joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x513c34
jmp 0x513de0
jl 0x513c36
shl ecx, 0
ror esp, 0
shl esp, 0
jp 0x513c51
pushf
neg edx
neg edx
popf
xchg ebx, ebx
jb 0x513c4d
nop
jnp 0x513c51
lcall 0xec45, 0x8908458b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x504f80], edx
test esp, 0x54ac
mov ebx, ebx
jge 0x513c73
mov esp, esp
xchg ecx, eax
xchg ecx, eax
jl 0x513c73
mov edx, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x504fc8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x504fc8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x504fc4], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x503f10], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x503f14], ecx
test ecx, eax
jbe 0x513ca6
js 0x513ca8
jnp 0x513cb8
pushf
std
cld
popf
jmp 0x513cb2
xchg esp, esp
nop
jp 0x513cb8
mov ebp, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
shr eax, 0
je 0x513cfd
jae 0x513cf3
lea ecx, [ecx]
lea esp, [esp]
jne 0x513cfd
mov eax, 0x558aaf56
invalid
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
test eax, 0x7a10
js 0x513d6c
jp 0x513d6e
jg 0x513d93
pushf
xor ebx, dword [esp + 4]
xor ebx, dword [esp + 4]
sub ecx, 0
cmp esi, dword [esp]
jle 0x513d82
popf
lea ecx, [ecx + 0x214d]
lea ecx, [ecx - 0x214d]
jle 0x513d93
sub eax, 0x4fc43d83
push eax
add byte [eax], al
cmp dword [0x504fc4], 0
je 0x513db0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x504fc4]
push eax
call fcn.00510bb9
mov dword [0x504f7c], eax
jae 0x513db2
jge 0x513db4
cmc
jns 0x513dd0
pushf
test ecx, eax
jo 0x513dbd
jbe 0x513dbf
popf
lea edi, [edi + 0x546e]
lea edi, [edi - 0x546e]
js 0x513dd0
mov ebp, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0050e181
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x514d6c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x504f84
call fcn.00512e43
add esp, 0xc
mov byte [0x504f84], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x5155d3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0050e181
add esp, 0xc
add eax, 0
jge 0x5155f1
jbe 0x515601
pushf
shl esp, 0
popf
je 0x5155fc
js 0x5155fe
ja 0x515601
mov esp, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
test dword [esp + 4], ebx
jns 0x515651
mov esp, esp
mov esi, esi
js 0x51564d
js 0x515651
mov eax, 0xec4d8a7f
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.005248b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5156e8
xor eax, eax
jmp 0x5157af
shl esp, 0
cmp edi, eax
call 0x5156f2
add esp, 4
test esp, 0x62ad
jb 0x515704
lea esp, [esp]
jae 0x515704
call 0xec9ee46f
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00510bb9
mov dword [ebp - 0x18], eax
shl ecx, 0
push edx
pop edx
stc
jmp 0x51571c
jo 0x515732
pushf
lea eax, [eax + 0x24ec]
sub eax, 0x24ec
popf
jnp 0x51572f
jno 0x515732
call 0xbb67a0
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0050e181
add esp, 0xc
push edi
add edi, 0x40bf
ror edi, 0xf
pop edi
shr esp, 0
js 0x51575c
xchg esi, esi
mov esp, esp
jne 0x515758
jns 0x51575c
mov esp, 0xe87d83f9
add byte [ebp + 4], dh
cmp dword [ebp - 0x18], 0
jne 0x515766
xor eax, eax
jmp 0x5157af
ror esp, 0
jb 0x515771
jae 0x51576d
nop
jae 0x515771
add eax, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0052580a
add esp, 4
cmp esp, 0x4c3b
sub esp, 0
and esi, 0xffffffff
cmp ebx, 0x4de9
jb 0x515798
xchg edi, edi
jae 0x515798
mov edi, 0x558b8ba8
sbb byte [edx - 0x75], dl
inc ebp
adc al, 0x50
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x5169ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0050e181
add esp, 0xc
jo 0x516a0e
nop
js 0x516a11
jbe 0x516a22
lea ebx, [ebx + 0x4327]
lea ebx, [ebx - 0x4327]
ja 0x516a22
add esi, 0xc64ef045
inc ebp
cmc
push 0x66f145c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
or eax, 0
ja 0x516a5c
js 0x516a59
jbe 0x516a5c
add eax, 0x80f04d8a
jmp 0xf09ef266
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov eax, eax
jnp 0x516ad0
pushf
push edx
pop edx
stc
lea ebx, [ebx]
popf
jno 0x516acb
jns 0x516acd
jp 0x516ad0
lcall 0x8900, 0x1b18fe8
inc ebp
cld
call fcn.00531c64
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x516ae2
xor eax, eax
jmp 0x516b21
jp 0x516ae4
nop
jbe 0x516afe
pushf
not ebx
not ebx
shl esp, 0
or eax, 0
cmp edi, dword [esp]
popf
nop
jnp 0x516afb
ja 0x516afe
or dword [ebp - 0x74af0fbb], 0xe851fc4d
scasb al, byte es:[edi]
mov al, byte [0x4589ffff]
in al, dx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00510bb9
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0050e181
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x518715
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0050e181
add esp, 0xc
not edi
not edi
xchg edi, edi
push edx
add edx, 0x2caa
ror edx, 0xe
pop edx
jb 0x518754
pushf
stc
lea esi, [esi]
shr eax, 0
popf
jge 0x51874d
xchg esp, esp
jb 0x518751
jae 0x518754
xor eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
shr esp, 0
xchg edi, ecx
xchg edi, ecx
cmp ebx, dword [esp]
push eax
add eax, 0xaaf
ror eax, 1
pop eax
ja 0x5187b8
pushf
lea ebx, [ebx + 0x6d7a]
lea ebx, [ebx - 0x6d7a]
cld
xchg edi, edi
add edi, 0
popf
jae 0x5187b1
lea edx, [edx]
jbe 0x5187b5
jbe 0x5187b8
mov eax, 0x80f44d8a
jmp 0xf49f0fc2
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
cmp ebx, dword [esp]
std
cld
ror eax, 0x1d
rol eax, 0x1d
and esp, 0xffffffff
je 0x518831
mov ecx, ecx
jnp 0x51882c
jg 0x51882e
jne 0x518831
mov eax, 0x19457e8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x531c8d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x518849
mov eax, 1
jmp 0x518919
call fcn.0051884e
Function at 0x518b3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x505108], 1
jne 0x518c7d
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050e181
add esp, 0xc
xor esi, ecx
xor esi, ecx
call 0x518b6c
add esp, 4
test ebx, 0x221a
rol esi, 0x10
rol esi, 0x10
ja 0x518b84
mov ecx, ecx
jo 0x518b81
jbe 0x518b84
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
jg 0x518bb2
je 0x518bc6
pushf
or edx, edx
jo 0x518bba
cmp ecx, dword [esp]
jge 0x518bbf
popf
jg 0x518bc3
jne 0x518bc6
mov eax, 0x80e84d8a
jmp 0xe89f13d0
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.005248b4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x518c33
mov eax, dword [ebp + 8]
jmp 0x518ce1
jg 0x518c35
jns 0x518c37
or ecx, ecx
jne 0x518c45
nop
mov esp, esp
jl 0x518c40
jnp 0x518c42
je 0x518c45
mov ecx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00510bb9
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0050e181
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x518c76
mov edx, dword [ebp - 8]
mov dword [0x505108], edx
jmp 0x518c7b
mov eax, dword [ebp + 8]
jmp 0x518ce1
jmp 0x518c85
mov eax, dword [0x505108]
mov dword [ebp - 8], eax
mov eax, eax
cmp esp, 0x759b
add esi, 0
std
cld
jo 0x518ca1
pushf
jae 0x518c98
jb 0x518c9a
popf
xchg ecx, ecx
jno 0x518ca1
mov ebp, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
add esi, 0
jno 0x518cbb
pushf
rol ecx, 8
rol ecx, 0x18
popf
jne 0x518cb8
jo 0x518cbb
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0052580a
add esp, 4
and esp, 0xffffffff
shr esp, 0
jae 0x518ccf
xor esp, 0
jle 0x518cda
jbe 0x518cd6
jg 0x518cda
ljmp 0xff50:0x8458b1c
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x51b1e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050e181
add esp, 0xc
jge 0x51b201
sub esp, 0
shl edx, 0
js 0x51b209
jns 0x51b214
mov esp, esp
je 0x51b20f
jae 0x51b211
js 0x51b214
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
jbe 0x51b25e
lea edx, [edx]
js 0x51b27a
mov esp, esp
xchg edx, ecx
xchg edx, ecx
lea eax, [eax + 0x4d7f]
lea eax, [eax - 0x4d7f]
lea esp, [esp]
jns 0x51b27a
call 0x813a0008
jmp 0xe89f3a84
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.005248b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x51b323
xor eax, eax
jmp 0x51b3c5
xchg esi, esi
ja 0x51b32c
jbe 0x51b329
jbe 0x51b32c
mov esi, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00510bb9
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0050e181
add esp, 0xc
add eax, dword [esp]
sub eax, dword [esp]
jle 0x51b36f
pushf
shl ecx, 0
ror edi, 3
ror edi, 0x1d
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
popf
xchg edx, edx
nop
jg 0x51b36f
mov ebp, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x51b379
xor eax, eax
jmp 0x51b3c5
neg edi
neg edi
nop
xor ebx, 0
jnp 0x51b38c
lea eax, [eax]
jb 0x51b387
jp 0x51b38c
mov edx, 0x458bc831
in al, 0x50
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0052580a
add esp, 4
xchg esp, esp
cmp esi, dword [esp]
jl 0x51b3c2
pushf
clc
xor edi, ecx
xor edi, ecx
add ecx, 0x3022
sub ecx, 0x3022
xor esi, dword [esp + 0x10]
xor esi, dword [esp + 0x10]
popf
nop
jp 0x51b3bf
jge 0x51b3c2
mov ecx, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51b3cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050e181
add esp, 0xc
nop
call fcn.0051b3eb

Function at 0x51cc4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0050e181
add esp, 0xc
ror edi, 0xd
ror edi, 0x13
sub esp, 0
sub esp, 0
rol esp, 0
je 0x51cc88
pushf
mov edx, edx
lea edi, [edi]
ror ecx, 0xf
ror ecx, 0x11
popf
jp 0x51cc85
jne 0x51cc88
add eax, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
mov esi, esi
call fcn.0051ccbf
Function at 0x525206
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0050e181
add esp, 0xc
lea ecx, [ecx + 0x3b10]
sub ecx, 0x3b10
jns 0x52522d
xchg esp, esp
test dword [esp], ebx
jne 0x525245
jle 0x525236
lea esi, [esi + 0x1ed5]
lea esi, [esi - 0x1ed5]
je 0x525245
mov ebx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
call 0x52527a
add esp, 4
jp 0x525290
pushf
or esp, 0
popf
nop
jle 0x525289
xchg esi, edx
xchg esi, edx
jnp 0x525290
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.005248b4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x525305
xor eax, eax
jmp 0x5253a2
stc
not eax
not eax
mov esi, esi
cmp esp, 0x3d65
jg 0x52531c
lea esi, [esi]
je 0x525318
jle 0x52531c
xor eax, 0xec458d57
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00510bb9
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0050e181
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x525346
xor eax, eax
jmp 0x5253a2
cmp ebx, esi
or ebx, 0
ror ecx, 0x1f
ror ecx, 1
rol esi, 0x16
rol esi, 0xa
jbe 0x525375
pushf
jno 0x52535c
add edx, 0x3986
sub edx, 0x3986
cld
sub esp, 0
popf
jnp 0x525370
jne 0x525372
ja 0x525375
mov ebp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0052580a
add esp, 4
jmp 0x525383
xor ebx, 0
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
jnp 0x52539b
pushf
cmp esi, ebx
popf
jp 0x525398
jp 0x52539b
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x526596
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0050e181
add esp, 0xc
ror edi, 0x15
rol edi, 0x15
call 0x5265ba
add esp, 4
xor ecx, edx
xor ecx, edx
and esp, 0xffffffff
jns 0x5265cb
xchg esp, esp
js 0x5265cb
call 0x4b3eab95
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
mov esp, esp
jae 0x526614
ja 0x526611
jb 0x526614
mov ebx, 0x80ec4d8a
jmp 0xec9fee1e
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.00531c64
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5266a8
xor eax, eax
jmp 0x526715
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00510bb9
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0050e181
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x526713
cmp esi, 0x6c9a
jg 0x5266e1
mov eax, eax
ja 0x5266da
jae 0x5266dc
jmp 0x5266de
jle 0x5266e1
mov eax, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0052580a
add esp, 4
add eax, 0x75f0
sub eax, 0x75f0
jg 0x5266f9
js 0x52670a
pushf
or esp, 0
or edi, 0
popf
mov ecx, ecx
jns 0x52670a
call 0x525abc99
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x526715
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4