joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbcc52b
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], sp
bsf di, ax
mov word [esp], di
jmp 0xbcc7d4
lea edi, [edi + 8]
mov dword [edi], edx
pop edi
lea edi, [eax + ebx]
mov edx, dword [esp]
jmp 0xbcc5dd
pushal
mov eax, dword [esp]
mov dword [esp], ecx
stc
popal
jmp 0xbcc577
xor edx, esi
setge bl
mov esi, 0x57bc0c6c
xchg di, bp
jmp 0xbcc66e
shl edx, 8
mov bl, byte [esp]
neg di
xchg bl, bh
mov ebx, 0x6caddf94
jmp 0xbcc59b
rcr dh, 5
clc
lea esp, [esp + 4]
movzx edx, byte [eax + 0xc]
mov bl, byte [esp]
jmp 0xbcc5b9
xor edx, eax
xchg al, ah
mov si, di
xchg bx, si
push edx
jmp 0xbcc646
xchg bx, di
shl edx, 8
push edx
jmp 0xbcc5ee
clc
pushal
xor edx, esi
ror edi, 0x15
mov bl, byte [esp]
jmp 0xbcc605
mov si, dx
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0xbcc653
mov dword [ecx + 0xc], edx
setg ah
setg al
mov eax, edx
jmp 0xbcc62b
shr eax, 0x10
lea esp, [esp + 0x40]
mov esi, 0xff
bswap ebp
jmp 0xbcc67b
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
jmp 0xbcc61f
and eax, esi
mov di, cx
mov bx, word [esp]
xchg bl, bh
jmp 0xbcc781
bsf bx, ax
mov edi, edx
lea ebp, [esi - 0x1d]
mov bl, byte [esp]
lea ebp, [ecx - 0x4d573765]
jmp 0xbcc6dc
lea esp, [esp + 8]
movzx esi, byte [eax + 0xd]
push edx
push edi
jmp 0xbcc590
mov edi, dword [edi*4 + 0xbaa590]
mov ebx, dword [esp]
dec bx
mov bl, byte [esp]
setle bl
jmp 0xbcc746
shr edi, 8
and edi, esi
btc ebp, edi
jmp 0xbcc6b4
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
call fcn.00bcc6e6
shr edi, 0x18
lea ebp, [ecx + 3]
clc
inc bp
jmp 0xbcc758
and edi, 0xff0000
mov bl, 0xcc
mov bl, byte [esp]
mov bl, bh
lea ebp, [ebx + esi]
jmp 0xbcc705
movzx edi, byte [edi*4 + 0xbaa590]
btr ebp, edx
bt ebp, ebx
xor eax, edi
jmp 0xbcc7bb
mov edi, edx
jmp 0xbcc79c
mov eax, dword [eax*4 + 0xbaa590]
mov di, 0x3203
xor eax, 0x1000000
xchg bx, di
mov di, sp
jmp 0xbcc68b
and edi, esi
push esp
mov bp, 0x7f9
bsf bp, si
jmp 0xbcc818
mov edi, 0x4b80fe6c
lea edi, [ecx*4]
mov di, word [esp]
jmp 0xbcc76a
xor edx, esi
mov si, 0x5dd1
lea esi, [esi + 0x642a1fe5]
mov esi, dword [esp]
mov di, 0xc07b
jmp 0xbcc6a5
and edi, ebp
sub esp, 0x10
call 0xbcc7f7
dec edx
pop dword [esp + 8]
xor eax, edi
jmp 0xbcc995
lea edi, [ecx + 0x10]
jmp 0xbcc8d0
mov edi, dword [edi*4 + 0xbaa590]
not ebp
lea esp, [esp + 4]
mov ebp, 0xff00
jmp 0xbcc7ec
mov eax, dword [esi]
pop esi
cmc
call fcn.00bcc86a
test al, 0x33
mov dword [0xbef135c6], eax
xor al, 0xaa
int 0x3c
jmp dword [ecx - 0xe74a920]
push esi
mov esi, ecx
lea esi, [esi + 8]
jmp 0xbcc84b
mov dword [edi], eax
not ah
bswap eax
mov eax, 0x6879aa94
mov al, ah
jmp 0xbcc862
xor ebx, eax
sub esp, 0x18
lea esp, [esp + 0x17]
add esp, 0
lea esp, [esp + 1]
jmp 0xbcc88e
neg edi
lea esp, [esp + 0x10]
xor eax, dword [ecx]
inc edi
jmp 0xbcc802

Function at 0xbcc6e6
Capabilities:
Encrypt data using aes

Disassembly:
bsr di, cx
jmp 0xbcc72e
mov edi, edx
mov ebp, 0x2adb72aa
jmp 0xbcc714
add esp, 3
mov edi, 0x1ac6739a
lea esp, [esp + 1]
jmp 0xbcc6ec
Function at 0x5e6063
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x5e6077
jmp 0x5e6238
cld
jb 0x5e6090
pushf
cmp ebx, ecx
lea esp, [esp]
test esp, 0x1082
popf
jno 0x5e608b
jmp 0x5e608d
jae 0x5e6090
mov esi, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x5d9ba4], edx
and esp, 0xffffffff
add eax, 0
jo 0x5e60d9
pushf
cmp ebx, 0x6761
add edi, dword [esp]
sub edi, dword [esp]
js 0x5e60b9
popf
lea ecx, [ecx + 0x5910]
lea ecx, [ecx - 0x5910]
lea esp, [esp]
lea ebx, [ebx + 0x51b2]
lea ebx, [ebx - 0x51b2]
jno 0x5e60d9
mov esp, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x5d9a54
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x5d9a54], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x5d9a50], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x5d9788], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x5d978c], ecx
jns 0x5e610a
jne 0x5e6121
lea edi, [edi + 0x61f1]
lea edi, [edi - 0x61f1]
jl 0x5e611a
lea ecx, [ecx]
je 0x5e611e
je 0x5e6121
xor eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
cmp ecx, dword [esp + 8]
jb 0x5e616c
pushf
xchg ebx, ebx
test esp, 0x4342
popf
jle 0x5e6169
jae 0x5e616c
mov edx, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
ror esp, 0
jnp 0x5e61f4
pushf
inc edx
dec edx
push ebx
add ebx, 0x27d3
ror ebx, 0x1a
pop ebx
jne 0x5e61ea
or esp, 0
popf
ja 0x5e61f1
jp 0x5e61f4
mov eax, 0x9a503d83
pop ebp
add byte [eax], al
cmp dword [0x5d9a50], 0
je 0x5e6211
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x5d9a50]
push eax
call fcn.005f2eda
mov dword [0x5d9ba0], eax
lea edi, [edi]
std
cld
ror esp, 0
jg 0x5e621a
je 0x5e6228
pushf
and edi, 0xffffffff
popf
jo 0x5e6225
jne 0x5e6228
sub dword [edx + 0xd], 0x4d8d006a
invalid
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.005fb014
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5e696a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.005fb014
add esp, 0xc
rol ecx, 2
ror ecx, 2
shl eax, 0
rol edx, 0
jo 0x5e699c
xchg esp, esp
lea ecx, [ecx]
lea edx, [edx]
jne 0x5e6999
jno 0x5e699c
mov eax, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x4c
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x42
mov byte [ebp - 0xf], 0
jns 0x5e69d6
xchg ebx, ebx
xor edi, dword [esp + 8]
xor edi, dword [esp + 8]
jno 0x5e69e2
jno 0x5e69fd
pushf
jnp 0x5e69e8
call fcn.005e69ed
Function at 0x5e6cee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x5d9c5c], 1
jne 0x5e6e69
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005fb014
add esp, 0xc
lea edi, [edi + 0x1181]
sub edi, 0x1181
jno 0x5e6d31
lea edx, [edx + 0x113a]
lea edx, [edx - 0x113a]
jo 0x5e6d31
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
push edi
add edi, 0x5b30
ror edi, 0x1f
pop edi
ror ecx, 0x1b
ror ecx, 5
ja 0x5e6d80
pushf
add esp, 0
popf
mov eax, eax
jbe 0x5e6d80
or dword [edx - 0x167f17b3], 0xe84d8801
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.005f1b76
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5e6df5
xor eax, eax
jmp 0x5e6ed5
nop
rol ecx, 0
jle 0x5e6dfb
add ebx, 0x52d6
sub ebx, 0x52d6
jns 0x5e6e15
jp 0x5e6e0b
jne 0x5e6e0d
mov edx, edx
jp 0x5e6e11
js 0x5e6e15
call 0xe8a3fb1c
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005f2eda
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005fb014
add esp, 0xc
xchg esp, esp
lea esi, [esi + 0x60e3]
lea esi, [esi - 0x60e3]
dec esi
inc esi
or eax, 0
jg 0x5e6e53
jbe 0x5e6e4c
xchg ecx, ebx
xchg ecx, ebx
jle 0x5e6e53
mov eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0x5e6e63
mov eax, dword [ebp - 8]
mov dword [0x5d9c5c], eax
jmp 0x5e6e67
xor eax, eax
jmp 0x5e6ed5
jmp 0x5e6e72
mov ecx, dword [0x5d9c5c]
mov dword [ebp - 8], ecx
shl esp, 0
lea esp, [esp]
js 0x5e6e91
pushf
lea edx, [edx + 0x1a9f]
lea edx, [edx - 0x1a9f]
popf
xchg edi, edi
ja 0x5e6e8e
jns 0x5e6e91
jmp 0x8a56c420
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, eax
or esp, 0
not eax
not eax
rol esp, 0
jo 0x5e6ebe
pushf
cmc
jne 0x5e6eaa
ror ebx, 9
rol ebx, 9
and ecx, 0xffffffff
popf
jmp 0x5e6eb7
jg 0x5e6eb9
xchg ebx, ebx
jno 0x5e6ebe
mov edi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.005e961e
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5e6ede
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x5d92c0
call fcn.005fd44c
add esp, 0xc
mov byte [0x5d92c0], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x5e6f36
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005fb014
add esp, 0xc
test ebx, edx
sub esp, 0
xchg esp, esp
js 0x5e6f63
pushf
xchg ecx, ecx
popf
jno 0x5e6f60
jns 0x5e6f63
mov ebp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
xchg edi, eax
xchg edi, eax
jo 0x5e6fbd
pushf
ror esp, 0
popf
jo 0x5e6fb8
mov edx, edx
jno 0x5e6fbd
mov edi, 0x80e84d8a
jmp 0xe8abf7c7
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.005f1b76
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5e7066
xor eax, eax
jmp 0x5e7117
lea eax, [eax + 0x3f21]
sub eax, 0x3f21
jns 0x5e707e
xchg edi, ecx
xchg edi, ecx
mov esp, esp
mov ebx, ebx
js 0x5e707e
add eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005f2eda
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005fb014
add esp, 0xc
lea ebx, [ebx + 0x302b]
lea ebx, [ebx - 0x302b]
or eax, 0
push esi
pop esi
jne 0x5e70c0
pushf
jbe 0x5e70b5
popf
ja 0x5e70b9
jp 0x5e70bb
je 0x5e70bd
je 0x5e70c0
xor eax, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x5e70ca
xor eax, eax
jmp 0x5e7117
jg 0x5e70cc
and esp, 0xffffffff
lea esp, [esp]
jae 0x5e70e8
jl 0x5e70d6
nop
lea edi, [edi + 0x533a]
lea edi, [edi - 0x533a]
jp 0x5e70e5
jb 0x5e70e8
jmp 0x5142b677
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005e961e
add esp, 4
and ecx, ecx
call fcn.005e70fb
Function at 0x5e711e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005fb014
add esp, 0xc
sub esp, 0
rol ecx, 0xb
rol ecx, 0x15
jbe 0x5e7154
jnp 0x5e714b
ja 0x5e714d
jp 0x5e714f
mov esi, esi
ja 0x5e7154
lcall 0x45c6, 0x4ef045c6
cmc
push 0x66f145c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
add edi, 0
xchg ebx, esi
xchg ebx, esi
nop
je 0x5e719f
pushf
shl ebx, 0
sub esi, 0
popf
jnp 0x5e719a
jmp 0x5e719c
jne 0x5e719f
xor eax, 0x80f04d8a
jmp 0xf0abf9a9
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
rol esi, 0
jl 0x5e720e
mov edx, edx
jne 0x5e7208
ja 0x5e720a
jge 0x5e720e
cmp dword [eax + 0x1f3fe8], 0xfc458900
call fcn.005e9152
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5e7220
xor eax, eax
jmp 0x5e7255
jns 0x5e7222
stc
jle 0x5e7225
jno 0x5e7232
pushf
lea ecx, [ecx]
popf
lea ecx, [ecx]
jo 0x5e7232
jmp 0x514eb7c3
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005f2eda
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.005fb014
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e7cfc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.005fb014
add esp, 0xc
xor ebx, 3
xor ebx, 3
jp 0x5e7d22
jbe 0x5e7d1f
jnp 0x5e7d22
mov edx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
add edi, 0x56f8
sub edi, 0x56f8
add esi, 0x40c1
sub esi, 0x40c1
jnp 0x5e7d7f
pushf
ror ebx, 3
rol ebx, 3
jbe 0x5e7d76
popf
xchg esi, ebx
xchg esi, ebx
jp 0x5e7d7f
mov ecx, 0x80f44d8a
jmp 0xf4ac0589
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
call fcn.005e7de4
Function at 0x5e9bb3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005fb014
add esp, 0xc
add ebx, 0x23b0
sub ebx, 0x23b0
jo 0x5e9be2
xchg ecx, edx
xchg ecx, edx
jno 0x5e9be2
mov ecx, 0xe845c65f
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
jns 0x5e9c18
mov ecx, ecx
jns 0x5e9c32
jl 0x5e9c1e
lea esi, [esi + 0x3260]
lea esi, [esi - 0x3260]
lea ecx, [ecx]
jns 0x5e9c2e
js 0x5e9c32
mov esp, 0xe84d8a61
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
lea ecx, [ecx + 0x3353]
lea ecx, [ecx - 0x3353]
cmp esi, ebx
jl 0x5e9cb5
pushf
xchg ebx, ebx
popf
mov esi, esi
jge 0x5e9cb5
jmp 0xdd59a1
call fcn.005f1b76
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5e9cca
xor eax, eax
jmp 0x5e9d66
lea esi, [esi]
jne 0x5e9ce6
lea edi, [edi + 0x1c17]
lea edi, [edi - 0x1c17]
lea ecx, [ecx]
xchg edx, ebx
xchg edx, ebx
mov ebx, ebx
je 0x5e9ce6
add eax, 0xe84d8d32
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005f2eda
mov dword [ebp - 4], eax
inc edx
dec edx
cld
rol esp, 0
jg 0x5e9d0c
pushf
shl esp, 0
mov esp, esp
popf
jb 0x5e9d09
jle 0x5e9d0c
call 0xc8aa7a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005fb014
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5e9d26
xor eax, eax
jmp 0x5e9d66
nop
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
shl esi, 0
xchg esp, esp
jl 0x5e9d4d
pushf
cmp esi, edi
xor eax, 0
js 0x5e9d3f
shr eax, 0
popf
jl 0x5e9d46
jbe 0x5e9d48
jnp 0x5e9d4a
jge 0x5e9d4d
jmp 0x525aeadc
mov ecx, dword [ebp - 4]
push ecx
call fcn.005e961e
add esp, 4
or esi, 0
jo 0x5e9d63
jge 0x5e9d60
jno 0x5e9d63
mov esp, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5edb8e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005fb014
add esp, 0xc
call fcn.005edbb3

Function at 0x5edd32
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005fb014
add esp, 0xc
rol esp, 0
shl edx, 0
ja 0x5edd64
pushf
and esi, 0xffffffff
cmp esi, dword [esp]
popf
je 0x5edd5f
jns 0x5edd61
jbe 0x5edd64
mov edx, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
xchg ecx, eax
xchg ecx, eax
test esp, 0x240f
cmp ebx, dword [esp]
jns 0x5eddbd
jo 0x5eddd6
pushf
call fcn.005eddc6

Function at 0x5edf2b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.005fb014
add esp, 0xc
and esp, 0xffffffff
xchg esi, eax
xchg esi, eax
jae 0x5edf4b
jl 0x5edf4d
ja 0x5edf73
pushf
or esp, 0
xor ecx, dword [esp]
xor ecx, dword [esp]
push eax
pop eax
dec eax
inc eax
popf
jmp 0x5edf62
lea edx, [edx + 0x1d9d]
lea edx, [edx - 0x1d9d]
mov esp, esp
jbe 0x5edf73
add eax, 0x53e045c6
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x52
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x7a
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x62
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x46
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0
add esi, 0
jae 0x5edfbc
or esi, esi
xor ebx, dword [esp]
xor ebx, dword [esp]
jle 0x5edfdf
pushf
ror edx, 2
ror edx, 0x1e
lea edx, [edx]
call fcn.005edfd5