joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4585f2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0046cded
add esp, 0xc
jo 0x45860d
js 0x458616
jl 0x458611
jns 0x458616
xor eax, 0x45c6df57
loopne 0x458662
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
lea ecx, [ecx + 0x701]
sub ecx, 0x701
cmp edi, ecx
call fcn.00458675
Function at 0x45d9ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046cded
add esp, 0xc
cmp esp, 0x7b16
cmp edx, ecx
xor eax, dword [esp]
xor eax, dword [esp]
cmp esi, ebx
jp 0x45da38
pushf
inc ebx
dec ebx
call fcn.0045da20
Function at 0x45f217
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x43f8c4], 1
jne 0x45f394
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046cded
add esp, 0xc
add eax, dword [esp]
sub eax, dword [esp]
ror ecx, 0xc
rol ecx, 0xc
add eax, 0
jmp 0x45f24e
jl 0x45f272
pushf
lea esp, [esp]
cmp edi, 0x6e9
mov esp, esp
popf
jl 0x45f261
lea esi, [esi + 0x6ed1]
lea esi, [esi - 0x6ed1]
mov esi, esi
jge 0x45f272
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
dec esi
inc esi
rol edi, 7
rol edi, 0x19
ror edx, 0x1d
rol edx, 0x1d
js 0x45f2c6
lea ecx, [ecx + 0x77a5]
lea ecx, [ecx - 0x77a5]
jo 0x45f2c0
jno 0x45f2c2
jns 0x45f2c6
sbb dword [ebx], 0x80e84d8a
jmp 0xe8937ad0
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00447f00
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45f33b
xor eax, eax
jmp 0x45f3e6
push esi
pop esi
add esp, 0
jne 0x45f34a
jle 0x45f344
mov ecx, ecx
je 0x45f34a
ljmp 0x8b50:0xe8458d8f
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0045ad63
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0046cded
add esp, 0xc
test eax, 0x331f
jae 0x45f37e
jo 0x45f373
jnp 0x45f375
mov eax, eax
jg 0x45f379
jb 0x45f37e
add eax, 0x7d838cc0
clc
add byte [edx + ecx - 0x75], dh
inc ebp
clc
cmp dword [ebp - 8], 0
je 0x45f38e
mov eax, dword [ebp - 8]
mov dword [0x43f8c4], eax
jmp 0x45f392
xor eax, eax
jmp 0x45f3e6
jmp 0x45f39d
mov ecx, dword [0x43f8c4]
mov dword [ebp - 8], ecx
add esi, 0
lea esp, [esp]
jl 0x45f3b7
pushf
shr esi, 0
neg edx
neg edx
popf
xchg ebx, edi
xchg ebx, edi
jge 0x45f3b7
mov edi, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
rol eax, 0x1f
ror eax, 0x1f
lea ebx, [ebx]
lea edi, [edi]
stc
jns 0x45f3cf
lea edx, [edx]
js 0x45f3cf
mov esi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0044b39c
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45f6a5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046cded
add esp, 0xc
test dword [esp], esi
add edx, 0
jno 0x45f6c6
jp 0x45f6c8
ja 0x45f6d1
jbe 0x45f6cc
jbe 0x45f6d1
add eax, 0x45c6b239
in al, dx
push ebx
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
js 0x45f70f
js 0x45f711
jg 0x45f719
jmp 0x45f715
jle 0x45f719
mov edi, 0xec4d8aab
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.00447f00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45f7a3
jmp 0x45f811
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0045ad63
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0046cded
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x45f811
jo 0x45f7cb
jns 0x45f7e3
pushf
ror edx, 0
rol edi, 0x1b
rol edi, 5
popf
lea ecx, [ecx]
xchg edi, eax
xchg edi, eax
jno 0x45f7e0
js 0x45f7e3
or dword [ebx - 0x17af17bb], 0xfffebbb0
mov eax, dword [ebp - 0x18]
push eax
call fcn.0044b39c
add esp, 4
jo 0x45f7f1
add ebx, 0
jp 0x45f7f6
jae 0x45f7fe
mov edx, edx
jb 0x45f7fe
call 0x14938370
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x463c64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046cded
Function at 0x46b575
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0046cded
add esp, 0xc
add esp, 0
jbe 0x46b593
jp 0x46b59b
jae 0x46b597
jnp 0x46b59b
mov eax, 0xe445c636
push ebx
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
rol esp, 0
jl 0x46b5e8
jb 0x46b5ea
jg 0x46b5f5
jns 0x46b5ee
jp 0x46b5f0
jmp 0x46b5f2
jle 0x46b5f5
mov ebx, 0x80e44d8a
jmp 0xe4943dff
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.00447f00
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46b6a6
xor eax, eax
jmp 0x46b72c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0045ad63
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0046cded
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x46b72a
xchg esp, esp
jno 0x46b6d5
nop
jo 0x46b6d5
mov edi, 0xfc4d8b41
mov ecx, dword [ebp - 4]
push ecx
call fcn.0044b39c
add esp, 4
jb 0x46b6e3
lea edi, [edi + 0x522d]
sub edi, 0x522d
lea edi, [edi + 0x60d8]
lea edi, [edi - 0x60d8]
je 0x46b711
pushf
mov ebx, ebx
add edx, 0
cmp edx, 0x6f41
popf
xchg esi, esi
jne 0x46b711
sub eax, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x46b72c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46bd49
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046cded
add esp, 0xc
ror ebx, 0
cmp esi, dword [esp]
jle 0x46bd76
jns 0x46bd6c
lea esp, [esp]
jp 0x46bd71
jmp 0x46bd73
jg 0x46bd76
add eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
or edi, edi
call 0x46bdad
lea esp, [esp + 4]
xor esi, dword [esp]
xor esi, dword [esp]
test esi, 0x5bc0
je 0x46bdd4
pushf
inc ecx
dec ecx
lea eax, [eax]
rol edx, 1
ror edx, 1
popf
js 0x46bdcd
xchg esp, esp
jl 0x46bdd1
jne 0x46bdd4
add eax, 0x80ec4d8a
jmp 0xec9445de
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00447f00
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46be49
xor eax, eax
jmp 0x46beda
std
cld
jnp 0x46be5e
lea eax, [eax + 0x4b79]
lea eax, [eax - 0x4b79]
xchg ebx, eax
xchg ebx, eax
jp 0x46be5e
or dword [ebp - 0x74af13bb], 0xe851f84d
clc
out dx, al
invalid
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0045ad63
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0046cded
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x46be88
xor eax, eax
jmp 0x46beda
nop
shl esi, 0
test ecx, 0x23c6
je 0x46bea7
lea esi, [esi + 0x7bbe]
lea esi, [esi - 0x7bbe]
je 0x46bea2
jge 0x46bea4
jne 0x46bea7
sub eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0044b39c
add esp, 4
add esp, 0
cmp esp, 0x3bdd
ja 0x46bed3
pushf
cmp esp, 0x4eec
shr edx, 0
jg 0x46becb
popf
lea esp, [esp]
jbe 0x46bed3
mov esp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x46bee3
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x43e518
call fcn.00465553
add esp, 0xc
mov byte [0x43e518], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x46c1ab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046cded
add esp, 0xc
and edx, edx
rol eax, 0
jp 0x46c1d3
jnp 0x46c1cd
je 0x46c1cf
jnp 0x46c1d3
mov ebx, 0xec45c6d6
dec eax
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
mov esi, esi
jge 0x46c219
jnp 0x46c211
lea ebx, [ebx]
nop
jl 0x46c219
cmp ebp, 0xec4d8af8
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.004550b0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46c29c
xor eax, eax
jmp 0x46c312
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0045ad63
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0046cded
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x46c310
xchg edi, ebx
xchg edi, ebx
jg 0x46c2e4
pushf
test esp, 0x59c9
call fcn.0046c2d5
xor eax, eax
Function at 0x46de4d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0046cded
add esp, 0xc
cmp esi, 0x5625
sub esp, 0
rol edx, 0
jg 0x46de85
pushf
test esp, 0x41e7
popf
ja 0x46de80
jne 0x46de82
jle 0x46de85
call 0x543b244f
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
push esi
pop esi
jge 0x46deb9
jg 0x46ded2
pushf
std
cld
popf
lea esi, [esi + 0x2134]
lea esi, [esi - 0x2134]
mov ecx, ecx
jle 0x46ded2
mov ebx, 0x80f44d8a
jmp 0xf49466dc
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
ror eax, 0
clc
and ebx, ebx
jge 0x46df4e
pushf
shl ebx, 0
nop
test esi, 0x1094
jae 0x46df48
popf
nop
jl 0x46df4e
add eax, 0xff634ae8
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call 0x46429d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x46df66
mov eax, 1
jmp 0x46e006
mov edi, edi
mov eax, eax
lea esp, [esp]
jge 0x46df78
pushf
nop
popf
nop
jl 0x46df78
mov ebx, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0045ad63
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0046cded
add esp, 0xc
neg esi
neg esi
and edi, 0xffffffff
jge 0x46dfa1
jp 0x46dfa8
jae 0x46dfa5
jnp 0x46dfa8
mov ecx, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x46dfb5
mov eax, 1
jmp 0x46e006
nop
jae 0x46dfca
lea eax, [eax + 0xa72]
lea eax, [eax - 0xa72]
je 0x46dfc6
jb 0x46dfca
mov esi, 0xec458b0f
mov eax, dword [ebp - 0x14]
push eax
call fcn.0044b39c
add esp, 4
jbe 0x46dfd8
cmp esp, 0x670e
js 0x46dfff
pushf
or esp, 0
xor eax, 0
add edi, 0xc6e
sub edi, 0xc6e
popf
ja 0x46dff8
xchg esi, eax
xchg esi, eax
je 0x46dffc
jns 0x46dfff
lcall 0x55ff, 0x51084d8b
in al, dx
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46ffd3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0046cded
add esp, 0xc
je 0x46ffee
push ebx
add ebx, 0x48ac
ror ebx, 3
pop ebx
ror esp, 0
jns 0x470007
jno 0x470000
jl 0x470002
js 0x470007
mov edx, 0x45c62601
invalid
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
jo 0x470039
neg ebx
neg ebx
rol esp, 0
js 0x470048
jo 0x470044
jns 0x470048
mov eax, 0xf04d8a16
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
add esp, 0
jg 0x4700ad
js 0x4700b9
mov edx, edx
jg 0x4700b3
nop
nop
jns 0x4700b9
add eax, 0x7e42e82d
std
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.00447f00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4700cb
xor eax, eax
jmp 0x470101
jp 0x4700cd
jns 0x4700de
jae 0x4700d1
jns 0x4700d3
lea esp, [esp]
xchg edi, ecx
xchg edi, ecx
js 0x4700de
mov edi, 0xf0458d25
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0045ad63
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0046cded
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470108
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0046cded
add esp, 0xc
push 0x21
push 0x43fbc8
lea ecx, [ebp - 0x138]
push ecx
call fcn.0046fbf1
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x470210
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0046cded
add esp, 0xc
push 0xb
push 0x43fbec
lea edx, [ebp - 0x138]
push edx
call fcn.0046fbf1
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x470203
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0046fbf1
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x470212
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x470916
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046cded
add esp, 0xc
ror eax, 8
ror eax, 0x18
jbe 0x470940
mov esi, esi
jbe 0x47093b
js 0x47093d
ja 0x470940
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
push edx
pop edx
xor ebx, dword [esp]
xor ebx, dword [esp]
cmp ebx, dword [esp + 4]
jge 0x4709b5
pushf
lea edx, [edx + 0x2bdc]
lea edx, [edx - 0x2bdc]
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
xor ebx, 0x7876
xor ebx, 0x7876
popf
jge 0x4709b0
jg 0x4709b2
jl 0x4709b5
mov ebp, 0x80e84d8a
jmp 0xe89491bf
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004550b0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x470a41
xor eax, eax
jmp 0x470abb
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0045ad63
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0046cded
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x470ab9
inc ebx
dec ebx
and eax, eax
jno 0x470a81
pushf
shl esp, 0
xchg edx, esi
xchg edx, esi
nop
rol eax, 0
popf
jb 0x470a7e
jo 0x470a81
or dword [ebx - 0x17af07bb], 0xfffda912
mov eax, dword [ebp - 8]
push eax
call fcn.0044b39c
add esp, 4
jbe 0x470a8f
inc ecx
dec ecx
rol esp, 0
ja 0x470aa8
pushf
and esi, 0xffffffff
test edx, 0x5a4e
popf
lea ebx, [ebx]
jbe 0x470aa8
or dword [ebx - 0x74aeefb3], 0x8b520c55
inc ebp
or byte [eax - 1], dl
push ebp
clc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x470abb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc