joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8b97
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4a8bab
jmp 0x4a8d42
xor ecx, ebx
xor ecx, ebx
test esp, 0x67d1
cmc
jo 0x4a8bc5
pushf
cld
shl ebx, 0
popf
jg 0x4a8bc2
jno 0x4a8bc5
mov ebx, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x491b24], edx
and edx, 0xffffffff
and edx, 0xffffffff
cmc
jnp 0x4a8bea
xchg esp, esp
jns 0x4a8be3
nop
je 0x4a8be6
jp 0x4a8bea
mov esi, 0xec458be9
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x49333c], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x493338], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x491b18], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x491b1c], ecx
xchg edi, eax
xchg edi, eax
ror esi, 0
push ecx
pop ecx
jle 0x4a8c34
pushf
rol esp, 0
jp 0x4a8c29
popf
xchg esi, esi
jle 0x4a8c2f
jae 0x4a8c31
jg 0x4a8c34
call 0x4e3ad1fe
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
stc
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
sub esi, 0
or esi, esi
ja 0x4a8c89
pushf
ror esp, 0
xchg ebx, ebx
nop
popf
js 0x4a8c84
lea edx, [edx]
jbe 0x4a8c89
mov ecx, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
stc
jne 0x4a8cf4
xchg esp, esp
call 0x4a8cfb
add esp, 4
jp 0x4a8d04
nop
jnp 0x4a8d04
ljmp 0x49:0x33383d83
cmp dword [0x493338], 0
je 0x4a8d21
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x493338]
push eax
call fcn.0049db9f
mov dword [0x491b20], eax
std
cld
jo 0x4a8d32
pushf
jp 0x4a8d29
popf
xchg edx, esi
xchg edx, esi
jno 0x4a8d32
add eax, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00499b0b
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ad54d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00499b0b
add esp, 0xc
jle 0x4ad56f
inc edx
dec edx
shl esp, 0
jo 0x4ad57c
mov esp, esp
jno 0x4ad57c
xor eax, 0xec45c608
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004a72c7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4ad644
xor eax, eax
jmp 0x4ad6b8
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049db9f
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00499b0b
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x4ad66e
xor eax, eax
jmp 0x4ad6b8
xor ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x10]
ror ebx, 0x1f
ror ebx, 1
jge 0x4ad694
pushf
test ebx, 0xb78
not ebx
not ebx
dec ebx
inc ebx
popf
jle 0x4ad68f
jmp 0x4ad691
jl 0x4ad694
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.004aa525
add esp, 4
and eax, eax
or esp, 0
jp 0x4ad6ad
nop
jne 0x4ad6aa
jnp 0x4ad6ad
xor eax, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ad6c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00499b0b
add esp, 0xc
jns 0x4ad6dc
jle 0x4ad6f7
pushf
xor esp, 0
jbe 0x4ad6e5
add ebx, dword [esp]
sub ebx, dword [esp]
lea esp, [esp]
popf
je 0x4ad6f2
lea esi, [esi]
jg 0x4ad6f7
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
ja 0x4ad72d
test dword [esp], edi
jae 0x4ad743
pushf
rol eax, 1
rol eax, 0x1f
or esp, 0
popf
js 0x4ad740
jb 0x4ad743
xor eax, 0x80e84d8a
jmp 0xe8985f4d
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jle 0x4ad7ad
add ecx, 0
ror esp, 0
jge 0x4ad7ba
jbe 0x4ad7b7
jl 0x4ad7ba
mov eax, 0xff9b08e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.004a72c7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ad7cf
xor eax, eax
jmp 0x4ad85d
push ebx
pop ebx
lea ebx, [ebx]
ja 0x4ad7e7
pushf
std
cld
xchg ebx, ebx
ror esp, 0
jge 0x4ad7e0
popf
xchg esp, esp
jbe 0x4ad7e7
xor eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0049db9f
mov dword [ebp - 4], eax
test ecx, edi
nop
je 0x4ad7fc
xchg esp, esp
jne 0x4ad809
xchg edi, edi
ja 0x4ad804
jmp 0x4ad806
je 0x4ad809
lcall 0x458d, 0x6a0d6a
call 0xc340c064
invalid
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00499b0b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4ad823
xor eax, eax
jmp 0x4ad85d
nop
jno 0x4ad826
js 0x4ad828
jnp 0x4ad840
pushf
jl 0x4ad82e
xchg edi, esi
xchg edi, esi
jg 0x4ad834
cmc
popf
jo 0x4ad839
xchg esi, edx
xchg esi, edx
jp 0x4ad840
call 0x524725cf
mov ecx, dword [ebp - 4]
push ecx
call fcn.004aa525
add esp, 4
shl esi, 0
jl 0x4ad85a
jnp 0x4ad853
jns 0x4ad855
lea edx, [edx]
jge 0x4ad85a
sub eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af6e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x493078
call fcn.0049d40f
add esp, 0xc
mov byte [0x493078], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x4af738
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00499b0b
add esp, 0xc
lea eax, [eax + 0x2f]
lea eax, [eax - 0x2f]
mov eax, eax
sub esp, 0
jne 0x4af769
jle 0x4af760
nop
lea esp, [esp]
jmp 0x4af766
je 0x4af769
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
lea ecx, [ecx + 0x201e]
lea ecx, [ecx - 0x201e]
lea esp, [esp]
jbe 0x4af7d3
pushf
cmp esp, 0x7b3b
popf
xchg esi, esi
jle 0x4af7d0
ja 0x4af7d3
mov edx, 0x80e84d8a
jmp 0xe8987fdd
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.004a72c7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4af87c
xor eax, eax
jmp 0x4af90c
and esi, 0xffffffff
xor esp, 0
xchg esi, esi
jg 0x4af88b
nop
jle 0x4af88b
jmp 0xe8908614
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049db9f
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00499b0b
add esp, 0xc
xchg esp, esp
shl eax, 0
jno 0x4af8c8
pushf
rol edx, 0xa
ror edx, 0xa
ror esp, 0
mov ebx, ebx
inc edi
dec edi
popf
lea eax, [eax]
jo 0x4af8c8
mov esp, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x4af8d2
xor eax, eax
jmp 0x4af90c
ror edx, 0xf
ror edx, 0x11
jno 0x4af8da
and ecx, ecx
jle 0x4af8f0
pushf
xchg esi, esi
jno 0x4af8e4
popf
lea esp, [esp]
mov esp, esp
mov esp, esp
jg 0x4af8f0
jmp 0x512f3e7f
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004aa525
add esp, 4
rol esi, 0
or edi, edi
jg 0x4af909
mov eax, eax
nop
jle 0x4af909
mov esi, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b152b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
Function at 0x4b185b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x491b44], 1
jne 0x4b19da
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00499b0b
add esp, 0xc
xchg esi, edi
xchg esi, edi
lea eax, [eax]
jp 0x4b1889
xor edi, 0x577c
xor edi, 0x577c
jl 0x4b189d
jno 0x4b1899
jge 0x4b189d
lcall 0xc648, 0xe845c665
inc ebp
in eax, dx
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
inc ecx
dec ecx
shr edx, 0
add esi, 0
jge 0x4b18eb
pushf
lea esp, [esp]
xor edi, 0
ja 0x4b18e1
popf
je 0x4b18e5
jne 0x4b18e7
nop
jl 0x4b18eb
mov ebx, 0x80e84d8a
jmp 0xe898a0f5
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.004a72c7
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b1960
xor eax, eax
jmp 0x4b1a49
xchg edi, edi
test esp, 0x57ec
stc
neg eax
neg eax
ja 0x4b197b
xchg edx, eax
xchg edx, eax
jo 0x4b1973
jae 0x4b1975
jge 0x4b1977
jbe 0x4b197b
mov eax, 0xe8458d1e
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0049db9f
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00499b0b
add esp, 0xc
cmc
call 0x4b19a1
add esp, 4
shr eax, 0
jno 0x4b19c4
pushf
lea esi, [esi + 0x775b]
sub esi, 0x775b
lea esi, [esi]
popf
lea esp, [esp]
nop
jb 0x4b19c1
jo 0x4b19c4
add dword [ebx + 0x7400f87d], 0xf8458b0a
cmp dword [ebp - 8], 0
je 0x4b19d4
mov eax, dword [ebp - 8]
mov dword [0x491b44], eax
jmp 0x4b19d8
xor eax, eax
jmp 0x4b1a49
jmp 0x4b19e3
mov ecx, dword [0x491b44]
mov dword [ebp - 8], ecx
call 0x4b19e8
lea esp, [esp + 4]
jnp 0x4b1a07
pushf
add edi, 0x1aa8
sub edi, 0x1aa8
popf
jp 0x4b1a00
ja 0x4b1a02
xchg esi, eax
xchg esi, eax
jp 0x4b1a07
mov esi, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
xor eax, ecx
xor eax, ecx
ror eax, 0x19
rol eax, 0x19
rol esi, 0x1e
ror esi, 0x1e
xchg ebx, edi
xchg ebx, edi
jl 0x4b1a32
pushf
xchg esp, esp
xor edi, ecx
xor edi, ecx
popf
jl 0x4b1a2f
jge 0x4b1a32
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004aa525
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b28c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00499b0b
add esp, 0xc
lea ecx, [ecx]
cmp esp, 0x7795
lea esi, [esi + 0x5a83]
sub esi, 0x5a83
add esp, 0
js 0x4b2915
pushf
lea eax, [eax]
cmp esi, dword [esp + 8]
not edx
not edx
shr esp, 0
popf
xchg ebx, eax
xchg ebx, eax
jg 0x4b2912
jns 0x4b2915
add esi, 0xc651e845
inc ebp
in eax, dx
je 0x4b28e4
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
test dword [esp], ebx
xchg edi, eax
xchg edi, eax
xor esp, 0
stc
je 0x4b29cf
nop
jne 0x4b29cf
mov edi, 0xf3e80075
dec eax
invalid
call fcn.004a72c7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b29e4
xor eax, eax
jmp 0x4b2a82
push ecx
pop ecx
inc esi
dec esi
jns 0x4b29fc
pushf
xor edx, 0
jl 0x4b29f1
add edi, 0
stc
popf
xchg ecx, eax
xchg ecx, eax
js 0x4b29fc
add eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0049db9f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00499b0b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4b2a26
xor eax, eax
jmp 0x4b2a82
xor edi, dword [esp + 0xc]
xor edi, dword [esp + 0xc]
test dword [esp], esi
not edx
not edx
shr edx, 0
je 0x4b2a58
pushf
jbe 0x4b2a3e
and edi, 0xffffffff
push eax
add eax, 0x5959
ror eax, 0x14
pop eax
jbe 0x4b2a4d
popf
lea edi, [edi]
jb 0x4b2a53
jbe 0x4b2a55
jne 0x4b2a58
sub eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004aa525
add esp, 4
mov esi, esi
lea ecx, [ecx]
jnp 0x4b2a77
pushf
jge 0x4b2a6e
ja 0x4b2a70
popf
mov esp, esp
jp 0x4b2a77
sub eax, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b3948
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00499b0b
add esp, 0xc
lea eax, [eax]
xchg edx, esi
xchg edx, esi
bnd js 0x4b3969
Function at 0x46eced
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0046ee9d
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x46edeb
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x46ed8e
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x46edd1
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x46eda5
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x46edc0
test al, 0x40
je 0x46edb7
mov ecx, dword [edi + 0x20]
jmp 0x46edbe
test al, 0x80
je 0x46edd1
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x46edd1
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x46ed5d
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x473688
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4736c0
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4736ae
mov al, 1
jmp 0x473701
cmp dword [ebx + 0x54], ecx
jne 0x4736b7
mov al, 2
jmp 0x473701
cmp dword [ebx + 0x7c], ecx
jne 0x473701
mov al, 3
jmp 0x473701
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4736d5
mov al, 4
jmp 0x473701
cmp ecx, 5
jne 0x4736f5
cmp ebx, 0
jne 0x4736e3
mov al, 5
jmp 0x473701
cmp ebx, 1
jne 0x4736ec
mov al, 6
jmp 0x473701
cmp ebx, 2
jne 0x4736f5
mov al, 7
jmp 0x473701
cmp ecx, 6
jne 0x473701
cmp ebx, 0
jne 0x473701
mov al, 8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40eab0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47f62b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00473d50
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40eb32
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00471810
mov eax, dword [eax]
push 0xbf3210
push eax
call fcn.00463a34
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00473fdb
test bl, bl
je 0x40eb32
push 0xbf3210
lea ecx, [esp + 0xc]
call fcn.0047436b
push 0xbf6d8c
lea ecx, [esp + 0xc]
call fcn.0047436b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40eb6e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00473fdb
jmp 0x40ec39
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40ebf2
lea edx, [esp + 0x7c]
push 0xbf6d88
push edx
call fcn.00463a34
add esp, 8
test eax, eax
je 0x40ebf2
lea eax, [esp + 0x7c]
push 0xbf6d84
push eax
call fcn.00463a34
add esp, 8
test eax, eax
je 0x40ebf2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40eb82
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00473fdb
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40fe90
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40fef2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc