joyce8/EMBER2024-capa huggingface dataset:
Function at 0x612818
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00605802
add esp, 0xc
and ebx, ebx
xor edx, edi
xor edx, edi
sub edi, 0
jne 0x612845
jns 0x61283e
xchg esi, ebx
xchg esi, ebx
je 0x612845
mov ebx, 0x48e045c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
clc
jnp 0x6128af
pushf
xchg ecx, ecx
neg ecx
neg ecx
test ecx, 0x426f
xchg ecx, edi
xchg ecx, edi
popf
jmp 0x6128aa
je 0x6128ac
jp 0x6128af
mov edx, 0x80e04d8a
jmp 0xe0aeb0b9
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
nop
ja 0x61295d
pushf
cmp ecx, dword [esp]
popf
nop
jbe 0x612958
mov esp, esp
jbe 0x61295d
sub eax, 0xa3a1
call fcn.0061cd03
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x612972
xor eax, eax
jmp 0x612c1e
push ecx
add ecx, 0x6a2c
ror ecx, 0x1d
pop ecx
or ecx, 0
ror eax, 0x1d
rol eax, 0x1d
jbe 0x6129a7
pushf
inc esi
dec esi
xor eax, 0x73ff
xor eax, 0x73ff
test esp, 0x270f
jge 0x61299e
popf
xchg esi, esi
js 0x6129a4
ja 0x6129a7
call 0x52417738
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0060f961
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00605802
add esp, 0xc
nop
cmp ecx, 0x77ac
jne 0x6129e6
pushf
xor ebx, 0x624d
xor ebx, 0x624d
clc
popf
mov ecx, ecx
je 0x6129e6
add dword [ebx + 0x7500fc7d], 0xe9c03307
sub eax, dword [edx]
add byte [eax], al
cmp dword [ebp - 4], 0
jne 0x6129f3
xor eax, eax
jmp 0x612c1e
test esi, edx
jns 0x612a10
pushf
dec ecx
inc ecx
or eax, 0
call fcn.00612a03
Function at 0x613ef5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00605802
add esp, 0xc
cmp ecx, dword [esp]
jnp 0x613f13
jp 0x613f15
shr edx, 0
jbe 0x613f32
pushf
and esp, 0xffffffff
rol esi, 0xa
ror esi, 0xa
cld
xor esp, 0
popf
ja 0x613f2d
jnp 0x613f2f
ja 0x613f32
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
test dword [esp], edx
je 0x613f7f
jb 0x613f81
stc
jle 0x613f89
xchg ecx, eax
xchg ecx, eax
jg 0x613f89
mov eax, 0x80e84d8a
jmp 0xe8aec793
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.0061cd03
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x614032
xor eax, eax
jmp 0x6140f2
ror eax, 1
ror eax, 0x1f
test esi, 0x5f6a
lea ebx, [ebx + 0x6bad]
sub ebx, 0x6bad
ja 0x614060
mov esi, esi
jp 0x61404f
lea esi, [esi + 0x1419]
lea esi, [esi - 0x1419]
jbe 0x614060
mov edx, 0x458d43f4
call 0xfcaecbb7
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0060f961
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00605802
add esp, 0xc
or ecx, 0
xor ecx, 0x1231
xor ecx, 0x1231
ror esp, 0
add esi, dword [esp]
sub esi, dword [esp]
jle 0x6140a6
jo 0x61409c
xchg edi, ebx
xchg edi, ebx
jp 0x6140a2
jg 0x6140a6
mov eax, 0xe47d83cb
add byte [ebp + 4], dh
invalid
cmp dword [ebp - 0x1c], 0
jne 0x6140b0
invalid
xor eax, eax
jmp 0x6140f2
Function at 0x61b7e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push cs
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00605802
add esp, 0xc
rol edi, 0x1f
ror edi, 0x1f
ror eax, 7
rol eax, 7
dec edx
inc edx
push eax
add eax, 0x6f0c
ror eax, 0x17
pop eax
jae 0x61b826
xchg esi, esi
jmp 0x61b81e
je 0x61b820
jle 0x61b822
jb 0x61b826
add eax, 0xec45c6cf
jp 0x61b7f1
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0xe9a77e79
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
lea esp, [esp]
je 0x61b871
pushf
shr esp, 0
popf
jne 0x61b86c
jnp 0x61b86e
jne 0x61b871
xor eax, 0x80f44d8a
jmp 0xf4af407b
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
jg 0x61b8e4
jns 0x61b8fa
pushf
clc
ror ebx, 0xb
ror ebx, 0x15
popf
jbe 0x61b8f3
jns 0x61b8f5
xchg edx, eax
xchg edx, eax
js 0x61b8fa
mov esi, 0x1404e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.0061cd03
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x61b90d
jmp 0x61b9a6
rol ecx, 0x1d
rol ecx, 3
xor eax, ecx
xor eax, ecx
rol esp, 0
jne 0x61b927
pushf
test dword [esp], edi
popf
nop
je 0x61b927
mov ecx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0060f961
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00605802
add esp, 0xc
rol eax, 1
rol eax, 0x1f
je 0x61b95d
pushf
jp 0x61b952
popf
jle 0x61b956
jnp 0x61b958
jb 0x61b95a
jne 0x61b95d
mov esi, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x61b965
jmp 0x61b9a6
and edx, edx
and edx, edx
xchg esi, esi
jmp 0x61b96d
je 0x61b974
jp 0x61b971
jne 0x61b974
mov ebx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.006232a9
add esp, 4
test esp, 0x58a8
jge 0x61b99f
pushf
neg edx
neg edx
nop
test eax, 0x7fa1
popf
jnp 0x61b998
jmp 0x61b99a
mov eax, eax
jl 0x61b99f
add eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x61d133
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00605802
add esp, 0xc
rol esp, 0
xchg edx, eax
xchg edx, eax
jb 0x61d15f
jne 0x61d155
jno 0x61d157
mov ecx, ecx
jb 0x61d15b
jae 0x61d15f
sub eax, 0xec45c648
inc esp
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
push edi
pop edi
xor esp, 0
jno 0x61d1a7
pushf
jb 0x61d19a
jge 0x61d19c
popf
jge 0x61d1a0
jns 0x61d1a2
jle 0x61d1a4
jo 0x61d1a7
jmp 0x814e1f35
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0061cd03
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x61d21c
xor eax, eax
jmp 0x61d2b6
not edi
not edi
cmp esp, 0x4bb5
sub ebx, 0
je 0x61d22b
js 0x61d24a
pushf
cmp esp, 0x3abf
xor ebx, dword [esp + 0xc]
xor ebx, dword [esp + 0xc]
jns 0x61d23f
popf
jge 0x61d243
jo 0x61d245
jge 0x61d247
jns 0x61d24a
mov esi, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0060f961
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00605802
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x61d274
xor eax, eax
jmp 0x61d2b6
sub edi, 0
jo 0x61d282
mov esi, esi
jle 0x61d27d
jno 0x61d27f
jno 0x61d282
mov edi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.006232a9
add esp, 4
and ebx, ebx
je 0x61d292
stc
je 0x61d2af
pushf
rol esp, 0
popf
js 0x61d29e
lea ebx, [ebx + 0x5f76]
lea ebx, [ebx - 0x5f76]
lea ebx, [ebx]
jne 0x61d2af
mov esp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x61d2bf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00605802
add esp, 0xc
jle 0x61d2da
test dword [esp], edi
xchg esp, esp
test ecx, eax
jo 0x61d2f3
pushf
rol edx, 3
rol edx, 0x1d
cmc
popf
jo 0x61d2f0
jno 0x61d2f3
call 0x544618bd
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
xor ecx, 0x2de1
xor ecx, 0x2de1
shr esp, 0
jb 0x61d34c
jno 0x61d34e
jns 0x61d358
lea esp, [esp]
ja 0x61d355
js 0x61d358
mov edx, 0x80e44d8a
jmp 0xe4af5b62
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0061cd03
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x61d409
xor eax, eax
jmp 0x61d499
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0060f961
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00605802
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x61d497
clc
nop
jnp 0x61d451
pushf
cmp esi, 0xdec
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
shl ecx, 0
popf
xchg esi, edi
xchg esi, edi
jne 0x61d44e
jp 0x61d451
ljmp 0x4fe8:0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.006232a9
add esp, 4
lea edx, [edx + 0x683a]
sub edx, 0x683a
mov esp, esp
jg 0x61d46d
jnp 0x61d46f
jns 0x61d47e
jle 0x61d473
jo 0x61d475
lea esp, [esp]
jmp 0x61d47a
js 0x61d47e
mov edx, 0x18558bb9
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x61d499
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x61d4a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00605802
add esp, 0xc
lea eax, [eax + 0x3f1d]
lea eax, [eax - 0x3f1d]
cmp ecx, dword [esp + 4]
je 0x61d4de
pushf
sub esp, 0
stc
popf
xchg esp, esp
lea eax, [eax]
jle 0x61d4db
jne 0x61d4de
mov edi, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
call 0x61d513
add esp, 4
jle 0x61d518
cmp esi, dword [esp]
jns 0x61d52f
pushf
js 0x61d521
jp 0x61d523
and esp, 0xffffffff
popf
jno 0x61d52a
lea eax, [eax]
js 0x61d52f
lcall 0x1e9, 0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
xor ecx, 0x1398
xor ecx, 0x1398
je 0x61d5a7
lea edx, [edx]
mov ebx, ebx
nop
jne 0x61d5a7
add eax, 0x57e8403b
idiv edi
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.0061cd03
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x61d5bc
xor eax, eax
jmp 0x61d66d
xor esp, 0
jge 0x61d5d1
pushf
sub esp, 0
test dword [esp + 0x10], eax
popf
jo 0x61d5ce
jl 0x61d5d1
mov ebx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0060f961
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00605802
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x61d647
neg eax
neg eax
shr esp, 0
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
jns 0x61d608
jae 0x61d614
jno 0x61d60c
jns 0x61d60e
mov edi, edi
jb 0x61d614
jmp 0xfca7614d
mov eax, dword [ebp - 4]
push eax
call fcn.006232a9
add esp, 4
push edi
pop edi
rol edx, 5
ror edx, 5
je 0x61d63e
pushf
shl esi, 0
clc
test ecx, ebx
shl edi, 0
popf
je 0x61d639
jp 0x61d63b
jne 0x61d63e
mov eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x61d66d
jns 0x61d649
js 0x61d64b
jo 0x61d66b
pushf
mov esi, esi
jl 0x61d653
xchg esi, esi
add edi, 0
popf
lea eax, [eax + 0x27f9]
lea eax, [eax - 0x27f9]
mov ecx, ecx
jno 0x61d66b
mov edx, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x61d676
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x5f76d0], 1
jne 0x61d7cd
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00605802
add esp, 0xc
push ebx
add ebx, 0x3b69
ror ebx, 1
pop ebx
clc
lea ecx, [ecx + 0x6240]
lea ecx, [ecx - 0x6240]
jno 0x61d6ba
xchg edx, edx
jo 0x61d6ba
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
jae 0x61d6e8
lea esi, [esi]
test esp, 0x4d1e
ja 0x61d6f9
nop
jbe 0x61d6f5
jbe 0x61d6f9
mov eax, 0xe84d8ab4
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0061cd03
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x61d766
mov eax, dword [ebp + 8]
jmp 0x61d83e
lea edx, [edx + 0x342c]
sub edx, 0x342c
xchg esp, esp
xor ecx, 0x646e
xor ecx, 0x646e
jle 0x61d795
lea ebx, [ebx + 0x729e]
lea ebx, [ebx - 0x729e]
mov edx, edx
jg 0x61d795
mov ecx, 0x558da074
call 0xf4a762ee
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0060f961
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00605802
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x61d7c6
mov edx, dword [ebp - 8]
mov dword [0x5f76d0], edx
jmp 0x61d7cb
mov eax, dword [ebp + 8]
jmp 0x61d83e
jmp 0x61d7d5
mov eax, dword [0x5f76d0]
mov dword [ebp - 8], eax
add eax, 0x1d58
sub eax, 0x1d58
jl 0x61d7e1
cld
ja 0x61d7e9
jle 0x61d7e6
jbe 0x61d7e9
add eax, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
lea edx, [edx]
nop
jg 0x61d812
pushf
mov esi, esi
jmp 0x61d7fa
lea ecx, [ecx + 0x76ab]
lea ecx, [ecx - 0x76ab]
jae 0x61d808
popf
lea esp, [esp]
mov edi, edi
jle 0x61d812
or dword [ebx - 0x17ad03ab], 0x5a8e
mov edx, dword [ebp - 4]
push edx
call fcn.006232a9
add esp, 4
test esp, 0x4c32
jmp 0x61d826
je 0x61d837
pushf
xchg edi, edi
jnp 0x61d82e
popf
jle 0x61d832
je 0x61d834
jne 0x61d837
xor eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x62336b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x5f76cc], 1
jne 0x6234f1
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00605802
add esp, 0xc
nop
jns 0x623394
test ecx, esi
jae 0x6233ab
pushf
ja 0x62339c
or edx, edx
dec edx
inc edx
test dword [esp], esi
popf
jmp 0x6233a7
nop
jb 0x6233ab
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
test edi, 0x106e
lea eax, [eax + 0x7f5f]
sub eax, 0x7f5f
jno 0x623408
pushf
call 0x6233f5
lea esp, [esp + 4]
neg ecx
neg ecx
popf
jle 0x623401
jbe 0x623403
xchg esi, esi
jo 0x623408
add eax, 0x80e84d8a
jmp 0xe8afbc12
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0061cd03
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x62347d
xor eax, eax
jmp 0x62355f
and esp, 0xffffffff
push eax
add eax, 0x5899
ror eax, 0x1d
pop eax
dec esi
inc esi
ja 0x62349b
pushf
jl 0x623492
lea esi, [esi]
popf
ja 0x623498
jbe 0x62349b
mov esi, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0060f961
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00605802
add esp, 0xc
xor edx, 0x4a0f
xor edx, 0x4a0f
rol edx, 0x1a
rol edx, 6
jl 0x6234db
lea esp, [esp]
jb 0x6234d4
mov edx, edx
xchg esi, esi
jge 0x6234db
ljmp 0xa74:0xf87d83
cmp dword [ebp - 8], 0
je 0x6234eb
mov eax, dword [ebp - 8]
mov dword [0x5f76cc], eax
jmp 0x6234ef
xor eax, eax
jmp 0x62355f
jmp 0x6234fa
mov ecx, dword [0x5f76cc]
mov dword [ebp - 8], ecx
rol ebx, 0x1f
ror ebx, 0x1f
test dword [esp + 0xc], eax
shr ecx, 0
shr esp, 0
jb 0x623520
pushf
inc edx
dec edx
shr esp, 0
xor esp, 0
popf
lea esp, [esp]
jge 0x62351d
jae 0x623520
call 0x8a5a8aaf
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
test edx, 0x54a8
and esp, 0xffffffff
dec eax
inc eax
lea ecx, [ecx]
jae 0x623548
pushf
jle 0x623539
test dword [esp + 8], edi
popf
jp 0x623541
jmp 0x623543
lea esi, [esi]
jb 0x623548
mov edx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.006232a9
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x623710
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x52e082
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x52e0ce
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x52e0c8
mov ecx, dword [0x56e7f8]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x52e0bc
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x52e0a1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x52e0ca
xor al, al
mov esp, ebp
pop ebp
ret