joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e95d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc64
push ebx
xor edx, edx
mov dword [ebp - 0x39c], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x4e976c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x53568c], 0
je 0x4e96a7
mov eax, dword [ebp - 4]
call fcn.00404cc4
cmp eax, 2
jne 0x4e961f
mov eax, dword [ebp - 4]
cmp word [eax + 2], 0x3a
je 0x4e9640
mov eax, dword [ebp - 4]
call fcn.00404cc4
cmp eax, 3
jne 0x4e9667
mov eax, dword [ebp - 4]
cmp word [eax + 2], 0x3a
jne 0x4e9667
mov eax, dword [ebp - 4]
cmp word [eax + 4], 0x5c
jne 0x4e9667
mov eax, dword [0x4e977c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov byte [ebp - 8], al
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
setne al
neg al
sbb ebx, ebx
jmp 0x4e974b
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cb4
push eax
call sub.kernel32.dll_FindFirstFileW
cmp eax, 0xffffffff
setne dl
neg dl
sbb ebx, ebx
test ebx, ebx
je 0x4e974b
test byte [ebp - 0x258], 0x10
setne dl
neg dl
sbb ebx, ebx
push eax
call sub.kernel32.dll_FindClose_1
jmp 0x4e974b
mov eax, dword [ebp - 4]
call fcn.00404cc4
cmp eax, 2
jne 0x4e96be
mov eax, dword [ebp - 4]
cmp word [eax + 2], 0x3a
je 0x4e96df
mov eax, dword [ebp - 4]
call fcn.00404cc4
cmp eax, 3
jne 0x4e9703
mov eax, dword [ebp - 4]
cmp word [eax + 2], 0x3a
jne 0x4e9703
mov eax, dword [ebp - 4]
cmp word [eax + 4], 0x5c
jne 0x4e9703
mov eax, dword [0x4e977c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov byte [ebp - 8], al
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
setne al
neg al
sbb ebx, ebx
jmp 0x4e974b
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x39c]
mov edx, dword [ebp - 4]
call fcn.004046ac
mov eax, dword [ebp - 0x39c]
call fcn.004048e4
push eax
call sub.kernel32.dll_FindFirstFileA_1
cmp eax, 0xffffffff
setne dl
neg dl
sbb ebx, ebx
test ebx, ebx
je 0x4e974b
test byte [ebp - 0x398], 0x10
setne dl
neg dl
sbb ebx, ebx
push eax
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9773
lea eax, [ebp - 0x39c]
call fcn.00404414
lea eax, [ebp - 4]
call fcn.00404b30
ret
Function at 0x4e9868
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x4e993b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x53568c], 0
je 0x4e98fc
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x4e98d9
mov eax, dword [ebp - 4]
cmp word [eax + 2], 0x5c
jne 0x4e98d9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cc4
mov ecx, eax
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00404e60
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x4e9950
call fcn.00404d30
jmp 0x4e98e9
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4e9968
call fcn.00404d30
push ebx
mov eax, dword [ebp - 8]
call fcn.00404cb4
push eax
call sub.kernel32.dll_CreateDirectoryW
mov ebx, eax
jmp 0x4e9918
push ebx
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.004046ac
mov eax, dword [ebp - 0x10]
call fcn.004048e4
push eax
call sub.kernel32.dll_CreateDirectoryA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9942
lea eax, [ebp - 0x10]
call fcn.00404414
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b48
ret

Function at 0x4eaf78
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x98], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4eb0b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x4eb0cc
call fcn.00404468
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4eb09d
mov edi, dword [ebp - 0x8c]
mov esi, dword [ebp - 0x90]
mov eax, dword [ebp - 0x84]
dec eax
je 0x4eb006
dec eax
jne 0x4eb09d
lea eax, [ebp - 0x98]
call fcn.004ec578
mov eax, dword [ebp - 0x98]
xor edx, edx
call fcn.004092a8
mov edx, ebx
call fcn.004e9c08
jmp 0x4eb09d
push ebx
mov dword [ebp - 0xa8], esi
mov byte [ebp - 0xa4], 0
mov dword [ebp - 0xa0], edi
mov byte [ebp - 0x9c], 0
lea edx, [ebp - 0xa8]
mov ecx, 1
mov eax, 0x4eb0dc
call fcn.0040a2a8
cmp esi, 4
jne 0x4eb04d
test edi, edi
jne 0x4eb04d
mov eax, ebx
mov edx, 0x4eb0ec
call fcn.004046ec
jmp 0x4eb09d
cmp esi, 4
jne 0x4eb079
cmp edi, 0xa
jne 0x4eb079
cmp byte [ebp - 0x7f], 0x41
jne 0x4eb06b
mov eax, ebx
mov edx, 0x4eb0fc
call fcn.004046ec
jmp 0x4eb09d
mov eax, ebx
mov edx, 0x4eb10c
call fcn.004046ec
jmp 0x4eb09d
cmp esi, 4
jne 0x4eb091
cmp edi, 0x5a
jne 0x4eb091
mov eax, ebx
mov edx, 0x4eb11c
call fcn.004046ec
jmp 0x4eb09d
mov eax, ebx
mov edx, 0x4eb12c
call fcn.004046ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb0bd
lea eax, [ebp - 0x98]
call fcn.00404414
ret
Function at 0x4ed1dc
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048d4
xor eax, eax
push ebp
push 0x4ed384
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 4]
call fcn.004ed444
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
call fcn.004044ac
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x4ed354
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 4]
call fcn.0040493c
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4ed354
xor edx, edx
push ebp
push 0x4ed34d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4ed336
xor edx, edx
push ebp
push 0x4ed32f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x18]
push 2
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4ed30f
mov eax, ebx
cmp word [eax], 0x5a4d
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4ed30f
add ebx, dword [eax + 0x3c]
push 4
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4ed30f
cmp dword [ebx], 0x4550
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4ed30f
lea eax, [ebp - 0x110]
test eax, eax
je 0x4ed30f
lea eax, [ebp - 0x110]
mov ecx, 0xf8
mov edx, ebx
call fcn.00407850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed336
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed354
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
cmp word [ebp - 0xf8], 0x20b
mov eax, dword [ebp - 8]
sete byte [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed38b
lea eax, [ebp - 0x114]
call fcn.00404414
lea eax, [ebp - 4]
call fcn.00404414
ret
Function at 0x503f94
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ebx
push esi
add esp, 4
add ebx, 0x3926
pop ebx
push edi
xor edi, 0x17f88
and edi, 0x16909
or edi, 0x3893
pop edi
push edx
push edx
add esp, 4
sub edx, 0xe01
sub edx, 0xeaf6
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
call 0x504092
add byte [edi], bh
xor al, 0x3c
cmp dh, byte [ebx]
cmp al, 0x40
cmp cl, byte [esi + 0x47]
add esp, 4
call 0x5040a3
add byte [ebp + 0x32], cl
cmp al, byte [esi + 0x40]
inc edx
dec ecx
inc esi
add esp, 4
add esi, 0xb818
sub esi, 0x15dc4
pop esi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
push ecx
add esp, 4
and eax, 0xa930
and eax, 0x15434
sub eax, 0x8d4a
pop eax
push edx
sub edx, 0x5679
or edx, 0x8063
xor edx, 0x6265
jmp 0x50411f
pop edx
mov dword [ebp - 0x10], 1
push ebx
add ebx, 0x106d8
and ebx, 0xa2e6
jmp 0x50413b
call 0x504147
add byte [ecx + 0x39], cl
cmp byte [esi + 0x42], al
cmp dword [ebx + 0x535b04c4], eax
push ecx
add esp, 4
jmp 0x504158
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push edx
add esp, 4
jmp 0x504192
jmp 0x504198
pop esi
push edi
push ebx
add esp, 4
xor edi, 0x596c
xor edi, 0xc2ea
add edi, 0xf007
sub edi, 0xcbb
pop edi
push edx
push ebx
add esp, 4
jmp 0x5041c2
sub edx, 0x172c2
pop edx
push ebx
push ebx
add esp, 4
add ebx, 0x11a1b
sub ebx, 0x11df8
sub ebx, 0xfb3f
pop ebx
push ecx
add ecx, 0xa11d
pop ecx
mov dword [ebp - 0x2c], 1
push ecx
push edi
add esp, 4
jmp 0x5041fb
pop ecx
push edx
and edx, 0x11a0b
call 0x504210
add byte [ecx + 0x39], cl
inc edi
xor al, byte [ecx + 0x48]
inc esp
add esp, 4
sub edx, 0x17490
pop edx
push esi
add esi, 0x39c
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x504403
Function at 0x504092
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ebx
push esi
add esp, 4
add ebx, 0x3926
pop ebx
push edi
xor edi, 0x17f88
and edi, 0x16909
or edi, 0x3893
pop edi
push edx
push edx
add esp, 4
sub edx, 0xe01
sub edx, 0xeaf6
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
call 0x504092
add byte [edi], bh
xor al, 0x3c
cmp dh, byte [ebx]
cmp al, 0x40
cmp cl, byte [esi + 0x47]
add esp, 4
call 0x5040a3
add byte [ebp + 0x32], cl
cmp al, byte [esi + 0x40]
inc edx
dec ecx
inc esi
add esp, 4
add esi, 0xb818
sub esi, 0x15dc4
pop esi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
push ecx
add esp, 4
and eax, 0xa930
and eax, 0x15434
sub eax, 0x8d4a
pop eax
push edx
sub edx, 0x5679
or edx, 0x8063
xor edx, 0x6265
jmp 0x50411f
pop edx
mov dword [ebp - 0x10], 1
push ebx
add ebx, 0x106d8
and ebx, 0xa2e6
jmp 0x50413b
call 0x504147
add byte [ecx + 0x39], cl
cmp byte [esi + 0x42], al
cmp dword [ebx + 0x535b04c4], eax
push ecx
add esp, 4
jmp 0x504158
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push edx
add esp, 4
jmp 0x504192
jmp 0x504198
pop esi
push edi
push ebx
add esp, 4
xor edi, 0x596c
xor edi, 0xc2ea
add edi, 0xf007
sub edi, 0xcbb
pop edi
push edx
push ebx
add esp, 4
jmp 0x5041c2
sub edx, 0x172c2
pop edx
push ebx
push ebx
add esp, 4
add ebx, 0x11a1b
sub ebx, 0x11df8
sub ebx, 0xfb3f
pop ebx
push ecx
add ecx, 0xa11d
pop ecx
mov dword [ebp - 0x2c], 1
push ecx
push edi
add esp, 4
jmp 0x5041fb
pop ecx
push edx
and edx, 0x11a0b
call 0x504210
add byte [ecx + 0x39], cl
inc edi
xor al, byte [ecx + 0x48]
inc esp
add esp, 4
sub edx, 0x17490
pop edx
push esi
add esi, 0x39c
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x504403
Function at 0x5040a3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ebx
push esi
add esp, 4
add ebx, 0x3926
pop ebx
push edi
xor edi, 0x17f88
and edi, 0x16909
or edi, 0x3893
pop edi
push edx
push edx
add esp, 4
sub edx, 0xe01
sub edx, 0xeaf6
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
call 0x504092
add byte [edi], bh
xor al, 0x3c
cmp dh, byte [ebx]
cmp al, 0x40
cmp cl, byte [esi + 0x47]
add esp, 4
call 0x5040a3
add byte [ebp + 0x32], cl
cmp al, byte [esi + 0x40]
inc edx
dec ecx
inc esi
add esp, 4
add esi, 0xb818
sub esi, 0x15dc4
pop esi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
push ecx
add esp, 4
and eax, 0xa930
and eax, 0x15434
sub eax, 0x8d4a
pop eax
push edx
sub edx, 0x5679
or edx, 0x8063
xor edx, 0x6265
jmp 0x50411f
pop edx
mov dword [ebp - 0x10], 1
push ebx
add ebx, 0x106d8
and ebx, 0xa2e6
jmp 0x50413b
call 0x504147
add byte [ecx + 0x39], cl
cmp byte [esi + 0x42], al
cmp dword [ebx + 0x535b04c4], eax
push ecx
add esp, 4
jmp 0x504158
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push edx
add esp, 4
jmp 0x504192
jmp 0x504198
pop esi
push edi
push ebx
add esp, 4
xor edi, 0x596c
xor edi, 0xc2ea
add edi, 0xf007
sub edi, 0xcbb
pop edi
push edx
push ebx
add esp, 4
jmp 0x5041c2
sub edx, 0x172c2
pop edx
push ebx
push ebx
add esp, 4
add ebx, 0x11a1b
sub ebx, 0x11df8
sub ebx, 0xfb3f
pop ebx
push ecx
add ecx, 0xa11d
pop ecx
mov dword [ebp - 0x2c], 1
push ecx
push edi
add esp, 4
jmp 0x5041fb
pop ecx
push edx
and edx, 0x11a0b
call 0x504210
add byte [ecx + 0x39], cl
inc edi
xor al, byte [ecx + 0x48]
inc esp
add esp, 4
sub edx, 0x17490
pop edx
push esi
add esi, 0x39c
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x504403
Function at 0x504147
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ebx
push esi
add esp, 4
add ebx, 0x3926
pop ebx
push edi
xor edi, 0x17f88
and edi, 0x16909
or edi, 0x3893
pop edi
push edx
push edx
add esp, 4
sub edx, 0xe01
sub edx, 0xeaf6
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
call 0x504092
add byte [edi], bh
xor al, 0x3c
cmp dh, byte [ebx]
cmp al, 0x40
cmp cl, byte [esi + 0x47]
add esp, 4
call 0x5040a3
add byte [ebp + 0x32], cl
cmp al, byte [esi + 0x40]
inc edx
dec ecx
inc esi
add esp, 4
add esi, 0xb818
sub esi, 0x15dc4
pop esi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
push ecx
add esp, 4
and eax, 0xa930
and eax, 0x15434
sub eax, 0x8d4a
pop eax
push edx
sub edx, 0x5679
or edx, 0x8063
xor edx, 0x6265
jmp 0x50411f
pop edx
mov dword [ebp - 0x10], 1
push ebx
add ebx, 0x106d8
and ebx, 0xa2e6
jmp 0x50413b
call 0x504147
add byte [ecx + 0x39], cl
cmp byte [esi + 0x42], al
cmp dword [ebx + 0x535b04c4], eax
push ecx
add esp, 4
jmp 0x504158
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push edx
add esp, 4
jmp 0x504192
jmp 0x504198
pop esi
push edi
push ebx
add esp, 4
xor edi, 0x596c
xor edi, 0xc2ea
add edi, 0xf007
sub edi, 0xcbb
pop edi
push edx
push ebx
add esp, 4
jmp 0x5041c2
sub edx, 0x172c2
pop edx
push ebx
push ebx
add esp, 4
add ebx, 0x11a1b
sub ebx, 0x11df8
sub ebx, 0xfb3f
pop ebx
push ecx
add ecx, 0xa11d
pop ecx
mov dword [ebp - 0x2c], 1
push ecx
push edi
add esp, 4
jmp 0x5041fb
pop ecx
push edx
and edx, 0x11a0b
call 0x504210
add byte [ecx + 0x39], cl
inc edi
xor al, byte [ecx + 0x48]
inc esp
add esp, 4
sub edx, 0x17490
pop edx
push esi
add esi, 0x39c
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x504403
Function at 0x504210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ebx
push esi
add esp, 4
add ebx, 0x3926
pop ebx
push edi
xor edi, 0x17f88
and edi, 0x16909
or edi, 0x3893
pop edi
push edx
push edx
add esp, 4
sub edx, 0xe01
sub edx, 0xeaf6
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
call 0x504092
add byte [edi], bh
xor al, 0x3c
cmp dh, byte [ebx]
cmp al, 0x40
cmp cl, byte [esi + 0x47]
add esp, 4
call 0x5040a3
add byte [ebp + 0x32], cl
cmp al, byte [esi + 0x40]
inc edx
dec ecx
inc esi
add esp, 4
add esi, 0xb818
sub esi, 0x15dc4
pop esi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
push ecx
add esp, 4
and eax, 0xa930
and eax, 0x15434
sub eax, 0x8d4a
pop eax
push edx
sub edx, 0x5679
or edx, 0x8063
xor edx, 0x6265
jmp 0x50411f
pop edx
mov dword [ebp - 0x10], 1
push ebx
add ebx, 0x106d8
and ebx, 0xa2e6
jmp 0x50413b
call 0x504147
add byte [ecx + 0x39], cl
cmp byte [esi + 0x42], al
cmp dword [ebx + 0x535b04c4], eax
push ecx
add esp, 4
jmp 0x504158
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push edx
add esp, 4
jmp 0x504192
jmp 0x504198
pop esi
push edi
push ebx
add esp, 4
xor edi, 0x596c
xor edi, 0xc2ea
add edi, 0xf007
sub edi, 0xcbb
pop edi
push edx
push ebx
add esp, 4
jmp 0x5041c2
sub edx, 0x172c2
pop edx
push ebx
push ebx
add esp, 4
add ebx, 0x11a1b
sub ebx, 0x11df8
sub ebx, 0xfb3f
pop ebx
push ecx
add ecx, 0xa11d
pop ecx
mov dword [ebp - 0x2c], 1
push ecx
push edi
add esp, 4
jmp 0x5041fb
pop ecx
push edx
and edx, 0x11a0b
call 0x504210
add byte [ecx + 0x39], cl
inc edi
xor al, byte [ecx + 0x48]
inc esp
add esp, 4
sub edx, 0x17490
pop edx
push esi
add esi, 0x39c
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x504403
Function at 0x5075c8
Capabilities:
Parse pe header

Disassembly:
pop eax
mov dword [ebp - 0x3c0], eax
push eax
push ecx
add esp, 4
sub eax, 0x16670
call 0x5075ea
add byte [eax + 0x40], cl
inc ebx
xor ecx, dword [eax + 0x46]
aaa
inc edi
dec edi
cmp byte [ebx + 0xbe804c4], al
add byte [eax], al
add byte [eax], al
inc esi
inc esi
xor eax, 0x3245383f
inc edx
dec ecx
xor al, byte [ebx - 0x74a7fb3c]
lea esp, [eax - 0x20]
invalid

Function at 0x5075ea
Capabilities:
Parse pe header

Disassembly:
pop eax
mov dword [ebp - 0x3c0], eax
push eax
push ecx
add esp, 4
sub eax, 0x16670
call 0x5075ea
add byte [eax + 0x40], cl
inc ebx
xor ecx, dword [eax + 0x46]
aaa
inc edi
dec edi
cmp byte [ebx + 0xbe804c4], al
add byte [eax], al
add byte [eax], al
inc esi
inc esi
xor eax, 0x3245383f
inc edx
dec ecx
xor al, byte [ebx - 0x74a7fb3c]
lea esp, [eax - 0x20]
invalid

Function at 0x5075fd
Capabilities:
Parse pe header

Disassembly:
pop eax
mov dword [ebp - 0x3c0], eax
push eax
push ecx
add esp, 4
sub eax, 0x16670
call 0x5075ea
add byte [eax + 0x40], cl
inc ebx
xor ecx, dword [eax + 0x46]
aaa
inc edi
dec edi
cmp byte [ebx + 0xbe804c4], al
add byte [eax], al
add byte [eax], al
inc esi
inc esi
xor eax, 0x3245383f
inc edx
dec ecx
xor al, byte [ebx - 0x74a7fb3c]
lea esp, [eax - 0x20]
invalid
Function at 0x507ed4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
add esp, 4
or esi, 0x7c76
jmp 0x507d5a
pop esi
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x507e9d
cmp dword [ebp - 0x14d0], 0
jne 0x507ee6
push ecx
push edx
add esp, 4
add ecx, 0x1aba
call 0x507ec1
add byte [eax + 0x33], cl
dec edi
cmp al, 0x36
inc esp
dec edi
dec edx
inc esi
add esp, 4
call 0x507ed4
add byte [eax + 0x36], dl
inc edx
cmp al, 0x4f
push eax
dec eax
cmp esi, dword [0x5904c483]
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x507f27
jmp 0x507c34