joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429777
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x42e1eb
call fcn.00410968
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004250ea
mov eax, dword [0x43b988]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x441120
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.00429617
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.004215d8
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.0040e4c7
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00421588
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.0042149b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x120a2db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.012101c9
add esp, 0xc
stc
jle 0x120a2f7
call fcn.0120a2fc

Function at 0x120b399
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.012101c9
add esp, 0xc
add ecx, 0x5fb2
sub ecx, 0x5fb2
lea edi, [edi]
xchg edx, edx
jo 0x120b3ca
jno 0x120b3c6
jno 0x120b3ca
sub eax, 0xf045c629
dec eax
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
ror eax, 0
jl 0x120b403
js 0x120b3f9
xchg esi, esi
jmp 0x120b3fd
jne 0x120b3ff
jge 0x120b403
mov ebx, 0xf04d8a05
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.0120e9fc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x120b463
xor eax, eax
jmp 0x120b4c7
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.01227c60
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x120b4c5
test edx, eax
jo 0x120b498
xchg edi, edx
xchg edi, edx
jmp 0x120b493
nop
jno 0x120b498
mov esp, 0xec4d8b98
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.01225301
add esp, 4
je 0x120b4a6
inc eax
dec eax
not ebx
not ebx
jl 0x120b4b8
js 0x120b4b0
ja 0x120b4b2
jp 0x120b4b4
jge 0x120b4b8
mov esp, 0xc558b5c
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x120b4c7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1211381
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x1204868
call fcn.012316d2
add esp, 0xc
mov byte [0x1204868], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x1212b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x1204b3c], 1
jne 0x1212c99
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.012101c9
add esp, 0xc
clc
test edi, esi
jge 0x1212b6d
pushf
jno 0x1212b5f
jo 0x1212b61
sub esp, 0
je 0x1212b66
popf
jle 0x1212b6a
jl 0x1212b6d
mov edi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
jo 0x1212b9f
jp 0x1212ba1
rol eax, 0x15
ror eax, 0x15
lea ecx, [ecx + 0xd40]
sub ecx, 0xd40
jp 0x1212bbd
jne 0x1212bb7
xchg esp, esp
jnp 0x1212bbd
add eax, 0xe84d8ad5
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.01210cba
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1212c32
xor eax, eax
jmp 0x1212d02
test esp, 0x2afd
inc edi
dec edi
je 0x1212c49
pushf
jae 0x1212c40
popf
jbe 0x1212c44
jno 0x1212c46
jne 0x1212c49
mov ebp, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.01227c60
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.012101c9
add esp, 0xc
add edx, 0x7b22
sub edx, 0x7b22
jbe 0x1212c77
je 0x1212c83
lea edi, [edi]
lea edi, [edi]
jns 0x1212c7f
jne 0x1212c83
jmp 0xf99eb066
cmp dword [ebp - 8], 0
je 0x1212c93
mov eax, dword [ebp - 8]
mov dword [0x1204b3c], eax
jmp 0x1212c97
xor eax, eax
jmp 0x1212d02
jmp 0x1212ca2
mov ecx, dword [0x1204b3c]
mov dword [ebp - 8], ecx
rol edi, 0x16
rol edi, 0xa
jp 0x1212caa
test ebx, 0x3872
jle 0x1212cce
pushf
test dword [esp], ebx
cmp esp, 0x598a
jmp 0x1212cbf
jb 0x1212cc1
popf
xchg edx, edi
xchg edx, edi
jo 0x1212cc9
jno 0x1212ccb
jg 0x1212cce
lcall 0xfc55, 0x89f8558b
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
test dword [esp + 0xc], edi
ror esi, 0xc
rol esi, 0xc
jb 0x1212ceb
jnp 0x1212ce2
nop
jnp 0x1212ce5
jg 0x1212ce7
jae 0x1212ceb
mov esp, 0xfc458bb8
mov eax, dword [ebp - 4]
push eax
call fcn.01225301
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x121355d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.012101c9
add esp, 0xc
push edi
pop edi
jb 0x121357a
jns 0x121358c
pushf
xchg edi, esi
xchg edi, esi
and ecx, 0xffffffff
popf
jg 0x1213589
js 0x121358c
add eax, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
xor esp, 0
jle 0x12135c9
jge 0x12135de
pushf
lea eax, [eax]
je 0x12135d1
jl 0x12135d3
popf
jl 0x12135d7
mov eax, eax
jp 0x12135db
jl 0x12135de
mov ebp, 0x80ec4d8a
jmp 0xed6ebde8
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.0120e9fc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1213661
xor eax, eax
jmp 0x12136cd
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.01227c60
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x12136cb
xchg edx, edx
nop
jp 0x121369b
pushf
jge 0x1213690
popf
jns 0x1213694
jb 0x1213696
xchg esp, esp
jnp 0x121369b
mov edx, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.01225301
add esp, 4
push esi
pop esi
cmp esi, dword [esp]
jbe 0x12136ba
pushf
and ebx, 0xffffffff
popf
lea ebx, [ebx]
ja 0x12136ba
mov edi, 0x5010458b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x12136cd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x121428e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.012101c9
add esp, 0xc
xchg ecx, ecx
or esi, esi
ja 0x12142c5
pushf
lea ebx, [ebx + 0x2c48]
lea ebx, [ebx - 0x2c48]
sub esp, 0
popf
jno 0x12142c2
jbe 0x12142c5
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
lea eax, [eax + 0x1f1]
lea eax, [eax - 0x1f1]
xor ebx, edx
xor ebx, edx
jnp 0x1214311
jge 0x121430d
jp 0x1214311
mov ebp, 0xe84d8a42
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
ror edx, 0xb
rol edx, 0xb
neg eax
neg eax
shl eax, 0
je 0x121439f
pushf
jnp 0x121438c
cmp eax, 0x7079
cmp edi, esi
neg eax
neg eax
popf
lea esp, [esp]
jne 0x121439f
call fcn.00ea5a8b
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.01210cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x12143b4
xor eax, eax
jmp 0x121446d
test ecx, 0x17cc
add esp, 0
jns 0x12143cd
pushf
add edi, 0
popf
jbe 0x12143c8
jbe 0x12143ca
js 0x12143cd
call 0x5309915e
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.01227c60
mov dword [ebp - 4], eax
xor ebx, dword [esp + 4]
xor ebx, dword [esp + 4]
or ecx, ecx
test esi, eax
call 0x12143ee
lea esp, [esp + 4]
jns 0x12143fc
jne 0x12143f6
jae 0x12143f8
js 0x12143fc
mov edi, 0x6a0d6a0a
add byte [ebp - 0x17af17bb], cl
sar byte [ebp - 0x3b7c0001], 0xc
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1214416
xor eax, eax
jmp 0x121446d
rol ebx, 0x19
ror ebx, 0x19
ror edx, 4
rol edx, 4
xor esi, 0
add edi, 0
je 0x1214441
pushf
jmp 0x121442e
lea esi, [esi + 0x1235]
lea esi, [esi - 0x1235]
popf
mov edx, edx
jne 0x1214441
mov ebx, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.01225301
add esp, 4
nop
xor edi, eax
xor edi, eax
jg 0x1214454
je 0x121446a
lea ecx, [ecx + 0x55cd]
lea ecx, [ecx - 0x55cd]
jo 0x1214464
jbe 0x1214466
jne 0x121446a
lcall 0x5e5f, 0xfc55ff59
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x121484f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.012101c9
add esp, 0xc
lea esp, [esp]
ror ebx, 0x1f
rol ebx, 0x1f
jbe 0x1214881
jl 0x1214875
nop
jge 0x1214878
xchg edi, edx
xchg edi, edx
ja 0x1214881
xor eax, 0x45c61b18
in al, 0x52
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
jae 0x12148cf
test dword [esp], edx
xchg ecx, ecx
jne 0x12148e9
pushf
lea edx, [edx]
call fcn.012148df
Function at 0x1216e0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.012101c9
add esp, 0xc
cld
cmp esp, 0x54dc
jo 0x1216e3b
pushf
jns 0x1216e30
popf
jno 0x1216e34
xchg esp, esp
jne 0x1216e38
jno 0x1216e3b
mov ebp, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
jmp 0x1216e85
xchg ecx, ebx
xchg ecx, ebx
je 0x1216e8b
test dword [esp], edi
jno 0x1216e98
lea ecx, [ecx]
jo 0x1216e94
jo 0x1216e98
adc esi, 0x80e44d8a
jmp 0xe56ef6a2
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.01210cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1216f46
xor eax, eax
jmp 0x1216fbd
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.01227c60
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1216fbb
and edx, edx
jnp 0x1216f87
lea esp, [esp]
jmp 0x1216f75
jns 0x1216f77
lea ebx, [ebx + 0x2988]
lea ebx, [ebx - 0x2988]
jp 0x1216f87
ljmp 0xe851:0xfc4d8b16
mov ecx, dword [ebp - 4]
push ecx
call fcn.01225301
add esp, 4
jle 0x1216f95
std
cld
xchg esp, esp
jb 0x1216fa2
xchg ecx, eax
xchg ecx, eax
jbe 0x1216f9f
jae 0x1216fa2
mov ebp, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x1216fbd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x12192a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.012101c9
add esp, 0xc
jnp 0x12192c2
jo 0x12192e3
pushf
xor edx, dword [esp]
xor edx, dword [esp]
jge 0x12192ce
popf
mov edx, edx
lea ecx, [ecx + 0x87b]
lea ecx, [ecx - 0x87b]
lea esi, [esi]
jno 0x12192e3
mov esp, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
jg 0x1219315
add esp, 0
jno 0x121932e
pushf
or edx, 0
jbe 0x1219321
jno 0x1219323
jp 0x1219325
popf
mov esp, esp
jne 0x121932b
jo 0x121932e
sub eax, 0x80ec4d8a
jmp 0xed6f1b38
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.01210cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x12193a3
xor eax, eax
jmp 0x121942d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.01227c60
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x121942b
jo 0x12193cb
nop
nop
jp 0x12193cf
jb 0x12193f7
pushf
lea ebx, [ebx + 0x4b55]
sub ebx, 0x4b55
or ecx, 0
jnp 0x12193e4
lea edi, [edi + 0x5d62]
sub edi, 0x5d62
popf
jle 0x12193f4
jae 0x12193f7
mov ecx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.01225301
add esp, 4
cmp edi, dword [esp + 4]
std
cld
je 0x121941a
pushf
shr esi, 0
ror ebx, 0
popf
jae 0x1219417
jne 0x121941a
mov eax, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x121942d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1219850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.012101c9
add esp, 0xc
test dword [esp], edx
xchg esp, esp
ror eax, 0x1d
ror eax, 3
shl eax, 0
jp 0x12198a3
pushf
jl 0x121987d
lea ecx, [ecx + 0x42c1]
lea ecx, [ecx - 0x42c1]
lea eax, [eax + 0x6a0e]
lea eax, [eax - 0x6a0e]
jge 0x1219897
popf
lea esp, [esp]
jae 0x121989e
je 0x12198a0
jnp 0x12198a3
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x55
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0
and edx, edx
jno 0x12198e7
je 0x12198dd
mov ebx, ebx
xchg ebx, ebx
xchg esp, esp
jo 0x12198e7
mov edx, 0xe84d8a28
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
call fcn.01210cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1219962
jmp 0x12199e7
lea edi, [edi]
xor edi, dword [esp]
xor edi, dword [esp]
mov esp, esp
jns 0x1219979
nop
jmp 0x1219971
jge 0x1219973
xchg esi, esi
js 0x1219979
lcall 0x8b51, 0xe84d8da2
push ebp
clc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.01227c60
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x12199e7
lea edx, [edx]
or esp, 0
jle 0x12199be
pushf
xchg esp, esp
test dword [esp], edi
neg ecx
neg ecx
test edx, 0x141c
popf
jnp 0x12199bb
jg 0x12199be
mov edi, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.01225301
add esp, 4
xor ecx, esi
xor ecx, esi
std
cld
cld
dec edi
inc edi
jg 0x12199e0
pushf
std
cld
popf
jl 0x12199dd
jle 0x12199e0
mov esi, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1220352
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.012101c9
add esp, 0xc
push 0x21
push 0x1204e18
lea ecx, [ebp - 0x138]
push ecx
call fcn.01228080
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x122045a
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.012101c9
add esp, 0xc
push 0xb
push 0x1204e3c
lea edx, [ebp - 0x138]
push edx
call fcn.01228080
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x122044d
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.01228080
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x122045c
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret