joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4420ec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46b200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0043c4f5
and dword [ebp - 0x14], 0
cmp dword [0x46f8b0], 0
mov dword [ebp - 0x18], eax
jne 0x44219f
push 0x4528bc
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x442247
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x4528b0
push ebx
call edi
test eax, eax
je 0x442247
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push 0x4528a0
push ebx
mov dword [0x46f8b0], eax
call edi
push eax
call esi
push 0x45288c
push ebx
mov dword [0x46f8b4], eax
call edi
push eax
call esi
push 0x452870
push ebx
mov dword [0x46f8b8], eax
call edi
push eax
call esi
mov dword [0x46f8c0], eax
test eax, eax
je 0x44219f
push 0x452858
push ebx
call edi
push eax
call esi
mov dword [0x46f8bc], eax
mov eax, dword [0x46f8bc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x4421f8
cmp dword [0x46f8c0], ecx
je 0x4421f8
push eax
call esi
push dword [0x46f8c0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4421f8
test ebx, ebx
je 0x4421f8
call edi
test eax, eax
je 0x4421ef
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4421ef
test byte [ebp - 8], 1
jne 0x4421f8
or dword [ebp + 0x10], 0x200000
jmp 0x44222b
mov eax, dword [0x46f8b4]
cmp eax, dword [ebp - 0x18]
je 0x44222b
push eax
call esi
test eax, eax
je 0x44222b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44222b
mov eax, dword [0x46f8b8]
cmp eax, dword [ebp - 0x18]
je 0x44222b
push eax
call esi
test eax, eax
je 0x44222b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46f8b0]
call esi
test eax, eax
je 0x442247
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x442249
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004350d6
leave
ret
Function at 0x5a38c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x5a38e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x5a38d0
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret

Function at 0x5a38f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x5a3912
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x5a3900
mov byte [esi + 6], 0
mov eax, esi
pop esi
ret
Function at 0x5a4320
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x5a4342
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x5a4330
mov byte [esi + 3], 0
mov eax, esi
pop esi
ret

Function at 0x5a4350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movaps xmm0, xmmword [0x205540]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x21], 0x434c5270
mov dword [ebp - 0x1d], 0x484a4d57
mov word [ebp - 0x19], 0x100
nop word [eax + eax]
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x18
jb 0x5a4380
mov byte [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0x7e756461
mov dword [ebp - 0x13], 0x7a713a7f
mov word [ebp - 0xf], 0x7b
mov byte [ebp - 0xd], 1
nop dword [eax + eax]
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x5a43b0
push ebx
push esi
push edi
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], 0
push eax
push eax
call fcn.007ef83b
lea ecx, [ebp - 0x31]
push ecx
push eax
call dword [0x1eb0d4]
mov ebx, eax
xor edi, edi
mov dword [ebp - 8], ebx
push edi
call fcn.007bb309
mov dword [ebp - 4], eax
test eax, eax
je 0x5a446b
mov esi, dword [0x21348c]
push esi
push edi
push eax
call fcn.00751407
ret
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]

Function at 0x5a44a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x5a44c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x5a44b0
mov byte [esi + 0xa], 0
mov eax, esi
pop esi
ret

Function at 0x5a4610
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x5a4632
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x5a4620
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret

Function at 0x5a4640
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x5a4662
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x5a4650
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret

Function at 0x5a4a70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x5a4a92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x5a4a80
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret

Function at 0x5a5780
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x5a57a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x5a5790
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret
Function at 0x5a57b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x5a57d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x5a57c0
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret

Function at 0x5a57e0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1e2556
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x100727d
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x5a5844
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push edi
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0067c250
mov edi, eax
add esp, 8
test edi, edi
je 0x5a58dd
push 2
push 0
push edi
call fcn.00680026
push edi
call fcn.0067bddb
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.00680026
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x5a58b1
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x5a58a8
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0x5a58c0
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00601cf0
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x5a58ca
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.00684acf
push edi
call fcn.0067fad8
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop edi
cmp ecx, 0x10
jb 0x5a590e
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5a5904
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5a591f
push ecx
push edx
call fcn.00676402
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0067b6a0
int3
Function at 0x5a5930
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1e25a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov dword [ebp - 0x14], ecx
push edi
mov dword [ebp - 0x18], 0
push 0x24
mov dword [ebp - 4], 1
call fcn.00676181
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 2
lea esi, [edi + 0xc]
xorps xmm0, xmm0
mov ecx, esi
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov dword [edi], 0x201618
push 0
movups xmmword [esi], xmm0
push 0x1ff4b8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0059cc10
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [ebp - 0x18], 3
xor ecx, ecx
mov dword [ebp - 0x10], 0x100727d
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x5a59d8
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0067c250
mov edi, eax
add esp, 8
test edi, edi
je 0x5a5a79
push 2
push 0
push edi
call fcn.00680026
push edi
call fcn.0067bddb
push 0
push 0
push edi
mov esi, eax
call fcn.00680026
mov eax, 0x1e8480
add esp, 0x1c
cmp esi, eax
cmova esi, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
cmp esi, dword [ecx + 0x10]
lea edx, [ecx + 0x10]
ja 0x5a5a4d
cmp dword [ecx + 0x14], 0x10
jb 0x5a5a45
mov ecx, dword [ecx]
mov dword [edx], esi
mov byte [ecx + esi], 0
jmp 0x5a5a5c
mov eax, esi
sub eax, dword [edx]
push 0
push eax
call fcn.00601cf0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [eax + 0x14], 0x10
jb 0x5a5a66
mov eax, dword [eax]
push edi
push esi
push 1
push eax
call fcn.00684acf
push edi
call fcn.0067fad8
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop edi
pop esi
cmp ecx, 0x10
jb 0x5a5aab
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5a5aa1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5a5abc
push ecx
push edx
call fcn.00676402
add esp, 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0067b6a0
int3
Function at 0x5a5ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], 0x100727d
xor ecx, ecx
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x5a5ae0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push esi
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0067c250
mov esi, eax
add esp, 8
test esi, esi
je 0x5a5b2b
push 2
push 0
push esi
call fcn.00680026
push esi
call fcn.0067bddb
push esi
mov edi, eax
call fcn.0067fad8
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop esi
cmp ecx, 0x10
jb 0x5a5b5c
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5a5b52
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5a5b63
push ecx
push edx
call fcn.00676402
add esp, 8
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
call fcn.0067b6a0
int3

Function at 0x5a5bb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0x1a], 0x557d645d
xor ecx, ecx
mov dword [ebp - 0x16], 0x73436076
mov dword [ebp - 0x12], 0x75706b65
mov word [ebp - 0xe], 0x75
mov byte [ebp - 0xc], 1
nop word [eax + eax]
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0xd
jb 0x5a5be0
mov byte [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xb], 0x7e756441
mov dword [ebp - 7], 0x7a713a7f
mov word [ebp - 3], 0x7b
mov byte [ebp - 1], 1
nop dword [eax + eax]
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x5a5c10
lea eax, [ebp - 0xb]
mov byte [ebp - 1], 0
push eax
call fcn.009bc167
pop esp
lea ecx, [ebp - 0x1a]
push ecx
push eax
call dword [0x1eb0d4]
test eax, eax
je 0x5a5c45
lea ecx, [ebp - 0xb8]
push ecx
call eax
jmp 0x5a5c52
lea eax, [ebp - 0xb8]
push eax
call dword [0x1eb0a8]
mov eax, dword [ebp - 0xb4]
cmp eax, 0xb
je 0x5a5c62
cmp eax, 0xa
jne 0x5a5c71
cmp dword [ebp - 0xb0], 0
je 0x5a5c8b
xor al, al
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x5a5c6b
mov eax, dword [ebp - 0xb0]
cmp eax, 3
je 0x5a5c8b
cmp eax, 2
sete al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x5a5d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x100727d
xor ecx, ecx
nop dword [eax]
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x5a5d50
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0067c250
add esp, 8
test eax, eax
je 0x5a5d8b
push eax
call fcn.0067fad8
add esp, 4
mov bl, 1
jmp 0x5a5d8d
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x5a5dbd
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5a5db3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5a5dc4
push ecx
push edx
call fcn.00676402
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0067b6a0
int3
Function at 0x5a7840
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x5a7862
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x5a7850
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret

Function at 0x5a8c50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x5a8c72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x5a8c60
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0x5a8cb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x5a8cd2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x5a8cc0
mov byte [esi + 9], 0
mov eax, esi
pop esi
ret

Function at 0x5a8ce0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x5a8d02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x5a8cf0
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret

Function at 0x5a8d10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x5a8d32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x5a8d20
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret

Function at 0x5a8d40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x5a8d62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x5a8d50
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret

Function at 0x5a8e00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x5a8e22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x5a8e10
mov byte [esi + 0x22], 0
mov eax, esi
pop esi
ret

Function at 0x5a8e30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x5a8e52
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x5a8e40
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret

Function at 0x5aa360
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x5aa382
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x5aa370
mov byte [esi + 7], 0
mov eax, esi
pop esi
ret
Function at 0x5ade70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x5ade92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x5ade80
mov byte [esi + 0x1d], 0
mov eax, esi
pop esi
ret
Function at 0x5aeab0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
push ebx
call fcn.009700e9
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5aec30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x10], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, dword [ebp - 8]
shr ebx, 0x1f
and bl, 1
mov dword [ebp - 0xe], 0x7c637564
mov dword [ebp - 0xa], 0x24267876
xor eax, eax
mov dword [ebp - 6], 0x76757c39
mov word [ebp - 2], 0x100
lea ecx, [eax + 0xf]
xor byte [ebp + eax - 0xe], cl
inc eax
cmp eax, 0xc
jb 0x5aec81
lea eax, [ebp - 0xe]
mov byte [ebp - 1], 0
push eax
call fcn.007c9a2f
popal
test eax, eax
movzx ecx, bl
mov eax, 1
pop edi
cmove ecx, eax
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5aef20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
xor bl, bl
call fcn.00798ad5
popfd
test eax, eax
jne 0x5aef42
push 0x15
call fcn.00884bae
mov eax, dword [ebp - 0x4cfd8b40]
add edi, eax
inc ebp
sti
dec esp
sub cl, byte [ebp]
mov bl, 1
mov dword [ebp - 5], 0x4d2a4c
xor ecx, ecx
mov byte [ebp - 1], 1
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 5], al
inc ecx
cmp ecx, 3
jb 0x5aef51
push 0x105
lea eax, [ebp - 0x120]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x105
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 5]
push eax
call fcn.0082ad3a
fild word [ebp + 0x28840fc0]
add dword [eax], eax
add bh, al
inc ebp
neg dword [ecx + 0x52]
jle 0x5af009
xor ecx, ecx
mov dword [ebp - 5], 0x636657
mov byte [ebp - 1], 1
nop dword [eax]
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 7
jb 0x5aefb0
mov byte [ebp - 1], 0
lea ecx, [ebp - 9]
lea eax, [ebp - 0x120]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5aeff0
test dl, dl
je 0x5aefec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5aeff0
add eax, 2
add ecx, 2
test dl, dl
jne 0x5aefd0
xor eax, eax
jmp 0x5aeff5
sbb eax, eax
or eax, 1
test eax, eax
je 0x5af0b9
mov dword [ebp - 8], 0x6a7e5259
xor ecx, ecx
mov dword [ebp - 4], 0x1005240
inc eax
push edx
add byte [ecx], al
nop dword [eax]
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 6
jb 0x5af010
mov byte [ebp - 1], 0
lea ecx, [ebp - 8]
lea eax, [ebp - 0x120]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5af050
test dl, dl
je 0x5af04c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5af050
add eax, 2
add ecx, 2
test dl, dl
jne 0x5af030
xor eax, eax
jmp 0x5af055
sbb eax, eax
or eax, 1
test eax, eax
je 0x5af0b9
mov dword [ebp - 0xb], 0x6a7e5259
xor ecx, ecx
mov dword [ebp - 7], 0x65706154
mov word [ebp - 3], 0x63
mov byte [ebp - 1], 1
lea eax, [ecx + 0xf]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x5af073
mov byte [ebp - 1], 0
lea ecx, [ebp - 0xb]
lea eax, [ebp - 0x120]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5af0b0
test dl, dl
je 0x5af0ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5af0b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x5af090
xor eax, eax
jmp 0x5af0b5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x5af0c0
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5afed0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x5afef2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0x2a
jb 0x5afee0
mov byte [esi + 0x2b], 0
mov eax, esi
pop esi
ret

Function at 0x5aff00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x5aff22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x5aff10
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
ret
Function at 0x5b0530
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1e3213
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x470
mov dword [ebp - 0x14], 0
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x2d], 0x73767543
mov dword [ebp - 0x29], 0x7a705c7f
mov dword [ebp - 0x25], 0x6b7d67
mov byte [ebp - 0x21], 1
mov al, cl
add al, 0xf
xor byte [ebp + ecx - 0x2d], al
inc ecx
cmp ecx, 0xb
jb 0x5b0586
lea ecx, [ebp - 0x2d]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b05a0
mov esi, 0x7fffffff
sub ecx, edx
mov edx, dword [0x212b2c]
mov eax, esi
sub eax, edx
cmp eax, ecx
jb 0x5b1fe7
cmp dword [0x212b30], 0x10
mov eax, 0x212b1c
push edx
cmovae eax, dword [0x212b1c]
push eax
push ecx
lea eax, [ebp - 0x2d]
push eax
push ecx
push dword [ebp - 0x1b]
lea ecx, [ebp - 0x1ec]
call fcn.00606cf0
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x2e], 0x60746040
mov dword [ebp - 0x2a], 0x787a5772
mov dword [ebp - 0x26], 0x6e7a7d79
mov word [ebp - 0x22], 0x100
nop dword [eax]
mov al, cl
add al, 0xf
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0xc
jb 0x5b0610
lea ecx, [ebp - 0x2e]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b0628
sub ecx, edx
mov eax, esi
mov edx, dword [0x212b2c]
sub eax, edx
cmp eax, ecx
jb 0x5b1fec
cmp dword [0x212b30], 0x10
mov eax, 0x212b1c
push edx
cmovae eax, dword [0x212b1c]
push eax
push ecx
lea eax, [ebp - 0x2e]
push eax
push ecx
push dword [ebp - 0x1b]
lea ecx, [ebp - 0x27c]
call fcn.00606cf0
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0x2b], 0x62445546
mov dword [ebp - 0x27], 0x73617577
mov word [ebp - 0x23], 0x65
mov byte [ebp - 0x21], 1
nop word [eax + eax]
mov al, cl
add al, 0xf
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 9
jb 0x5b0690
lea ecx, [ebp - 0x2b]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b06a8
sub ecx, edx
mov eax, esi
mov edx, dword [0x212b2c]
sub eax, edx
cmp eax, ecx
jb 0x5b1ff1
cmp dword [0x212b30], 0x10
mov eax, 0x212b1c
push edx
cmovae eax, dword [0x212b1c]
push eax
push ecx
lea eax, [ebp - 0x2b]
push eax
push ecx
push dword [ebp - 0x1b]
lea ecx, [ebp - 0x15c]
call fcn.00606cf0
push 0x200
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.006783e0
add esp, 0xc
lea eax, [ebp - 0x480]
push 0x200
push eax
push 0
call fcn.009acddb
mov ebx, 0xc7c0570f
test dword [esi + edi*8], edi
invalid
call fcn.0059c440
call fcn.0059c440
call fcn.0059c440
push eax
call fcn.006753ab
call fcn.0059c440
call fcn.0067b6a0
call fcn.0067b6a0
call fcn.0067b6a0
push eax
call fcn.006753ab
call fcn.0067b6a0
call fcn.0059c440
call fcn.0067b6a0
call fcn.0067b6a0
call fcn.0067b6a0
call fcn.0067b6a0
call fcn.0067b6a0
call fcn.0067b6a0
call fcn.0067b6a0
int3
Function at 0x5b78b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x5b78d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x5b78c0
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
ret
Function at 0x5bdc40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x5bdc62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xf]
inc eax
xor byte [edx], cl
cmp eax, 0x20
jb 0x5bdc50
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
ret