joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f9ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0048e238
add esp, 0xc
jno 0x48f9c9
xchg edi, eax
xchg edi, eax
or edi, edi
mov eax, eax
jnp 0x48f9d8
xchg edi, edx
xchg edi, edx
jp 0x48f9d8
add eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
test dword [esp], edi
stc
dec eax
inc eax
add edx, 0x4062
sub edx, 0x4062
jg 0x48fa33
pushf
cmp edx, esi
jno 0x48fa22
popf
lea edi, [edi + 0x2f3b]
lea edi, [edi - 0x2f3b]
jle 0x48fa33
mov edx, 0x80f04d8a
jmp 0xf096823d
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
test dword [esp], ebx
jg 0x48faac
jge 0x48fa9a
lea edi, [edi + 0x3741]
lea edi, [edi - 0x3741]
jae 0x48faa8
jle 0x48faac
add eax, 0xf563e8ae
invalid
call fcn.0047f014
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48fabe
xor eax, eax
jmp 0x48faf2
mov ebx, ebx
jne 0x48facf
pushf
inc edx
dec edx
popf
jp 0x48faca
js 0x48facc
je 0x48facf
or dword [ebp - 0x74af0fbb], 0xe851fc4d
or eax, 0x89fffef8
inc ebp
in al, dx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047f2e9
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0048e238
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4935e1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048e238
add esp, 0xc
std
cld
jns 0x4935fe
dec ecx
inc ecx
add esi, 0
ja 0x49361a
pushf
add edi, 0xb5a
sub edi, 0xb5a
popf
mov ebx, ebx
jbe 0x49361a
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
ror edx, 0x1f
rol edx, 0x1f
nop
jno 0x49365e
jge 0x493659
lea esi, [esi]
jo 0x49365e
xor eax, 0x80e84d8a
jmp 0xe896be68
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
test dword [esp], edx
je 0x4936d7
jno 0x4936cd
xchg ebx, ebx
lea ecx, [ecx]
jle 0x4936d3
jne 0x4936d7
mov ebx, 0xb938e887
invalid
call fcn.0047f014
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4936ec
xor eax, eax
jmp 0x49379a
jno 0x4936ee
call 0x4936f3
lea esp, [esp + 4]
shl edx, 0
jp 0x49371b
pushf
xor esi, edi
xor esi, edi
jmp 0x493704
or esp, 0
push ecx
add ecx, 0x541b
ror ecx, 0xf
pop ecx
popf
ja 0x493716
xchg esp, esp
jnp 0x49371b
sub eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0047f2e9
mov dword [ebp - 4], eax
lea eax, [eax + 0x2432]
lea eax, [eax - 0x2432]
not ebx
not ebx
je 0x493748
mov edx, edx
jae 0x493741
lea ecx, [ecx]
jnp 0x493745
jne 0x493748
add eax, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048e238
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x493762
xor eax, eax
jmp 0x49379a
jmp 0x493764
push esi
pop esi
jo 0x493768
add esp, 0
jg 0x49377e
lea esi, [esi + 0x6e0d]
lea esi, [esi - 0x6e0d]
jns 0x49377b
jle 0x49377e
jmp 0x5245850d
mov ecx, dword [ebp - 4]
push ecx
call fcn.00478641
add esp, 4
jnp 0x49378c
nop
jnp 0x493797
xchg edx, edx
lea esi, [esi]
jp 0x493797
mov ebx, 0xfc55ff75
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495dfc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048e238
add esp, 0xc
add esi, 0
xor esp, 0
ror edx, 0x19
ror edx, 7
jb 0x495e3d
pushf
jmp 0x495e27
call 0x495e2c
lea esp, [esp + 4]
mov eax, eax
popf
je 0x495e36
xchg ecx, ecx
mov eax, eax
jae 0x495e3d
mov ecx, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
add eax, dword [esp]
sub eax, dword [esp]
lea ecx, [ecx + 0x38cc]
lea ecx, [ecx - 0x38cc]
ror ebx, 0xc
rol ebx, 0xc
cmp esi, dword [esp]
jp 0x495ea7
lea esi, [esi + 0x56b3]
lea esi, [esi - 0x56b3]
mov eax, eax
lea ebx, [ebx + 0x7507]
lea ebx, [ebx - 0x7507]
jnp 0x495ea7
add eax, 0x80ec4d8a
jmp 0xec96e6b1
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0047f014
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x495f19
xor eax, eax
jmp 0x495f98
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0047f2e9
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0048e238
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x495f96
xchg edx, edx
jnp 0x495f53
pushf
std
cld
popf
lea esp, [esp]
jb 0x495f4e
mov ecx, ecx
jp 0x495f53
jmp 0x5145a4e2
mov eax, dword [ebp - 4]
push eax
call fcn.00478641
add esp, 4
lea ebx, [ebx]
xor ebx, 0x4c45
xor ebx, 0x4c45
ror edi, 8
ror edi, 0x18
jns 0x495f85
pushf
jp 0x495f79
je 0x495f7b
nop
jle 0x495f7e
popf
lea esi, [esi]
js 0x495f85
mov ecx, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x495f98
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49718d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0048e238
add esp, 0xc
or esp, 0
lea edx, [edx]
js 0x4971ba
pushf
xor ebx, esi
xor ebx, esi
popf
jnp 0x4971b7
jns 0x4971ba
mov edi, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
ror esi, 0x14
rol esi, 0x14
lea edi, [edi + 0x2a47]
sub edi, 0x2a47
and eax, eax
rol ebx, 0xf
rol ebx, 0x11
je 0x497223
jbe 0x497220
jne 0x497223
mov ebp, 0x80e44d8a
jmp 0xe496fa2d
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0047f014
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4972d1
xor eax, eax
jmp 0x497349
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0047f2e9
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0048e238
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x497347
cmp ebx, eax
sub esp, 0
shl esp, 0
call 0x497304
add esp, 4
jge 0x497311
xchg ebx, ebx
jl 0x49730d
jl 0x497311
mov esi, 0xfc4d8b46
mov ecx, dword [ebp - 4]
push ecx
call fcn.00478641
add esp, 4
add ecx, 0
nop
lea edx, [edx]
js 0x497325
jnp 0x49732e
jg 0x497329
xchg esp, esp
jp 0x49732e
ljmp 0x458b:0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x497349
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x497352
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048e238
add esp, 0xc
cld
sub esp, 0
je 0x497383
pushf
rol esi, 7
rol esi, 0x19
popf
mov esp, esp
nop
jmp 0x497380
jne 0x497383
xor eax, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
sub ecx, 0
jae 0x4973dc
pushf
jae 0x4973cc
jns 0x4973ce
xchg esp, esp
or esp, 0
popf
xchg esp, esp
xchg esi, eax
xchg esi, eax
jb 0x4973dc
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.00474800
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x497470
xor eax, eax
jmp 0x4974dd
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0047f2e9
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048e238
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4974db
jle 0x497498
and ebx, 0xffffffff
lea esp, [esp]
jp 0x4974aa
lea esp, [esp]
xchg ecx, edx
xchg ecx, edx
jnp 0x4974aa
add eax, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00478641
add esp, 4
test dword [esp + 0xc], edx
jg 0x4974d2
pushf
neg edi
neg edi
xor esp, 0
not eax
not eax
popf
jnp 0x4974cd
xchg esi, esi
jle 0x4974d2
ljmp 0x55ff:0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x4974dd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49759b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x46e064], 1
jne 0x497709
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048e238
add esp, 0xc
dec esi
inc esi
jb 0x4975c5
jne 0x4975d9
pushf
jb 0x4975cb
std
cld
jno 0x4975cf
popf
xchg esp, esp
lea edx, [edx]
nop
je 0x4975d9
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
lea eax, [eax + 0x4943]
sub eax, 0x4943
jl 0x497626
pushf
cmp esp, 0x3a2d
cmc
popf
jne 0x497623
jge 0x497626
add eax, 0x80e84d8a
jmp 0xe896fe30
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0047f014
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49769b
xor eax, eax
jmp 0x497797
test dword [esp + 0x10], eax
sub edx, 0
cmp ebx, dword [esp]
jge 0x4976a7
jbe 0x4976b8
pushf
jl 0x4976ad
popf
xchg edi, ebx
xchg edi, ebx
mov esp, esp
ja 0x4976b8
add eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0047f2e9
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0048e238
add esp, 0xc
jg 0x4976da
jle 0x4976f0
xchg ecx, ecx
nop
mov esp, esp
lea edi, [edi + 0x4de7]
lea edi, [edi - 0x4de7]
jg 0x4976f0
add eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0x497700
mov eax, dword [ebp - 8]
mov dword [0x46e064], eax
jmp 0x497707
xor eax, eax
jmp 0x497797
jmp 0x497712
mov ecx, dword [0x46e064]
mov dword [ebp - 8], ecx
ror esp, 0
jae 0x497740
pushf
lea eax, [eax + 0x361]
lea eax, [eax - 0x361]
sub esp, 0
lea esp, [esp]
popf
xchg esi, eax
xchg esi, eax
lea eax, [eax + 0xd78]
lea eax, [eax - 0xd78]
xchg esp, esp
jb 0x497740
add eax, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
add edx, 0xd44
sub edx, 0xd44
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
mov edi, edi
push ecx
add ecx, 0x3091
ror ecx, 0x16
pop ecx
je 0x497780
pushf
lea esi, [esi]
cmp eax, dword [esp + 4]
cmp ecx, dword [esp]
sub esp, 0
popf
jnp 0x49777b
lea edi, [edi]
jne 0x497780
mov edi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00478641
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x497e76
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0048e238
add esp, 0xc
not edx
not edx
jl 0x497ea7
jno 0x497e9e
mov esi, esi
jno 0x497ea2
jmp 0x497ea4
jge 0x497ea7
mov edi, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
cmp edx, 0x151e
jne 0x497ef1
pushf
mov edi, edi
rol edx, 0
jg 0x497ee8
popf
jb 0x497eec
jns 0x497eee
je 0x497ef1
mov edi, 0x80f04d8a
jmp 0xf09706fb
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jno 0x497f53
shr esp, 0
ja 0x497f61
jno 0x497f5a
jg 0x497f5c
lea esi, [esi]
jbe 0x497f61
mov ecx, 0xfdc89ae8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.00474800
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x497f73
xor eax, eax
jmp 0x497fbb
jns 0x497f75
jne 0x497f98
pushf
ror edi, 0
cmp eax, 0x56e7
popf
xchg edx, edi
xchg edx, edi
lea edx, [edx + 0x6d9c]
lea edx, [edx - 0x6d9c]
xchg esp, esp
je 0x497f98
mov ecx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047f2e9
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0048e238
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x499850
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40137f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4130ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push edi
mov dword [ebp - 0x218], 1
push 0x458810
lea ecx, [ebp - 0x228]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x224]
push eax
push 0xf003f
push 0
push str.SOFTWAREZKYRCheckToolOS
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x40140e
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x214], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x220], 0x200
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push str.OSType
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp - 0x228]
call sub.MFC42.DLL_CString::operator_2
push str.PeOS
lea eax, [ebp - 0x228]
push eax
call fcn.004059b0
and eax, 0xff
test eax, eax
je 0x40148d
mov dword [ebp - 0x218], 0
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x412508
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4139ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x29c
push edi
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 4], 1
push 0x44
push 0
lea eax, [ebp - 0x268]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x2a4], 0
mov ecx, 0xe
xor eax, eax
lea edi, [ebp - 0x2a0]
rep stosd dword es:[edi], eax
lea ecx, [ebp + 8]
call fcn.00405a10
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp + 0xc]
call fcn.00405a10
push eax
lea edx, [ebp - 0x110]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 0x2a4], 0x3c
mov dword [ebp - 0x2a0], 0x440
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x298], 0x7e3884
lea eax, [ebp - 0x224]
mov dword [ebp - 0x294], eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x288], 6
mov dword [ebp - 0x284], 0
lea edx, [ebp - 0x2a4]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 8