
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ebfa
push dword [ebp + 8]
mov ecx, esi
call dword [0x4191a0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40f40e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], eax
dec dword [ebp + 0x5d88d445]
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
in al, 0x2b
call fcn.0040f007
push eax
push esi
push dword [ebp + 8]
call fcn.0040efbc
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040eff7
jbe 0x40f456
pop ecx
xchg byte [eax - 0x8363], cl
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
Function at 0x40fb72
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040efbc
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
invalid
movsd dword es:[edi], dword [esi]
invalid
cli
invalid
invalid
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401c66
pop dword [ebp - 0x44]
mov eax, 0x92d37320
add eax, 0x6d6ca946
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xce399ac0
add dword [ebp - 0x54], 0x8018aa8b
mov dword [ebp - 0x50], 0x19168955
add dword [ebp - 0x50], 0x191cc2f0
mov dword [ebp - 0x4c], 0x53d4068a
add dword [ebp - 0x4c], 0xf8783da4
mov dword [ebp - 0x48], 0x45498b0c
sub dword [ebp - 0x48], 0x45498b0c
lea eax, [ebp - 0x54]
push eax
mov eax, 0x26800acb
add eax, 0xd9c02589
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x78896b9b
add dword [ebp - 0x54], 0xfbe8fdbb
mov dword [ebp - 0x50], 0xb892991b
add dword [ebp - 0x50], 0x88d9c85a
mov dword [ebp - 0x4c], 0xb8822d85
sub dword [ebp - 0x4c], 0x5512c119
mov dword [ebp - 0x48], 0xc36f3da1
sub dword [ebp - 0x48], 0xc36f3da1
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xe7049beb
sub eax, 0xe6c46bbf
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3510e
push 0
call eax
mov ecx, 0x4257
xor edi, edi
add edi, eax
mov ebx, 0xe38b0d24
sub ebx, 0xe34a9d24
add ebx, dword [ebp - 0x44]
mov esi, 0x87918166
sub esi, 0xb6de0c45
xor dword [ebp - 0x34], 0xdd666fda
mov edx, dword [ebx]
xor dword [ebp - 8], esi
add edx, esi
xor dword [ebp - 0x30], edi
mov dword [edi], edx
xor dword [ebp - 0x20], edx
add edi, 4
add ebx, 0x45ea42a8
sub ebx, 0x45ea42a4
loop 0x401d84
add eax, 0xa649a690
sub eax, 0xa648aa61
mov ebx, eax
add eax, 5
mov ecx, 0xc7b09c60
sub ecx, 0xc7709c60
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x408480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
xor edx, edx
test edi, edi
jne 0x408492
xor eax, eax
pop edi
pop ebp
ret
mov eax, edi
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408498
sub eax, esi
xor esi, esi
test eax, eax
jle 0x4084bf
movsx ecx, byte [esi + edi]
inc esi
add ecx, edx
imul edx, ecx, 0x401
mov ecx, edx
shr ecx, 6
xor edx, ecx
cmp esi, eax
jl 0x4084a7
lea ecx, [edx + edx*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
mov ecx, 1
imul eax, eax, 0x8001
pop esi
pop edi
test eax, eax
cmove eax, ecx
pop ebp
ret
Function at 0x40b380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x40b38c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.0040b3a0

Function at 0x428c00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00440a90

Function at 0x42ceb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 8
call fcn.00652993
add esp, 4
test eax, eax
je 0x42cecf
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
jmp 0x42ced1
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x42cf10
push 0x80000
push 0
call fcn.00655548
add esp, 0x18
cmp eax, 0xffffffff
je 0x42cf02
test eax, eax
je 0x42cf02
push eax
call dword [0x6c4218]
xor eax, eax
mov esp, ebp
pop ebp
ret
call fcn.006554f4
mov eax, dword [eax]
mov esp, ebp
pop ebp
ret

Function at 0x42e280
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
mov eax, dword [ecx + 4]
push dword [ebp + 8]
push dword [eax]
call fcn.0066874d
add esp, 0xc
cdq
pop ebp
ret 0xc

Function at 0x442600
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xc
call fcn.00652993
add esp, 4
test eax, eax
je 0x442625
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
jmp 0x442627
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x442670
push 0x80000
push 0
call fcn.00655548
add esp, 0x18
cmp eax, 0xffffffff
je 0x442658
test eax, eax
je 0x442658
push eax
call dword [0x6c4218]
xor eax, eax
mov esp, ebp
pop ebp
ret
call fcn.006554f4
mov eax, dword [eax]
mov esp, ebp
pop ebp
ret
Function at 0x454aa0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x454ad2
mov eax, dword [edi + 4]
mov al, byte [ecx + eax - 1]
cmp al, 0x5b
je 0x454ad2
cmp al, 0x7b
je 0x454ad2
cmp al, 0x3a
je 0x454ad2
cmp al, 0x2c
je 0x454ad2
push 0x2c
lea ecx, [edi + 4]
call fcn.0042fa60
add edi, 4
push 0x22
mov ecx, edi
call fcn.0042fa60
mov ecx, dword [ebp + 0xc]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
sub ecx, edx
mov dword [ebp - 8], edx
mov dword [ebp + 0xc], ecx
test ecx, ecx
jle 0x454b9c
mov eax, dword [ebp + 8]
dec ecx
inc eax
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
mul ecx
mov ecx, dword [ebp - 4]
push ebx
mov ebx, edx
shr ebx, 1
inc ebx
mov edi, edi
movzx esi, byte [ecx - 1]
movzx eax, byte [ecx]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 1]
shl esi, 8
mov ecx, edi
or esi, eax
mov eax, esi
sar eax, 0x12
movzx eax, byte [eax + 0x97f2c8]
push eax
call fcn.0042fa60
mov eax, esi
mov ecx, edi
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x97f2c8]
push eax
call fcn.0042fa60
mov eax, esi
mov ecx, edi
sar eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x97f2c8]
push eax
call fcn.0042fa60
and esi, 0x3f
mov ecx, edi
movzx eax, byte [esi + 0x97f2c8]
push eax
call fcn.0042fa60
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
dec ebx
jne 0x454b20
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
pop ebx
cmp edx, 1
jne 0x454bd8
mov eax, dword [ebp + 8]
movzx esi, byte [ecx + eax]
mov ecx, edi
shl esi, 0x10
mov eax, esi
sar eax, 0x12
movzx eax, byte [eax + 0x97f2c8]
push eax
call fcn.0042fa60
sar esi, 0xc
mov ecx, edi
and esi, 0x3f
movzx eax, byte [esi + 0x97f2c8]
push eax
call fcn.0042fa60
push 0x3d
jmp 0x454c2a
cmp edx, 2
jne 0x454c3a
mov eax, dword [ebp + 8]
movzx esi, byte [ecx + eax + 1]
movzx eax, byte [ecx + eax]
mov ecx, edi
shl eax, 8
or esi, eax
shl esi, 8
mov eax, esi
sar eax, 0x12
movzx eax, byte [eax + 0x97f2c8]
push eax
call fcn.0042fa60
mov eax, esi
mov ecx, edi
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x97f2c8]
push eax
call fcn.0042fa60
sar esi, 6
and esi, 0x3f
movzx eax, byte [esi + 0x97f2c8]
push eax
mov ecx, edi
call fcn.0042fa60
push 0x3d
mov ecx, edi
call fcn.0042fa60
push 0x22
mov ecx, edi
call fcn.0042fa60
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x46a580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x10
push esi
mov esi, ecx
test edx, edx
je 0x46a621
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 4]
mov eax, dword [ecx - 1]
and eax, 0xffff0000
cmp eax, fcn.00430000
jne 0x46a5d8
mov edi, dword [ebp + 0xc]
add edi, 0xb
add edi, ecx
test edx, edx
jle 0x46a620
movzx eax, byte [edi]
lea edi, [edi + 1]
add eax, dword [esi]
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor eax, ecx
mov dword [esi], eax
dec edx
jne 0x46a5b6
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 0
lea eax, [ecx - 1]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], eax
call fcn.004904c0
test al, al
je 0x46a620
lea ecx, [ecx]
mov eax, dword [esi]
add eax, dword [ebp - 0xc]
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor eax, ecx
lea ecx, [ebp - 0x10]
mov dword [esi], eax
call fcn.004904c0
test al, al
jne 0x46a600
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x480db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004663e0

Function at 0x480ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00466430
Function at 0x5a9a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi + 0x24], 0
jne 0x5a9b00
cmp byte [edi + 0x24], 0
je 0x5a9a8c
movdqu xmm0, xmmword [esi]
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
movdqu xmmword [edi + 0x10], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x20], xmm0
pop edi
pop esi
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edi]
jge 0x5a9b00
push ebx
lea eax, [ecx + ecx*2]
add eax, eax
lea ebx, [esi + 4]
add ebx, eax
add eax, 6
add eax, edi
sub esi, edi
movzx edx, word [eax - 2]
cmp dx, word [ebx]
jne 0x5a9abe
mov cx, word [eax]
cmp cx, word [esi + eax]
jne 0x5a9abe
cmp byte [esi + eax + 2], 0
jne 0x5a9ac2
mov byte [eax + 2], 0
mov cx, word [ebx]
add ebx, 6
and cx, dx
and word [eax], cx
mov word [eax - 2], cx
movzx ecx, cx
and word [esi + eax], cx
movzx ecx, word [esi + eax]
movzx edx, word [eax]
xor ecx, edx
not ecx
and word [eax - 2], cx
movzx ecx, word [eax - 2]
and ecx, edx
mov word [eax], cx
add eax, 6
mov ecx, dword [ebp + 0xc]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, dword [edi]
jl 0x5a9aa5
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x5dc950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0xa470b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 6
call fcn.005b3960
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 7
mov ecx, esi
mov byte [ebp - 9], 0x18
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 0
mov ecx, esi
mov byte [ebp - 9], 0x14
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0
mov ecx, esi
call fcn.005b3ad0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 6
mov ecx, esi
mov byte [ebp - 9], 0x10
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 1
mov ecx, esi
mov byte [ebp - 9], 0xc
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 1
mov ecx, esi
call fcn.005b3ad0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 8
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
push 1
push 0
mov ecx, esi
call fcn.005b4050
push 0
mov ecx, esi
call fcn.005b2560
push 0
mov ecx, esi
call fcn.005b3960
push 2
push 2
mov ecx, esi
call fcn.005b4400
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0
push eax
mov ecx, esi
mov dword [ebp - 0x60], 0
call fcn.005af000
mov word [ebp - 0xb], 0x9744
lea eax, [ebp - 0xc]
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
push eax
push 0
mov ecx, esi
call fcn.005b2ba0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x9644
push eax
push 0
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.005b3b70
push 0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x9344
push eax
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.005b2b00
push 2
mov ecx, esi
call fcn.005b2560
push 1
mov ecx, esi
call fcn.005b21a0
push 1
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
push 5
call fcn.005b25b0
push 1
mov ecx, esi
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
call fcn.005b3870
push 1
mov ecx, esi
call fcn.005b21a0
push 1
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
push 4
call fcn.005b25b0
lea eax, [ebp - 0xbc]
mov dword [ebp - 0xbc], 0
push eax
mov ecx, esi
mov dword [ebp - 0xb8], 0
call fcn.005af000
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x9744
push eax
push 0
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
mov ecx, esi
call fcn.005b3bd0
push 0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x9344
push eax
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.005b2b00
push 2
mov ecx, esi
call fcn.005b2560
push 1
mov ecx, esi
call fcn.005b21a0
push 1
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
push 5
call fcn.005b25b0
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.005af000
push 6
mov ecx, esi
call fcn.005b3870
mov ecx, esi
call fcn.005b39d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00654228
mov esp, ebp
pop ebp
ret
Function at 0x5dcbd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0xa470b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 7
mov ecx, esi
mov word [ebp - 0xb], 0x2444
mov byte [ebp - 9], 0xc
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb47
push eax
push 1
mov ecx, esi
mov byte [ebp - 0xc], 2
call fcn.005b2ba0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 8
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 0
mov ecx, esi
mov byte [ebp - 9], 4
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x4344
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.005b27e0
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], 0x301
push eax
push 2
mov ecx, esi
call fcn.005b2ba0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xffffffff
push eax
push 0
mov ecx, esi
call fcn.005b2c00
push 1
push 2
mov ecx, esi
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
call fcn.005b1af0
push 1
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
push 4
call fcn.005b25b0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xfc43
push eax
push 0
mov ecx, esi
mov byte [ebp - 0xc], 2
call fcn.005b2ba0
push 1
mov ecx, esi
call fcn.005b21d0
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.005af000
mov word [ebp - 0xb], 0xf47
mov byte [ebp - 0xc], 2
push 0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.005b2b00
lea eax, [ebp - 8]
mov dword [ebp - 8], 2
push eax
push 0
mov ecx, esi
call fcn.005b2c00
mov ecx, esi
call fcn.005b39d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00654228
mov esp, ebp
pop ebp
ret
Function at 0x5dcd30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0xa470b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 6
call fcn.005b3960
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 7
mov ecx, esi
mov byte [ebp - 9], 0x14
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 1
mov ecx, esi
mov byte [ebp - 9], 0xc
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 1
mov ecx, esi
call fcn.005b3ad0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 8
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
push 1
push 6
mov ecx, esi
call fcn.005b2b60
lea eax, [ebp - 8]
mov dword [ebp - 8], 5
push eax
push 6
mov ecx, esi
call fcn.005b3ad0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb344
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.005b27e0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 6
mov ecx, esi
mov byte [ebp - 9], 0x10
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 6
mov ecx, esi
call fcn.005b3ad0
push 6
mov ecx, esi
call fcn.005b21a0
push 0
push 0
mov ecx, esi
call fcn.005b4400
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb744
push eax
mov byte [ebp - 9], 7
mov ecx, esi
mov byte [ebp - 0xc], 3
push 2
call fcn.005b2ba0
push 1
push 2
push 0
mov ecx, esi
call fcn.005b3c60
push 0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb344
push eax
mov ecx, esi
mov byte [ebp - 9], 4
mov byte [ebp - 0xc], 3
call fcn.005b2b00
lea eax, [ebp - 8]
mov dword [ebp - 0xbc], 0
push eax
push 6
mov ecx, esi
mov dword [ebp - 0xb8], 0
mov dword [ebp - 8], 0
call fcn.005b1b90
push 1
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
push 4
call fcn.005b25b0
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0
push eax
mov ecx, esi
mov dword [ebp - 0x60], 0
call fcn.005af000
push 2
push 0
mov ecx, esi
call fcn.005b2b60
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb744
push eax
push 2
mov ecx, esi
mov byte [ebp - 9], 3
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
push 1
push 2
push 0
mov ecx, esi
call fcn.005b3c60
push 0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb304
push eax
mov ecx, esi
mov byte [ebp - 0xc], 2
call fcn.005b2b00
push 6
mov ecx, esi
call fcn.005b21a0
push 1
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
push 5
call fcn.005b25b0
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
call fcn.005af000
push 1
push 6
push 2
mov ecx, esi
call fcn.005b3c60
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], 0x301
push eax
mov ecx, esi
call fcn.005b2b00
push 6
mov ecx, esi
call fcn.005b3870
mov ecx, esi
call fcn.005b39d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00654228
mov esp, ebp
pop ebp
ret
Function at 0x5dd310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0xa470b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 6
call fcn.005b3960
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 7
mov ecx, esi
mov byte [ebp - 9], 0x14
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 1
mov ecx, esi
mov byte [ebp - 9], 0xc
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 1
mov ecx, esi
call fcn.005b3ad0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 3
mov ecx, esi
mov byte [ebp - 9], 8
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
push 1
push 2
mov ecx, esi
call fcn.005b2b60
lea eax, [ebp - 8]
mov dword [ebp - 8], 5
push eax
push 2
mov ecx, esi
call fcn.005b3ad0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0x2444
push eax
push 6
mov ecx, esi
mov byte [ebp - 9], 0x10
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 6
mov ecx, esi
call fcn.005b3ad0
push 6
mov ecx, esi
call fcn.005b21a0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb744
push eax
push 7
mov ecx, esi
mov byte [ebp - 9], 7
mov byte [ebp - 0xc], 3
call fcn.005b27e0
push 2
push 6
mov ecx, esi
call fcn.005b4050
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb344
push eax
mov byte [ebp - 9], 7
mov ecx, esi
mov byte [ebp - 0xc], 3
push 3
call fcn.005b27e0
push 6
mov ecx, esi
call fcn.005b34a0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb704
push eax
push 2
mov ecx, esi
mov byte [ebp - 0xc], 2
call fcn.005b2ba0
lea eax, [ebp - 8]
mov dword [ebp - 0xbc], 0
push eax
push 6
mov ecx, esi
mov dword [ebp - 0xb8], 0
mov dword [ebp - 8], 0
call fcn.005b1b90
push 1
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
push 4
call fcn.005b25b0
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0
push eax
mov ecx, esi
mov dword [ebp - 0x60], 0
call fcn.005af000
push 2
push 0
mov ecx, esi
call fcn.005b2b60
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb744
push eax
push 2
mov ecx, esi
mov byte [ebp - 9], 4
mov byte [ebp - 0xc], 3
call fcn.005b2ba0
push 1
push 2
push 0
mov ecx, esi
call fcn.005b3d90
push 0
lea eax, [ebp - 0xc]
mov word [ebp - 0xb], 0xb304
push eax
mov ecx, esi
mov byte [ebp - 0xc], 2
call fcn.005b2b00
push 6
mov ecx, esi
call fcn.005b2560
push 1
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
push 5
call fcn.005b25b0
lea eax, [ebp - 0xbc]
mov ecx, esi
push eax
call fcn.005af000
push 1
push 6
push 2
mov ecx, esi
call fcn.005b3d90
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], 0x301
push eax
mov ecx, esi
call fcn.005b2b00
push 6
mov ecx, esi
call fcn.005b3870
mov ecx, esi
call fcn.005b39d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00654228
mov esp, ebp
pop ebp
ret