joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20572d9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2055a104
add esp, 0xc
push ebx
pop ebx
ror edi, 0
nop
jbe 0x20572dcc
xchg ebx, edx
xchg ebx, edx
xchg esi, esi
ja 0x20572dcc
mov eax, 0xec45c601
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x42
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xb], 0x78
and esp, 0xffffffff
ja 0x20572e01
rol esi, 0x11
rol esi, 0xf
je 0x20572e1e
pushf
dec eax
inc eax
cmp edx, dword [esp]
jae 0x20572e12
clc
popf
jne 0x20572e17
ja 0x20572e19
js 0x20572e1b
jne 0x20572e1e
mov ebp, 0x80ec4d8a
jmp 0xca4b628
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.2055eb0a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20572e93
xor eax, eax
jmp 0x20573108
and ecx, ecx
lea edi, [edi + 0x7c21]
lea edi, [edi - 0x7c21]
cmp esp, 0x31c8
jae 0x20572ea9
je 0x20572ec7
pushf
shr esp, 0
cmp ecx, dword [esp + 0xc]
call fcn.20572eb9
Function at 0x2057487f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2055a104
add esp, 0xc
call 0x2057489d
lea esp, [esp + 4]
shr esp, 0
cmp esi, dword [esp]
ror esp, 0
je 0x205748b5
xchg esi, edx
xchg esi, edx
xchg esp, esp
jne 0x205748b5
mov esi, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
xor ecx, 0
clc
jmp 0x205748f3
je 0x205748f5
ja 0x20574901
jae 0x205748f9
js 0x205748fb
js 0x205748fd
jbe 0x20574901
mov esi, 0xec4d8a69
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.2055eb0a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20574984
xor eax, eax
jmp 0x20574a00
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.2055cb42
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x205749fe
xor esp, 0
jbe 0x205749af
mov edx, edx
add ecx, dword [esp]
sub ecx, dword [esp]
jnp 0x205749cf
pushf
lea esi, [esi]
jl 0x205749bf
cmp esi, 0x79ec
rol edi, 0
popf
jmp 0x205749cc
jp 0x205749cf
mov edi, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.205599f9
add esp, 4
test esp, 0x4a9e
jbe 0x205749ed
jae 0x205749e5
xchg esp, esp
je 0x205749e9
nop
ja 0x205749ed
mov eax, 0x5010458b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x20574a00
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x205751d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2055a104
add esp, 0xc
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
jno 0x205751fc
xchg esp, esp
lea ebx, [ebx + 0x57cf]
sub ebx, 0x57cf
jg 0x20575218
mov esp, esp
js 0x20575210
jl 0x20575212
mov esp, esp
jle 0x20575218
sub eax, 0xf045c655
dec eax
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
cmp ecx, dword [esp + 0xc]
std
cld
lea edi, [edi + 0x3875]
sub edi, 0x3875
push esi
add esi, 0x3ff9
ror esi, 0x17
pop esi
jno 0x20575267
lea esp, [esp]
mov ebx, ebx
jo 0x20575267
mov esp, 0x80f04d8a
jmp 0x10a4da71
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.2055eb0a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x205752c7
xor eax, eax
jmp 0x20575333
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.2055cb42
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x20575331
lea esi, [esi + 0x3b53]
sub esi, 0x3b53
jp 0x205752fb
shl esp, 0
test esp, 0x7be6
js 0x2057530b
xchg esp, esp
jns 0x2057530b
jmp 0x7243a09a
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.205599f9
add esp, 4
inc ebx
dec ebx
jno 0x2057531b
jl 0x20575324
jne 0x2057531f
mov esp, esp
jge 0x20575324
mov ecx, 0x520c558b
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x20575333
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x20575658
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2055a104
add esp, 0xc
dec edi
inc edi
nop
add esi, 0
jle 0x20575691
pushf
lea eax, [eax + 0x1e85]
lea eax, [eax - 0x1e85]
xor ebx, 0
popf
js 0x2057568e
jg 0x20575691
lcall 0x45c6, 0x50e845c6
in eax, dx
inc esp
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0
jge 0x205756cf
rol esp, 0
jp 0x205756e6
jb 0x205756d6
lea ecx, [ecx + 0x70d1]
lea ecx, [ecx - 0x70d1]
jnp 0x205756e6
mov ebp, 0xe84d8a05
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
jae 0x20575762
jl 0x2057577b
pushf
xchg edi, edx
xchg edi, edx
call fcn.2057576f
Function at 0x20575bf2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2055a104
add esp, 0xc
xchg edi, edi
xor esp, 0
ror esp, 0
jge 0x20575c2e
pushf
rol esp, 0
cld
add esp, 0
popf
jns 0x20575c29
mov esp, esp
jl 0x20575c2e
mov edi, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.20572763
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20575cf6
xor eax, eax
jmp 0x20575d5f
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2055cb42
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x20575d20
xor eax, eax
jmp 0x20575d5f
lea esp, [esp]
dec edx
inc edx
je 0x20575d27
jb 0x20575d29
jnp 0x20575d32
jne 0x20575d2d
ja 0x20575d2f
jp 0x20575d32
jmp 0x713fa2c1
mov eax, dword [ebp - 0x18]
push eax
call fcn.205599f9
add esp, 4
inc ebx
dec ebx
and edx, 0xffffffff
jns 0x20575d45
test ecx, ebx
jno 0x20575d54
pushf
jae 0x20575d4d
popf
jmp 0x20575d51
jo 0x20575d54
lcall 0x558b, 0x510c4d8b
or byte [edx - 1], dl
push ebp
call 0xabb2bbc2
in eax, 0x5d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x20575d68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2055a104
add esp, 0xc
sub esi, 0
cmc
jp 0x20575d96
pushf
and ebx, ebx
or esp, 0
nop
popf
jp 0x20575d93
jnp 0x20575d96
mov esp, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
xor esi, 0
je 0x20575dcb
jl 0x20575dcd
xor ecx, 0x34dc
xor ecx, 0x34dc
jg 0x20575def
pushf
shr esp, 0
cmp esp, 0x25ae
popf
js 0x20575dea
jg 0x20575dec
jle 0x20575def
mov esp, 0x80ec4d8a
jmp 0xca4e5f9
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
add dword [eax + 0x4d8af445], ecx
invalid
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
or esp, 0
js 0x20575e54
call 0x20575e59
add esp, 4
je 0x20575e6a
jge 0x20575e60
lea edx, [edx]
jae 0x20575e64
jge 0x20575e66
jne 0x20575e6a
ljmp 0xffff:0xc8f4e883
call fcn.20572763
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20575e7f
xor eax, eax
jmp 0x20575f17
jnp 0x20575e81
jo 0x20575e9a
lea eax, [eax + 0x7edf]
lea eax, [eax - 0x7edf]
jnp 0x20575e91
mov edx, edx
lea esp, [esp]
jno 0x20575e9a
sub eax, 0xec458dc9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.2055cb42
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x20575efb
jle 0x20575ec2
ror esp, 0
or ecx, 0
je 0x20575ecf
lea eax, [eax]
jne 0x20575ecf
lcall 0x21e8, 0x50fc458b
cmp edi, esi
inc dword [ebx - 0x4072fb3c]
dec ecx
or byte [eax], al
add byte [ebp - 0x84841], cl
push dword [ebp + 9]
mov eax, dword [ebp - 4]
push eax
call fcn.205599f9
add esp, 4
lea edi, [edi + 0x849]
lea edi, [edi - 0x849]
jne 0x20575ef2
je 0x20575eeb
jg 0x20575eed
jae 0x20575eef
je 0x20575ef2
mov esi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x20575f17
ror ebx, 0x10
ror ebx, 0x10
jp 0x20575f15
pushf
add esp, 0
je 0x20575f0a
popf
jbe 0x20575f0e
xchg edi, eax
xchg edi, eax
je 0x20575f12
jnp 0x20575f15
sub eax, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20576a84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2055a104
add esp, 0xc
add esi, dword [esp]
sub esi, dword [esp]
js 0x20576aa5
jo 0x20576aa7
mov eax, eax
jne 0x20576ab2
lea edx, [edx]
jge 0x20576aaf
je 0x20576ab2
mov edi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
rol esi, 0
jl 0x20576af3
jo 0x20576af5
jp 0x20576b0d
pushf
xor esi, 0x7409
xor esi, 0x7409
popf
jmp 0x20576b09
nop
jnp 0x20576b0d
mov ecx, 0x80e84d8a
jmp 0x8a4f317
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.2055eb0a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20576b99
xor eax, eax
jmp 0x20576c0f
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2055cb42
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x20576c0d
call 0x20576bc4
lea esp, [esp + 4]
nop
or ecx, 0
jle 0x20576bce
jns 0x20576bd9
jge 0x20576bd2
jl 0x20576bd4
js 0x20576bd6
js 0x20576bd9
mov edi, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.205599f9
add esp, 4
xor edx, ebx
xor edx, ebx
cmc
jns 0x20576c00
lea edx, [edx + 0x60a3]
lea edx, [edx - 0x60a3]
jns 0x20576bfa
nop
lea eax, [eax]
js 0x20576c00
mov esp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x20576c0f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x20576c18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2055a104
add esp, 0xc
nop
push edi
add edi, 0x3b69
ror edi, 1
pop edi
jo 0x20576c64
pushf
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
jns 0x20576c4a
lea edx, [edx + 0x6806]
lea edx, [edx - 0x6806]
test dword [esp], ecx
popf
jp 0x20576c5d
jl 0x20576c5f
jle 0x20576c61
jno 0x20576c64
mov ebp, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
and edi, edi
test esi, edi
je 0x20576cac
jmp 0x20576c9c
lea edi, [edi + 0x651d]
lea edi, [edi - 0x651d]
jne 0x20576cac
jmp 0xca4f72b
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.20572763
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20576d1e
xor eax, eax
jmp 0x20576d86
jge 0x20576d20
jp 0x20576d2f
jb 0x20576d24
jnp 0x20576d26
jb 0x20576d28
jne 0x20576d2a
jnp 0x20576d2f
xor eax, 0x458d416c
in al, dx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.2055cb42
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2055a104
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x20576d59
xor eax, eax
jmp 0x20576d86
push esi
pop esi
jnp 0x20576d5d
jno 0x20576d65
jge 0x20576d61
jo 0x20576d65
ljmp 0xe850:0xfc458b83
mov eax, dword [ebp - 4]
push eax
call fcn.205599f9
add esp, 4
jge 0x20576d73
js 0x20576d75
jae 0x20576d7f
jp 0x20576d79
lea ebx, [ebx]
jb 0x20576d7f
mov ebp, 0x84d8b5f
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20578dcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.2055a104
add esp, 0xc
jbe 0x20578de7
jno 0x20578df0
je 0x20578deb
jb 0x20578ded
jo 0x20578df0
call 0x6747d3ba
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
jbe 0x20578e22
lea edi, [edi]
cld
mov esp, esp
jb 0x20578e34
mov esp, esp
jo 0x20578e2d
jl 0x20578e2f
jge 0x20578e31
jae 0x20578e34
call 0xa147dbc2
jmp 0x10a5163e
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
lea ebx, [ebx]
rol eax, 0
ja 0x20578ea1
lea esp, [esp]
jbe 0x20578ea1
jmp 0x1ff04c8d
call fcn.20572763
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20578eb3
xor eax, eax
jmp 0x20578eed
lea edi, [edi]
test dword [esp + 0x10], edx
or edx, 0
jne 0x20578eca
pushf
nop
xchg esp, esp
popf
jno 0x20578ec7
je 0x20578eca
mov esi, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2055cb42
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2055a104
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2057b416
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.2055a104
add esp, 0xc
push 0x21
push 0x20550638
lea ecx, [ebp - 0x138]
push ecx
call fcn.2057a641
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x2057b51e
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.2055a104
add esp, 0xc
push 0xb
push 0x2055065c
lea edx, [ebp - 0x138]
push edx
call fcn.2057a641
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x2057b511
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.2057a641
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x2057b520
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x2057b5b0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret