joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2057c276
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x205663e4], 1
jne 0x2057c3e5
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2057149a
add esp, 0xc
dec edi
inc edi
and esp, 0xffffffff
xchg edi, eax
xchg edi, eax
jns 0x2057c2b6
pushf
jno 0x2057c2a9
popf
xchg esi, eax
xchg esi, eax
jno 0x2057c2af
xchg esi, edi
xchg esi, edi
js 0x2057c2b6
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
call 0x2057c2eb
add esp, 4
jbe 0x2057c2f0
je 0x2057c306
pushf
xchg ecx, ebx
xchg ecx, ebx
stc
jp 0x2057c2fb
popf
jns 0x2057c2ff
lea eax, [eax]
jl 0x2057c303
jne 0x2057c306
add eax, 0x80e84d8a
jmp 0x8a54b10
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.2057ab09
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x2057c37b
xor eax, eax
jmp 0x2057c453
je 0x2057c37d
or edi, 0
jl 0x2057c399
pushf
test ebx, edi
jl 0x2057c388
je 0x2057c38a
sub ecx, 0
popf
jge 0x2057c391
jne 0x2057c393
lea esp, [esp]
jge 0x2057c399
xor eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.20583c1d
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.2057149a
add esp, 0xc
or ebx, 0
sub ebx, 0
js 0x2057c3cf
pushf
rol edx, 0
stc
popf
nop
xchg edi, edi
jns 0x2057c3cf
mov ecx, 0xf87d83
cmp dword [ebp - 8], 0
je 0x2057c3df
mov eax, dword [ebp - 8]
mov dword [0x205663e4], eax
jmp 0x2057c3e3
xor eax, eax
jmp 0x2057c453
jmp 0x2057c3ee
mov ecx, dword [0x205663e4]
mov dword [ebp - 8], ecx
cmp eax, 0x2412
add esp, 0
rol esp, 0
jl 0x2057c408
mov edi, edi
jae 0x2057c3ff
xchg edi, ecx
xchg edi, ecx
jge 0x2057c408
call 0x75e3afdc
clc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
clc
ror eax, 0x17
ror eax, 9
cld
jne 0x2057c43c
pushf
lea ecx, [ecx + 0x58f0]
sub ecx, 0x58f0
test esp, 0x2e66
xor eax, dword [esp]
xor eax, dword [esp]
shr esp, 0
popf
jae 0x2057c439
je 0x2057c43c
xor eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.2057935a
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2057edb7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2057149a
add esp, 0xc
jne 0x2057edd9
ror esp, 0
jne 0x2057eded
pushf
add esp, 0
popf
jo 0x2057ede7
lea esp, [esp]
je 0x2057eded
mov ebp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
xor esi, 0
rol esi, 0
xchg edx, edx
rol ebx, 0xf
ror ebx, 0xf
jno 0x2057ee45
pushf
shr esp, 0
add edx, dword [esp]
sub edx, dword [esp]
lea ebx, [ebx]
popf
jne 0x2057ee3e
jmp 0x2057ee40
je 0x2057ee42
jo 0x2057ee45
mov ebx, 0x80f04d8a
jmp 0x10a5764f
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
or ecx, ecx
mov eax, eax
xchg esi, edi
xchg esi, edi
jl 0x2057eebd
pushf
jae 0x2057eeb3
popf
jae 0x2057eeb7
nop
jmp 0x2057eeba
jge 0x2057eebd
ljmp 0x8900:0x1a49e8
call fcn.2058090b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2057eecf
xor eax, eax
jmp 0x2057ef13
xchg esp, esp
sub esp, 0
cmp edx, dword [esp]
jo 0x2057eed9
je 0x2057eef0
pushf
or edi, 0
and esi, esi
sub esp, 0
popf
js 0x2057eee9
xchg edx, edx
jg 0x2057eeed
jne 0x2057eef0
mov esi, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.20583c1d
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2057149a
Function at 0x205823f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.2057149a
add esp, 0xc
test eax, edx
jae 0x20582411
clc
je 0x20582425
pushf
xchg esp, esp
rol edi, 0x14
rol edi, 0xc
popf
jge 0x20582422
jne 0x20582425
xor eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
not esi
not esi
lea edx, [edx + 0x2818]
sub edx, 0x2818
push eax
add eax, 0x49cb
ror eax, 0x17
pop eax
jnp 0x20582484
lea ebx, [ebx + 0xd81]
lea ebx, [ebx - 0xd81]
jns 0x2058247f
js 0x20582481
jp 0x20582484
mov edx, 0x80f44d8a
jmp 0x14a5ac8e
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
xor eax, dword [esp]
xor eax, dword [esp]
ja 0x205824ec
cmp edx, 0x231b
jbe 0x205824fd
jns 0x205824f6
nop
mov eax, eax
ja 0x205824fd
mov ecx, 0x709ae852
add byte [eax], al
call 0x2058959c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x20582515
mov eax, 1
jmp 0x205825a5
push eax
add eax, 0x223a
ror eax, 0x1e
pop eax
jae 0x20582521
jne 0x20582529
nop
lea esi, [esi]
je 0x20582529
lcall 0x4d8b, 0x50f4458d
invalid
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.20583c1d
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.2057149a
add esp, 0xc
cld
mov ebx, ebx
add esi, dword [esp]
sub esi, dword [esp]
jo 0x20582554
jg 0x20582562
pushf
rol esp, 0
popf
jno 0x2058255f
jle 0x20582562
sub eax, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x2058256f
mov eax, 1
jmp 0x205825a5
lea edi, [edi + 0xbef]
lea edi, [edi - 0xbef]
dec ecx
inc ecx
sub ecx, 0
jae 0x20582587
nop
jb 0x20582587
mov esp, 0xec458b30
mov eax, dword [ebp - 0x14]
push eax
call fcn.2057935a
add esp, 4
jbe 0x20582595
jb 0x2058259e
xchg ebx, ecx
xchg ebx, ecx
jae 0x2058259e
mov edx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x205837be
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2057149a
add esp, 0xc
xchg esp, esp
jmp 0x205837db
jp 0x205837e7
pushf
nop
popf
jb 0x205837e4
jnp 0x205837e7
add eax, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
push edi
pop edi
jne 0x20583827
add eax, 0
jl 0x20583853
pushf
lea ebx, [ebx]
or edx, edx
lea edi, [edi + 0x7810]
lea edi, [edi - 0x7810]
popf
ja 0x20583842
lea edx, [edx + 0x4078]
lea edx, [edx - 0x4078]
lea edi, [edi]
jge 0x20583853
mov ebx, 0x80ec4d8a
jmp 0xca5c05d
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.2057ab09
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x205838e0
jmp 0x20583965
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.20583c1d
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2057149a
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x20583965
xchg esi, esi
lea esp, [esp]
shr edi, 0
jne 0x20583917
jb 0x20583912
jnp 0x20583914
je 0x20583917
lcall 0x3ae8, 0x50e8458b
pop edx
invalid
mov eax, dword [ebp - 0x18]
push eax
call fcn.2057935a
add esp, 4
lea eax, [eax + 0x68c0]
lea eax, [eax - 0x68c0]
jbe 0x20583952
pushf
xor eax, 0x5f43
xor eax, 0x5f43
mov eax, eax
popf
lea esi, [esi + 0xb95]
lea esi, [esi - 0xb95]
je 0x2058394f
ja 0x20583952
mov esp, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2058638f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x205863a3
jmp 0x2058655d
nop
jg 0x205863ae
jg 0x205863a8
jnp 0x205863aa
jle 0x205863ae
call 0x289deef8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x20564b24], edx
and edx, edx
not edi
not edi
sub eax, 0
cmp edi, dword [esp]
jg 0x205863f7
pushf
xchg ecx, ecx
xor esi, 0x76b6
xor esi, 0x76b6
ror edi, 3
rol edi, 3
lea ecx, [ecx + 0x3247]
sub ecx, 0x3247
popf
lea esp, [esp]
jle 0x205863f7
mov edi, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x20565294
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x20565294], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x20565290], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x205663f8], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x205663fc], ecx
and edi, 0xffffffff
jbe 0x2058643b
pushf
ror esp, 0
test dword [esp + 0x10], ebx
popf
jbe 0x20586438
ja 0x2058643b
call 0x6e48aa05
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jle 0x20586471
jmp 0x20586473
jge 0x2058648b
pushf
xor esp, 0
shr edi, 0
add esp, 0
xchg esi, eax
xchg esi, eax
popf
jg 0x20586486
xchg esi, eax
xchg esi, eax
jl 0x2058648b
mov esp, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
nop
je 0x205864fd
jb 0x205864f8
jne 0x205864fd
call 0x5ddc1d82
nop
push edx
push esi
and byte [eax], al
cmp dword [0x20565290], 0
je 0x2058651a
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x20565290]
push eax
call fcn.20583c1d
mov dword [0x20564b20], eax
xchg esp, esp
and esp, 0xffffffff
jmp 0x20586521
jbe 0x2058654d
pushf
jnp 0x20586527
ror ebx, 0
lea edi, [edi]
not edx
not edx
popf
lea eax, [eax + 0x4b7]
lea eax, [eax - 0x4b7]
lea edi, [edi + 0x2cb3]
lea edi, [edi - 0x2cb3]
ja 0x2058654d
mov esp, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.2057149a
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20586ca9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.2057149a
add esp, 0xc
push 0x21
push 0x2056661c
lea ecx, [ebp - 0x138]
push ecx
call fcn.20575912
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x20586db1
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.2057149a
add esp, 0xc
push 0xb
push 0x20566640
lea edx, [ebp - 0x138]
push edx
call fcn.20575912
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x20586da4
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.20575912
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x20586db3
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x20587f3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
sub edi, 0x4ff4
jns 0x20587f68
pushf
jle 0x20587f4b
rol edx, 0xf
ror edx, 0xf
inc esi
dec esi
cmp edi, dword [esp + 0x10]
popf
lea edx, [edx + 0x787a]
lea edx, [edx - 0x787a]
js 0x20587f68
mov ecx, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x6a
mov byte [ebp - 0x11], 0x57
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6f
xor ebx, edx
xor ebx, edx
xchg ebx, ebx
cmp ecx, 0x1a45
test esi, ecx
jb 0x20587fab
lea ebx, [ebx]
jle 0x20587fa8
jae 0x20587fab
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
cmp eax, dword [esp + 0xc]
not edx
not edx
lea ebx, [ebx + 0x5476]
lea ebx, [ebx - 0x5476]
ja 0x20588030
pushf
clc
lea edx, [edx]
lea ebx, [ebx + 0x4b36]
lea ebx, [ebx - 0x4b36]
popf
jle 0x2058802d
jbe 0x20588030
mov ecx, 0xff2ad4e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.2057ab09
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20588045
xor eax, eax
jmp 0x205880ea
or edi, edi
jp 0x2058805f
jge 0x2058804b
lea ebx, [ebx + 0x6bc0]
lea ebx, [ebx - 0x6bc0]
jl 0x20588059
jle 0x2058805b
jnp 0x2058805f
jmp 0xcae0dde
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.20583c1d
mov dword [ebp - 4], eax
push 0xb
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.2057149a
add esp, 0xc
js 0x20588081
js 0x20588094
pushf
jo 0x20588087
inc esi
dec esi
popf
ja 0x2058808d
jmp 0x2058808f
jmp 0x20588091
jns 0x20588094
call 0x2154fe1b
cmp dword [ebp - 4], 0
jne 0x2058809e
xor eax, eax
jmp 0x205880ea
add edi, 0x719b
sub edi, 0x719b
xchg edi, ecx
xchg edi, ecx
test esp, 0x7949
mov esp, esp
jle 0x205880ca
pushf
mov esi, esi
mov esp, esp
shr eax, 0
popf
jl 0x205880c5
jp 0x205880c7
jg 0x205880ca
mov esi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.2057935a
add esp, 4
and esi, esi
jbe 0x205880e7
jns 0x205880dc
xchg esi, edx
xchg esi, edx
xchg edx, edx
xchg ebx, ebx
ja 0x205880e7
mov edi, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2058a6fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2057149a
add esp, 0xc
js 0x2058a719
dec esi
inc esi
push ebx
add ebx, 0x3986
ror ebx, 0x19
pop ebx
clc
jae 0x2058a734
xchg edx, eax
xchg edx, eax
jns 0x2058a72d
je 0x2058a72f
jbe 0x2058a731
jb 0x2058a734
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
lea esp, [esp]
ja 0x2058a775
add esp, 0
ror edx, 0x14
ror edx, 0xc
jo 0x2058a796
pushf
jp 0x2058a784
jae 0x2058a786
or ecx, 0
mov esi, esi
popf
mov edi, edi
jo 0x2058a791
jge 0x2058a793
jno 0x2058a796
add eax, 0x80e84d8a
jmp 0x8a62fa0
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.2058090b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2058a822
xor eax, eax
jmp 0x2058a895
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.20583c1d
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.2057149a
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x2058a893
jne 0x2058a84a
cld
jno 0x2058a85f
lea edx, [edx + 0x7b5a]
lea edx, [edx - 0x7b5a]
nop
jo 0x2058a85f
xor eax, 0x458bcc3f
clc
mov eax, dword [ebp - 8]
push eax
call fcn.2057935a
add esp, 4
and eax, 0xffffffff
jae 0x2058a886
pushf
lea ebx, [ebx]
add esp, 0
test dword [esp + 0x10], ebx
popf
xchg esp, esp
lea eax, [eax]
jbe 0x2058a883
jb 0x2058a886
add eax, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x2058a895
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2058a89e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x205663e8], 1
jne 0x2058a9c7
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2057149a
add esp, 0xc
jl 0x2058a8c6
jae 0x2058a8d1
lea edi, [edi]
xchg ecx, eax
xchg ecx, eax
jb 0x2058a8ce
jb 0x2058a8d1
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
rol eax, 0
ja 0x2058a911
xchg ecx, edx
xchg ecx, edx
js 0x2058a908
jle 0x2058a90a
jo 0x2058a90c
jbe 0x2058a911
mov esp, 0x4d8a2315
call 0xa85a9298
dec ebp
call 0xa145fea8
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.2057ab09
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x2058a97e
mov eax, dword [ebp + 8]
jmp 0x2058aa37
and esp, 0xffffffff
xchg esi, edx
xchg esi, edx
shl ecx, 0
jnp 0x2058a98f
jge 0x2058a98c
jp 0x2058a98f
mov edi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.20583c1d
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2057149a
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x2058a9c0
mov edx, dword [ebp - 8]
mov dword [0x205663e8], edx
jmp 0x2058a9c5
mov eax, dword [ebp + 8]
jmp 0x2058aa37
jmp 0x2058a9cf
mov eax, dword [0x205663e8]
mov dword [ebp - 8], eax
xor esi, 0x6339
xor esi, 0x6339
nop
xor esp, 0
jne 0x2058a9e9
mov esp, esp
jge 0x2058a9e5
nop
je 0x2058a9e9
add eax, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
sub esp, 0
jg 0x2058aa0a
pushf
mov edi, edi
or edi, 0
cld
shr esp, 0
popf
ja 0x2058aa03
jno 0x2058aa05
jg 0x2058aa07
jle 0x2058aa0a
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.2057935a
add esp, 4
add eax, dword [esp]
sub eax, dword [esp]
test dword [esp], eax
add ebx, dword [esp]
sub ebx, dword [esp]
jg 0x2058aa30
lea esp, [esp]
jno 0x2058aa2c
jle 0x2058aa30
mov ecx, 0x8458bce
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x205911e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret