joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1877
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x3bd08]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3f
ja 0x4f1a95
mov esi, 0xbc4402d9
dec esp
pushfd
fdivp st(0)
mov edi, 0x33f43018
shl dword [ebp - 2], 0x54
in eax, 0xa7
insb byte es:[edi], dx
stosd dword es:[edi], eax
aaa
out dx, al
daa
adc al, 0x72
adc eax, 0x333f7366
mov esp, 0x552859a3
scasd eax, dword es:[edi]
out dx, eax
jbe 0x4f193c
inc ebp
dec edx
push ebx
popal
scasd eax, dword es:[di]
cld
sbb ah, byte [edi + eax*4 + 0x4b]
out 7, eax
mov ebp, 0x680eba8c
invalid
mov ebp, 0x1ecf940d
loope 0x4f197e
push ecx
ljmp 0xf715
jbe 0x4f196e
pop esp
shr cl, 0x1f
pop esp
cmp dl, byte [edx - 0x60]
loop 0x4f1902
imul ebp, dword [ecx], 0x12
and byte [edi], al
int3
add al, byte [eax]
lcall 0x640e, 0xfa6863c0
loopne 0x4f19ae
mov ss, ebx
or dl, cl
adc al, byte [ebp - 0x61ec58b]
mov ebx, 0xcb3867c4
insb byte es:[edi], dx
sub bh, bh
sub byte [edi], 0x20
je 0x4f192a
and byte [esi], 0x18
add dword [esi + 0x1b1a0438], esi
inc eax
mov ebp, eax
ret
mov ds, ecx
xor al, 0xa3
inc ebx
dec ecx
jge 0x4f19b4
push edx
mov esp, 0xc965707d
shl byte [esi - 0x3c5496fc], 0x59
lodsb al, byte [esi]
pop edi
outsd dx, dword [esi]
stosd dword es:[edi], eax
loopne 0x4f193c
add al, 0x69
stosd dword es:[edi], eax
ret
pop ecx
mov esi, 0xefeec377
push esp
sbb dl, byte [ebp - 0x52]
js 0x4f1962
invalid
pushal
or esp, dword [ebx - 0xd017bb9]
push ds
push ds
out dx, eax
das
inc edi
mov eax, dword [0xe2a1ba1d]
lodsb al, byte [esi]
pop esp
sbb dword [edi - 0x423ad9e8], esp
retf 0xdc79
mov ecx, dword [ebp + 8]
push 5
pop edx
cmp dword [ecx], edx
jae 0x4f1aa3
mov eax, edx
jmp 0x4f1afb
mov al, byte [edi + 0x325a0]
imul dl
add al, byte [edi + 0x3259c]
mov dword [ecx], edx
mov cl, 9
imul cl
add al, byte [edi + 0x32598]
push 0xb
mov byte [ebx], al
pop ecx
push 2
pop eax
shl eax, cl
cmp esi, eax
jbe 0x4f1ae0
push 3
pop eax
shl eax, cl
cmp esi, eax
jbe 0x4f1adc
inc ecx
cmp ecx, 0x1e
jle 0x4f1ac2
jmp 0x4f1ae5
push 3
jmp 0x4f1ae2
push 2
pop esi
shl esi, cl
xor edx, edx
mov ecx, edx
mov eax, esi
shr eax, cl
add ecx, 8
inc edx
mov byte [ebx + edx], al
cmp ecx, 0x20
jl 0x4f1ae9
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4f350d
Capabilities:
Check for software breakpoints
Check for time delay via gettickcount

Disassembly:
pop ebx
mov edi, 0xd815ff56
rcl byte [eax + eax - 0x75], cl
dec ebp
or byte [edi], cl
mov bh, 1
cmp eax, 0x13
jg 0x4f2991
cmp eax, 0x10
jge 0x4f29a0
clc
adc byte [ebp + 0x30], bh
cmp eax, 2
jl 0x4f2984
cmp eax, 7
jle 0x4f29a0
cmp eax, 9
jle 0x4f2984
cmp eax, 0xb
jle 0x4f29a0
push ecx
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
pop esi
pop ebp
ret 4
cmp eax, 0x15
jl 0x4f2984
cmp eax, 0x17
jle 0x4f29a0
cmp eax, 0x40
jne 0x4f2984
push 0x10
push ecx
push esi
call fcn.004193d0
add esp, 0xc
xor eax, eax
jmp 0x4f298c
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x64
ja 0x4f2bc1
sbb eax, 0x2f77e596
out dx, al
insb byte es:[edi], dx
outsd dx, dword [esi]
in al, 0x3c
jle 0x4f2957
loop 0x4f296c
xchg edx, eax
hlt
movzx eax, word [esi]
cmp eax, 0x13
jg 0x4f2beb
cmp eax, 0x10
jge 0x4f2bfa
cmp eax, 2
jl 0x4f2be2
cmp eax, 7
jle 0x4f2bfa
cmp eax, 9
jle 0x4f2be2
cmp eax, 0xb
jle 0x4f2bfa
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
pop esi
ret
cmp eax, 0x15
jl 0x4f2be2
cmp eax, 0x17
jle 0x4f2bfa
cmp eax, 0x40
jne 0x4f2be2
xor eax, eax
mov dword [esi], eax
pop esi
ret
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x17
ja 0x4f371e
wait
outsd dx, dword [esi]
pop esp
or byte [ecx + 0x63053359], bl
sti
mov eax, dword [edx - 0x1408364]
sbb ch, byte [edi - 0x19]
mov byte [edi + 0x57], 0x69
mov esi, 0x496d694d
das
jge 0x4f357f
in al, 0x5b
cmp eax, 0x26ed3771
and byte [edx], dh
and eax, 0xbdf2b444
cmp al, 0xcc
in al, 0x79
nop
ja 0x4f3580
call [edi]
cmpsd dword [esi], dword es:[edi]
dec eax
jmp 0x1a401948
cli
push 0x1e
cmpsd dword [esi], dword es:[edi]
or al, 0x11
aad 0xba
imul ebp, dword [ebp - 0x66], 0x28
sub dword [eax - 0x5a], ebx
xlatb
call 0x3fa78492
cmpsd dword [esi], dword es:[edi]
test byte [ecx + 0x60], ah
shl dword [eax + 0x6182f87d], 1
add dl, byte [edi - 0x24]
inc ebx
sal edx, 1
mov byte [0x48da6408], al
cmp ebx, dword [ebx - 0x4e1b5cfc]
leave
jb 0x4f360b
cli
inc edi
xor dword [edi + edi*2 - 0x178f1c93], ebp
push edx
setp byte [eax + 0x33c109cb]
cmp al, 0x72
invalid
test eax, 0x8d0d1a5a
das
push esp
jbe 0x4f3663
cmp al, byte [esi - 0x513f78d4]
invalid
cmpsb byte [esi], byte es:[edi]
salc
int 2
add al, 0x4d
neg byte [0xbf797934]
adc dl, ah
invalid
mov ecx, esi
pop esi
jmp 0x4f29b0
Function at 0x4fca3a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 4
ja 0x4fca82
pop ebp
dec esi
fidiv word [ecx - 0x5b]
xor al, 0x30
mov dl, 0x82
std
cmc
aas
adc byte [esi + edi - 0x45], 0x46
xchg ebp, eax
push es
add al, 0xc8
xor al, byte [edi]
mov ecx, 0xfad355bd
push esp
invalid
xor esi, esi
cmp dword [edi + 8], esi
jle 0x4fcab8
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 0xc]
mov edx, esi
cmp dword [eax], ecx
jne 0x4fca9a
cmp dword [eax + 4], edx
je 0x4fcaa5
inc esi
add eax, 8
cmp esi, dword [edi + 8]
jl 0x4fca91
jmp 0x4fcab8
push edx
push ecx
mov ecx, ebx
call fcn.00410cfc
mov eax, dword [edi]
push 1
push esi
mov ecx, edi
call dword [eax + 4]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4fd81f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x54a70b
call fcn.0054565c
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x11
ja 0x4fda42
fild qword [eax - 0x2418e801]
invalid
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
xor eax, eax
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov byte [ebx], cl
cmp byte [ebp + 8], cl
je 0x4fda95
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], ecx
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push edi
call dword [eax + 0x18]
mov edi, eax
test edi, edi
jne 0x4fda8b
cmp word [ebp - 0x20], 0x40
jne 0x4fdaa4
or eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov byte [ebx], 1
xor edi, edi
lea ecx, [ebp - 0x20]
call fcn.004f350d
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
cmp word [ebp - 0x20], 0
je 0x4fda89
mov edi, 0x80070057
jmp 0x4fda8b
Function at 0x500c15
Capabilities:
Check for time delay via gettickcount

Disassembly:
xchg ebp, eax
cmp eax, 0xb39672c1
sub dword [eax], edx
jb 0x500c37
nop
cmp dword [ecx], esp
int1
push esi
pop eax
push esi
push edi
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x67
ja 0x500e29
scasb al, byte es:[edi]
into
jns 0x500c36
cwde
pushal
adc al, byte [edi + 0x6723ee77]
loop 0x500bfe
invalid
pop dword [edi + 0x426ad191]
mov edi, 0xd2e6736a
jo 0x500c24
push 0x56599a3e
cmpsd dword [esi], dword es:[edi]
or eax, dword [esi + 0xc]
inc esi
daa
dec ebp
sub ecx, dword [ebp + 0xe4717a4]
in al, 0x53
loopne 0x500bf4
cmp dh, 0x94
movsb byte es:[edi], byte [esi]
sub esp, ecx
xchg edx, eax
invalid
xor eax, eax
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x18]
pop esi
jmp 0x50206f
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x36
ja 0x502280
jle 0x5020d3
push dword [ebx - 0xe1b2c42]
jle 0x5020f8
enter 0xffffffffffffc46f, 0xffffffffffffff9a
test dword [ecx - 0x6fd3e62a], esi
cld
lahf
out dx, al
mov eax, dword [edi + 0x125e3dcc]
pop esi
salc
or byte [ebp + 0x3767e322], ah
movsd dword es:[edi], dword [esi]
out dx, eax
ret
cmp bl, cl
rol dword [ebx + 0x3d], 0xbd
sub byte [ebp + 0xc46dcf3], dl
pop esp
jne 0x502112
add al, 0xf9
push eax
salc
sbb byte [esi - 0x1bd25770], al
fcmovbe st(0), st(7)
mov bl, 0x57
mov ecx, 0x41f127d5
jne 0x5020c2
dec esi
inc ebp
cld
and cl, 0x1e
leave
push eax
adc edi, ecx
sub dword [ebp + 0x23620428], ebx
inc eax
mul byte [edx]
push 0x1a
lahf
ret 0x7af4
inc edx
cmp eax, esi
xor eax, 0x38a33c68
int3
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
pop esi
ret

Function at 0x500e43
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x58
ja 0x501058
cmp eax, 0xaa85ec26
pop ecx
and eax, 0x433300ad
invalid
lea edi, [esi + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x38], 0
jne 0x50106b
mov dword [esi + 0x38], ebx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret
Function at 0x50228c
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push es
lodsd eax, dword [esi]
add ecx, dword [ebp]
in al, 0x30
xchg esp, eax
add edx, dword [ecx + esi - 0x67acf165]
mov esi, 0x2daf77de
mov ah, 0xce
pop edi
aas
pop eax
nop
push eax
or dword [esi - 0x6f], ebx
push edx
xor byte [eax + 0x2cfbfcbb], ch
mov esp, 0xfcf7ac92
cld
sti
sub al, 0xbc
xchg edx, eax
lodsb al, byte [esi]
idiv esp
sub al, 0x11
jb 0x502201
adc eax, 0x72f7e556
sbb eax, 0xd0243b39
cmp esp, dword [eax + edx*8]
add dh, byte [esi - 0x11]
mov ebp, 0x5545dbc2
out 0xda, eax
cmp ch, ch
pop ss
lodsb al, byte [esi]
loope 0x502223
fadd qword [eax]
aas
in eax, dx
dec esi
fcom qword [ebx - 5]
mov dword [esi], edi
xor byte [edi + 0x1d52045e], dl
dec ecx
or dword [eax], esi
mul byte [ebx + 0x19161491]
out 0x2b, eax
leave
pop ebp
inc esp
fdiv dword [eax + 0x64ef31b]
das
mov bl, 0x5e
sub byte [0xa1558d5d], dl
invalid
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3b
ja 0x50249f
inc ebp
cmp dword [ecx - 3], ebp
dec edx
mul byte [ebx]
cmp al, 0x84
mov dword [0xdd46664e], eax
arpl word [edi], bx
jne 0x502236
adc eax, 0x346bfb5e
ret 0x53c8
xor edi, edi
mov dword [esi + 0x18], edi
lea ebx, [esi + 0x270]
mov edx, esi
mov ecx, ebx
mov dword [ebx + 0x14], edi
call fcn.00500c15
inc edi
add ebx, 0x44
cmp edi, 0x20
jb 0x5024aa
lea ecx, [esi + 0x20]
call fcn.0050db1e
pop edi
lea ecx, [esi + 0x58]
pop esi
pop ebx
jmp fcn.0050db1e

Function at 0x503924
Capabilities:
Get common file path

Disassembly:
add byte [ecx], bh
inc edi
or byte [eax + ecx + 0x50], dh
mov ecx, edi
call fcn.0040de7a
push dword [edi]
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, edi
mov esi, eax
call fcn.00410ff9
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
mov eax, 0x54a984
call fcn.0054565c
sub esp, 0xc
push ebx
push esi
mov esi, ecx
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x47
ja 0x503b47
jb 0x5038fa
or dword [ebx - 0x3a], esi
dec ecx
mov eax, 0x1def702f
inc ebx
mov ch, 0xe0
dec ecx
add ch, cl
xor cl, dl
pop ebx
invalid
mov eax, dword [esi + 0x20]
shr eax, 4
test al, 1
lea eax, [esi + 0x28]
lea edx, [ebp + 8]
lea ecx, [ebp - 0x18]
push eax
je 0x503b6d
call fcn.00410f71
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.005048f7
jmp 0x503b79
call fcn.00410f71
mov ecx, dword [eax]
call fcn.00505529
push dword [ebp - 0x18]
mov bl, al
call fcn.00418a9a
pop ecx
pop ecx
push dword [ebp + 8]
call fcn.00418a9a
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x503b9e
Capabilities:
Create directory

Disassembly:
inc ebp
cld
add eax, ebp
mov word [0xceb0000], cs
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x54
ja 0x503daf
add byte [eax], al
add byte [edx], bl
ljmp 0xf8ac
sbb ch, dl
dec edi
adc al, 0x99
jge 0x503b63
clc
cmp bh, al
pushal
mov cl, 0xcd
inc eax
leave
test ch, 0x48
sbb eax, 0x13531f0
xchg dh, ch
rcl byte [edi - 0x23], 0x1b
fcom qword [edi + 0x1f]
into
cdq
loope 0x503c50
add eax, 0xe06f1149
loope 0x503bf0
inc ebx
or eax, 0x83d53ba2
clc
dec esi
wait
jae 0x503b88
and esp, ebp
jnp 0x503bfd
outsd dx, dword [esi]
arpl word [esi], bx
sbb bl, bl
call 0x6dabf865
jno 0x503bae
pop ebx
insd dword es:[edi], dx
push ss
imul edi, dword [ebx + 0x7b4f6e59], 0xdc090b00
or esp, ebx
imul esp, dword [esi + edi*2 + 0x3b], 0x9e06cd54
jnp 0x503baf
iretd
push cs
imul edx, edi, 0xa0716a3d
jns 0x503c7d
invalid
add esp, dword [ebx - 0x71cd363b]
jecxz 0x503c6d
mov eax, dword [0x8a8a6687]
xor al, 0x66
scasb al, byte es:[edi]
ljmp 0xb2d3
jp 0x503c87
or eax, 0x2f6d6172
jecxz 0x503c43
das
sbb ah, ah
fsub dword [edx]
inc esp
nop
adc dword [edx + 0x63], 0x68
popfd
popal
pop esp
inc ebp
out 0x1f, eax
xchg ebx, eax
xchg edx, eax
jne 0x503ce6
push 0xf957b7
fdivr dword [ecx + 0x45]
inc edi
ror al, 0x87
xor eax, 0x51d89618
fld qword [eax + 0x33]
je 0x503cb2
push cs
iretd
in eax, 0xf5
insb byte es:[edi], dx
cmp dword [esi - 0x3a], 0xb49e9265
hlt
or ecx, 0x18071c27
fistp dword [ecx + 0x79]
jge 0x503ca8
leave
daa
sbb al, 7
sbb bl, bl
pop ecx
jns 0x503d6c
mov eax, 0x679b3e5
in eax, 0xb3
jns 0x503cfa
jo 0x503ce5
imul edi, dword [ebx + ebp*2 + 0x2e], 0x62
mov ebp, 0x2230da77
bound edi, qword [ebp + 0x2230da77]
sbb eax, 0xbfbac0a9
les ebp, [ecx + 0x229ce8f]
sub edi, dword [esi]
dec ebp
jns 0x503d6b
aaa
push es
lahf
xor ecx, dword [esi]
test eax, 0x6f735286
mov gs, word [eax - 0x14]
push ds
jl 0x503d15
and ch, 0xcc
push ebx
mov ecx, 0xc6f64987
mov esp, 0xd4fdf3da
lahf
mov edi, 0x393c9d89
pop edi
xchg dword [ebp - 0x15], esi
jne 0x503d40
cld
lea ebp, [esi]
cmp byte [esi + 0x24c819cb], al
dec ecx
sbb eax, ecx
and al, 0x49
fcom qword [edx]
shl ebx, 1
imul eax, dword [edi + 0x537e3947], 0x18
imul eax, dword [ecx + 0x3e], 0xfffffff9
and dword [ebp - 0x30], ecx
popal
iretd
pop es
test eax, 0xc9e70b15
mov dl, 0x7e
mov edi, 0x38471ce
push ecx
cmp ebp, dword [ebx - 0x42]
or eax, 0xa282a677
push edi
insb byte es:[edi], dx
cmp dword [esi - 0x16a38ec4], ebx
and dword [esi + 0x61], 0xffffffa1
mov esp, 0xb472c187
pushfd
invalid
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]

Function at 0x503fde
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x51
ja 0x5041f2
add byte [esi], ah
imul edi, dword [edi + 0x141b3c4b], 0x5b
imul edi, dword es:[edi + 0x141b3c4b], 0x5b
and ah, byte [esi - 0x80]
ja 0x503ff2
retf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
pop edi
setne al
pop esi
ret
Function at 0x504c21
Capabilities:
Move file

Disassembly:
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x13
ja 0x504e35
mov word es:[esi], es
inc ebp
jne 0x504c8a
cld
hlt
cmpsd dword [esi], dword es:[edi]
mov ebx, 0x88cd27a5
les esi, [esi + 0x23]
add byte [ebx + ecx], ch
aaa
mov bh, byte [ecx - 0x57]
adc dword [ecx], esp
xchg dword [ecx + 0x14], ecx
test eax, 0x83261079
add byte [edi + 0x11], bh
pop edi
invalid
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
pop edi
setne al
pop esi
ret

Function at 0x50598d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x58
ja 0x505ba5
or byte [0xf0176e39], 0xd9
test byte [ebp - 0x411c192d], 0x69
mov al, byte [0xf9cf9489]
push ds
pop es
cmp eax, 0xf8a7f6cc
add eax, 0x1715d24f
push 0x7a500043
popfd
adc dword [ebp + 1], 0xffffff89
jnp 0x505a46
iretd
mul byte [edi + 0x44]
invalid
aad 0xe
cmp al, 0x57
test byte [edi], ch
xchg byte [eax + 0x5118343f], ch
insb byte es:[edi], dx
ja 0x505a86
mov eax, dword [0xe667e1ee]
cmpsb byte [esi], byte es:[edi]
pop esp
dec eax
xchg byte [ecx], bh
mov eax, dword [edx + 0x4b]
adc al, 0xb8
sar bh, 0xae
push cs
xchg esi, eax
cmp dword [0x8c769f08], ecx
sub dword [ebx + ebp*2 - 0x657f1125], esp
inc edi
add dword [edx + 0x13af3c24], eax
fimul word [eax]
pushfd
cdq
cmpsb byte [esi], byte es:[edi]
loope 0x505a39
fucomi st(6)
sbb byte [edx + 0x24820147], 0x3c
scasd eax, dword es:[edi]
adc ebx, esi
or byte [ecx + ebx*4 - 0x644a1e5a], bl
wait
clc
sub ah, byte [edi + 0x25]
mov esp, 0x626e0ef2
mov esi, 0x8831b8b1
in al, dx
js 0x505a72
pop es
sub eax, 0x243157b7
mov eax, 0xdb74ffe8
xor dword [eax - 0x51], 0x81d04dc1
mov cl, 0x89
cmp ch, byte [ebx]
cmp dl, byte [ebp + 0x4b1a335c]
jp 0x505b0e
pop edi
invalid
invalid
lea eax, [ebp - 4]
push eax
mov edx, esi
mov ecx, edi
call fcn.00504e45
pop ecx
pop edi
pop esi
leave
ret
Function at 0x505bb7
Capabilities:
Get common file path

Disassembly:
nop
sbb dword [edx], esi
mov eax, 0xcb769be3
dec edi
scasb al, byte es:[edi]
jge 0x505bc2
shl dword [esi], 1
pop esp
or dword [ecx + 0x4d], eax
ror dword [ebp - 0x67d6d51e], 0x38
add edx, dword [ebx + 0x3e]
sbb dword [eax], esp
hlt
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x6b
ja 0x505dc9
clc
imul ecx, dword [edi], 0xffffff87
inc dword [ecx]
add byte [eax], al
mov ebp, 0x85d39b4
xor ebx, ebp
adc al, bl
inc esi
push edi
add dl, byte [edi - 0x46edaf77]
imul edx, dword [ebx], 0xffffffd4
xchg ebp, eax
mov edx, 0x6a7333c2
adc al, 0x5b
out 0x94, al
dec edx
salc
pop esp
mov edi, 0x5ff3f465
xchg esi, eax
jno 0x505b81
wait
not byte [edx + 0x29]
push ebx
ja 0x505c0a
imul esp, dword [edx + 0x1a], 0x632077f8
ror byte [edi], cl
sub ecx, dword [ebx]
rcl esp, 0x68
hlt
out 0x44, eax
bound ebx, qword [eax - 0x49]
inc eax
lahf
sbb ebp, dword [edi + ebx*4 + 0x1eb29ec0]
int 0x19
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
into
mov byte [esi], bh
push ds
bound edx, qword [esi]
out dx, al
inc eax
stosb byte es:[edi], al
jp 0x505c7c
xchg edx, eax
bound eax, qword [esi - 0x2ae6834]
fadd qword [esi - 0x1c]
cmpsb byte [esi], byte es:[edi]
add dword [ebx + 0x2daf9e16], edi
xchg edx, eax
xchg ebx, eax
and byte [ebp*2 - 0x50d223e5], bl
cmp byte [0xc637fdd], bl
push es
arpl si, bx
outsb dx, byte [esi]
cmpsd dword [esi], dword es:[edi]
insd dword es:[edi], dx
cmp al, 0x1c
xchg byte [edi + 0x23], dl
mov bl, 0x1a
rcl dword [ecx - 0x74], cl
sbb al, 0x86
push edi
and esi, dword [ebx - 0x73ae2ce6]
cmpsd dword [esi], dword es:[edi]
sbb al, 0xdd
out dx, eax
stosd dword es:[edi], eax
sar dword [edi - 0x6cfc867d], 1
or dword [ecx*4 - 0x5c61b566], esp
add cl, byte [esi + 0x21]
scasb al, byte es:[edi]
iretd
jp 0x505cc1
pop edx
xor edi, ebp
invalid
cmp esi, ebp
push ebp
cmp byte [eax], bh
jno 0x505c50
lodsd eax, dword [esi]
in eax, dx
push ecx
sub al, 0x35
notrack jmp 0x505ccc
xor eax, 0x2efceb3e
pop edx
mov edi, 0xc79e3f45
in eax, dx
dec edx
mov edx, 0xf9bb408
mov dx, 0x5c66
mov esp, 0x2c9a7042
mov ch, 0xc
and al, 0xb4
ljmp 0x96a
mov esi, 0x105
cmp dword [edi + 8], esi
jg 0x505de3
lea eax, [esi + 1]
cmp dword [edi + 8], eax
je 0x505de3
push eax
mov ecx, edi
call fcn.0040de7a
push dword [edi]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, edi
mov esi, eax
call fcn.00410ff9
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret
Function at 0x5099b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 4
ja 0x5099f9
and ebx, dword [ebp - 0x43]
and ecx, dword [esi - 0x16]
sub ah, cl
dec edx
xchg edx, eax
mov eax, dword [0x35e8eb73]
xor al, 0x72
cmp edi, ecx
clc
mov al, 0x20
je fcn.00509a1f
outsd dx, dword [esi]
push ebp
invalid
mov ecx, dword [esi + 0x48]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ecx + eax*4]
lea eax, [ecx + 0x20]
push eax
push dword [ecx + 0x30]
lea eax, [esi + 0x14]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.00509151
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x50a7a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x69
ja 0x50a9b5
jle 0x50a7e7
outsd dx, dword [esi]
daa
inc ecx
and ah, byte [0xa21c7799]
sbb eax, dword [ebx + 4]
inc esi
bound edx, qword [edi + ebx*8]
or edx, dword [eax - 0x2b]
cmp ebx, dword [ebx + 0x76]
int 0x25
xlatb
inc esi
pop ecx
das
out dx, al
cdq
shr byte [esi + 0x14c349f3], cl
pop ebx
xchg ebp, ebp
sub dword [esi + 0x3c5d3177], ebx
sub dword [ecx + 0x33cb025c], esi
in al, 0x89
sbb eax, 0x2501d3c6
mov cl, 0x5c
add cl, bl
xor esp, esp
mov dword [0x2501d3c6], ebx
cmpsd dword [esi], dword es:[edi]
test dword [ebx], ebp
pop esp
lodsd eax, dword [esi]
mov dword [eax - 0x7d], 0xd18adfa2
mov dl, cl
fist dword [edx]
wait
loopne 0x50a82a
pop ss
xor ah, byte [esi - 0x16]
out dx, eax
pop esi
or ebx, edx
add al, 0xf1
pop ds
or al, 0xd6
mov eax, 0xdea43006
and ch, byte [esi + 0x72]
sbb ebp, dword [edi - 0x2ac311c4]
outsb dx, byte [esi]
test eax, 0xb559e855
add eax, 0xfb72399b
wait
cmp dword [edx - 5], esi
jo 0x50a800
movsd dword es:[edi], dword [esi]
mov ecx, 0x98ca5073
sub byte [ebx - 0x54], bh
or eax, 0x2a3209c2
xchg ebp, eax
dec edx
jl 0x50a8aa
into
or al, 0x2e
mov dword [0x660cbf62], eax
inc esp
xlatb
enter 0xffffffffffffdb69, 0x72
pop ss
pop eax
mov bl, 0x3b
or dl, dh
jae 0x50a7e6
pushfd
ret 0xdd0f
or dword [esi - 0x3285c16c], 0xffffffb0
popfd
xchg byte [ecx - 0x4f], dh
sbb cl, bh
xchg ecx, eax
wait
mov eax, 0x40315e20
in al, dx
adc dword [esi], edx
fmul dword [edi - 0x2828cdde]
mov ebx, 0x6cc3d857
push edi
fadd st(3)
insb byte es:[edi], dx
and eax, 0x2b208a0e
xlatb
fist word [eax + 0x4e]
xchg ebx, eax
je 0x50a915
outsd dx, dword [esi]
mov dh, 0xbd
lds ecx, [eax + 0x1c]
not byte [edi]
xchg edi, eax
popfd
daa
daa
jg 0x50a88f
out 0, eax
sub esi, dword [esi - 0x61]
mov ch, 0xb4
and byte [eax], dl
push ebx
inc ebp
jno 0x50a912
adc al, 0x7d
cdq
mov al, 0xd5
adc al, 0x7f
cmp cl, dl
ret 0xfa10
salc
and esp, eax
inc ecx
int 0x92
mov bl, 0xf4
jae 0x50a871
ror dword [edx], 1
pop ds
adc ecx, dword [esi + 0x47]
xchg ebx, eax
jbe 0x50a900
add al, 0xd4
mov word [esi - 0x28e0c52d], ss
ret
pmaddwd mm2, qword [ebx - 3]
fimul word [0x5d47d2c1]
imul eax, dword [edx - 0x16], 0xffffffda
add ecx, dword [eax + 0x2b232c29]
and ebp, dword [ebx]
jle 0x50a8c8
mov dl, 0x3c
and dl, byte [edx]
invalid
cmp al, 0x22
adc al, dh
iretd
cmp byte [ebp + 8], 0
push dword [ebp + 0xc]
lea ecx, [esi + 0x24]
jne 0x50a9c4
lea ecx, [esi + 0x38]
call fcn.00410e81
pop esi
pop ebp
ret 8

Function at 0x50b0ca
Capabilities:
Check for time delay via gettickcount
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x64
ja 0x50b2de
adc ah, byte [esi + 0x14b4984]
pushfd
retf
cmp byte [0x57647f], 0
mov ecx, dword [edi]
mov edx, dword [esi]
pop edi
pop esi
jne fcn.004c492a
jmp fcn.004c4983