joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104734b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0104731c
add esp, 0xc
sub eax, 0
jle 0x1047377
pushf
shr esp, 0
popf
xchg esp, esp
mov esp, esp
jg 0x1047377
call 0x51ecb941
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0
jne 0x10473b5
jnp 0x10473b7
jo 0x10473bf
lea esi, [esi]
jno 0x10473bf
mov ebp, 0xe84d8a7a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
add ecx, 0x5089
sub ecx, 0x5089
jno 0x1047453
xchg esi, esi
xchg esi, ebx
xchg esi, ebx
jle 0x104744f
jo 0x1047453
mov ebx, 0xac60e83a
add dword [eax], eax
call 0x10620b8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1047468
xor eax, eax
jmp 0x10476e5
jbe 0x104746a
js 0x104746c
ror edx, 0x1a
rol edx, 0x1a
je 0x1047474
jl 0x104747b
lea eax, [eax]
jge 0x104747b
sub eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0105c3f6
mov dword [ebp - 0x1c], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0104731c
add esp, 0xc
ror esp, 0
neg edx
neg edx
add eax, 0
jns 0x10474b0
mov esp, esp
jp 0x10474ab
jo 0x10474ad
js 0x10474b0
mov ebp, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x10474bd
xor eax, eax
jmp 0x10476e5
lea ecx, [ecx + 0x4ec0]
lea ecx, [ecx - 0x4ec0]
shl esi, 0
jno 0x10474e6
pushf
rol ebx, 0x14
rol ebx, 0xc
nop
call fcn.010474dc
Function at 0x1047d9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0104731c
add esp, 0xc
mov esp, esp
jmp 0x1047dbb
inc ecx
dec ecx
jb 0x1047de3
pushf
lea edx, [edx + 0x606a]
sub edx, 0x606a
popf
lea esp, [esp]
lea ebx, [ebx + 0x82b]
lea ebx, [ebx - 0x82b]
jns 0x1047de0
jae 0x1047de3
mov eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cld
cld
jl 0x1047e17
jp 0x1047e1f
mov eax, eax
jnp 0x1047e1f
lcall 0xe980, 0xf04d8a01
add dword [eax + 0x558af04d], ecx
cmc
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
push esi
pop esi
test ebx, esi
ror esp, 0
jmp 0x1047e88
jb 0x1047ea1
pushf
not ecx
not ecx
ror esp, 0
sub eax, 0
popf
jp 0x1047e9a
xchg ecx, edx
xchg ecx, edx
jae 0x1047ea1
sub eax, 0x104a9
call fcn.0105834f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1047eb3
xor eax, eax
jmp 0x1047eea
cmc
js 0x1047ec7
lea ebx, [ebx + 0x3980]
lea ebx, [ebx - 0x3980]
js 0x1047ec4
jns 0x1047ec7
ljmp 0x4d8b:0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0105c3f6
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0104731c
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1049a33
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0104731c
add esp, 0xc
lea edi, [edi]
jbe 0x1049a6f
pushf
jge 0x1049a54
cmp ecx, ebx
sub ecx, 0
xor esp, 0
popf
jl 0x1049a60
lea eax, [eax + 0x1e5b]
lea eax, [eax - 0x1e5b]
ja 0x1049a6f
add eax, 0x48e045c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
xchg edx, edx
lea edi, [edi + 0x4510]
lea edi, [edi - 0x4510]
add ecx, dword [esp]
sub ecx, dword [esp]
mov esp, esp
jo 0x1049ada
jns 0x1049ad5
jbe 0x1049ad7
jno 0x1049ada
add eax, 0x80e04d8a
jmp 0xe15222e4
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
xor eax, 0
xor ebx, edx
xor ebx, edx
rol eax, 0
je 0x1049ba3
pushf
jp 0x1049b86
push edi
pop edi
rol edi, 0x15
rol edi, 0xb
lea ecx, [ecx + 0x46d7]
lea ecx, [ecx - 0x46d7]
popf
jns 0x1049b9e
jp 0x1049ba0
jne 0x1049ba3
sub eax, 0xe7a7
call fcn.0105834f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1049bb8
xor eax, eax
jmp 0x1049e63
rol edx, 0x12
rol edx, 0xe
jbe 0x1049bd6
pushf
and esp, 0xffffffff
ror edx, 0x14
ror edx, 0xc
popf
jo 0x1049bcf
xchg edx, edx
lea edx, [edx]
ja 0x1049bd6
mov edi, 0x51e04d8d
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0105c3f6
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0104731c
add esp, 0xc
jno 0x1049bf8
jns 0x1049c16
pushf
jl 0x1049bfe
add eax, dword [esp]
sub eax, dword [esp]
call fcn.01049c09
Function at 0x104bc2b
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x103cca0
call fcn.0105ee3a
add esp, 0xc
mov byte [0x103cca0], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x1061f3f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0104731c
add esp, 0xc
rol ecx, 0
jle 0x1061f5d
shr ecx, 0
or esp, 0
jno 0x1061f7a
pushf
jo 0x1061f69
and esp, 0xffffffff
add esi, 0
popf
jmp 0x1061f73
jne 0x1061f75
mov esp, esp
jo 0x1061f7a
mov esi, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jae 0x1061fac
jb 0x1061fc6
pushf
xor esp, 0
add ecx, 0x7ec9
sub ecx, 0x7ec9
popf
jmp 0x1061fc3
jae 0x1061fc6
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0105834f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1062038
xor eax, eax
jmp 0x10620af
jb 0x106203a
clc
or edx, 0
jge 0x106204b
jno 0x1062042
jl 0x1062044
jne 0x1062046
jp 0x1062048
jl 0x106204b
mov ebp, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0105c3f6
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0104731c
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1062075
xor eax, eax
jmp 0x10620af
ror esi, 0
xchg edi, ecx
xchg edi, ecx
jno 0x1062083
jae 0x1062080
jo 0x1062083
xor eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.01062a33
add esp, 4
jne 0x1062091
test dword [esp], eax
xor ecx, dword [esp]
xor ecx, dword [esp]
jg 0x10620a8
jb 0x106209e
jl 0x10620a0
lea esp, [esp]
jle 0x10620a8
add eax, 0x4d8ba59f
or byte [ecx - 1], dl
push ebp
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10624f1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0104731c
add esp, 0xc
xchg edx, ebx
xchg edx, ebx
ja 0x106252c
pushf
rol edi, 7
ror edi, 7
cmp ebx, dword [esp + 4]
popf
jg 0x1062527
xchg edx, edx
jbe 0x106252c
mov esp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
cmp ebx, dword [esp + 0xc]
jo 0x10625db
ja 0x10625dd
lea esp, [esp]
jae 0x10625fd
pushf
add esi, 0x6c60
sub esi, 0x6c60
jb 0x10625f2
cmp edi, dword [esp + 8]
popf
xchg ebx, eax
xchg ebx, eax
jb 0x10625fd
sub eax, 0xffff5d4d
call fcn.0105834f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1062612
xor eax, eax
jmp 0x10626b9
call fcn.01062617
Function at 0x10627c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0104731c
add esp, 0xc
nop
jne 0x10627f6
pushf
xchg edi, edi
xor esp, 0
test dword [esp], ebx
xor edx, dword [esp + 4]
xor edx, dword [esp + 4]
popf
lea esi, [esi]
je 0x10627f6
mov ebp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
xchg ebx, ebx
test edi, 0x39a0
jl 0x1062834
jno 0x106283b
jle 0x1062838
jo 0x106283b
add eax, 0x80e84d8a
jmp 0xe953b045
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
nop
stc
test eax, esi
xor edx, dword [esp]
xor edx, dword [esp]
jl 0x10628c2
pushf
neg edx
neg edx
lea esi, [esi]
popf
jbe 0x10628bb
lea ecx, [ecx]
je 0x10628bf
jge 0x10628c2
ljmp 0x89ff:0xff5a88e8
call fcn.0105834f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10628d7
xor eax, eax
jmp 0x1062991
and esp, 0xffffffff
jp 0x10628dc
clc
mov edi, edi
jle 0x10628f1
pushf
ror esp, 0
popf
lea ecx, [ecx]
jg 0x10628ec
jge 0x10628ee
jg 0x10628f1
mov edx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0105c3f6
mov dword [ebp - 4], eax
ror ecx, 0
jle 0x1062906
not ecx
not ecx
cmp edx, dword [esp + 8]
jno 0x1062927
pushf
or esp, 0
cmp edi, dword [esp + 4]
stc
test dword [esp + 8], edx
popf
jp 0x1062922
xchg esi, esi
jo 0x1062927
call 0x1703695
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0104731c
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1062941
xor eax, eax
jmp 0x1062991
lea ecx, [ecx + 0x2adf]
lea ecx, [ecx - 0x2adf]
test esp, 0x50b3
jge 0x1062955
jo 0x1062960
lea edi, [edi]
jno 0x106295b
jno 0x1062960
call 0x4e91550d
cld
mov ecx, dword [ebp - 4]
push ecx
call fcn.01062a33
add esp, 4
lea edx, [edx + 0x676d]
sub edx, 0x676d
xor esi, dword [esp + 0xc]
xor esi, dword [esp + 0xc]
jns 0x106298e
pushf
or ebx, 0
popf
jle 0x106298b
js 0x106298e
xor eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10658ef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x103ca80], 1
jne 0x1065a55
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0104731c
add esp, 0xc
cmp ecx, 0x5fa9
jne 0x106591d
jnp 0x1065933
pushf
add edx, 0
lea esp, [esp]
xor esp, 0
popf
jge 0x106592e
jnp 0x1065930
jp 0x1065933
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
sub esp, 0
jbe 0x106597b
pushf
rol eax, 0xc
rol eax, 0x14
popf
jnp 0x1065974
jno 0x1065976
je 0x1065978
ja 0x106597b
xor eax, 0x80e84d8a
jmp 0xe953e185
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0105834f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10659f0
xor eax, eax
jmp 0x1065ab1
rol edi, 0x18
rol edi, 8
jbe 0x10659f8
cmp ebx, edx
je 0x1065a02
ja 0x10659fe
jne 0x1065a02
xor eax, 0xe8458dda
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0105c3f6
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0104731c
add esp, 0xc
rol ecx, 0
xor esi, dword [esp]
xor esi, dword [esp]
jg 0x1065a2d
std
cld
jl 0x1065a3f
pushf
cld
popf
xchg edx, edx
lea esi, [esi]
jns 0x1065a3c
jge 0x1065a3f
mov ebp, 0xf87d83
cmp dword [ebp - 8], 0
je 0x1065a4f
mov eax, dword [ebp - 8]
mov dword [0x103ca80], eax
jmp 0x1065a53
xor eax, eax
jmp 0x1065ab1
jmp 0x1065a5e
mov ecx, dword [0x103ca80]
mov dword [ebp - 8], ecx
mov edx, edx
jb 0x1065a6c
jge 0x1065a64
jle 0x1065a66
nop
jo 0x1065a69
jae 0x1065a6c
or dword [ebx + 0x5589f855], 0x4f928dfc
adc eax, 0xea810000
dec edi
adc eax, 0xf60b0000
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
lea edx, [edx + 0x154f]
sub edx, 0x154f
or esi, esi
neg esi
neg esi
mov esi, esi
je 0x1065a9a
pushf
nop
nop
shl esp, 0
test eax, 0x7cb6
popf
nop
jne 0x1065a9a
lcall 0x90e8, 0x50fc458b
iretd
mov eax, dword [ebp - 4]
push eax
call fcn.01062a33
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1065f56
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0104731c
add esp, 0xc
lea ebx, [ebx + 0x5d1]
lea ebx, [ebx - 0x5d1]
test dword [esp], edx
xor ecx, 0
not ecx
not ecx
jnp 0x1065f96
xchg ebx, esi
xchg ebx, esi
lea eax, [eax]
jge 0x1065f8f
lea esp, [esp]
jp 0x1065f96
mov esi, 0xec45c61a
jp 0x1065f61
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0xea4c25e9
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
and ecx, 0xffffffff
jp 0x1065fe8
jnp 0x1065fd5
lea ecx, [ecx + 0x1019]
lea ecx, [ecx - 0x1019]
jmp 0x1065fe3
jnp 0x1065fe8
add eax, 0x4d8a5404
hlt
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
rol esp, 0
jp 0x106605e
test edx, 0x4632
je 0x106606e
jnp 0x1066068
lea ecx, [ecx]
jne 0x106606e
mov edx, 0x22dce888
invalid
call fcn.0105834f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1066081
jmp 0x1066129
jg 0x1066083
xor esp, 0
jo 0x1066096
pushf
test dword [esp], edx
popf
jno 0x1066091
je 0x1066093
jno 0x1066096
mov ecx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0105c3f6
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0104731c
add esp, 0xc
shr esp, 0
cmp esi, 0x5949
ror ecx, 0x16
ror ecx, 0xa
jae 0x10660cc
jo 0x10660c9
jb 0x10660cc
add eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x10660d4
jmp 0x1066129
push ecx
add ecx, 0x1229
ror ecx, 0x14
pop ecx
lea ecx, [ecx + 0x56d3]
lea ecx, [ecx - 0x56d3]
clc
push ecx
pop ecx
jp 0x10660fe
pushf
or edx, 0
popf
jb 0x10660f9
jb 0x10660fb
jnp 0x10660fe
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.01062a33
add esp, 4
jl 0x106610c
cmp eax, dword [esp + 0x10]
jae 0x1066122
pushf
cld
or ecx, 0
stc
popf
jns 0x106611d
xchg esi, esi
jb 0x1066122
call 0x510ea6b1
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1066166
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0104731c
add esp, 0xc
call 0x106618b
lea esp, [esp + 4]
cld
or esp, 0
xor esi, dword [esp + 8]
xor esi, dword [esp + 8]
jp 0x10661a4
jle 0x106619f
jnp 0x10661a4
mov esp, 0x45c6b906
invalid
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
ja 0x10661d6
je 0x10661f1
pushf
dec ecx
inc ecx
popf
ja 0x10661e0
jl 0x10661e2
lea edi, [edi + 0x22a2]
lea edi, [edi - 0x22a2]
jne 0x10661f1
add eax, 0x80f04d8a
jmp 0xf153e9fb
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
xor ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x10]
rol ebx, 0x12
rol ebx, 0xe
jno 0x1066261
jle 0x1066263
jbe 0x1066273
pushf
cmc
jmp 0x106626a
popf
mov edi, edi
xchg esp, esp
ja 0x1066273
mov ecx, 0xfe661de8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.0104c895
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1066285
xor eax, eax
jmp 0x10662bc
ror edx, 0xb
rol edx, 0xb
inc ebx
dec ebx
jbe 0x1066299
lea ebx, [ebx]
jns 0x1066293
xchg esp, esp
ja 0x1066299
mov esp, 0xf0458d49
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0105c3f6
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0104731c
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret