joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fe476
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00605802
add esp, 0xc
add ebx, 0
jb 0x5fe49c
je 0x5fe496
jo 0x5fe498
jae 0x5fe49c
mov eax, 0xe845c6c7
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
shr esi, 0
jo 0x5fe4ed
pushf
test eax, 0x68d3
sub esp, 0
rol esp, 0
popf
jae 0x5fe4e6
jge 0x5fe4e8
jge 0x5fe4ea
jno 0x5fe4ed
mov esp, 0x80e84d8a
jmp 0xe8ad6cf7
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jb 0x5fe557
jb 0x5fe559
mov ebx, ebx
push eax
pop eax
jbe 0x5fe566
jnp 0x5fe561
mov esi, esi
ja 0x5fe566
lcall 0x8900, 0x1e798e8
inc ebp
clc
call fcn.0061cd03
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5fe57b
xor eax, eax
jmp 0x5fe619
cmp edx, 0x3d86
not edx
not edx
nop
jo 0x5fe59a
pushf
ror ecx, 0x15
ror ecx, 0xb
rol esp, 0
popf
xchg esi, esi
jno 0x5fe59a
or dword [ebp - 0x74ae17b3], 0xe852f855
mov edx, 0x89000113
inc ebp
cld
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0060f961
mov dword [ebp - 4], eax
ror eax, 1
rol eax, 1
jp 0x5fe5bb
jbe 0x5fe5b2
jb 0x5fe5b4
xchg esi, ecx
xchg esi, ecx
jnp 0x5fe5bb
mov ecx, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00605802
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5fe5d5
xor eax, eax
jmp 0x5fe619
push esi
add esi, 0x18c0
ror esi, 0xd
pop esi
sub esi, 0
jge 0x5fe5e5
jb 0x5fe5f2
jns 0x5fe5e9
xchg esp, esp
jo 0x5fe5ed
jae 0x5fe5f2
mov ebp, 0x4d8b6aad
cld
mov ecx, dword [ebp - 4]
push ecx
call fcn.006232a9
add esp, 4
test dword [esp], edi
rol edx, 0
xor ecx, 0
jne 0x5fe616
js 0x5fe60b
xchg esp, esp
js 0x5fe60f
jg 0x5fe611
je 0x5fe616
add eax, 0x55ffc565
cld
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5fe9cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00605802
add esp, 0xc
shl esp, 0
je 0x5fe9f3
pushf
nop
popf
xchg ecx, eax
xchg ecx, eax
jne 0x5fe9f3
sub eax, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
xchg ecx, ecx
jns 0x5fea5a
pushf
lea esi, [esi]
xor esi, 0x77c2
xor esi, 0x77c2
popf
xchg esp, esp
js 0x5fea5a
sub eax, 0x80e84d8a
jmp 0xe8ad7264
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
lea esi, [esi + 0x7018]
lea esi, [esi - 0x7018]
jge 0x5feb04
shl esp, 0
jne 0x5feb19
lea ebx, [ebx + 0x5fc4]
lea ebx, [ebx - 0x5fc4]
je 0x5feb19
sub eax, 0x5b89e821
add byte [eax], al
call 0x6046a7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5feb2e
xor eax, eax
jmp 0x5febd9
add esi, 0x53a7
sub esi, 0x53a7
xor esp, 0
dec edx
inc edx
jb 0x5feb4c
lea eax, [eax]
jle 0x5feb45
jae 0x5feb47
js 0x5feb49
jae 0x5feb4c
mov ebx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0060f961
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00605802
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x5feb76
xor eax, eax
jmp 0x5febd9
lea edi, [edi + 0x12e1]
sub edi, 0x12e1
lea eax, [eax + 0xf7d]
sub eax, 0xf7d
js 0x5feb8f
neg edi
neg edi
jno 0x5feba7
pushf
lea eax, [eax]
xor edi, 0
popf
jl 0x5feba0
xchg esp, esp
jo 0x5feba4
jo 0x5feba7
xor eax, 0x51e44d8b
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.006232a9
add esp, 4
lea esp, [esp]
call fcn.005febbb
Function at 0x6008b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00605802
add esp, 0xc
jae 0x6008cc
jp 0x6008ce
jge 0x6008d0
je 0x6008eb
pushf
push eax
pop eax
cmp esp, 0x59af
jnp 0x6008de
or edx, edx
popf
jle 0x6008e4
mov edx, edx
jo 0x6008e8
jne 0x6008eb
add eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
stc
jno 0x60091e
xor eax, ecx
xor eax, ecx
jo 0x600932
pushf
cld
popf
jnp 0x60092b
jmp 0x60092d
js 0x60092f
jno 0x600932
mov esp, 0x80f04d8a
jmp 0xf0ad913c
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
xor esi, 0
lea edx, [edx + 0x3890]
lea edx, [edx - 0x3890]
jnp 0x6009a3
shr eax, 0
jle 0x6009b8
pushf
clc
mov ebx, ebx
xchg ebx, ebx
popf
xchg ebx, esi
xchg ebx, esi
jg 0x6009b8
sub eax, 0x1c346e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.0061cd03
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6009ca
xor eax, eax
jmp 0x600a09
lea esi, [esi + 0x1f15]
lea esi, [esi - 0x1f15]
xor ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0xc]
je 0x6009e6
jae 0x6009e2
jne 0x6009e6
sub eax, 0xf0458d8d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0060f961
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00605802
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x600be6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00605802
add esp, 0xc
push edx
add edx, 0x7022
ror edx, 0x15
pop edx
jne 0x600c23
pushf
inc esi
dec esi
popf
mov eax, eax
lea esi, [esi + 0x4f57]
lea esi, [esi - 0x4f57]
je 0x600c23
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
clc
shr esp, 0
jb 0x600c65
xchg ecx, esi
xchg ecx, esi
jge 0x600c78
pushf
and esi, esi
popf
jo 0x600c73
jl 0x600c75
jl 0x600c78
sub eax, 0x80e84d8a
jmp 0xe8ad9482
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0060db88
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x600d07
xor eax, eax
jmp 0x600d9d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0060f961
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00605802
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x600d9b
jae 0x600d2f
cmc
jae 0x600d32
lea edi, [edi + 0x34f4]
sub edi, 0x34f4
jge 0x600d4d
pushf
lea esi, [esi]
and ebx, ebx
popf
jg 0x600d4a
jl 0x600d4d
mov ebp, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.006232a9
add esp, 4
lea ecx, [ecx]
lea esp, [esp]
test esp, 0x7cc7
xor ebx, dword [esp + 4]
xor ebx, dword [esp + 4]
jo 0x600d8a
pushf
add edi, 0x7d0e
sub edi, 0x7d0e
ror ebx, 0
ror edx, 0
cmc
popf
jge 0x600d87
jno 0x600d8a
mov edx, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x600d9d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x603659
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00605802
add esp, 0xc
push 0x21
push 0x5f7d24
lea ecx, [ebp - 0x138]
push ecx
call fcn.0061555e
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x603761
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.00605802
add esp, 0xc
push 0xb
push 0x5f7d48
lea edx, [ebp - 0x138]
push edx
call fcn.0061555e
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x603754
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0061555e
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x603763
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x60622c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00605802
add esp, 0xc
xchg ecx, ecx
or esp, 0
rol edx, 0
ror ecx, 0x18
rol ecx, 0x18
js 0x606268
js 0x60625e
jno 0x606260
jp 0x606262
jge 0x606264
jns 0x606268
mov edi, 0xec45c6f1
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0061cd03
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x606330
xor eax, eax
jmp 0x6063aa
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0060f961
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00605802
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x60635a
xor eax, eax
jmp 0x6063aa
push eax
add eax, 0xeec
ror eax, 0x1f
pop eax
lea esi, [esi]
jg 0x606368
jge 0x60636a
jbe 0x60637b
pushf
ja 0x606370
popf
jbe 0x606374
jge 0x606376
mov esp, esp
ja 0x60637b
mov edx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.006232a9
add esp, 4
jnp 0x606389
jb 0x60638b
cmp esp, 0x3659
js 0x60639f
pushf
rol esp, 0
popf
mov edx, edx
jns 0x60639f
sub eax, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x60662a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00605802
add esp, 0xc
lea edi, [edi + 0x6044]
lea edi, [edi - 0x6044]
jle 0x606651
jo 0x606653
jp 0x60666e
pushf
cmp ecx, 0xfb
xor edx, ecx
xor edx, ecx
mov edx, edx
popf
xchg esp, esp
jnp 0x606669
jns 0x60666b
jnp 0x60666e
add eax, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
ja 0x6066ac
jl 0x6066c9
pushf
clc
rol ebx, 4
ror ebx, 4
rol esp, 0
test dword [esp + 4], eax
popf
mov esi, esi
ja 0x6066c4
jge 0x6066c6
jge 0x6066c9
call 0x814cb457
jmp 0xecadeed3
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0061cd03
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x606753
jmp 0x6067d0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0060f961
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00605802
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x6067d0
or esi, esi
test esp, 0x63d2
dec ecx
inc ecx
jg 0x606785
jb 0x60679c
jno 0x606789
lea ebx, [ebx + 0x4232]
lea ebx, [ebx - 0x4232]
mov ebx, ebx
xchg esp, esp
jae 0x60679c
mov esi, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.006232a9
add esp, 4
call fcn.006067ad
Function at 0x60776d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00605802
add esp, 0xc
lea esi, [esi + 0x2c55]
lea esi, [esi - 0x2c55]
js 0x60779b
je 0x60779d
jge 0x6077a6
jnp 0x6077a1
mov esi, esi
jl 0x6077a6
xor eax, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
shl esp, 0
xor ecx, 0
rol ebx, 0
not edi
not edi
jb 0x6077ec
mov eax, eax
jae 0x6077ec
call 0x4deaa0f9
invalid
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
lea esp, [esp]
test edx, eax
ja 0x607853
jp 0x607871
pushf
and ebx, 0xffffffff
test dword [esp], edx
jl 0x60785f
lea eax, [eax + 0x3a98]
sub eax, 0x3a98
popf
jae 0x60786e
jnp 0x607871
mov ebp, 0x6312e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.0060db88
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x607883
xor eax, eax
jmp 0x6078c0
test eax, 0x4929
or eax, 0
test esp, 0x7759
test dword [esp], ecx
jbe 0x60789d
jae 0x607898
ja 0x60789d
sub eax, 0x458dd18d
invalid
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0060f961
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00605802
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x608ab8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00605802
add esp, 0xc
or ecx, 0
je 0x608ad6
shr edx, 0
jae 0x608ae3
jmp 0x608add
jmp 0x608adf
jb 0x608ae3
mov ebx, 0xec45c62b
dec eax
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
push ecx
pop ecx
jb 0x608b2e
lea edx, [edx]
jae 0x608b2e
ljmp 0x80ec:0x4d8ac49a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.0061cd03
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x608bc5
xor eax, eax
jmp 0x608cb8
cmp edi, eax
xor esi, dword [esp]
xor esi, dword [esp]
call fcn.00608bd2
Function at 0x60dba5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00605802
add esp, 0xc
jns 0x60dbc7
jl 0x60dbd4
jae 0x60dbcb
ja 0x60dbcd
xchg esi, ecx
xchg esi, ecx
jge 0x60dbd4
mov edx, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jp 0x60dc7f
jo 0x60dc81
call fcn.0060dc86