joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4edc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0x2fd
call fcn.00049640
mov edi, eax
test edi, edi
je 0x4ef9c
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0004eb40
cmp al, 1
jne 0x4ef9c
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x18]
push ecx
push esi
mov dword [ebp - 0x18], 0x736f746e
mov dword [ebp - 0x14], 0x6c6e726b
mov dword [ebp - 0x10], 0x6578652e
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x2c], 0x43666f49
mov dword [ebp - 0x28], 0x6c706d6f
mov dword [ebp - 0x24], 0x52657465
mov dword [ebp - 0x20], 0x65757165
mov dword [ebp - 0x1c], 0x7473
call fcn.00014e00
cmp al, 1
jne 0x4ee5d
mov edx, dword [ebp - 8]
add edx, edi
push edx
push 0x300
call fcn.00049620
push 0x116a
call fcn.00049650
mov ebx, eax
mov eax, dword [ebp - 4]
push ebx
push eax
push esi
call fcn.0004ec20
cmp al, 1
jne 0x4ef8a
mov ecx, dword [ebp - 4]
push ecx
push esi
xor eax, eax
mov ecx, edi
call fcn.00014be0
cmp al, 1
jne 0x4ef8a
lea eax, [ebx + 4]
mov dword [ebp - 8], 7
lea esp, [esp]
mov ecx, dword [eax]
mov edi, dword [ebp - 4]
mov dword [eax - 4], 0
test ecx, ecx
je 0x4eeda
lea edx, [ecx + 0x10]
cmp edx, edi
ja 0x4eeda
add ecx, esi
mov edx, 1
mov dword [eax - 4], edx
mov ebx, dword [ecx]
mov dword [eax + 8], ebx
mov ebx, dword [ecx + 4]
mov dword [eax + 0xc], ebx
mov ebx, dword [ecx + 8]
mov dword [eax + 0x10], ebx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0x14], ecx
jmp 0x4eedf
mov edx, 1
mov ecx, dword [eax + 0x1c]
mov dword [eax + 0x18], 0
test ecx, ecx
je 0x4ef10
lea ebx, [ecx + 0x10]
cmp ebx, edi
ja 0x4ef10
add ecx, esi
mov dword [eax + 0x18], edx
mov ebx, dword [ecx]
mov dword [eax + 0x24], ebx
mov ebx, dword [ecx + 4]
mov dword [eax + 0x28], ebx
mov ebx, dword [ecx + 8]
mov dword [eax + 0x2c], ebx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0x30], ecx
mov ecx, dword [eax + 0x38]
mov dword [eax + 0x34], 0
test ecx, ecx
je 0x4ef41
lea ebx, [ecx + 0x10]
cmp ebx, edi
ja 0x4ef41
add ecx, esi
mov dword [eax + 0x34], edx
mov ebx, dword [ecx]
mov dword [eax + 0x40], ebx
mov ebx, dword [ecx + 4]
mov dword [eax + 0x44], ebx
mov ebx, dword [ecx + 8]
mov dword [eax + 0x48], ebx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0x4c], ecx
mov ecx, dword [eax + 0x54]
mov dword [eax + 0x50], 0
test ecx, ecx
je 0x4ef72
lea ebx, [ecx + 0x10]
cmp ebx, edi
ja 0x4ef72
add ecx, esi
mov dword [eax + 0x50], edx
mov edi, dword [ecx]
mov dword [eax + 0x5c], edi
mov edi, dword [ecx + 4]
mov dword [eax + 0x60], edi
mov edi, dword [ecx + 8]
mov dword [eax + 0x64], edi
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0x68], ecx
add eax, 0x70
sub dword [ebp - 8], edx
jne 0x4eea0
push 1
push 0x2ff
call fcn.00049620
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4efb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x44005c
mov dword [ebp - 0x18], 0x690072
mov dword [ebp - 0x14], 0x650076
mov dword [ebp - 0x10], 0x5c0072
mov dword [ebp - 0xc], 0x630041
mov dword [ebp - 8], 0x690070
mov dword [ebp - 4], 0
call fcn.0008b990
mov esp, ebp
pop ebp
ret

Function at 0x4f000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 0x1c], 0x44005c
mov dword [ebp - 0x18], 0x690072
mov dword [ebp - 0x14], 0x650076
mov dword [ebp - 0x10], 0x5c0072
mov dword [ebp - 0xc], 0x630041
mov dword [ebp - 8], 0x690070
mov dword [ebp - 4], ebx
call fcn.0008b990
cmp eax, ebx
je 0x4f098
lea edx, [eax + 0x3c]
mov eax, dword [ebp + 8]
lea ecx, [ebx + 2]
add eax, 0x24
push esi
lea esi, [ecx - 2]
mov dword [eax - 0x24], esi
mov esi, dword [edx - 4]
mov dword [eax - 0x18], esi
lea esi, [ecx - 1]
mov dword [eax], esi
mov esi, dword [edx]
mov dword [eax + 0xc], esi
mov dword [eax + 0x24], ecx
mov esi, dword [edx + 4]
mov dword [eax + 0x30], esi
lea esi, [ecx + 1]
mov dword [eax + 0x48], esi
mov esi, dword [edx + 8]
add ecx, 4
mov dword [eax + 0x54], esi
lea esi, [ecx - 2]
add edx, 0x10
add eax, 0x90
cmp esi, 0x1b
jbe 0x4f050
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4f2b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 0x2c], 0x44005c
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x5c0072
mov dword [ebp - 0x1c], 0x630041
mov dword [ebp - 0x18], 0x690070
mov dword [ebp - 0x14], ebx
call fcn.0008b990
cmp eax, ebx
je 0x4f337
mov ecx, dword [esi]
cmp ecx, 0x1b
ja 0x4f337
mov edx, dword [esi + 8]
lea eax, [eax + ecx*4 + 0x38]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
push eax
cli
mov eax, cr0
mov dword [ebp - 4], eax
and eax, 0xfffeffff
mov cr0, eax
push ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
lock xchg dword [eax], ebx
mov dword [ebp - 8], ebx
pop ebx
mov eax, dword [ebp - 4]
mov cr0, eax
sti
pop eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
push ebx
mov eax, 0x730079
mov ecx, 0x1770
xor ebx, ebx
mov dword [ebp - 0x60], 0x53005c
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 0x650074
mov dword [ebp - 0x54], 0x52006d
mov dword [ebp - 0x50], 0x6f006f
mov dword [ebp - 0x4c], 0x5c0074
mov dword [ebp - 0x48], 0x790073
mov dword [ebp - 0x44], 0x740073
mov dword [ebp - 0x40], 0x6d0065
mov dword [ebp - 0x3c], 0x320033
mov dword [ebp - 0x38], 0x64005c
mov dword [ebp - 0x34], 0x690072
mov dword [ebp - 0x30], 0x650076
mov dword [ebp - 0x2c], 0x730072
cmp word [edx], cx
push esi
mov dword [ebp - 0x28], 0x61005c
mov dword [ebp - 0x24], 0x610074
jae 0x4f501
mov dword [ebp - 0x20], 0x690070
mov dword [ebp - 0x1c], 0x73002e
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
jmp 0x4f51c
mov dword [ebp - 0x20], 0x6f0070
mov dword [ebp - 0x1c], 0x740072
mov dword [ebp - 0x18], 0x73002e
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x60]
call fcn.0004d700
test eax, eax
jne 0x4f55e
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
push ebx
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x4f54c
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
push ebx
xor ebx, ebx
mov eax, 0x1770
push esi
push edi
mov byte [ebp - 1], bl
cmp word [ecx], ax
jae 0x4f8e5
push 0x2f6
jmp 0x4f8ea
push 0x2f8
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x4faaa
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.0004f460
cmp al, 1
jne 0x4faaa
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 8]
push esi
mov dword [ebp - 0x1c], 0x736f746e
mov dword [ebp - 0x18], 0x6c6e726b
mov dword [ebp - 0x14], 0x6578652e
mov dword [ebp - 0x30], 0x43666f49
mov dword [ebp - 0x2c], 0x6c706d6f
mov dword [ebp - 0x28], 0x52657465
mov dword [ebp - 0x24], 0x65757165
mov dword [ebp - 0x20], 0x7473
call fcn.00014e00
cmp al, 1
jne 0x4f975
mov ecx, dword [ebp - 0xc]
add ecx, edi
push ecx
push 0x2fb
call fcn.00049620
push 0x1098
call fcn.00049650
mov edx, dword [ebp - 8]
mov ebx, eax
push ebx
push edx
mov eax, esi
mov dword [ebp - 0xc], ebx
call fcn.0004f570
cmp al, 1
jne 0x4f9fb
mov eax, dword [ebp - 8]
push eax
push esi
xor eax, eax
mov ecx, edi
call fcn.00014be0
cmp al, 1
jne 0x4f9fb
lea ecx, [ebx + 4]
mov edx, 0x1d
mov edi, edi
mov eax, dword [ecx]
mov dword [ecx - 4], 0
test eax, eax
je 0x4f9e5
lea edi, [eax + 0x10]
cmp edi, dword [ebp - 8]
ja 0x4f9e5
add eax, esi
mov dword [ecx - 4], 1
mov edi, dword [eax]
mov dword [ecx + 8], edi
mov edi, dword [eax + 4]
mov dword [ecx + 0xc], edi
mov edi, dword [eax + 8]
mov dword [ecx + 0x10], edi
mov eax, dword [eax + 0xc]
mov dword [ecx + 0x14], eax
add ecx, 0x1c
dec edx
jne 0x4f9b0
push 1
push 0x2fa
mov bl, 1
call fcn.00049620
jmp 0x4f9fe
mov bl, byte [ebp - 1]
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp bl, 1
jne 0x4faaa
push 0x2a7
call fcn.00049640
mov edx, eax
test edx, edx
jne 0x4fa3a
call fcn.0008b3d0
push 0x2a7
call fcn.00049640
mov edx, eax
push 0x4c
call fcn.00049640
push 0x21
mov esi, eax
call fcn.00049640
push 3
mov ecx, eax
call fcn.00049640
test edx, edx
je 0x4faaa
test esi, esi
je 0x4faaa
test ecx, ecx
je 0x4faaa
test eax, eax
je 0x4faaa
lea edi, [edx + 0x10]
cmp edi, ecx
ja 0x4faaa
mov ecx, dword [ebp - 0xc]
add ecx, 4
mov edi, 0x1c
cmp dword [ecx], 0
jne 0x4faa4
mov dword [ecx - 4], 1
mov dword [ecx], edx
lea ebx, [eax + edx]
mov dword [ecx + 4], ebx
mov ebx, dword [esi + edx]
mov dword [ecx + 8], ebx
mov ebx, dword [esi + edx + 4]
mov dword [ecx + 0xc], ebx
mov ebx, dword [esi + edx + 8]
mov dword [ecx + 0x10], ebx
mov ebx, dword [esi + edx + 0xc]
mov dword [ecx + 0x14], ebx
add ecx, 0x1c
dec edi
jne 0x4fa75
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x44005c
mov dword [ebp - 0x18], 0x690072
mov dword [ebp - 0x14], 0x650076
mov dword [ebp - 0x10], 0x5c0072
mov dword [ebp - 0xc], 0x740041
mov dword [ebp - 8], 0x700061
mov dword [ebp - 4], 0x69
call fcn.0008b990
mov esp, ebp
pop ebp
ret

Function at 0x4fb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
lea eax, [ebp - 0x1c]
push eax
xor bl, bl
mov dword [ebp - 0x1c], 0x44005c
mov dword [ebp - 0x18], 0x690072
mov dword [ebp - 0x14], 0x650076
mov dword [ebp - 0x10], 0x5c0072
mov dword [ebp - 0xc], 0x740041
mov dword [ebp - 8], 0x700061
mov dword [ebp - 4], 0x69
call fcn.0008b990
test eax, eax
je 0x4fbb3
push esi
xor edx, edx
lea esi, [eax + 0x3c]
lea ecx, [edi + 0x24]
mov dword [ecx - 0x24], edx
mov ebx, dword [esi - 4]
mov dword [ecx - 0x18], ebx
lea ebx, [edx + 1]
mov dword [ecx], ebx
mov ebx, dword [esi]
mov dword [ecx + 0xc], ebx
lea ebx, [edx + 2]
mov dword [ecx + 0x24], ebx
mov ebx, dword [esi + 4]
mov dword [ecx + 0x30], ebx
lea ebx, [edx + 3]
mov dword [ecx + 0x48], ebx
mov ebx, dword [esi + 8]
mov dword [ecx + 0x54], ebx
add edx, 4
add esi, 0x10
add ecx, 0x90
cmp edx, 0x1b
jbe 0x4fb60
mov dword [edi + 0x3f0], edx
mov ecx, dword [eax + 0x30]
pop esi
mov dword [edi + 0x3fc], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fd40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
lea eax, [ebp - 0x2c]
push eax
xor ebx, ebx
mov dword [ebp - 0x2c], 0x44005c
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x5c0072
mov dword [ebp - 0x1c], 0x740041
mov dword [ebp - 0x18], 0x700061
mov dword [ebp - 0x14], 0x69
call fcn.0008b990
cmp eax, ebx
je 0x4fe10
mov ecx, dword [esi]
cmp ecx, 0x1b
ja 0x4fdcf
mov edx, dword [esi + 8]
lea eax, [eax + ecx*4 + 0x38]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
push eax
cli
mov eax, cr0
mov dword [ebp - 4], eax
and eax, 0xfffeffff
mov cr0, eax
push ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
lock xchg dword [eax], ebx
mov dword [ebp - 8], ebx
pop ebx
mov eax, dword [ebp - 4]
mov cr0, eax
sti
pop eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x1c
jne 0x4fe10
mov ecx, dword [esi + 8]
add eax, 0x30
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ebx
push eax
cli
mov eax, cr0
mov dword [ebp - 8], eax
and eax, 0xfffeffff
mov cr0, eax
push ebx
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
lock xchg dword [eax], ebx
mov dword [ebp - 4], ebx
pop ebx
mov eax, dword [ebp - 8]
mov cr0, eax
sti
pop eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ff40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov eax, 0x790073
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x60]
xor bl, bl
mov dword [ebp - 0x60], 0x53005c
mov dword [ebp - 0x5c], 0x730079
mov dword [ebp - 0x58], 0x650074
mov dword [ebp - 0x54], 0x52006d
mov dword [ebp - 0x50], 0x6f006f
mov dword [ebp - 0x4c], 0x5c0074
mov dword [ebp - 0x44], 0x740073
mov dword [ebp - 0x40], 0x6d0065
mov dword [ebp - 0x3c], 0x320033
mov dword [ebp - 0x38], 0x64005c
mov dword [ebp - 0x34], 0x690072
mov dword [ebp - 0x30], 0x650076
mov dword [ebp - 0x2c], 0x730072
mov dword [ebp - 0x28], 0x63005c
mov dword [ebp - 0x24], 0x61006c
mov dword [ebp - 0x20], 0x730073
mov dword [ebp - 0x1c], 0x6e0070
mov dword [ebp - 0x18], 0x2e0070
mov dword [ebp - 0x10], 0x73
call fcn.0004d700
test eax, eax
jne 0x5001c
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x5000a
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [edi + 0x3c]
xor cl, cl
push 0x2f1
mov byte [ebp - 1], cl
call fcn.00049640
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x5022e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
push ecx
xor edx, edx
mov eax, edi
mov dword [ebp - 0x24], 0x73616c43
mov dword [ebp - 0x20], 0x696e4973
mov dword [ebp - 0x1c], 0x6c616974
mov dword [ebp - 0x18], 0x657a69
call fcn.00015090
cmp eax, ebx
je 0x500cf
mov ecx, dword [ebp + 8]
mov edx, dword [esi + edi + 0x34]
mov dword [ebp - 8], edx
cmp eax, ecx
jae 0x500cf
lea edx, [eax + 0x1000]
cmp edx, ecx
jae 0x500cf
add eax, edi
lea ecx, [eax + 0x1000]
xor edi, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
cmp eax, ecx
jb 0x500e6
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
push ecx
lea esi, [ebp - 0x58]
mov ecx, eax
call fcn.00032c70
test al, al
je 0x50222
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
lea ecx, [eax - 0x10ab]
cmp ecx, 7
ja 0x50135
mov eax, dword [ebp - 0x48]
test eax, eax
jle 0x50210
mov edx, dword [ebp - 8]
cmp eax, edx
jbe 0x50210
mov esi, eax
sub esi, edx
cmp dword [ebp + 8], esi
jbe 0x50210
mov dword [ebp + ecx*4 - 0x34], eax
jmp 0x50210
cmp eax, 0x107c
jne 0x5019c
mov eax, dword [ebp - 0x4c]
lea ecx, [eax - 0x38]
cmp ecx, 0x6c
ja 0x50210
test al, 3
jne 0x50210
lea ecx, [eax - 0x38]
shr ecx, 2
cmp ecx, 0x1b
ja 0x50210
movzx edx, byte [ebp - 0x50]
shr edx, 3
and edx, 7
mov eax, dword [ebp + edx*4 - 0x34]
test eax, eax
je 0x50210
sub eax, dword [ebp - 8]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx + edx*4]
mov dword [ecx + 4], eax
add eax, dword [ebp - 0x10]
mov byte [ebp - 1], 1
mov dword [ecx + 8], eax
inc ebx
mov edi, ecx
jmp 0x50210
cmp eax, 0x10b8
jne 0x501f2
mov ecx, dword [ebp - 0x48]
test ecx, ecx
jle 0x50210
cmp ecx, dword [ebp - 8]
jbe 0x50210
sub ecx, dword [ebp - 8]
cmp dword [ebp + 8], ecx
jbe 0x50210
mov eax, dword [ebp - 0x4c]
lea edx, [eax - 0x38]
cmp edx, 0x6c
ja 0x50210
test al, 3
jne 0x50210
add eax, 0xffffffc8
shr eax, 2
cmp eax, 0x1b
ja 0x50210
lea edx, [eax*8]
sub edx, eax
mov eax, dword [ebp + 0xc]
lea eax, [eax + edx*4]
mov dword [eax + 4], ecx
add ecx, dword [ebp - 0x10]
mov byte [ebp - 1], 1
mov dword [eax + 8], ecx
inc ebx
mov edi, eax
jmp 0x50210
cmp eax, 0x107e
je 0x50210
cmp ebx, 1
ja 0x50222
jne 0x50210
xor ebx, ebx
test edi, edi
je 0x50210
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x14]
jb 0x500e0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
xor ebx, ebx
push 0x2f1
mov byte [ebp - 1], bl
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x5041a
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0004ff40
cmp al, 1
jne 0x5041a
mov esi, dword [ebp - 0xc]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 8]
push esi
mov dword [ebp - 0x1c], 0x736f746e
mov dword [ebp - 0x18], 0x6c6e726b
mov dword [ebp - 0x14], 0x6578652e
mov dword [ebp - 0x30], 0x43666f49
mov dword [ebp - 0x2c], 0x6c706d6f
mov dword [ebp - 0x28], 0x52657465
mov dword [ebp - 0x24], 0x65757165
mov dword [ebp - 0x20], 0x7473
call fcn.00014e00
cmp al, 1
jne 0x502de
mov edx, dword [ebp - 0xc]
add edx, edi
push edx
push 0x2f4
call fcn.00049620
push 0xfc6
call fcn.00049650
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x5036b
mov eax, dword [ebp - 8]
push ebx
push eax
mov eax, esi
call fcn.00050030
cmp al, 1
jne 0x5036b
mov ecx, dword [ebp - 8]
push ecx
push esi
xor eax, eax
mov ecx, edi
call fcn.00014be0
cmp al, 1
jne 0x5036b
lea ecx, [ebx + 4]
mov edx, 0x1d
jmp 0x50320
mov eax, dword [ecx]
mov dword [ecx - 4], 0
test eax, eax
je 0x50355
lea edi, [eax + 0x10]
cmp edi, dword [ebp - 8]
ja 0x50355
add eax, esi
mov dword [ecx - 4], 1
mov edi, dword [eax]
mov dword [ecx + 8], edi
mov edi, dword [eax + 4]
mov dword [ecx + 0xc], edi
mov edi, dword [eax + 8]
mov dword [ecx + 0x10], edi
mov eax, dword [eax + 0xc]
mov dword [ecx + 0x14], eax
add ecx, 0x1c
dec edx
jne 0x50320
push 1
push 0x2f3
mov bl, 1
call fcn.00049620
jmp 0x5036e
mov bl, byte [ebp - 1]
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp bl, 1
jne 0x5041a
push 0x2a7
call fcn.00049640
mov edx, eax
test edx, edx
jne 0x503aa
call fcn.0008b3d0
push 0x2a7
call fcn.00049640
mov edx, eax
push 0x4c
call fcn.00049640
push 0x21
mov esi, eax
call fcn.00049640
push 3
mov ecx, eax
call fcn.00049640
test edx, edx
je 0x5041a
test esi, esi
je 0x5041a
test ecx, ecx
je 0x5041a
test eax, eax
je 0x5041a
lea edi, [edx + 0x10]
cmp edi, ecx
ja 0x5041a
mov ecx, dword [ebp - 0xc]
add ecx, 4
mov edi, 0x1c
cmp dword [ecx], 0
jne 0x50414
mov dword [ecx - 4], 1
mov dword [ecx], edx
lea ebx, [eax + edx]
mov dword [ecx + 4], ebx
mov ebx, dword [esi + edx]
mov dword [ecx + 8], ebx
mov ebx, dword [esi + edx + 4]
mov dword [ecx + 0xc], ebx
mov ebx, dword [esi + edx + 8]
mov dword [ecx + 0x10], ebx
mov ebx, dword [esi + edx + 0xc]
mov dword [ecx + 0x14], ebx
add ecx, 0x1c
dec edi
jne 0x503e5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 0x1c], 0x44005c
mov dword [ebp - 0x18], 0x690072
mov dword [ebp - 0x14], 0x650076
mov dword [ebp - 0x10], 0x5c0072
mov dword [ebp - 0xc], 0x690044
mov dword [ebp - 8], 0x6b0073
mov dword [ebp - 4], ebx
call fcn.0008b990
cmp eax, ebx
je 0x504d3
push esi
xor edx, edx
lea esi, [eax + 0x3c]
lea ecx, [edi + 0x24]
lea esp, [esp]
mov dword [ecx - 0x24], edx
mov ebx, dword [esi - 4]
mov dword [ecx - 0x18], ebx
lea ebx, [edx + 1]
mov dword [ecx], ebx
mov ebx, dword [esi]
mov dword [ecx + 0xc], ebx
lea ebx, [edx + 2]
mov dword [ecx + 0x24], ebx
mov ebx, dword [esi + 4]
mov dword [ecx + 0x30], ebx
lea ebx, [edx + 3]
mov dword [ecx + 0x48], ebx
mov ebx, dword [esi + 8]
mov dword [ecx + 0x54], ebx
add edx, 4
add esi, 0x10
add ecx, 0x90
cmp edx, 0x1b
jbe 0x50480
mov dword [edi + 0x3f0], edx
mov ecx, dword [eax + 0x30]
pop esi
mov dword [edi + 0x3fc], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 0x2c], 0x44005c
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x5c0072
mov dword [ebp - 0x1c], 0x690044
mov dword [ebp - 0x18], 0x6b0073
mov dword [ebp - 0x14], ebx
call fcn.0008b990
cmp eax, ebx
je 0x5083c
mov ecx, dword [esi]
cmp ecx, 0x1b
ja 0x507fb
mov edx, dword [esi + 8]
lea eax, [eax + ecx*4 + 0x38]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
push eax
cli
mov eax, cr0
mov dword [ebp - 4], eax
and eax, 0xfffeffff
mov cr0, eax
push ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
lock xchg dword [eax], ebx
mov dword [ebp - 8], ebx
pop ebx
mov eax, dword [ebp - 4]
mov cr0, eax
sti
pop eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x1c
jne 0x5083c
mov ecx, dword [esi + 8]
add eax, 0x30
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ebx
push eax
cli
mov eax, cr0
mov dword [ebp - 8], eax
and eax, 0xfffeffff
mov cr0, eax
push ebx
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
lock xchg dword [eax], ebx
mov dword [ebp - 4], ebx
pop ebx
mov eax, dword [ebp - 8]
mov cr0, eax
sti
pop eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
xor ebx, ebx
mov ecx, 0x730079
mov edx, 0x790073
push esi
mov dword [ebp - 0x60], 0x53005c
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], 0x650074
mov dword [ebp - 0x54], 0x52006d
mov dword [ebp - 0x50], 0x6f006f
mov dword [ebp - 0x4c], 0x5c0074
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], 0x740073
mov dword [ebp - 0x40], 0x6d0065
mov dword [ebp - 0x3c], 0x320033
mov dword [ebp - 0x38], 0x64005c
mov dword [ebp - 0x34], 0x690072
mov dword [ebp - 0x30], 0x650076
mov dword [ebp - 0x2c], 0x730072
cmp eax, ebx
jne 0x50b6d
mov dword [ebp - 0x28], 0x66005c
mov dword [ebp - 0x24], 0x730061
mov dword [ebp - 0x20], 0x660074
mov dword [ebp - 0x1c], 0x740061
mov dword [ebp - 0x18], 0x73002e
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ebx
jmp 0x50bba
cmp eax, 2
jne 0x50b93
mov dword [ebp - 0x28], 0x6e005c
mov dword [ebp - 0x24], 0x660074
mov dword [ebp - 0x20], 0x2e0073
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0x73
jmp 0x50bba
cmp eax, 1
jne 0x50bba
mov dword [ebp - 0x28], 0x65005c
mov dword [ebp - 0x24], 0x660078
mov dword [ebp - 0x20], 0x740061
mov dword [ebp - 0x1c], 0x73002e
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x60]
call fcn.0004d700
test eax, eax
jne 0x50bfc
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
push ebx
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x50bea
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8