joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eef31
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00512b9e
add esp, 0xc
mov esi, esi
jns 0x4eef72
pushf
jnp 0x4eef59
lea edi, [edi + 0x1b68]
lea edi, [edi - 0x1b68]
jne 0x4eef67
popf
ja 0x4eef6b
jb 0x4eef6d
jmp 0x4eef6f
js 0x4eef72
add esi, 0xc651e845
inc ebp
in eax, dx
je 0x4eef41
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
cld
and ecx, ecx
add esp, 0
ja 0x4ef02b
mov esp, esp
jne 0x4ef027
jbe 0x4ef02b
mov esp, 0x49c8e85c
add byte [eax], al
call fcn.004f39f8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ef040
xor eax, eax
jmp 0x4ef0d2
xchg esp, esp
xchg ecx, edi
xchg ecx, edi
jno 0x4ef060
pushf
or edi, edi
shr esi, 0
popf
lea esi, [esi + 0x42c4]
lea esi, [esi - 0x42c4]
jo 0x4ef060
mov eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004f3a1e
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00512b9e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4ef08a
xor eax, eax
jmp 0x4ef0d2
or edx, edx
push ebx
pop ebx
je 0x4ef090
jp 0x4ef0a1
pushf
shr ecx, 0
ror esp, 0
popf
jnp 0x4ef09e
jnp 0x4ef0a1
xor eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0050bbfe
add esp, 4
cmp esp, 0x4a65
xchg edi, edx
xchg edi, edx
inc ebx
dec ebx
sub esi, 0
jge 0x4ef0c7
mov edx, edx
jge 0x4ef0c2
jge 0x4ef0c4
jl 0x4ef0c7
lcall 0x4d8b, 0x500c458b
or byte [ecx - 1], dl
push ebp
cld
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ef2d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00512b9e
add esp, 0xc
shr esp, 0
and esp, 0xffffffff
call fcn.004ef2fb
Function at 0x4f81dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00512b9e
add esp, 0xc
rol ecx, 0x1d
rol ecx, 3
jl 0x4f81fd
cmp edx, dword [esp]
jnp 0x4f821c
pushf
xor ebx, 0x2c31
xor ebx, 0x2c31
or ecx, ecx
stc
popf
jno 0x4f8217
jns 0x4f8219
jp 0x4f821c
mov eax, 0x53e045c6
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x52
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x7a
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x62
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x46
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0
lea ebx, [ebx + 0x3425]
sub ebx, 0x3425
jb 0x4f827a
pushf
cmc
popf
jge 0x4f8275
jg 0x4f8277
jae 0x4f827a
add eax, 0x80e04d8a
jmp 0xe09d0a84
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x1e]
sub dl, 1
mov byte [ebp - 0x1e], dl
mov al, byte [ebp - 0x19]
sub al, 1
mov byte [ebp - 0x19], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x1d]
sub dl, 1
mov byte [ebp - 0x1d], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x1c]
sub dl, 1
mov byte [ebp - 0x1c], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
jne 0x4f8307
ror ebx, 0
call fcn.004f830f
Function at 0x4f9fef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or eax, 0x4eaf7c
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00512b9e
add esp, 0xc
std
cld
cmp ecx, eax
jo 0x4fa014
jle 0x4fa010
jno 0x4fa014
mov esp, 0xec45c6db
jp 0x4f9fdf
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0xe9956667
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
add ebx, dword [esp]
sub ebx, dword [esp]
jnp 0x4fa06a
pushf
rol ecx, 7
ror ecx, 7
clc
add edx, dword [esp]
sub edx, dword [esp]
popf
jl 0x4fa067
jp 0x4fa06a
mov ecx, 0x80f44d8a
jmp 0xf49d2874
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
sub ebx, 0
ja 0x4fa0e0
xor edx, dword [esp + 8]
xor edx, dword [esp + 8]
jl 0x4fa0f2
xchg ecx, ecx
je 0x4fa0ee
jge 0x4fa0f2
mov ebx, 0x9901e83a
invalid
call fcn.004f39f8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4fa105
jmp 0x4fa1b2
ror ecx, 0
call fcn.004fa10d
Function at 0x4fa897
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00512b9e
add esp, 0xc
test dword [esp + 4], eax
lea ebx, [ebx + 0x537e]
lea ebx, [ebx - 0x537e]
lea edx, [edx + 0x3f7b]
sub edx, 0x3f7b
jo 0x4fa8e1
pushf
add esi, dword [esp]
sub esi, dword [esp]
xchg esi, esi
jns 0x4fa8da
popf
jge 0x4fa8de
jno 0x4fa8e1
mov ecx, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
xchg esi, esi
jle 0x4fa940
pushf
test edi, 0x3fc4
jns 0x4fa92b
xchg esi, esi
popf
jb 0x4fa931
lea eax, [eax + 0x6f8b]
lea eax, [eax - 0x6f8b]
jg 0x4fa940
mov ecx, 0x80ec4d8a
jmp 0xec9d314a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.004f39f8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4fa9ca
jmp 0x4faa49
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f3a1e
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00512b9e
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4faa49
call fcn.004fa9f5
Function at 0x506cdd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00512b9e
add esp, 0xc
jl 0x506cf8
not ecx
not ecx
jl 0x506d10
lea esi, [esi + 0x2a5a]
lea esi, [esi - 0x2a5a]
ja 0x506d0c
jge 0x506d10
mov esp, 0xe845c62e
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
ja 0x506d46
je 0x506d4f
jbe 0x506d4a
jmp 0x506d4c
jne 0x506d4f
call 0x8138badd
jmp 0xe89df559
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
ror edi, 0
jg 0x506dbc
add ecx, dword [esp]
sub ecx, dword [esp]
js 0x506dd7
pushf
rol eax, 0x1d
ror eax, 0x1d
jno 0x506dce
push edi
pop edi
popf
jmp 0x506dd4
jns 0x506dd7
mov edi, 0xfecc1ce8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.004f39f8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x506dec
xor eax, eax
jmp 0x506e8d
or esp, 0
rol ebx, 0x16
rol ebx, 0xa
rol eax, 0
jns 0x506e10
je 0x506dfc
jnp 0x506dfe
xchg ecx, ecx
lea ecx, [ecx + 0x1841]
lea ecx, [ecx - 0x1841]
js 0x506e10
ljmp 0x8b51:0xe84d8da4
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004f3a1e
mov dword [ebp - 4], eax
cmp esp, 0x1734
jb 0x506e2d
jbe 0x506e2a
jae 0x506e2d
mov esp, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00512b9e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x506e47
xor eax, eax
jmp 0x506e8d
shr eax, 0
je 0x506e54
xchg ebx, ebx
jle 0x506e50
jne 0x506e54
or eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.0050bbfe
add esp, 4
mov esp, esp
std
cld
jge 0x506e8a
pushf
xchg edi, esi
xchg edi, esi
lea eax, [eax + 0x3f9f]
lea eax, [eax - 0x3f9f]
popf
lea ecx, [ecx + 0x3016]
lea ecx, [ecx - 0x3016]
nop
jl 0x506e8a
call 0x604cc48d
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x509a88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00512b9e
add esp, 0xc
lea edx, [edx]
sub esp, 0
cmp ecx, dword [esp + 8]
xor edx, dword [esp + 8]
xor edx, dword [esp + 8]
js 0x509abd
jns 0x509ab6
jno 0x509ab8
jns 0x509abd
mov eax, 0x45c62757
invalid
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
nop
neg ecx
neg ecx
and edi, 0xffffffff
jnp 0x509b02
xchg esi, ecx
xchg esi, ecx
jbe 0x509afd
mov esp, esp
jp 0x509b02
mov esp, 0x80f04d8a
jmp 0xf09e230c
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
rol ebx, 0
add ebx, dword [esp]
sub ebx, dword [esp]
add ebx, dword [esp]
sub ebx, dword [esp]
jno 0x509b7b
jnp 0x509b75
je 0x509b77
jo 0x509b7b
mov ecx, 0x9e78e81e
invalid
call fcn.004f39f8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x509b8d
xor eax, eax
jmp 0x509bc5
jl 0x509b8f
jno 0x509ba2
pushf
xchg ebx, esi
xchg ebx, esi
popf
lea ecx, [ecx]
jp 0x509b9d
je 0x509b9f
jo 0x509ba2
mov ebp, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f3a1e
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00512b9e
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50c9df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4ea67c], 1
jne 0x50cb45
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00512b9e
add esp, 0xc
lea esp, [esp]
ja 0x50ca0a
shl eax, 0
jno 0x50ca16
ja 0x50ca11
xchg ebx, ebx
jo 0x50ca16
add esi, 0xc648e845
inc ebp
in eax, dx
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
test esp, 0x7ae
jae 0x50ca4e
rol eax, 0xe
rol eax, 0x12
jle 0x50ca5d
jp 0x50ca58
jg 0x50ca5d
lcall 0x80e8, 0x4d8a6b04
jmp 0xe89e5267
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.004f39f8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x50cad2
xor eax, eax
jmp 0x50cb94
xor esp, 0
je 0x50caf8
pushf
cmp esp, 0x36e2
jbe 0x50cae1
popf
xchg esi, esi
lea edi, [edi + 0x5491]
lea edi, [edi - 0x5491]
xchg ebx, edi
xchg ebx, edi
jne 0x50caf8
mov esp, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004f3a1e
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00512b9e
add esp, 0xc
cmp edx, dword [esp + 8]
rol ecx, 0xf
rol ecx, 0x11
jae 0x50cb2f
jae 0x50cb26
mov ecx, ecx
lea eax, [eax]
jb 0x50cb2f
lcall 0xf8, 0x7d8326c9
cmp dword [ebp - 8], 0
je 0x50cb3f
mov eax, dword [ebp - 8]
mov dword [0x4ea67c], eax
jmp 0x50cb43
xor eax, eax
jmp 0x50cb94
jmp 0x50cb4e
mov ecx, dword [0x4ea67c]
mov dword [ebp - 8], ecx
jle 0x50cb50
test esp, 0x3e60
not eax
not eax
jg 0x50cb63
jp 0x50cb5e
xchg esp, esp
jle 0x50cb63
mov eax, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov ebx, ebx
shl edi, 0
jnp 0x50cb70
jnp 0x50cb7d
pushf
ja 0x50cb76
popf
jge 0x50cb7a
jp 0x50cb7d
mov ebp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0050bbfe
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50ef84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00512b9e
add esp, 0xc
lea esi, [esi + 0x29f4]
lea esi, [esi - 0x29f4]
jno 0x50efbc
ja 0x50efad
lea ebx, [ebx + 0x2d6d]
lea ebx, [ebx - 0x2d6d]
jo 0x50efbc
mov edx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
push esi
add esi, 0x5ff8
ror esi, 3
pop esi
jns 0x50f00e
pushf
jb 0x50effd
popf
lea edx, [edx + 0x6dab]
lea edx, [edx - 0x6dab]
js 0x50f00e
lcall 0x1e9, 0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004f39f8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x50f083
xor eax, eax
jmp 0x50f106
jns 0x50f085
test dword [esp], edi
ror esp, 0
or ebx, 0
jb 0x50f098
lea esp, [esp]
jbe 0x50f095
jae 0x50f098
mov ecx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004f3a1e
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00512b9e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x50f0c2
xor eax, eax
jmp 0x50f106
test dword [esp], esi
ja 0x50f0c7
jge 0x50f0d9
pushf
rol ebx, 0
jb 0x50f0d0
popf
xchg esi, esi
jl 0x50f0d6
jl 0x50f0d9
or dword [ebx - 0x17af03bb], 0xffffcb1c
mov eax, dword [ebp - 4]
push eax
call fcn.0050bbfe
add esp, 4
mov esp, esp
or edx, 0
test dword [esp], esi
Function at 0x5104c7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00512b9e
add esp, 0xc
push 0x21
push 0x4eae38
lea ecx, [ebp - 0x138]
push ecx
call fcn.0050e2de
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x5105cf
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.00512b9e
add esp, 0xc
push 0xb
push 0x4eae5c
lea edx, [ebp - 0x138]
push edx
call fcn.0050e2de
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x5105c2
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0050e2de
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x5105d1
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x511e66
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4ea680], 1
jne 0x511fa8
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00512b9e
add esp, 0xc
call fcn.00511e91
mov eax, dword [0x4ea680]
mov dword [ebp - 8], eax
Function at 0x51631e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00512b9e
add esp, 0xc
test dword [esp + 0xc], ecx
nop
jae 0x516350
jno 0x516347
mov esi, esi
jmp 0x51634b
jle 0x51634d
jb 0x516350
call 0x523da91a
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004f39f8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x516418
xor eax, eax
jmp 0x516493
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f3a1e
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00512b9e
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x516442
xor eax, eax
jmp 0x516493
stc
and edx, edx
jp 0x516458
pushf
mov ebx, ebx
shl esp, 0
xor esp, 0
popf
jl 0x516455
jnp 0x516458
jmp 0x5139a9e7
mov eax, dword [ebp - 0x18]
push eax
call fcn.0050bbfe
add esp, 4
xor ecx, 0x4a10
xor ecx, 0x4a10
lea eax, [eax + 0x5b4f]
lea eax, [eax - 0x5b4f]
jl 0x516488
xchg esi, edi
xchg esi, edi
jge 0x516484
jge 0x516488
ljmp 0x8b51:0xc4d8bc0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8