joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50bb4a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x556c8c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
call fcn.0050bc5e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x50bc4d
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x73
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x43
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x48
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x44
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x79
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x70
xor eax, eax
inc eax
imul eax, eax, 0xd
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xe
jae 0x50bbe3
jmp 0x50bbe8
call fcn.004270d4
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x74
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x68
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x74
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50bc44
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426fa0
mov esp, ebp
pop ebp
ret

Function at 0x50e710
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
call fcn.00514bb0
mov edx, 0x20
mov ecx, eax
call fcn.0052fc70
add esp, 4
test eax, eax
je 0x50e78b
lea eax, [esp + 8]
mov edx, str.SeDebugPrivilege
push eax
call fcn.00528310
add esp, 4
test eax, eax
je 0x50e782
mov eax, dword [esp + 8]
sub esp, 0xc
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call fcn.0052fe10
add esp, 0x10
mov ecx, dword [esp + 4]
call fcn.0052e1f0
add esp, 0x24
ret
Function at 0x50ea40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00514b50
mov edi, eax
test edi, edi
je 0x50eaae
lea eax, [esp + 0x10]
mov dword [esp + 0x11], 0x75515354
push eax
push edi
mov dword [esp + 0x26], 0x6e656b
mov word [esp + 0x23], 0x5472
mov word [esp + 0x20], 0x7355
mov word [esp + 0x1d], 0x7265
mov byte [esp + 0x1f], 0x79
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x25], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x50eaa7
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x50eac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x50eb2a
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x4b6e6570
push eax
push edi
mov dword [esp + 0x22], 0x417845
mov word [esp + 0x19], 0x6765
mov byte [esp + 0x18], 0x52
mov word [esp + 0x20], 0x7965
mov byte [esp + 0x1b], 0x4f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x50eb23
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x50eb40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80004005
call fcn.00402020
mov edi, eax
test edi, edi
je 0x50ebb8
lea eax, [esp + 0xc]
mov dword [esp + 0xf], 0x6e4b7465
push eax
push edi
mov dword [esp + 0x22], 0x61507265
mov word [esp + 0x27], 0x68
mov dword [esp + 0x1c], 0x6f466e77
mov word [esp + 0x14], 0x4853
mov byte [esp + 0x1b], 0x6f
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x16], 0x47
mov word [esp + 0x20], 0x646c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x50ebb1
push dword [esp + 0x2c]
push 0
push 0
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x5145b0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], 0x546420
push eax
call fcn.00443110
add esp, 0xc
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret
Function at 0x514a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 0xb], 0x6f567473
push eax
mov esi, ecx
mov dword [esp + 0x15], 0x57656d
mov dword [esp + 8], 0x646e6946
mov word [esp + 0xd], 0x7269
mov word [esp + 0x13], 0x756c
mov byte [esp + 0xc], 0x46
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x514a63
push 0x104
push esi
call eax
pop esi
add esp, 0x14
ret
or eax, 0xffffffff
pop esi
add esp, 0x14
ret

Function at 0x514c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x514cd9
lea eax, [esp + 0xc]
mov word [esp + 0xf], 0x6576
push eax
push edi
mov dword [esp + 0x26], 0x41646953
mov dword [esp + 0x22], 0x6f546469
mov word [esp + 0x14], 0x6f43
mov dword [esp + 0x1e], 0x53676e69
mov word [esp + 0x19], 0x7472
mov word [esp + 0x1c], 0x7274
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x2a], 0
mov byte [esp + 0x1b], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x514cd2
push ebx
push 0x5675d8
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x514cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call fcn.00402ea0
mov esi, eax
test esi, esi
je 0x514d7c
lea eax, [esp + 0xc]
mov word [esp + 0x24], 0x6d61
push eax
push esi
mov dword [esp + 0x1b], 0x63696c70
mov dword [esp + 0x15], 0x646c6975
mov word [esp + 0x2f], 0x41
mov dword [esp + 0x28], 0x4e687469
mov byte [esp + 0x14], 0x42
mov dword [esp + 0x21], 0x65636341
mov word [esp + 0x19], 0x7845
mov word [esp + 0x26], 0x5773
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x25], 0x73
mov word [esp + 0x1f], 0x7469
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x514d75
push 0
push dword [esp + 0x38]
push dword [esp + 0x38]
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x516260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51b3eb
mov eax, dword fs:[0]
push eax
mov eax, 0x10d4
mov dword fs:[0], esp
call fcn.004972d0
cmp byte [edx], 0
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x60], 0
push edi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
jne 0x5162ac
xor ecx, ecx
jmp 0x5162ba
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5162b1
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.00408e50
lea edx, [ebp - 0x5c]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.005256b0
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x5162eb
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.00409e50
push 0x400
lea eax, [ebp - 0x864]
push 0
push eax
call fcn.00443110
mov esi, dword [ebp - 0x3c]
add esp, 0xc
mov edi, dword [ebp - 0x40]
xor edx, edx
sub esi, edi
je 0x516327
lea eax, [ebp - 0x864]
sub edi, eax
lea ecx, [ebp - 0x864]
add ecx, edx
inc edx
mov al, byte [edi + ecx]
mov byte [ecx], al
cmp edx, esi
jb 0x516315
push 0x400
lea eax, [ebp - 0x464]
push 0
push eax
call fcn.00443110
add esp, 0xc
lea eax, [ebp - 0xc64]
xorps xmm0, xmm0
movups xmmword [ebp - 0x54], xmm0
push 0x400
push 0
push eax
call fcn.00443110
add esp, 0xc
mov dword [ebp - 0x1e], 0x43424342
lea eax, [ebp - 0x34]
mov dword [ebp - 0x2d], 0x41324443
mov dword [ebp - 0x17], 0x393946
mov word [ebp - 0x23], 0x4232
push eax
lea eax, [ebp - 0xc64]
mov dword [ebp - 0x33], 0x44373838
push 0x400
push eax
mov word [ebp - 0x20], 0x4134
mov word [ebp - 0x26], 0x3646
mov byte [ebp - 0x34], 0x43
mov word [ebp - 0x29], 0x4537
mov word [ebp - 0x2f], 0x3234
mov byte [ebp - 0x24], 0x44
mov byte [ebp - 0x27], 0x39
mov word [ebp - 0x1a], 0x3646
mov byte [ebp - 0x21], 0x36
mov byte [ebp - 0x18], 0x38
call fcn.00469f82
add esp, 0xc
lea ecx, [ebp - 0x10dc]
call fcn.0051dac0
sub esp, 8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xc64]
push eax
call fcn.0052c050
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x40]
push ecx
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0x10dc]
call fcn.00514900
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
cmp byte [ebp - 0x454], 0
jne 0x516427
xor ecx, ecx
jmp 0x516439
lea ecx, [ebp - 0x454]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x516430
sub ecx, edx
push ecx
lea eax, [ebp - 0x454]
mov ecx, ebx
push eax
call fcn.00408e50
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x516492
mov eax, dword [ebp - 0x38]
sub eax, ecx
cmp eax, 0x1000
jb 0x516489
test cl, 0x1f
je 0x516465
call fcn.0044d762
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x516471
call fcn.0044d762
sub ecx, eax
cmp ecx, 4
jae 0x51647d
call fcn.0044d762
cmp ecx, 0x23
jbe 0x516487
call fcn.0044d762
mov ecx, eax
push ecx
call fcn.00426633
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x518450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp + 3], 0x54657461
push eax
mov word [esp + 5], 0x6572
mov dword [esp + 0xb], 0x61657268
mov byte [esp + 4], 0x43
mov word [esp + 0xf], 0x64
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5184a1
push dword [esp + 0x20]
push 0
push 0
push 0x51e250
push 0
push 0
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret
Function at 0x51a9b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.00402020
mov edi, eax
test edi, edi
je 0x51aa1e
lea eax, [esp + 0xc]
mov dword [esp + 0x15], 0x466c6169
push eax
push edi
mov dword [esp + 0x28], 0x576874
mov dword [esp + 0x23], 0x50726564
mov dword [esp + 0x19], 0x63657053
mov dword [esp + 0x14], 0x65474853
mov byte [esp + 0x18], 0x74
mov word [esp + 0x21], 0x6c6f
mov byte [esp + 0x27], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51aa17
push esi
push 0x25
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x51ab30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
lea eax, [esp + 4]
mov dword [esp + 0x17], 0x656d6954
push eax
mov esi, ecx
mov word [esp + 0x11], 0x6954
mov word [esp + 0xc], 0x7379
mov word [esp + 9], 0x7465
mov byte [esp + 0x1f], 0
mov word [esp + 0xe], 0x6574
mov dword [esp + 0x15], 0x69467341
mov word [esp + 0x13], 0x656d
mov byte [esp + 0x10], 0x6d
mov byte [esp + 8], 0x47
mov word [esp + 0x19], 0x656c
mov byte [esp + 0xb], 0x53
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51ab9c
push esi
call eax
pop esi
add esp, 0x18
ret

Function at 0x51abb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 8], 0x636f7250
push eax
mov esi, edx
mov word [esp + 0x14], 0x4632
mov edi, ecx
mov dword [esp + 0x17], 0x747372
mov word [esp + 0x11], 0x7373
mov byte [esp + 0x10], 0x65
mov byte [esp + 0x13], 0x33
mov byte [esp + 0x16], 0x69
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51ac05
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x51ac10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00518280
mov edi, eax
test edi, edi
je 0x51ac66
lea eax, [esp + 0x10]
mov word [esp + 0x10], 0x6150
push eax
push edi
mov dword [esp + 0x1b], 0x70704168
mov dword [esp + 0x1f], 0x41646e65
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x23], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51ac5f
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x51ad10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x51ad9d
lea eax, [esp + 0xc]
mov dword [esp + 0x13], 0x63697672
push eax
push edi
mov dword [esp + 0x16], 0x53797265
mov dword [esp + 0x20], 0x656a624f
mov dword [esp + 0x2a], 0x79746972
mov word [esp + 0x28], 0x7563
mov word [esp + 0x14], 0x7551
mov word [esp + 0x25], 0x5374
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x2e], 0
mov byte [esp + 0x24], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51ad96
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push 4
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x51c120
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
mov dword [esp], ecx
xor eax, eax
nop dword [eax + eax]
mov byte [eax + ecx], al
inc eax
cmp eax, 0x100
jl 0x51c130
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
movzx eax, dl
xor esi, esi
push edi
xor cl, cl
mov dword [esp + 0x14], eax
mov ebp, 0xff
xor ebx, ebx
lea edi, [ebx + 1]
cmp ebp, edi
jbe 0x51c174
nop dword [eax]
lea edi, [edi*2 + 1]
cmp edi, ebp
jb 0x51c160
jmp 0x51c174
mov edx, dword [esp + 0x20]
movzx eax, cl
mov ecx, dword [esp + 0x10]
mov cl, byte [eax + ecx]
add cl, byte [esi + str.ujcdmosqtfppzpcwhtbiboike]
inc esi
cmp esi, dword [esp + 0x14]
jb 0x51c18f
xor esi, esi
add cl, dl
movzx edx, cl
inc ebx
and edx, edi
cmp ebx, 0xb
jbe 0x51c1a0
mov eax, edx
xor edx, edx
div ebp
cmp edx, ebp
ja 0x51c170
mov edi, dword [esp + 0x10]
movzx edx, dl
mov bl, byte [edi + ebp]
mov al, byte [edx + edi]
mov byte [edi + ebp], al
mov byte [edx + edi], bl
mov edx, dword [esp + 0x20]
sub ebp, 1
jne 0x51c153
movzx eax, byte [edi + 1]
mov byte [edi + 0x100], al
movzx eax, byte [edi + 3]
mov byte [edi + 0x101], al
movzx eax, byte [edi + 5]
mov byte [edi + 0x102], al
movzx eax, byte [edi + 7]
mov byte [edi + 0x103], al
movzx eax, cl
movzx eax, byte [eax + edi]
mov byte [edi + 0x104], al
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x51ca20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x110
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x1c]
mov edi, ecx
push 0
push eax
xor bl, bl
call fcn.00443110
add esp, 8
lea edx, [esp + 0x1c]
call fcn.0052c6c0
lea ecx, [esp + 0x1c]
call fcn.00522d20
lea edx, [esp + 0x10]
mov dword [esp + 0x12], 0x7461642e
lea ecx, [esp + 0x1c]
mov word [esp + 0x10], 0x6d74
mov byte [esp + 0x16], bl
call fcn.0051ac10
push ecx
push 3
sub esp, 8
lea ecx, [esp + 0x2c]
mov edx, 0x80000000
call fcn.00522db0
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x51cab6
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov ecx, esi
setne bl
call fcn.0052e1f0
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x110
ret
Function at 0x51cad0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x114
push ebx
push esi
push 0x104
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], ecx
push 0
push eax
xor bl, bl
call fcn.00443110
add esp, 8
lea edx, [esp + 0x1c]
call fcn.0052c6c0
lea ecx, [esp + 0x1c]
call fcn.00522d20
lea edx, [esp + 0xc]
mov word [esp + 0xc], 0x6d74
lea ecx, [esp + 0x1c]
mov dword [esp + 0xf], 0x746164
mov byte [esp + 0xe], 0x2e
call fcn.0051ac10
push ecx
push 2
sub esp, 8
lea ecx, [esp + 0x2c]
mov edx, 0x40000000
call fcn.00522db0
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
je 0x51cb6c
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 4
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov ecx, esi
setne bl
call fcn.0052e1f0
pop esi
mov al, bl
pop ebx
add esp, 0x114
ret

Function at 0x51dcd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp]
mov dword [esp + 0xf], 0x616e5332
push eax
mov word [esp + 4], 0x7243
mov word [esp + 0xe], 0x6568
mov dword [esp + 9], 0x6f6f5465
mov word [esp + 7], 0x7461
mov dword [esp + 0x19], 0x746f68
mov byte [esp + 6], 0x65
mov word [esp + 0x17], 0x7370
mov word [esp + 0x11], 0x3370
mov byte [esp + 0xd], 0x6c
mov byte [esp + 0x10], 0x6c
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51dd3b
push 0
push 2
call eax
add esp, 0x1c
ret
or eax, 0xffffffff
add esp, 0x1c
ret

Function at 0x51dd50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
xor esi, esi
call fcn.00514b50
mov edi, eax
test edi, edi
je 0x51ddc1
lea eax, [esp + 8]
mov dword [esp + 8], 0x45535457
push eax
push edi
mov word [esp + 0x24], 0x41
mov dword [esp + 0x1b], 0x73655365
mov word [esp + 0x19], 0x7461
mov dword [esp + 0x14], 0x656d756e
mov dword [esp + 0x1f], 0x6e6f6973
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x23], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51ddba
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push 1
push esi
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret

Function at 0x51ddd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x11], 0x65707954
push eax
mov esi, edx
mov word [esp + 0xf], 0x6942
mov edi, ecx
mov word [esp + 0x19], 0x41
mov word [esp + 0xc], 0x6547
mov dword [esp + 0x11], 0x7972616e
mov byte [esp + 0xe], 0x74
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51de22
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x51df70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x51dffc
lea eax, [esp + 0x10]
mov dword [esp + 0x11], 0x74616572
push eax
push edi
mov dword [esp + 0x1e], 0x636f7250
mov dword [esp + 0x26], 0x65735573
mov word [esp + 0x23], 0x7373
mov byte [esp + 0x18], 0x43
mov word [esp + 0x2b], 0x41
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x25], 0x41
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x22], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51dff5
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push esi
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push esi
push esi
push esi
push dword [esp + 0x4c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x521750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x12], 0x747865
push eax
mov esi, edx
mov dword [esp + 0xe], 0x7365636f
mov edi, ecx
mov dword [esp + 0x12], 0x4e323373
mov word [esp + 0xc], 0x7250
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x521797
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x5217a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, edx
mov esi, 1
call fcn.00518280
mov edi, eax
test edi, edi
je 0x52180a
lea eax, [esp + 0xc]
mov dword [esp + 0x13], 0x4165756c
push eax
push edi
mov dword [esp + 0x17], 0x61567465
mov word [esp + 0x15], 0x5348
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x521803
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push 0x80000002
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x5218b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 6], 0x6e696d72
push eax
mov esi, ecx
mov dword [esp + 0x12], 0x65636f72
mov word [esp + 0xf], 0x6574
mov word [esp + 8], 0x6554
mov word [esp + 0x16], 0x7373
mov byte [esp + 0xe], 0x61
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x18], 0
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x521909
push 0
push esi
call eax
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x522b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x522b7a
lea eax, [esp + 0x10]
mov dword [esp + 0x11], 0x75516765
push eax
push edi
mov dword [esp + 0x25], 0x577845
mov byte [esp + 0x18], 0x52
mov word [esp + 0x20], 0x6156
mov word [esp + 0x23], 0x6575
mov word [esp + 0x1d], 0x7265
mov byte [esp + 0x22], 0x6c
mov byte [esp + 0x1f], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x522b73
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x522db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0x11], 0x4165
push eax
mov esi, edx
mov byte [esp + 0x17], 0
mov edi, ecx
mov dword [esp + 0x10], 0x69466574
mov dword [esp + 0xc], 0x61657243
mov byte [esp + 0x14], 0x6c
call fcn.0052fb90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x522e05
push 0
push 0
push dword [esp + 0x28]
push 0
push 0
push esi
push edi
call eax
pop edi
pop esi
add esp, 0xc
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 0xc
ret

Function at 0x522e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x522e83
lea eax, [esp + 0xc]
mov word [esp + 0x1b], 0x78
push eax
push edi
mov word [esp + 0x15], 0x7075
mov dword [esp + 0x1a], 0x54657461
mov dword [esp + 0x1e], 0x6e656b6f
mov word [esp + 0x18], 0x6369
mov byte [esp + 0x14], 0x44
mov byte [esp + 0x17], 0x6c
mov byte [esp + 0x22], 0x45
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x522e7c
push dword [esp + 0x30]
push 1
push 2
push esi
push 0x2000000
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret