joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c8b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44c8e3
push esi
call fcn.0045ab30
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44c8dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44c969
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44c952
mov eax, dword [esi + 8]
test eax, eax
je 0x44c907
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44c94e
cmp eax, 2
je 0x44c952
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44c8fa
cmp eax, 3
je 0x44c92d
cmp eax, 1
jne 0x44c8fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44c8fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44c8fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044c990
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44c978
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044c990
add esp, 4
pop esi
ret

Function at 0x44d210
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x44d231
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x44d231
mov eax, dword [eax + 0x44]
test eax, eax
je 0x44d231
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x46d620
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x46d630
mov esi, 1
push esi
call fcn.00483cf7
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x46d682
call fcn.004847fd
mov edi, eax
call fcn.00470170
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x46d666
mov edx, dword [0x559fa8]
mov dword [0x559fa4], edx
test al, 0x18
je 0x46d677
push esi
push 0x24
push 5
call fcn.004709c0
add esp, 0xc
test edi, edi
je 0x46d69d
push 1
call fcn.00485785
test byte [esp + 0x14], 0x20
je 0x46d69d
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x46e7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x46e894
cmp byte [edx], 0
je 0x46e887
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.0046e720
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.0046e720
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.0046e690
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x46e851
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.0046e6d0
fmul qword [0x53c130]
push ecx
fstp qword [esp]
call fcn.00482668
fadd qword [0x53c128]
add esp, 8
call fcn.00482738
mov byte [ebx], al
inc ebx
dec edi
jne 0x46e824
lea ecx, [esp + 0x20]
push ecx
call fcn.0046e6d0
fmul qword [0x53c130]
push ecx
fstp qword [esp]
call fcn.00482668
add esp, 8
call fcn.00482738
cmp esi, ebx
je 0x46e87d
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x46e876
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ec60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x46ec90
mov byte [edi + esi], 2
jmp 0x46ecc7
test al, 4
je 0x46ec9a
mov byte [edi + esi], 0xd
jmp 0x46ecc7
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x46ecb3
mov byte [edi + esi], 2
jmp 0x46ecc7
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x46ecc3
mov byte [edi + esi], 0x19
jmp 0x46ecc7
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x46ec77
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x46ed3b
cmp dl, 0xd
je 0x46ed3b
xor edx, edx
jmp 0x46ed40
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x46ed2b
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x46ed60
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.0046d620
mov esi, eax
add esp, 8
test esi, esi
jne 0x46ed81
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.004703b0
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x46eda6
push esi
call fcn.0046d6b0
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.0048e4ec
push ebx
push edi
mov ebp, eax
call fcn.00470420
push 0x46ede0
push ebp
push esi
call fcn.00471750
push esi
call fcn.0046d6b0
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x4700e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x62d6a0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x62d5d4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x47015b
push 0x4c
push 1
call fcn.00484c25
mov esi, eax
add esp, 8
test esi, esi
jne 0x470123
push 0x62d6a0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x62d5d4]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x622990]
inc eax
lea edx, [esi + 0xc]
mov dword [0x622990], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.00473c60
add esp, 8
mov byte [esi + 0x3c], 1
push 0x62d6a0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x4705e0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.004847fd
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.0048e4ec
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4706da
call fcn.004847fd
cmp dword [eax], 0
je 0x470627
call fcn.004847fd
mov ebp, dword [eax]
jmp 0x47062a
or ebp, 0xffffffff
call fcn.00470170
test esi, esi
mov dword [eax], ebp
jne 0x47063f
call fcn.004847fd
cmp dword [eax], 4
je 0x47068f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x470672
cmp esi, 0xffffffff
je 0x4706b4
test al, 6
je 0x470672
call fcn.00470170
mov ecx, dword [eax]
push ecx
push ebx
call fcn.00473c90
add esp, 4
push eax
push 0x24
push 9
call fcn.004709c0
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x4706d2
test al, 6
je 0x470680
test ah, 2
je 0x4706d2
test esi, esi
jbe 0x4706de
test ah, 2
je 0x4706de
add dword [esp + 0x18], esi
sub edi, esi
call fcn.004847fd
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.0048e4ec
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4706da
jmp 0x470614
call fcn.00470170
mov eax, dword [eax]
push eax
push ebx
call fcn.00473c90
add esp, 4
push eax
push 0x24
push 2
call fcn.004709c0
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x4706eb
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x4706f4
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x486bc4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x486be4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0048478a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x486c07
test byte [esp + 8], 2
je 0x486c07
call fcn.004847fd
mov dword [eax], 0xd
call fcn.00484806
mov dword [eax], 5
jmp 0x486be0
xor eax, eax
ret
Function at 0x49873a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x498772
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004967f1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004967c9
jmp 0x49877e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x499e30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x499e72
call fcn.0049f922
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x499e72
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x499e69
xor eax, eax
jmp 0x499e7a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00499e80
pop edi
pop esi
pop ebx
ret 4

Function at 0x49fe52
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49fe80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49fe9e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049fdb8
jmp 0x49fe9e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49fe9e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049fdb8
test edi, edi
mov eax, edi
jne 0x49fe88
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5c7000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005eaef2
add esp, 0xc
jbe 0x5c701b
mov eax, eax
jnp 0x5c7031
pushf
cmp edi, dword [esp + 0xc]
and esp, 0xffffffff
inc ecx
dec ecx
popf
jnp 0x5c702e
jp 0x5c7031
mov edi, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
lea eax, [eax + 0x34c0]
lea eax, [eax - 0x34c0]
stc
jp 0x5c7097
pushf
lea edi, [edi + 0x18e6]
sub edi, 0x18e6
shl esi, 0
ja 0x5c708b
xor eax, 0
popf
xchg esp, esp
jb 0x5c7094
jnp 0x5c7097
mov esp, 0x80f44d8a
jmp 0xf4a9f8a1
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
ja 0x5c710a
test edi, eax
mov eax, eax
js 0x5c7110
jg 0x5c7127
pushf
jb 0x5c7116
ror ebx, 0xe
ror ebx, 0x12
jae 0x5c711e
popf
mov edx, edx
jne 0x5c7124
jle 0x5c7127
sub eax, 0x1c784
call fcn.005e38b0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5c713a
jmp 0x5c71cb
jae 0x5c713c
jo 0x5c713e
jnp 0x5c7140
mov esp, esp
jp 0x5c714b
nop
mov esp, esp
jnp 0x5c714b
mov ecx, 0xe8558d31
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005cb5eb
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.005eaef2
add esp, 0xc
not esi
not esi
xchg edi, edi
mov eax, eax
jne 0x5c7175
js 0x5c7188
lea edi, [edi + 0x2680]
lea edi, [edi - 0x2680]
jns 0x5c7188
mov eax, 0x7d830bbf
cld
add byte [ebp + 2], dh
cmp dword [ebp - 4], 0
jne 0x5c7190
jmp 0x5c71cb
ror esi, 8
rol esi, 8
je 0x5c7198
lea eax, [eax]
stc
jge 0x5c71a6
jno 0x5c719f
jno 0x5c71a1
jge 0x5c71a3
jl 0x5c71a6
mov edx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.005e7465
add esp, 4
cmp esp, 0x27a2
jne 0x5c71c4
jno 0x5c71bc
xchg edx, edi
xchg edx, edi
je 0x5c71c4
add eax, 0x8458bce
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5cbb95
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.005eaef2
add esp, 0xc
ror edx, 0x16
rol edx, 0x16
ror edi, 0
sub esp, 0
ror esi, 0x11
rol esi, 0x11
js 0x5cbbd6
pushf
std
cld
je 0x5cbbc8
or edi, 0
popf
xchg edx, ecx
xchg edx, ecx
jp 0x5cbbd3
jns 0x5cbbd6
mov ecx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
rol edi, 0
std
cld
lea esp, [esp]
jns 0x5cbc16
lea esp, [esp]
js 0x5cbc16
mov ebx, 0x80f44d8a
jmp 0xf4aa4420
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
inc ebx
dec ebx
jge 0x5cbc7a
jne 0x5cbc94
xchg edx, ecx
xchg edx, ecx
jns 0x5cbc82
js 0x5cbc84
lea edi, [edi + 0x2687]
lea edi, [edi - 0x2687]
je 0x5cbc94
call 0x7a02a582
add byte [eax], al
call fcn.005d363e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5cbcac
mov eax, 1
jmp 0x5cbd5c
je 0x5cbcae
jg 0x5cbcc1
pushf
xchg esi, edi
xchg esi, edi
popf
jb 0x5cbcba
js 0x5cbcbc
jno 0x5cbcbe
jle 0x5cbcc1
add eax, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005cb5eb
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.005eaef2
add esp, 0xc
sub esp, 0
push edi
pop edi
and esp, 0xffffffff
call 0x5cbcee
lea esp, [esp + 4]
js 0x5cbd00
jb 0x5cbcf6
mov esp, esp
xchg ecx, ecx
je 0x5cbcfc
jns 0x5cbd00
xor eax, 0xec7d83da
add byte [ebp + 7], dh
cmp dword [ebp - 0x14], 0
jne 0x5cbd0d
mov eax, 1
jmp 0x5cbd5c
test ebx, 0x7d5
not eax
not eax
add ecx, dword [esp]
sub ecx, dword [esp]
jns 0x5cbd1f
jns 0x5cbd2a
xchg edx, esi
xchg edx, esi
js 0x5cbd2a
mov ecx, 0x458bd376
in al, dx
mov eax, dword [ebp - 0x14]
push eax
call fcn.005e7465
add esp, 4
rol esp, 0
cmp eax, dword [esp]
jbe 0x5cbd55
pushf
jge 0x5cbd42
popf
xchg esp, esp
lea ecx, [ecx + 0x569e]
lea ecx, [ecx - 0x569e]
ja 0x5cbd55
mov ecx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5ccde7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005eaef2
add esp, 0xc
mov ebx, ebx
lea ebx, [ebx]
ror edi, 0
rol ecx, 0x1c
rol ecx, 4
jo 0x5cce1b
pushf
clc
popf
jno 0x5cce16
jno 0x5cce18
jno 0x5cce1b
mov edx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
stc
not eax
not eax
jp 0x5cce5c
mov esp, esp
jle 0x5cce56
jne 0x5cce58
nop
jnp 0x5cce5c
mov eax, 0x80ec4d8a
jmp 0xecaa5666
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.005e38b0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5ccece
xor eax, eax
jmp 0x5ccf4c
std
cld
jb 0x5ccedc
jbe 0x5cced4
mov edi, edi
je 0x5cced8
jae 0x5ccedc
mov edx, 0xec458d72
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005cb5eb
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005eaef2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5ccf06
xor eax, eax
jmp 0x5ccf4c
rol ebx, 0x10
ror ebx, 0x10
jbe 0x5ccf15
js 0x5ccf10
ja 0x5ccf15
mov esp, 0x458bcce6
cld
mov eax, dword [ebp - 4]
push eax
call fcn.005e7465
add esp, 4
jns 0x5ccf23
mov esp, esp
jo 0x5ccf27
jns 0x5ccf29
jns 0x5ccf45
pushf
jno 0x5ccf2f
test ebx, 0x3708
or esi, 0
jo 0x5ccf3a
popf
jbe 0x5ccf3e
lea edi, [edi]
jbe 0x5ccf42
js 0x5ccf45
mov eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5cfa94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005eaef2
add esp, 0xc
sub esp, 0
jns 0x5cfab9
jne 0x5cfabb
jnp 0x5cfac9
jnp 0x5cfabf
jl 0x5cfac1
jb 0x5cfac3
jns 0x5cfac5
jp 0x5cfac9
add eax, 0xf045c6d6
dec esi
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
dec ecx
inc ecx
nop
jne 0x5cfafe
shr edx, 0
jle 0x5cfb09
lea esp, [esp]
jg 0x5cfb09
jmp 0x814d4897
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
lea esi, [esi + 0x281a]
lea esi, [esi - 0x281a]
jp 0x5cfb77
ror edi, 0xb
rol edi, 0xb
jnp 0x5cfb89
jnp 0x5cfb81
nop
mov edx, edx
jle 0x5cfb86
jp 0x5cfb89
call 0x147f375
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.005de685
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5cfb9b
xor eax, eax
jmp 0x5cfbd8
xor esp, 0
xchg esp, esp
je 0x5cfbb5
mov edx, edx
lea esi, [esi + 0x54bf]
lea esi, [esi - 0x54bf]
jne 0x5cfbb2
jne 0x5cfbb5
mov esp, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cb5eb
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.005eaef2
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d2891
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005eaef2
add esp, 0xc
rol esi, 6
ror esi, 6
call fcn.005d28b5