joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f8086
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4e22ac], 1
jne 0x4f81f3
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00506175
add esp, 0xc
ja 0x4f80ae
test eax, 0x29b6
jno 0x4f80c6
pushf
xchg ecx, ecx
nop
jl 0x4f80bc
popf
lea edi, [edi]
nop
jp 0x4f80c3
jo 0x4f80c6
xor eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
xor edx, dword [esp]
xor edx, dword [esp]
xor ecx, esi
xor ecx, esi
js 0x4f810e
jl 0x4f8104
xchg edi, esi
xchg edi, esi
xchg esi, esi
jns 0x4f810e
xor eax, 0xe84d8acf
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.005061a4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4f8183
xor eax, eax
jmp 0x4f8245
jnp 0x4f8185
jl 0x4f8198
lea esi, [esi + 0x7224]
lea esi, [esi - 0x7224]
xchg esp, esp
jge 0x4f8198
mov ebx, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004ecdaf
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00506175
add esp, 0xc
xchg edi, edi
push esi
add esi, 0x3cd8
ror esi, 0x18
pop esi
or ebx, ebx
xor esp, 0
jnp 0x4f81dd
lea ebx, [ebx + 0x77fd]
lea ebx, [ebx - 0x77fd]
jmp 0x4f81da
jp 0x4f81dd
mov ecx, 0xf87d83
cmp dword [ebp - 8], 0
je 0x4f81ed
mov eax, dword [ebp - 8]
mov dword [0x4e22ac], eax
jmp 0x4f81f1
xor eax, eax
jmp 0x4f8245
jmp 0x4f81fc
mov ecx, dword [0x4e22ac]
mov dword [ebp - 8], ecx
and esp, 0xffffffff
je 0x4f820c
jns 0x4f8203
jmp 0x4f8205
mov eax, eax
jno 0x4f8209
jne 0x4f820c
mov ebx, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
std
cld
mov edx, edx
sub esp, 0
je 0x4f822e
lea ebx, [ebx + 0x2e7a]
lea ebx, [ebx - 0x2e7a]
xchg ebx, eax
xchg ebx, eax
jbe 0x4f822b
jne 0x4f822e
mov ebp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0050c251
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f8de7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00506175
add esp, 0xc
test ebx, eax
jnp 0x4f8e1a
pushf
jl 0x4f8e08
add ebx, 0
cmp ecx, 0x4a8a
popf
jle 0x4f8e15
jmp 0x4f8e17
jp 0x4f8e1a
mov ecx, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
nop
inc ebx
dec ebx
mov esp, esp
je 0x4f8e69
lea esp, [esp]
jnp 0x4f8e62
jl 0x4f8e64
ja 0x4f8e66
jne 0x4f8e69
sub eax, 0x80ec4d8a
jmp 0xec9d1673
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.005061a4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4f8ef6
jmp 0x4f8f84
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ecdaf
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00506175
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4f8f84
test ecx, 0x3e91
jne 0x4f8f24
je 0x4f8f31
jl 0x4f8f28
js 0x4f8f2a
jb 0x4f8f2c
jnp 0x4f8f2e
jne 0x4f8f31
lcall 0x17e8, 0x50e8458b
xor eax, dword [ecx]
add byte [ebx + 0x7404c4], al
mov eax, dword [ebp - 0x18]
push eax
call fcn.0050c251
add esp, 4
je 0x4f8f3f
lea ecx, [ecx + 0x3e4a]
lea ecx, [ecx - 0x3e4a]
dec ebx
inc ebx
jno 0x4f8f71
pushf
cmp esp, 0x2852
jb 0x4f8f59
shl esp, 0
popf
js 0x4f8f60
lea esi, [esi + 0x69d5]
lea esi, [esi - 0x69d5]
jg 0x4f8f6e
jo 0x4f8f71
sub eax, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f91db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00506175
add esp, 0xc
mov ecx, ecx
jae 0x4f9203
xchg esi, esi
xchg ebx, ebx
xchg esp, esp
jl 0x4f9200
jb 0x4f9203
xor eax, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
shl ecx, 0
shr edi, 0
mov eax, eax
jp 0x4f9251
pushf
shl esp, 0
push ebx
pop ebx
xchg edi, eax
xchg edi, eax
inc ecx
dec ecx
popf
xchg esp, esp
xchg esp, esp
jnp 0x4f9251
mov esi, 0x80ec4d8a
jmp 0xec9d1a5b
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov eax, eax
cmp ecx, dword [esp + 8]
jo 0x4f92c0
jl 0x4f92bb
jns 0x4f92bd
jno 0x4f92c0
add eax, 0xcedfe8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.005061a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4f92d5
xor eax, eax
jmp 0x4f9373
cmc
inc edx
dec edx
ror esi, 2
rol esi, 2
add esi, 0
jno 0x4f92ec
ja 0x4f92e5
jge 0x4f92e7
ja 0x4f92e9
jo 0x4f92ec
mov ecx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004ecdaf
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00506175
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4f9366
add esp, 0
push edi
pop edi
jp 0x4f9319
mov edi, edi
jg 0x4f9326
jb 0x4f931f
mov edi, edi
mov esi, esi
jle 0x4f9326
lcall 0x22e8, 0x50fc458b
das
add dword [eax], eax
mov eax, dword [ebp - 4]
push eax
call fcn.0050c251
add esp, 4
lea esi, [esi + 0x1057]
lea esi, [esi - 0x1057]
cmc
xor edi, 0x2f94
xor edi, 0x2f94
xor ebx, ecx
xor ebx, ecx
jno 0x4f935d
mov edx, edx
jbe 0x4f9355
mov esp, esp
jne 0x4f9359
jo 0x4f935d
sub ebp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x4f9373
push ebx
pop ebx
jp 0x4f9371
lea esi, [esi]
jbe 0x4f936e
jnp 0x4f9371
lcall 0x8b5b, 0x5e5fc033
in eax, 0x5d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fdd22
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00506175
add esp, 0xc
call fcn.004fdd47

Function at 0x4fdecc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00506175
add esp, 0xc
test ebx, 0x429b
jae 0x4fdef8
xchg ebx, eax
xchg ebx, eax
je 0x4fdef1
mov esp, esp
jno 0x4fdef5
jb 0x4fdef8
add eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
cmp esi, dword [esp]
jnp 0x4fdf4b
pushf
inc ebx
dec ebx
shl edx, 0
clc
ja 0x4fdf3f
popf
mov edx, edx
lea esp, [esp]
jle 0x4fdf48
jp 0x4fdf4b
mov eax, 0x80f44d8a
jmp 0xf49d6755
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
js 0x4fdfbe
ja 0x4fdfc0
mov ecx, ecx
sub esp, 0
ja 0x4fdfe4
pushf
test esp, 0x4af3
cmp ebx, 0x5110
jle 0x4fdfd7
popf
xchg ebx, esi
xchg ebx, esi
je 0x4fdfdf
jne 0x4fdfe1
jbe 0x4fdfe4
mov edi, 0x81bbe8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.005061a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4fdff7
jmp 0x4fe0a7
clc
test esp, 0x5a54
jl 0x4fe000
jne 0x4fe015
pushf
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
inc edi
dec edi
popf
jnp 0x4fe012
je 0x4fe015
mov ecx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004ecdaf
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00506175
add esp, 0xc
test esi, 0x241a
nop
ja 0x4fe03e
call fcn.004fe043
Function at 0x4fe5d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00506175
add esp, 0xc
je 0x4fe5f1
je 0x4fe5ff
xchg edi, ecx
xchg edi, ecx
jp 0x4fe5f9
mov ecx, ecx
nop
jne 0x4fe5ff
mov edi, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
inc esi
dec esi
and esi, 0xffffffff
js 0x4fe63e
jge 0x4fe645
lea eax, [eax]
jl 0x4fe645
mov edi, 0x80e84d8a
jmp 0xe89d6e4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.00511546
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4fe6cb
xor eax, eax
jmp 0x4fe74b
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004ecdaf
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00506175
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4fe749
jnp 0x4fe6f3
jg 0x4fe70a
pushf
lea esi, [esi]
mov edi, edi
ror edi, 0x12
ror edi, 0xe
popf
jle 0x4fe705
jmp 0x4fe707
jle 0x4fe70a
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0050c251
add esp, 4
rol ebx, 0x1a
rol ebx, 6
call fcn.004fe721
xor eax, eax
Function at 0x505a4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00506175
add esp, 0xc
jbe 0x505a6d
jmp 0x505a6f
xchg ebx, ebx
jp 0x505a84
pushf
jg 0x505a77
ror edi, 0x12
rol edi, 0x12
popf
jl 0x505a81
jnp 0x505a84
mov esp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
ror eax, 6
ror eax, 0x1a
sub esp, 0
jno 0x505abf
not ebx
not ebx
jl 0x505ad0
jae 0x505ac7
jp 0x505ac9
jae 0x505acb
jb 0x505acd
jge 0x505ad0
xor eax, 0x80f04d8a
jmp 0xf09de2da
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
cmp eax, 0x6442
jne 0x505b42
nop
xchg esi, ecx
xchg esi, ecx
mov ecx, ecx
je 0x505b42
mov ecx, 0xb9ffe8b5
add byte [eax], al
call fcn.00511546
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x505b54
xor eax, eax
jmp 0x505b8a
inc eax
dec eax
jne 0x505b58
jo 0x505b67
pushf
rol edx, 0
popf
jg 0x505b63
nop
jno 0x505b67
mov ebp, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ecdaf
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00506175
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x505f78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00506175
add esp, 0xc
xchg esi, esi
mov ecx, ecx
jbe 0x505f97
je 0x505fa8
pushf
test dword [esp], edi
nop
popf
lea eax, [eax]
jno 0x505fa5
jne 0x505fa8
mov ecx, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
push esi
pop esi
cmp edx, 0x5276
clc
xor ebx, esi
xor ebx, esi
jae 0x506009
jp 0x506005
jb 0x506009
ljmp 0xe980:0xe84d8a85
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
call fcn.005060aa
Function at 0x50658d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00506175
add esp, 0xc
add eax, 0
lea esp, [esp]
ror edx, 0
jo 0x5065b1
jae 0x5065be
lea edx, [edx]
jns 0x5065b7
jg 0x5065b9
je 0x5065bb
jb 0x5065be
add eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
test edi, eax
shl esp, 0
mov ecx, ecx
ja 0x506600
jo 0x5065f9
jo 0x5065fb
jge 0x5065fd
jbe 0x506600
lcall 0x1e9, 0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
or esp, 0
shr edx, 0
test ebx, esi
jge 0x506681
jge 0x50666c
lea ecx, [ecx + 0x1354]
lea ecx, [ecx - 0x1354]
xchg ebx, ebx
xchg edi, edi
jl 0x506681
mov ebx, 0x72e834d7
cmp al, 0xff
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call fcn.004fa2f8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x506699
mov eax, 1
jmp 0x50674a
xchg esp, esp
rol edi, 3
rol edi, 0x1d
cmp eax, 0x1620
add esp, 0
jae 0x5066c4
pushf
shl esp, 0
ja 0x5066b2
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
shr esp, 0
popf
lea edx, [edx]
jb 0x5066c4
lcall 0x4d8b, 0x50f4458d
invalid
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004ecdaf
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00506175
add esp, 0xc
sub esp, 0
or esp, 0
test dword [esp + 8], esi
jnp 0x5066f0
jl 0x5066f7
jne 0x5066f4
jge 0x5066f7
jmp 0x13ce47e
cmp dword [ebp - 0x14], 0
jne 0x506704
mov eax, 1
jmp 0x50674a
xchg esp, esp
ror esi, 0x1d
rol esi, 0x1d
and edi, 0xffffffff
jge 0x506726
pushf
shl ecx, 0
lea eax, [eax]
cmc
and edx, edx
popf
jle 0x50671f
xchg edi, edi
js 0x506723
jl 0x506726
call 0x513cacb5
mov eax, dword [ebp - 0x14]
push eax
call fcn.0050c251
add esp, 4
stc
jne 0x506735
rol ecx, 4
ror ecx, 4
jbe 0x506743
jae 0x50673f
ja 0x506743
mov esi, 0x84d8bbe
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x50d94e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00506175
add esp, 0xc
shr esp, 0
call fcn.0050d96f

Function at 0x50e62a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00506175
add esp, 0xc
push 0x21
push 0x4e3e4c
lea ecx, [ebp - 0x138]
push ecx
call fcn.004fcc5f
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x50e732
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.00506175
add esp, 0xc
push 0xb
push 0x4e3e70
lea edx, [ebp - 0x138]
push edx
call fcn.004fcc5f
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x50e725
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004fcc5f
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x50e734
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x514f14
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x4e2ca8
call fcn.00504ae6
add esp, 0xc
mov byte [0x4e2ca8], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret