joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20559005
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2055a104
add esp, 0xc
cmp esp, 0x1262
ja 0x20559039
pushf
sub esi, 0
or ecx, ecx
popf
jae 0x20559031
xchg edi, ebx
xchg edi, ebx
nop
jbe 0x20559039
mov edi, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
ror edx, 0x16
rol edx, 0x16
jae 0x2055907f
js 0x2055907b
jb 0x2055907f
sub eax, 0xe84d8a44
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.2055eb0a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20559105
xor eax, eax
jmp 0x2055919e
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.2055cb42
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x2055919c
and ecx, 0xffffffff
jno 0x20559130
push eax
add eax, 0x61ef
ror eax, 0x18
pop eax
ja 0x20559160
pushf
shl esp, 0
inc edi
dec edi
add eax, 0x44bf
sub eax, 0x44bf
popf
jl 0x20559151
lea ebx, [ebx + 0xa83]
lea ebx, [ebx - 0xa83]
jbe 0x20559160
xor eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.205599f9
add esp, 4
jne 0x2055916e
ror esp, 0
je 0x20559187
lea edx, [edx + 0x13f2]
lea edx, [edx - 0x13f2]
mov esi, esi
jge 0x20559183
jne 0x20559187
mov ecx, 0x14458b28
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x2055919e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x20559f3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x2054eb28], 1
jne 0x2055a078
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2055a104
add esp, 0xc
js 0x20559f65
lea ecx, [ecx + 0x34a3]
lea ecx, [ecx - 0x34a3]
and esi, 0xffffffff
ja 0x20559f7e
xchg edi, edi
xchg ebx, eax
xchg ebx, eax
jbe 0x20559f7e
lcall 0xc648, 0xe845c6fe
inc ebp
in eax, dx
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
mov esp, esp
jg 0x20559fc7
pushf
mov ebx, ebx
jmp 0x20559fb4
popf
lea ebx, [ebx + 0x16ca]
lea ebx, [ebx - 0x16ca]
jns 0x20559fc4
jle 0x20559fc7
mov esp, 0x80e84d8a
jmp 0x8a327d1
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.20572763
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x2055a034
mov eax, dword [ebp + 8]
jmp 0x2055a0fb
lea ecx, [ecx]
jg 0x2055a03d
je 0x2055a03a
jle 0x2055a03d
sub eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.2055cb42
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x2055a06e
mov edx, dword [ebp - 8]
mov dword [0x2054eb28], edx
jmp 0x2055a076
mov eax, dword [ebp + 8]
jmp 0x2055a0fb
jmp 0x2055a080
mov eax, dword [0x2054eb28]
mov dword [ebp - 8], eax
ja 0x2055a082
jl 0x2055a09b
pushf
xchg edi, esi
xchg edi, esi
rol ebx, 0
xor esp, 0
popf
jae 0x2055a094
jnp 0x2055a096
jo 0x2055a098
jge 0x2055a09b
mov ecx, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jbe 0x2055a0a3
test ecx, eax
jp 0x2055a0cc
pushf
call fcn.2055a0ae
Function at 0x2055b801
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2055a104
add esp, 0xc
jg 0x2055b823
ror eax, 0x15
ror eax, 0xb
je 0x2055b83e
mov edx, edx
lea edx, [edx + 0x2e16]
lea edx, [edx - 0x2e16]
xchg edx, edx
jne 0x2055b83e
mov ebp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
shl esp, 0
jg 0x2055b886
xchg edi, eax
xchg edi, eax
lea eax, [eax + 0x8f1]
lea eax, [eax - 0x8f1]
jle 0x2055b883
jle 0x2055b886
call 0xa1460614
jmp 0x10a34090
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jns 0x2055b8e8
jle 0x2055b8ea
jg 0x2055b8ec
xor ebx, 0x3671
xor ebx, 0x3671
js 0x2055b90c
pushf
jl 0x2055b8fe
stc
test eax, 0x4bfd
cmc
popf
jmp 0x2055b909
jns 0x2055b90c
add eax, 0x31f9e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.2055eb0a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2055b91e
xor eax, eax
jmp 0x2055b973
jne 0x2055b920
cmp ecx, dword [esp]
lea edi, [edi]
xor ecx, 0x7367
xor ecx, 0x7367
jae 0x2055b950
jns 0x2055b935
lea eax, [eax + 0x2787]
lea eax, [eax - 0x2787]
lea eax, [eax + 0x5e48]
lea eax, [eax - 0x5e48]
jb 0x2055b950
ljmp 0x4d8b:0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2055cb42
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2055a104
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x2055bd27
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x2054eb24], 1
jne 0x2055be83
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2055a104
add esp, 0xc
dec ebx
inc ebx
call fcn.2055bd54
mov ecx, dword [0x2054eb24]
mov dword [ebp - 8], ecx
Function at 0x2055c384
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2055a104
add esp, 0xc
nop
shr edx, 0
je 0x2055c3aa
xor eax, 0
jne 0x2055c3b5
mov eax, eax
je 0x2055c3b5
sub eax, 0xe845c6aa
push ecx
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
dec edx
inc edx
jl 0x2055c473
pushf
or ebx, ebx
popf
xchg edi, ebx
xchg edi, ebx
lea ecx, [ecx]
jle 0x2055c470
jge 0x2055c473
add eax, 0x162ebe8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.20572763
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2055c488
xor eax, eax
jmp 0x2055c512
mov edi, edi
jb 0x2055c48c
and esi, esi
jle 0x2055c4a1
pushf
xor esp, 0
clc
popf
lea edx, [edx]
jmp 0x2055c49c
lea edx, [edx]
jg 0x2055c4a1
jmp 0x733e1a32
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.2055cb42
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x2055c4cb
xor eax, eax
jmp 0x2055c512
xor ebx, dword [esp]
xor ebx, dword [esp]
call 0x2055c4d6
add esp, 4
jne 0x2055c4e4
jmp 0x2055c4dd
js 0x2055c4df
jb 0x2055c4e1
je 0x2055c4e4
jmp 0x73521a73
mov edx, dword [ebp - 4]
push edx
call fcn.205599f9
add esp, 4
xchg edx, edx
add edi, dword [esp]
sub edi, dword [esp]
jo 0x2055c507
jo 0x2055c4fc
jnp 0x2055c4fe
lea esp, [esp]
jge 0x2055c503
jno 0x2055c507
cmp dword [edx + 0x500c458b], 0x51084d8b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2055c9be
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2055a104
add esp, 0xc
jae 0x2055c9d9
jle 0x2055c9e9
pushf
and eax, 0xffffffff
popf
jne 0x2055c9e4
js 0x2055c9e6
jg 0x2055c9e9
mov esi, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
or edx, 0
lea eax, [eax]
js 0x2055ca41
pushf
shl edi, 0
sub esp, 0
js 0x2055ca36
jnp 0x2055ca38
popf
jno 0x2055ca3c
jae 0x2055ca3e
jns 0x2055ca41
mov ecx, 0x80ec4d8a
jmp 0xca3524b
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.20572763
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2055cacb
jmp 0x2055cb39
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2055cb42
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x2055cb39
test dword [esp + 8], ecx
cmp esp, 0x793
or esp, 0
je 0x2055cb0b
jns 0x2055cb02
mov edi, edi
xchg edi, esi
xchg edi, esi
jne 0x2055cb0b
mov ebp, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.205599f9
add esp, 4
mov edi, edi
and esi, esi
jge 0x2055cb1d
xchg ebx, ebx
jb 0x2055cb26
lea edi, [edi]
jae 0x2055cb26
jmp 0x716a18b5
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x205602c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2055a104
add esp, 0xc
shr ecx, 0
and ecx, ecx
call fcn.205602e4
Function at 0x20562e4c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2055a104
add esp, 0xc
neg ecx
neg ecx
jge 0x20562e6b
ror eax, 0
je 0x20562e82
jae 0x20562e72
lea ebx, [ebx + 0x5c98]
lea ebx, [ebx - 0x5c98]
jne 0x20562e82
call 0xc9bf578
jp 0x20562e4d
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0x99bf4d5
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
xor ecx, dword [esp + 4]
xor ecx, dword [esp + 4]
xchg ebx, edx
xchg ebx, edx
lea esi, [esi]
mov edi, edi
jns 0x20562ed1
mov esi, esi
js 0x20562ed1
mov edi, 0x80f44d8a
jmp 0x14a3b6db
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
test dword [esp + 8], edi
neg ecx
neg ecx
sub esi, 0
jbe 0x20562f5f
pushf
jl 0x20562f53
clc
popf
js 0x20562f58
lea edx, [edx]
jp 0x20562f5c
ja 0x20562f5f
sub eax, 0xf7ff
call fcn.20572763
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20562f72
jmp 0x20562ff6
rol edx, 0x10
ror edx, 0x10
jnp 0x20562f82
jne 0x20562f7c
mov ebx, ebx
jp 0x20562f82
mov ebx, 0xe8558d9f
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.2055cb42
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.2055a104
add esp, 0xc
lea esp, [esp]
rol esp, 0
jae 0x20562fb5
jno 0x20562fac
lea eax, [eax]
jno 0x20562fb0
nop
jb 0x20562fb5
mov ebx, 0xfc7d8338
add byte [ebp + 2], dh
cmp dword [ebp - 4], 0
jne 0x20562fbd
jmp 0x20562ff6
shr ecx, 0
jnp 0x20562fd6
jl 0x20562fc4
xchg esp, esp
lea edi, [edi + 0x72bb]
lea edi, [edi - 0x72bb]
jp 0x20562fd6
xor eax, 0xfc558be6
mov edx, dword [ebp - 4]
push edx
call fcn.205599f9
add esp, 4
ror eax, 0
jne 0x20562fef
jp 0x20562fe9
nop
je 0x20562fef
lcall 0x5008, 0x458b1d61
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x2056938f
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
or edi, edi
rol ebx, 0
jns 0x2056939d
je 0x205693aa
pushf
jge 0x205693a3
popf
jnp 0x205693a7
jne 0x205693aa
mov ebp, 0x3308458b
leave
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xc3
je 0x205693e5
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx]
cmp eax, 0xcb
je 0x205693e5
mov ecx, dword [ebp + 8]
xor edx, edx
mov dl, byte [ecx]
cmp edx, 0xc2
je 0x205693e5
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xca
jne 0x205693ef
mov eax, 1
jmp 0x2056956c
jae 0x205693f1
call fcn.205693f6
Function at 0x20570365
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2055a104
add esp, 0xc
xchg ecx, ecx
shl esp, 0
jno 0x20570385
add eax, dword [esp]
sub eax, dword [esp]
jae 0x205703a1
pushf
and esp, 0xffffffff
mov edx, edx
lea ecx, [ecx]
inc ebx
dec ebx
popf
lea eax, [eax]
je 0x2057039e
jb 0x205703a1
xor eax, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
ror eax, 0x13
ror eax, 0xd
ror ecx, 7
rol ecx, 7
jl 0x205703fb
jne 0x20570405
xchg ebx, ebx
je 0x20570401
je 0x20570405
jmp 0x8a48e44
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
cmp edx, 0xfc2
nop
test dword [esp + 0xc], eax
jne 0x205704b7
jb 0x205704b0
mov ebx, ebx
je 0x205704b7
ljmp 0xa1:0x36e84029
call fcn.2057a5f2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x205704cc
xor eax, eax
jmp 0x2057056c
xor ecx, dword [esp]
xor ecx, dword [esp]
push edi
add edi, 0xd2f
ror edi, 0x14
pop edi
call fcn.205704e2
Function at 0x20570eba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.2055a104
add esp, 0xc
and eax, 0xffffffff
cmp esi, dword [esp + 0x10]
cmp ebx, esi
jl 0x20570eee
pushf
test dword [esp], edx
popf
jp 0x20570ee7
je 0x20570ee9
lea eax, [eax]
jge 0x20570eee
mov ebx, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
and esp, 0xffffffff
jl 0x20570f3b
jns 0x20570f4a
pushf
je 0x20570f41
popf
ja 0x20570f45
jo 0x20570f47
js 0x20570f4a
lcall 0x1e9, 0x80e44d8a
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.20572763
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20570ff8
xor eax, eax
jmp 0x20571067
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.2055cb42
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x20571065
jge 0x20571020
push ebx
pop ebx
jne 0x2057102c
xchg edi, edx
xchg edi, edx
je 0x2057102c
call 0x1ca49bc5
mov ecx, dword [ebp - 4]
push ecx
call fcn.205599f9
add esp, 4
and eax, 0xffffffff
jb 0x2057103d
jb 0x2057104c
pushf
rol eax, 0
js 0x20571046
popf
nop
jae 0x2057104c
call 0x726f65db
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x20571067
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14