joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d910
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
test ecx, ecx
je 0x48d9b2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x48d9b2
shr edx, 0
and esp, 0xffffffff
clc
jl 0x48d935
je 0x48d940
lea esi, [esi]
jne 0x48d93b
mov eax, eax
jne 0x48d940
mov eax, 0xff81
add dword [eax], eax
cmp edi, 0x10000
jae 0x48d971
xor eax, dword [esp]
xor eax, dword [esp]
xchg edx, eax
xchg edx, eax
js 0x48d968
pushf
xor esp, 0
ror edx, 0
mov edx, edx
lea esp, [esp]
popf
jnp 0x48d963
jne 0x48d965
jns 0x48d968
xor eax, 0xc1e85157
int1
add dword [eax], eax
push edi
push ecx
call 0x4acb30
jmp 0x48d995
std
cld
cmp edx, dword [esp + 8]
xor ecx, 0
add ebx, dword [esp]
sub ebx, dword [esp]
jnp 0x48d98b
lea ecx, [ecx]
xchg esi, eax
xchg esi, eax
je 0x48d988
jp 0x48d98b
add eax, 0x5708458b
mov eax, dword [ebp + 8]
push edi
push eax
call fcn.004988c0
add esp, 8
test eax, eax
je 0x48d9bd
jns 0x48d99e
je 0x48d9ab
nop
jb 0x48d9a3
lea esi, [esi]
js 0x48d9a7
jne 0x48d9ab
ljmp 0xc25d:0x5b5e5fa5
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0x4884c4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x48f710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x11
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.004a9150
add esp, 0xc
push eax
add eax, 0x6013
ror eax, 3
pop eax
and eax, 0xffffffff
jge 0x48f743
je 0x48f73a
jno 0x48f73c
lea edx, [edx]
jl 0x48f743
mov eax, 0x65b27f36
mov dl, 0x65
mov al, 0x66
mov cl, 0x6d
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], dl
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0x42
mov byte [ebp - 0x17], al
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 8], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], cl
mov byte [ebp - 0xc], dl
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], cl
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], al
shl edi, 0
xor ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0xc]
jge 0x48f793
add esp, 0
je 0x48f7b2
pushf
js 0x48f79c
jge 0x48f79e
call fcn.0048f7a3
Function at 0x496410
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x486c48
call fcn.00492f80
add esp, 0xc
mov byte [0x486c48], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x496ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.004a9150
add esp, 0xc
and esp, 0xffffffff
lea edi, [edi]
ror edi, 5
ror edi, 0x1b
je 0x496cd2
pushf
ror esi, 0
popf
lea edx, [edx]
jne 0x496cd2
lcall 0x53e8, 0x45c666b0
mov al, 0x66
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x50
mov byte [ebp - 0x14], 0x71
mov byte [ebp - 0x13], al
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], 0x7a
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov ebx, ebx
cmp edx, dword [esp]
xor ebx, 0x6ace
xor ebx, 0x6ace
jae 0x496d2c
pushf
lea edi, [edi]
cmc
push esi
pop esi
je 0x496d25
popf
jnp 0x496d29
jb 0x496d2c
mov edi, 0x8ae8558a
dec ebp
in eax, dx
mov dl, byte [ebp - 0x18]
mov cl, byte [ebp - 0x13]
mov al, byte [ebp - 0xe]
mov bl, byte [ebp - 0x17]
dec dl
dec cl
mov byte [ebp - 0x18], dl
mov dl, byte [ebp - 0x12]
dec al
mov byte [ebp - 0x13], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0x16]
dec dl
mov byte [ebp - 0x17], bl
mov bl, byte [ebp - 0x11]
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0xc]
dec cl
dec al
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0x15]
dec bl
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0x11], bl
mov bl, byte [ebp - 0x14]
mov byte [ebp - 0xc], dl
mov dl, byte [ebp - 0xf]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x10], al
mov byte [ebp - 0x14], bl
mov byte [ebp - 0xf], dl
jl 0x496d96
jo 0x496d9e
jne 0x496d9a
jno 0x496d9e
mov edi, 0x4e3de888
add dword [eax], eax
call 0x4abbe0
test eax, eax
mov dword [ebp - 4], eax
jne 0x496db8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test edx, 0x1b8e
jg 0x496dd1
pushf
call fcn.00496dc7
Function at 0x49a5c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004a9150
add esp, 0xc
xor esi, dword [esp + 0xc]
xor esi, dword [esp + 0xc]
js 0x49a5ed
lea edi, [edi]
jae 0x49a5e7
mov esi, esi
jns 0x49a5ed
xor eax, 0xc666b06b
inc ebp
invalid
mov al, 0x66
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
or esp, 0
or edi, edi
je 0x49a62d
mov esi, esi
jne 0x49a62d
call 0x8b39f3bb
inc ebp
cmc
mov cl, byte [ebp - 0x10]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 6]
mov dl, byte [ebp - 0xf]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
dec dl
mov byte [ebp - 6], bl
mov bl, byte [ebp - 0xe]
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
dec dl
mov byte [ebp - 0xe], bl
mov bl, byte [ebp - 0xc]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0xd], cl
mov byte [ebp - 8], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], dl
call fcn.004a1b60
test eax, eax
je 0x49a72b
jnp 0x49a69c
sub esp, 0
cmp ebx, dword [esp + 8]
cmp eax, dword [esp]
je 0x49a6cb
pushf
xor edi, 0x5ea6
xor edi, 0x5ea6
xchg esi, edi
xchg esi, edi
not ecx
not ecx
popf
jp 0x49a6c2
xchg edx, esi
xchg edx, esi
jo 0x49a6c8
jne 0x49a6cb
add eax, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0048d910
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.004a9150
add esp, 0xc
test esi, esi
je 0x49a72b
neg ebx
neg ebx
jge 0x49a6f1
xchg edi, edi
jns 0x49a70e
pushf
test edx, ecx
lea ebx, [ebx + 0x588b]
sub ebx, 0x588b
popf
js 0x49a709
jmp 0x49a70b
js 0x49a70e
ljmp 0:0x2ce856
push esi
call fcn.0049a740
add esp, 4
and esp, 0xffffffff
ja 0x49a725
xchg esp, esp
jle 0x49a720
jbe 0x49a725
sub eax, 0x458bc15d
or byte [eax - 1], dl
salc
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49a740
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
jl 0x49a748
jns 0x49a753
xchg ebx, ebx
xchg esp, esp
lea esi, [esi]
js 0x49a753
sub eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call fcn.004a7ac0
add esp, 4
cmp eax, 2
jne 0x49a7b1
add edi, dword [esp]
sub edi, dword [esp]
test edx, 0x6425
dec edx
inc edx
jnp 0x49a77d
jl 0x49a776
je 0x49a778
mov esi, esi
jp 0x49a77d
sub dword [eax - 0x1c], 0xa3004886
movsb byte es:[edi], byte [esi]
outsb dx, byte [esi]
dec eax
add bh, bh
adc eax, sym.imp.KERNEL32.dll_OutputDebugStringA
push 0x4886e4
mov dword [0x486ea4], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xchg edx, edx
ja 0x49a7a7
jnp 0x49a793
jg 0x49a795
mov edi, edi
lea edi, [edi + 0x49cb]
lea edi, [edi - 0x49cb]
jbe 0x49a7a7
ljmp 0:0x1b81c
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
shr esp, 0
jle 0x49a7da
pushf
cmp esi, 0x7842
rol ebx, 0
lea ecx, [ecx + 0x3e59]
sub ecx, 0x3e59
jo 0x49a7cf
popf
mov edi, edi
jb 0x49a7d5
mov esp, esp
jg 0x49a7da
add eax, 0xc0335e5f
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4a38d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
mov dword [ebp - 0xb], eax
push 0x488804
mov byte [ebp - 0xc], 0
mov byte [ebp - 7], al
call esi
sidt [ebp - 0xc]
mov eax, dword [ebp - 0xa]
add eax, 8
mov ebx, dword [eax]
add eax, 0x10
mov eax, dword [eax]
and eax, 0xffff
and ebx, 0xffff
sub eax, ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1e
jne 0x4a3934
xor esp, 0
test edx, eax
shl eax, 0
and esp, 0xffffffff
js 0x4a392d
xchg ecx, ecx
xchg edi, eax
xchg edi, eax
jns 0x4a392d
sub eax, 0x2bf
add bl, ch
sub edi, esi
rcl edi, 0x6b
add byte [eax], al
mov edi, 2
jmp 0x4a395d
test ecx, 0x6bd7
jge 0x4a393c
jle 0x4a393e
jno 0x4a3958
pushf
xor esp, 0
popf
jne 0x4a3949
lea ebx, [ebx + 0x2118]
lea ebx, [ebx - 0x2118]
jo 0x4a3958
sub eax, 0x4bf
add byte [eax - 0xc], ch
xchg dword [eax], ecx
mov edi, 4
push 0x4887f4
call esi
test eax, 0x20d9
xor eax, 0x245f
xor eax, 0x245f
xchg edx, ecx
xchg edx, ecx
jl 0x4a3982
mov esi, esi
xchg esp, esp
js 0x4a397f
jge 0x4a3982
mov ecx, 0x5e5fc78b
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a3990
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x489a9c]
push esi
push edi
push eax
push 0x489de5
mov byte [0x489de4], 0x45
call fcn.00491180
mov edx, dword [0x489a9c]
mov al, 0x2d
mov byte [0x489dea], al
mov byte [0x489deb], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x489de9], cl
mov byte [0x489dec], cl
mov esi, 0x489ded
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x478a69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x4a39df
mov byte [esi], 0
pop edi
mov eax, 0x489de4
pop esi
ret
Function at 0x4a47a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004a9150
add esp, 0xc
add esi, dword [esp]
sub esi, dword [esp]
add edi, 0x679e
sub edi, 0x679e
jg 0x4a47e2
pushf
lea esi, [esi + 0x1ae3]
sub esi, 0x1ae3
popf
xchg esp, esp
jle 0x4a47e2
mov eax, 0x75b066b1
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 7], 0x4a
mov byte [ebp - 8], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 0xa], al
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], al
mov byte [ebp - 4], 0x70
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 9], cl
mov byte [ebp - 6], 0x6f
neg eax
neg eax
jnp 0x4a482d
jne 0x4a4822
jns 0x4a4824
jnp 0x4a4826
xchg edx, ecx
xchg edx, ecx
jp 0x4a482d
mov edi, 0x8afc4d8a
inc ebp
cmc
mov cl, byte [ebp - 4]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 0xf]
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 4], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0xf], bl
mov bl, byte [ebp - 0xa]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 6]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
dec al
dec bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 7]
dec cl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 5]
mov byte [ebp - 8], cl
mov cl, byte [ebp - 0xe]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0x10], al
mov byte [ebp - 7], bl
mov byte [ebp - 5], dl
mov byte [ebp - 0xe], cl
xor edx, dword [esp]
xor edx, dword [esp]
jle 0x4a48a4
xchg edx, esi
xchg edx, esi
jg 0x4a48a4
mov ebp, 0xffd2b7e8
dec dword [ebx + 0xfc985c8]
test byte [ebx - 0x7d000000], dl
test byte [eax], 0xfd
call fcn.004a1b60
mov ecx, eax
test ecx, ecx
je 0x4a4946
xor esi, 0
std
cld
xchg edi, eax
xchg edi, eax
jg 0x4a48c6
mov esp, esp
jge 0x4a48c0
lea edx, [edx]
jle 0x4a48c6
mov esi, 0xf0558db6
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.0048d910
mov esi, eax
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004a9150
add esp, 0xc
jp 0x4a48e4
je 0x4a48e6
jne 0x4a48fb
lea edx, [edx + 0x322c]
lea edx, [edx - 0x322c]
jnp 0x4a48f6
je 0x4a48f8
je 0x4a48fb
sub eax, 0x4774f685
test esi, esi
je 0x4a4946
and edx, 0xffffffff
and ecx, ecx
jne 0x4a491d
pushf
not edi
not edi
cld
xchg esp, esp
rol esp, 0
popf
lea ecx, [ecx]
jbe 0x4a4918
xchg edi, eax
xchg edi, eax
je 0x4a491d
call 0x5e683177
invalid
push esi
call fcn.0049a740
add esp, 4
shr edx, 0
call 0x4a492e
add esp, 4
jg 0x4a4940
xchg ebx, ecx
xchg ebx, ecx
jge 0x4a4939
jbe 0x4a493b
mov esp, esp
jle 0x4a4940
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a5160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0x10
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004a9150
add esp, 0xc
ja 0x4a517a
lea esp, [esp]
push ebx
pop ebx
jl 0x4a51a1
pushf
call 0x4a5188
lea esp, [esp + 4]
cmp esp, 0x65e9
ror ebx, 3
rol ebx, 3
popf
mov esp, esp
lea edx, [edx]
jge 0x4a51a1
mov esi, 0x74b066b1
mov cl, 0x66
mov al, 0x74
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xb], 0x70
mov byte [ebp - 6], 0x55
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x6a
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 9], cl
mov byte [ebp - 4], 0x6e
mov byte [ebp - 0xd], 0x51
mov byte [ebp - 8], al
mov byte [ebp - 3], cl
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 7], al
mov byte [ebp - 2], al
mov byte [ebp - 1], 0
rol ebx, 0x1d
ror ebx, 0x1d
xor ecx, dword [esp]
xor ecx, dword [esp]
jns 0x4a51f7
pushf
stc
popf
jb 0x4a51f4
js 0x4a51f7
mov ebx, 0x8af0458a
pop ebp
cmc
mov al, byte [ebp - 0x10]
mov bl, byte [ebp - 0xb]
mov dl, byte [ebp - 6]
mov cl, byte [ebp - 0xf]
dec al
dec bl
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xb], bl
mov bl, byte [ebp - 5]
mov byte [ebp - 6], dl
mov dl, byte [ebp - 0xe]
dec cl
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 4]
dec dl
mov byte [ebp - 5], bl
mov bl, byte [ebp - 0xd]
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 8]
dec cl
dec al
mov byte [ebp - 9], cl
mov cl, byte [ebp - 3]
dec bl
mov byte [ebp - 4], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0xd], bl
mov bl, byte [ebp - 7]
mov byte [ebp - 8], dl
mov dl, byte [ebp - 2]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 3], cl
mov byte [ebp - 0xc], al
mov byte [ebp - 7], bl
mov byte [ebp - 2], dl
call fcn.004a1b60
test eax, eax
jne 0x4a5280
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
add esp, 0
jbe 0x4a5291
jo 0x4a5287
jnp 0x4a5289
jno 0x4a528b
jns 0x4a528d
ja 0x4a5291
mov ebp, 0xf04d8dad
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0048d910
mov esi, eax
xchg ebx, ebx
and esp, 0xffffffff
neg eax
neg eax
jno 0x4a52c3
pushf
test dword [esp + 8], edi
xor ebx, 0x6040
xor ebx, 0x6040
popf
jno 0x4a52be
xchg edx, edx
jo 0x4a52c3
add eax, 0x558d106a
invalid
push 0x10
lea edx, [ebp - 0x10]
push 0
push edx
call fcn.004a9150
add esp, 0xc
add ecx, 0
stc
jns 0x4a52e0
jb 0x4a52db
js 0x4a52dd
js 0x4a52e0
add dword [ebp + 0x330a75f6], 0x8b5b5ec0
in eax, 0x5d
test esi, esi
jne 0x4a52ee
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
jle 0x4a52f8
jle 0x4a5300
lea ebx, [ebx]
jg 0x4a5300
lcall 0xff54, 0x3ae8562a
inc dword [ebx - 0x2708fb3c]
push esi
call fcn.0049a740
add esp, 4
neg eax
neg eax
jge 0x4a531f
pushf
jns 0x4a5313
ror esp, 0
jo 0x4a5318
popf
js 0x4a531c
jl 0x4a531f
lcall 0x144d, 0x8b18458b
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4a92f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004a9150
add esp, 0xc
nop
jae 0x4a931e
pushf
stc
xchg ecx, ecx
ror ebx, 0x1b
rol ebx, 0x1b
popf
ja 0x4a931b
jb 0x4a931e
mov eax, 0x65b073b1
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4e
lea esp, [esp]
jbe 0x4a9363
jo 0x4a935d
lea esp, [esp]
ja 0x4a9363
sub eax, 0xffff87f8
call fcn.004a1b60
test eax, eax
jne 0x4a9375
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
stc
cmc
jle 0x4a9379
ja 0x4a938f
pushf
cmp edx, 0x468d
popf
mov edx, edx
jbe 0x4a9389
lea esp, [esp]
jbe 0x4a938f
lcall 0xe850, 0x51f04d8d
ja 0x4a93dc
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0048d910
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.004a9150
add esp, 0xc
test esi, esi
jne 0x4a93ba
invalid
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test dword [esp + 4], ebx
clc
add edx, 0x5727
sub edx, 0x5727
ja 0x4a93e1
pushf
call 0x4a93d4
add esp, 4
or edx, 0
popf
jno 0x4a93de
jbe 0x4a93e1
add eax, 0x1359e856
invalid
push esi
call fcn.0049a740
add esp, 4
cmc
shl edi, 0
test esp, 0x28ef
ror ecx, 0x10
ror ecx, 0x10
jae 0x4a9414
pushf
call 0x4a9403
lea esp, [esp + 4]
inc ebx
dec ebx
popf
xchg ecx, ecx
jg 0x4a940f
jg 0x4a9411
jb 0x4a9414
mov esi, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a9850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004a9150
add esp, 0xc
or eax, 0
and ecx, ecx
jb 0x4a986f
jo 0x4a9871
jo 0x4a987e
jne 0x4a9875
jo 0x4a9877
jae 0x4a9879
jno 0x4a987e
mov ebx, 0x73b0931a
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], al
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xa], al
mov byte [ebp - 5], cl
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], al
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x46
mov byte [ebp - 3], 0x74
call fcn.004a1b60
test eax, eax
jne 0x4a98ca
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0048d910
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.004a9150
add esp, 0xc
test esi, esi
jne 0x4a98f4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
nop
je 0x4a9902
pushf
ja 0x4a98fb
popf
jbe 0x4a98ff
jne 0x4a9902
call 0xe83815c
invalid
push esi
call fcn.0049a740
add esp, 4
shl esp, 0
push ebx
add ebx, 0x1f08
ror ebx, 0x1d
pop ebx
add ecx, 0x423d
sub ecx, 0x423d
jg 0x4a9927
jns 0x4a9930
jnp 0x4a992b
xchg ecx, eax
xchg ecx, eax
js 0x4a9930
mov ebx, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ce7ea
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call 0xb081121c
inc ebx
cmp dl, byte [esi - 0xe]
dec eax
imul eax, dword [ecx - 0x7948ebab], 0xcd84f93d
cmpsd dword [esi], dword es:[edi]
and dword [edx - 0x6c793d8a], 0xffffffd3
or ebp, ebx
je 0x4ce7c9
scasb al, byte es:[edi]
mov word [esi], cs
push cs
push cs
xchg ecx, eax
ret
cmp al, 0xe
pop ds
inc eax
add dword [edi + esi], 0xfb838f45
inc edi
pop edi
add ch, byte [esi]
sbb al, 0x47
sub ah, byte [esi - 0x1b]
clc
in eax, 0x7d
mov al, 0x35
push 0xcba263b9
mov eax, dword [0xb0fa868]
test al, 0xf
or ebx, dword [esi - 0x7e]
pushfd
or eax, 0x66078618
cmc
test al, 0xf
or ebx, dword [esi - 0x7e]
pushfd
or eax, 0x66078618
cmc
and byte [edx + 9], ah
scasd eax, dword es:[edi]
dec eax
sub dword [edx], edx
outsd dx, dword [esi]
pushal
ja 0x4ce81b
inc edx
test al, 0xaf
sub eax, 0xf53934e9
jle 0x4ce79a
outsb dx, byte [esi]
invalid
dec eax
in eax, 0x18
mov ebp, 0xb4f3ade
sbb byte [ebp + 0xb4f3ade], bh
cmp cl, byte [edi + 0xb]
pop esp
je 0x4ce820
rcl byte [edi - 0x1b]
inc eax
pmaddwd mm3, qword [edx + edi - 0x485e190]
mov bh, 0xd7
adc dword ds:[edi], ecx
sbb cl, byte [edx]
jnp 0x4ce7bc
fadd qword [edi + 0x4f]
mov bl, 0x78
jne 0x4ce856
xor ah, byte [eax + 0x5a24fd10]
sbb eax, 0x5e52195
sub bl, byte [esi + 0x3f0fc697]
in eax, 0xb9
pop edx
invalid
rcr dword [ebx], 0xa0
add dl, byte [edx - 0x381fcca4]
pop ebx
jl 0x4ce851
push eax
push esi
neg byte [edx + 0x2ab7f88f]
stc
cdq
fdivr dword [ebx - 0x32b2b45f]
mov eax, dword [0x41909ac5]
je 0x4ce8d7
fdivr dword [esi - 0x366b3fa1]
jmp 0x4ce81d
sub dword [edi - 0x36d01dc9], ebp
int 0xa1
adc dword [esi - 0x71], 0xfffffff1
cwde
popfd
mov byte [eax + 0x1d], dh
inc edi
lea ebx, [ebx - 0x56]
sub dh, 0xe2
mov dword [ebp + 0x56b62aec], ebx
retf
Function at 0x40a3f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x466eeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045bb08
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a472
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00459a57
mov eax, dword [eax]
push 0x7381c0
push eax
call fcn.0044c954
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045bd93
test bl, bl
je 0x40a472
push 0x7381c0
lea ecx, [esp + 0xc]
call fcn.0045c123
push 0x73bd28
lea ecx, [esp + 0xc]
call fcn.0045c123
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a4ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045bd93
jmp 0x40a579
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a532
lea edx, [esp + 0x7c]
push 0x73bd24
push edx
call fcn.0044c954
add esp, 8
test eax, eax
je 0x40a532
lea eax, [esp + 0x7c]
push 0x73bd20
push eax
call fcn.0044c954
add esp, 8
test eax, eax
je 0x40a532
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a4c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045bd93
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ad70
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40add2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc