joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce40
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x40eaf3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], ebx
call sub.MFC42.DLL_CString::MakeLower
mov ebp, dword [esp + 0x150]
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebx
push ebx
rep stosd dword es:[edi], eax
push 2
mov dword [ebp], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40cfb7
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40cfb0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x38]
lea edx, [esp + 0x10]
push ecx
push 0x4146a8
push edx
mov byte [esp + 0x150], 1
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::MakeLower
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
push eax
push ecx
call edi
add esp, 8
test eax, eax
je 0x40cf74
lea ecx, [esp + 0x10]
mov byte [esp + 0x144], bl
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x14]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40cfb0
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x38]
lea ecx, [esp + 0x10]
push eax
push 0x4146a8
push ecx
mov byte [esp + 0x150], 1
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::MakeLower
mov edx, dword [esp + 0x14c]
mov eax, dword [esp + 0x10]
push edx
push eax
call edi
add esp, 8
test eax, eax
jne 0x40cf0a
mov ecx, dword [esp + 0x1c]
push esi
mov dword [ebp], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov byte [esp + 0x144], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x40cfd0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret

Function at 0x40cff0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40d00b
pop esi
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x50e000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005334d1
add esp, 0xc
js 0x50e022
mov edi, edi
call fcn.0050e029
Function at 0x50e3c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x50b228], 1
jne 0x50e512
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005334d1
add esp, 0xc
cld
jl 0x50e3fb
pushf
jl 0x50e3ee
dec esi
inc esi
popf
je 0x50e3f4
jmp 0x50e3f6
lea esi, [esi]
jge 0x50e3fb
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
xchg esp, esp
jbe 0x50e445
pushf
test dword [esp], ebx
ror esi, 0
cmp esi, edi
rol eax, 0x1f
rol eax, 1
popf
jo 0x50e442
ja 0x50e445
xor eax, 0x80e84d8a
jmp 0xe89e6c4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00515558
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x50e4ba
xor eax, eax
jmp 0x50e56c
jl 0x50e4bc
je 0x50e4c7
jl 0x50e4c0
jne 0x50e4c2
jg 0x50e4c4
jne 0x50e4c7
add eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0051c169
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005334d1
add esp, 0xc
mov ebx, ebx
ror edi, 0
dec edx
inc edx
cmp ecx, esi
jae 0x50e4fc
jmp 0x50e4f4
xchg esp, esp
jo 0x50e4f8
jb 0x50e4fc
lcall 0x7400, 0xf87d8373
or cl, byte [ebx + 0x28a3f845]
mov dl, 0x50
add bl, ch
add al, 0x33
shr bl, 0x5c
cmp dword [ebp - 8], 0
je 0x50e50c
mov eax, dword [ebp - 8]
mov dword [0x50b228], eax
jmp 0x50e510
xor eax, eax
jmp 0x50e56c
jmp 0x50e51b
mov ecx, dword [0x50b228]
mov dword [ebp - 8], ecx
cld
jbe 0x50e530
pushf
jl 0x50e522
xchg edx, ecx
xchg edx, ecx
test edi, eax
stc
popf
jnp 0x50e52d
ja 0x50e530
add eax, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
and edx, edx
push eax
pop eax
shl esp, 0
jnp 0x50e555
pushf
or eax, 0
xor edi, dword [esp]
xor edi, dword [esp]
popf
xchg esp, esp
jns 0x50e550
jp 0x50e552
jp 0x50e555
call 0x514d2ae4
mov eax, dword [ebp - 4]
push eax
call fcn.0052fdaf
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50ee60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
jp 0x50ee6b
not ecx
not ecx
mov edi, edi
je 0x50ee83
lea edi, [edi + 0x59dd]
lea edi, [edi - 0x59dd]
jne 0x50ee83
mov edi, 0x203d8358
mov dl, 0x50
add byte [ecx], al
cmp dword [0x50b220], 1
jne 0x50efd1
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005334d1
add esp, 0xc
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 6], 0x42
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x47
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 7], 0x66
jb 0x50eed2
jge 0x50eed4
jb 0x50eeec
jg 0x50eed8
xchg esp, esp
jl 0x50eedc
lea edi, [edi + 0x20c8]
lea edi, [edi - 0x20c8]
jae 0x50eeec
sub eax, 0xf04d8a4e
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
lea ebx, [ebx + 0x3e6e]
sub ebx, 0x3e6e
and esi, esi
inc edx
dec edx
call fcn.0050ef61
mov ecx, dword [0x50b220]
mov dword [ebp - 4], ecx
Function at 0x511e45
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x50b22c], 1
jne 0x511f8a
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005334d1
add esp, 0xc
lea esi, [esi]
and esi, esi
je 0x511e7d
pushf
jne 0x511e75
popf
lea esp, [esp]
jne 0x511e7d
mov ebp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
cmp esp, 0x25b0
ror edx, 0x19
ror edx, 7
je 0x511ec3
mov ecx, ecx
jb 0x511ebb
lea edx, [edx]
jle 0x511ebf
jne 0x511ec3
adc dword [ebp - 0x76], 0xe980e84d
add dword [eax + 0x558ae84d], ecx
in eax, dx
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.00515558
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x511f30
mov eax, dword [ebp + 8]
jmp 0x511fee
push esi
add esi, 0x5924
ror esi, 8
pop esi
test edx, 0x2292
je 0x511f43
rol edx, 8
ror edx, 8
jle 0x511f52
mov eax, eax
jg 0x511f52
mov ecx, 0x558d4dcf
call 0xf496aaab
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0051c169
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.005334d1
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x511f83
mov edx, dword [ebp - 8]
mov dword [0x50b22c], edx
jmp 0x511f88
mov eax, dword [ebp + 8]
jmp 0x511fee
jmp 0x511f92
mov eax, dword [0x50b22c]
mov dword [ebp - 8], eax
clc
cmp edx, ecx
call fcn.00511f9a
Function at 0x5152fd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x50a130], 1
je 0x51532b
rol edi, 0x1d
ror edi, 0x1d
xor esi, 0
jno 0x515321
jnp 0x51531c
jo 0x515321
mov edx, 0x30a16590
mov eax, dword [0x45890050]
cld
mov eax, dword [0x50a130]
mov dword [ebp - 4], eax
jmp 0x515346
mov ebx, ebx
cld
neg edx
neg edx
and esi, esi
jnp 0x51533f
nop
jmp 0x515339
xchg esp, esp
jp 0x51533f
mov edi, 0xe9c03353
or dword [edx], eax
add byte [eax], al
xor eax, eax
jmp 0x51554f
xchg esi, ecx
xchg esi, ecx
sub esp, 0
rol edx, 0x12
ror edx, 0x12
jb 0x515361
pushf
add esp, 0
popf
jbe 0x51535e
jae 0x515361
call 0x524da0f0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0052fdaf
add esp, 4
push 0xd
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005334d1
add esp, 0xc
jmp 0x51537f
ror ebx, 9
ror ebx, 0x17
test dword [esp + 4], eax
call fcn.0051538e
Function at 0x516dd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005334d1
add esp, 0xc
jb 0x516df6
shr edi, 0
xchg ebx, esi
xchg ebx, esi
jno 0x516e21
pushf
cmc
test edi, 0x49de
xor edx, 0
test dword [esp], edi
popf
ja 0x516e12
lea edx, [edx + 0x68ef]
lea edx, [edx - 0x68ef]
jo 0x516e21
mov esp, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.00515558
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x516ee9
xor eax, eax
jmp 0x516f60
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0051c169
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005334d1
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x516f13
xor eax, eax
jmp 0x516f60
xor ebx, edi
xor ebx, edi
jae 0x516f19
xor edi, esi
xor edi, esi
jb 0x516f3d
pushf
cmp edi, 0x5678
lea ecx, [ecx + 0x3791]
lea ecx, [ecx - 0x3791]
or edi, 0
popf
jb 0x516f3a
jae 0x516f3d
add eax, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.0052fdaf
add esp, 4
clc
je 0x516f55
jmp 0x516f4e
ja 0x516f50
mov esp, esp
jne 0x516f55
mov ebp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x51a340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x51a354
jmp 0x51a4f8
neg ecx
neg ecx
cmp edx, 0x2f6f
call fcn.0051a363
Function at 0x51a59c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.005334d1
add esp, 0xc
lea edi, [edi]
lea ecx, [ecx + 0x6f27]
lea ecx, [ecx - 0x6f27]
mov ebx, ebx
jne 0x51a5dc
pushf
push esi
pop esi
xor ecx, dword [esp]
xor ecx, dword [esp]
xchg ecx, ecx
popf
jae 0x51a5d7
mov esp, esp
je 0x51a5dc
add eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
xchg ebx, eax
xchg ebx, eax
jge 0x51a625
jg 0x51a612
jle 0x51a614
jl 0x51a616
lea edx, [edx + 0x7104]
lea edx, [edx - 0x7104]
jl 0x51a625
lcall 0x1e9, 0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
js 0x51a687
sub esp, 0
test dword [esp], ecx
xor eax, dword [esp]
xor eax, dword [esp]
jae 0x51a6ac
pushf
cld
and eax, eax
xor ebx, 0x6b89
xor ebx, 0x6b89
popf
nop
jb 0x51a6ac
call 0x17ac498
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x52cfce
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x51a6c4
mov eax, 1
jmp 0x51a78f
cmp esp, 0x280e
add esi, 0x4a5c
sub esi, 0x4a5c
lea esi, [esi]
test edx, 0x4860
jbe 0x51a6ef
pushf
shr ebx, 0
shl esp, 0
popf
jge 0x51a6ec
ja 0x51a6ef
mov edi, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0051c169
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.005334d1
add esp, 0xc
jo 0x51a711
cmp ecx, 0x4f9
je 0x51a725
pushf
or esi, esi
nop
popf
jbe 0x51a722
jne 0x51a725
mov edx, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x51a732
mov eax, 1
jmp 0x51a78f
shl esi, 0
ja 0x51a737
stc
jne 0x51a761
pushf
lea ecx, [ecx + 0x21cd]
sub ecx, 0x21cd
rol esi, 0x13
ror esi, 0x13
xchg edx, edx
add eax, dword [esp]
sub eax, dword [esp]
popf
jo 0x51a75a
jbe 0x51a75c
jns 0x51a75e
je 0x51a761
mov eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.0052fdaf
add esp, 4
je 0x51a76f
jnp 0x51a788
pushf
jnp 0x51a775
popf
jmp 0x51a779
lea eax, [eax + 0x330b]
lea eax, [eax - 0x330b]
jp 0x51a788
mov ecx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x528c68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005334d1
add esp, 0xc
test dword [esp + 0x10], esi
call 0x528c8a
add esp, 4
xchg edx, edx
or edi, 0
je 0x528cb4
pushf
and ecx, 0xffffffff
xchg esp, esp
sub eax, 0
lea eax, [eax + 0x3866]
lea eax, [eax - 0x3866]
popf
jmp 0x528cae
lea esp, [esp]
jne 0x528cb4
mov edi, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
shl esp, 0
xchg ecx, edx
xchg ecx, edx
xchg esp, esp
jle 0x528d06
pushf
lea esi, [esi]
rol edx, 0xd
rol edx, 0x13
test esi, edx
xchg ecx, eax
xchg ecx, eax
popf
jge 0x528d01
jne 0x528d03
jg 0x528d06
mov esp, 0x80ec4d8a
jmp 0xeca01510
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00515558
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x528d7b
xor eax, eax
jmp 0x528e08
xor ecx, dword [esp]
xor ecx, dword [esp]
lea edi, [edi]
cmc
jmp 0x528d86
jle 0x528d8d
jo 0x528d8a
jg 0x528d8d
mov edi, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0051c169
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005334d1
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x528db7
xor eax, eax
jmp 0x528e08
je 0x528db9
jge 0x528dbb
sub esp, 0
jg 0x528dd9
pushf
rol edx, 0x1f
ror edx, 0x1f
mov esp, esp
ror esi, 0xd
ror esi, 0x13
lea edx, [edx]
popf
js 0x528dd6
jle 0x528dd9
ljmp 0xcde8:0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0052fdaf
add esp, 4
push ebx
add ebx, 0x7595
ror ebx, 0xa
pop ebx
test dword [esp], edi
sub edx, 0
jbe 0x528e01
lea ebx, [ebx]
mov edi, edi
js 0x528dfe
ja 0x528e01
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x528f9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005334d1
add esp, 0xc
sub edx, 0
lea eax, [eax + 0x69ae]
lea eax, [eax - 0x69ae]
xchg ebx, edx
xchg ebx, edx
jne 0x528fd9
mov edi, edi
nop
je 0x528fd9
mov eax, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jge 0x529084
std
cld
test edi, ebx
ror edx, 7
rol edx, 7
jl 0x529095
jmp 0x529092
jge 0x529095
mov esi, 0xfec4bee8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.00515558
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5290aa
xor eax, eax
jmp 0x52914c
js 0x5290ac
nop
sub esp, 0
ror edi, 0
jb 0x5290d4
pushf
neg eax
neg eax
rol esi, 0x10
ror esi, 0x10
dec ecx
inc ecx
call 0x5290c8
add esp, 4
popf
xchg esi, esi
jnp 0x5290d1
jae 0x5290d4
or dword [ebp - 0x74ad17ab], 0xe850f845
mov byte [eax], dh
invalid
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0051c169
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.005334d1
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x5290fe
xor eax, eax
jmp 0x52914c
jns 0x529100
jno 0x529113
nop
lea edi, [edi + 0x2c28]
lea edi, [edi - 0x2c28]
jo 0x529113
mov ebx, 0xfc558bf5
mov edx, dword [ebp - 4]
push edx
call fcn.0052fdaf
add esp, 4
cmp esp, 0x1a28
jge 0x529127
jle 0x529141
pushf
dec edx
inc edx
popf
lea eax, [eax + 0x5112]
lea eax, [eax - 0x5112]
xchg ebx, ebx
nop
jg 0x529141
mov ebp, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52a57d
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x50a138
call fcn.0052ea24
add esp, 0xc
mov byte [0x50a138], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret