joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10125ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.10021e20
mov eax, dword [0x10195170]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x28], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x101261b5
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x10126145
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.10125a00
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x101260e0
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x1012619c
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10020a26
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10020a26
add esp, 0x28
ret
Function at 0x101284d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.10021e20
mov eax, dword [0x10195170]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x28], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x10128695
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x10128625
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.10127e40
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x101285c0
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x1012867c
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10020a26
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10020a26
add esp, 0x28
ret
Function at 0x10129ec0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.10021e20
mov eax, dword [0x10195170]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
mov ebx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xb4]
test edi, edi
je 0x1012a063
push ebp
dec edi
lea ebp, [ebx + 0xc]
add ebx, 0x14
shr edi, 3
push esi
mov esi, dword [esp + 0xb8]
inc edi
mov dword [esp + 0x18], ebx
jmp 0x10129f10
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebp]
and al, 0xdf
mov dword [esp + 0x14], ecx
or al, 0x40
mov dword [esp + 0x28], ecx
mov byte [ebp], al
movzx eax, byte [ebx]
and al, 0xbf
mov dword [esp + 0x20], ecx
or al, 0x20
push ebp
mov byte [ebx], al
call fcn.100bee00
lea eax, [esp + 0x30]
push eax
push ebp
call fcn.100bebc0
push 1
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.100e8830
push ebx
call fcn.100bee00
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.100bebc0
push 1
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.100e8830
mov ecx, dword [esp + 0x44]
add esp, 0x30
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
xor edx, ecx
xor ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
xor ebx, eax
mov dword [esp + 0x14], ecx
xor eax, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x10], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [esp + 0x10]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, ecx
shr eax, 8
mov byte [ecx + 4], dl
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
dec edi
jne 0x10129f10
pop esi
pop ebp
mov ecx, dword [esp + 0xa4]
pop edi
pop ebx
xor ecx, esp
call fcn.10020a26
add esp, 0xa0
ret
Function at 0x53f8e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0054df2a
add esp, 0xc
lea esi, [esi + 0x67ee]
lea esi, [esi - 0x67ee]
jle 0x53f919
mov edx, edx
lea ecx, [ecx]
jmp 0x53f915
jg 0x53f919
sub eax, 0xf445c662
push ebx
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
or esi, esi
test esi, edi
jle 0x53f94f
stc
je 0x53f974
pushf
cmp esp, 0x7052
push edx
add edx, 0x5335
ror edx, 0xc
pop edx
xchg ecx, esi
xchg ecx, esi
popf
lea ebx, [ebx]
mov ecx, ecx
jle 0x53f971
jne 0x53f974
mov esi, 0x80f44d8a
jmp 0xf4a1817e
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
xchg esp, esp
cmp ecx, dword [esp]
jns 0x53f9e0
xchg esp, esp
js 0x53f9e0
add eax, 0x8c6e8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x5402ab
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x53f9f8
mov eax, 1
jmp 0x53faa8
cmp eax, edi
lea edx, [edx + 0x6a6d]
lea edx, [edx - 0x6a6d]
jle 0x53fa13
lea edx, [edx]
lea esp, [esp]
xchg esp, esp
jg 0x53fa13
sub eax, 0xf4458d32
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00543a96
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0054df2a
add esp, 0xc
lea esi, [esi]
jle 0x53fa5d
pushf
test ebx, 0x1072
sub esi, 0
xor eax, ecx
xor eax, ecx
jno 0x53fa48
popf
jb 0x53fa4c
jb 0x53fa4e
lea ebx, [ebx + 0x238d]
lea ebx, [ebx - 0x238d]
jg 0x53fa5d
mov ecx, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x53fa6a
mov eax, 1
jmp 0x53faa8
jg 0x53fa6c
jle 0x53fa6e
jb 0x53fa82
pushf
push eax
pop eax
cmp edx, dword [esp]
popf
jae 0x53fa7b
jne 0x53fa7d
ja 0x53fa7f
jae 0x53fa82
mov ebp, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.0053e4cb
add esp, 4
sub esp, 0
dec edi
inc edi
or ecx, 0
jae 0x53fa98
jno 0x53faa1
lea edi, [edi]
xchg edi, edi
jo 0x53faa1
mov ecx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5411d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0054df2a
add esp, 0xc
test dword [esp], eax
jg 0x5411f7
jg 0x541204
jg 0x5411fb
xchg edx, ecx
xchg edx, ecx
jl 0x541201
jle 0x541204
mov edx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
rol edi, 0xa
rol edi, 0x16
test dword [esp + 4], esi
add edx, dword [esp]
sub edx, dword [esp]
jmp 0x54124a
jno 0x541259
jae 0x54124e
jno 0x541250
xchg ebx, edi
xchg ebx, edi
jns 0x541256
jo 0x541259
call 0x813c5fe7
jmp 0xe8a19a63
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
shr edx, 0
jb 0x5412ce
jo 0x5412c8
mov esp, esp
jae 0x5412ce
lcall 2, 0x3a7de82c
call fcn.00564d50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5412e3
xor eax, eax
jmp 0x541392
lea eax, [eax]
js 0x5412e7
jns 0x5412ee
jg 0x5412eb
js 0x5412ee
mov ebx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00543a96
mov dword [ebp - 4], eax
mov edi, edi
jg 0x541316
pushf
add ebx, dword [esp]
sub ebx, dword [esp]
add esp, 0
popf
jg 0x541311
xchg edi, edi
jle 0x541316
sub eax, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0054df2a
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x541330
xor eax, eax
jmp 0x541392
test dword [esp], esi
cmp ebx, esi
test esp, 0x6c29
shl esp, 0
jb 0x541363
pushf
push ecx
add ecx, 0x3d86
ror ecx, 0x1a
pop ecx
test esp, 0xec0
shr esp, 0
rol edx, 0x1e
rol edx, 2
popf
jae 0x541360
jae 0x541363
mov esi, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.0053e4cb
add esp, 4
shl esp, 0
cmp esp, 0x1c2c
ror esp, 0
jne 0x54138f
pushf
jno 0x541381
xor esp, 0
popf
xchg esp, esp
xchg edx, edx
jg 0x54138c
je 0x54138f
xor eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5413b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0054df2a
add esp, 0xc
xor edx, dword [esp]
xor edx, dword [esp]
je 0x5413d9
xor ebx, dword [esp + 8]
xor ebx, dword [esp + 8]
je 0x5413f9
pushf
test eax, 0xbdc
lea eax, [eax]
popf
jbe 0x5413f0
jo 0x5413f2
xchg edi, esi
xchg edi, esi
jne 0x5413f9
mov esp, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
lea edx, [edx]
sub eax, 0
jge 0x541454
lea esp, [esp]
je 0x54144d
jno 0x54144f
jno 0x541451
jl 0x541454
mov ecx, 0x80e44d8a
jmp 0xe4a19c5e
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.00564d50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x541502
xor eax, eax
jmp 0x541571
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00543a96
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0054df2a
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x54156f
rol eax, 0
stc
rol ebx, 0xd
rol ebx, 0x13
jg 0x54153c
mov eax, eax
jl 0x541538
jle 0x54153c
add eax, 0xfc4d8bb1
mov ecx, dword [ebp - 4]
push ecx
call fcn.0053e4cb
add esp, 4
shl esp, 0
sub esp, 0
jge 0x541556
jge 0x541552
jl 0x541556
jmp 0x18a9a085
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x541571
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x545bb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0054df2a
add esp, 0xc
rol esp, 0
jp 0x545bd9
jo 0x545bd4
mov ebx, ebx
jnp 0x545bd9
add eax, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
stc
cmp ecx, dword [esp + 0xc]
xchg edx, edx
nop
je 0x545c18
mov esp, esp
jne 0x545c18
jmp 0x8140a9a6
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00564d50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x545c8d
xor eax, eax
jmp 0x545d11
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00543a96
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0054df2a
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x545d0f
std
cld
shr esp, 0
jge 0x545cba
mov ecx, ecx
jp 0x545cdd
pushf
shl esp, 0
sub edx, 0
test dword [esp], esi
call fcn.00545cce
xor eax, eax
Function at 0x54919a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [esp + edi*8]
invalid
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0054df2a
add esp, 0xc
std
cld
jp 0x5491bd
je 0x5491b9
jnp 0x5491bd
add eax, 0xec45c6a7
jp 0x549188
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0xe99a5810
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
lea edx, [edx + 0x7c0e]
lea edx, [edx - 0x7c0e]
sub esp, 0
shl edi, 0
jbe 0x549214
xchg esi, edx
xchg esi, edx
xchg edi, ebx
xchg edi, ebx
ja 0x549214
xor eax, 0x80f44d8a
jmp 0xf4a21a1e
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
xor esp, 0
ror esp, 0
cmp esp, 0x2a89
std
cld
jbe 0x5492aa
pushf
shl esp, 0
add esp, 0
and ebx, 0xffffffff
rol esp, 0
popf
jp 0x5492a7
ja 0x5492aa
add eax, 0x1baa1e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.00564d50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5492bd
jmp 0x54937c
mov ecx, ecx
lea ebx, [ebx + 0x1785]
lea ebx, [ebx - 0x1785]
xor esi, dword [esp]
xor esi, dword [esp]
and eax, 0xffffffff
jno 0x5492dd
lea esp, [esp]
jo 0x5492dd
add eax, 0xe8558d84
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00543a96
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0054df2a
add esp, 0xc
jl 0x5492ff
lea esi, [esi]
jnp 0x54931e
pushf
lea eax, [eax + 0x11c4]
lea eax, [eax - 0x11c4]
jae 0x549313
popf
mov ecx, ecx
lea edx, [edx]
je 0x54931b
jp 0x54931e
mov ecx, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x549326
jmp 0x54937c
test esp, 0x5d65
xchg esp, esp
nop
jg 0x549352
pushf
shr eax, 0
test esp, 0x7422
call fcn.00549341
Function at 0x54cb65
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0054df2a
add esp, 0xc
xor ecx, edx
xor ecx, edx
add esi, 0
nop
lea ecx, [ecx + 0x35c5]
sub ecx, 0x35c5
jge 0x54cbbd
pushf
or ecx, 0
xor ebx, 0x77ba
xor ebx, 0x77ba
call fcn.0054cbb1