joyce8/EMBER2024-capa huggingface dataset:
Function at 0xce4a2e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00cdab4e
add esp, 0xc
mov ebx, ebx
ja 0xce4a4b
rol esp, 0
js 0xce4a58
jbe 0xce4a52
jne 0xce4a54
jns 0xce4a58
add eax, 0xec45c68a
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
xchg esp, esp
jno 0xce4a8c
ror edx, 0x11
rol edx, 0x11
nop
je 0xce4aa7
pushf
nop
jg 0xce4a9a
xchg esp, esp
inc eax
dec eax
popf
jle 0xce4aa2
jb 0xce4aa4
jne 0xce4aa7
mov edi, 0x80ec4d8a
jmp 0xed1bd2b1
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
cld
rol edi, 0x10
ror edi, 0x10
ja 0xce4b17
lea esp, [esp]
jbe 0xce4b17
mov ebx, 0x301e8ea
add dword [eax], eax
call fcn.00cf4e1d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xce4b2c
xor eax, eax
jmp 0xce4bc9
mov esp, esp
js 0xce4b3e
jb 0xce4b32
lea esp, [esp]
xchg esi, edx
xchg esi, edx
jns 0xce4b3e
add eax, 0x458d6c52
in al, dx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00ce304d
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0xce4bb4
je 0xce4b66
je 0xce4b68
jae 0xce4b6e
nop
jb 0xce4b6e
sub eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00ce234f
add esp, 4
jmp 0xce4b7c
and esp, 0xffffffff
and ecx, ecx
add esp, 0
jle 0xce4bab
pushf
add edx, 0x7deb
sub edx, 0x7deb
cld
cmp esi, dword [esp]
popf
jae 0xce4b9c
lea ebx, [ebx + 0x4e1a]
lea ebx, [ebx - 0x4e1a]
jg 0xce4bab
mov ebp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0xce4bc9
rol esp, 0
mov ecx, ecx
sub edx, 0
xchg esp, esp
je 0xce4bc7
jnp 0xce4bc2
jne 0xce4bc7
add eax, 0xc033647c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xce5b0b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00cdab4e
add esp, 0xc
sub esp, 0
lea ebx, [ebx + 0x6902]
sub ebx, 0x6902
cld
je 0xce5b56
pushf
call 0xce5b3d
add esp, 4
je 0xce5b42
lea ecx, [ecx + 0x3f72]
lea ecx, [ecx - 0x3f72]
popf
nop
jb 0xce5b53
jne 0xce5b56
mov eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
shl esi, 0
test dword [esp], ecx
js 0xce5ba3
jno 0xce5b90
jne 0xce5b92
lea eax, [eax + 0x3244]
lea eax, [eax - 0x3244]
jne 0xce5ba0
jns 0xce5ba3
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00cf4e1d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xce5c18
xor eax, eax
jmp 0xce5ccb
or esp, 0
sub ecx, 0
add esp, 0
jo 0xce5c51
pushf
shl eax, 0
lea ebx, [ebx]
xor ebx, dword [esp]
xor ebx, dword [esp]
lea eax, [eax + 0x2dc]
lea eax, [eax - 0x2dc]
popf
jp 0xce5c40
je 0xce5c42
lea esi, [esi + 0x4ea0]
lea esi, [esi - 0x4ea0]
jno 0xce5c51
mov eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00ce304d
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0xce5c7b
xor eax, eax
jmp 0xce5ccb
xor esi, dword [esp]
xor esi, dword [esp]
test dword [esp + 4], eax
call 0xce5c8a
add esp, 4
jae 0xce5c94
mov esp, esp
jb 0xce5c94
mov eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00ce234f
add esp, 4
shr esp, 0
shl ebx, 0
mov esp, esp
cmc
jno 0xce5cc4
pushf
jbe 0xce5caf
cmp esp, 0x36bd
mov esp, esp
popf
jg 0xce5cbb
xchg ecx, edi
xchg ecx, edi
mov ecx, ecx
jo 0xce5cc4
sub eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xcea2a3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00cdab4e
add esp, 0xc
lea esi, [esi + 0x2945]
lea esi, [esi - 0x2945]
js 0xcea2d2
lea eax, [eax]
mov esi, esi
jns 0xcea2d2
sub eax, 0xe845c662
inc esp
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
ror esp, 0
rol esi, 0x14
ror esi, 0x14
jae 0xcea329
jp 0xcea332
jp 0xcea32d
jb 0xcea32f
jnp 0xcea332
sub eax, 0x80e84d8a
jmp 0xe91c2b3c
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
jbe 0xcea3d0
cld
jle 0xcea3e2
lea edi, [edi + 0xf4f]
lea edi, [edi - 0xf4f]

Function at 0xceb8c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00cdab4e
add esp, 0xc
xchg esp, esp
sub ecx, 0
jle 0xceb8fe
pushf
xchg ebx, ebx
lea ebx, [ebx + 0x7749]
lea ebx, [ebx - 0x7749]
jbe 0xceb8f5
popf
mov esp, esp
je 0xceb8fb
jg 0xceb8fe
add esi, 0xc650e845
inc ebp
in eax, dx
inc esp
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0
call fcn.00ceb93f
Function at 0xced4f5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00cdab4e
add esp, 0xc
jbe 0xced517
jl 0xced519
xor ebx, dword [esp]
xor ebx, dword [esp]
xor eax, dword [esp + 0xc]
xor eax, dword [esp + 0xc]
jno 0xced53f
lea eax, [eax + 0x837]
lea eax, [eax - 0x837]
jo 0xced537
mov edi, edi
xchg edi, edi
jo 0xced53f
mov ebx, 0xf045c6dd
dec esi
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
push ecx
add ecx, 0x39e6
ror ecx, 0xa
pop ecx
jbe 0xced58c
pushf
stc
cmp ecx, ebx
popf
jge 0xced585
xchg esp, esp
xchg ecx, ecx
ja 0xced58c
mov esi, 0x80f04d8a
jmp 0xf11c5d96
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
shl esi, 0
jnp 0xced5f1
jae 0xced5f3
jnp 0xced5fe
jns 0xced5f7
xchg esi, esi
xchg esi, esi
jp 0xced5fe
mov edx, 0xff5176e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.00ce2779
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xced610
xor eax, eax
jmp 0xced664
not edi
not edi
call fcn.00ced619
Function at 0xcee05c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00cdab4e
add esp, 0xc
cmp ebx, dword [esp]
je 0xcee07a
je 0xcee099
pushf
and esp, 0xffffffff
mov edi, edi
or eax, 0
popf
lea ecx, [ecx + 0x44e8]
lea ecx, [ecx - 0x44e8]
jo 0xcee096
jne 0xcee099
mov esp, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
cmp esi, dword [esp]
nop
jp 0xcee0cd
jle 0xcee0c9
jnp 0xcee0cd
xor eax, 0xf04d8a99
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.00ce2779
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xcee12d
xor eax, eax
jmp 0xcee1a8
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00ce304d
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0xcee1a6
and edi, edi
push edx
pop edx
push ebx
pop ebx
jp 0xcee16c
pushf
cmp edi, ebx
xchg ecx, eax
xchg ecx, eax
popf
jl 0xcee165
jg 0xcee167
lea edi, [edi]
jnp 0xcee16c
add eax, 0x51ec4d8b
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00ce234f
add esp, 4
je 0xcee17a
add esp, 0
ror esp, 0
test dword [esp + 4], edx
jae 0xcee199
pushf
add edx, dword [esp]
sub edx, dword [esp]
mov ecx, ecx
popf
lea ebx, [ebx]
jl 0xcee196
jb 0xcee199
mov ebx, 0x520c558b
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0xcee1a8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xcf1587
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00cdab4e
add esp, 0xc
xor esp, 0
jnp 0xcf15bb
xchg ecx, eax
xchg ecx, eax
lea ecx, [ecx + 0x33de]
lea ecx, [ecx - 0x33de]
js 0xcf15b5
jns 0xcf15b7
jp 0xcf15bb
add eax, 0xe045c6b5
dec eax
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
lea eax, [eax]
jge 0xcf161e
pushf
jo 0xcf160f
test esp, 0x3957
popf
jge 0xcf1619
jns 0xcf161b
jl 0xcf161e
mov edi, 0x80e04d8a
jmp 0xe11c9e28
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
xchg edi, edx
xchg edi, edx
jne 0xcf16da
pushf
call fcn.00cf16c7
Function at 0xcf2deb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00cdab4e
add esp, 0xc
sub esp, 0
jg 0xcf2e23
pushf
push ecx
add ecx, 0x61f2
ror ecx, 0x1e
pop ecx
ja 0xcf2e18
dec esi
inc esi
add esp, 0
popf
nop
jle 0xcf2e23
mov esp, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
lea ebx, [ebx + 0x6013]
lea ebx, [ebx - 0x6013]
jbe 0xcf2e61
clc
jno 0xcf2e6b
jl 0xcf2e66
jo 0xcf2e68
jo 0xcf2e6b
mov esp, 0x80f04d8a
jmp 0xf11cb675
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
test edx, ecx
jg 0xcf2ed4
jne 0xcf2ed1
jle 0xcf2ed4
mov ebp, 0x1f44e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.00cf4e1d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xcf2ee6
xor eax, eax
jmp 0xcf2f13
add esp, 0
jge 0xcf2ef0
nop
jl 0xcf2ef0
mov ecx, 0xf0458d35
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00ce304d
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00cdab4e
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xcf2fbf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00cdab4e
add esp, 0xc
je 0xcf2fda
mov esp, esp
cld
test edx, 0x426a
jbe 0xcf2ffa
pushf
xor edi, esi
xor edi, esi
xor esi, dword [esp]
xor esi, dword [esp]
or ebx, ebx
popf
mov esp, esp
ja 0xcf2ffa
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
std
cld
js 0xcf3049
pushf
shr ecx, 0
jmp 0xcf3039
cmc
cmp ecx, 0x37a5
popf
mov esi, esi
jns 0xcf3046
jns 0xcf3049
or dword [edx - 0x167f17b3], 0xe84d8801
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
inc edi
dec edi
stc
test edx, ebx
js 0xcf30cb
pushf
shr esp, 0
lea esp, [esp]
popf
jle 0xcf30c4
jb 0xcf30c6
mov ebx, ebx
jns 0xcf30cb
mov ebp, 0x1d4de8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.00cf4e1d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xcf30e0
xor eax, eax
jmp 0xcf3172
nop
and ebx, ebx
or esp, 0
or ecx, ecx
js 0xcf30ff
pushf
jae 0xcf30ee
popf
lea eax, [eax + 0x2d22]
lea eax, [eax - 0x2d22]
jns 0xcf30ff
mov edx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00ce304d
mov dword [ebp - 4], eax
inc edi
dec edi
jge 0xcf311f
pushf
ror esp, 0
popf
jae 0xcf311c
jl 0xcf311f
mov esi, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0xcf3139
xor eax, eax
jmp 0xcf3172
test dword [esp + 4], ebx
mov ebx, ebx
jle 0xcf3147
jns 0xcf3143
jg 0xcf3147
mov ecx, 0xfc4d8b29
mov ecx, dword [ebp - 4]
push ecx
call fcn.00ce234f
add esp, 4
shr ebx, 0
ror ebx, 0x10
rol ebx, 0x10
jo 0xcf315e
jg 0xcf316f
pushf
jnp 0xcf3164
popf
js 0xcf3168
jae 0xcf316a
jnp 0xcf316c
jle 0xcf316f
jmp 0x60cb8772
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xcf50e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0xccd284
call fcn.00cf4161
add esp, 0xc
mov byte [0xccd284], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0xd04301
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00cdab4e
add esp, 0xc
jg 0xd0431c
xor eax, 0
jb 0xd0432f
xchg edi, eax
xchg edi, eax
xchg edi, ebx
xchg edi, ebx
xchg esp, esp
mov edx, edx
jae 0xd0432f
sub eax, 0xec45c697
push ebx
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
lea esi, [esi + 0xdbd]
lea esi, [esi - 0xdbd]
jle 0xd04379
jle 0xd0437b
je 0xd0438c
pushf
rol ebx, 0xb
rol ebx, 0x15
popf
je 0xd04389
jne 0xd0438c
mov eax, 0x80ec4d8a
jmp 0xed1dcb96
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.00cf4e1d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xd04419
jmp 0xd044ad
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00ce304d
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0xd044ad
jbe 0xd04441
dec eax
inc eax
ror edi, 0x10
rol edi, 0x10
jne 0xd04462
pushf
shl ebx, 0
rol esi, 0
mov esp, esp
and ecx, ecx
popf
lea edx, [edx]
xchg esp, esp
jno 0xd0445f
je 0xd04462
ljmp 0xe4e8:0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00ce234f
add esp, 4
call 0xd04473
lea esp, [esp + 4]
je 0xd0449a
pushf
add edx, 0x1853
sub edx, 0x1853
mov edx, edx
shl ebx, 0
ror edx, 0
popf
jb 0xd04493
jne 0xd04495
je 0xd04497
jne 0xd0449a
mov esi, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10