joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcd940e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00cdab4e
add esp, 0xc
ja 0xcd9429
jp 0xcd9434
xchg esp, esp
jno 0xcd942f
jp 0xcd9431
jnp 0xcd9434
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
and eax, eax
or edi, 0
jg 0xcd9482
jg 0xcd9479
xchg ecx, edx
xchg ecx, edx
je 0xcd947f
jle 0xcd9482
xor eax, 0x80e84d8a
jmp 0xe91b1c8c
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.00ce2779
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xcd950e
xor eax, eax
jmp 0xcd9585
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00ce304d
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 8], 0
je 0xcd9583
cmc
test dword [esp + 0xc], esi
jmp 0xcd953b
jo 0xcd9553
pushf
cld
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
popf
xchg edx, edx
jne 0xcd954e
jne 0xcd9550
jno 0xcd9553
jmp 0x51c5dae2
mov eax, dword [ebp - 8]
push eax
call fcn.00ce234f
add esp, 4
rol ecx, 0x1b
ror ecx, 0x1b
mov esi, esi
not ebx
not ebx
cmp ecx, dword [esp + 0x10]
jne 0xcd9576
js 0xcd9573
je 0xcd9576
ljmp 0x558b:0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0xcd9585
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xcdab7d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00cdab4e
add esp, 0xc
lea esp, [esp]
jnp 0xcdaba2
jae 0xcdaba4
jbe 0xcdabb9
pushf
shr esp, 0
ror edi, 1
ror edi, 0x1f
popf
jbe 0xcdabb4
jp 0xcdabb6
ja 0xcdabb9
mov esp, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.00cf4e1d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xcdac84
xor eax, eax
jmp 0xcdad18
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00ce304d
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0xcdacae
xor eax, eax
jmp 0xcdad18
js 0xcdacb0
jbe 0xcdacb2
lea ecx, [ecx + 0x79d5]
sub ecx, 0x79d5
je 0xcdaced
pushf
push eax
add eax, 0x556a
ror eax, 8
pop eax
or esp, 0
call 0xcdacd4
add esp, 4
push edx
add edx, 0x6ada
ror edx, 0xe
pop edx
popf
jge 0xcdace6
jmp 0xcdace8
mov edx, edx
jne 0xcdaced
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00ce234f
add esp, 4
test dword [esp], eax
jae 0xcdad0d
xchg ecx, esi
xchg ecx, esi
ja 0xcdad04
xchg ecx, esi
xchg ecx, esi
mov edi, edi
jb 0xcdad0d
mov edi, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xcdc3ff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00cdab4e
add esp, 0xc
nop
xchg edi, edi
jbe 0xcdc42c
lea esi, [esi + 0x7a9]
lea esi, [esi - 0x7a9]
ja 0xcdc42c
mov edx, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
ror edx, 0
jle 0xcdc476
xchg edx, edi
xchg edx, edi
jnp 0xcdc46f
jb 0xcdc471
jbe 0xcdc473
jg 0xcdc476
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.00ce2779
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xcdc4f9
xor eax, eax
jmp 0xcdc56c
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00ce304d
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0xcdc56a
xchg edi, ecx
xchg edi, ecx
lea ecx, [ecx + 0x7d83]
sub ecx, 0x7d83
jo 0xcdc531
jb 0xcdc538
je 0xcdc535
jae 0xcdc538
mov edi, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.00ce234f
add esp, 4
shr esp, 0
jo 0xcdc559
pushf
ror esi, 4
rol esi, 4
popf
lea esp, [esp]
jno 0xcdc559
mov esp, 0x5010458b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0xcdc56c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0xcdc776
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00cdab4e
add esp, 0xc
jnp 0xcdc798
rol eax, 0
add ecx, dword [esp]
sub ecx, dword [esp]
ja 0xcdc7ae
pushf
ja 0xcdc7a7
popf
jp 0xcdc7ab
jbe 0xcdc7ae
add esi, 0xc651e845
inc ebp
in eax, dx
je 0xcdc77d
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jp 0xcdc859
jo 0xcdc85b
shr esp, 0
jne 0xcdc870
pushf
shl esp, 0
popf
lea esp, [esp]
jle 0xcdc86c
nop
je 0xcdc870
mov esi, 0x185a8e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 4], dh
call fcn.00cf4e1d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xcdc882
xor eax, eax
jmp 0xcdc901
rol edi, 9
rol edi, 0x17
and esp, 0xffffffff
jae 0xcdc893
nop
jbe 0xcdc890
jb 0xcdc893
mov esi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00ce304d
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0xcdc8bd
xor eax, eax
jmp 0xcdc901
js 0xcdc8bf
xor esp, 0
nop
jb 0xcdc8c5
jno 0xcdc8df
pushf
xchg ebx, esi
xchg ebx, esi
cld
popf
lea edi, [edi + 0xa29]
lea edi, [edi - 0xa29]
jo 0xcdc8df
lcall 0x67e8, 0x52fc558b
pop edx
add byte [eax], al
mov edx, dword [ebp - 4]
push edx
call fcn.00ce234f
add esp, 4
mov esi, esi
inc ecx
dec ecx
jo 0xcdc8f6
lea ecx, [ecx]
jno 0xcdc8f6
sub eax, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xcdd437
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00cdab4e
add esp, 0xc
sub esp, 0
xor esp, 0
shl edx, 0
neg edi
neg edi
jno 0xcdd475
jno 0xcdd461
lea ecx, [ecx + 0x62ad]
lea ecx, [ecx - 0x62ad]
mov esp, esp
jb 0xcdd471
jo 0xcdd475
call 0xe9139b56
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
test eax, ebx
mov esp, esp
je 0xcdd4bc
xchg esp, esp
jne 0xcdd4bc
mov ebx, 0x80e84d8a
jmp 0xe91b5cc6
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00ce2779
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xcdd54b
xor eax, eax
jmp 0xcdd5db
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00ce304d
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 8], 0
je 0xcdd5d9
shl edi, 0
lea ebx, [ebx + 0x25dc]
lea ebx, [ebx - 0x25dc]
jo 0xcdd582
xor esi, 0
jge 0xcdd595
je 0xcdd589
xchg esp, esp
xchg ebx, ecx
xchg ebx, ecx
jns 0xcdd591
jl 0xcdd595
mov ebp, 0xf8458b0f
mov eax, dword [ebp - 8]
push eax
call fcn.00ce234f
add esp, 4
add edi, 0x7c16
sub edi, 0x7c16
lea ebx, [ebx]
shl esp, 0
jle 0xcdd5c8
lea ebx, [ebx + 0x1e1d]
lea ebx, [ebx - 0x1e1d]
mov eax, eax
nop
jg 0xcdd5c5
jg 0xcdd5c8
ljmp 0x558b:0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0xcdd5db
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0xcdfee7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00cdab4e
add esp, 0xc
and ecx, ecx
or eax, eax
jge 0xcdff12
jmp 0xcdff08
jnp 0xcdff0a
jle 0xcdff0c
jmp 0xcdff0e
jl 0xcdff12
xor eax, 0xf445c642
push ebx
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
test dword [esp + 8], edi
neg eax
neg eax
push ebx
pop ebx
lea esp, [esp]
js 0xcdff63
pushf
jle 0xcdff55
jg 0xcdff57
or esp, 0
popf
jl 0xcdff5e
lea ecx, [ecx]
jns 0xcdff63
mov edi, 0x80f44d8a
jmp 0xf51b876d
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
neg ebx
neg ebx
lea ecx, [ecx + 0x3e87]
sub ecx, 0x3e87
jge 0xcdffd5
and eax, 0xffffffff
jns 0xcdfff0
pushf
jne 0xcdffde
xor eax, dword [esp + 8]
xor eax, dword [esp + 8]
rol esp, 0
popf
jae 0xcdffed
js 0xcdfff0
add eax, 0xff63d5e8
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call 0xcd63ca
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0xce0008
mov eax, 1
jmp 0xce009e
push esi
add esi, 0xce7
ror esi, 0xc
pop esi
je 0xce001c
lea esp, [esp]
jne 0xce001c
mov edi, 0xf4458dfc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00ce304d
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00cdab4e
add esp, 0xc
xchg ebx, eax
xchg ebx, eax
jb 0xce004d
ja 0xce0042
jno 0xce0044
mov esp, esp
xchg esi, edx
xchg esi, edx
jae 0xce004d
mov edi, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0xce005a
mov eax, 1
jmp 0xce009e
mov edi, edi
and esp, 0xffffffff
push ebx
pop ebx
jae 0xce0079
pushf
ror edx, 0x10
rol edx, 0x10
je 0xce006d
rol eax, 0
jne 0xce0072
popf
xchg ecx, ecx
jb 0xce0079
add eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00ce234f
add esp, 4
ror edx, 0x1b
rol edx, 0x1b
js 0xce008d
test dword [esp], ecx
jp 0xce0097
mov esp, esp
jnp 0xce0097
jmp 0x51d64e26
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xce0e7e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00cdab4e
add esp, 0xc
add esp, 0
jg 0xce0e9c
ror esi, 1
rol esi, 1
je 0xce0ea2
jle 0xce0ea9
jne 0xce0ea6
jg 0xce0ea9
lcall 0x45c6, 0x7aec45c6
call 0xea13d4fc
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
xchg ecx, ebx
xchg ecx, ebx
xor edx, ebx
xor edx, ebx
ja 0xce0eeb
and ecx, ecx
jae 0xce0ef5
lea eax, [eax]
jb 0xce0ef5
mov esp, 0xf44d8ae8
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
rol ebx, 0
nop
je 0xce0f8a
pushf
rol eax, 0x11
rol eax, 0xf
lea edi, [edi + 0x95b]
lea edi, [edi - 0x95b]
xchg edx, edx
clc
popf
js 0xce0f87
jne 0xce0f8a
add eax, 0x13e8ee8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.00cf4e1d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xce0f9d
jmp 0xce1043
std
cld
add eax, 0x737f
sub eax, 0x737f
jb 0xce0fab
jge 0xce0fad
jnp 0xce0fb8
jg 0xce0fb1
jno 0xce0fb3
jp 0xce0fb8
mov esi, 0x558dca20
call 0xf9139b11
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00ce304d
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00cdab4e
add esp, 0xc
push eax
pop eax
jo 0xce0fdc
jnp 0xce0fe6
jne 0xce0fe0
jbe 0xce0fe2
jp 0xce0fe6
jmp 0xfd4b9353
cmp dword [ebp - 4], 0
jne 0xce0fee
jmp 0xce1043
xchg ebx, ebx
ja 0xce1002
pushf
lea esp, [esp]
popf
jge 0xce0ffb
xchg edx, eax
xchg edx, eax
ja 0xce0fff
jbe 0xce1002
lcall 0x44e8, 0x52fc558b
adc eax, dword [eax]
add byte [ebx + 0x7f04c4], al
mov edx, dword [ebp - 4]
push edx
call fcn.00ce234f
add esp, 4
jg 0xce1010
xor esi, 0x7ca0
xor esi, 0x7ca0
jl 0xce103c
pushf
inc eax
dec eax
push eax
pop eax
lea ebx, [ebx + 0x792]
sub ebx, 0x792
jl 0xce1032
popf
jbe 0xce1036
nop
jbe 0xce1039
jge 0xce103c
jmp 0x50d655cb
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xce130e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00cdab4e
add esp, 0xc
jge 0xce1329
jnp 0xce132b
jb 0xce1341
pushf
test esp, 0x5358
jl 0xce1337
xor ecx, edi
xor ecx, edi
popf
nop
jae 0xce1341
mov esi, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
ror eax, 0x12
ror eax, 0xe
jo 0xce1391
and edx, 0xffffffff
jnp 0xce13a7
pushf
stc
and ecx, 0xffffffff
popf
je 0xce13a0
jno 0xce13a2
jmp 0xce13a4
jp 0xce13a7
xor eax, 0x80e44d8a
jmp 0xe51b9bb1
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.00cf4e1d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xce1458
xor eax, eax
jmp 0xce1511
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00ce304d
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00cdab4e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0xce150f
ror esi, 0x1f
rol esi, 0x1f
shl esp, 0
lea edi, [edi + 0x542e]
sub edi, 0x542e
call fcn.00ce149c
xor eax, eax
Function at 0xce35d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00cdab4e
add esp, 0xc
push 0x21
push 0xcced54
lea ecx, [ebp - 0x138]
push ecx
call fcn.00cedd0a
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0xce36d8
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.00cdab4e
add esp, 0xc
push 0xb
push 0xcced78
lea edx, [ebp - 0x138]
push edx
call fcn.00cedd0a
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0xce36cb
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00cedd0a
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0xce36da
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xce45e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00cdab4e
add esp, 0xc
jmp 0xce45fd
ror edi, 0
jp 0xce4602
jne 0xce4613
pushf
lea esi, [esi]
popf
mov eax, eax
jp 0xce460e
je 0xce4610
je 0xce4613
xor eax, 0x48e045c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
call fcn.00ce4664