joyce8/EMBER2024-capa huggingface dataset:
Function at 0x82a64b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x8232b0], 1
jne 0x82a7ba
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00847175
add esp, 0xc
test dword [esp], edi
jae 0x82a676
add ecx, 0x5ed1
sub ecx, 0x5ed1
jle 0x82a6a5
pushf
lea eax, [eax + 0x299c]
sub eax, 0x299c
ja 0x82a693
push esi
add esi, 0xbf7
ror esi, 0xc
pop esi
popf
ja 0x82a6a2
jg 0x82a6a5
add esi, 0xc648e845
inc ebp
in eax, dx
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
ror esp, 0
je 0x82a6d6
jne 0x82a6e7
pushf
jns 0x82a6dc
popf
je 0x82a6e0
jno 0x82a6e2
jmp 0x82a6e4
je 0x82a6e7
mov esi, 0x80e84d8a
jmp 0xe8d02ef1
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.008471a4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x82a754
mov eax, dword [ebp + 8]
jmp 0x82a813
jl 0x82a756
test dword [esp + 0x10], edi
call fcn.0082a75f
mov eax, dword [0x8232b0]
mov dword [ebp - 8], eax
Function at 0x82be4a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00847175
add esp, 0xc
xor esp, 0
clc
stc
je 0x82be71
lea esi, [esi]
nop
jne 0x82be71
mov ebx, 0xec45c65d
dec eax
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
test ecx, esi
rol eax, 0xa
ror eax, 0xa
or eax, eax
ror edx, 0
jg 0x82becb
je 0x82bec2
mov ebx, ebx
lea esi, [esi]
jmp 0x82bec8
jle 0x82becb
mov esi, 0x80ec4d8a
jmp 0xecd046d5
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.008471a4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x82bf62
xor eax, eax
jmp 0x82c039
lea ebx, [ebx]
ror esp, 0
nop
xor edx, dword [esp]
xor edx, dword [esp]
js 0x82bf79
js 0x82bf72
jne 0x82bf74
jp 0x82bf76
jns 0x82bf79
mov eax, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0082ddaf
mov dword [ebp - 0x18], eax
xor ebx, 0x5b65
xor ebx, 0x5b65
je 0x82bfad
pushf
call fcn.0082bf9e
Function at 0x82e05a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00847175
add esp, 0xc
cmc
cmc
test esi, 0x6912
nop
jg 0x82e091
lea ecx, [ecx]
lea esi, [esi + 0x6f59]
lea esi, [esi - 0x6f59]
jle 0x82e091
xor eax, 0x45c6bf88
in al, dx
inc esp
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
xor esp, 0
xor edi, 0x2562
xor edi, 0x2562
js 0x82e0d2
jbe 0x82e0d4
jge 0x82e0de
jo 0x82e0d8
mov esi, esi
jl 0x82e0de
mov ebx, 0xec4d8af4
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.008471a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x82e153
xor eax, eax
jmp 0x82e201
or eax, 0
mov esi, esi
mov eax, eax
jne 0x82e16b
pushf
xchg edi, edi
popf
xchg esp, esp
xchg esp, esp
xchg esp, esp
je 0x82e16b
xor eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0082ddaf
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00847175
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x82e195
xor eax, eax
jmp 0x82e201
xor ecx, 0x2fc5
xor ecx, 0x2fc5
shr edx, 0
add edx, 0
je 0x82e1a9
jl 0x82e1c7
pushf
shl esi, 0
test edi, ebx
ror eax, 0xc
rol eax, 0xc
lea edx, [edx]
popf
xchg ecx, edi
xchg ecx, edi
xchg ebx, edx
xchg ebx, edx
jge 0x82e1c7
or dword [ebx - 0x17af03bb], 0x1f081
mov eax, dword [ebp - 4]
push eax
call fcn.0084d251
add esp, 4
js 0x82e1d5
lea edx, [edx + 0x6485]
lea edx, [edx - 0x6485]
or ecx, ecx
jb 0x82e1e5
jnp 0x82e1fa
pushf
xor eax, dword [esp + 0xc]
xor eax, dword [esp + 0xc]
popf
jb 0x82e1f5
jle 0x82e1f7
jp 0x82e1fa
ljmp 0x55ff:0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x8312d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00847175
add esp, 0xc
push edx
add edx, 0x43f2
ror edx, 5
pop edx
lea edx, [edx]
jne 0x831319
pushf
jp 0x8312fc
jge 0x8312fe
jmp 0x831300
neg eax
neg eax
popf
ja 0x831308
jnp 0x83130a
lea edx, [edx + 0x672a]
lea edx, [edx - 0x672a]
je 0x831319
xor eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cld
je 0x83136c
pushf
call fcn.00831353
Function at 0x839086
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x8232ac], 1
jne 0x8391f3
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00847175
add esp, 0xc
ja 0x8390ae
test eax, 0x29b6
jno 0x8390c6
pushf
xchg ecx, ecx
nop
jl 0x8390bc
popf
lea edi, [edi]
nop
jp 0x8390c3
jo 0x8390c6
xor eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
xor edx, dword [esp]
xor edx, dword [esp]
xor ecx, esi
xor ecx, esi
js 0x83910e
jl 0x839104
xchg edi, esi
xchg edi, esi
xchg esi, esi
jns 0x83910e
xor eax, 0xe84d8acf
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.008471a4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x839183
xor eax, eax
jmp 0x839245
jnp 0x839185
jl 0x839198
lea esi, [esi + 0x7224]
lea esi, [esi - 0x7224]
xchg esp, esp
jge 0x839198
mov ebx, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0082ddaf
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00847175
add esp, 0xc
xchg edi, edi
push esi
add esi, 0x3cd8
ror esi, 0x18
pop esi
or ebx, ebx
xor esp, 0
jnp 0x8391dd
lea ebx, [ebx + 0x77fd]
lea ebx, [ebx - 0x77fd]
jmp 0x8391da
jp 0x8391dd
mov ecx, 0xf87d83
cmp dword [ebp - 8], 0
je 0x8391ed
mov eax, dword [ebp - 8]
mov dword [0x8232ac], eax
jmp 0x8391f1
xor eax, eax
jmp 0x839245
jmp 0x8391fc
mov ecx, dword [0x8232ac]
mov dword [ebp - 8], ecx
and esp, 0xffffffff
je 0x83920c
jns 0x839203
jmp 0x839205
mov eax, eax
jno 0x839209
jne 0x83920c
mov ebx, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
std
cld
mov edx, edx
sub esp, 0
je 0x83922e
lea ebx, [ebx + 0x2e7a]
lea ebx, [ebx - 0x2e7a]
xchg ebx, eax
xchg ebx, eax
jbe 0x83922b
jne 0x83922e
mov ebp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0084d251
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x839de7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00847175
add esp, 0xc
test ebx, eax
jnp 0x839e1a
pushf
jl 0x839e08
add ebx, 0
cmp ecx, 0x4a8a
popf
jle 0x839e15
jmp 0x839e17
jp 0x839e1a
mov ecx, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
nop
inc ebx
dec ebx
mov esp, esp
je 0x839e69
lea esp, [esp]
jnp 0x839e62
jl 0x839e64
ja 0x839e66
jne 0x839e69
sub eax, 0x80ec4d8a
jmp 0xecd12673
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.008471a4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x839ef6
jmp 0x839f84
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0082ddaf
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00847175
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x839f84
test ecx, 0x3e91
jne 0x839f24
je 0x839f31
jl 0x839f28
js 0x839f2a
jb 0x839f2c
jnp 0x839f2e
jne 0x839f31
lcall 0x17e8, 0x50e8458b
xor eax, dword [ecx]
add byte [ebx + 0x7404c4], al
mov eax, dword [ebp - 0x18]
push eax
call fcn.0084d251
add esp, 4
je 0x839f3f
lea ecx, [ecx + 0x3e4a]
lea ecx, [ecx - 0x3e4a]
dec ebx
inc ebx
jno 0x839f71
pushf
cmp esp, 0x2852
jb 0x839f59
shl esp, 0
popf
js 0x839f60
lea esi, [esi + 0x69d5]
lea esi, [esi - 0x69d5]
jg 0x839f6e
jo 0x839f71
sub eax, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x83a1db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00847175
add esp, 0xc
mov ecx, ecx
jae 0x83a203
xchg esi, esi
xchg ebx, ebx
xchg esp, esp
jl 0x83a200
jb 0x83a203
xor eax, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
shl ecx, 0
shr edi, 0
mov eax, eax
jp 0x83a251
pushf
shl esp, 0
push ebx
pop ebx
xchg edi, eax
xchg edi, eax
inc ecx
dec ecx
popf
xchg esp, esp
xchg esp, esp
jnp 0x83a251
mov esi, 0x80ec4d8a
jmp 0xecd12a5b
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov eax, eax
cmp ecx, dword [esp + 8]
jo 0x83a2c0
jl 0x83a2bb
jns 0x83a2bd
jno 0x83a2c0
add eax, 0xcedfe8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.008471a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x83a2d5
xor eax, eax
jmp 0x83a373
cmc
inc edx
dec edx
ror esi, 2
rol esi, 2
add esi, 0
jno 0x83a2ec
ja 0x83a2e5
jge 0x83a2e7
ja 0x83a2e9
jo 0x83a2ec
mov ecx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0082ddaf
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00847175
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x83a366
add esp, 0
push edi
pop edi
jp 0x83a319
mov edi, edi
jg 0x83a326
jb 0x83a31f
mov edi, edi
mov esi, esi
jle 0x83a326
lcall 0x22e8, 0x50fc458b
das
add dword [eax], eax
mov eax, dword [ebp - 4]
push eax
call fcn.0084d251
add esp, 4
lea esi, [esi + 0x1057]
lea esi, [esi - 0x1057]
cmc
xor edi, 0x2f94
xor edi, 0x2f94
xor ebx, ecx
xor ebx, ecx
jno 0x83a35d
mov edx, edx
jbe 0x83a355
mov esp, esp
jne 0x83a359
jo 0x83a35d
sub ebp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x83a373
push ebx
pop ebx
jp 0x83a371
lea esi, [esi]
jbe 0x83a36e
jnp 0x83a371
lcall 0x8b5b, 0x5e5fc033
in eax, 0x5d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x83ed22
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00847175
add esp, 0xc
call fcn.0083ed47

Function at 0x83eecc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00847175
add esp, 0xc
test ebx, 0x429b
jae 0x83eef8
xchg ebx, eax
xchg ebx, eax
je 0x83eef1
mov esp, esp
jno 0x83eef5
jb 0x83eef8
add eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
cmp esi, dword [esp]
jnp 0x83ef4b
pushf
inc ebx
dec ebx
shl edx, 0
clc
ja 0x83ef3f
popf
mov edx, edx
lea esp, [esp]
jle 0x83ef48
jp 0x83ef4b
mov eax, 0x80f44d8a
jmp 0xf4d17755
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
js 0x83efbe
ja 0x83efc0
mov ecx, ecx
sub esp, 0
ja 0x83efe4
pushf
test esp, 0x4af3
cmp ebx, 0x5110
jle 0x83efd7
popf
xchg ebx, esi
xchg ebx, esi
je 0x83efdf
jne 0x83efe1
jbe 0x83efe4
mov edi, 0x81bbe8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.008471a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x83eff7
jmp 0x83f0a7
clc
test esp, 0x5a54
jl 0x83f000
jne 0x83f015
pushf
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
inc edi
dec edi
popf
jnp 0x83f012
je 0x83f015
mov ecx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0082ddaf
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00847175
add esp, 0xc
test esi, 0x241a
nop
ja 0x83f03e
call fcn.0083f043
Function at 0x83f5d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00847175
add esp, 0xc
je 0x83f5f1
je 0x83f5ff
xchg edi, ecx
xchg edi, ecx
jp 0x83f5f9
mov ecx, ecx
nop
jne 0x83f5ff
mov edi, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
inc esi
dec esi
and esi, 0xffffffff
js 0x83f63e
jge 0x83f645
lea eax, [eax]
jl 0x83f645
mov edi, 0x80e84d8a
jmp 0xe8d17e4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.00852546
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x83f6cb
xor eax, eax
jmp 0x83f74b
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0082ddaf
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00847175
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x83f749
jnp 0x83f6f3
jg 0x83f70a
pushf
lea esi, [esi]
mov edi, edi
ror edi, 0x12
ror edi, 0xe
popf
jle 0x83f705
jmp 0x83f707
jle 0x83f70a
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0084d251
add esp, 4
rol ebx, 0x1a
rol ebx, 6
call fcn.0083f721
xor eax, eax
Function at 0x846a4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00847175
add esp, 0xc
jbe 0x846a6d
jmp 0x846a6f
xchg ebx, ebx
jp 0x846a84
pushf
jg 0x846a77
ror edi, 0x12
rol edi, 0x12
popf
jl 0x846a81
jnp 0x846a84
mov esp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
ror eax, 6
ror eax, 0x1a
sub esp, 0
jno 0x846abf
not ebx
not ebx
jl 0x846ad0
jae 0x846ac7
jp 0x846ac9
jae 0x846acb
jb 0x846acd
jge 0x846ad0
xor eax, 0x80f04d8a
jmp 0xf0d1f2da
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
cmp eax, 0x6442
jne 0x846b42
nop
xchg esi, ecx
xchg esi, ecx
mov ecx, ecx
je 0x846b42
mov ecx, 0xb9ffe8b5
add byte [eax], al
call fcn.00852546
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x846b54
xor eax, eax
jmp 0x846b8a
inc eax
dec eax
jne 0x846b58
jo 0x846b67
pushf
rol edx, 0
popf
jg 0x846b63
nop
jno 0x846b67
mov ebp, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0082ddaf
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00847175
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret