joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471e20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x471ef9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
mov dl, byte [eax + 0xc]
mov eax, dword [0x47bcbc]
call fcn.00477d14
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp al, 3
jne 0x471eb5
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00472198
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
cmp eax, 0xf
jne 0x471eb5
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047230c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0xc]
cmp eax, 4
ja 0x471eb9
xor ebx, ebx
jmp 0x471ebb
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471f00
lea eax, [ebp - 0x18]
call fcn.00405834
lea eax, [ebp - 0x14]
call fcn.00405834
lea eax, [ebp - 0x10]
call fcn.00405834
lea eax, [ebp - 0xc]
call fcn.00405834
lea eax, [ebp - 8]
call fcn.00405834
lea eax, [ebp - 4]
call fcn.00405834
ret

Function at 0x472668
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x47267f
add esp, 0xfffffff0
call fcn.004034e8
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x4726fb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403154
mov byte [esi + 0xc], bl
mov al, byte [ebp + 8]
mov byte [esi + 0xd], al
lea ecx, [ebp - 0xc]
xor edx, edx
mov dl, byte [esi + 0xc]
mov eax, dword [0x47bcbc]
call fcn.00477d14
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov byte [esi + 0xe], al
xor eax, eax
mov dword [esi + 0x210], eax
mov eax, esi
call fcn.00472778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472702
lea eax, [ebp - 0xc]
call fcn.00405834
lea eax, [ebp - 8]
call fcn.00405834
ret
Function at 0x473e2c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x473eec
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
xor edx, edx
mov dl, byte [eax + 0xc]
mov eax, dword [0x47bcbc]
call fcn.00477d14
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp al, 9
je 0x473e83
mov ebx, 0x80000002
mov edi, 0x80000004
jmp 0x473e8d
mov ebx, 0x80860003
mov edi, 0x80860006
mov eax, esi
call fcn.00403f98
sub edi, ebx
jb 0x473ec6
inc edi
xchg edi, ebx
push edi
push 1
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0xc]
mov dl, 1
mov eax, dword [0x46e5bc]
call fcn.004714a8
lea edx, [ebp - 0x10]
call fcn.004713b8
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.00404260
inc edi
dec ebx
jne 0x473e9b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473ef3
lea eax, [ebp - 0x10]
call fcn.00403f98
lea eax, [ebp - 0xc]
call fcn.00405834
lea eax, [ebp - 8]
call fcn.00405834
ret
Function at 0x475fd8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x475fe1
xchg dword [ebp - 4], ecx
push ebx
push esi
test dl, dl
je 0x475ff9
add esp, 0xfffffff0
call fcn.004034e8
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x47613c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403154
mov bl, byte [ebp - 2]
mov byte [esi + 0xc], bl
lea ecx, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov eax, dword [0x47bcbc]
call fcn.00477d14
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp al, 9
sete al
mov byte [esi + 0xe], al
cmp byte [esi + 0xe], 0
jne 0x476098
lea ecx, [ebp - 0x1c]
xor edx, edx
mov dl, byte [esi + 0xc]
mov eax, dword [0x47bcbc]
call fcn.00477d14
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0xc]
cmp eax, 0x80000004
setb al
mov byte [esi + 0xd], al
jmp 0x4760de
lea ecx, [ebp - 0x2c]
xor edx, edx
mov dl, byte [esi + 0xc]
mov eax, dword [0x47bcbc]
call fcn.00477d14
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0xc]
cmp eax, 0x80860006
setb al
mov byte [esi + 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476143
lea eax, [ebp - 0x2c]
call fcn.00405834
lea eax, [ebp - 0x28]
call fcn.00405834
lea eax, [ebp - 0x24]
call fcn.00405834
lea eax, [ebp - 0x20]
call fcn.00405834
lea eax, [ebp - 0x1c]
call fcn.00405834
lea eax, [ebp - 0x18]
call fcn.00405834
lea eax, [ebp - 0x14]
call fcn.00405834
lea eax, [ebp - 0x10]
call fcn.00405834
lea eax, [ebp - 0xc]
call fcn.00405834
lea eax, [ebp - 8]
call fcn.00405834
ret
Function at 0x476338
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x476340
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4764e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
xor edx, edx
mov dl, byte [esi + 0xc]
mov eax, dword [0x47bcbc]
call fcn.00477d14
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp al, 2
jne 0x4763dc
push 2
push 2
push 1
mov bl, byte [esi + 0xc]
mov ecx, ebx
mov dl, 1
mov eax, dword [0x46e5bc]
call fcn.004714a8
lea edx, [ebp - 0x14]
call fcn.004715d0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x10]
and eax, 0xff
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x46e5bc]
call fcn.004714a8
mov edx, eax
test edx, edx
je 0x4763d2
sub edx, 0xffffffd8
lea eax, [ebp - 4]
call fcn.0040584c
jmp 0x476437
mov al, byte [esi + 0xd]
sub al, 3
jb 0x4763e7
sub al, 2
jne 0x476410
push 0x80000005
push 1
mov cl, byte [esi + 0xc]
mov dl, 1
mov eax, dword [0x46e5bc]
call fcn.004714a8
mov edx, eax
test edx, edx
je 0x476406
sub edx, 0xffffffd8
lea eax, [ebp - 4]
call fcn.0040584c
jmp 0x476437
push 0x80000006
push 1
mov cl, byte [esi + 0xc]
mov dl, 1
mov eax, dword [0x46e5bc]
call fcn.004714a8
mov edx, eax
test edx, edx
je 0x47642f
sub edx, 0xffffffd8
lea eax, [ebp - 4]
call fcn.0040584c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, 1
mov eax, esi
call fcn.00476210
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [ebp - 0x1c]
mov ecx, 2
mov eax, esi
call fcn.00476210
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, dword [ebp - 0x20]
mov ecx, 3
mov eax, esi
call fcn.00476210
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 0x24]
mov ecx, 4
mov eax, esi
call fcn.00476210
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4764e7
lea eax, [ebp - 0x24]
mov edx, dword [0x46e2c0]
mov ecx, 5
call fcn.00404a20
lea eax, [ebp - 0x10]
call fcn.00405834
lea eax, [ebp - 0xc]
call fcn.00405834
lea eax, [ebp - 8]
call fcn.00405834
lea eax, [ebp - 4]
call fcn.00405834
ret
Function at 0x4771bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x4771d3
add esp, 0xfffffff0
call fcn.004034e8
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x477242
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403154
mov bl, byte [ebp - 2]
mov byte [esi + 0xc], bl
lea ecx, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov eax, dword [0x47bcbc]
call fcn.00477d14
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x18]
cmp al, 1
sete al
mov byte [esi + 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477249
lea eax, [ebp - 0xc]
call fcn.00405834
lea eax, [ebp - 8]
call fcn.00405834
ret

Function at 0x477424
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
add esp, 0xffffffc0
mov esi, eax
mov eax, esi
call fcn.004774d4
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 5
jb 0x47744b
mov eax, esi
call fcn.004774d4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
lea eax, [esp + 0x28]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, dword [esp + 0x10]
sbb edx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
fild qword [esp + 0x30]
fild qword [esp + 0x28]
fdivp st(1)
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, dword [esp + 8]
sbb edx, dword [esp + 0xc]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
fild qword [esp + 0x38]
fdivrp st(1)
fdiv dword [0x4774d0]
fstp qword [esp]
wait
fld qword [esp]
add esp, 0x40
pop esi
pop ebx
ret

Function at 0x4777d8
Capabilities:
Get system information on windows

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, edx
push esp
call sub.kernel32.dll_GetSystemInfo
mov ecx, dword [esp + 0x14]
mov dl, 1
mov eax, dword [0x46e3c4]
call fcn.00470c48
mov edx, eax
test edx, edx
je 0x4777fd
sub edx, 0xfffffff0
mov eax, ebx
call fcn.0040584c
add esp, 0x24
pop ebx
ret
Function at 0x50af3e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0050e181
add esp, 0xc
push 0x21
push 0x5058d8
lea ecx, [ebp - 0x138]
push ecx
call fcn.0051ec93
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x50b046
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0050e181
add esp, 0xc
push 0xb
push 0x5058fc
lea edx, [ebp - 0x138]
push edx
call fcn.0051ec93
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x50b039
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0051ec93
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x50b048
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x50b0ba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050e181
add esp, 0xc
jo 0x50b0d5
shl esp, 0
and edx, 0xffffffff
stc
jns 0x50b0eb
pushf
jb 0x50b0e2
jae 0x50b0e4
popf
je 0x50b0e8
js 0x50b0eb
add eax, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0
lea eax, [eax + 0x3744]
lea eax, [eax - 0x3744]
ja 0x50b12d
add esi, 0x5831
sub esi, 0x5831
jae 0x50b146
xchg esi, edi
xchg esi, edi
jnp 0x50b141
jp 0x50b143
jb 0x50b146
xor eax, 0x80e84d8a
jmp 0xe89e3950
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
xor ebx, 0
xchg ecx, ecx
not edi
not edi
jg 0x50b1ce
pushf
or esp, 0
jg 0x50b1c0
jmp 0x50b1c2
and esp, 0xffffffff
popf
jg 0x50b1c9
jp 0x50b1cb
jle 0x50b1ce
sub eax, 0x196e1
call fcn.005248b4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x50b1e3
xor eax, eax
jmp 0x50b440
shr esp, 0
lea esp, [esp]
or esp, 0
lea eax, [eax + 0x6c04]
lea eax, [eax - 0x6c04]
jge 0x50b212
pushf
cmp esp, 0x72fa
popf
xchg esi, ecx
xchg esi, ecx
xchg edx, ebx
xchg edx, ebx
lea esp, [esp]
jl 0x50b212
sub eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00510bb9
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050e181
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x50b23f
xor eax, eax
jmp 0x50b440
rol edi, 0
shr ecx, 0
jmp 0x50b247
jl 0x50b251
js 0x50b24b
jbe 0x50b24d
jge 0x50b251
sub eax, 0xfc4d8b6f
mov ecx, dword [ebp - 4]
push ecx
call fcn.0052580a
add esp, 4
push 0xd
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0050e181
add esp, 0xc
lea esp, [esp]
xor esi, ebx
xor esi, ebx
shl edi, 0
shl eax, 0
ja 0x50b28c
pushf
shr ebx, 0
jb 0x50b283
Function at 0x50ed22
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050e181
add esp, 0xc
jnp 0x50ed3d
jle 0x50ed52
pushf
xchg esi, esi
stc
cld
popf
je 0x50ed49
jp 0x50ed4b
xchg edi, edx
xchg edi, edx
jg 0x50ed52
mov esp, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
js 0x50ed8c
or esp, 0
clc
jmp 0x50ed92
jnp 0x50ed9c
xchg edi, edi
je 0x50ed98
jp 0x50ed9c
mov esi, 0xe84d8a0d
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.00531c64
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x50ee1f
xor eax, eax
jmp 0x50ee9d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00510bb9
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0050e181
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x50ee9b
test dword [esp], edx
test edi, eax
xchg edx, edx
add ebx, 0x232f
sub ebx, 0x232f
jl 0x50ee6d
pushf
lea esp, [esp]
add esi, 0
xchg esi, eax
xchg esi, eax
popf
xchg edi, edi
jle 0x50ee6a
jge 0x50ee6d
call 0x534d43fc
mov edx, dword [ebp - 4]
push edx
call fcn.0052580a
add esp, 4
rol edi, 0
xor esp, 0
jp 0x50ee86
jp 0x50ee83
jnp 0x50ee86
mov eax, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x50ee9d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x50fa30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0050e181
add esp, 0xc
js 0x50fa4b
jb 0x50fa4d
shr esp, 0
je 0x50fa6b
pushf
not ecx
not ecx
xchg edi, edi
or edx, 0
ror edi, 0x1f
ror edi, 1
popf
jbe 0x50fa66
jp 0x50fa68
jne 0x50fa6b
mov ebx, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
xchg edi, ecx
xchg edi, ecx
jns 0x50fac0
pushf
stc
test dword [esp], ebx
neg ebx
neg ebx
popf
lea eax, [eax]
jns 0x50fabd
js 0x50fac0
mov edi, 0x80ec4d8a
jmp 0xec9e82ca
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.005248b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x50fb4a
jmp 0x50fbc2
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00510bb9
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0050e181
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x50fbc2
rol esp, 0
sub eax, 0
jno 0x50fb82
jmp 0x50fb7a
jnp 0x50fb7c
lea esp, [esp]
jo 0x50fb82
xor eax, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.0052580a
add esp, 4
rol esp, 0
call 0x50fb96
add esp, 4
add esp, 0
mov esp, esp
jb 0x50fbaf
pushf
cmp esp, 0x6abd
popf
mov edi, edi
jae 0x50fbaf
mov edi, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x511949
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050e181
add esp, 0xc
lea edx, [edx]
xchg ebx, edx
xchg ebx, edx
xchg esp, esp
xchg esp, esp
jne 0x511982
pushf
cmp ebx, dword [esp]
stc
add esp, 0
popf
ja 0x51197b
jo 0x51197d
jae 0x51197f
je 0x511982
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
call fcn.005119c3
Function at 0x512cb6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0050e181
add esp, 0xc
test dword [esp], edi
nop
rol eax, 7
ror eax, 7
neg eax
neg eax
je 0x512cee
lea eax, [eax]
lea edx, [edx]
jne 0x512cee
call 0xec96f31d
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.005248b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x512db9
xor eax, eax
jmp 0x512e3a
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00510bb9
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0050e181
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x512de3
xor eax, eax
jmp 0x512e3a
cmp edi, dword [esp + 4]
jnp 0x512df9
pushf
lea esp, [esp]
or esp, 0
nop
popf
mov edi, edi
jp 0x512df9
or dword [ebx - 0x17af17bb], 0x12a08
mov eax, dword [ebp - 0x18]
push eax
call fcn.0052580a
add esp, 4
lea ecx, [ecx]
ror esp, 0
jl 0x512e2f
pushf
and edx, edx
cmp esi, 0x2e9f
rol eax, 0x16
ror eax, 0x16
popf
lea esi, [esi + 0x7a3f]
lea esi, [esi - 0x7a3f]
jb 0x512e2c
jge 0x512e2f
mov ebp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8