joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2056a514
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2057149a
add esp, 0xc
rol edx, 2
rol edx, 0x1e
xor esp, 0
jp 0x2056a54d
jo 0x2056a53a
lea edx, [edx + 0x3e7b]
lea edx, [edx - 0x3e7b]
xchg edx, ecx
xchg edx, ecx
jnp 0x2056a54d
xor eax, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
xor esp, 0
test eax, 0x2b04
jmp 0x2056a587
js 0x2056a59b
pushf
lea esp, [esp]
js 0x2056a590
jne 0x2056a592
popf
js 0x2056a596
lea ecx, [ecx]
jns 0x2056a59b
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov esp, esp
jle 0x2056a60f
pushf
and esp, 0xffffffff
jnp 0x2056a606
popf
jmp 0x2056a60a
jl 0x2056a60c
jg 0x2056a60f
xor eax, 0x104f5e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.2057ab09
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2056a624
xor eax, eax
jmp 0x2056a6a9
ror esp, 0
jl 0x2056a637
pushf
test dword [esp], edi
popf
ja 0x2056a632
xchg esi, eax
xchg esi, eax
jge 0x2056a637
mov ebx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.20583c1d
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2057149a
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x2056a692
jno 0x2056a65f
rol edx, 0x13
ror edx, 0x13
js 0x2056a66f
ja 0x2056a669
jne 0x2056a66b
jns 0x2056a66f
jmp 0x1c9c3219
mov eax, dword [ebp - 4]
push eax
call fcn.2057935a
add esp, 4
push esi
pop esi
jl 0x2056a689
jl 0x2056a681
lea edx, [edx]
mov esp, esp
jge 0x2056a689
ljmp 0xff51:0x84d8b79
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x2056a6a9
and ecx, ecx
jnp 0x2056a696
jb 0x2056a6a7
pushf
lea esi, [esi]
popf
ja 0x2056a6a0
mov eax, eax
mov eax, eax
jae 0x2056a6a7
lcall 0x8b5b, 0x5e5fc033
in eax, 0x5d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x205714c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
mov ax, word [0x2055cda4]
cmp eax, 1
jne 0x205714ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x20571699
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2057149a
add esp, 0xc
and edx, 0xffffffff
lea edi, [edi + 0x41cc]
lea edi, [edi - 0x41cc]
je 0x20571510
jge 0x2057150d
jne 0x20571510
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
lea edx, [edx]
jnp 0x20571548
test ecx, ebx
sub ecx, 0
jbe 0x20571560
pushf
jo 0x20571553
std
cld
popf
xchg esp, esp
jge 0x2057155b
jg 0x2057155d
ja 0x20571560
add eax, 0x80e8558a
ljmp 0x458a
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
or esp, 0
add edx, 0x1def
sub edx, 0x1def
jae 0x205715d9
lea esi, [esi]
jle 0x205715e9
jmp 0x205715df
lea esi, [esi]
xchg ebx, edi
xchg ebx, edi
jg 0x205715e9
mov edi, 0x951be87d
add byte [eax], al
call fcn.2057ab09
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x205715fe
xor eax, eax
jmp 0x20571699
lea edi, [edi]
rol ecx, 0
jge 0x20571612
ja 0x20571607
xchg edx, esi
xchg edx, esi
jl 0x2057160d
mov ecx, ecx
jl 0x20571612
mov eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.20583c1d
mov dword [ebp - 4], eax
test ecx, 0x41e5
js 0x20571638
pushf
shr ecx, 0
popf
jns 0x20571633
jbe 0x20571635
jns 0x20571638
sub eax, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2057149a
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x20571652
xor eax, eax
jmp 0x20571699
jg 0x20571654
test dword [esp + 4], edx
cmp eax, 0x7fdb
ja 0x2057167f
pushf
cmp esi, dword [esp]
xor edx, dword [esp]
xor edx, dword [esp]
not ecx
not ecx
call fcn.20571673
Function at 0x20572563
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2057149a
add esp, 0xc
ror ecx, 0xc
rol ecx, 0xc
cmp ebx, 0x567c
jg 0x2057258a
mov ecx, ecx
jne 0x205725ae
xchg esp, esp
lea ecx, [ecx + 0x1474]
lea ecx, [ecx - 0x1474]
xchg esp, esp
lea edx, [edx + 0x1fa4]
lea edx, [edx - 0x1fa4]
je 0x205725ae
mov esi, 0xec45c62a
inc esp
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
test dword [esp], ecx
and edi, edi
jmp 0x205725e5
jo 0x205725ef
mov esp, esp
lea esp, [esp]
jno 0x205725ef
add eax, 0x80ec4d8a
jmp 0xca4adf9
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.2057ab09
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20572664
xor eax, eax
jmp 0x205726f7
xor ebx, edi
xor ebx, edi
shl ecx, 0
jg 0x20572678
xchg edx, ebx
xchg edx, ebx
xchg edi, edi
jle 0x20572675
jle 0x20572678
mov edi, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.20583c1d
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2057149a
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x205726a2
xor eax, eax
jmp 0x205726f7
lea esp, [esp]
jle 0x205726a7
not ecx
not ecx
ror esp, 0
je 0x205726cb
pushf
jns 0x205726b4
xor edi, 0x5ffe
xor edi, 0x5ffe
neg edx
neg edx
popf
jl 0x205726c8
jne 0x205726cb
jmp 0x71536c5a
mov eax, dword [ebp - 4]
push eax
call fcn.2057935a
add esp, 4
or edi, 0
xchg esi, esi
cmp edi, dword [esp]
mov edi, edi
jo 0x205726f0
jae 0x205726e5
jo 0x205726e7
jb 0x205726e9
xchg ebx, ebx
jno 0x205726f0
lcall 0x5108, 0x4d8b5606
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20572fd8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2057149a
add esp, 0xc
ror ecx, 0x11
ror ecx, 0xf
call 0x20573003
lea esp, [esp + 4]
stc
clc
jb 0x2057301f
js 0x2057300d
lea ebx, [ebx + 0x333]
lea ebx, [ebx - 0x333]
mov ecx, ecx
jae 0x2057301f
mov esp, 0xe845c65c
push ecx
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
je 0x205730ca
nop
test esp, 0x4a3a
and eax, 0xffffffff
jo 0x205730e8
pushf
and esp, 0xffffffff
rol edi, 0x12
rol edi, 0xe
popf
xchg ebx, ebx
jno 0x205730e8
add eax, 0x7a1ce8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.2057ab09
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x205730fd
xor eax, eax
jmp 0x205731b8
push ebx
add ebx, 0x1eb0
ror ebx, 0x15
pop ebx
jns 0x2057310a
jmp 0x2057310c
jo 0x2057310e
js 0x20573123
pushf
mov esp, esp
xchg ebx, eax
xchg ebx, eax
popf
mov esp, esp
xchg edx, edi
xchg edx, edi
jge 0x20573120
jns 0x20573123
sub eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.20583c1d
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2057149a
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x2057314d
xor eax, eax
jmp 0x205731b8
add esp, 0
cmp edx, dword [esp + 4]
rol ebx, 4
ror ebx, 4
rol edx, 0xb
rol edx, 0x15
js 0x20573178
pushf
rol ebx, 0
lea eax, [eax]
xchg ebx, edi
xchg ebx, edi
jge 0x2057316f
popf
xchg edx, esi
xchg edx, esi
jns 0x20573178
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.2057935a
add esp, 4
test ebx, 0x30bd
rol edi, 0xc
rol edi, 0x14
je 0x205731ad
pushf
lea edx, [edx + 0x4a80]
lea edx, [edx - 0x4a80]
mov ecx, ecx
popf
jnp 0x205731a6
ja 0x205731a8
jg 0x205731aa
jne 0x205731ad
mov ecx, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2057447d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2057149a
add esp, 0xc
sub esp, 0
add eax, 0
xor esp, 0
xor ebx, eax
xor ebx, eax
ja 0x205744b7
pushf
jne 0x205744a9
or esp, 0
popf
je 0x205744b0
jae 0x205744b2
jg 0x205744b4
jbe 0x205744b7
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
dec ebx
inc ebx
cld
je 0x20574518
xchg esp, esp
lea ecx, [ecx + 0x1bb6]
lea ecx, [ecx - 0x1bb6]
jno 0x20574514
jne 0x20574518
add eax, 0xe84d8a81
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.2057ab09
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x205745c1
xor eax, eax
jmp 0x20574651
sub edi, 0
jge 0x205745c6
push edx
add edx, 0x3aff
ror edx, 0x15
pop edx
jbe 0x205745d3
js 0x205745e1
xchg esi, edx
xchg esi, edx
mov esp, esp
lea eax, [eax]
jns 0x205745e1
add dword [ecx + 0x50e8458d], 0x51fc4d8b
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.20583c1d
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.2057149a
add esp, 0xc
mov esi, esi
jp 0x20574618
pushf
jle 0x20574609
rol esp, 0
popf
jle 0x20574610
jae 0x20574612
lea esp, [esp]
jnp 0x20574618
sub eax, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x20574622
xor eax, eax
jmp 0x20574651
not edx
not edx
lea eax, [eax]
jae 0x2057462a
rol ebx, 0
jg 0x20574636
je 0x20574631
jle 0x20574636
and dword [eax], 0xe4458b70
mov eax, dword [ebp - 0x1c]
push eax
call fcn.2057935a
add esp, 4
jne 0x20574644
je 0x2057464e
je 0x20574648
jg 0x2057464a
jne 0x2057464e
mov eax, 0xe455ffb3
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x20575149
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2057149a
add esp, 0xc
shr ebx, 0
jo 0x20575167
jne 0x20575192
pushf
jg 0x2057516d
sub ecx, 0
call fcn.20575175

Function at 0x20577324
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2057149a
add esp, 0xc
xor edx, 0
shl ebx, 0
jl 0x20577345
jb 0x2057735c
jo 0x20577349
lea edx, [edx]
lea ebx, [ebx + 0x5ffe]
lea ebx, [ebx - 0x5ffe]
jnp 0x20577359
jae 0x2057735c
mov edx, 0x50e845c6
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0
mov esp, esp
jg 0x2057739c
ror edx, 7
ror edx, 0x19
jb 0x205773b8
pushf
cmp edi, dword [esp]
dec ebx
inc ebx
inc edx
dec edx
popf
jp 0x205773b1
jl 0x205773b3
xchg esi, esi
jae 0x205773b8
mov edi, 0x80e84d8a
jmp 0x8a4fbc2
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
cld
lea ebx, [ebx + 0x70c]
sub ebx, 0x70c
jns 0x20577459
pushf
clc
mov esi, esi
popf
jbe 0x2057744a
lea edi, [edi + 0x5492]
lea edi, [edi - 0x5492]
js 0x20577459
mov edx, 0x1213ee8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 7], dh
call 0x2058959c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2057746e
xor eax, eax
jmp 0x205776c3
test dword [esp], edi
std
cld
sub esp, 0
cmp eax, dword [esp]
jge 0x20577494
pushf
ror esp, 0
add esp, 0
not ebx
not ebx
rol eax, 0xc
rol eax, 0x14
popf
xchg esi, esi
jl 0x20577494
call 0x713fba25
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.20583c1d
mov dword [ebp - 0x1c], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.2057149a
add esp, 0xc
or esp, 0
call fcn.205774bc
Function at 0x20579b25
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2057149a
add esp, 0xc
or ecx, 0
js 0x20579b4f
pushf
mov esp, esp
popf
nop
jno 0x20579b4c
jns 0x20579b4f
mov esp, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
test esp, 0x6cc5
cmp esp, 0x36eb
nop
jbe 0x20579b93
xchg ebx, ebx
ja 0x20579b93
mov eax, 0x80f04d8a
jmp 0x10a5239d
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
ror ebx, 0
je 0x20579bfe
xchg ebx, ebx
nop
jne 0x20579bfe
mov ebx, 0xf06e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.2057ab09
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20579c10
xor eax, eax
jmp 0x20579c50
test edx, 0x72a8
lea edx, [edx + 0xf6f]
lea edx, [edx - 0xf6f]
jle 0x20579c2d
jns 0x20579c26
xchg esi, eax
xchg esi, eax
jg 0x20579c2d
xor eax, 0x458d46cb
invalid
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.20583c1d
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2057149a
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2057a882
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.2057149a
add esp, 0xc
dec edi
inc edi
jb 0x2057a89f
jl 0x2057a8bc
pushf
jno 0x2057a8a5
lea ebx, [ebx + 0x50c0]
lea ebx, [ebx - 0x50c0]
xchg ecx, edi
xchg ecx, edi
popf
mov edi, edi
jge 0x2057a8bc
mov ebp, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
lea esi, [esi]
rol esp, 0
jle 0x2057a914
jbe 0x2057a90d
js 0x2057a90f
jo 0x2057a911
jg 0x2057a914
add eax, 0x80e44d8a
jmp 0x4a5311e
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.2057ab09
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2057a9c5
xor eax, eax
jmp 0x2057aa45
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.20583c1d
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.2057149a
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x2057aa43
test dword [esp + 0x10], ecx
cmp esp, 0x4b9a
je 0x2057a9f7
jbe 0x2057aa17
pushf
lea esp, [esp]
ror eax, 0x16
rol eax, 0x16
popf
lea esi, [esi + 0x7e45]
lea esi, [esi - 0x7e45]
xchg edx, edx
ja 0x2057aa17
or dword [ebx - 0x17ae03b3], 0xffffe93a
mov ecx, dword [ebp - 4]
push ecx
call fcn.2057935a
add esp, 4
nop
jns 0x2057aa2a
nop
js 0x2057aa2a
sub eax, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x2057aa45
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14