joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59a380
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
push esi
xor esi, esi
cmp eax, esi
mov word [esp + 0xc], si
mov word [esp + 0xe], si
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov word [esp + 0x18], si
jne 0x59a3b9
mov dword [esp + 4], 0x6054b50
mov word [esp + 8], si
mov word [esp + 0xa], si
jmp 0x59a3e6
mov dword [esp + 4], 0x605444f
mov dword [esp + 8], 1
mov ecx, 4
mov al, cl
mov dl, 3
imul dl
mov dl, byte [esp + ecx + 4]
sub al, 0x4d
xor dl, al
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x16
jb 0x59a3ce
mov ecx, dword [esp + 0x20]
lea eax, [esp + 4]
push 0x16
push eax
push ecx
call fcn.00567250
add esp, 0xc
cmp eax, 0x16
mov eax, 1
je 0x59a406
mov eax, esi
pop esi
add esp, 0x18
ret

Function at 0x59acd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push ebx
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
not eax
jl 0x59addd
push esi
mov esi, edi
shr esi, 3
mov ecx, esi
neg ecx
lea edi, [edi + ecx*8]
mov ecx, dword [esp + 0x14]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x62c244]
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x62c244]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x62c244]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x62c244]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x62c244]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x62c244]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x62c244]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x62c244]
xor eax, edx
inc ecx
dec esi
jne 0x59acf6
pop esi
jmp 0x59ade1
mov ecx, dword [esp + 0x10]
test edi, edi
je 0x59ae03
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x62c244]
xor eax, edx
inc ecx
dec edi
jne 0x59ade5
pop edi
pop ebx
not eax
ret

Function at 0x59ae60
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [0x6b6700]
mov edx, dword [esp + 4]
mov eax, ecx
and edx, 0xff
and eax, 0xff
xor eax, edx
shr ecx, 8
mov eax, dword [eax*4 + 0x62c244]
xor eax, ecx
mov ecx, dword [0x6b6704]
mov dword [0x6b6700], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [0x6b6708]
imul eax, eax, 0x8088405
inc eax
mov edx, ecx
mov dword [0x6b6704], eax
and edx, 0xff
shr eax, 0x18
xor eax, edx
shr ecx, 8
mov eax, dword [eax*4 + 0x62c244]
xor eax, ecx
mov dword [0x6b6708], eax
ret
Function at 0x59aef0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, eax
dec eax
test ecx, ecx
jle 0x59af2e
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea edi, [eax + 1]
mov dl, byte [esi]
mov byte [esp + 0x14], dl
call fcn.0059aed0
mov bl, al
mov eax, dword [esp + 0x14]
push eax
call fcn.0059ae60
mov dl, byte [esp + 0x18]
add esp, 4
xor bl, dl
mov byte [esi], bl
inc esi
dec edi
jne 0x59af05
pop edi
pop esi
pop ebx
ret
Function at 0x6d2410
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
push ecx
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, 0xa46de6
xor esi, eax
sub esi, eax
and esi, 0xffff
call 0x6d2431
pop eax
sub eax, 0x135
add esi, eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esi]
inc esi
push edi
mov ah, byte [esi]
xor ah, al
mov byte [edi], ah
inc esi
ror al, 1
inc edi
dec ecx
jne 0x6d2441
pop eax
pop ecx
pop edi
pop esi
ret

Function at 0x6d25fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, esi
add eax, dword [esi + 0x3c]
mov edi, esi
add edi, dword [eax + 0x78]
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.006d25c0
test eax, eax
jne 0x6d2669
mov ebx, 0
cmp ebx, dword [edi + 0x18]
jae 0x6d2686
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.006d25c0
test eax, eax
je 0x6d2680
lea eax, [ebx + ebx]
add eax, dword [edi + 0x24]
movzx eax, word [eax + esi]
shl eax, 2
add eax, dword [edi + 0x1c]
add esi, dword [eax + esi]
mov eax, esi
jmp 0x6d268b
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x6d2646
mov eax, 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10460058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104601a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1046007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1046006a
add dl, dl
jne 0x10460089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104600dc
xor eax, eax
add dl, dl
jne 0x10460096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1046017d
add dl, dl
jne 0x104600a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104600b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104600bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104600c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104600d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10460075
mov eax, 1
add dl, dl
jne 0x104600ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104600f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104600e1
sub eax, ebx
mov ebx, 1
jne 0x10460128
mov ecx, 1
add dl, dl
jne 0x1046010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10460119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10460105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10460075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1046013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1046014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10460136
cmp eax, 0x7d00
jae 0x1046016d
cmp eax, 0x500
jb 0x10460168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10460075
cmp eax, 0x7f
ja 0x10460170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10460075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1046019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10460075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40c5bf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40c5ce
pop dword [ebp - 0x34]
mov eax, 0x79f417c9
add eax, 0x864cae05
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x4ce40
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x3ab8
mov edx, eax
mov ebx, 0x2903f03d
add ebx, 0xd7436dc3
add ebx, dword [ebp - 0x34]
mov esi, 0xc4a7875c
xor dword [ebp - 4], 0xa810c3d2
mov edi, dword [ebx]
sub dword [ebp - 0x20], 0xa45c3e6c
xor edi, esi
xor dword [ebp - 0x24], eax
mov dword [edx], edi
xor dword [ebp - 4], 0x71461b21
add edx, 0x19e4f234
add edx, 0xe61b0dd0
add ebx, 0xde91283d
sub ebx, 0xde912839
loop 0x40c61c
add eax, 0x42c2b764
add eax, 0xbd3e264f
mov ebx, eax
add eax, 0x2205ad1d
add eax, 0xddfa52e8
mov ecx, 0xd1330662
sub ecx, 0xd0f30662
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x609b81
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x603fe8], 1
jne 0x609cdd
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0061511f
add esp, 0xc
rol edi, 5
rol edi, 0x1b
jge 0x609baf
and ecx, 0xffffffff
jo 0x609bb4
jns 0x609bcc
pushf
xor edx, 0
not esi
not esi
jmp 0x609bc1
popf
mov esp, esp
xchg ebx, ebx
mov esp, esp
js 0x609bcc
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
jmp 0x609bfa
xchg edx, esi
xchg edx, esi
js 0x609c14
lea esp, [esp]
lea edx, [edx + 0x53ec]
lea edx, [edx - 0x53ec]
jo 0x609c11
jns 0x609c14
xor eax, 0x80e84d8a
jmp 0xe8ae241e
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.00612b5a
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x609c81
mov eax, dword [ebp + 8]
jmp 0x609d5b
shl ebx, 0
and esi, 0xffffffff
jge 0x609ca2
pushf
cmp ebx, esi
popf
lea edi, [edi + 0x7038]
lea edi, [edi - 0x7038]
lea eax, [eax]
jge 0x609c9f
jl 0x609ca2
sub eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0060bf28
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0061511f
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x609cd3
mov edx, dword [ebp - 8]
mov dword [0x603fe8], edx
jmp 0x609cdb
mov eax, dword [ebp + 8]
jmp 0x609d5b
jmp 0x609ce5
mov eax, dword [0x603fe8]
mov dword [ebp - 8], eax
ror ebx, 0
jne 0x609d04
pushf
push ecx
add ecx, 0x3289
ror ecx, 0x1e
pop ecx
clc
cmp edx, edi
or esp, 0
popf
jae 0x609d01
je 0x609d04
mov eax, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
push edx
add edx, 0x55bc
ror edx, 4
pop edx
ror edi, 0
not esi
not esi
jno 0x609d2a
mov edi, edi
nop
ja 0x609d23
jns 0x609d25
jo 0x609d2a
xor eax, 0x558bb9b2
cld
mov edx, dword [ebp - 4]
push edx
call fcn.0061266b
add esp, 4
lea esi, [esi]
add ebx, 0x35ce
sub ebx, 0x35ce
jg 0x609d54
pushf
clc
popf
lea edx, [edx]
mov esp, esp
jns 0x609d51
jle 0x609d54
mov edi, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x60b4ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0060b4bc
Function at 0x610270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0061511f
add esp, 0xc
ja 0x610292
add edi, dword [esp]
sub edi, dword [esp]
ja 0x6102a0
lea ebx, [ebx]
jbe 0x6102a0
mov edx, 0xec45c6d8
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.00612b5a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x61036b
xor eax, eax
jmp 0x6103f3
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0060bf28
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0061511f
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x610395
xor eax, eax
jmp 0x6103f3
lea eax, [eax + 0x106b]
sub eax, 0x106b
xor ecx, dword [esp + 4]
xor ecx, dword [esp + 4]
lea esp, [esp]
mov eax, eax
jns 0x6103c2
pushf
rol eax, 0x1e
ror eax, 0x1e
popf
jb 0x6103bb
lea ebx, [ebx]
mov eax, eax
js 0x6103c2
call 0x51494951
mov eax, dword [ebp - 0x18]
push eax
call fcn.0061266b
add esp, 4
jge 0x6103d0
xor ebx, 0
test edx, 0x7efd
jbe 0x6103e8
xchg edi, esi
xchg edi, esi
jp 0x6103e1
lea ecx, [ecx]
mov ebx, ebx
ja 0x6103e8
ljmp 0x558b:0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x611553
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0061511f
add esp, 0xc
shr esp, 0
mov esp, esp
ja 0x611590
pushf
rol eax, 0xc
ror eax, 0xc
sub esp, 0
ror edi, 0x17
ror edi, 9
popf
jne 0x611588
xchg ecx, ecx
lea esp, [esp]
jbe 0x611590
mov eax, 0x53e045c6
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x52
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x7a
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x62
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x46
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
jo 0x6115f6
pushf
xchg ebx, esi
xchg ebx, esi
jmp 0x6115e6
call fcn.006115eb
Function at 0x611a8a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x611a9e
jmp 0x611c63
cmp esp, 0x5488
not ecx
not ecx
jno 0x611ac6
pushf
ror edx, 0x1f
ror edx, 1
xchg ebx, ecx
xchg ebx, ecx
jbe 0x611ab7
xor edi, eax
xor edi, eax
popf
jae 0x611abf
jl 0x611ac1
jne 0x611ac3
jo 0x611ac6
mov edx, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x604264], edx
sub edi, 0
xchg esp, esp
jno 0x611af1
pushf
cmp esi, dword [esp + 0x10]
rol esi, 9
ror esi, 9
popf
jo 0x611aee
jo 0x611af1
mov ecx, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x604154
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x604154], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x604150], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x604058], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x60405c], ecx
stc
jae 0x611b3c
pushf
add ecx, 0
push eax
add eax, 0x5f6e
ror eax, 0x19
pop eax
rol ebx, 0
popf
je 0x611b39
jb 0x611b3c
mov esi, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
xor esi, 0
ror ecx, 0x15
ror ecx, 0xb
ja 0x611b7b
jl 0x611b9f
pushf
lea ecx, [ecx + 0x756c]
sub ecx, 0x756c
test esp, 0x7b13
jns 0x611b93
lea esp, [esp]
popf
jl 0x611b9a
jge 0x611b9c
jge 0x611b9f
jmp 0x8151712d
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
lea esi, [esi + 0x14]
lea esi, [esi - 0x14]
jl 0x611c0f
jns 0x611c18
jae 0x611c13
js 0x611c18
mov ebp, 0x3d83f52d
push eax
inc ecx
pushal
add byte [eax], al
cmp dword [0x604150], 0
je 0x611c35
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x604150]
push eax
call fcn.0060bf28
mov dword [0x604260], eax
rol ebx, 7
ror ebx, 7
jae 0x611c3d
jbe 0x611c3f
cmp edx, dword [esp]
jae 0x611c53
pushf
mov esp, esp
popf
mov esi, esi
xchg edi, eax
xchg edi, eax
ja 0x611c50
jb 0x611c53
mov edx, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0061511f
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x61c37d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0061511f
add esp, 0xc
and ecx, 0xffffffff
xor ecx, dword [esp]
xor ecx, dword [esp]
jae 0x61c3c6
pushf
add edi, 0xc25
sub edi, 0xc25
nop
test esp, 0xd81
popf
xchg edx, edx
jb 0x61c3c3
jb 0x61c3c6
sub eax, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
lea eax, [eax + 0x666c]
lea eax, [eax - 0x666c]
jo 0x61c40d
jo 0x61c406
lea ebx, [ebx]
jno 0x61c40a
jno 0x61c40d
add eax, 0x80f04d8a
jmp 0xf0af4c17
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
shr ebx, 0
nop
je 0x61c473
jbe 0x61c47d
jg 0x61c477
mov ecx, ecx
ja 0x61c47d
add eax, 0xf3d9e814
add byte [eax], al
call fcn.0062b85b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x61c48f
xor eax, eax
jmp 0x61c4c5
xchg esp, esp
cmp esp, 0x6882
jae 0x61c4a2
lea ebx, [ebx]
jl 0x61c49d
mov edi, edi
jb 0x61c4a2
ljmp 0x4d8b:0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0060bf28
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0061511f
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61c500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0061511f
add esp, 0xc
xor eax, ebx
xor eax, ebx
jb 0x61c51f
jle 0x61c532
pushf
jle 0x61c525
jle 0x61c527
jle 0x61c529
popf
jg 0x61c52d
mov ecx, ecx
jg 0x61c532
mov ecx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
xchg ebx, esi
xchg ebx, esi
jge 0x61c582
pushf
or esp, 0
cmp edx, dword [esp + 0x10]
xor ebx, 0
or edx, 0
popf
xchg ebx, edx
xchg ebx, edx
jge 0x61c57f
jl 0x61c582
mov ecx, 0x80f44d8a
jmp 0xf4af4d8c
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
rol esi, 0
jbe 0x61c5fa
jo 0x61c5f1
lea eax, [eax]
jp 0x61c5f5
ja 0x61c5fa
mov esp, 0xd2e8da31
sub byte [eax], al
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x61eed1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x61c612
mov eax, 1
jmp 0x61c6ab
add eax, 0
cmp edi, dword [esp + 0xc]
rol esp, 0
jns 0x61c62c
pushf
or esp, 0
popf
xchg esp, esp
jmp 0x61c629
js 0x61c62c
mov eax, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0060bf28
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0061511f
add esp, 0xc
std
cld
jl 0x61c659
lea ecx, [ecx]
xchg esi, eax
xchg esi, eax
jge 0x61c659
xor eax, 0x7d83bec3
in al, dx
add byte [ebp + 7], dh
cmp dword [ebp - 0x14], 0
jne 0x61c666
mov eax, 1
jmp 0x61c6ab
or esi, esi
ror esi, 0
shr esp, 0
jbe 0x61c67a
jnp 0x61c672
js 0x61c674
jbe 0x61c676
ja 0x61c67a
jmp 0xeca7517d
mov eax, dword [ebp - 0x14]
push eax
call fcn.0061266b
add esp, 4
cmp ecx, edi
or ecx, 0
ror eax, 0x1e
ror eax, 2
jle 0x61c6a4
pushf
shl esi, 0
jae 0x61c69a
lea ebx, [ebx]
popf
lea esp, [esp]
jg 0x61c6a4
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4