joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc1ad07
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c26c69
add esp, 0xc
jno 0xc1ad22
jne 0xc1ad48
pushf
dec ebx
inc ebx
xor esi, 0x631f
xor esi, 0x631f
sub ebx, 0
popf
lea edx, [edx + 0x2e35]
lea edx, [edx - 0x2e35]
je 0xc1ad48
xor eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
xchg esp, esp
jl 0xc1ad95
pushf
rol ebx, 6
ror ebx, 6
mov esp, esp
popf
xchg esp, esp
jge 0xc1ad95
lcall 0x1e9, 0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
jne 0xc1ae08
cld
jno 0xc1ae0b
sub esp, 0
jl 0xc1ae15
jb 0xc1ae12
jge 0xc1ae15
xor eax, 0x510e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.00c1b32a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xc1ae28
jmp 0xc1aedd
lea eax, [eax + 0x434b]
lea eax, [eax - 0x434b]
clc
xchg ecx, ecx
jnp 0xc1ae49
lea esi, [esi + 0x6ecc]
lea esi, [esi - 0x6ecc]
jp 0xc1ae49
xor eax, 0xe8558d56
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00c3172f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00c26c69
add esp, 0xc
shl esp, 0
test edi, 0x2b89
xor ebx, 0
ror esp, 0
jo 0xc1ae84
xchg edx, edx
jp 0xc1ae7e
xchg edi, edi
jno 0xc1ae84
xor eax, 0xfc7d8327
add byte [ebp + 2], dh
cmp dword [ebp - 4], 0
jne 0xc1ae8c
jmp 0xc1aedd
sub esp, 0
ror edx, 0x16
rol edx, 0x16
inc ebx
dec ebx
test esp, 0x69b9
jle 0xc1aea9
nop
jae 0xc1aea2
jge 0xc1aea4
xchg edi, edi
jg 0xc1aea9
mov esp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00c1bfd4
add esp, 4
rol ebx, 1
ror ebx, 1
cld
js 0xc1aed6
pushf
xor edx, 0
or eax, eax
popf
lea edi, [edi + 0x5773]
lea edi, [edi - 0x5773]
lea ebx, [ebx]
jns 0xc1aed6
mov ebx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xc1af8f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c26c69
add esp, 0xc
cmp esi, ebx
jno 0xc1afb8
pushf
xchg esp, esp
popf
nop
jae 0xc1afb5
jo 0xc1afb8
lcall 0x45c6, 0x50e845c6
in eax, dx
inc esp
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0
cmp esp, 0x74d9
jno 0xc1affc
cmp esp, 0x5e3f
jnp 0xc1b00c
jb 0xc1b006
jo 0xc1b008
jp 0xc1b00c
mov ebx, 0xe84d8a94
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
lea esp, [esp]
jnp 0xc1b097
je 0xc1b08d
je 0xc1b08f
jnp 0xc1b091
jnp 0xc1b093
jp 0xc1b097
xor eax, 0xf14e8ad
add byte [eax], al
call 0xc1bfb0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xc1b0ac
xor eax, eax
jmp 0xc1b321
and ebx, ebx
neg edi
neg edi
lea esi, [esi + 0x79a9]
lea esi, [esi - 0x79a9]
jns 0xc1b0c0
jge 0xc1b0d9
pushf
and esp, 0xffffffff
call fcn.00c1b0cc
Function at 0xc1c1c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00c26c69
add esp, 0xc
mov esi, esi
jg 0xc1c1e2
jge 0xc1c201
pushf
ror esi, 0xd
rol esi, 0xd
test dword [esp], edx
call fcn.00c1c1f4

Function at 0xc1c5bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00c26c69
add esp, 0xc
or edi, edi
lea edi, [edi]
jae 0xc1c5fa
pushf
jo 0xc1c5e7
mov esp, esp
xor ecx, dword [esp]
xor ecx, dword [esp]
popf
lea ebx, [ebx]
jo 0xc1c5f5
lea ebx, [ebx]
jb 0xc1c5fa
mov ebx, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
lea edi, [edi]
clc
jne 0xc1c63f
pushf
xchg esi, esi
xchg esi, esi
ror esp, 0
popf
jb 0xc1c63c
je 0xc1c63f
mov esi, 0x80f04d8a
jmp 0xf10f4e49
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
nop
rol ebx, 0x15
rol ebx, 0xb
rol esi, 0
jge 0xc1c6ab
je 0xc1c6b7
jp 0xc1c6af
jp 0xc1c6b1
jo 0xc1c6b3
jne 0xc1c6b7
jmp 0x2709afa7
call fcn.00c1ed03
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xc1c6c9
xor eax, eax
jmp 0xc1c720
shr eax, 0
lea esp, [esp]
ror ebx, 0
push edi
pop edi
jbe 0xc1c6fd
pushf
and esp, 0xffffffff
jns 0xc1c6dd
call 0xc1c6e2
lea esp, [esp + 4]
mov ecx, ecx
popf
jne 0xc1c6ec
lea esi, [esi + 0x5436]
lea esi, [esi - 0x5436]
jl 0xc1c6fa
ja 0xc1c6fd
mov ecx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00c3172f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00c26c69
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc1ca88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00c26c69
add esp, 0xc
and edi, 0xffffffff
push ebx
pop ebx
shl eax, 0
je 0xc1cad0
pushf
xor ebx, 0x57b6
xor ebx, 0x57b6
jne 0xc1cabb
popf
lea edx, [edx + 0x128e]
lea edx, [edx - 0x128e]
xchg edx, eax
xchg edx, eax
je 0xc1cacd
jne 0xc1cad0
mov esp, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
xor ebx, dword [esp]
xor ebx, dword [esp]
and eax, 0xffffffff
sub ebx, 0
jl 0xc1cb0e
jp 0xc1cb22
pushf
rol esi, 0
shr edx, 0
popf
mov esp, esp
lea esp, [esp]
jnp 0xc1cb22
mov eax, 0x80f44d8a
jmp 0xf50f532c
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
call 0xc1cb87
add esp, 4
jle 0xc1cb8c
test dword [esp + 8], edx
jp 0xc1cbaf
pushf
add edx, 0
ja 0xc1cb99
call 0xc1cb9e
lea esp, [esp + 4]
jno 0xc1cba4
popf
mov esp, esp
ja 0xc1cbaa
jge 0xc1cbac
jnp 0xc1cbaf
mov ecx, 0xfff3fce8
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call 0xc1bfb0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0xc1cbc7
mov eax, 1
jmp 0xc1cc7c
lea ebx, [ebx + 0x55d9]
sub ebx, 0x55d9
jl 0xc1cbd5
je 0xc1cbe1
jg 0xc1cbd9
xchg esi, esi
jbe 0xc1cbdd
jne 0xc1cbe1
mov ebx, 0xf4458d46
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00c3172f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00c26c69
add esp, 0xc
jo 0xc1cc03
xchg edx, eax
xchg edx, eax
test ecx, esi
jo 0xc1cc09
jns 0xc1cc25
pushf
jl 0xc1cc0f
xchg ebx, ecx
xchg ebx, ecx
neg esi
neg esi
xor esp, 0
popf
jne 0xc1cc1e
ja 0xc1cc20
jl 0xc1cc22
js 0xc1cc25
mov edx, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0xc1cc32
mov eax, 1
jmp 0xc1cc7c
xor esi, 0
or esp, 0
ror esp, 0
jo 0xc1cc56
pushf
xchg esp, esp
lea edx, [edx]
popf
jo 0xc1cc47
lea ebx, [ebx + 0x6e61]
lea ebx, [ebx - 0x6e61]
jno 0xc1cc56
mov edi, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00c1bfd4
add esp, 4
jmp 0xc1cc64
ja 0xc1cc75
pushf
std
cld
test ecx, edi
popf
jns 0xc1cc70
jne 0xc1cc72
jbe 0xc1cc75
mov eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xc1cc85
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00c26c69
add esp, 0xc
cmp ebx, ecx
cmp esp, 0xc44
jb 0xc1ccc3
pushf
inc eax
dec eax
js 0xc1ccb5
shr ebx, 0
mov ecx, ecx
popf
jae 0xc1ccbe
jle 0xc1ccc0
jae 0xc1ccc3
mov edi, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.00c1b32a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xc1cd8b
xor eax, eax
jmp 0xc1ce05
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00c3172f
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00c26c69
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0xc1cdb5
xor eax, eax
jmp 0xc1ce05
ror esp, 0
test esp, 0x5537
test edi, 0x579
or edi, 0
je 0xc1cdd1
jb 0xc1cdcb
ja 0xc1cdcd
jne 0xc1cdd1
jmp 0xe90759aa
mov eax, dword [ebp - 0x18]
push eax
call fcn.00c1bfd4
add esp, 4
mov edi, edi
and edi, edi
jne 0xc1cdfa
pushf
ror edi, 0x1d
rol edi, 0x1d
xor ecx, dword [esp]
xor ecx, dword [esp]
jns 0xc1cdf3
popf
jne 0xc1cdf7
je 0xc1cdfa
ljmp 0x558b:0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xc2076a
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0xc07c70
call fcn.00c2c334
add esp, 0xc
mov byte [0xc07c70], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0xc26c98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c26c69
add esp, 0xc
add ebx, 0
jns 0xc26cd4
pushf
shl esp, 0
lea eax, [eax + 0x2e37]
sub eax, 0x2e37
test dword [esp + 0xc], ebx
clc
popf
jmp 0xc26ccf
jns 0xc26cd1
js 0xc26cd4
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
jmp 0xc26d0a
je 0xc26d15
mov ebx, ebx
jnp 0xc26d10
jge 0xc26d12
jne 0xc26d15
mov ebp, 0x80e84d8a
jmp 0xe90ff51f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
neg esi
neg esi
push ecx
add ecx, 0x5f9e
ror ecx, 0xe
pop ecx
not ebx
not ebx
jno 0xc26d9c
jl 0xc26d94
jns 0xc26d96
mov esp, esp
jo 0xc26d9c
mov ebp, 0x4589e878
invalid
call fcn.00c1b32a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xc26db1
xor eax, eax
jmp 0xc26e56
nop
rol esp, 0
jp 0xc26dc3
xchg esp, esp
mov esi, esi
xchg edi, esi
xchg edi, esi
jnp 0xc26dc3
jmp 0xe90ffbaf
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00c3172f
mov dword [ebp - 4], eax
add edi, 0x1ebc
sub edi, 0x1ebc
xchg ebx, ebx
jne 0xc26df2
pushf
test esp, 0x2416
popf
jp 0xc26def
je 0xc26df2
mov eax, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c26c69
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0xc26e0c
xor eax, eax
jmp 0xc26e56
ror ecx, 0x13
rol ecx, 0x13
test esi, 0x107c
lea edi, [edi + 0x598e]
lea edi, [edi - 0x598e]
mov edx, edx
jnp 0xc26e31
mov edx, edx
jo 0xc26e2c
xchg esp, esp
jp 0xc26e31
mov ebp, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00c1bfd4
add esp, 4
jge 0xc26e3f
jne 0xc26e53
lea ebx, [ebx + 0x1e2]
lea ebx, [ebx - 0x1e2]
jmp 0xc26e4f
nop
je 0xc26e53
call 0x60bec456
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc27e8d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0xc07c48], 1
jne 0xc27fda
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c26c69
add esp, 0xc
shr esp, 0
jbe 0xc27ec4
jbe 0xc27eba
lea eax, [eax]
lea ebx, [ebx]
je 0xc27ec0
ja 0xc27ec4
mov ecx, 0xe845c6fa
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
and esp, 0xffffffff
rol esp, 0
add esi, dword [esp]
sub esi, dword [esp]
jb 0xc27efe
je 0xc27f1b
pushf
nop
or eax, 0
popf
lea ebx, [ebx + 0x1fc2]
lea ebx, [ebx - 0x1fc2]
jbe 0xc27f16
jae 0xc27f18
jne 0xc27f1b
mov ecx, 0x80e84d8a
jmp 0xe9100725
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.00c1b32a
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xc27f88
mov eax, dword [ebp + 8]
jmp 0xc2806b
rol ecx, 0x14
rol ecx, 0xc
jb 0xc27f90
xor edi, 0
std
cld
ja 0xc27f9f
jae 0xc27f99
jl 0xc27f9b
jbe 0xc27f9f
mov edx, 0xe8558d56
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00c3172f
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00c26c69
add esp, 0xc
cmp dword [ebp - 8], 0
je 0xc27fd0
mov edx, dword [ebp - 8]
mov dword [0xc07c48], edx
jmp 0xc27fd8
mov eax, dword [ebp + 8]
jmp 0xc2806b
jmp 0xc27fe2
mov eax, dword [0xc07c48]
mov dword [ebp - 8], eax
rol edi, 0x15
rol edi, 0xb
jno 0xc28000
pushf
add edi, 0
ror edx, 0x1c
ror edx, 4
lea edx, [edx]
popf
js 0xc27ffb
xchg edx, edx
jo 0xc28000
call 0x8abacd8f
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
ror eax, 0
cmp ecx, dword [esp + 0x10]
jp 0xc28036
pushf
cmp eax, ebx
push edx
add edx, 0x5f7c
ror edx, 6
pop edx
xor edi, esi
xor edi, esi
rol esp, 0
popf
lea ecx, [ecx + 0x62f4]
lea ecx, [ecx - 0x62f4]
jnp 0xc28036
mov ebx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00c1bfd4
add esp, 4
or edi, edi
clc
jge 0xc28047
cmp edx, 0xa01
js 0xc28064
pushf
test eax, 0x7f4d
neg edi
neg edi
cmc
popf
jge 0xc2805f
jge 0xc28061
jns 0xc28064
ljmp 0x55ff:0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xc296d2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0xc07c44], 1
jne 0xc29853
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c26c69
add esp, 0xc
cmp esp, 0x4ece
jle 0xc2970b
jbe 0xc29702
jg 0xc29704
jge 0xc29706
js 0xc29708
jg 0xc2970b
call 0x49aadcd5
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
sub ebx, 0
jnp 0xc2975c
pushf
lea eax, [eax]
lea esp, [esp]
popf
jno 0xc2974b
lea ecx, [ecx + 0x2c5]
lea ecx, [ecx - 0x2c5]
jle 0xc29759
jp 0xc2975c
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00c1b32a
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xc297d1
xor eax, eax
jmp 0xc298a3
xchg esp, esp
rol ecx, 0
test ebx, 0x7638
rol edx, 0x1d
ror edx, 0x1d
jle 0xc297ff
pushf
lea ecx, [ecx]
add edi, 0
cmp eax, 0x2f3a
test esp, 0x4ba3
popf
mov edx, edx
jno 0xc297fc
jg 0xc297ff
or dword [ebp - 0x74af17bb], 0xe851f44d
and edi, dword [edi]
add byte [ecx + 0xc6af845], cl
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00c3172f
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00c26c69
add esp, 0xc
cmp esp, 0x4db3
jae 0xc2983d
pushf
add edx, dword [esp]
sub edx, dword [esp]
or eax, eax
ror esp, 0
popf
xchg ecx, edx
xchg ecx, edx
jb 0xc2983d
add eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0xc2984d
mov eax, dword [ebp - 8]
mov dword [0xc07c44], eax
jmp 0xc29851
xor eax, eax
jmp 0xc298a3
jmp 0xc2985c
mov ecx, dword [0xc07c44]
mov dword [ebp - 8], ecx
xchg esp, esp
cld
neg ecx
neg ecx
jo 0xc29877
pushf
jp 0xc29869
shr esp, 0
popf
xchg esp, esp
je 0xc29872
xchg ecx, ecx
jno 0xc29877
sub eax, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp edx, 0x712
jae 0xc2988c
js 0xc29887
jb 0xc2988c
jmp 0x464dfb8b
mov eax, dword [ebp - 4]
push eax
call fcn.00c1bfd4
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xc2c363
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00c26c69
add esp, 0xc
call fcn.00c2c381