joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e660
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x458bb4]
cmp dword [eax + 0x30], 0
je 0x44e70a
cmp dword [ebx + 0x94], 0
jne 0x44e704
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44e5f0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44e704
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44e6ca
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44e704
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004178a4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44e6d9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44f268
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44f29d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045e8
jmp 0x44f2aa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040454c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4503bc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4503fd
mov eax, esi
call fcn.00436bd8
test al, al
je 0x4503fd
mov eax, dword [ebx + 0x84]
call fcn.00436978
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4503fd
push 0
mov eax, dword [ebx + 0x84]
call fcn.00436978
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x452dd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x452e64
push 0
mov eax, ebx
call fcn.004049b8
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x452e3f
mov eax, esi
call fcn.004047b8
inc eax
push eax
mov eax, esi
call fcn.004049b8
push eax
push 1
push 0
mov eax, edi
call fcn.004049b8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x452e5a
mov ecx, dword [0x456ef4]
mov dl, 1
mov eax, dword [0x451524]
call fcn.0040beec
call fcn.00403f0c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x453a50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049a8
xor eax, eax
push ebp
push 0x453aad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x453ac0
call fcn.00404804
mov eax, dword [ebp - 8]
call fcn.004049b8
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453ab4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040451c
ret

Function at 0x454e38
Capabilities:
Set current directory

Disassembly:
mov eax, edx
add eax, dword [edx + 4]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
ret
Function at 0x47762a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048801b
add esp, 0xc
call fcn.00477648
Function at 0x47a2a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048801b
add esp, 0xc
lea edi, [edi]
jae 0x47a2ca
lea esp, [esp]
jo 0x47a2c4
jns 0x47a2c6
jb 0x47a2ca
mov ecx, 0xe845c698
push eax
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0
cmc
call fcn.0047a30c

Function at 0x47d896
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0048801b
add esp, 0xc
add esi, 0
jnp 0x47d8d4
pushf
cmp edx, 0x3e6c
rol esi, 0
shl edi, 0
inc eax
dec eax
popf
xchg ecx, ecx
jbe 0x47d8d1
jp 0x47d8d4
add eax, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
ror edi, 0
lea esp, [esp]
std
cld
jns 0x47d915
jp 0x47d910
jle 0x47d912
js 0x47d915
mov ecx, 0x80f04d8a
jmp 0xf095611f
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
push eax
add eax, 0x598b
ror eax, 7
pop eax
jne 0x47d988
jno 0x47d983
jp 0x47d985
je 0x47d988
mov esp, 0x412fe8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.00481abc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47d99a
xor eax, eax
jmp 0x47d9ce
xchg esp, esp
add ebx, 0
jp 0x47d9ab
jb 0x47d9a3
jmp 0x47d9a5
nop
lea esi, [esi]
jnp 0x47d9ab
ljmp 0x4d8b:0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00488963
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0048801b
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47df12
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0048801b
add esp, 0xc
je 0x47df2d
jne 0x47df2f
jg 0x47df41
pushf
test dword [esp], ebx
jge 0x47df38
je 0x47df3a
popf
mov edx, edx
jle 0x47df41
sub eax, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
xchg esp, esp
js 0x47df86
pushf
ror eax, 0x19
ror eax, 7
test ecx, 0x638c
popf
xchg ecx, eax
xchg ecx, eax
xchg esp, esp
lea ecx, [ecx]
jns 0x47df86
xor eax, 0x80f04d8a
jmp 0xf0956790
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.00481abc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47dfe6
xor eax, eax
jmp 0x47e05c
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00488963
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0048801b
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x47e05a
xor ebx, dword [esp + 0xc]
xor ebx, dword [esp + 0xc]
js 0x47e023
pushf
jo 0x47e01a
dec edi
inc edi
popf
jo 0x47e020
jns 0x47e023
mov esp, 0x51ec4d8b
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00496b37
add esp, 4
ror eax, 0x10
ror eax, 0x10
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
je 0x47e03f
jg 0x47e04d
pushf
sub esp, 0
popf
jp 0x47e04a
jle 0x47e04d
mov ebp, 0x520c558b
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x47e05c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47ec42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048801b
add esp, 0xc
test ecx, eax
mov ebx, ebx
jb 0x47ec6a
lea esp, [esp]
mov esp, esp
jae 0x47ec6a
mov edi, 0xf345c63f
jne 0x47ec35
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x11], 0x54
inc ebp
in eax, dx
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x67
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 6], 0x42
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 5], 0
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0xa], 0x4a
mov byte [ebp - 7], 0x70
jae 0x47ecac
xor edx, esi
xor edx, esi
xchg esi, esi
jp 0x47ecb9
jbe 0x47ecb6
jnp 0x47ecb9
add eax, 0x80ec4d8a
jmp 0xec9574c3
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
jg 0x47ed3d
not edi
not edi
or edi, 0
jns 0x47ed57
pushf
cmp ecx, dword [esp]
js 0x47ed4d
shl esp, 0
popf
jbe 0x47ed54
js 0x47ed57
add eax, 0x19397e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 5], dh
call fcn.004980f3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47ed6a
jmp 0x47edfb
stc
shr esp, 0
jge 0x47ed77
jne 0x47ed72
lea esi, [esi]
jl 0x47ed77
mov edx, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00488963
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048801b
add esp, 0xc
call fcn.0047ed9c
Function at 0x47f1ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x47f1c0
jmp 0x47f395
lea edx, [edx + 0x4b36]
lea edx, [edx - 0x4b36]
shl esp, 0
je 0x47f1d1
jnp 0x47f1da
js 0x47f1d5
jp 0x47f1d7
jp 0x47f1da
add eax, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x47260c], edx
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
jns 0x47f1f5
nop
jg 0x47f1f8
jno 0x47f211
pushf
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
popf
jg 0x47f208
xchg edi, edx
xchg edi, edx
jnp 0x47f20e
jo 0x47f211
mov eax, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x47374c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x47374c], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x473748], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x473838], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x47383c], ecx
call fcn.0047f245
Function at 0x47f9d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0048801b
add esp, 0xc
sub esp, 0
jge 0x47fa05
pushf
js 0x47f9f6
shr esi, 0
and esp, 0xffffffff
popf
jl 0x47fa00
xchg ecx, eax
xchg ecx, eax
jl 0x47fa05
add eax, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
jns 0x47fa4f
call 0x47fa54
lea esp, [esp + 4]
jb 0x47fa63
jne 0x47fa5c
xchg esi, eax
xchg esi, eax
jge 0x47fa60
jae 0x47fa63
ljmp 0x1e9:0x80e44d8a
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.004980f3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47fb11
xor eax, eax
jmp 0x47fb90
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00488963
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0048801b
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x47fb8e
xor edi, edx
xor edi, edx
rol esi, 0
cmp ebx, 0x3d3d
test dword [esp + 0x10], ebx
jne 0x47fb50
jne 0x47fb4c
je 0x47fb50
mov ecx, 0xfc4d8bf9
mov ecx, dword [ebp - 4]
push ecx
call fcn.00496b37
add esp, 4
xor ebx, edi
xor ebx, edi
ror edi, 0xc
ror edi, 0x14
jno 0x47fb68
jne 0x47fb75
ja 0x47fb6c
mov ecx, ecx
ja 0x47fb70
xchg edx, edx
je 0x47fb75
mov edi, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x47fb90
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4816e6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0048801b
add esp, 0xc
push 0x21
push 0x4739f8
lea ecx, [ebp - 0x138]
push ecx
call fcn.0047d9d5
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4817ee
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0048801b
add esp, 0xc
push 0xb
push 0x473a1c
lea edx, [ebp - 0x138]
push edx
call fcn.0047d9d5
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4817e1
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0047d9d5
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4817f0
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x481af4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0048801b
add esp, 0xc
clc
lea edi, [edi + 0x6ef9]
lea edi, [edi - 0x6ef9]
jo 0x481b27
mov esp, esp
jg 0x481b20
jg 0x481b22
jnp 0x481b24
jno 0x481b27
mov esp, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
xor ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0xc]
jl 0x481b86
pushf
add edx, 0x279e
sub edx, 0x279e
add eax, dword [esp]
sub eax, dword [esp]
test esp, 0x4eb5
popf
xchg edi, ecx
xchg edi, ecx
jne 0x481b83
jge 0x481b86
mov edi, 0x80f44d8a
jmp 0xf495a390
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
jnp 0x481be8
je 0x481bf2
jae 0x481bec
jno 0x481bee
jne 0x481bf2
mov ebp, 0x7c43e8ea
add dword [eax], eax
call 0x49983a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x481c0a
mov eax, 1
jmp 0x481cb1
js 0x481c0c
neg esi
neg esi
jbe 0x481c1b
jno 0x481c14
lea eax, [eax]
lea ebx, [ebx]
ja 0x481c1b
add eax, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00488963
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0048801b
add esp, 0xc
add edx, dword [esp]
sub edx, dword [esp]
mov eax, eax
jle 0x481c57
pushf
shl esp, 0
xchg esi, esi
popf
mov esp, esp
js 0x481c52
ja 0x481c54
jg 0x481c57
add dword [ebx + 0x7500ec7d], 0x1b807
add byte [eax], al
cmp dword [ebp - 0x14], 0
jne 0x481c64
mov eax, 1
jmp 0x481cb1
rol eax, 5
rol eax, 0x1b
xor edi, edx
xor edi, edx
jnp 0x481c83
pushf
add esp, 0
je 0x481c77
lea eax, [eax]
js 0x481c7b
popf
nop
jae 0x481c80
jp 0x481c83
mov ebx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00496b37
add esp, 4
add ebx, dword [esp]
sub ebx, dword [esp]
add edi, dword [esp]
sub edi, dword [esp]
neg edi
neg edi
not edx
not edx
jnp 0x481caa
jnp 0x481ca7
jp 0x481caa
mov esp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x482262
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x47261c], 1
jne 0x4823c5
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048801b
add esp, 0xc
nop
lea ecx, [ecx + 0x73cd]
lea ecx, [ecx - 0x73cd]
jns 0x4822a4
jg 0x482299
jns 0x48229b
lea eax, [eax]
ja 0x48229f
js 0x4822a4
mov ebp, 0x45c6c7b3
call 0xed8de8f3
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
sub esp, 0
je 0x4822d9
jne 0x4822e4
nop
jae 0x4822de
mov esi, esi
je 0x4822e4
and dword [ebx], 0x80e84d8a
jmp 0xe895aaee
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.004980f3
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x482359
xor eax, eax
jmp 0x48242a
rol ebx, 0
cmp edi, dword [esp + 4]
je 0x482362
jnp 0x482372
mov edi, edi
jge 0x482368
jnp 0x48236a
xchg ebx, edi
xchg ebx, edi
jp 0x482372
add eax, 0xe8458d6e
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00488963
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0048801b
add esp, 0xc
xchg edx, edx
jge 0x4823af
pushf
jb 0x48239a
rol ebx, 6
ror ebx, 6
jmp 0x4823a2
popf
jg 0x4823a6
jae 0x4823a8
xchg edi, esi
xchg edi, esi
jl 0x4823af
sub eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0x4823bf
mov eax, dword [ebp - 8]
mov dword [0x47261c], eax
jmp 0x4823c3
xor eax, eax
jmp 0x48242a
jmp 0x4823ce
mov ecx, dword [0x47261c]
mov dword [ebp - 8], ecx
jae 0x4823d0
test edi, ebx
rol edx, 0
cmc
jbe 0x4823de
lea ebx, [ebx]
ja 0x4823de
mov ebp, 0xf8558b5f
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
or ebx, ebx
je 0x482413
pushf
jle 0x4823ec
lea ebx, [ebx + 0x1da0]
lea ebx, [ebx - 0x1da0]
shl esp, 0
ror esp, 0
popf
jne 0x482402
mov esp, esp
lea edx, [edx + 0x4db0]
lea edx, [edx - 0x4db0]
jne 0x482413
jmp 0x514469a2
mov eax, dword [ebp - 4]
push eax
call fcn.00496b37
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x482b35
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048801b
add esp, 0xc
test esp, 0x4815
xchg esi, esi
jno 0x482b61
xchg esp, esp
mov eax, eax
jo 0x482b61
mov esp, 0x45c687d9
call 0xe98df1b0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
add esp, 0
xor esp, 0
lea edi, [edi + 0x2382]
lea edi, [edi - 0x2382]
not edx
not edx
jno 0x482bc3
pushf
call fcn.00482bb4