joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c01c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sahf
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
jo 0x50bfe4
inc ebp
cmc
inc edx
jo 0x50bfe4
inc ebp
cmc
inc edx
jae 0x50c023
jae 0x50c025
jo 0x50c027
lea eax, [eax]
jae 0x50c03f
pushf
nop
or ebx, 0
jno 0x50c033
lea edi, [edi]
popf
nop
xchg edi, edx
xchg edi, edx
jb 0x50c03f
mov ebp, 0x80e84d8a
jmp 0xe89e4849
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.00520551
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x50c0cb
xor eax, eax
jmp 0x50c143
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005132bc
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0052b4cd
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x50c141
xor ecx, 0x573
xor ecx, 0x573
jnp 0x50c0ff
jo 0x50c101
mov esp, esp
jb 0x50c111
jp 0x50c107
lea ecx, [ecx]
ja 0x50c10b
je 0x50c10d
jae 0x50c111
lcall 0xe850, 0xf8458b8e
sub ecx, esi
invalid
mov eax, dword [ebp - 8]
push eax
call fcn.00508f45
add esp, 4
jb 0x50c11f
call 0x50c124
add esp, 4
jg 0x50c134
pushf
jbe 0x50c12d
popf
jg 0x50c131
jle 0x50c134
mov esp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x50c143
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5130c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x50333c], 1
jne 0x513256
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0052b4cd
add esp, 0xc
nop
inc edx
dec edx
test esi, edi
clc
jl 0x513110
pushf
sub esp, 0
jns 0x5130fa
or ecx, ecx
push ebx
add ebx, 0x58d4
ror ebx, 0xc
pop ebx
popf
jge 0x51310b
js 0x51310d
jge 0x513110
call 0x493976da
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
ror ecx, 0x1b
rol ecx, 0x1b
jp 0x513148
rol eax, 0
jnp 0x513163
pushf
rol ecx, 0x19
ror ecx, 0x19
sub esp, 0
popf
jge 0x51315c
jae 0x51315e
jp 0x513160
jp 0x513163
call 0x81397ef1
jmp 0xe89eb96d
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.005242c6
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5131d8
xor eax, eax
jmp 0x5132b3
jo 0x5131da
call fcn.005131df
mov ecx, dword [0x50333c]
mov dword [ebp - 8], ecx
Function at 0x5133af
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0052b4cd
add esp, 0xc
push ecx
pop ecx
shr esp, 0
nop
neg eax
neg eax
jbe 0x5133dd
mov ebx, ebx
jg 0x5133d8
jp 0x5133da
ja 0x5133dd
mov ebx, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
dec ecx
inc ecx
xor esi, 0x4461
xor esi, 0x4461
jb 0x51342a
jl 0x513427
jae 0x51342a
sub eax, 0x80e84d8a
jmp 0xe89ebc34
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.00520551
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5134b0
xor eax, eax
jmp 0x513539
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005132bc
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0052b4cd
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x513537
lea edi, [edi + 0x188]
lea edi, [edi - 0x188]
js 0x5134f9
pushf
rol esp, 0
cmp edi, 0x212c
popf
nop
jb 0x5134f4
lea eax, [eax]
jns 0x5134f9
mov eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00508f45
add esp, 4
inc ebx
dec ebx
lea ebx, [ebx]
rol esi, 1
rol esi, 0x1f
cld
js 0x513522
pushf
test esp, 0x2dd3
popf
xchg edi, ecx
xchg edi, ecx
jns 0x513522
ljmp 0x4d8b:0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x513539
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x513e9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x503340], 1
jne 0x513fe9
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0052b4cd
add esp, 0xc
nop
lea edi, [edi]
ror ecx, 0x1b
rol ecx, 0x1b
je 0x513edf
pushf
not eax
not eax
inc ebx
dec ebx
popf
mov esp, esp
jne 0x513edf
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
mov edi, edi
rol ebx, 0
jl 0x513f29
pushf
jge 0x513f16
cmp edx, dword [esp]
rol esp, 0
cmp edx, 0x4e73
popf
xchg ebx, ebx
jge 0x513f29
mov esp, 0x80e84d8a
jmp 0xe89ec733
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.005242c6
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x513f96
mov eax, dword [ebp + 8]
jmp 0x514065
add esp, 0
je 0x513fb1
pushf
call fcn.00513fa2
mov eax, dword [0x503340]
mov dword [ebp - 8], eax
Function at 0x51741a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0052b4cd
add esp, 0xc
test edx, eax
or esp, 0
jge 0x51743a
ja 0x51744a
pushf
clc
popf
jmp 0x517443
xchg esp, esp
jl 0x517447
jbe 0x51744a
mov ebp, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
jns 0x51748c
jp 0x5174a3
pushf
xor eax, edx
xor eax, edx
xor ebx, dword [esp]
xor ebx, dword [esp]
popf
mov edx, edx
jmp 0x5174a0
jnp 0x5174a3
xor eax, 0x80ec4d8a
jmp 0xec9efcad
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.00520551
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x51753a
xor eax, eax
jmp 0x5175c7
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005132bc
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0052b4cd
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x5175c5
lea edx, [edx + 0x1ef]
lea edx, [edx - 0x1ef]
push ebx
add ebx, 0x5e44
ror ebx, 0xe
pop ebx
cmp edi, dword [esp]
je 0x517584
jg 0x51757e
jbe 0x517580
nop
jne 0x517584
mov ebp, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00508f45
add esp, 4
cmp ecx, 0x3c13
test dword [esp], ebx
stc
stc
jge 0x5175bc
pushf
rol esp, 0
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
ror eax, 0
and edi, edi
popf
xchg esi, ebx
xchg esi, ebx
jo 0x5175b7
jne 0x5175b9
jl 0x5175bc
ljmp 0x55ff:0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x5175c7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x520386
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0052b4cd
add esp, 0xc
ror esp, 0
rol ebx, 0
je 0x5203a7
ja 0x5203a9
jae 0x5203b6
mov esi, esi
jnp 0x5203af
mov eax, eax
js 0x5203b3
jb 0x5203b6
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
or ecx, 0
jb 0x5203ef
xor edi, edx
xor edi, edx
jo 0x5203f5
jp 0x520403
jmp 0x5203f9
xchg esp, esp
jae 0x5203fd
ja 0x5203ff
jnp 0x520403
add eax, 0xe84d8a11
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
test edx, 0x445a
jle 0x52048e
pushf
or eax, eax
push esi
pop esi
add eax, 0x37d0
sub eax, 0x37d0
popf
je 0x520487
js 0x520489
jnp 0x52048b
jg 0x52048e
mov ebx, 0x3e33e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.005242c6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5204a3
xor eax, eax
jmp 0x52054a
jl 0x5204a5
jg 0x5204c8
pushf
xor eax, ebx
xor eax, ebx
cmp edx, 0x5298
clc
nop
popf
xchg esp, esp
lea ebx, [ebx + 0x367b]
lea ebx, [ebx - 0x367b]
jle 0x5204c8
sub eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005132bc
mov dword [ebp - 4], eax
jb 0x5204da
jnp 0x5204e6
mov edx, edx
jbe 0x5204e0
jle 0x5204e2
jp 0x5204e6
mov ebx, 0x6a0d6ab7
add byte [ebp - 0x17af17bb], cl
fisubr dword [edi - 0x3b7d0000]
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0052b4cd
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x520500
or al, 0x83
jge 0x5204f5
add byte [ebp + 4], dh
xor eax, eax
jmp 0x52054a
cmp ebx, dword [esp]
ja 0x520514
jns 0x520507
xchg esi, ecx
xchg esi, ecx
je 0x52050d
jo 0x52050f
jbe 0x520514
mov edi, 0x4d8b458c
cld
mov ecx, dword [ebp - 4]
push ecx
call fcn.00508f45
add esp, 4
jns 0x520522
add ecx, 0x1cbb
sub ecx, 0x1cbb
cmp eax, dword [esp]
jo 0x520547
lea edi, [edi + 0x68a0]
lea edi, [edi - 0x68a0]
je 0x520541
jnp 0x520543
jno 0x520547
jmp 0xfca8046e
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52672f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0052b4cd
add esp, 0xc
cmp edx, 0x7c37
jmp 0x526757
jns 0x526759
xor edi, dword [esp + 8]
xor edi, dword [esp + 8]
jl 0x526784
pushf
jae 0x526767
xor esi, dword [esp + 8]
xor esi, dword [esp + 8]
lea eax, [eax + 0x54b6]
lea eax, [eax - 0x54b6]
popf
xchg esp, esp
js 0x526781
jge 0x526784
mov ebx, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
xor esp, 0
nop
jo 0x5267d0
pushf
mov edx, edx
xor edi, dword [esp]
xor edi, dword [esp]
jge 0x5267c6
popf
nop
lea esi, [esi]
jno 0x5267cd
jno 0x5267d0
call 0x8142b55e
jmp 0xf09fefda
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov esp, esp
jp 0x526834
jp 0x526836
xor edi, ecx
xor edi, ecx
jb 0x526844
mov esp, esp
ja 0x526840
jae 0x526844
add eax, 0x9d08e863
invalid
call fcn.00520551
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x526856
xor eax, eax
jmp 0x52689f
rol esi, 0xd
ror esi, 0xd
lea edx, [edx + 0x1d01]
sub edx, 0x1d01
jae 0x52686a
jne 0x52687c
pushf
jo 0x526870
shl esp, 0
popf
xchg ecx, ebx
xchg ecx, ebx
je 0x52687c
call 0x5142ae0d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005132bc
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0052b4cd
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x527eb1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0052b4cd
add esp, 0xc
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
jg 0x527ee6
pushf
mov ecx, ecx
add ebx, dword [esp]
sub ebx, dword [esp]
popf
mov esi, esi
nop
jle 0x527ee6
add esi, 0xc648ec45
inc ebp
clc
inc edx
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
add edi, dword [esp]
sub edi, dword [esp]
jne 0x527f2d
mov esi, esi
mov eax, eax
je 0x527f2d
jmp 0x813eccbb
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.00520551
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x527fb0
xor eax, eax
jmp 0x52802c
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.005132bc
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0052b4cd
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x52802a
cmc
jg 0x527feb
pushf
xor ebx, 0
rol edi, 0x10
ror edi, 0x10
popf
js 0x527fe8
jle 0x527feb
mov ebp, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.00508f45
add esp, 4
cmp edx, dword [esp + 8]
xchg esp, esp
xor ebx, edi
xor ebx, edi
ja 0x528003
jbe 0x528019
pushf
jne 0x528009
add eax, dword [esp]
sub eax, dword [esp]
popf
lea esp, [esp]
mov esi, esi
ja 0x528019
mov ecx, 0x5010458b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x52802c
xor eax, eax
pop edi
Function at 0x52b4fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0052b4cd
add esp, 0xc
and ebx, 0xffffffff
jo 0x52b51a
test esp, 0x6e2
jae 0x52b52e
pushf
nop
popf
jle 0x52b529
mov esp, esp
jb 0x52b52e
mov esp, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cmp eax, 0xc1d
cmp edi, 0x1152
je 0x52b57d
pushf
js 0x52b56f
lea esp, [esp]
jns 0x52b574
popf
js 0x52b578
xchg ebx, ebx
jne 0x52b57d
add eax, 0x80f04d8a
jmp 0xf0a03d87
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
jo 0x52b5df
jnp 0x52b5e1
ror esp, 0
jnp 0x52b5fe
pushf
lea edi, [edi + 0x7775]
lea edi, [edi - 0x7775]
popf
lea esp, [esp]
jp 0x52b5fb
jp 0x52b5fe
jmp 0xffdf79ea
call fcn.005242c6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x52b610
xor eax, eax
jmp 0x52b650
std
cld
push edi
pop edi
jl 0x52b62d
pushf
lea esi, [esi]
lea ecx, [ecx + 0x6fb8]
lea ecx, [ecx - 0x6fb8]
popf
lea eax, [eax]
jge 0x52b62d
sub eax, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005132bc
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0052b4cd
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52bd30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0052b4cd
add esp, 0xc
rol edx, 0
jbe 0x52bd4e
jb 0x52bd5b
xchg esp, esp
mov eax, eax
xchg esp, esp
jl 0x52bd58
jae 0x52bd5b
mov ebx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
shl esp, 0
xor esp, 0
xchg edx, edx
ror esp, 0
jne 0x52bd9d
js 0x52bd9a
je 0x52bd9d
lcall 0x1e9, 0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
shr esp, 0
jno 0x52be09
jns 0x52be04
xchg esp, esp
jo 0x52be09
jmp 0x114c4f5
call 0x538014
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x52be21
mov eax, 1
jmp 0x52bea9
xchg edi, edi
xchg ecx, eax
xchg ecx, eax
jg 0x52be27
mov esp, esp
ja 0x52be36
mov ebx, ebx
mov ebx, ebx
xchg esp, esp
jbe 0x52be36
call 0x45e056e5
hlt
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005132bc
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0052b4cd
add esp, 0xc
cmp ebx, 0x54e3
jo 0x52be64
jge 0x52be60
jno 0x52be64
jmp 0xecd0419c
cmp dword [ebp - 0x14], 0
jne 0x52be71
mov eax, 1
jmp 0x52bea9
mov esi, esi
jnp 0x52be89
xchg esp, esp
nop
jmp 0x52be7a
lea ebx, [ebx + 0x4360]
lea ebx, [ebx - 0x4360]
jp 0x52be89
add eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00508f45
add esp, 4
ja 0x52be97
cmc
je 0x52bea2
jns 0x52be9c
jmp 0x52be9e
jne 0x52bea2
mov eax, 0x84d8b58
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4