joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5746c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add eax, ebp
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0056d357
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0x18], 0x54
mov byte [ebp - 0x17], 0x76
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x71
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x55
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0
jb 0x574724
jae 0x574724
jmp 0x5746af
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
jmp 0x885930c5
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jle 0x57479a
jg 0x57479a
call 0x1041b86
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.0057f472
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5747ad
or eax, 0xffffffff
jmp 0x574802
jb 0x5747b2
jae 0x5747b2
jmp 0x574740
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0057a424
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.005725aa
add esp, 0xc
jl 0x5747d7
jge 0x5747d7
call 0x153c55e
cmp dword [ebp - 4], 0
jne 0x5747e2
or eax, 0xffffffff
jmp 0x574802
cmp dword [esp + 4], 0x1730372
mov edx, dword [ebp - 4]
push edx
call fcn.005762d0
add esp, 4
jb 0x5747fb
jae 0x5747fb
jmp 0x574787
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x57618a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
jbe 0x5761ec
ja 0x5761ec
call 0x813faf7a
jmp 0xe8a4e9f6
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00568a8a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x576278
xor eax, eax
jmp fcn.005762c7
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0057a424
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005725aa
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x5762c5
jne 0x5762a3
je 0x5762a3
je 0x57622f
mov eax, dword [ebp - 8]
inc ebp
clc
push eax
call fcn.005762d0
add esp, 4
jp 0x5762b4
jnp 0x5762b4
call 0x5167b043
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
xor eax, eax
Function at 0x578c06
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cmp dword [esp + 4], 0x1770376
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
jbe 0x578cc4
ja 0x578cc4
ljmp 0x8900:0x67a9e8
call fcn.0057f472
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x578cd6
xor eax, eax
jmp 0x578cfe
jns 0x578cdb
js 0x578cdb
or dword [ebp - 0x74af0fbb], 0xe851fc4d
cmp al, 0x17
add byte [eax], al
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0057a424
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.005725aa
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jmp 0x703971
cmp eax, 0xdbff0a8f
in al, dx
loope 0x7038f4
or ch, byte [esi - 0x18ebe27d]
push esp
test dword [edx], ebp
leave
jmp 0x703963
cmp al, byte [edx]
imul bh
jl 0x703974
adc al, 0xb
sbb byte [ebp + eax*4 + 0x13104cb6], al
mov edx, 0x9efbf51e
adc edi, dword [edx - 0x61040ae2]
cmc
sti
sahf
mov ss, word [edx + 0x981b07e]
sbb edx, dword [eax - 0x3a2f5302]
xor ax, 0xf47f
scasb al, byte es:[edi]
fsubr dword [edx + edi*8]
aas
fmul qword [eax]
sahf
sti
enter 0x6734, 0xffffffffffffffcd
or eax, ebp
mov esi, 0x56a938f
cli
fistp dword [ecx - 0x2f]
jnp 0x703922
mov ch, 0xe2
invalid
push ebx
cmp byte [ebp + 0x48], dl
mov esi, 0x660f47af
or al, 0xf3
pop eax
mov eax, dword [0xf3302761]
out 0x37, al
mov ebx, 0xc61ef0c9
sub edx, dword [eax]
imul edi, edx, 0x14
mov ch, 0x45
jl 0x703990
jge 0x703a63
mov byte [esp], dl
insd dword es:[edi], dx
mov ebp, dword [ebp + 0x29220d0f]
ret
out 0x1d, al
pop ebp
and eax, 0x47b722d6
mov bh, 0x47
sbb dword [eax - 0x7e13b443], esi
mov al, dh
push cs
and al, 0xd3
xchg esi, eax
mov eax, 0x70467fdb
shufps xmm3, xmmword [esi], 0xa4
xlatb
inc eax
sub byte [esi + 0x49], bl
adc eax, 0x897864a7
pushfd
jns 0x703a69
and al, 0x24
add byte [ebx], ah
iretd
Function at 0x57905a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005725aa
add esp, 0xc
jne 0x579078
je 0x579078
call 0x453fd642
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x55
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0xf], 0x66
jbe 0x5790b1
ja 0x5790b1
mov esp, 0x80e84d8a
jmp 0xe8a518bb
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
out dx, eax
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jb 0x57911e
invalid
jae 0x57911e
jmp 0x579107
call fcn.0057f472
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x579130
xor eax, eax
jmp 0x579193
jle 0x579135
jg 0x579135
call 0x523fdec6
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0057a424
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x57915f
xor eax, eax
jmp 0x579193
jne 0x579164
je 0x579164
jmp 0x5790f0
mov ecx, dword [ebp - 4]
push ecx
call fcn.005762d0
add esp, 4
cmp dword [esp + 8], 0x1740375
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5795eb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
jle 0x579628
jg 0x579628
call 0x2d37dbb6
add dword [eax + 0x4d8ae045], ecx
in eax, 0x80
jmp 0xe5a51e3a
mov al, byte [ebp - 0x20]
sub al, 1
mov byte [ebp - 0x20], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x1f]
sub cl, 1
mov byte [ebp - 0x1f], cl
mov dl, byte [ebp - 0x1a]
sub dl, 1
mov byte [ebp - 0x1a], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x1e]
sub dl, 1
mov byte [ebp - 0x1e], dl
mov al, byte [ebp - 0x19]
sub al, 1
mov byte [ebp - 0x19], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x1d]
sub al, 1
mov byte [ebp - 0x1d], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x1c]
sub al, 1
mov byte [ebp - 0x1c], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
cmp dword [esp + 4], 0x1730372
cmp dword [0x5612c0], 0
je 0x5796ed
jb 0x5796da
jae 0x5796da
cmp dword [ebp - 0x74af1fbb], ecx
or eax, 0x5612c0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [0x5612c0]
push ecx
call fcn.0057a424
mov dword [ebp - 0xc], eax
jne 0x5796f2
je 0x5796f2
ja 0x57975d
push 0x13
push 0
adc ebp, dword [edx]
lea edx, [ebp - 0x20]
push edx
call fcn.005725aa
add esp, 0xc
jb 0x579707
inc dword [ebx + 0x3720cc4]
jae 0x579707
add al, 0x83
jge 0x5796fe
cmp dword [ebp - 0xc], 0
je 0x57971e
add byte [ecx + edx + 0x72], dh
add esi, dword [ebx + 1]
jb 0x579712
jae 0x579712
or byte [ebx - 0x17af0bbb], cl
mov ch, 0xcb
invalid
mov eax, dword [ebp - 0xc]
push eax
call fcn.005762d0
add esp, 4
jle 0x579723
jg 0x579723
call 0x5167e4b2
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x2e
je 0x57976c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x57976c
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x579746
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x579e3e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x579e52
jmp 0x579f7c
jne 0x579e57
je 0x579e57
call 0x895fe3e6
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x55f47c], edx
jb 0x579e6d
jae 0x579e6d
adc cl, byte [ebx + 0x488bec45]
add al, 0x89
or eax, 0x5612c4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x5612c4], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x5612c0], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x55fef0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x55fef4], ecx
jbe 0x579ea1
ja 0x579ea1
mov dl, 0xc6
inc ebp
invalid
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jne 0x579eda
je 0x579eda
call 0x8147f468
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jl 0x579f47
jge 0x579f47
call 0x1317dcce
push esi
add byte [eax], al
cmp dword [0x5612c0], 0
je 0x579f64
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x5612c0]
push eax
call fcn.0057a424
mov dword [0x55f478], eax
cmp dword [esp + 8], 0x1740375
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.005725aa
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x57a1fd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 9], 0x62
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x55
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0x14], 0x79
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x66
jl 0x57a26b
jge 0x57a26b
call 0x813feff9
jmp 0xe8a52a75
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
in al, dx
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
jne 0x57a304
je 0x57a304
call 0xa90cf0
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.0057f472
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x57a316
xor eax, eax
jmp 0x57a36b
jns 0x57a31b
js 0x57a31b
call 0x513fe8ac
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0057a424
mov dword [ebp - 0x1c], eax
jle 0x57a330
jg 0x57a330
jmp 0x57a39b
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005725aa
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x57a34a
xor eax, eax
jmp 0x57a36b
jb 0x57a34f
jae 0x57a34f
call 0x513be8de
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005762d0
add esp, 4
jb 0x57a360
jae 0x57a360
jmp 0x57a2ec
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
add byte [eax], al
jmp fcn.0057a422
Function at 0x57eb8d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
jbe 0x57ebf3
ja 0x57ebf3
call 0x81443981
jmp 0xeca573fd
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.00568a8a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x57ec87
xor eax, eax
jmp 0x57ecce
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0057a424
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x57eccc
jne 0x57ecb2
je 0x57ecb2
jne 0x57ec3e
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.005762d0
add esp, 4
jp 0x57ecc3
dec ebp
call 0x766dd50a
invalid
jnp 0x57ecc3
call 0x52604252
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x57ecce
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x57f4ef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.005725aa
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x16], 0x62
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x18], 0x6a
mov byte [ebp - 0x13], 0x51
mov byte [ebp - 0xe], 0x74
jb 0x57f559
jae 0x57f559
and byte [edx - 0x167f1bb3], cl
add dword [eax + 0x558ae44d], ecx
jmp 0x8859dfe9
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1a]
sub dl, 1
mov byte [ebp - 0x1a], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x19]
sub dl, 1
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
push ebp
call 0x2d453b61
add dword [eax + 0x4d8aed45], ecx
sub cl, 1
mov byte [ebp - 0xe], cl
jo 0x57f5e9
jno 0x57f5e9
call fcn.00567ad5
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 4], dh
call fcn.0057f472
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x57f5fb
xor eax, eax
jmp 0x57f650
jne 0x57f600
je 0x57f600
call 0x533c4b91
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0057a424
mov dword [ebp - 4], eax
push 0x14
push 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.005725aa
add esp, 0xc
jbe 0x57f625
ja 0x57f625
call 0x15473ac
cmp dword [ebp - 4], 0
jne 0x57f62f
xor eax, eax
jmp 0x57f650
jns 0x57f634
js 0x57f634
call 0x53544bc3
mov edx, dword [ebp - 4]
push edx
call fcn.005762d0
add esp, 4
jb 0x57f645
jae 0x57f645
jmp 0x57f5d1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8