joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c8316
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005da12d
add esp, 0xc
add edi, 0
jl 0x5c8334
jle 0x5c833d
xchg esp, esp
je 0x5c833a
jg 0x5c833d
sub eax, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
jno 0x5c8377
jns 0x5c8384
jp 0x5c837b
jl 0x5c837d
xchg edi, ebx
xchg edi, ebx
js 0x5c8384
mov esp, 0x80e84d8a
jmp 0xe8aa0b8e
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.005e8272
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5c8407
xor eax, eax
jmp 0x5c8471
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005cc224
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x5c846f
stc
jge 0x5c8435
xchg edi, edi
jl 0x5c8435
mov ebp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.005c0cb3
add esp, 4
jnp 0x5c8443
jns 0x5c845a
pushf
test dword [esp + 0xc], edx
mov edx, edx
rol esp, 0
shr esi, 0
popf
jae 0x5c8457
js 0x5c845a
mov ecx, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x5c8471
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5c85c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005da12d
add esp, 0xc
jo 0x5c85e1
lea esi, [esi + 0x3e30]
lea esi, [esi - 0x3e30]
ja 0x5c8603
pushf
jl 0x5c85f3
xor ecx, dword [esp]
xor ecx, dword [esp]
js 0x5c85fb
nop
popf
jl 0x5c8600
jbe 0x5c8603
add eax, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
inc edx
dec edx
xchg esp, esp
je 0x5c864a
lea eax, [eax]
jne 0x5c864a
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.005d5752
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5c86d4
jmp 0x5c8738
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cc224
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x5c8738
or ebx, 0
add esi, dword [esp]
sub esi, dword [esp]
ja 0x5c870a
jp 0x5c8707
jbe 0x5c870a
add eax, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.005c0cb3
add esp, 4
test ecx, eax
jno 0x5c8725
jo 0x5c871c
jge 0x5c871e
mov esp, esp
jns 0x5c8722
jo 0x5c8725
mov edx, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5c9616
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x5ba178], 1
je 0x5c9646
add edi, 0
mov ebx, ebx
jno 0x5c963c
pushf
jg 0x5c9633
popf
jno 0x5c9637
jo 0x5c9639
jo 0x5c963c
mov edi, 0x5ba178a1
add byte [ecx + 0x16ebfc45], cl
mov eax, dword [0x5ba178]
mov dword [ebp - 4], eax
jmp 0x5c965c
test ecx, ebx
rol esp, 0
jo 0x5c9655
lea eax, [eax]
jbe 0x5c9651
jno 0x5c9655
sub eax, 0xe9c03341
fild word [ecx]
add byte [eax], al
xor eax, eax
jmp 0x5c983b
xor edi, dword [esp]
xor edi, dword [esp]
rol ecx, 9
ror ecx, 9
jno 0x5c9675
jle 0x5c966c
jb 0x5c966e
jns 0x5c9670
jnp 0x5c9672
jo 0x5c9675
mov eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.005c0cb3
add esp, 4
push 0xd
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005da12d
add esp, 0xc
cmp edx, ecx
ror edi, 0xd
ror edi, 0x13
inc ebx
dec ebx
jo 0x5c96a7
jmp 0x5c969f
xchg ecx, ecx
jmp 0x5c96a3
jno 0x5c96a7
add eax, 0xe845c64d
dec ebp
mov byte [ebp - 0x18], 0x4d
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x7a
mov byte [ebp - 0x17], 0x70
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x16], 0x62
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x10], 0x62
mov byte [ebp - 0x14], 0x4d
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 0xc], 0
mov edx, edx
inc edx
dec edx
jne 0x5c96fa
pushf
jp 0x5c96e5
cmp edx, esi
xor ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0xc]
xchg esi, esi
popf
jmp 0x5c96f5
jp 0x5c96f7
je 0x5c96fa
mov esp, 0x2ce8458a
add dword [eax + 0x4d8ae845], ecx
in eax, dx
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
je 0x5c9764
xor ebx, dword [esp]
xor ebx, dword [esp]
ja 0x5c9791
pushf
jns 0x5c9770
neg eax
neg eax
call fcn.005c9779
Function at 0x5cbdd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005da12d
add esp, 0xc
sub esi, 0
ror edx, 0x12
rol edx, 0x12
xchg esp, esp
jne 0x5cbe0a
pushf
xchg esp, esp
popf
jb 0x5cbe05
mov esp, esp
je 0x5cbe0a
xor eax, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.005d5752
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5cbed2
xor eax, eax
jmp 0x5cbf43
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cc224
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x5cbefc
xor eax, eax
jmp 0x5cbf43
rol edx, 0
jnp 0x5cbf01
mov ebx, ebx
je 0x5cbf17
pushf
jp 0x5cbf09
xor esp, 0
jae 0x5cbf0e
popf
jle 0x5cbf12
xchg ecx, ecx
jne 0x5cbf17
or dword [ebx - 0x17af17bb], 0xffff4d93
mov eax, dword [ebp - 0x18]
push eax
call fcn.005c0cb3
add esp, 4
call fcn.005cbf28
Function at 0x5d030a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x5d031e
jmp 0x5d04da
lea ecx, [ecx + 0x6db9]
lea ecx, [ecx - 0x6db9]
xchg ecx, eax
xchg ecx, eax
jnp 0x5d0336
jp 0x5d0330
ja 0x5d0332
jp 0x5d0336
mov ebp, 0x8458bab
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x5ba17c], edx
cld
jb 0x5d034a
and esp, 0xffffffff
shl esp, 0
jnp 0x5d0359
jae 0x5d0354
mov ebx, ebx
jp 0x5d0359
lcall 0x448, 0x8bec458b
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x5ba9ac], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x5ba9a8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x5ba7b8], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x5ba7bc], ecx
xor edx, dword [esp + 8]
xor edx, dword [esp + 8]
jae 0x5d03b7
pushf
xor edx, 0x6697
xor edx, 0x6697
popf
xchg esi, edi
xchg esi, edi
xchg esp, esp
lea edx, [edx + 0x45e6]
lea edx, [edx - 0x45e6]
jb 0x5d03b7
call 0x4e4d4981
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
xchg ecx, ecx
jb 0x5d03ef
jmp 0x5d03f1
shr esp, 0
js 0x5d0408
jg 0x5d03f8
lea edx, [edx + 0x1b23]
lea edx, [edx - 0x1b23]
jns 0x5d0408
jmp 0xf0b28eb5
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jo 0x5d0472
or edx, edx
xchg ebx, ebx
call fcn.005d047b
Function at 0x5d1dee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005da12d
add esp, 0xc
test esp, 0x7523
rol esp, 0
add esp, 0
je 0x5d1e1d
xchg esp, esp
jg 0x5d1e19
jne 0x5d1e1d
mov esp, 0xe845c62f
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
cld
or ecx, ecx
or esi, 0
ja 0x5d1e59
jne 0x5d1e77
pushf
nop
test esp, 0xd0b
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
popf
lea edx, [edx]
jae 0x5d1e72
mov edx, edx
je 0x5d1e77
add eax, 0x80e84d8a
jmp 0xe8aaa681
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
nop
test esi, 0x783d
jae 0x5d1f06
pushf
clc
test esp, 0x958
xor edx, 0x730
xor edx, 0x730
popf
jle 0x5d1f01
jge 0x5d1f03
jb 0x5d1f06
sub eax, 0x3847e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.005d5752
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5d1f1b
xor eax, eax
jmp 0x5d1fdd
cmp ebx, dword [esp + 0x10]
and esp, 0xffffffff
jns 0x5d1f2d
jo 0x5d1f26
jg 0x5d1f28
jbe 0x5d1f2a
js 0x5d1f2d
add eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005cc224
mov dword [ebp - 4], eax
add ebx, 0
shr edx, 0
and edi, edi
jns 0x5d1f62
pushf
jle 0x5d1f4b
lea esi, [esi + 0x4c4]
lea esi, [esi - 0x4c4]
xchg edx, ecx
xchg edx, ecx
popf
jns 0x5d1f5f
js 0x5d1f62
mov ebx, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5d1f7c
xor eax, eax
jmp 0x5d1fdd
add edi, 0x5d19
sub edi, 0x5d19
add ecx, 0x538a
sub ecx, 0x538a
jno 0x5d1fa8
pushf
or edx, 0
cmp edx, 0x7328
popf
jbe 0x5d1fa5
jo 0x5d1fa8
xor eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.005c0cb3
add esp, 4
push ebx
add ebx, 0x697a
ror ebx, 0x1b
pop ebx
xchg edx, ebx
xchg edx, ebx
ror edx, 6
ror edx, 0x1a
jp 0x5d1fcb
je 0x5d1fda
xchg edx, esi
xchg edx, esi
jo 0x5d1fd3
lea esi, [esi]
jg 0x5d1fd7
jne 0x5d1fda
mov esp, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d1fe4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005da12d
add esp, 0xc
mov eax, eax
jns 0x5d2001
jae 0x5d2010
jbe 0x5d2005
lea edi, [edi]
jne 0x5d2009
xchg edi, ebx
xchg edi, ebx
jb 0x5d2010
sub eax, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
mov eax, eax
xchg ebx, eax
xchg ebx, eax
je 0x5d205c
xchg edi, edi
jne 0x5d205c
mov ecx, 0xec4d8a64
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.005e8272
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5d20f0
xor eax, eax
jmp 0x5d2153
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005cc224
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x5d2151
or esi, 0
jl 0x5d2122
jmp 0x5d211d
lea ecx, [ecx]
jge 0x5d2122
jmp 0x52456eb1
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.005c0cb3
add esp, 4
nop
call fcn.005d2134
xor eax, eax
Function at 0x5d8312
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x5ba8b0
call fcn.005d04e3
add esp, 0xc
mov byte [0x5ba8b0], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x5d85d3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005da12d
add esp, 0xc
xor esp, 0
ror esp, 0
test edx, ebx
jnp 0x5d85fc
jb 0x5d85f8
jp 0x5d85fc
mov esi, 0xe845c65e
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
nop
shl esp, 0
nop
xor ebx, esi
xor ebx, esi
jno 0x5d8658
xchg esp, esp
jo 0x5d8653
jge 0x5d8655
jo 0x5d8658
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.005d5752
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5d8701
xor eax, eax
jmp 0x5d87ab
xor ebx, 0
ja 0x5d8724
pushf
jge 0x5d870a
or esp, 0
jae 0x5d870f
popf
lea ecx, [ecx + 0x6ade]
lea ecx, [ecx - 0x6ade]
mov esp, esp
jns 0x5d8721
jbe 0x5d8724
xor eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cc224
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005da12d
add esp, 0xc
ror ebx, 3
rol ebx, 3
shl esp, 0
lea esp, [esp]
js 0x5d875a
mov ebx, ebx
jge 0x5d8756
jns 0x5d875a
mov ebx, 0xe47d832a
add byte [ebp + 4], dh
cmp dword [ebp - 0x1c], 0
jne 0x5d8764
xor eax, eax
jmp 0x5d87ab
js 0x5d8766
rol edi, 0
jb 0x5d8771
jbe 0x5d876d
jae 0x5d8771
mov eax, 0xe4458bef
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005c0cb3
add esp, 4
xchg ecx, eax
xchg ecx, eax
jns 0x5d8781
test ebx, 0x3e96
jl 0x5d87a8
pushf
not edi
not edi
lea esi, [esi + 0x24b6]
sub esi, 0x24b6
test edx, ecx
popf
mov esp, esp
jle 0x5d87a3
lea eax, [eax]
jge 0x5d87a8
ljmp 0x5b5e:0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ddd36
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005da12d
add esp, 0xc
or edx, 0
jp 0x5ddd54
ror edi, 0
jno 0x5ddd64
mov ebx, ebx
mov esp, esp
jno 0x5ddd5f
ja 0x5ddd61
jo 0x5ddd64
add esi, 0xc67aec45
inc ebp
call 0xe9a3a3b7
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
jl 0x5ddd9e
shr esp, 0
je 0x5dddbd
pushf
ror edi, 1
rol edi, 1
test dword [esp + 4], edx
jnp 0x5dddaf
rol esp, 0
popf
jle 0x5dddb6
je 0x5dddb8
jne 0x5dddba
jne 0x5dddbd
ljmp 0x1e9:0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
cmc
jle 0x5dde50
xchg esp, esp
jne 0x5dde3d
lea ebx, [ebx + 0x155e]
lea ebx, [ebx - 0x155e]
xchg esp, esp
jg 0x5dde50
xor eax, 0xfde845af
js 0x5dde53
call fcn.005d5752
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5dde63
invalid
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 5], dh
jmp 0x5ddef6
neg eax
neg eax
jae 0x5dde7b
pushf
cld
cmc
add esi, 0
popf
lea eax, [eax]
ja 0x5dde76
jno 0x5dde78
jb 0x5dde7b
mov ebp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005cc224
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.005da12d
add esp, 0xc
cmc
jl 0x5ddeaf
pushf
xchg esi, ecx
xchg esi, ecx
cmp edi, dword [esp + 0xc]
popf
lea edx, [edx]
jge 0x5ddeaf
mov ecx, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x5ddeb7
jmp 0x5ddef6
jno 0x5ddeb9
cmp esp, 0x4d86
call 0x5ddec4
add esp, 4
jne 0x5ddece
jl 0x5ddecb
je 0x5ddece
mov edx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.005c0cb3
add esp, 4
nop
shl edi, 0
push eax
pop eax
dec edx
inc edx
jne 0x5ddeef
pushf
xchg ebx, eax
xchg ebx, eax
popf
js 0x5ddeec
je 0x5ddeef
mov esi, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4