joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20049201
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.2004f9af
add esp, 0xc
and esp, 0xffffffff
rol esp, 0
mov ebx, ebx
test esi, 0x7b05
ja 0x20049237
jp 0x2004922c
mov ebx, ebx
jnp 0x20049230
lea ebx, [ebx]
jbe 0x20049237
mov ebp, 0x45c69adf
loopne 0x2004928e
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x52
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x7a
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x62
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x46
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0
xchg esp, esp
jae 0x2004927f
test dword [esp], edi
ror esp, 0
je 0x20049293
jb 0x20049289
jle 0x2004928b
xchg ecx, ecx
xchg esp, esp
jne 0x20049293
in al, 0x75
add al, byte [0xe04d8a09]
add eax, 0xe04d8a09
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x1e]
sub dl, 1
mov byte [ebp - 0x1e], dl
mov al, byte [ebp - 0x19]
sub al, 1
mov byte [ebp - 0x19], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x1d]
sub dl, 1
mov byte [ebp - 0x1d], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x1c]
sub dl, 1
mov byte [ebp - 0x1c], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
xor esp, 0
dec edx
inc edx
jmp 0x20049325
je 0x20049338
pushf
inc ecx
dec ecx
je 0x2004932d
jno 0x2004932f
popf
jno 0x20049333
jge 0x20049335
jne 0x20049338
sub eax, 0x222fee8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 0xa], dh
call 0x2006b63b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20049350
mov eax, 1
jmp 0x200495a7
rol edx, 0xe
ror edx, 0xe
clc
call fcn.2004935c
Function at 0x2004b280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2004f9af
add esp, 0xc
push esi
pop esi
jp 0x2004b2a5
jns 0x2004b29f
lea esp, [esp]
jnp 0x2004b2a5
lcall 0x45c6, 0x4aec45c6
clc
arpl si, ax
inc ebp
cmc
push 0xffffffffffffffc6
inc ebp
out dx, al
pop eax
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
lea edi, [edi]
xchg edi, edi
jns 0x2004b2f1
nop
xchg ebx, ebx
js 0x2004b2f1
mov ebx, 0x80ec4d8a
jmp 0xc523afb
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.2005c4f6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2004b388
xor eax, eax
jmp 0x2004b418
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.2004d43e
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2004f9af
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x2004b416
xor ecx, ebx
xor ecx, ebx
je 0x2004b3b4
add eax, dword [esp]
sub eax, dword [esp]
cmp edi, 0x6ee2
jp 0x2004b3e2
pushf
mov eax, eax
jp 0x2004b3c8
add eax, 0
mov edi, edi
popf
xchg ebx, ebx
lea ebx, [ebx + 0x4be5]
lea ebx, [ebx - 0x4be5]
mov eax, eax
jnp 0x2004b3e2
mov ecx, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.2006a497
add esp, 4
stc
ror esp, 0
jb 0x2004b40d
pushf
dec esi
inc esi
popf
jle 0x2004b3fc
lea ebx, [ebx + 0x6deb]
lea ebx, [ebx - 0x6deb]
jg 0x2004b40a
jae 0x2004b40d
or dword [ebx - 0xadf7ab], 0x2ebe855
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x2004b418
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x2004b43c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2004f9af
add esp, 0xc
jo 0x2004b457
lea esp, [esp]
cld
call fcn.2004b460
Function at 0x2004b82d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2004f9af
add esp, 0xc
ror edx, 0x1c
ror edx, 4
jnp 0x2004b855
jge 0x2004b857
rol eax, 8
ror eax, 8
ja 0x2004b866
jl 0x2004b861
jo 0x2004b863
jbe 0x2004b866
mov eax, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.2005b8d3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2004b92e
xor eax, eax
jmp 0x2004b9a1
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2004d43e
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2004f9af
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x2004b958
xor eax, eax
jmp 0x2004b9a1
test dword [esp + 4], edi
nop
jg 0x2004b975
pushf
mov edx, edx
add esi, dword [esp]
sub esi, dword [esp]
xor esp, 0
popf
jno 0x2004b970
xchg esp, esp
jle 0x2004b975
ljmp 0x19e8:0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.2006a497
add esp, 4
rol esi, 5
ror esi, 5
and esp, 0xffffffff
lea ecx, [ecx]
jle 0x2004b996
xchg esp, esp
jbe 0x2004b992
jg 0x2004b996
mov edi, 0xc4d8bfd
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2004c76b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2004f9af
add esp, 0xc
lea esp, [esp]
cmp ecx, dword [esp + 0xc]
cmp eax, dword [esp + 8]
jne 0x2004c7a6
pushf
ror eax, 0x11
rol eax, 0x11
stc
xor edi, 0
popf
mov ecx, ecx
js 0x2004c7a3
je 0x2004c7a6
mov edi, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
not esi
not esi
lea ebx, [ebx + 0x7a59]
lea ebx, [ebx - 0x7a59]
jb 0x2004c7f0
ror esp, 0
jo 0x2004c7f9
nop
jno 0x2004c7f9
mov esp, 0x80e84d8a
jmp 0x8525003
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.2005c4f6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2004c87f
xor eax, eax
jmp 0x2004c8ff
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.2004d43e
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2004f9af
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x2004c8fd
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
xor ebx, 0
shl edi, 0
je 0x2004c8bf
jnp 0x2004c8b7
jne 0x2004c8b9
jb 0x2004c8bb
jne 0x2004c8bf
jmp 0x1c5a5442
mov edx, dword [ebp - 4]
push edx
call fcn.2006a497
add esp, 4
cmc
mov esp, esp
lea esp, [esp]
jl 0x2004c8d3
je 0x2004c8e8
pushf
rol ebx, 0xe
ror ebx, 0xe
popf
jg 0x2004c8e1
jne 0x2004c8e3
js 0x2004c8e5
jne 0x2004c8e8
lcall 0x4d8b, 0x5014458b
adc byte [ecx - 0x75], dl
push ebp
or al, 0x52
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x2004c8ff
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2004cd1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x2004cd32
jmp 0x2004ced8
mov eax, eax
lea esi, [esi + 0x752f]
lea esi, [esi - 0x752f]
jno 0x2004cd42
ja 0x2004cd4b
mov ecx, ecx
jbe 0x2004cd4b
sub eax, 0x458b1482
or byte [ecx + 0x4d8bec45], cl
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x20040070], edx
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
test esp, 0x3f5b
nop
cmp esp, 0x3389
jge 0x2004cd79
xchg edx, eax
xchg edx, eax
jl 0x2004cd79
xor eax, 0xec458b45
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x20040338], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x20040334], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x2003fcb0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x2003fcb4], ecx
clc
jp 0x2004cdc2
pushf
or esi, 0
test dword [esp], edi
call fcn.2004cdb8
Function at 0x2004d97f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2004f9af
add esp, 0xc
test dword [esp], ecx
and edx, 0xffffffff
rol esp, 0
lea esi, [esi + 0x6414]
lea esi, [esi - 0x6414]
js 0x2004d9b5
xchg edx, edx
jns 0x2004d9b5
mov ebp, 0xf045c631
dec eax
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
clc
lea ebx, [ebx]
je 0x2004d9ee
mov esp, esp
lea esp, [esp]
xchg ecx, ecx
jne 0x2004d9ee
lcall 0x80f0, 0x4d8a9d65
jmp 0x105261f8
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.2005c4f6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2004da4e
xor eax, eax
jmp 0x2004daaf
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.2004d43e
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2004f9af
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x2004daad
js 0x2004da76
jg 0x2004da80
mov esp, esp
xchg ebx, ebx
jle 0x2004da80
lcall 0xe851, 0xec4d8b06
push cs
retf 1
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.2006a497
add esp, 4
nop
cmc
neg edx
neg edx
jg 0x2004da94
jnp 0x2004daa0
ja 0x2004da98
jae 0x2004da9a
jb 0x2004da9c
jp 0x2004daa0
mov esp, 0xc558bcf
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x2004daaf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x20052b79
Capabilities:
Contain obfuscated stackstrings

Disassembly:
popfd
mov eax, eax
jns 0x20052b6d
lcall 0x5f00, 0x50b8
mov eax, 0x50
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2004f9af
add esp, 0xc
dec edx
inc edx
jnp 0x20052b9c
lea ebx, [ebx]
jp 0x20052b9c
mov ecx, 0xec45c6f2
jp 0x20052b67
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0x94af1ef
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
shl ecx, 0
xchg esp, esp
call fcn.20052bde
Function at 0x20052d13
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.2004f9af
add esp, 0xc
rol eax, 0x11
ror eax, 0x11
jno 0x20052d49
pushf
cld
shl edx, 0
neg eax
neg eax
xchg ebx, eax
xchg ebx, eax
popf
jae 0x20052d44
mov edi, edi
jo 0x20052d49
sub eax, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
xor esp, 0
stc
push edx
pop edx
jb 0x20052d99
ja 0x20052dab
pushf
shr esp, 0
jae 0x20052da2
mov esp, esp
popf
jbe 0x20052da8
jbe 0x20052dab
add eax, 0x80e44d8a
jmp 0x452b5b5
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.2005b8d3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20052e59
xor eax, eax
jmp 0x20052ed0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.2004d43e
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.2004f9af
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x20052ece
and esp, 0xffffffff
dec ecx
inc ecx
jge 0x20052e9d
lea edx, [edx + 0x3264]
lea edx, [edx - 0x3264]
jmp 0x20052e94
nop
xchg esi, ebx
xchg esi, ebx
jl 0x20052e9d
mov esi, 0xfc4d8b7a
mov ecx, dword [ebp - 4]
push ecx
call fcn.2006a497
add esp, 4
neg eax
neg eax
jl 0x20052eb5
jl 0x20052eb1
jge 0x20052eb5
mov edi, 0x18558bb6
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x20052ed0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x2005b354
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2004f9af
add esp, 0xc
shr esp, 0
jle 0x2005b390
pushf
call 0x2005b379
lea esp, [esp + 4]
add eax, dword [esp]
sub eax, dword [esp]
jbe 0x2005b385
shr esp, 0
popf
nop
jmp 0x2005b38d
jg 0x2005b390
sub eax, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
cmp ebx, dword [esp + 8]
neg ecx
neg ecx
cmp eax, 0x6fdd
js 0x2005b3d4
mov ecx, ecx
jns 0x2005b3d4
mov esi, 0x80ec4d8a
jmp 0xc533bde
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
nop
jb 0x2005b43f
jae 0x2005b439
mov esp, esp
jae 0x2005b43f
mov ebp, 0x48fe896
add byte [eax], al
call fcn.2005b8d3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2005b454
xor eax, eax
jmp 0x2005b4f3
xchg ecx, edx
xchg ecx, edx
xchg ebx, ebx
or eax, 0
jl 0x2005b46e
pushf
lea ebx, [ebx]
cmp esi, dword [esp + 8]
popf
mov esp, esp
jge 0x2005b46e
sub eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.2004d43e
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2004f9af
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x2005b4d4
neg edx
neg edx
cmp eax, 0x33c2
ja 0x2005b4aa
mov esp, esp
jmp 0x2005b4a3
mov ebx, ebx
jle 0x2005b4a7
jbe 0x2005b4aa
mov ebp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.2006a497
add esp, 4
jmp 0x2005b4b8
not ecx
not ecx
rol esp, 0
jle 0x2005b4cb
xchg edi, esi
xchg edi, esi
xchg esi, esi
jg 0x2005b4cb
call 0x2853401f
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x2005b4f3
cmp edi, 0x4e6e
jle 0x2005b4f1
js 0x2005b4de
jb 0x2005b4e0
jp 0x2005b4e2
lea edx, [edx + 0x2366]
lea edx, [edx - 0x2366]
jg 0x2005b4f1
xor eax, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x2005b908
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2004f9af
add esp, 0xc
nop
lea edx, [edx]
or edi, edi
js 0x2005b937
jns 0x2005b931
jnp 0x2005b933
jns 0x2005b937
or dword [eax], 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
clc
jne 0x2005b974
jmp 0x2005b96c
jg 0x2005b96e
lea ecx, [ecx]
je 0x2005b974
xor ebx, 0x80f04d8a
jmp 0x1053417e
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
cmp ecx, dword [esp + 0xc]
lea edi, [edi + 0xa94]
lea edi, [edi - 0xa94]
jge 0x2005b9e6
rol edx, 0
jae 0x2005b9fa
pushf
sub esp, 0
popf
nop
lea esi, [esi]
jno 0x2005b9f7
jb 0x2005b9fa
mov edx, 0xaf7e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.2005c4f6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2005ba0c
xor eax, eax
jmp 0x2005ba45
jne 0x2005ba0e
nop
lea edx, [edx]
je 0x2005ba22
pushf
jge 0x2005ba17
mov esp, esp
jl 0x2005ba1b
popf
mov ebx, ebx
jne 0x2005ba22
add eax, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2004d43e
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2004f9af
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2005e7a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2004f9af
add esp, 0xc
rol esi, 0x18
ror esi, 0x18
call fcn.2005e7c8