joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529504
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00533a13
add esp, 0xc
jbe 0x529526
shr ebx, 0
cmp edx, dword [esp + 4]
ja 0x52953d
pushf
jg 0x529533
popf
lea esp, [esp]
jle 0x52953a
jbe 0x52953d
mov esi, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
test esi, edi
ror esp, 0
xchg ebx, ebx
jp 0x52960e
pushf
lea ebx, [ebx + 0x5e02]
lea ebx, [ebx - 0x5e02]
cmp ecx, 0x7dc6
popf
lea edx, [edx]
jne 0x529609
jl 0x52960b
jnp 0x52960e
jmp 0x1d142fa
call fcn.005414bf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x529623
xor eax, eax
jmp 0x5296b7
test esi, 0x5cf8
rol esp, 0
dec eax
inc eax
jbe 0x529630
jne 0x52963b
xchg esp, esp
jns 0x529636
je 0x52963b
mov ecx, 0x558ddb51
call 0xf8982194
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00523000
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00533a13
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x529665
xor eax, eax
jmp 0x5296b7
jle 0x529667
xchg esp, esp
jne 0x52967c
pushf
jns 0x52966f
jnp 0x529671
xor esi, edx
xor esi, edx
popf
mov ebx, ebx
je 0x52967c
sub eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00545b94
add esp, 4
add edx, dword [esp]
sub edx, dword [esp]
jae 0x5296ac
pushf
xor esi, ebx
xor esi, ebx
test dword [esp], edx
add edx, 0x2696
sub edx, 0x2696
popf
jle 0x5296a9
jb 0x5296ac
or dword [ebx - 0x74aff3bb], 0xff51084d
push ebp
cld
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52c7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00533a13
add esp, 0xc
jno 0x52c80b
xor ebx, esi
xor ebx, esi
jl 0x52c81b
pushf
stc
popf
jge 0x52c818
jge 0x52c81b
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
rol edi, 1
rol edi, 0x1f
jg 0x52c856
je 0x52c867
pushf
jno 0x52c85c
jl 0x52c85e
popf
jle 0x52c862
xchg edi, edi
jne 0x52c867
add eax, 0x80e84d8a
jmp 0xe8a05071
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
sub ebx, 0
mov edx, edx
jl 0x52c8dc
xchg ecx, ecx
jge 0x52c8dc
jmp 0x4c31b189
call fcn.005414bf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x52c8f1
xor eax, eax
jmp 0x52c9bf
jne 0x52c8f3
clc
ror esi, 0
cmc
jle 0x52c906
pushf
shr esp, 0
popf
xchg edx, eax
xchg edx, eax
jg 0x52c906
call 0x523b1697
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00523000
mov dword [ebp - 4], eax
mov edx, edx
jg 0x52c91a
shl edx, 0
xchg ecx, ecx
js 0x52c93e
pushf
rol esi, 0
and ecx, ecx
rol esp, 0
popf
jae 0x52c92f
lea esi, [esi + 0x48aa]
lea esi, [esi - 0x48aa]
jns 0x52c93e
mov eax, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00533a13
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x52c958
xor eax, eax
jmp 0x52c9bf
xor edi, 0x685
xor edi, 0x685
rol esi, 0x14
rol esi, 0xc
lea ecx, [ecx + 0x502]
lea ecx, [ecx - 0x502]
jnp 0x52c978
jns 0x52c993
pushf
add ecx, dword [esp]
sub ecx, dword [esp]
and ebx, ebx
add eax, 0
and esp, 0xffffffff
popf
lea edx, [edx]
jbe 0x52c990
js 0x52c993
jmp 0x524f1722
mov ecx, dword [ebp - 4]
push ecx
call fcn.00545b94
add esp, 4
ror edi, 0x1b
ror edi, 5
add ebx, 0x4146
sub ebx, 0x4146
jb 0x52c9b3
jo 0x52c9bc
ja 0x52c9b7
xchg ecx, ecx
jno 0x52c9bc
sub eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x531751
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00533a13
add esp, 0xc
js 0x53176c
jl 0x53177c
jbe 0x531770
lea edx, [edx + 0x5e]
lea edx, [edx - 0x5e]
jg 0x531778
jge 0x53177c
call 0xf498de06
push ebx
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
jo 0x5317ae
test dword [esp], ebx
jle 0x5317c2
pushf
or edx, edx
popf
jmp 0x5317bb
jb 0x5317bd
ja 0x5317bf
jg 0x5317c2
mov eax, 0x80f44d8a
jmp 0xf4a09fcc
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
xchg edi, eax
xchg edi, eax
test ebx, 0x47bf
rol ebx, 0x13
ror ebx, 0x13
jno 0x53183d
pushf
jno 0x531836
popf
jbe 0x53183a
jo 0x53183d
mov ebp, 0x10c7be8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x5424bd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x531855
mov eax, 1
jmp 0x531919
or ebx, 0
sub esp, 0
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
lea edi, [edi]
jnp 0x531875
pushf
cmp esi, edx
mov ebx, ebx
cmc
popf
mov esp, esp
jp 0x531875
jmp 0x51475e06
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00523000
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00533a13
add esp, 0xc
not edi
not edi
xchg esi, eax
xchg esi, eax
xor ecx, 0
add edi, dword [esp]
sub edi, dword [esp]
jae 0x5318ba
pushf
test edi, 0x6e43
cld
jg 0x5318b1
jae 0x5318b3
popf
mov esp, esp
jb 0x5318ba
ljmp 0x775:0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x5318c7
mov eax, 1
jmp 0x531919
or esi, esi
jno 0x5318cb
push edx
add edx, 0x77ad
ror edx, 0xb
pop edx
cmp esi, 0x4a52
jns 0x5318e3
nop
js 0x5318e3
mov edx, 0xec458b7e
mov eax, dword [ebp - 0x14]
push eax
call fcn.00545b94
add esp, 4
and esp, 0xffffffff
jl 0x5318f4
jo 0x5318f6
jp 0x531912
pushf
xor esi, 0x3b68
xor esi, 0x3b68
or esp, 0
popf
jle 0x53190d
jo 0x53190f
jnp 0x531912
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x531d36
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00533a13
add esp, 0xc
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
jle 0x531d59
jne 0x531d60
jns 0x531d5d
je 0x531d60
mov eax, 0x75f345c6
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x67
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 6], 0x42
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 5], 0
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0xa], 0x4a
mov byte [ebp - 7], 0x70
lea edx, [edx]
js 0x531db0
jge 0x531da6
xchg ebx, edx
xchg ebx, edx
jge 0x531dac
jns 0x531db0
mov edi, 0xec4d8a78
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
not edx
not edx
sub esp, 0
add edi, dword [esp]
sub edi, dword [esp]
jno 0x531e4b
xchg edx, esi
xchg edx, esi
mov esp, esp
jo 0x531e4b
mov esp, 0xf66fe863
add byte [eax], al
call fcn.005414bf
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x531e5e
jmp 0x531ee5
xor esi, dword [esp]
xor esi, dword [esp]
nop
ror esi, 0
cmp edi, 0x53ca
jp 0x531e76
jns 0x531e72
jnp 0x531e76
mov ebp, 0xec4d8d11
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00523000
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00533a13
add esp, 0xc
mov esp, esp
jb 0x531e9f
jo 0x531e9c
jae 0x531e9f
mov edx, 0xe87d83
cmp dword [ebp - 0x18], 0
jne 0x531ea7
jmp 0x531ee5
dec edi
inc edi
mov edi, edi
jno 0x531eb8
jns 0x531eaf
jp 0x531eb1
jge 0x531eb3
jo 0x531eb8
xor eax, 0x4d8b601c
call 0x3d270710
add dword [eax], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00545b94
add esp, 4
lea ecx, [ecx + 0x7952]
lea ecx, [ecx - 0x7952]
jbe 0x531ed2
jp 0x531ede
xchg esp, esp
ja 0x531ed8
mov ebx, ebx
jnp 0x531ede
lcall 0xff52, 0x8558b80
push ebp
call 0x8bae7d48
in eax, 0x5d
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53220d
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
call fcn.00532229

Function at 0x533a42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00533a13
add esp, 0xc
mov esi, esi
jle 0x533a65
jb 0x533a61
jg 0x533a65
add eax, 0xf045c6a9
inc esi
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
ja 0x533a97
jg 0x533aa6
lea ecx, [ecx]
lea esp, [esp]
mov ebx, ebx
jb 0x533aa2
jle 0x533aa6
add eax, 0xf04d8a64
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov ecx, ecx
cld
shl esp, 0
push ecx
add ecx, 0x61fc
ror ecx, 0xf
pop ecx
jbe 0x533b30
pushf
jb 0x533b1d
jae 0x533b1f
ror esi, 0
js 0x533b24
popf
jnp 0x533b28
lea ecx, [ecx]
lea esp, [esp]
ja 0x533b30
mov eax, 0xd98ae8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.005414bf
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x533b42
xor eax, eax
jmp 0x533b8d
dec eax
inc eax
xor esp, 0
jne 0x533b49
jg 0x533b6a
pushf
ror esp, 0
lea esi, [esi + 0x442d]
lea esi, [esi - 0x442d]
rol esp, 0
popf
jle 0x533b63
lea esi, [esi]
xchg edi, eax
xchg edi, eax
jle 0x533b6a
mov ecx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00523000
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00533a13
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53af43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x53af57
jmp 0x53b0ed
jns 0x53af59
shl esp, 0
test dword [esp + 8], edi
jne 0x53af73
pushf
shl edi, 0
js 0x53af69
test dword [esp], esi
popf
xchg esp, esp
je 0x53af73
lcall 0xec45, 0x8908458b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x51fc84], edx
jmp 0x53af86
add ebx, 0
jbe 0x53af94
mov esp, esp
lea ebx, [ebx]
ja 0x53af94
sub eax, 0x458b5b03
in al, dx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x5201ec], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x5201e8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x51fab8], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x51fabc], ecx
and esi, 0xffffffff
call 0x53afcb
add esp, 4
cmp esp, 0xa76
mov esp, esp
jno 0x53afe5
pushf
test dword [esp + 4], edx
popf
xchg ebx, ebx
jo 0x53afe5
mov ebx, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
test dword [esp + 0xc], ebx
not ecx
not ecx
jl 0x53b023
cmp edx, eax
je 0x53b02e
mov ebx, ebx
jne 0x53b02e
xor eax, 0x558a4eed
invalid
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
clc
sub ecx, 0
jp 0x53b0a1
xchg edi, edi
jnp 0x53b0a1
mov esp, 0x1e83d83
push edx
add byte [eax], al
cmp dword [0x5201e8], 0
je 0x53b0be
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x5201e8]
push eax
call fcn.00523000
mov dword [0x51fc80], eax
cmp esi, 0x1ad4
jge 0x53b0dd
lea edx, [edx]
lea ebx, [ebx + 0x4eb0]
lea ebx, [ebx - 0x4eb0]
mov edx, edx
jbe 0x53b0d8
jl 0x53b0dd
mov eax, 0xd6adb11
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00533a13
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53ccf5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00533a13
add esp, 0xc
xchg esi, esi
xchg esp, esp
sub edx, 0
test ebx, eax
jle 0x53cd31
pushf
jne 0x53cd24
xchg ecx, ecx
popf
jne 0x53cd2a
jns 0x53cd2c
xchg esi, esi
jg 0x53cd31
mov edi, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
cld
jo 0x53cd70
mov esp, esp
jns 0x53cd68
mov ebx, ebx
jns 0x53cd6c
jno 0x53cd70
add eax, 0xf04d8a5a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
dec ebx
inc ebx
shl ecx, 0
lea eax, [eax]
and esp, 0xffffffff
js 0x53cde5
jp 0x53cdde
jp 0x53cde0
mov esp, esp
jns 0x53cde5
jmp 0xb97ad1
call fcn.00543396
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x53cdf7
xor eax, eax
jmp 0x53ce34
jns 0x53cdf9
test esp, 0x3253
add edx, dword [esp]
sub edx, dword [esp]
jae 0x53ce11
jnp 0x53ce09
ja 0x53ce0b
lea ecx, [ecx]
jb 0x53ce11
xor eax, 0xf0458ded
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00523000
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00533a13
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53ddd1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x5201b0], 1
jne 0x53df35
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00533a13
add esp, 0xc
test dword [esp], eax
nop
rol ecx, 0x13
rol ecx, 0xd
js 0x53de16
pushf
test ecx, eax
cmp edx, 0x73a6
jns 0x53de0f
popf
jle 0x53de13
jns 0x53de16
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
xor eax, dword [esp]
xor eax, dword [esp]
ja 0x53de61
pushf
jg 0x53de4e
popf
xchg ebx, ebx
lea eax, [eax + 0x44e7]
lea eax, [eax - 0x44e7]
jbe 0x53de61
mov edx, 0x80e84d8a
jmp 0xe8a1666b
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.005414bf
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x53dece
mov eax, dword [ebp + 8]
jmp 0x53dfbe
shr edx, 0
cmp edi, dword [esp + 0x10]
clc
jne 0x53ded8
jle 0x53defa
pushf
neg eax
neg eax
stc
push edx
add edx, 0x794e
ror edx, 0xe
pop edx
rol edi, 0
popf
jg 0x53def3
jne 0x53def5
jle 0x53def7
jg 0x53defa
mov ebp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00523000
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00533a13
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x53df2b
mov edx, dword [ebp - 8]
mov dword [0x5201b0], edx
jmp 0x53df33
mov eax, dword [ebp + 8]
jmp 0x53dfbe
jmp 0x53df3d
mov eax, dword [0x5201b0]
mov dword [ebp - 8], eax
or edi, 0
lea edi, [edi]
jno 0x53df5a
pushf
std
cld
xchg edx, edx
inc ebx
dec ebx
xor edx, eax
xor edx, eax
popf
nop
nop
lea esp, [esp]
jo 0x53df5a
ljmp 0xfc4d:0x89f84d8b
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp edx, dword [esp]
lea esi, [esi + 0x6335]
lea esi, [esi - 0x6335]
or eax, eax
je 0x53df73
jge 0x53df91
pushf
sub ebx, 0
neg ecx
neg ecx
popf
lea ebx, [ebx + 0x489f]
lea ebx, [ebx - 0x489f]
xchg esi, eax
xchg esi, eax
jl 0x53df91
mov ecx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00545b94
add esp, 4
xor edi, ebx
xor edi, ebx
jle 0x53dfa3
xor ebx, dword [esp]
xor ebx, dword [esp]
jbe 0x53dfb7
xchg esp, esp
jmp 0x53dfaf
mov esp, esp
jnp 0x53dfb3
ja 0x53dfb7
mov edi, 0x8458b3d
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4