joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52233e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0053d44e
add esp, 0xc
add esi, 0
add esi, dword [esp]
sub esi, dword [esp]
xor esp, 0
stc
jbe 0x52238b
pushf
jo 0x522371
rol esp, 0
ror edx, 0
push edi
add edi, 0x1d11
ror edi, 4
pop edi
popf
jne 0x522386
xchg ebx, eax
xchg ebx, eax
ja 0x52238b
mov esi, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
test esp, 0x6a8b
neg ecx
neg ecx
jno 0x522440
jns 0x52244a
jno 0x522444
jbe 0x522446
js 0x52244a
mov ebp, 0xc916e8e0
add dword [eax], eax
call fcn.0053ed65
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x52245f
xor eax, eax
jmp 0x5224fc
test esp, 0x430c
jbe 0x522487
pushf
jb 0x52246b
xchg edx, ebx
xchg edx, ebx
lea ebx, [ebx + 0x134d]
sub ebx, 0x134d
cmp ebx, dword [esp + 0x10]
popf
lea esi, [esi]
nop
ja 0x522487
or dword [ebp - 0x74ad17ab], 0xe850f845
xor esi, dword [ebx + 1]
add byte [ecx + 0xe6afc45], cl
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005397c7
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0053d44e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5224b1
xor eax, eax
jmp 0x5224fc
jmp 0x5224b3
lea edi, [edi]
cmp esi, ebx
add edi, dword [esp]
sub edi, dword [esp]
jns 0x5224d8
pushf
add edi, 0x3faf
sub edi, 0x3faf
popf
ja 0x5224d1
lea edi, [edi]
jg 0x5224d5
js 0x5224d8
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00543d38
add esp, 4
xor esp, 0
jg 0x5224f1
jno 0x5224eb
ja 0x5224ed
jle 0x5224f1
add eax, 0xc458b8f
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52478a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x519df8], 1
jne 0x5248e6
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0053d44e
add esp, 0xc
or edx, edx
jle 0x5247be
mov ecx, ecx
js 0x5247b8
jns 0x5247ba
jg 0x5247be
call 0xe8980e85
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x15], 0x55
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xf], 0x76
and esp, 0xffffffff
jge 0x524816
pushf
xchg ecx, edi
xchg ecx, edi
rol ecx, 0x16
ror ecx, 0x16
xchg edx, ebx
xchg edx, ebx
rol eax, 0xe
rol eax, 0x12
popf
jge 0x524811
xchg esp, esp
jl 0x524816
or dword [edx - 0x167f17b3], 0xe84d8801
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
nop
js 0x524881
or esp, 0
jo 0x524886
jp 0x52488f
xchg ebx, esi
xchg ebx, esi
jnp 0x52488f
mov eax, 0x1a4d1e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 4], dh
call fcn.0053ed65
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5248a1
xor eax, eax
jmp 0x52491f
shl edx, 0
cmp esi, dword [esp]
jb 0x5248af
jge 0x5248ab
jae 0x5248af
mov ebp, 0xe84d8d86
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005397c7
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0053d44e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x5248e0
mov ecx, dword [ebp - 4]
mov dword [0x519df8], ecx
jmp 0x5248e4
xor eax, eax
jmp 0x52491f
jmp 0x5248ef
mov edx, dword [0x519df8]
mov dword [ebp - 4], edx
and eax, 0xffffffff
mov ebx, ebx
rol ecx, 0x13
ror ecx, 0x13
inc edx
dec edx
jns 0x524903
mov esp, esp
js 0x524903
lcall 0x2ce8, 0x50fc458b
hlt
mov eax, dword [ebp - 4]
push eax
call fcn.00543d38
add esp, 4
jns 0x524911
or edx, 0
jae 0x52491c
jl 0x524918
jb 0x52491c
xor eax, 0xfc55ff50
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52497c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x524990
jmp 0x524b57
xor ecx, 0x645d
xor ecx, 0x645d
jbe 0x5249a6
jae 0x5249a0
lea esp, [esp]
ja 0x5249a6
add eax, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x519de0], edx
jbe 0x5249b9
lea eax, [eax + 0x7587]
lea eax, [eax - 0x7587]
test ebx, 0x7b05
ja 0x5249d2
jo 0x5249cf
jbe 0x5249d2
mov esi, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x519e88
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x519e88], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x519e84], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x519f50], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x519f54], ecx
stc
or esp, 0
jle 0x524a13
pushf
xchg ebx, ebx
popf
lea esp, [esp]
jg 0x524a13
mov eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
mov ecx, ecx
ror edi, 0x18
rol edi, 0x18
jno 0x524a51
xor ebx, dword [esp]
xor ebx, dword [esp]
jg 0x524a69
pushf
and ebx, 0xffffffff
popf
jmp 0x524a62
jno 0x524a64
xchg edx, eax
xchg edx, eax
jle 0x524a69
or dword [edx - 0x157f0fab], 0xf0558801
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jge 0x524ad3
jo 0x524ad5
xor edx, dword [esp]
xor edx, dword [esp]
jg 0x524b0e
pushf
xor ebx, dword [esp + 8]
xor ebx, dword [esp + 8]
lea ebx, [ebx + 0x2d4f]
lea ebx, [ebx - 0x2d4f]
std
cld
cmp ecx, dword [esp + 0x10]
popf
lea edx, [edx + 0x2d49]
lea edx, [edx - 0x2d49]
jno 0x524b09
je 0x524b0b
jle 0x524b0e
lcall 0x51, 0x9e843d83
add byte [esp + edx - 0x73], dh
push ebp
invalid
cmp dword [0x519e84], 0
je 0x524b2b
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x519e84]
push eax
call fcn.005397c7
mov dword [0x519ddc], eax
jl 0x524b2d
js 0x524b2f
jmp 0x524b31
jno 0x524b47
pushf
xchg esi, ecx
xchg esi, ecx
xor ecx, 0
mov edx, edx
popf
mov edx, edx
jb 0x524b44
jo 0x524b47
mov ebp, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0053d44e
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52510b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0053d44e
add esp, 0xc
jae 0x525126
dec ecx
inc ecx
xor eax, 0x649d
xor eax, 0x649d
shr esi, 0
jp 0x525143
nop
nop
xchg edi, edx
xchg edi, edx
xchg edx, eax
xchg edx, eax
jnp 0x525143
mov edx, 0xec45c618
inc esp
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
xor edx, 0x671a
xor edx, 0x671a
jge 0x525181
test esp, 0x34bc
ror esi, 0
je 0x525192
jg 0x52518e
jne 0x525192
mov ebp, 0xec4d8a3d
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0053ed65
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x525207
xor eax, eax
jmp 0x525290
cmp esp, 0x7c96
inc edx
dec edx
ja 0x525216
jne 0x525213
jbe 0x525216
mov esp, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005397c7
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0053d44e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x525240
xor eax, eax
jmp 0x525290
xor esp, 0
shl esp, 0
xchg edx, esi
xchg edx, esi
jle 0x52524c
jo 0x52525d
pushf
or esp, 0
rol esi, 0
popf
nop
nop
jno 0x52525d
or dword [ebx - 0x17af03bb], 0x1ead2
mov eax, dword [ebp - 4]
push eax
call fcn.00543d38
add esp, 4
mov esp, esp
and esp, 0xffffffff
test dword [esp], edx
push ecx
add ecx, 0x3971
ror ecx, 0xa
pop ecx
jp 0x525289
jge 0x525280
xchg ebx, edx
xchg ebx, edx
xchg ebx, eax
xchg ebx, eax
jnp 0x525289
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5261dc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x51a278
call fcn.005363c3
add esp, 0xc
mov byte [0x51a278], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x529fd2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0053d44e
add esp, 0xc
xor edx, dword [esp + 8]
xor edx, dword [esp + 8]
or ebx, 0
je 0x529fff
mov esp, esp
jns 0x529ffc
jne 0x529fff
xor eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
test dword [esp + 8], edx
jo 0x52a047
xchg edi, eax
xchg edi, eax
je 0x52a041
je 0x52a043
jno 0x52a047
add eax, 0xf44d8a9b
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
and ebx, 0xffffffff
add esp, 0
ja 0x52a0cf
pushf
xor eax, edi
xor eax, edi
popf
jo 0x52a0ca
xchg esp, esp
jbe 0x52a0cf
mov edx, 0x14c91e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.0053ed65
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x52a0e2
jmp 0x52a178
cmp ebx, dword [esp + 4]
cmc
jae 0x52a0fc
lea edx, [edx + 0x56a9]
lea edx, [edx - 0x56a9]
xchg esi, eax
xchg esi, eax
jle 0x52a0f9
jb 0x52a0fc
mov ebx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005397c7
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0053d44e
add esp, 0xc
je 0x52a11e
jno 0x52a12a
jnp 0x52a122
nop
ja 0x52a125
lea edi, [edi]
jo 0x52a12a
sub eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x52a132
jmp 0x52a178
ror ebx, 5
rol ebx, 5
jbe 0x52a13a
rol ebx, 0
and esi, esi
jae 0x52a147
jae 0x52a143
jb 0x52a147
mov edi, 0xfc558b4f
mov edx, dword [ebp - 4]
push edx
call fcn.00543d38
add esp, 4
jb 0x52a155
cmp ebx, edx
lea ebx, [ebx + 0xf03]
lea ebx, [ebx - 0xf03]
jno 0x52a171
jns 0x52a167
jb 0x52a169
jo 0x52a16b
jno 0x52a16d
jo 0x52a171
or dword [ebp - 0x75], 0xff500845
push ebp
cld
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52ab4d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0053d44e
add esp, 0xc
ror edi, 0x1c
ror edi, 4
mov eax, eax
lea edx, [edx]
ror esi, 8
ror esi, 0x18
jp 0x52ab8b
pushf
sub esp, 0
ror esp, 0
xchg edx, eax
xchg edx, eax
popf
jae 0x52ab86
jge 0x52ab88
jnp 0x52ab8b
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
jmp 0x52abc1
or esi, 0
js 0x52abdc
pushf
jb 0x52abca
call 0x52abcf
add esp, 4
popf
xchg edx, edx
lea esp, [esp]
jns 0x52abdc
mov eax, 0x80e84d8a
jmp 0xe8a033e6
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
stc
add esp, 0
inc eax
dec eax
lea eax, [eax + 0x7c13]
lea eax, [eax - 0x7c13]
jbe 0x52ac69
pushf
rol eax, 7
rol eax, 0x19
popf
jmp 0x52ac64
mov eax, eax
ja 0x52ac69
mov esi, 0x140f7e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0053ed65
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x52ac7e
xor eax, eax
jmp 0x52ad23
xor edi, ebx
xor edi, ebx
rol edi, 0
test dword [esp + 8], eax
jb 0x52ac96
xchg ebx, ecx
xchg ebx, ecx
xchg ecx, eax
xchg ecx, eax
jle 0x52ac93
jae 0x52ac96
add eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005397c7
mov dword [ebp - 4], eax
test dword [esp + 0x10], edx
je 0x52acc5
pushf
rol ebx, 0
add ebx, dword [esp]
sub ebx, dword [esp]
or esp, 0
neg ebx
neg ebx
popf
jbe 0x52acc2
jne 0x52acc5
mov ecx, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0053d44e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x52acdf
xor eax, eax
jmp 0x52ad23
xchg ebx, eax
xchg ebx, eax
test dword [esp], eax
jno 0x52acfe
pushf
sub esp, 0
jl 0x52aced
popf
lea ebx, [ebx + 0x828]
lea ebx, [ebx - 0x828]
jo 0x52acfe
ljmp 0x31e8:0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00543d38
add esp, 4
and ecx, ecx
shl esp, 0
jg 0x52ad20
jae 0x52ad13
xchg ecx, esi
xchg ecx, esi
xchg esi, edx
xchg esi, edx
jle 0x52ad1d
jle 0x52ad20
mov esp, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52b0f2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0053d44e
add esp, 0xc
cmc
xor edi, dword [esp + 8]
xor edi, dword [esp + 8]
jbe 0x52b116
lea edx, [edx + 0x634c]
sub edx, 0x634c
jno 0x52b12b
jge 0x52b126
js 0x52b128
jo 0x52b12b
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
rol edi, 0
jl 0x52b178
test edi, 0x22a1
push edi
pop edi
je 0x52b18c
jmp 0x52b184
xchg edi, esi
xchg edi, esi
jne 0x52b18c
mov edx, 0xe84d8a0e
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.0053ed65
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x52b235
xor eax, eax
jmp 0x52b2f7
sub edx, 0
push esi
add esi, 0x74dc
ror esi, 0x14
pop esi
jno 0x52b260
pushf
not edi
not edi
ror eax, 0x1c
ror eax, 4
ja 0x52b253
xchg edx, esi
xchg edx, esi
popf
mov ecx, ecx
js 0x52b25d
jo 0x52b260
add eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005397c7
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0053d44e
add esp, 0xc
call fcn.0052b285
Function at 0x53cd5a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0053d44e
add esp, 0xc
and ebx, 0xffffffff
jp 0x53cd92
pushf
jp 0x53cd83
xchg esp, esp
ror esp, 0
popf
jle 0x53cd8c
nop
ja 0x53cd8f
jnp 0x53cd92
lcall 0x45c6, 0x4ef045c6
cmc
push 0x66f145c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
call 0x53cdc7
add esp, 4
jp 0x53cdcc
push edi
add edi, 0x2520
ror edi, 0xc
pop edi
jb 0x53cde4
mov esp, esp
lea esp, [esp]
je 0x53cde0
jae 0x53cde4
ljmp 0xe980:0xf04d8a4a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
test ebx, edi
jae 0x53ce4d
lea edi, [edi]
jb 0x53ce4d
lcall 0x89ff, 0xff5a07e8
inc ebp
cld
call fcn.00532859
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x53ce5f
xor eax, eax
jmp 0x53ce9b
ror edx, 0x19
rol edx, 0x19
push eax
pop eax
jae 0x53ce78
pushf
jg 0x53ce6d
xchg esp, esp
jae 0x53ce71
popf
jle 0x53ce75
jb 0x53ce78
xor eax, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005397c7
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0053d44e
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret