joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e5a1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00464e6e
add esp, 0xc
xchg ecx, edi
xchg ecx, edi
ror esp, 0
rol esp, 0
jl 0x45e5d5
pushf
sub esp, 0
cmp edi, dword [esp]
popf
jp 0x45e5d2
jge 0x45e5d5
mov eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
jno 0x45e60f
jae 0x45e618
jo 0x45e613
jno 0x45e615
jb 0x45e618
mov esi, 0x80f44d8a
jmp 0xf4936e22
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
xchg ebx, ebx
xchg esp, esp
neg ecx
neg ecx
js 0x45e69f
pushf
add eax, 0
popf
jno 0x45e69c
jns 0x45e69f
mov eax, 0xbcdae8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.0046a37e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45e6b2
jmp 0x45e751
jb 0x45e6b4
shr esp, 0
xor ebx, dword [esp]
xor ebx, dword [esp]
lea ecx, [ecx + 0x62ff]
lea ecx, [ecx - 0x62ff]
jbe 0x45e6dd
pushf
cmp ebx, 0x4f4f
rol edx, 0
popf
jno 0x45e6da
ja 0x45e6dd
mov eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046b05f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00464e6e
add esp, 0xc
jae 0x45e6ff
cmp esi, dword [esp + 0xc]
jp 0x45e71d
pushf
add esi, 0
shr esp, 0
xchg ecx, esi
xchg ecx, esi
add esp, 0
popf
ja 0x45e718
xchg edi, eax
xchg edi, eax
jnp 0x45e71d
mov edi, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x45e725
jmp 0x45e751
push edx
pop edx
jns 0x45e729
js 0x45e733
lea esi, [esi]
jns 0x45e72f
jns 0x45e733
mov ebp, 0xfc558b4c
mov edx, dword [ebp - 4]
push edx
call fcn.0046394c
add esp, 4
js 0x45e741
je 0x45e74a
lea ecx, [ecx]
ja 0x45e747
jne 0x45e74a
jmp 0x504e2cd9
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45f377
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e6e
add esp, 0xc
je 0x45f392
std
cld
xchg esp, esp
jnp 0x45f3be
pushf
jmp 0x45f39c
lea esi, [esi + 0x1bcc]
sub esi, 0x1bcc
xor ecx, 0x63ff
xor ecx, 0x63ff
popf
lea eax, [eax]
lea esp, [esp]
jp 0x45f3be
mov ebp, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
test edi, 0x1b26
jg 0x45f3fe
nop
jle 0x45f3f9
jle 0x45f3fe
ljmp 0x80ec:0x4d8a0fb5
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0046a37e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45f470
xor eax, eax
jmp 0x45f4ee
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0046b05f
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x45f4ec
xchg ecx, ecx
call fcn.0045f49d
xor eax, eax
Function at 0x4603c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00464e6e
add esp, 0xc
and esp, 0xffffffff
js 0x460402
pushf
ror esp, 0
jb 0x4603ec
lea edi, [edi]
popf
popfd
ja 0x4603f2
nop
lea eax, [eax + 0x7287]
lea eax, [eax - 0x7287]
jns 0x460402
xor eax, 0x48e045c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
jmp 0x460450
shr ebx, 0
xor esp, 0
js 0x46046b
lea ecx, [ecx + 0x7608]
lea ecx, [ecx - 0x7608]
mov edx, edx
jns 0x46046b
add eax, 0x4d8ae9b1
loopne 0x4603ef
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
or edi, 0
not esi
not esi
sub esp, 0
jl 0x46051f
jmp 0xe0938c75
jne 0x460515
jns 0x460517
jmp 0x460519
jnp 0x46051b
jge 0x46051f
xor eax, 0x9e5ae8c7
add byte [eax], al
call fcn.0046a37e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x460534
xor eax, eax
jmp 0x4607f3
not ebx
not ebx
jae 0x460552
pushf
call fcn.00460541
Function at 0x460ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00464e6e
add esp, 0xc
add ebx, dword [esp]
sub ebx, dword [esp]
add esp, 0
jo 0x460f17
lea edi, [edi]
xchg ecx, ecx
je 0x460f11
xchg esp, esp
jno 0x460f17
mov ecx, 0xf045c675
dec esi
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
ror esp, 0
or esp, 0
jbe 0x460f5a
pushf
jg 0x460f53
popf
jl 0x460f57
ja 0x460f5a
mov esi, 0x80f04d8a
jmp 0xf0939764
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
ror esi, 0
jb 0x460fbf
cmp eax, dword [esp]
jle 0x460fd8
pushf
push edi
pop edi
call fcn.00460fcd
Function at 0x46243a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00464e6e
add esp, 0xc
cmc
jbe 0x46245f
jns 0x462458
xchg edi, edx
xchg edi, edx
ja 0x46245f
add eax, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x4c
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x42
mov byte [ebp - 0xf], 0
neg ecx
neg ecx
lea ebx, [ebx + 0x5bb]
lea ebx, [ebx - 0x5bb]
lea esi, [esi]
add ebx, 0x3697
sub ebx, 0x3697
jbe 0x4624c2
xchg esp, esp
jle 0x4624bb
jge 0x4624bd
xchg ebx, eax
xchg ebx, eax
ja 0x4624c2
mov edx, 0x80e44d8a
jmp 0xe493accc
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x1a]
sub cl, 1
mov byte [ebp - 0x1a], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
or edi, 0
or esi, esi
jg 0x46254c
pushf
neg edi
neg edi
ror edx, 0
popf
jg 0x462547
jns 0x462549
jle 0x46254c
mov edi, 0xffc024e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 0xa], dh
call 0x45e575
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x462564
mov eax, 1
jmp 0x46279e
nop
xor esi, 0
cmp ecx, dword [esp]
test ebx, 0x11d6
jno 0x46257a
jbe 0x462575
js 0x462577
jo 0x46257a
lcall 0x458b, 0x52e4558d
clc
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046b05f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4625aa
mov eax, 1
jmp 0x46279e
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
mov edx, edx
jo 0x4625cf
pushf
and esi, 0xffffffff
push edx
add edx, 0x540c
ror edx, 0xb
pop edx
popf
xchg esp, esp
xchg esp, esp
jno 0x4625cf
mov ecx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0046394c
add esp, 4
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00464e6e
add esp, 0xc
xor edi, 0
rol edi, 0
jb 0x46260e
pushf
dec edx
inc edx
call fcn.004625fc
Function at 0x46591c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00464e6e
add esp, 0xc
je 0x465937
xor edi, dword [esp]
xor edi, dword [esp]
xor ecx, 0x7745
xor ecx, 0x7745
cmc
jge 0x465951
mov edx, edx
jl 0x465951
mov ebx, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
jne 0x465983
jge 0x465994
jle 0x465987
lea ebx, [ebx]
xchg ebx, esi
xchg ebx, esi
lea esp, [esp]
jl 0x465994
mov ebx, 0xf04d8aa1
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
push ebx
add ebx, 0x6da
ror ebx, 0x1f
pop ebx
clc
jo 0x465a02
cmp edx, 0x2abc
je 0x465a15
je 0x465a0c
nop
xchg ecx, edx
xchg ecx, edx
jne 0x465a15
mov ebp, 0x4964e8e6
add byte [eax], al
call fcn.0046a37e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x465a27
xor eax, eax
jmp 0x465a6d
stc
cmp ebx, dword [esp + 0xc]
ror esi, 0
jg 0x465a4a
pushf
cmp edx, dword [esp + 4]
jo 0x465a39
popf
lea ebx, [ebx + 0x34c4]
lea ebx, [ebx - 0x34c4]
jle 0x465a4a
mov edx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046b05f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00464e6e
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x465a74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00464e6e
add esp, 0xc
jp 0x465a8f
xchg ecx, eax
xchg ecx, eax
lea ebx, [ebx]
jo 0x465a95
jae 0x465aa1
jle 0x465a99
lea eax, [eax]
ja 0x465a9d
jb 0x465aa1
mov esi, 0xf045c60c
dec eax
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
Function at 0x465bb3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00464e6e
add esp, 0xc
push 0x21
push 0x456d08
lea ecx, [ebp - 0x138]
push ecx
call fcn.00469167
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x465cbb
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.00464e6e
add esp, 0xc
push 0xb
push 0x456d2c
lea edx, [ebp - 0x138]
push edx
call fcn.00469167
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x465cae
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00469167
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x465cbd
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x469d09
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e6e
add esp, 0xc
ja 0x469d24
ja 0x469d2b
js 0x469d28
jbe 0x469d2b
mov edx, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
not esi
not esi
cmp esi, dword [esp]
jno 0x469d77
pushf
test dword [esp + 8], edx
test ecx, 0x35b8
popf
jp 0x469d74
jo 0x469d77
mov ebp, 0x80ec4d8a
jmp 0xec942581
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
ror esp, 0
js 0x469ddc
call 0x469de1
lea esp, [esp + 4]
jge 0x469df1
xchg edx, edi
xchg edx, edi
jg 0x469ded
jl 0x469df1
jmp 0x5cf86d3
call fcn.0046a37e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x469e06
xor eax, eax
jmp 0x469e9f
xor edi, dword [esp + 0xc]
xor edi, dword [esp + 0xc]
xor ecx, 0
jns 0x469e19
lea esp, [esp]
js 0x469e19
sub eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0046b05f
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x469e88
cmp ebx, edi
xor ecx, 0
jno 0x469e5b
lea ebx, [ebx + 0x1bbd]
lea ebx, [ebx - 0x1bbd]
jge 0x469e54
mov esi, esi
jp 0x469e58
jo 0x469e5b
mov ebx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0046394c
add esp, 4
cld
ror edx, 0
nop
jg 0x469e7f
pushf
add esp, 0
je 0x469e75
popf
nop
jb 0x469e7a
jo 0x469e7c
jle 0x469e7f
mov eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x469e9f
jl 0x469e8a
cmp esp, 0x757f
je 0x469e9d
xchg edx, edi
xchg edx, edi
jbe 0x469e98
js 0x469e9a
jne 0x469e9d
mov esp, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46aeb3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00464e6e
add esp, 0xc
add eax, 0
add ecx, 0x1452
sub ecx, 0x1452
add esp, 0
ror esp, 0
jbe 0x46aef5
pushf
xor esp, 0
nop
jle 0x46aeeb
add esi, 0
popf
jb 0x46aef2
ja 0x46aef5
lcall 0x45c6, 0x48e845c6
jns 0x46aec4
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
inc ebp
cmc
inc edx
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
push ebx
add ebx, 0x5813
ror ebx, 8
pop ebx
mov edi, edi
test dword [esp + 8], ebx
jne 0x46af50
jne 0x46af46
js 0x46af48
mov eax, eax
nop
je 0x46af50
xor eax, 0x4d8a019d
call 0x884898d7
dec ebp
call 0x813a04e7
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0045e7b0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46afdc
xor eax, eax
jmp 0x46b056
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046b05f
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x46b054
xor esp, 0
je 0x46b01f
pushf
test esp, 0x4c25
cmp edi, dword [esp + 0x10]
and esp, 0xffffffff
popf
xchg edx, ecx
xchg edx, ecx
jne 0x46b01f
add eax, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.0046394c
add esp, 4
test esp, 0x5ae4
nop
jle 0x46b043
pushf
js 0x46b038
popf
jp 0x46b03c
jb 0x46b03e
jl 0x46b040
jg 0x46b043
ljmp 0x558b:0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x46b056
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46b53f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x46b553
jmp 0x46b6fb
test dword [esp], eax
shl eax, 0
mov esp, esp
jns 0x46b55d
js 0x46b56c
pushf
xchg esp, esp
js 0x46b565
popf
je 0x46b569
jns 0x46b56c
mov edx, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x45696c], edx
stc
jg 0x46b596
pushf
shl esp, 0
ror esi, 0x19
ror esi, 7
jne 0x46b58d
clc
popf
nop
jne 0x46b593
jle 0x46b596
add eax, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x456974
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x456974], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x456970], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x4561b0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x4561b4], ecx
add esp, 0
jp 0x46b5da
pushf
xor edx, 0
popf
jp 0x46b5d3
jp 0x46b5d5
jnp 0x46b5d7
jnp 0x46b5da
add eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
call 0x46b613
add esp, 4
lea esp, [esp]
and eax, 0xffffffff
jb 0x46b634
lea esp, [esp]
jnp 0x46b623
jg 0x46b625
lea ecx, [ecx + 0x2733]
lea ecx, [ecx - 0x2733]
jae 0x46b634
mov esp, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
js 0x46b69e
inc ebx
dec ebx
cmp ebx, 0x6970
test esp, 0x329
je 0x46b6b5
jo 0x46b6b0
jns 0x46b6b2
jne 0x46b6b5
sub eax, 0x69703d83
inc ebp
add byte [eax], al
cmp dword [0x456970], 0
je 0x46b6d2
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x456970]
push eax
call fcn.0046b05f
mov dword [0x456968], eax
xor esp, 0
rol ebx, 0x19
ror ebx, 0x19
cmp esi, ecx
jle 0x46b6eb
jne 0x46b6e1
xchg edi, eax
xchg edi, eax
xchg esi, ebx
xchg esi, ebx
jg 0x46b6eb
lcall 0x8d00, 0x6a0d6af4
dec ebp
invalid
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00464e6e
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4