joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d0390
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x18], ecx
push str.navigation
lea ecx, [ebp + 8]
call fcn.00422730
test eax, eax
jne 0x5d0417
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
push str.SoftwareNavPlugin
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str._run__superwp
call fcn.004bd4a0
add esp, 4
push ecx
mov ecx, esp
push 0x6abcf8
call fcn.004131e0
push ecx
mov ecx, esp
push 0x6abd04
call fcn.004131e0
push ecx
mov ecx, esp
push str.navplugin
call fcn.004131e0
call fcn.004dfe30
mov ecx, eax
call fcn.004e1230
jmp 0x5d04c2
push str.desktoplite
lea ecx, [ebp + 8]
call fcn.00422730
test eax, eax
jne 0x5d0452
push 2
push 0x1c
push 1
lea ecx, [ebp - 0x2c]
call fcn.006150e0
push 0
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004bc680
mov ecx, eax
call fcn.004bc7d0
lea ecx, [ebp - 0x2c]
call fcn.006151e0
jmp 0x5d04c2
lea edx, [ebp + 8]
push edx
push 0x6abd3c
lea ecx, [ebp - 0x10]
call fcn.004131e0
push eax
lea eax, [ebp - 8]
push eax
call fcn.00421f30
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00413870
lea ecx, [ebp - 8]
call fcn.0040d3c0
push eax
call fcn.004bcfa0
add esp, 4
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov byte [ebp - 1], cl
push 4
lea edx, [ebp - 0x14]
push edx
push 4
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
lea ecx, [ebp - 1]
call fcn.005d0ad0
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 8]
call fcn.00413870
push 0
push 0
push 1
push 0
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
call fcn.004154a0
mov ecx, eax
call fcn.005f1000
lea ecx, [ebp + 8]
call fcn.00413870
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3f50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0xa
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0x6ac434
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 8
Function at 0x5d5310
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
je 0x5d532d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5d5331
xor eax, eax
jmp 0x5d5394
mov ecx, dword [ebp + 8]
push ecx
call fcn.00603960
add esp, 4
test eax, eax
jne 0x5d5345
xor eax, eax
jmp 0x5d5394
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5d5379
mov eax, dword [0x6ea3c0]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5d5379
call dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x5d538a
mov dword [ebp - 0x10], 1
jmp 0x5d5391
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x5d93a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0xa
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret 8
Function at 0x5da530
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x5da54d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5da554
xor eax, eax
jmp 0x5da5e0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00603960
add esp, 4
test eax, eax
jne 0x5da568
xor eax, eax
jmp 0x5da5e0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5da5c5
push 0x6acffc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5da59b
call dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
push str.IWebViewToIWebViewEx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
push str.IsSupportedWebViewEngine
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx], 0
je 0x5da5d6
mov dword [ebp - 0x10], 1
jmp 0x5da5dd
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x5e9170
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x5e9338
test eax, eax
je 0x5e9338
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x5e9338
push ecx
push ebx
push eax
call fcn.0063a460
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x5e9338
cmp edi, 0xffffffff
je 0x5e9331
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.005f0710
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x5e9331
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x5e92c7
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x5e9331
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x5e92c7
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x5e9260
cmp edi, esi
jae 0x5e92c7
nop
sub esi, edi
sbb ecx, eax
js 0x5e9275
jg 0x5e9270
cmp esi, 0x400000
jb 0x5e9275
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x5e92c7
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.005f0760
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x5e92bb
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x5e9260
jg 0x5e92c7
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x5e9260
lea eax, [ebp - 0x6c]
push eax
call fcn.005f0600
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push 0x6b0d98
push 3
push edi
call fcn.0047fcf0
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x5e92e0
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.0065470c
add esp, 8
mov esi, 1
test ebx, ebx
je 0x5e931d
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x5e932b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x5f1430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d488
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x640063
mov dword [ebp - 0x50], 0x320030
mov dword [ebp - 0x4c], 0x300036
mov dword [ebp - 0x48], 0x390034
mov dword [ebp - 0x44], 0x640065
mov dword [ebp - 0x40], 0x660032
mov dword [ebp - 0x3c], 0x660065
mov dword [ebp - 0x38], 0x300061
mov dword [ebp - 0x34], 0x640033
mov dword [ebp - 0x30], 0x340032
mov dword [ebp - 0x2c], 0x380066
mov dword [ebp - 0x28], 0x350061
mov dword [ebp - 0x24], 0x660062
mov dword [ebp - 0x20], 0x370063
mov dword [ebp - 0x1c], 0x630036
mov dword [ebp - 0x18], 0x300035
mov word [ebp - 0x14], ax
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f154b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f152b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f1510
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3

Function at 0x5f1560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d4b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x790073
mov dword [ebp - 0x24], 0x630073
mov dword [ebp - 0x20], 0x65006c
mov dword [ebp - 0x1c], 0x6e0061
mov dword [ebp - 0x18], 0x720065
mov word [ebp - 0x14], ax
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f1629
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f160b
lea ecx, [ebp - 0x28]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f15f0
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3
Function at 0x5f1a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d488
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x450036
mov dword [ebp - 0x50], 0x360034
mov dword [ebp - 0x4c], 0x320046
mov dword [ebp - 0x48], 0x420041
mov dword [ebp - 0x44], 0x350041
mov dword [ebp - 0x40], 0x440039
mov dword [ebp - 0x3c], 0x360034
mov dword [ebp - 0x38], 0x370031
mov dword [ebp - 0x34], 0x350042
mov dword [ebp - 0x30], 0x390041
mov dword [ebp - 0x2c], 0x360041
mov dword [ebp - 0x28], 0x390032
mov dword [ebp - 0x24], 0x330038
mov dword [ebp - 0x20], 0x420038
mov dword [ebp - 0x1c], 0x370046
mov dword [ebp - 0x18], 0x380034
mov word [ebp - 0x14], ax
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f1b5b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f1b3b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f1b20
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3

Function at 0x5f1c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d548
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x6f0053
mov dword [ebp - 0x34], 0x740066
mov dword [ebp - 0x30], 0x610077
mov dword [ebp - 0x2c], 0x650072
mov dword [ebp - 0x28], 0x43005c
mov dword [ebp - 0x24], 0x6d006f
mov dword [ebp - 0x20], 0x61004d
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x720065
mov word [ebp - 0x14], ax
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f1d22
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f1d02
lea ecx, [ebp - 0x38]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f1ce7
sub ecx, edx
lea eax, [ebp - 0x38]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3
Function at 0x5f1e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x720074
mov dword [ebp - 0x28], 0x630061
mov dword [ebp - 0x24], 0x6c0065
mov dword [ebp - 0x20], 0x730065
mov dword [ebp - 0x1c], 0x630073
mov dword [ebp - 0x18], 0x610068
mov dword [ebp - 0x14], 0x74
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f1ece
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f1eae
lea ecx, [ebp - 0x2c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f1e93
sub ecx, edx
lea eax, [ebp - 0x2c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3

Function at 0x5f1fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d488
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x300066
mov dword [ebp - 0x50], 0x620064
mov dword [ebp - 0x4c], 0x300030
mov dword [ebp - 0x48], 0x320032
mov dword [ebp - 0x44], 0x630034
mov dword [ebp - 0x40], 0x640066
mov dword [ebp - 0x3c], 0x330035
mov dword [ebp - 0x38], 0x620065
mov dword [ebp - 0x34], 0x630064
mov dword [ebp - 0x30], 0x320039
mov dword [ebp - 0x2c], 0x650066
mov dword [ebp - 0x28], 0x640065
mov dword [ebp - 0x24], 0x610031
mov dword [ebp - 0x20], 0x640036
mov dword [ebp - 0x1c], 0x310066
mov dword [ebp - 0x18], 0x360035
mov word [ebp - 0x14], ax
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f20bb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f209b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f2080
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3
Function at 0x5f20d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d488
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x610035
mov dword [ebp - 0x50], 0x660031
mov dword [ebp - 0x4c], 0x340035
mov dword [ebp - 0x48], 0x660033
mov dword [ebp - 0x44], 0x620061
mov dword [ebp - 0x40], 0x340039
mov dword [ebp - 0x3c], 0x360063
mov dword [ebp - 0x38], 0x350037
mov dword [ebp - 0x34], 0x640063
mov dword [ebp - 0x30], 0x320037
mov dword [ebp - 0x2c], 0x370038
mov dword [ebp - 0x28], 0x300065
mov dword [ebp - 0x24], 0x390030
mov dword [ebp - 0x20], 0x610030
mov dword [ebp - 0x1c], 0x320037
mov dword [ebp - 0x18], 0x370065
mov word [ebp - 0x14], ax
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f21eb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f21cb
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f21b0
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3
Function at 0x5f2200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d488
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x320065
mov dword [ebp - 0x50], 0x300064
mov dword [ebp - 0x4c], 0x650030
mov dword [ebp - 0x48], 0x310061
mov dword [ebp - 0x44], 0x390039
mov dword [ebp - 0x40], 0x320063
mov dword [ebp - 0x3c], 0x650062
mov dword [ebp - 0x38], 0x610062
mov dword [ebp - 0x34], 0x340066
mov dword [ebp - 0x30], 0x620061
mov dword [ebp - 0x2c], 0x390062
mov dword [ebp - 0x28], 0x390031
mov dword [ebp - 0x24], 0x310064
mov dword [ebp - 0x20], 0x340034
mov dword [ebp - 0x1c], 0x660034
mov dword [ebp - 0x18], 0x320031
mov word [ebp - 0x14], ax
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f231b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f22fb
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f22e0
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3
Function at 0x5f2400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d488
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x340037
mov dword [ebp - 0x50], 0x360061
mov dword [ebp - 0x4c], 0x620036
mov dword [ebp - 0x48], 0x620034
mov dword [ebp - 0x44], 0x610039
mov dword [ebp - 0x40], 0x610063
mov dword [ebp - 0x3c], 0x660034
mov dword [ebp - 0x38], 0x300032
mov dword [ebp - 0x34], 0x640034
mov dword [ebp - 0x30], 0x660038
mov dword [ebp - 0x2c], 0x630038
mov dword [ebp - 0x28], 0x300036
mov dword [ebp - 0x24], 0x340034
mov dword [ebp - 0x20], 0x610036
mov dword [ebp - 0x1c], 0x630032
mov dword [ebp - 0x18], 0x630030
mov word [ebp - 0x14], ax
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f251b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f24fb
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f24e0
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3
Function at 0x5f2530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d488
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x420044
mov dword [ebp - 0x50], 0x450044
mov dword [ebp - 0x4c], 0x460041
mov dword [ebp - 0x48], 0x370039
mov dword [ebp - 0x44], 0x300035
mov dword [ebp - 0x40], 0x370030
mov dword [ebp - 0x3c], 0x300034
mov dword [ebp - 0x38], 0x440039
mov dword [ebp - 0x34], 0x370042
mov dword [ebp - 0x30], 0x350038
mov dword [ebp - 0x2c], 0x390041
mov dword [ebp - 0x28], 0x390036
mov dword [ebp - 0x24], 0x410042
mov dword [ebp - 0x20], 0x330043
mov dword [ebp - 0x1c], 0x370044
mov dword [ebp - 0x18], 0x330036
mov word [ebp - 0x14], ax
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f264b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f262b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f2610
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3
Function at 0x5f2980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d488
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x300066
mov dword [ebp - 0x50], 0x660065
mov dword [ebp - 0x4c], 0x610035
mov dword [ebp - 0x48], 0x320066
mov dword [ebp - 0x44], 0x630031
mov dword [ebp - 0x40], 0x390063
mov dword [ebp - 0x3c], 0x360033
mov dword [ebp - 0x38], 0x390061
mov dword [ebp - 0x34], 0x370039
mov dword [ebp - 0x30], 0x340039
mov dword [ebp - 0x2c], 0x630037
mov dword [ebp - 0x28], 0x360063
mov dword [ebp - 0x24], 0x640037
mov dword [ebp - 0x20], 0x650065
mov dword [ebp - 0x1c], 0x360036
mov dword [ebp - 0x18], 0x330036
mov word [ebp - 0x14], ax
call fcn.00415500
mov ecx, eax
test ecx, ecx
je 0x5f2a9b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00414720
test al, al
jne 0x5f2a7b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5f2a60
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040e650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040d450
int3