joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e40
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x410068]
test esi, esi
jle 0x401f60
mov eax, dword [0x41006c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401e74
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401ef7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401e60
mov dword [esp], ebx
call fcn.00402850
mov edi, eax
test eax, eax
je 0x401f87
mov eax, dword [0x41006c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402990
mov edx, dword [0x41006c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401f67
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401ef0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401f00
add dword [0x410068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x41006c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401ef0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401de0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401e7e
mov eax, dword [0x41006c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401de0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401de0
lea esi, [esi]
nop

Function at 0x4024a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x410084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41007c]
sub esp, 4
test ebx, ebx
je 0x4024f5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4024ee
test esi, esi
je 0x4024ee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4024d0
mov dword [esp], 0x410084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402720
Capabilities:
Parse pe header
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_exit]
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__exit]
mov eax, dword [esp + 4]
xor edx, edx
cmp word [eax], 0x5a4d
jne 0x402758
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
je 0x402760
mov eax, edx
ret
xor edx, edx
cmp word [eax + 0x18], 0x10b
sete dl
mov eax, edx
ret

Function at 0x402850
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402875
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402880
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402875
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4028c8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4028be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4028ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4028b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x406e61
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x431414], 0
jne 0x406e9f
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406e75
mov dword [ecx*4 + 0x431410], eax
inc ecx
cmp ecx, 0x100
jl 0x406e70
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406ecc
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x431410]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ead
not eax
pop ebp
ret 0xc

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x1e219e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jno 0x1e219fa
mov edx, dword [esp + 3]
call fcn.01e21952
iretd
call 0x1e219e3
inc esp
invalid
dec edx
jno 0x1e219c0
jo 0x1e219c0
mov edi, 0x47b4ad3d
test byte [edi + ebx - 0x1695459a], cl
neg dx
jle 0x1e21a65
jg 0x1e21a65
in al, 0x7a
sbb eax, 0x109159ec
xchg ebx, eax
or ah, byte [ebp + 0x24548bd4]
add ecx, dword [ebp - reloc.kernel32.dll_VirtualAlloc]
enter 0xffffffffffffba66, 0xffffffffffffffed
clc
mov edx, dword [esp + 3]
lea esp, [esp + 0x24]
dec al
mov dx, 0xf8ed
jmp 0x1e219d6
jmp 0x1e21a49
xchg byte [esp + 9], ah
jmp 0x1e21a7d
xchg byte [esp + 9], ah
mov dl, 0xe4
xchg dx, ax
mov dl, dh
jmp 0x1e21a83
add bl, al
mov dh, dl
mov eax, 0x60239698
xchg dx, ax
dec ax
je 0x1e21a0a
jne 0x1e21a49
imul esi, ebx, 0x47f50663
jbe 0x1e21aaa
inc esi
mov ax, 0x8e4c
sub esp, 0x10
jp 0x1e21a0c
jnp 0x1e21a16
cmpsd dword [esi], dword es:[edi]
and dh, byte [eax - 0x146ddd29]
not dword [bp + si - reloc.kernel32.dll_VirtualAlloc]
sbb dh, byte [ebp + 0x64]
xchg edi, eax
jmp 0x1e21a30
mov dl, 0xe4
xchg dx, ax
mov dl, dh
call fcn.01e21a67
not eax
setnp al
ror cl, 0
and eax, 0x17c2eb46
jne 0x1e21ad4
setge al
mov edx, 0xa2d0556a
neg ax
clc
jmp 0x1e21ad6
lea edx, [esi - 0xfe]
lea esp, [esp + 4]
sub cl, 0xde
setg dh
xchg al, dh
jmp 0x1e21a88
setge al
mov edx, 0xa2d0556a
neg ax
jmp 0x1e21aec
jmp 0x1e21abe
mov eax, 0x6a4f6399
jmp 0x1e21af2
clc
mov eax, 0x6a4f6399
bsr eax, ecx
neg cl
bt edx, edx
jmp 0x1e21b41
not al
mov dx, word [esp]
bsf dx, ax
lea edx, [ebx*4]
mov eax, dword [esp]
rdtsc
jmp 0x1e21b4b
add byte [ebx + 0x25956603], dl
xchg esi, eax
mov dx, cx
setg dl
dec edx
jmp 0x1e2198d
bsf dx, ax
lea edx, [ebx*4]
mov eax, dword [esp]
jmp 0x1e21b14
jp 0x1e21b00
not al
mov dx, word [esp]
jmp 0x1e21b2b
rol cl, 0
inc eax
jmp 0x1e21c03
rdtsc
mov dx, ax
mov dx, 0xe025
bswap eax
neg ah
bsr ax, bp
jmp 0x1e21b9b
fiadd dword [edi + 0x55e9242c]
cli
invalid
sub esp, 0x10
jne 0x1e21bad
je 0x1e21bad
out dx, eax
jge 0x1e21b7c
je 0x1e21b18
inc ebx
fisttp word [esi - 0x24]
mov ebx, 0xa65f9256
ror dword [edx - reloc.kernel32.dll_VirtualAlloc], 1
adc al, 0xad
add byte [eax], al
add byte [eax], al
mov al, bh
inc cl
lea edx, [ebp*4]
xchg dx, ax
xchg dl, al
jmp 0x1e21b85
mov edx, ecx
dec eax
ja 0x1e21be7
stc
setp al
jmp 0x1e21be9
mov dx, 0xe025
bswap eax
neg ah
jmp 0x1e21b62
stc
setp al
jmp 0x1e21be9
jmp 0x1e21bd1
shl edx, 2
inc eax
jae 0x1e21c10
mov ax, word [esp]
inc ah
jmp fcn.01e20dd4
jle 0x1e21b55
rdtsc
mov dx, ax
jmp 0x1e21bc7
mov ax, word [esp]
jmp 0x1e22818
inc ah
jmp fcn.01e20dd4
Function at 0x1e21b1f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jno 0x1e219fa
mov edx, dword [esp + 3]
call fcn.01e21952
iretd
call 0x1e219e3
inc esp
invalid
dec edx
jno 0x1e219c0
jo 0x1e219c0
mov edi, 0x47b4ad3d
test byte [edi + ebx - 0x1695459a], cl
neg dx
jle 0x1e21a65
jg 0x1e21a65
in al, 0x7a
sbb eax, 0x109159ec
xchg ebx, eax
or ah, byte [ebp + 0x24548bd4]
add ecx, dword [ebp - reloc.kernel32.dll_VirtualAlloc]
enter 0xffffffffffffba66, 0xffffffffffffffed
clc
mov edx, dword [esp + 3]
lea esp, [esp + 0x24]
dec al
mov dx, 0xf8ed
jmp 0x1e219d6
jmp 0x1e21a49
xchg byte [esp + 9], ah
jmp 0x1e21a7d
xchg byte [esp + 9], ah
mov dl, 0xe4
xchg dx, ax
mov dl, dh
jmp 0x1e21a83
add bl, al
mov dh, dl
mov eax, 0x60239698
xchg dx, ax
dec ax
je 0x1e21a0a
jne 0x1e21a49
imul esi, ebx, 0x47f50663
jbe 0x1e21aaa
inc esi
mov ax, 0x8e4c
sub esp, 0x10
jp 0x1e21a0c
jnp 0x1e21a16
cmpsd dword [esi], dword es:[edi]
and dh, byte [eax - 0x146ddd29]
not dword [bp + si - reloc.kernel32.dll_VirtualAlloc]
sbb dh, byte [ebp + 0x64]
xchg edi, eax
jmp 0x1e21a30
mov dl, 0xe4
xchg dx, ax
mov dl, dh
call fcn.01e21a67
not eax
setnp al
ror cl, 0
and eax, 0x17c2eb46
jne 0x1e21ad4
setge al
mov edx, 0xa2d0556a
neg ax
clc
jmp 0x1e21ad6
lea edx, [esi - 0xfe]
lea esp, [esp + 4]
sub cl, 0xde
setg dh
xchg al, dh
jmp 0x1e21a88
setge al
mov edx, 0xa2d0556a
neg ax
jmp 0x1e21aec
jmp 0x1e21abe
mov eax, 0x6a4f6399
jmp 0x1e21af2
clc
mov eax, 0x6a4f6399
bsr eax, ecx
neg cl
bt edx, edx
jmp 0x1e21b41
not al
mov dx, word [esp]
bsf dx, ax
lea edx, [ebx*4]
mov eax, dword [esp]
rdtsc
jmp 0x1e21b4b
add byte [ebx + 0x25956603], dl
xchg esi, eax
mov dx, cx
setg dl
dec edx
jmp 0x1e2198d
bsf dx, ax
lea edx, [ebx*4]
mov eax, dword [esp]
jmp 0x1e21b14
jp 0x1e21b00
not al
mov dx, word [esp]
jmp 0x1e21b2b
rol cl, 0
inc eax
jmp 0x1e21c03
rdtsc
mov dx, ax
mov dx, 0xe025
bswap eax
neg ah
bsr ax, bp
jmp 0x1e21b9b
fiadd dword [edi + 0x55e9242c]
cli
invalid
sub esp, 0x10
jne 0x1e21bad
je 0x1e21bad
out dx, eax
jge 0x1e21b7c
je 0x1e21b18
inc ebx
fisttp word [esi - 0x24]
mov ebx, 0xa65f9256
ror dword [edx - reloc.kernel32.dll_VirtualAlloc], 1
adc al, 0xad
add byte [eax], al
add byte [eax], al
mov al, bh
inc cl
lea edx, [ebp*4]
xchg dx, ax
xchg dl, al
jmp 0x1e21b85
mov edx, ecx
dec eax
ja 0x1e21be7
stc
setp al
jmp 0x1e21be9
mov dx, 0xe025
bswap eax
neg ah
jmp 0x1e21b62
stc
setp al
jmp 0x1e21be9
jmp 0x1e21bd1
shl edx, 2
inc eax
jae 0x1e21c10
mov ax, word [esp]
inc ah
jmp fcn.01e20dd4
jle 0x1e21b55
rdtsc
mov dx, ax
jmp 0x1e21bc7
mov ax, word [esp]
jmp 0x1e22818
inc ah
jmp fcn.01e20dd4
Function at 0x1e23268
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edi
mov ch, cl
bsf cx, bp
je 0x1e2324c
sub esp, 0x18
push word [esp + 6]
jmp 0x1e23251
sub esp, 0x18
jmp 0x1e23277
pop word [esp]
lea ecx, reloc.kernel32.dll_VirtualAlloc
mov dh, 8
jmp 0x1e23288
mov ecx, ebx
lea ecx, [edi*4]
lea esp, [esp + 4]
jmp 0x1e2322b
push word [esp + 6]
pop word [esp]
lea ecx, reloc.kernel32.dll_VirtualAlloc
mov dh, 8
lea ecx, [ecx + edi]
jmp 0x1e232f1
lea ecx, [ebx + edi]
xchg cx, ax
mov dx, word [esp]
jmp 0x1e232d5
rcr ecx, 2
lea ecx, [ebx + edi]
xchg cx, ax
mov dx, word [esp]
shl edx, cl
jmp 0x1e23311
shl edx, cl
jmp 0x1e23311
bsr eax, ebp
jl 0x1e232fb
bswap edx
bsf cx, cx
mov eax, 0x7ef4f6b5
neg dh
jmp 0x1e23358
ror edi, 0
jl 0x1e232c0
rcr ecx, 2
jmp 0x1e232aa
bswap edx
bsf cx, cx
jmp 0x1e233c4
clc
bswap edx
lea esp, [esp + 0x18]
not edi
mov ax, word [esp]
jmp 0x1e232d9
sbb ax, bx
mov cx, word [esp]
mov cx, sp
jmp 0x1e2335e
btc cx, ax
jmp 0x1e233cf
dec edi
rdtsc
add edi, dword [ebp]
rdtsc
call fcn.01e2339e
fcomp dword [ecx - 0x37]
test al, 0x5b
wait
cmp bh, byte [edx + 0x7bba4f28]
sbb esi, dword [edx + 0x6d]
jl 0x1e233cb
sbb ax, bx
mov cx, word [esp]
mov cx, sp
jmp 0x1e2335e
mov eax, 0x7ef4f6b5
neg dh
btc cx, ax
xor edi, 0x6df2b82e
rcr ax, 0xc
jns 0x1e2333f
js 0x1e2337c
Function at 0x1e27873
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 0x12], ax
lea esp, [esp + 1]
lea esp, [esp + 0x18]
jmp 0x1e277d7

Function at 0x1e75b90
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x1e233a0
Function at 0x5bf5c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.005da12d
add esp, 0xc
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
cmp esp, 0x90e
jg 0x5bf60e
pushf
lea ebx, [ebx]
add eax, 0x5bbe
sub eax, 0x5bbe
call fcn.005bf5fe

Function at 0x5bfacc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005da12d
add esp, 0xc
lea esp, [esp]
jle 0x5bfaea
rol edx, 0
ror esp, 0
je 0x5bfb0b
pushf
rol esi, 0x1e
rol esi, 2
popf
lea edi, [edi + 0x10a4]
lea edi, [edi - 0x10a4]
jne 0x5bfb0b
add eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
test esp, 0x4086
ror esp, 0
jb 0x5bfb5a
pushf
add esp, 0
add esp, 0
jp 0x5bfb50
popf
jb 0x5bfb54
lea esp, [esp]
jae 0x5bfb5a
mov ebx, 0x80ec4d8a
jmp 0xeca98364
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.005d5752
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5bfbcc
xor eax, eax
jmp 0x5bfc4b
rol ecx, 0
je 0x5bfbdf
pushf
mov esp, esp
popf
nop
xchg ecx, ecx
jbe 0x5bfbdc
jne 0x5bfbdf
xor eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005cc224
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5bfc09
xor eax, eax
jmp 0x5bfc4b
rol ebx, 0x16
rol ebx, 0xa
test eax, edx
shr esp, 0
stc
jge 0x5bfc2d
pushf
cmp esp, 0xf83
clc
and edi, edi
popf
jns 0x5bfc26
jle 0x5bfc28
mov eax, eax
jl 0x5bfc2d
mov esp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.005c0cb3
add esp, 4
lea eax, [eax]
jle 0x5bfc3d
jg 0x5bfc44
jb 0x5bfc41
jle 0x5bfc44
mov edi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5c064f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005da12d
add esp, 0xc
shr edx, 0
ror ebx, 3
rol ebx, 3
and ecx, 0xffffffff
xor edx, ecx
xor edx, ecx
ja 0x5c0686
jno 0x5c0683
jbe 0x5c0686
mov esp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jp 0x5c0731
ror edi, 6
ror edi, 0x1a
jbe 0x5c074f
pushf
xchg esp, esp
ror esp, 0
or edx, 0
nop
popf
xchg ebx, ebx
jmp 0x5c074a
mov edx, edx
ja 0x5c074f
call 0x1ac063b
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.005d5752
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5c0764
xor eax, eax
jmp 0x5c07f3
jge 0x5c0766
ja 0x5c076d
jno 0x5c076a
jbe 0x5c076d
lcall 0x458b, 0x52e8558d
clc
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005cc224
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5c0797
xor eax, eax
jmp 0x5c07f3
jl 0x5c0799
xor ebx, 0
xor esp, 0
cmp esp, 0x2fb3
je 0x5c07b3
pushf
and edx, 0xffffffff
popf
jo 0x5c07b0
jne 0x5c07b3
mov edx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.005c0cb3
add esp, 4
ror esi, 2
rol esi, 2
cmp edi, 0x655a
jg 0x5c07cd
cmp ecx, dword [esp + 0xc]
js 0x5c07e8
lea esp, [esp]
xchg ebx, eax
xchg ebx, eax
lea ebx, [ebx + 0x31da]
lea ebx, [ebx - 0x31da]
jns 0x5c07e8
call 0xca19328
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5c2068
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005da12d
add esp, 0xc
jae 0x5c2083
jo 0x5c208c
jno 0x5c2087
jno 0x5c208c
add eax, 0x45c677b7
call 0xeda1e6d7
push esp
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
rol ecx, 0
jae 0x5c20e2
jo 0x5c20df
jb 0x5c20e2
mov esp, 0x80e84d8a
jmp 0xe8a9a8ec
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
not eax
not eax
ja 0x5c218f
jge 0x5c2186
jl 0x5c2188
jbe 0x5c218a
lea ebx, [ebx]
jbe 0x5c218f
mov ecx, 0x34de8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 7], dh
call 0x5c24e1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5c21a4
xor eax, eax
jmp 0x5c222e
xchg ebx, edx
xchg ebx, edx
lea edx, [edx + 0x32e5]
lea edx, [edx - 0x32e5]
jl 0x5c21bb
js 0x5c21b8
jge 0x5c21bb
mov edx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005cc224
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x5c21e5
xor eax, eax
jmp 0x5c222e
jno 0x5c21e7
jne 0x5c2203
pushf
cmp edi, dword [esp + 0x10]
popf
lea edx, [edx + 0x7cbb]
lea edx, [edx - 0x7cbb]
lea esp, [esp]
je 0x5c2203
mov esp, 0x51e44d8b
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005c0cb3
add esp, 4
jae 0x5c2211
add eax, 0
xor esi, 0
call fcn.005c221c
Function at 0x5c2327
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x5ba9dc], 1
jne 0x5c2492
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005da12d
add esp, 0xc
jp 0x5c234f
or esp, 0
test eax, 0x7bf7
shl ecx, 0
jb 0x5c236a
lea esp, [esp]
mov ecx, ecx
mov esi, esi
xchg ebx, edx
xchg ebx, edx
jae 0x5c236a
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
jl 0x5c239c
nop
rol ecx, 0x15
ror ecx, 0x15
jne 0x5c23bb
pushf
cmp esp, 0x161f
sub esi, 0
popf
mov ecx, ecx
je 0x5c23b6
jbe 0x5c23b8
je 0x5c23bb
mov edi, 0x80e84d8a
jmp 0xe8a9abc5
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.005d5752
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5c2430
xor eax, eax
jmp 0x5c24d8
and ecx, 0xffffffff
jae 0x5c243b
jno 0x5c2437
jb 0x5c243b
add eax, 0xe8458da5
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005cc224
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005da12d
add esp, 0xc
js 0x5c245d
js 0x5c245f
shr esp, 0
lea edx, [edx + 0x7ca3]
lea edx, [edx - 0x7ca3]
jl 0x5c247c
pushf
and esp, 0xffffffff
popf
je 0x5c2479
jge 0x5c247c
call 0x154a203
cmp dword [ebp - 8], 0
je 0x5c248c
mov eax, dword [ebp - 8]
mov dword [0x5ba9dc], eax
jmp 0x5c2490
xor eax, eax
jmp 0x5c24d8
jmp 0x5c249b
mov ecx, dword [0x5ba9dc]
mov dword [ebp - 8], ecx
cmp edx, ebx
jbe 0x5c24ab
xchg ebx, eax
xchg ebx, eax
js 0x5c24a3
xchg edx, esi
xchg edx, esi
ja 0x5c24ab
mov eax, 0xf8558b3d
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
shr esp, 0
sub esi, 0
jp 0x5c24c1
xchg edx, edi
xchg edx, edi
jnp 0x5c24c1
call 0xfca1b01c
mov eax, dword [ebp - 4]
push eax
call fcn.005c0cb3
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8