joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c40f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.005c468d
add esp, 0xc
lea eax, [eax + 0x27b7]
sub eax, 0x27b7
jge 0x5c4129
jl 0x5c4121
mov edi, edi
jmp 0x5c4125
jl 0x5c4129
xor eax, 0xe045c689
dec eax
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
xor edx, 0x1d71
xor edx, 0x1d71
jns 0x5c41a2
pushf
xor esp, 0
lea esp, [esp]
sub esp, 0
stc
popf
mov esp, esp
lea edx, [edx + 0x7b29]
lea edx, [edx - 0x7b29]
js 0x5c41a2
mov edx, 0x80e04d8a
jmp 0xe0a9c9ac
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
jno 0x5c4240
jl 0x5c4254
pushf
xchg esi, edi
xchg esi, edi
popf
jle 0x5c424c
xchg ecx, edi
xchg ecx, edi
nop
jge 0x5c4254
mov ebp, 0x3040e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.005c7299
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5c4269
xor eax, eax
jmp 0x5c4516
not ecx
not ecx
add edi, 0xd2f
sub edi, 0xd2f
ror ebx, 0
jae 0x5c4296
pushf
dec eax
inc eax
test dword [esp], edi
call fcn.005c428a
Function at 0x5c4542
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005c468d
add esp, 0xc
add esi, 0x55ee
sub esi, 0x55ee
sub ebx, 0
rol esp, 0
push edx
pop edx
jp 0x5c4581
xchg esp, esp
jno 0x5c457c
jo 0x5c457e
jnp 0x5c4581
mov ebx, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
test dword [esp], esi
shl esi, 0
jae 0x5c45ce
ja 0x5c45bb
jle 0x5c45bd
lea edi, [edi]
lea edi, [edi + 0x1b10]
lea edi, [edi - 0x1b10]
jb 0x5c45ce
mov ebx, 0x80f04d8a
jmp 0xf0a9cdd8
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jno 0x5c4630
jge 0x5c4640
pushf
lea esp, [esp]
jge 0x5c4639
popf
xchg edi, eax
xchg edi, eax
jl 0x5c4640
mov edx, 0x1b8ffe8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.005dff44
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5c4652
xor eax, eax
jmp 0x5c4686
jb 0x5c4654
je 0x5c4663
pushf
ja 0x5c465a
popf
jl 0x5c465e
jb 0x5c4660
jne 0x5c4663
mov ecx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005c4ee9
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.005c468d
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c4860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005c468d
add esp, 0xc
or edx, 0
cmc
shr esp, 0
jbe 0x5c488f
xchg esp, esp
ja 0x5c488f
xor eax, 0xec45c699
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.005c7299
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5c4957
xor eax, eax
jmp 0x5c49bf
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005c4ee9
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005c468d
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x5c4981
xor eax, eax
jmp 0x5c49bf
mov eax, eax
jnp 0x5c4996
pushf
xchg esp, esp
jl 0x5c498b
test ecx, ebx
popf
jo 0x5c4991
js 0x5c4993
jp 0x5c4996
jmp 0x51448f25
mov eax, dword [ebp - 0x18]
push eax
call fcn.005cd658
add esp, 4
xor edi, dword [esp + 0x10]
xor edi, dword [esp + 0x10]
js 0x5c49b4
nop
jle 0x5c49af
xchg ecx, ecx
jns 0x5c49b4
lcall 0x558b, 0x510c4d8b
or byte [edx - 1], dl
push ebp
call 0x8bb7a822
in eax, 0x5d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5c8ff6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005c468d
add esp, 0xc
xor ecx, 0x228d
Function at 0x5cd707
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.005c468d
add esp, 0xc
ror eax, 0xe
ror eax, 0x12
and ecx, ecx
lea edx, [edx + 0x3686]
lea edx, [edx - 0x3686]
jae 0x5cd752
pushf
lea ecx, [ecx + 0x3156]
sub ecx, 0x3156
jo 0x5cd746
popf
jne 0x5cd74a
lea esp, [esp]
xchg edi, edi
jb 0x5cd752
sub eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
jl 0x5cd784
jge 0x5cd79a
pushf
cmc
shl esp, 0
sub esp, 0
jae 0x5cd791
popf
jbe 0x5cd795
jg 0x5cd797
jl 0x5cd79a
mov edi, 0x80f44d8a
jmp 0xf4aa5fa4
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
jno 0x5cd7fc
xor edi, dword [esp]
xor edi, dword [esp]
xor edi, 0
cmp esp, 0x7c41
jge 0x5cd827
pushf
or esp, 0
std
cld
cmp esp, 0x48b4
xchg ebx, ebx
popf
jnp 0x5cd820
jmp 0x5cd822
ja 0x5cd824
jl 0x5cd827
mov ecx, 0xff2ef4e8
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call 0x5c0720
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5cd83f
mov eax, 1
jmp 0x5cd900
add esp, 0
shl esp, 0
jge 0x5cd847
test ecx, eax
jb 0x5cd85c
lea ebx, [ebx]
lea ecx, [ecx + 0x1766]
lea ecx, [ecx - 0x1766]
jae 0x5cd85c
mov ebp, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005c4ee9
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.005c468d
add esp, 0xc
jge 0x5cd87e
jmp 0x5cd880
ja 0x5cd898
je 0x5cd884
lea eax, [eax]
lea ecx, [ecx]
lea ecx, [ecx + 0x7b95]
lea ecx, [ecx - 0x7b95]
jbe 0x5cd898
sub dword [ecx], 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x5cd8a5
mov eax, 1
jmp 0x5cd900
ror ebx, 0
test ecx, esi
add ebx, dword [esp]
sub ebx, dword [esp]
rol esi, 0
jnp 0x5cd8c3
lea esp, [esp]
jo 0x5cd8ba
jle 0x5cd8bc
lea edx, [edx]
jp 0x5cd8c3
lcall 0x50ec, 0x458be6bc
mov eax, dword [ebp - 0x14]
push eax
call fcn.005cd658
add esp, 4
ror ecx, 0xe
rol ecx, 0xe
lea esp, [esp]
jnp 0x5cd8f9
pushf
ror esp, 0
jl 0x5cd8e1
rol edx, 9
rol edx, 0x17
add ecx, dword [esp]
sub ecx, dword [esp]
popf
lea esp, [esp]
xchg edx, ecx
xchg edx, ecx
jp 0x5cd8f9
jmp 0x51652688
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5d0f06
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005c468d
add esp, 0xc
push ebx
add ebx, 0x36a
ror ebx, 0x16
pop ebx
nop
jp 0x5d0f2d
jo 0x5d0f52
pushf
push ebx
add ebx, 0x1318
ror ebx, 7
pop ebx
call 0x5d0f41
lea esp, [esp + 4]
jl 0x5d0f47
popf
xchg ecx, ecx
jo 0x5d0f4d
jmp 0x5d0f4f
jno 0x5d0f52
mov esp, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
rol eax, 0
cmp esp, 0x4abe
je 0x5d0fa4
xchg ebx, edi
xchg ebx, edi
jne 0x5d0fa4
mov ecx, 0x80ec4d8a
jmp 0xecaa97ae
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.005dff44
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5d103b
xor eax, eax
jmp 0x5d10d4
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005c4ee9
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005c468d
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x5d10d2
jle 0x5d1063
jle 0x5d108f
pushf
xor edx, dword [esp + 8]
xor edx, dword [esp + 8]
call 0x5d1074
add esp, 4
lea eax, [eax + 0x39d4]
lea eax, [eax - 0x39d4]
ror esp, 0
popf
jo 0x5d108a
mov esp, esp
jg 0x5d108f
mov ebx, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.005cd658
add esp, 4
or esi, esi
lea eax, [eax + 0x13a3]
lea eax, [eax - 0x13a3]
je 0x5d10c9
pushf
jb 0x5d10af
neg esi
neg esi
cmp eax, 0x7c82
xor ebx, dword [esp]
xor ebx, dword [esp]
popf
jp 0x5d10c2
jns 0x5d10c4
jmp 0x5d10c6
jne 0x5d10c9
mov esi, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x5d10d4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5d1fa8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005c468d
add esp, 0xc
shr edi, 0
jp 0x5d1fcf
je 0x5d1fc8
jbe 0x5d1fca
jnp 0x5d1fcf
mov eax, 0x45c6c605
call 0xe9a2e61e
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
add esi, 0
add ecx, 0
jne 0x5d2027
pushf
jne 0x5d200f
ja 0x5d2011
lea esp, [esp]
popf
xchg ebx, eax
xchg ebx, eax
lea edx, [edx + 0x7e75]
lea edx, [edx - 0x7e75]
je 0x5d2027
or dword [edx - 0x167f17b3], 0xe84d8801
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov edx, edx
jae 0x5d2093
test dword [esp + 0xc], ebx
jb 0x5d20a5
lea eax, [eax]
xchg ebx, edx
xchg ebx, edx
lea esp, [esp]
jae 0x5d20a5
call 0xffaf1091
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.005c7299
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5d20ba
xor eax, eax
jmp 0x5d2169
js 0x5d20bc
lea edi, [edi + 0x76c]
sub edi, 0x76c
ror esp, 0
lea ecx, [ecx]
jns 0x5d20ec
pushf
lea ecx, [ecx + 0x10c9]
sub ecx, 0x10c9
xchg edi, eax
xchg edi, eax
jno 0x5d20e1
js 0x5d20e3
popf
mov edx, edx
mov edi, edi
js 0x5d20ec
mov edx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005c4ee9
mov dword [ebp - 4], eax
lea ecx, [ecx + 0x2791]
lea ecx, [ecx - 0x2791]
jnp 0x5d2115
jg 0x5d210c
je 0x5d210e
xchg esp, esp
jp 0x5d2115
jmp 0xdc73593
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005c468d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5d212f
xor eax, eax
jmp 0x5d2169
nop
neg ecx
neg ecx
or edx, 0
jle 0x5d2147
pushf
jbe 0x5d213d
ror edi, 0
popf
jg 0x5d2144
jg 0x5d2147
mov esp, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cd658
add esp, 4
xchg ecx, esi
xchg ecx, esi
lea eax, [eax]
jge 0x5d2166
jge 0x5d215d
lea ebx, [ebx]
lea esi, [esi]
jns 0x5d2163
jl 0x5d2166
jmp 0x60597769
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d2170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
in al, dx
sbb al, 0x53
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.005c468d
add esp, 0xc
nop
xor esp, 0
jo 0x5d218f
jo 0x5d21a5
pushf
jge 0x5d2195
ror ecx, 0x18
rol ecx, 0x18
clc
popf
jo 0x5d21a0
jno 0x5d21a2
jno 0x5d21a5
add esi, 0xc653e445
inc ebp
bnd jo 0x5d2174
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
inc ebp
out 0x65, eax
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
jb 0x5d21ef
add ecx, 0x322a
sub ecx, 0x322a
inc esi
dec esi
xor edi, ecx
xor edi, ecx
jnp 0x5d2208
mov edi, edi
jp 0x5d2208
mov eax, 0x80e44d8a
jmp 0xe4aaaa12
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.005c7299
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5d22b6
xor eax, eax
jmp 0x5d2332
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005c4ee9
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.005c468d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x5d2330
call fcn.005d22e1
xor eax, eax
Function at 0x5d5ffe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005c468d
add esp, 0xc
not ecx
not ecx
rol ecx, 5
rol ecx, 0x1b
xchg esp, esp
jp 0x5d6032
pushf
xchg esp, esp
jae 0x5d602b
popf
mov ecx, ecx
jnp 0x5d6032
sub eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
shr esp, 0
ja 0x5d6074
pushf
jp 0x5d606b
popf
jg 0x5d606f
je 0x5d6071
jbe 0x5d6074
mov esp, 0x80ec4d8a
jmp 0xecaae87e
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.005c7299
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5d60e9
xor eax, eax
jmp 0x5d616d
jo 0x5d60eb
jg 0x5d6108
pushf
or esp, 0
ror esp, 0
popf
lea ecx, [ecx + 0x4ae7]
lea ecx, [ecx - 0x4ae7]
nop
nop
jle 0x5d6108
mov ebx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005c4ee9
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005c468d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5d6132
xor eax, eax
jmp 0x5d616d
or esp, 0
jp 0x5d6149
xchg edi, edi
lea ecx, [ecx + 0x78a0]
lea ecx, [ecx - 0x78a0]
jnp 0x5d6149
sub eax, 0xfc458b8c
mov eax, dword [ebp - 4]
push eax
call fcn.005cd658
add esp, 4
jl 0x5d6157
jno 0x5d6166
jp 0x5d615b
jno 0x5d615d
lea esp, [esp]
ja 0x5d6162
jo 0x5d6166
mov edx, 0x84d8b76
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5dfad3
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x5b60bc
call fcn.005e1281
add esp, 0xc
mov byte [0x5b60bc], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret