joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54cff2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x539bd4], 1
jne 0x54d172
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0054df2a
add esp, 0xc
ror ebx, 0x10
rol ebx, 0x10
jns 0x54d020
neg edi
neg edi
cmp esp, 0x6a78
jle 0x54d03b
pushf
nop
cld
jg 0x54d032
popf
js 0x54d036
jno 0x54d038
jg 0x54d03b
call 0x493d1605
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
js 0x54d06d
jns 0x54d06f
jg 0x54d071
jb 0x54d079
jl 0x54d075
jae 0x54d079
mov eax, 0xe84d8aa6
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00564d50
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x54d0ee
xor eax, eax
jmp 0x54d1d1
add esi, 0
lea ebx, [ebx + 0x7145]
sub ebx, 0x7145
jp 0x54d116
pushf
lea ebx, [ebx + 0x3f41]
sub ebx, 0x3f41
popf
jne 0x54d111
lea edi, [edi]
jnp 0x54d116
mov ebx, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00543a96
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0054df2a
add esp, 0xc
shr edi, 0
xchg ebx, eax
xchg ebx, eax
cmp esp, 0x5350
lea edi, [edi + 0x4dba]
lea edi, [edi - 0x4dba]
ja 0x54d15c
jnp 0x54d151
lea esp, [esp]
xchg esi, esi
js 0x54d158
jbe 0x54d15c
sub eax, 0xf87d83ce
add byte [edx + ecx - 0x75], dh
inc ebp
clc
cmp dword [ebp - 8], 0
je 0x54d16c
mov eax, dword [ebp - 8]
mov dword [0x539bd4], eax
jmp 0x54d170
xor eax, eax
jmp 0x54d1d1
jmp 0x54d17b
mov ecx, dword [0x539bd4]
mov dword [ebp - 8], ecx
cld
test eax, edx
jb 0x54d18c
jp 0x54d182
ja 0x54d184
lea edx, [edx]
jne 0x54d188
jae 0x54d18c
add eax, 0xf8558be3
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
inc ebx
dec ebx
jno 0x54d196
or edx, 0
test dword [esp], eax
jnp 0x54d1ba
pushf
xor edi, 0x1dba
xor edi, 0x1dba
jne 0x54d1ae
test dword [esp], edi
shl ebx, 0
popf
nop
jp 0x54d1ba
ljmp 0x8e8:0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0053e4cb
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x550a49
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0054df2a
add esp, 0xc
sub esi, 0
xor ebx, 0x1976
xor ebx, 0x1976
jae 0x550a77
nop
jb 0x550a77
mov esi, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
xor esi, dword [esp + 0xc]
xor esi, dword [esp + 0xc]
jae 0x550ab1
jp 0x550ac8
pushf
rol esi, 0
xor esp, 0
xchg edi, ebx
xchg edi, ebx
jae 0x550ac1
popf
jge 0x550ac5
jnp 0x550ac8
mov ebx, 0x80f04d8a
jmp 0xf0a292d2
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
or esp, 0
jno 0x550b35
mov esp, esp
mov edx, edx
jo 0x550b35
mov esp, 0x4216e84f
add dword [eax], eax
call fcn.00564d50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x550b47
xor eax, eax
jmp 0x550b9b
cmp ecx, 0x33c
add esi, 0x7d1d
sub esi, 0x7d1d
xor eax, 0x13f9
xor eax, 0x13f9
jle 0x550b78
lea esi, [esi + 0x881]
lea esi, [esi - 0x881]
jb 0x550b73
js 0x550b75
jg 0x550b78
mov esp, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00543a96
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0054df2a
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x551033
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0054df2a
add esp, 0xc
xor edi, dword [esp]
xor edi, dword [esp]
jp 0x551054
lea esi, [esi + 0x785d]
lea esi, [esi - 0x785d]
lea edx, [edx]
jl 0x55106b
jns 0x551066
jno 0x551068
jge 0x55106b
mov esi, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
shl esp, 0
xchg esp, esp
jp 0x5510a8
xchg ebx, ebx
jnp 0x5510a8
mov ebx, 0xec4d8a8e
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov eax, eax
mov ecx, ecx
sub ecx, 0
jg 0x551111
jl 0x55112b
pushf
xchg edi, edx
xchg edi, edx
clc
popf
lea ecx, [ecx + 0xdca]
lea ecx, [ecx - 0xdca]
jge 0x55112b
mov ebp, 0x13c20e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.00564d50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x551140
xor eax, eax
jmp 0x5511d2
shl esp, 0
sub esp, 0
js 0x55114e
jg 0x55114a
jns 0x55114e
lcall 0x8b50, 0xec458dee
dec ebp
clc
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00543a96
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0054df2a
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x5511ae
and edx, 0xffffffff
jnp 0x551188
pushf
jno 0x55117d
test dword [esp + 8], edx
popf
jg 0x551185
jp 0x551188
jmp 0x51515717
mov eax, dword [ebp - 4]
push eax
call fcn.0053e4cb
add esp, 4
cmp esi, dword [esp + 8]
jnp 0x55119a
nop
jne 0x5511a5
lea eax, [eax]
lea esp, [esp]
je 0x5511a5
or dword [ebx - 0xaef7b3], 0x24ebfc55
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x5511d2
test ebx, 0x159d
cmp ebx, esi
add esp, 0
jae 0x5511d0
pushf
test dword [esp], eax
inc eax
dec eax
xor esi, 0
popf
jb 0x5511c9
jo 0x5511cb
jl 0x5511cd
jb 0x5511d0
xor dword [ebx], 0x5b5e5fc0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x551e77
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0054df2a
add esp, 0xc
push 0x21
push 0x539de8
lea ecx, [ebp - 0x138]
push ecx
call fcn.00563d26
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x551f7f
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0054df2a
add esp, 0xc
push 0xb
push 0x539e0c
lea edx, [ebp - 0x138]
push edx
call fcn.00563d26
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x551f72
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00563d26
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x551f81
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x554a1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0054df2a
add esp, 0xc
add esi, 0x1fed
sub esi, 0x1fed
ror ebx, 0xe
rol ebx, 0xe
jno 0x554a53
jb 0x554a4d
nop
lea edi, [edi]
jo 0x554a53
add eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
xchg ebx, esi
xchg ebx, esi
jle 0x554a89
nop
jne 0x554a9b
pushf
test ebx, esi
popf
xchg ecx, ecx
jb 0x554a96
lea ecx, [ecx]
je 0x554a9b
mov edi, 0x80ec4d8a
jmp 0xeca2d2a5
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00564d50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x554b10
xor eax, eax
jmp 0x554ba4
clc
cmp esi, eax
jbe 0x554b15
test edx, eax
js 0x554b28
pushf
jnp 0x554b1d
popf
jl 0x554b21
je 0x554b23
jge 0x554b25
jns 0x554b28
mov edx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00543a96
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0054df2a
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x554b52
xor eax, eax
jmp 0x554ba4
lea eax, [eax + 0x3d5c]
lea eax, [eax - 0x3d5c]
lea esp, [esp]
std
cld
inc ecx
dec ecx
jle 0x554b7e
pushf
std
cld
popf
lea ebx, [ebx + 0x29a8]
lea ebx, [ebx - 0x29a8]
jmp 0x554b7b
jg 0x554b7e
lcall 0x44e8, 0x50fc458b
cdq
invalid
mov eax, dword [ebp - 4]
push eax
call fcn.0053e4cb
add esp, 4
xor esi, ebx
xor esi, ebx
jg 0x554b9d
pushf
test dword [esp + 8], esi
popf
jno 0x554b9a
jle 0x554b9d
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x55adda
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
sbb byte [ebx + 0x56], dl
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0054df2a
add esp, 0xc
add edi, 0x1e4
sub edi, 0x1e4
xchg esi, edx
xchg esi, edx
jno 0x55ae10
jnp 0x55ae07
jnp 0x55ae09
jl 0x55ae0b
js 0x55ae0d
jo 0x55ae10
lcall 0x45c6, 0x53ec45c6
clc
jo 0x55addf
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
cld
nop
or ecx, ecx
ror edx, 0xa
ror edx, 0x16
js 0x55ae62
inc ebp
cmc
jno 0x55ade3
inc ebp
out dx, eax
je 0x55ade7
inc ebp
invalid
jae 0x55ae5a
jmp 0x55ae5c
jp 0x55ae5e
jns 0x55ae62
mov edx, 0xec4d8a15
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.00564d50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x55aeef
jmp 0x55af86
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00543a96
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0054df2a
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x55af86
cmp ecx, dword [esp + 4]
jb 0x55af1b
or ebx, ebx
xor esp, 0
jbe 0x55af3a
pushf
cmp edi, dword [esp + 0xc]
test ebx, 0x6ca9
xor esp, 0
jb 0x55af33
popf
mov esi, esi
ja 0x55af3a
call 0x513df4c9
mov eax, dword [ebp - 0x18]
push eax
call fcn.0053e4cb
add esp, 4
xchg edi, edi
or edx, edx
call 0x55af4f
lea esp, [esp + 4]
je 0x55af73
pushf
and esi, 0xffffffff
shl esp, 0
popf
lea edx, [edx + 0x28a6]
lea edx, [edx - 0x28a6]
xchg esp, esp
lea esp, [esp]
jne 0x55af73
mov ecx, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x55b6b5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0054df2a
add esp, 0xc
call 0x55b6d3
add esp, 4
jo 0x55b6e4
mov ebx, ebx
lea esp, [esp]
mov esp, esp
lea ebx, [ebx]
jno 0x55b6e4
mov ecx, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
xor eax, 0
jb 0x55b729
jg 0x55b733
jns 0x55b72d
mov eax, eax
jle 0x55b733
or ebp, 0x80ec4d8a
jmp 0xeca33f3d
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.0054e8ec
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x55b7ca
xor eax, eax
jmp 0x55b853
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00543a96
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0054df2a
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x55b851
xchg edi, ecx
xchg edi, ecx
xor ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0xc]
je 0x55b81d
pushf
xor ecx, 0x1bc6
xor ecx, 0x1bc6
xor eax, ebx
xor eax, ebx
test edx, esi
popf
js 0x55b816
ja 0x55b818
xchg esp, esp
jne 0x55b81d
mov esp, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0053e4cb
add esp, 4
cmp eax, dword [esp]
xor ecx, 0
rol ebx, 0xd
rol ebx, 0x13
ja 0x55b848
pushf
jne 0x55b83b
jne 0x55b83d
popf
jmp 0x55b841
lea edx, [edx]
jns 0x55b845
jbe 0x55b848
jmp 0x525e0dd7
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x55b853
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x55b85c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0054df2a
add esp, 0xc
ja 0x55b877
je 0x55b896
pushf
push eax
add eax, 0x4f43
ror eax, 0xa
pop eax
rol esp, 0
cmp edi, dword [esp + 0xc]
add esp, 0
popf
mov edi, edi
jne 0x55b896
mov ecx, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0
shl esi, 0
rol eax, 0
cmp esp, 0x107
jns 0x55b8e3
pushf
jbe 0x55b8dc
popf
jle 0x55b8e0
js 0x55b8e3
sub eax, 0x80e84d8a
jmp 0xe8a340ed
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
call fcn.0055b950

Function at 0x55bde9
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, esi
call 0x55bdf6
lea esp, [esp + 4]
jge 0x55be05
jb 0x55bdfe
jge 0x55be00
jnp 0x55be02
jl 0x55be05
call 0x7abdbe73
adc eax, 0x15ff0054
xor al, 0xc0
push ebx
add cl, al
in al, dx
add ah, bh
push 0
push 0x54157a
call dword [sym.imp.USER32.dll_EnumWindows]
shr esp, 0
cld
jb 0x55be23
js 0x55be1a
lea edx, [edx]
je 0x55be1e
mov ecx, ecx
jae 0x55be23
mov edx, 0xaf583d83
push ebx
add byte [eax], al
cmp dword [0x53af58], 0
jle 0x55be56
rol eax, 0
jl 0x55be41
pushf
test dword [esp], edi
test dword [esp + 8], edx
popf
js 0x55be3e
jge 0x55be41
mov esp, 0x17b8
add bl, ch
adc eax, dword [ebx + 0x975ffe4]
jnp 0x55be4f
mov eax, 0x17
jmp 0x55be5b
jo 0x55be51
jl 0x55be53
je 0x55be56
add eax, 0x45b8
add byte [edi + 0x5e], bl
mov eax, 0x45
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5605fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0054df2a
add esp, 0xc
nop
js 0x560648
pushf
neg esi
neg esi
jge 0x560625
lea ebx, [ebx + 0x7824]
lea ebx, [ebx - 0x7824]
jnp 0x560633
popf
lea eax, [eax]
jmp 0x560639
lea edx, [edx + 0xd7d]
lea edx, [edx - 0xd7d]
jns 0x560648
add esi, 0xc651e845
inc ebp
in eax, dx
je 0x560617
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
add esp, 0
lea ecx, [ecx + 0x5b88]
sub ecx, 0x5b88
jg 0x560713
pushf
add esp, 0
shl esp, 0
je 0x56070c
popf
mov esi, esi
jle 0x560713
ljmp 0x8900:0x4638e8
call fcn.00564d50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x560728
xor eax, eax
jmp 0x5607be
xor eax, 0
xor ebx, dword [esp + 4]
xor ebx, dword [esp + 4]
and ecx, 0xffffffff
jae 0x56074d
jge 0x56073a
lea esp, [esp]
lea edx, [edx + 0x2427]
lea edx, [edx - 0x2427]
jb 0x56074d
call 0xe8ab9458
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00543a96
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0054df2a
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x560777
xor eax, eax
jmp 0x5607be
xor esi, dword [esp]
xor esi, dword [esp]
jnp 0x56077f
jns 0x560794
pushf
jmp 0x560785
jl 0x560787
add edi, dword [esp]
sub edi, dword [esp]
popf
jbe 0x560791
js 0x560794
mov ebp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0053e4cb
add esp, 4
lea esp, [esp]
xchg esp, esp
test esp, 0x3cf9
jne 0x5607b3
jbe 0x5607af
je 0x5607b3
sbb dword [ebx + 0x500c458b], 0x51084d8b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8