joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f95d2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050de68
add esp, 0xc
ror edx, 0xa
rol edx, 0xa
js 0x4f95fa
jnp 0x4f9605
mov ecx, ecx
jp 0x4f9600
jge 0x4f9602
jp 0x4f9605
mov esp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jb 0x4f96b0
jae 0x4f96b2
sub eax, 0
ror esp, 0
je 0x4f96c1
jmp 0x4f96bc
jnp 0x4f96be
jne 0x4f96c1
add eax, 0x1a707e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 4], dh
call fcn.00513dcd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4f96d3
xor eax, eax
jmp 0x4f974c
test esi, 0x549d
add ecx, dword [esp]
sub ecx, dword [esp]
jp 0x4f96e7
jnp 0x4f96e3
jnp 0x4f96e7
mov ecx, 0xe8558d45
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005173f7
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0050de68
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4f9711
xor eax, eax
jmp 0x4f974c
jno 0x4f9713
jns 0x4f9719
nop
js 0x4f9719
mov esi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004ff307
add esp, 4
cmp edi, dword [esp]
std
cld
lea edx, [edx]
jae 0x4f9741
lea edx, [edx + 0x227d]
lea edx, [edx - 0x227d]
lea esp, [esp]
jb 0x4f9741
add eax, 0xc458be6
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4fdac1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0050de68
add esp, 0xc
cmc
shr edi, 0
std
cld
lea esp, [esp]
ja 0x4fdafa
pushf
je 0x4fdae9
sub ebx, 0
lea esp, [esp]
xor edx, ebx
xor edx, ebx
popf
jnp 0x4fdaf7
jbe 0x4fdafa
mov ecx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
test dword [esp], ecx
jo 0x4fdb43
pushf
ror eax, 0x10
ror eax, 0x10
shl esp, 0
jle 0x4fdb3c
popf
jp 0x4fdb40
jno 0x4fdb43
call 0x814428d1
jmp 0xf49d634d
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
mov ecx, ecx
add esp, 0
je 0x4fdbaa
jbe 0x4fdbba
mov ebx, ebx
xchg edi, esi
xchg edi, esi
jne 0x4fdbb4
jnp 0x4fdbb6
ja 0x4fdbba
add eax, 0xd4bae81c
invalid
call 0x4fb079
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4fdbd2
mov eax, 1
jmp 0x4fdc6a
push ebx
pop ebx
ror edi, 0
jnp 0x4fdbe3
jmp 0x4fdbdb
mov edx, edx
xchg esi, eax
xchg esi, eax
jp 0x4fdbe3
mov ebp, 0xf4458d4d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005173f7
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0050de68
add esp, 0xc
jb 0x4fdc05
xor esi, 0
dec esi
inc esi
jae 0x4fdc19
lea edx, [edx]
xchg ebx, edx
xchg ebx, edx
je 0x4fdc14
jmp 0x4fdc16
jb 0x4fdc19
mov edi, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x4fdc26
mov eax, 1
jmp 0x4fdc6a
test esp, 0x3bcb
jle 0x4fdc2e
xor esp, 0
ja 0x4fdc45
pushf
sub ecx, 0
js 0x4fdc3a
popf
mov ecx, ecx
mov eax, eax
jp 0x4fdc42
jbe 0x4fdc45
mov ebx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.004ff307
add esp, 4
je 0x4fdc53
xchg esp, esp
xchg esi, esi
jne 0x4fdc63
pushf
jb 0x4fdc5d
popf
nop
je 0x4fdc63
mov esi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x500af5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050de68
add esp, 0xc
cmc
jbe 0x500b18
jg 0x500b13
lea eax, [eax]
ja 0x500b18
xor eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
and ebx, ebx
jo 0x500b50
je 0x500b5d
mov edx, edx
js 0x500b56
xchg edx, edx
mov eax, eax
jne 0x500b5d
add eax, 0x80e84d8a
jmp 0xe89d9367
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
rol eax, 4
rol eax, 0x1c
xor ebx, dword [esp]
xor ebx, dword [esp]
ja 0x500bdb
jbe 0x500bd5
mov eax, eax
jbe 0x500bdb
mov edx, 0x31ede80c
add dword [eax], eax
call fcn.00513dcd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x500bf0
xor eax, eax
jmp 0x500c98
stc
ja 0x500c02
pushf
mov ebx, ebx
or esp, 0
popf
js 0x500bfe
nop
jbe 0x500c02
or dword [ebp - 0x74ae17b3], 0xe852f855
call 0x89500d77
inc ebp
cld
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005173f7
mov dword [ebp - 4], eax
test esp, 0x5666
jp 0x500c36
pushf
shr esp, 0
push ecx
add ecx, 0x51d9
ror ecx, 0xf
pop ecx
clc
push ebx
pop ebx
popf
mov esi, esi
js 0x500c33
jnp 0x500c36
add eax, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050de68
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x500c50
xor eax, eax
jmp 0x500c98
shr ecx, 0
xchg ebx, eax
xchg ebx, eax
jge 0x500c6e
pushf
call 0x500c5e
add esp, 4
mov ebx, ebx
jp 0x500c65
std
cld
popf
jge 0x500c6b
jl 0x500c6e
mov ebp, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ff307
add esp, 4
jns 0x500c7c
xchg ecx, ecx
lea ebx, [ebx + 0x4712]
sub ebx, 0x4712
jne 0x500c95
jae 0x500c8e
lea eax, [eax]
je 0x500c95
mov esi, 0x55ff0302
cld
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x502b78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0050de68
add esp, 0xc
ror edi, 0
jl 0x502b96
jl 0x502ba1
xchg esp, esp
jbe 0x502b9c
mov ecx, ecx
jge 0x502ba1
add eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
shr esp, 0
jge 0x502bd6
push edx
pop edx
ja 0x502be8
pushf
lea esp, [esp]
popf
js 0x502be3
je 0x502be5
jbe 0x502be8
xor eax, 0x80f04d8a
jmp 0xf09db3f2
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
and eax, eax
sub esi, 0
jns 0x502c4f
jge 0x502c67
pushf
neg esi
neg esi
inc edx
dec edx
cmp eax, ecx
or edi, 0
popf
jae 0x502c62
ja 0x502c64
jl 0x502c67
call 0x1618e53
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.00513dcd
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x502c79
xor eax, eax
jmp 0x502cb8
add edi, dword [esp]
sub edi, dword [esp]
dec edi
inc edi
neg eax
neg eax
js 0x502c87
jns 0x502c95
xchg edi, edi
lea edx, [edx]
lea esi, [esi]
mov esp, esp
js 0x502c95
mov esi, 0xf0458d97
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005173f7
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0050de68
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5055b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050de68
add esp, 0xc
or esp, 0
shr edx, 0
jne 0x5055e3
pushf
jg 0x5055dc
popf
mov ebx, ebx
je 0x5055e3
xor eax, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0
jnp 0x505619
jbe 0x505629
xchg edi, edi
jns 0x50561f
je 0x505621
lea esp, [esp]
ja 0x505629
jmp 0x4ddad657
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
cmp edx, dword [esp + 8]
lea edx, [edx + 0x5e9a]
lea edx, [edx - 0x5e9a]
jg 0x5056b3
pushf
or esp, 0
jno 0x5056aa
popf
lea edx, [edx]
js 0x5056b0
jle 0x5056b3
sub eax, 0xe715e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.00513dcd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5056c8
xor eax, eax
jmp 0x505907
nop
nop
jle 0x5056e4
pushf
ror eax, 0x1e
ror eax, 2
cmp ebx, edx
add ecx, 0
popf
jge 0x5056dd
mov eax, eax
jmp 0x5056e1
jg 0x5056e4
mov esp, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005173f7
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050de68
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x505711
xor eax, eax
jmp 0x505907
call fcn.00505716
Function at 0x508992
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
cmp ecx, 0x2fe0
and edx, edx
sub ebx, 0
jae 0x5089b6
jnp 0x5089c1
jmp 0x5089ba
jp 0x5089bc
lea esi, [esi]
jp 0x5089c1
add eax, 0xfc7d83
cmp dword [ebp - 4], 0
je 0x5089e0
ja 0x5089c9
push edi
pop edi
jae 0x5089d9
xchg edx, ecx
xchg edx, ecx
js 0x5089d3
mov esp, esp
jb 0x5089d9
mov esp, 0xfb876
add byte [eax], al
mov eax, 0xf
jmp 0x5089fa
mov esp, esp
ror eax, 3
ror eax, 0x1d
jg 0x5089ea
and esi, 0xffffffff
jp 0x5089f5
jo 0x5089f1
jnp 0x5089f5
xor dword [ecx], 0x14b8
add byte [edi + 0x5e], bl
mov eax, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50ac51
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x4f4334
call fcn.004f95a3
add esp, 0xc
mov byte [0x4f4334], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x50ad42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x50ad56
jmp 0x50af01
shl edx, 0
mov eax, eax
jbe 0x50ad6c
pushf
dec eax
inc eax
popf
jg 0x50ad65
jge 0x50ad67
jno 0x50ad69
ja 0x50ad6c
call 0x8958f2fb
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x4f2f84], edx
nop
jg 0x50ad8a
xchg ecx, ecx
jle 0x50ad84
lea esi, [esi]
jle 0x50ad8a
mov edx, 0xec458bd9
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x4f30cc], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x4f30c8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x4f4374], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x4f4378], ecx
push esi
add esi, 0x79a1
ror esi, 0x14
pop esi
jle 0x50adc6
jl 0x50adc8
jle 0x50addc
pushf
test dword [esp + 0xc], edi
stc
popf
lea ecx, [ecx]
jle 0x50add7
ja 0x50add9
jg 0x50addc
sub eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
shr eax, 0
xchg ecx, ecx
not eax
not eax
je 0x50ae31
lea edx, [edx + 0x29f1]
lea edx, [edx - 0x29f1]
lea ecx, [ecx]
je 0x50ae2b
jle 0x50ae2d
jne 0x50ae31
jmp 0xf0a638f4
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
shl esi, 0
xchg esp, esp
jne 0x50aeaf
pushf
rol edi, 5
rol edi, 0x1b
popf
xchg esp, esp
je 0x50aeaf
call 0x3118ec36
dec edi
add byte [eax], al
cmp dword [0x4f30c8], 0
je 0x50aecc
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x4f30c8]
push eax
call fcn.005173f7
mov dword [0x4f2f80], eax
cmc
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
or edx, edx
je 0x50aef1
pushf
shr esp, 0
jg 0x50aee0
cmp edi, 0x6bc1
popf
jns 0x50aeea
jge 0x50aeec
js 0x50aeee
jne 0x50aef1
mov ebp, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0050de68
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x50bc14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0050de68
add esp, 0xc
nop
ror eax, 0xe
rol eax, 0xe
and al, byte ds:[eax]
add byte [ebx - 0x3e6ff33c], al
enter 0xffffffffffffc10e, 0xffffffffffffffc0
push cs
nop
std
cld
jne 0x50bc3f
js 0x50bc3b
je 0x50bc3f
mov ebx, 0xe045c682
dec eax
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
add ecx, dword [esp]
sub ecx, dword [esp]
xchg esi, esi
xor edi, ecx
xor edi, ecx
jo 0x50bca2
xchg ecx, edi
xchg ecx, edi
jno 0x50bca2
sub eax, 0x4d8af096
loopne 0x50bc26
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
jg 0x50bd40
jmp 0xe09e44ac
ja 0x50bd42
jne 0x50bd44
lea edi, [edi]
jge 0x50bd5b
lea eax, [eax + 0x55a9]
lea eax, [eax - 0x55a9]
lea ebx, [ebx]
jbe 0x50bd58
jl 0x50bd5b
mov edi, 0x806de8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.00513dcd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x50bd70
xor eax, eax
jmp 0x50c012
call fcn.0050bd75
Function at 0x50ee8f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0050de68
add esp, 0xc
cmp eax, ebx
mov ecx, ecx
jno 0x50eec6
pushf
push edx
add edx, 0x37bf
ror edx, 9
pop edx
lea ecx, [ecx]
xchg ebx, eax
xchg ebx, eax
popf
mov ebx, ebx
jo 0x50eec6
add eax, 0x48e445c6
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x15], 0x6a
mov byte [ebp - 0x19], 0x57
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xf], 0
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x42
jno 0x50ef00
lea ecx, [ecx]
xchg edi, edi
jns 0x50ef22
pushf
shl esp, 0
xor ebx, 0
cld
popf
jns 0x50ef13
lea ecx, [ecx + 0x65f0]
lea ecx, [ecx - 0x65f0]
js 0x50ef22
or dword [edx - 0x167f1bb3], 0xe44d8801
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x1b]
sub al, 1
mov byte [ebp - 0x1b], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x1a]
sub dl, 1
mov byte [ebp - 0x1a], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
sub esi, 0
js 0x50ef98
or esi, esi
je 0x50efb4
pushf
lea esp, [esp]
xchg edi, edx
xchg edi, edx
ror edx, 6
ror edx, 0x1a
popf
jnp 0x50efaf
jl 0x50efb1
jne 0x50efb4
ljmp 0x8900:0x4e14e8
call fcn.00513dcd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x50efc9
xor eax, eax
jmp 0x50f248
jg 0x50efcb
shl edi, 0
call fcn.0050efd3
mov ebx, 0x32e5156b
pop edi
pushfd
inc ebx
scasb al, byte es:[edi]
adc bh, ch
in al, dx
cld
sbb eax, 0xddc38eaf
std
pushfd
sbb byte [esi + edi*2], dh
cwde
cld
xor al, 0x8c
push ebp
fnstenv [eax]
mov eax, 0x9d937556
fstp xword [ebx + 0x1a]
mov cl, 0x54
inc ebx
dec edx
dec esi
scasb al, byte es:[edi]
iretd
Function at 0x513c43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0050de68
add esp, 0xc
jbe 0x513c5e
test dword [esp + 4], esi
test esp, 0x2805
or edx, 0
jp 0x513c7a
jbe 0x513c6f
lea ebx, [ebx]
jae 0x513c73
xchg ecx, esi
xchg ecx, esi
jnp 0x513c7a
xor eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
test esp, 0x7197
test dword [esp + 0x10], eax
test edi, 0x126f
jl 0x513cd3
pushf
add edi, 0x60f6
sub edi, 0x60f6
popf
js 0x513cce
jl 0x513cd0
jge 0x513cd3
call 0x813d8a61
jmp 0xec9ec4dd
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00513dcd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x513d45
xor eax, eax
jmp 0x513dc4
and edx, 0xffffffff
cld
jne 0x513d54
js 0x513d4d
jno 0x513d4f
je 0x513d54
lcall 0x50ec, 0x458d00cb
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005173f7
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0050de68
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x513d7e
xor eax, eax
jmp 0x513dc4
lea ecx, [ecx]
shr ebx, 0
jle 0x513d95
pushf
ror edi, 0
popf
jne 0x513d8e
lea edx, [edx]
ja 0x513d92
jg 0x513d95
mov ebp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004ff307
add esp, 4
cmp ecx, dword [esp + 0x10]
call 0x513daa
add esp, 4
inc edi
dec edi
jns 0x513dbd
je 0x513db3
js 0x513db5
lea esp, [esp]
jnp 0x513dba
js 0x513dbd
mov ebp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4