joyce8/EMBER2024-capa huggingface dataset:
Function at 0x829a30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x423000]
push edi
jmp 0x829a4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x829a51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x829a40
mov eax, 1
add ebx, ebx
jne 0x829a63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x829a74
jne 0x829a93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x829a93
dec eax
add ebx, ebx
jne 0x829a80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x829a58
add ebx, ebx
jne 0x829a8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x829ae5
xor ecx, ecx
sub eax, 3
jb 0x829aab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x829b1a
sar eax, 1
mov ebp, eax
jmp 0x829ab6
add ebx, ebx
jne 0x829ab6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x829a84
inc ecx
add ebx, ebx
jne 0x829ac4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x829a84
add ebx, ebx
jne 0x829ad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x829ac6
jne 0x829ae2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x829ac6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x829b04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x829af6
jmp 0x829a46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x829b04
add edi, ecx
jmp 0x829a46
pop esi
mov edi, esi
mov ecx, 0x2ef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x829b22
cmp byte [edi], 7
jne 0x829b22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x829b27
lea edi, [esi + 0x427000]
mov eax, dword [edi]
or eax, eax
je 0x829b9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4378b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x437968]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x829b54
mov ecx, edi
jns 0x829b83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x43796c]
or eax, eax
je 0x829b99
mov dword [ebx], eax
add ebx, 4
jmp 0x829b71
call dword [esi + 0x43797c]
mov ebp, dword [esi + 0x437970]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x829bd3
sub esp, 0xffffff80
jmp 0x403d8c
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x403e59
pop dword [ebp - 0x44]
mov eax, 0x5fec3c45
sub eax, 0x5fabfdec
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xe486f7c4
sub dword [ebp - 0x54], 0x9634b279
mov dword [ebp - 0x50], 0x62f32f4
add dword [ebp - 0x50], 0x2c041951
mov dword [ebp - 0x4c], 0xc1c5f4c1
add dword [ebp - 0x4c], 0x8a864f6d
mov dword [ebp - 0x48], 0x691c0c2e
sub dword [ebp - 0x48], 0x691c0c2e
lea eax, [ebp - 0x54]
push eax
mov eax, 0xe3a16718
add eax, 0x1c9f1974
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x5a5f57f8
add dword [ebp - 0x54], 0x1a13115e
mov dword [ebp - 0x50], 0xd9fd3f3a
sub dword [ebp - 0x50], 0x9890ddc5
mov dword [ebp - 0x4c], 0x2a6e83a9
add dword [ebp - 0x4c], 0x3900e8c3
mov dword [ebp - 0x48], 0xb7c556de
sub dword [ebp - 0x48], 0xb7c556de
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x87015f0a
sub eax, 0x86c0de36
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3bb3d
push 0
call eax
mov ecx, 0xe6c3a20e
add ecx, 0x193cb9c4
xor ebx, ebx
add ebx, eax
mov edi, 0xe13cdfd3
sub edi, 0xe0fbcfd3
add edi, dword [ebp - 0x44]
mov edx, 0xcd33a396
xor dword [ebp - 0x34], 0xe83ffdad
mov esi, dword [edi]
sub dword [ebp - 0x2c], 0x5e7b00bd
sub esi, edx
sub dword [ebp - 0x3c], ecx
mov dword [ebx], esi
xor dword [ebp - 0x2c], 0xe9b13bbf
add ebx, 0xd0852547
sub ebx, 0xd0852543
add edi, 0xabb8f241
add edi, 0x54470dc3
loop 0x403f77
add eax, 0x3059ede4
sub eax, 0x30588bc9
xor ebx, ebx
add ebx, eax
add eax, 0xf833ceb5
add eax, 0x7cc3150
mov ecx, 0x1ff146e7
add ecx, 0xe04eb919
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x205e91b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.20603ead
add esp, 0xc
add edi, dword [esp]
sub edi, dword [esp]
add esi, 0x7e56
sub esi, 0x7e56
push esi
pop esi
rol edx, 0x17
rol edx, 9
jne 0x205e91f4
jle 0x205e91ee
mov esp, esp
je 0x205e91f4
mov edx, 0xec45c6bc
push ebx
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
call fcn.205e9235
Function at 0x205eaa17
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x205eaa2b
jmp 0x205eabcb
xchg edi, ebx
xchg edi, ebx
mov edi, edi
je 0x205eaa57
pushf
lea eax, [eax + 0x313]
sub eax, 0x313
jmp 0x205eaa42
xor esi, dword [esp + 0x10]
xor esi, dword [esp + 0x10]
lea edi, [edi]
popf
ja 0x205eaa50
lea esi, [esi]
jge 0x205eaa54
jne 0x205eaa57
or dword [ebx + 0x45890845], 0xec4d8bec
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x205e3c84], edx
ror edx, 0x12
ror edx, 0xe
js 0x205eaa7a
pushf
js 0x205eaa74
popf
nop
jns 0x205eaa7a
sub eax, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x205e5194
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x205e5194], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x205e5190], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x205e5038], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x205e503c], ecx
or esp, 0
jge 0x205eaab8
jge 0x205eaab0
ja 0x205eaab2
xchg edi, edi
jl 0x205eaab8
xor eax, 0xf045c65e
dec ebp
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
lea ecx, [ecx + 0x270b]
sub ecx, 0x270b
add esp, 0
jbe 0x205eab08
pushf
jnp 0x205eab01
popf
jle 0x205eab05
ja 0x205eab08
mov edi, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
lea esi, [esi + 0x63b4]
sub esi, 0x63b4
nop
jp 0x205eab87
xchg esp, esp
nop
mov ecx, ecx
jnp 0x205eab87
mov ebp, 0x51903d83
pop esi
and byte [eax], al
cmp dword [0x205e5190], 0
je 0x205eaba4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x205e5190]
push eax
call fcn.205f03e1
mov dword [0x205e3c80], eax
push eax
add eax, 0x7e13
ror eax, 0x1b
pop eax
test eax, ecx
jp 0x205eabb2
je 0x205eabb4
jp 0x205eabbb
mov ecx, ecx
jnp 0x205eabbb
mov edi, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.20603ead
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x205ec37a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.20603ead
add esp, 0xc
lea esp, [esp]
jae 0x205ec3a2
jge 0x205ec39a
jb 0x205ec39c
jnp 0x205ec39e
jb 0x205ec3a2
mov esp, 0xec45c63f
dec eax
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
xchg edi, edi
rol edx, 0
ja 0x205ec3e9
ja 0x205ec401
pushf
add esp, 0
jg 0x205ec3f2
mov esp, esp
mov esp, esp
popf
xchg esp, esp
jo 0x205ec3fc
jmp 0x205ec3fe
jbe 0x205ec401
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.2060e6f9
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x205ec498
xor eax, eax
jmp 0x205ec56c
not esi
not esi
jns 0x205ec4b5
pushf
ror ecx, 0
xor esi, dword [esp]
xor esi, dword [esp]
lea esp, [esp]
popf
jle 0x205ec4b0
jne 0x205ec4b2
js 0x205ec4b5
mov ebx, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.205f03e1
mov dword [ebp - 0x18], eax
xor ecx, 0
nop
dec edi
inc edi
jg 0x205ec4e5
pushf
jle 0x205ec4d1
call fcn.205ec4d6
Function at 0x205ee752
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20603ead
add esp, 0xc
add esp, 0
js 0x205ee775
jbe 0x205ee772
jns 0x205ee775
mov ebp, 0x50e845c6
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0
sub esp, 0
jne 0x205ee7bb
jb 0x205ee7b8
je 0x205ee7bb
sub eax, 0x80e84d8a
jmp 0x8ac6fc5
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
jne 0x205ee837
inc ecx
dec ecx
call fcn.205ee83e
Function at 0x205efc55
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.20603ead
add esp, 0xc
stc
jp 0x205efc80
pushf
jne 0x205efc75
jle 0x205efc77
xchg ecx, eax
xchg ecx, eax
popf
jg 0x205efc7d
jnp 0x205efc80
sub eax, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
xor edi, 0x786
xor edi, 0x786
jo 0x205efcba
nop
jno 0x205efcba
or dword [edx - 0x167f0fb3], 0xf04d8801
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.20607308
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x205efd1a
xor eax, eax
jmp 0x205efd7f
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.205f03e1
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.20603ead
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x205efd7d
cmp ecx, edi
jno 0x205efd4a
lea ecx, [ecx]
jo 0x205efd4a
xor eax, 0xec4d8bcd
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.205ebbe9
add esp, 4
xchg edx, edx
jnp 0x205efd70
jmp 0x205efd5c
je 0x205efd5e
xchg esp, esp
lea ebx, [ebx + 0x473f]
lea ebx, [ebx - 0x473f]
jp 0x205efd70
jmp 0x2cb488e4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x205efd7f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x205f27fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.20603ead
add esp, 0xc
rol esp, 0
push edx
add edx, 0x18f3
ror edx, 0x1e
pop edx
shl esp, 0
jbe 0x205f2835
lea ebx, [ebx]
js 0x205f282e
nop
jne 0x205f2831
ja 0x205f2835
sub eax, 0xec45c6ab
push eax
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
add esp, 0
jo 0x205f287d
lea edi, [edi + 0x5ce]
lea edi, [edi - 0x5ce]
lea edi, [edi]
jno 0x205f287d
mov edx, 0x4d8a5ceb
in al, dx
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.2060e6f9
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x205f28ef
xor eax, eax
jmp 0x205f2969
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.205f03e1
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.20603ead
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x205f2967
test edx, 0x5083
xor ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x10]
sub ecx, 0
xchg edi, ecx
xchg edi, ecx
jne 0x205f2930
nop
je 0x205f2930
ljmp 0xb0e8:0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.205ebbe9
add esp, 4
jb 0x205f293e
cmp ecx, dword [esp]
je 0x205f2956
pushf
cmp esi, 0x7bfb
popf
lea edi, [edi]
jae 0x205f2951
xchg esp, esp
jne 0x205f2956
mov ecx, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x205f2969
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x205f55d1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20603ead
add esp, 0xc
xchg ecx, ecx
or edi, 0
cmc
shl esi, 0
jp 0x205f55fc
lea ebx, [ebx]
jbe 0x205f55f9
jnp 0x205f55fc
mov ebp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
jge 0x205f563a
xchg ebx, ecx
xchg ebx, ecx
xor esi, 0
jge 0x205f564e
xchg ebx, ebx
jae 0x205f5647
mov esp, esp
xchg ebx, ebx
jl 0x205f564e
mov ebx, 0x80e84d8a
jmp 0x8acde58
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.20607308
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x205f56da
xor eax, eax
jmp 0x205f5749
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.205f03e1
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.20603ead
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x205f5747
jne 0x205f5702
rol esp, 0
sub esi, 0
jp 0x205f5718
pushf
nop
popf
xchg edx, edx
mov esp, esp
mov edx, edx
jnp 0x205f5718
mov edi, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.205ebbe9
add esp, 4
xor edx, dword [esp]
xor edx, dword [esp]
shr esp, 0
jns 0x205f573a
pushf
jb 0x205f5733
popf
je 0x205f5737
js 0x205f573a
mov esi, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x205f5749
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x205fad03
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x205e5184], 1
jne 0x205fae7b
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20603ead
add esp, 0xc
lea edi, [edi + 0x7a46]
lea edi, [edi - 0x7a46]
lea ecx, [ecx + 0x1ec6]
lea ecx, [ecx - 0x1ec6]
jg 0x205fad48
xchg ecx, ecx
jle 0x205fad48
add esi, 0xc648e845
inc ebp
in eax, dx
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
rol edi, 0x15
ror edi, 0x15
and ecx, 0xffffffff
push esi
add esi, 0x45dc
ror esi, 0x13
pop esi
jl 0x205fad99
pushf
jle 0x205fad92
popf
xchg esi, eax
xchg esi, eax
jge 0x205fad99
add eax, 0x80e84d8a
jmp 0x8ad35a3
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.2060e6f9
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x205fae0e
xor eax, eax
jmp 0x205faecf
push edx
add edx, 0x49f6
ror edx, 0xa
pop edx
shr esp, 0
test dword [esp], ebx
jno 0x205fae21
jl 0x205fae3d
pushf
ror eax, 0
push ecx
add ecx, 0x7d86
ror ecx, 0x13
pop ecx
clc
popf
jo 0x205fae38
jne 0x205fae3a
jge 0x205fae3d
mov esp, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.205f03e1
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.20603ead
add esp, 0xc
nop
je 0x205fae65
jne 0x205fae62
jne 0x205fae65
mov edx, 0xf87d83
cmp dword [ebp - 8], 0
je 0x205fae75
mov eax, dword [ebp - 8]
mov dword [0x205e5184], eax
jmp 0x205fae79
xor eax, eax
jmp 0x205faecf
jmp 0x205fae84
mov ecx, dword [0x205e5184]
mov dword [ebp - 8], ecx
cmp ecx, edx
jne 0x205fae91
xchg esp, esp
jne 0x205fae8c
mov esp, esp
je 0x205fae91
sub eax, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
inc eax
dec eax
jb 0x205faeb8
pushf
rol edi, 0x19
rol edi, 7
mov eax, eax
cmp ecx, ebx
cmp esp, 0x480f
popf
xchg edi, edi
jo 0x205faeb3
jp 0x205faeb5
jae 0x205faeb8
mov esi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.205ebbe9
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x20604288
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20603ead
add esp, 0xc
push edi
add edi, 0x1fa3
ror edi, 0xd
pop edi
not ebx
not ebx
shr esi, 0
jae 0x206042b5
ja 0x206042c4
pushf
test ebx, edi
popf
jl 0x206042bf
jmp 0x206042c1
jbe 0x206042c4
mov ecx, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
call fcn.20604301