joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479bc8
Capabilities:
Set registry value

Disassembly:
jo 0x479975
jmp 0x479981
add byte [ebp - 0x717af040], al
add eax, dword [eax]
add byte [ebp - 0x7274ee90], cl
in al, 0xde
invalid
mov ecx, dword [ebp - 0x211c]
call fcn.004f2428
pushfd
mov al, byte [edi]
add byte [ebx - 0x211b73], cl
dec dword [ebp - 0x20137b]
call dword [eax - 0x18]
in al, dx
mov al, byte [edi]
add byte [ebp + 0x6b880fc0], al
add eax, dword [eax]
invalid
cmp esi, 0x13
ja 0x479ba4
je 0x479b5b
cmp esi, 8
lea eax, [ebp - 0x212c]
push eax
push 0
push 0
lea eax, [ebp - 0x2014]
push eax
call dword [0x5c33ec]
test eax, eax
js 0x479d11
mov eax, dword [ebp - 0x212c]
push 4
mov dword [ebp - 0x2128], eax
lea eax, [ebp - 0x2128]
push eax
push 4
push 0
push ebx
push dword [edi]
call dword [0x5c3054]
mov edi, eax
jmp 0x479ce3
aas
add dword [eax], eax
invalid
cmp esi, 0x4008
jne 0x479cf0
lea eax, [ebp - 0x2014]
push eax
call fcn.0054d31f
add esp, 4
mov dword [ebp - 0x2118], 0xff
add byte [ebx + 0x2b902c0], al
add byte [eax], al
add bh, al
inc ebp
cld
add byte [eax], al
add byte [eax], al
mul ecx
mov byte [ebp - 4], 1
test edx, edx
jne 0x479d2f
cmp eax, 0xffffffff
ja 0x479d2f
cmp eax, 0x100
jbe 0x479c04
push eax
lea ecx, [ebp - 0x2118]
call fcn.00481bd0
jmp 0x479c24
lea esi, [ebp - 0x2114]
mov dword [ebp - 0x2118], esi
jmp 0x479c2a
mov esi, dword [ebp - 0x2118]
test esi, esi
je 0x479cc9
add byte [eax], al
cmp word [ebp - 0x2014], 0
lea edi, [ebp - 0x2014]
je 0x479c76
push edi
call dword [0x5c3514]
movzx ecx, word [edi]
cmp ecx, 0x5c
jne 0x479c67
cmp word [eax], 0x30
jne 0x479c67
xor ecx, ecx
push eax
mov word [esi], cx
call dword [0x5c3514]
mov edi, eax
jmp 0x479c6d
mov word [esi], cx
add edi, 2
add esi, 2
cmp word [edi], 0
jne 0x479c42
xor eax, eax
mov dword [esi], eax
mov esi, dword [ebp - 0x2118]
test esi, esi
jne 0x479c89
lea edi, [eax + 0xd]
jmp 0x479cce
xor ebx, ebx
mov edi, esi
nop dword [eax]
push edi
call fcn.0054d3f9
inc eax
add esp, 4
lea edi, [edi + eax*2]
lea ebx, [ebx + eax*2]
cmp eax, 1
jne 0x479c90
mov eax, dword [ebp - 0x2124]
push ebx
push esi
push 7
push 0
push dword [ebp - 0x2120]
push dword [eax]
call dword [0x5c3054]
mov esi, dword [ebp - 0x2118]
mov edi, eax
jmp 0x479cce
mov edi, 0xe
lea eax, [ebp - 0x2114]
cmp esi, eax
je 0x479ce3
lea ecx, [ebp - 0x2118]
call fcn.00481b10
push 0x80070216
call fcn.004bc165
nop dword [eax]
scasb al, byte es:[edi]
lcall 71, 0x9ab30047
mov eax, 0xbd00479a
lcall 0, 0x47
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add dword [ecx], eax
add dword [ecx], eax
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add al, byte [edx]
add al, byte [edx]
add cl, ah
int3
Function at 0x479c58
Capabilities:
Set registry value

Disassembly:
jo 0x479975
jmp 0x479981
add byte [ebp - 0x717af040], al
add eax, dword [eax]
add byte [ebp - 0x7274ee90], cl
in al, 0xde
invalid
mov ecx, dword [ebp - 0x211c]
call fcn.004f2428
pushfd
mov al, byte [edi]
add byte [ebx - 0x211b73], cl
dec dword [ebp - 0x20137b]
call dword [eax - 0x18]
in al, dx
mov al, byte [edi]
add byte [ebp + 0x6b880fc0], al
add eax, dword [eax]
invalid
cmp esi, 0x13
ja 0x479ba4
je 0x479b5b
cmp esi, 8
lea eax, [ebp - 0x212c]
push eax
push 0
push 0
lea eax, [ebp - 0x2014]
push eax
call dword [0x5c33ec]
test eax, eax
js 0x479d11
mov eax, dword [ebp - 0x212c]
push 4
mov dword [ebp - 0x2128], eax
lea eax, [ebp - 0x2128]
push eax
push 4
push 0
push ebx
push dword [edi]
call dword [0x5c3054]
mov edi, eax
jmp 0x479ce3
aas
add dword [eax], eax
invalid
cmp esi, 0x4008
jne 0x479cf0
lea eax, [ebp - 0x2014]
push eax
call fcn.0054d31f
add esp, 4
mov dword [ebp - 0x2118], 0xff
add byte [ebx + 0x2b902c0], al
add byte [eax], al
add bh, al
inc ebp
cld
add byte [eax], al
add byte [eax], al
mul ecx
mov byte [ebp - 4], 1
test edx, edx
jne 0x479d2f
cmp eax, 0xffffffff
ja 0x479d2f
cmp eax, 0x100
jbe 0x479c04
push eax
lea ecx, [ebp - 0x2118]
call fcn.00481bd0
jmp 0x479c24
lea esi, [ebp - 0x2114]
mov dword [ebp - 0x2118], esi
jmp 0x479c2a
mov esi, dword [ebp - 0x2118]
test esi, esi
je 0x479cc9
add byte [eax], al
cmp word [ebp - 0x2014], 0
lea edi, [ebp - 0x2014]
je 0x479c76
push edi
call dword [0x5c3514]
movzx ecx, word [edi]
cmp ecx, 0x5c
jne 0x479c67
cmp word [eax], 0x30
jne 0x479c67
xor ecx, ecx
push eax
mov word [esi], cx
call dword [0x5c3514]
mov edi, eax
jmp 0x479c6d
mov word [esi], cx
add edi, 2
add esi, 2
cmp word [edi], 0
jne 0x479c42
xor eax, eax
mov dword [esi], eax
mov esi, dword [ebp - 0x2118]
test esi, esi
jne 0x479c89
lea edi, [eax + 0xd]
jmp 0x479cce
xor ebx, ebx
mov edi, esi
nop dword [eax]
push edi
call fcn.0054d3f9
inc eax
add esp, 4
lea edi, [edi + eax*2]
lea ebx, [ebx + eax*2]
cmp eax, 1
jne 0x479c90
mov eax, dword [ebp - 0x2124]
push ebx
push esi
push 7
push 0
push dword [ebp - 0x2120]
push dword [eax]
call dword [0x5c3054]
mov esi, dword [ebp - 0x2118]
mov edi, eax
jmp 0x479cce
mov edi, 0xe
lea eax, [ebp - 0x2114]
cmp esi, eax
je 0x479ce3
lea ecx, [ebp - 0x2118]
call fcn.00481b10
push 0x80070216
call fcn.004bc165
nop dword [eax]
scasb al, byte es:[edi]
lcall 71, 0x9ab30047
mov eax, 0xbd00479a
lcall 0, 0x47
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add dword [ecx], eax
add dword [ecx], eax
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add al, byte [edx]
add al, byte [edx]
add cl, ah
int3

Function at 0x47a440
Capabilities:
Delete registry value

Disassembly:
mov al, byte [edi]
add byte [ebx + 0xff685f0], cl
mov byte [esi + 0x66000009], ah
cmp dword [edi], 0x7d
je 0x47ade0
nop word [eax + eax]
Function at 0x47a4a0
Capabilities:
Delete registry value

Disassembly:
call fcn.004f2f91
mov esi, eax
test esi, esi
js 0x47ade0
cmp dword [ebp + 0x10], 0
je 0x47a5a2
movzx ecx, word [edi]
mov eax, edi
mov dword [ebp - 0x2248], 0

Function at 0x47a4c8
Capabilities:
Delete registry value

Disassembly:
mov dword [ebp - 0x2240], 0
test cx, cx
je 0x47a501
mov edx, ecx
nop dword [eax]
cmp dx, 0x5c
je 0x47a4f9
push eax
call dword [0x5c3514]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x47a4e0
jmp 0x47a501
test eax, eax
jne 0x47adc9
invalid
mov esi, 0x5e4e00
push dword [esi]
push edi
call dword [0x5c3334]
test eax, eax
je 0x47a554
add esi, 4
cmp esi, 0x5e4e30
jl 0x47a506
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2248]
call dword [edi - 0x77]
test dword [eax - 0x38000023], edi
test dword [ebp + ebx*8 + 0xffff], edi
add byte [eax], al
call fcn.004f278c
mov dword [ebp - 0x2248], 0
mov dword [ebp - 0x2240], 0
cmp dword [ebp - 0x2238], 0
je 0x47a598
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.004f3055
mov esi, eax
test esi, esi
js 0x47ade0
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.004f374b
mov esi, eax
test esi, esi
js 0x47ade0
mov dword [ebp - 0x2244], 0
jmp 0x47aa1b
mov dword [ebp - 0x2244], 0

Function at 0x47a678
Capabilities:
Delete registry value

Disassembly:
mov dword [ebp - 0x224c], 0
test esi, esi
js 0x47ade0
mov byte [ebp - 4], 0
mov dword [ebp - 0x2250], 0
jmp 0x47aa1b

Function at 0x47a6d8
Capabilities:
Delete registry value

Disassembly:
mov byte [ebp - 4], 0
test eax, eax
jne 0x47adb3
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [0x5c3050]
test eax, eax
je 0x47a6ff
cmp eax, 2
jne 0x47adb3
test ebx, ebx
je 0x47a70a
push ebx
call dword [0x5c304c]
mov ecx, eax
call fcn.004f2c56
mov esi, eax
test ebx, ebx
je 0x47ade0
push ebx
call dword [0x5c304c]
jmp 0x47ade0

Function at 0x47a828
Capabilities:
Delete registry value

Disassembly:
je 0x47a9da
mov byte [ebp - 4], 4
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x47a8a8
cmp dword [esi], 0
je 0x47a89b
push 0x5e22bc
call dword [0x5c33b0]
test eax, eax
jne 0x47a85e
mov eax, 1
jmp 0x47a8ee
push str.RegOpenKeyTransactedW
push eax
call dword [0x5c3148]
mov esi, eax
test esi, esi
je 0x47a8a1
mov eax, dword [ebp - 0x2228]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x221c]
push eax
push 0x20019
cmp dword [esi + 4], 0
jne 0x47a8a8
mov eax, 1
jmp 0x47a8c3
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x5c3044]

Function at 0x47a888
Capabilities:
Delete registry value

Disassembly:
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x5c3794]
call esi
jmp 0x47a8c3
test eax, eax
jne 0x47a8e8
test ebx, ebx
je 0x47a8d2
push ebx
call dword [0x5c304c]
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], 0
mov esi, dword [ebp - 0x2228]
invalid
inc ebp

Function at 0x47a918
Capabilities:
Delete registry value

Disassembly:
mov al, 0x33
pop esp
add byte [ebp - 0x47f58a40], al
add dword [eax], eax
add byte [eax], al
Function at 0x47a978
Capabilities:
Delete registry value

Disassembly:
jne 0x47a981
mov eax, 1
jmp 0x47a9a9
lea eax, [ebp - 0x223c]
push eax
lea eax, [ebp - 0x221c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x5c305c]
test eax, eax
jne 0x47a9ce
test ebx, ebx
je 0x47a9b8
push ebx
call dword [0x5c304c]
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], 0
mov byte [ebp - 4], 0
test eax, eax
jne 0x47add7
mov ecx, dword [ebp - 0x2224]

Function at 0x47a9e0
Capabilities:
Delete registry value

Disassembly:
push edi
call fcn.004f34d2
mov esi, eax
test esi, esi
js 0x47ade0
cmp word [edi], 0x3d
jne 0x47aa1b
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2230]
push edi
push 0
push eax
invalid
pushfd

Function at 0x47acd8
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov dword [ebp - 0x2238], eax
xor eax, eax
test ebx, ebx
je 0x47acf5
push ebx
call dword [0x5c304c]
mov dword [ebp - 0x2230], 0
mov dword [ebp - 0x222c], 0
test eax, eax
jne 0x47add7
cmp dword [ebp - 0x2234], eax
invalid
invalid
invalid
Function at 0x498a5f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmovle edx, dword [edi + 8]
inc esi
mov eax, edx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
add edi, 0x18
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
inc eax
mov dword [esp + 0x48], eax
dec eax
cmp eax, dword [esp + 0x64]
jl 0x498a20

Function at 0x498a84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
jmp 0x498a9e

Function at 0x498c3e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
call dword [0x5c34c8]
push 2
lea eax, [esp + 0x84]
push eax
mov eax, dword [esp + 0x58]
push dword [eax + 4]
push 0
call dword [0x5c3470]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x84]
push 0x16
mov edx, dword [eax + 0x10]
mov eax, dword [esp + 0x3c]
sub edx, dword [eax + 8]
mov eax, dword [esp + 0x90]
add edx, dword [esp + 0x74]
sub eax, ecx
push eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x90], edx
sub edx, eax
push edx
push ecx
push eax
push 0
push esi
call dword [0x5c34b8]
mov esi, dword [esp + 0x38]

Function at 0x498d05
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub eax, ecx
push eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x18]
inc esp
and al, 0x18
sub eax, dword [edx + 0x74]
sub eax, ecx
add eax, dword [esp + 0x44]
push eax
mov eax, dword [esi + 0xc]
sub eax, ecx
push eax
call dword [0x5c33ac]
mov ecx, dword [esp + 0x4c]
add eax, ecx
mov edx, dword [esi + 4]
mov dword [esp + 0x74], eax
test dl, 2
je 0x498e02
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push dword [esp + 0x58]
sub eax, dword [edx + 0x74]
sub eax, ecx
add eax, dword [esp + 0x44]
push eax
mov eax, dword [esi + 0x14]
sub eax, ecx
push eax
call dword [0x5c33ac]
add eax, dword [esp + 0x4c]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x54]
test eax, eax
je 0x498dfd
push dword [eax]
mov eax, dword [esp + 0x54]
push dword [eax + 4]
call dword [0x5c3450]
mov esi, eax
xorps xmm0, xmm0
lea eax, [esp + 0x90]
movaps xmmword [esp + 0x90], xmm0
push eax
push esi
call dword [0x5c34c8]
push 2
lea eax, [esp + 0x94]
push eax
mov eax, dword [esp + 0x58]
push dword [eax + 4]
push 0
call dword [0x5c3470]
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x94]
push 0x16
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x3c]
sub ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x78]
add eax, ecx
mov ecx, dword [esp + 0x94]
mov dword [esp + 0xa0], eax
sub eax, edx
push eax
mov eax, dword [esp + 0xa0]
sub eax, ecx
push eax
push edx
push ecx
push 0
push esi
call dword [0x5c34b8]
mov esi, dword [esp + 0x38]
mov edx, dword [esi + 4]
jmp 0x498e0c
sub eax, dword [esi + 0xc]
add eax, dword [esi + 0x14]
Function at 0x504538
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [ebp - 0x3e98]
mov byte [ebp - 4], 0x3a
call fcn.0054e0c3
push 0x671870
lea ecx, [ebp - 0x3e80]
inc esi
inc ebp
cld
cmp ebp, eax
cld
wait
add al, 0
push 0x671d38
lea ecx, [ebp - 0x3e68]
mov byte [ebp - 4], 0x3c
call fcn.0054e0eb
push 0x674060
lea ecx, [ebp - 0x3e50]
mov byte [ebp - 4], 0x3d
call fcn.0054e0ff
push 0x673c28
lea ecx, [ebp - 0x3e38]
mov byte [ebp - 4], 0x3e
call fcn.0054e113
push 0x672218
and ah, byte [edi]
lea ecx, [ebp - 0x3e20]
mov byte [ebp - 4], 0x3f
call 0x54e127
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x3e08]
push 0x670328
add al, ch
cld
wait
add al, 0
push 0x672da0
lea ecx, [ebp - 0x3df0]
mov byte [ebp - 4], 0x41
call 0x54e14f
push 0x670fa0
packuswb mm0, qword [eax]
lea ecx, [ebp - 0x3dd8]
mov byte [ebp - 4], 0x42
call fcn.0054e163
push 0x671fd8
lea ecx, [ebp - 0x3dc0]
mov byte [ebp - 4], 0x43
inc ebx
call fcn.0054e177
push 0x673f40
lea ecx, [ebp - 0x3da8]
mov byte [ebp - 4], 0x44
call fcn.0054e18b
push 0x671960
lea ecx, [ebp - 0x3d90]
mov byte [ebp - 4], 0x45
call fcn.0054e19f
push 0x671618

Function at 0x504555
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [ebp - 0x3e98]
mov byte [ebp - 4], 0x3a
call fcn.0054e0c3
push 0x671870
lea ecx, [ebp - 0x3e80]
inc esi
inc ebp
cld
cmp ebp, eax
cld
wait
add al, 0
push 0x671d38
lea ecx, [ebp - 0x3e68]
mov byte [ebp - 4], 0x3c
call fcn.0054e0eb
push 0x674060
lea ecx, [ebp - 0x3e50]
mov byte [ebp - 4], 0x3d
call fcn.0054e0ff
push 0x673c28
lea ecx, [ebp - 0x3e38]
mov byte [ebp - 4], 0x3e
call fcn.0054e113
push 0x672218
and ah, byte [edi]
lea ecx, [ebp - 0x3e20]
mov byte [ebp - 4], 0x3f
call 0x54e127
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x3e08]
push 0x670328
add al, ch
cld
wait
add al, 0
push 0x672da0
lea ecx, [ebp - 0x3df0]
mov byte [ebp - 4], 0x41
call 0x54e14f
push 0x670fa0
packuswb mm0, qword [eax]
lea ecx, [ebp - 0x3dd8]
mov byte [ebp - 4], 0x42
call fcn.0054e163
push 0x671fd8
lea ecx, [ebp - 0x3dc0]
mov byte [ebp - 4], 0x43
inc ebx
call fcn.0054e177
push 0x673f40
lea ecx, [ebp - 0x3da8]
mov byte [ebp - 4], 0x44
call fcn.0054e18b
push 0x671960
lea ecx, [ebp - 0x3d90]
mov byte [ebp - 4], 0x45
call fcn.0054e19f
push 0x671618
Function at 0x504664
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax + 0x50], ch
sbb ah, byte [edi]
lea ecx, [ebp - 0x3cd0]
mov byte [ebp - 4], 0x4d
call fcn.0054e23f
push 0x671d98
lea ecx, [ebp - 0x3cb8]
mov byte [ebp - 4], 0x4e
call fcn.0054e253
push 0x673c58
lea ecx, [ebp - 0x3ca0]
mov byte [ebp - 4], 0x4f
cld
dec edi
call fcn.0054e267
push 0x670ca0
lea ecx, [ebp - 0x3c88]
mov byte [ebp - 4], 0x50
call fcn.0054e27b
push 0x673ca0
lea ecx, [ebp - 0x3c70]
mov byte [ebp - 4], 0x51
call fcn.0054e28f
push 0x670a18
lea ecx, [ebp - 0x3c58]
mov byte [ebp - 4], 0x52
call fcn.0054e2a3
push 0x671d80
lea ecx, [ebp - 0x3c40]
mov byte [ebp - 4], 0x53
call fcn.0054e2b7
push 0x670118
sbb byte [ecx], al
add byte [di - 0x2773], cl
ret
invalid
inc esi
inc ebp
cld
push esp
call fcn.0054e2cb
wait
add al, 0
push 0x672e18
lea ecx, [ebp - 0x3c10]
mov byte [ebp - 4], 0x55
call fcn.0054e2df
push 0x673e98
lea ecx, [ebp - 0x3bf8]
mov byte [ebp - 4], 0x56
call fcn.0054e2f3
push 0x6735b0
lea ecx, [ebp - 0x3be0]
mov byte [ebp - 4], 0x57
call fcn.0054e307
push 0x6701c0
lea ecx, [ebp - 0x3bc8]
mov byte [ebp - 4], 0x58
call 0x54e31b
push 0x671a08
invalid
invalid

Function at 0x5048cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [ebp - 0x39e8]
mov byte [ebp - 4], 0x6c
call fcn.0054e4ab
push 0x671ca8
lea ecx, [ebp - 0x39d0]
mov byte [ebp - 4], 0x6d
call fcn.0054e4bf
push 0x670880
lea ecx, [ebp - 0x39b8]
inc esi
inc ebp
cld
outsb dx, byte [esi]
call fcn.0054e4d3
push 0x672d40
lea ecx, [ebp - 0x39a0]
mov byte [ebp - 4], 0x6f
call fcn.0054e4e7
push 0x671600
lea ecx, [ebp - 0x3988]
mov byte [ebp - 4], 0x70
call fcn.0054e4fb
mov byte [ebp - 4], 0x71
push 0x673058
lea ecx, [ebp - 0x3970]
call fcn.0054e50f
add al, 0
push 0x6738f8
lea ecx, [ebp - 0x3958]
mov byte [ebp - 4], 0x72
call fcn.0054e523
push 0x670970
invalid

Function at 0x504911
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [ebp - 0x39e8]
mov byte [ebp - 4], 0x6c
call fcn.0054e4ab
push 0x671ca8
lea ecx, [ebp - 0x39d0]
mov byte [ebp - 4], 0x6d
call fcn.0054e4bf
push 0x670880
lea ecx, [ebp - 0x39b8]
inc esi
inc ebp
cld
outsb dx, byte [esi]
call fcn.0054e4d3
push 0x672d40
lea ecx, [ebp - 0x39a0]
mov byte [ebp - 4], 0x6f
call fcn.0054e4e7
push 0x671600
lea ecx, [ebp - 0x3988]
mov byte [ebp - 4], 0x70
call fcn.0054e4fb
mov byte [ebp - 4], 0x71
push 0x673058
lea ecx, [ebp - 0x3970]
call fcn.0054e50f
add al, 0
push 0x6738f8
lea ecx, [ebp - 0x3958]
mov byte [ebp - 4], 0x72
call fcn.0054e523
push 0x670970
invalid
Function at 0x51b0d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ebx
add al, 0x2b
ror dword [ecx - 0x3ed7dbac], 0xf8
add ch, byte [ecx - 0x40]
stosd dword es:[edi], eax
stosb byte es:[edi], al
stosb byte es:[edi], al
stosb byte es:[edi], al
mov dword [esp + 0x1c], edx
mov dword [esp + 0x30], esi
test eax, eax
je 0x51b203
nop dword [eax]
nop dword [eax + eax]

Function at 0x51b163
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [edi], cl
dec edi
mov word [esp + edx*4], fs
add byte [eax], al
add byte [ebx + 0x4408b10], cl

Function at 0x51b33f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor al, 0x8b
je 0x51b367
adc byte [ebx], al
invalid
adc cl, byte [ebx + 0x5208384c]

Function at 0x51b3dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [eax]
add eax, 0x34
cmp dword [eax + 0x14], 0x10
jb 0x51b3b4
mov eax, dword [eax]
push eax
call 0x666b26
mov dword [esp + 0xc], eax
test eax, eax
je 0x51b3de
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x5c3794]
mov ecx, dword [esp + 0xc]
call esi
cmp eax, 6
je 0x51b4c7
add byte [eax], al
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
mov ecx, dword [eax + edi + 8]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
add eax, 0x34
cmp dword [eax + 0x14], 0x10
jb 0x51b3f9
mov eax, dword [eax]
push eax
call 0x666b6b

Function at 0x51b56f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub edx, ecx
add edx, 0xffffffec
test esi, esi
je 0x51b72e
mov eax, dword [esp + 0x38]
cmp eax, edx
push 0
push dword [esp + 0x58]
cmovle eax, edx
push eax
mov eax, dword [esp + 0x68]
add eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x68]
add eax, ecx
push eax
push 1
push dword [esi + 4]
call dword [0x5c34b8]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
add eax, 9
add eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
jmp 0x51b1e2
Function at 0x51b6a5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
pop es
add byte [ebx + 0x408bf447], cl
add al, 0x8b
dec esp
cmp al, bh

Function at 0x51b74f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x8b
or ebp, dword [ebx]
rol ecx, 0xf8
add ch, byte [ecx - 0x40]
stosd dword es:[edi], eax

Function at 0x51b87f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [esp + 0x20], eax
jb 0x51b7f0
jmp 0x51b72b

Function at 0x51cb69
Capabilities:
Encode data using base64

Disassembly:
inc eax
arpl word [eax], ax
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax

Function at 0x51cb78
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x24], ebx
push 0
call dword [0x5c3358]
mov eax, dword [ebp + 8]

Function at 0x51cb8b
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebx], 0
test eax, eax
je 0x51ce18
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x44], eax
call 0x5f0065
add esp, 4
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x40]
push eax
push 4
push 0
push 0
push 0
add byte [edx], ch
lea eax, [ebp - 0x48]
push eax
call dword [0x5c30c8]
test eax, eax
je 0x51ce18
mov eax, dword [ebp - 0x40]
lea eax, [eax*2 + 8]
mov dword [ebp - 0x2c], eax
inc eax
push eax
call 0x5e1d6c
mov edi, dword [ebp - 0x3c]
mov esi, eax
mov dword [ebx], esi
add esp, 4
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x51ce2c

Function at 0x51cbff
Capabilities:
Encode data using base64

Disassembly:
mov eax, ebx
mov ecx, 4
imul ecx
test edx, edx
jg 0x51ce59
jl 0x51cc1d
cmp eax, 0x7fffffff
ja 0x51ce59
push 0
push 3
push edx
push eax
call 0x612bf4
mov ecx, eax
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
call 0x8a13cf58
inc ebp
invalid
lea edx, [eax + eax*2]
adc al, 0x40
mov eax, ebx
sub eax, edx
mov dword [ebp - 0x38], edx
add ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
pop ds
add ebx, edx
mov edx, ecx
imul eax, ebx, 0x4c
sub edx, eax
je 0x51cc7b
and edx, 0x80000003
jns 0x51cc70
dec edx
or edx, 0xfffffffc
add edx, 1
je 0x51cc7b
mov eax, 4
sub eax, edx
add ecx, eax
lea ecx, [ecx + ebx*2]
add ecx, 2
cmp dword [ebp - 0x2c], ecx
jl 0x51ce2c
mov ecx, dword [ebp - 0x28]
mov eax, 0x6bca1af3
shl ecx, 2
xor ebx, ebx
imul ecx
mov dword [ebp - 0x30], ecx
xor ecx, ecx
sar edx, 5
add eax, 0x4d89c28b
loopne 0x51cc68
invalid
pop ds
push esi
call 0x5e1c04
mov eax, dword [ebp - 0x24]
add esp, 4
mov dword [eax], 0
jmp 0x51ce0f
push 0x80004005
call fcn.0055f28f
int3