joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489a00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b45d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x6319d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0046d4f0
test eax, eax
je 0x489aa5
push 0
push str.PROGBAR_DATA::Close_n
push 0x6b08d0
call fcn.00599ee3
mov eax, dword [str.ENTRY:]
mov ecx, dword [0x5ccf7c]
mov dword [0x6b07d0], eax
mov eax, 0x6b08d0
mov dword [0x6b07d4], ecx
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x489a61
mov edi, 0x6b07d0
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x489a72
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d500
push 0x6b07d0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
push str.SoftwareCnxtProgBar
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.00403380
mov dword [ebp - 4], edi
mov esi, 0xf003f
mov dword [ebp - 0x18], 0x6e
call fcn.0049cb90
test eax, eax
je 0x489ad1
mov esi, 0xf013f
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
push esi
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x489b14
mov edx, dword [ebp - 0x10]
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push eax
push str.ProgBarCnt
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x489b0a
lea edi, [eax + 1]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0046d4f0
test eax, eax
je 0x489b94
push edi
push str.PROGBAR_DATA::Close_:_bStatus___d_n
push 0x6b06d0
call fcn.00599ee3
mov ecx, dword [str.EXIT:]
mov edx, dword [0x5ccefc]
mov eax, 0x6b06d0
mov dword [0x6b05d0], ecx
add esp, 0xc
mov dword [0x6b05d4], edx
mov ecx, eax
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x489b50
mov edi, 0x6b05d0
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x489b61
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x6b05d0
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d510
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x489bba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49cbe0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x9c
xor esi, esi
lea eax, [ebp - 0xa0]
push esi
push eax
call fcn.00599fb0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [ebp - 0xa0]
push ecx
mov dword [ebp - 0xa0], 0x9c
call edi
test eax, eax
jne 0x49cc50
lea edx, [ebp - 0xa0]
push edx
mov dword [ebp - 0xa0], 0x94
call edi
test eax, eax
jne 0x49cc50
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x90], 2
jne 0x49cc67
cmp dword [ebp - 0x9c], 6
jb 0x49cc67
mov esi, 1
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00599ed4
mov esp, ebp
pop ebp
ret

Function at 0x49d1e0
Capabilities:
Check internet connectivity via wininet
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0046d4f0
test eax, eax
je 0x49d265
push 0
push str.GetNetworkConnectStatus_n
push 0x6c52e0
call fcn.00599ee3
mov eax, dword [str.ENTRY:]
mov ecx, dword [0x5ccf7c]
mov dword [0x6c51e0], eax
mov eax, 0x6c52e0
mov dword [0x6c51e4], ecx
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x49d221
mov edi, 0x6c51e0
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x49d232
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d500
push 0x6c51e0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
push 0
lea edx, [ebp - 4]
push edx
mov ebx, 1
mov dword [ebp - 4], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x49d298
push str.www.conexant.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 2
add ebx, 2
call fcn.0046d4f0
test eax, eax
je 0x49d313
push ebx
push str.GetNetworkConnectStatus_:_dwRetVal___d_n
push 0x6c50e0
call fcn.00599ee3
mov eax, dword [str.EXIT:]
mov ecx, dword [0x5ccefc]
mov dword [0x6c4fe0], eax
mov eax, 0x6c50e0
add esp, 0xc
mov dword [0x6c4fe4], ecx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49d2d1
mov edi, 0x6c4fe0
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x49d2e0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x6c4fe0
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d510
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d320
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5be55b
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x9c
xor esi, esi
lea eax, [ebp - 0xac]
push esi
push eax
call fcn.00599fb0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [ebp - 0xac]
push ecx
mov dword [ebp - 0xac], 0x9c
call edi
mov ebx, eax
test ebx, ebx
jne 0x49d39f
lea edx, [ebp - 0xac]
push edx
mov dword [ebp - 0xac], 0x94
call edi
test eax, eax
je 0x49d4ee
mov eax, dword [ebp - 0x9c]
sub eax, 2
jne 0x49d440
call fcn.0049cb90
mov ecx, dword [ebp - 0xa8]
cmp ecx, 5
jne 0x49d3f9
mov ecx, dword [ebp - 0xa4]
test ecx, ecx
jne 0x49d3cd
lea esi, [ecx + 1]
jmp 0x49d440
cmp ecx, 1
jne 0x49d3d7
lea esi, [ecx + 1]
jmp 0x49d440
cmp ecx, 2
jne 0x49d440
test eax, eax
je 0x49d3f2
lea esi, [ecx + 3]
test ebx, ebx
je 0x49d440
cmp byte [ebp - 0x12], 1
jne 0x49d440
lea esi, [ecx + 1]
jmp 0x49d440
mov esi, 4
jmp 0x49d440
cmp ecx, 6
jne 0x49d434
mov ecx, dword [ebp - 0xa4]
test ecx, ecx
jne 0x49d412
test eax, eax
setne cl
lea esi, [ecx + 6]
jmp 0x49d440
cmp ecx, 1
jne 0x49d423
xor edx, edx
test eax, eax
setne dl
lea esi, [edx + 8]
jmp 0x49d440
cmp ecx, 2
jb 0x49d440
xor ecx, ecx
test eax, eax
setne cl
lea esi, [ecx + 0xa]
jmp 0x49d440
jbe 0x49d440
xor edx, edx
test eax, eax
setne dl
lea esi, [edx + 0xa]
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x49d45a
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 4], 0
test ebx, ebx
je 0x49d4a6
movzx ecx, word [ebp - 0x14]
movzx edx, byte [ebp - 0x12]
push ecx
mov ecx, dword [ebp - 0xa8]
push edx
push eax
push ecx
push esi
lea edx, [ebp - 0xb0]
push str.RetVal_d__dwMajorVersion_d__dwMinorVersion_d__wProductType_d__wSuiteMask_d
push edx
call fcn.00408cb0
add esp, 0x1c
jmp 0x49d4c3
mov ecx, dword [ebp - 0xa8]
push eax
push ecx
push esi
lea edx, [ebp - 0xb0]
push str.RetVal_d__dwMajorVersion_d__dwMinorVersion_d
push edx
call fcn.00408cb0
add esp, 0x14
mov eax, dword [ebp - 0xb0]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x49d4ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret
Function at 0x49e3e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call fcn.0046d4f0
test eax, eax
je 0x49e466
push 0
push str.SendExitMsgToApp_n
push 0x6c64e0
call fcn.00599ee3
mov eax, dword [str.ENTRY:]
mov ecx, dword [0x5ccf7c]
mov dword [0x6c63e0], eax
mov eax, 0x6c64e0
mov dword [0x6c63e4], ecx
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x49e422
mov edi, 0x6c63e0
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x49e433
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d500
push 0x6c63e0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d4f0
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test eax, eax
je 0x49e49c
mov edx, dword [esi]
push edi
push edx
push str.csAppName___s__uExitMsg___d_n
push 0x6c62e0
call fcn.00599ee3
add esp, 0x10
push 0x6c62e0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
lea eax, [ebp - 8]
push eax
push esi
call fcn.0049e100
add esp, 8
test eax, eax
je 0x49e516
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x10]
push edx
push 0x49cd80
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x2ee
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov dword [ebp - 8], esp
mov edi, esp
push eax
call fcn.004022e0
add eax, 0x10
add esp, 4
lea ecx, [ebp - 1]
mov dword [edi], eax
call fcn.0042e880
test eax, eax
je 0x49e516
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov dword [ebp - 8], esp
mov edi, esp
push eax
call fcn.004022e0
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.0049dba0
add esp, 4
call fcn.0046d4f0
test eax, eax
je 0x49e594
push 0
push str.SendExitMsgToApp_n
push 0x6c61e0
call fcn.00599ee3
mov eax, dword [str.EXIT:]
mov ecx, dword [0x5ccefc]
mov dword [0x6c60e0], eax
mov eax, 0x6c61e0
mov dword [0x6c60e4], ecx
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x49e550
mov edi, 0x6c60e0
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x49e561
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x6c60e0
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d510
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49e7c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5be730
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6319d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea ecx, [ebp + 8]
call fcn.00403380
mov edx, dword [ebp + 8]
mov eax, dword [edx - 0xc]
mov dword [ebp - 4], 0
test eax, eax
js 0x49e869
push 0x5cd28c
push edx
call fcn.0059a963
add esp, 8
test eax, eax
je 0x49e866
mov edx, dword [ebp + 8]
sub eax, edx
cmp eax, 0xffffffff
je 0x49e869
inc eax
push eax
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 8]
call fcn.004024f0
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00402af0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x49e866
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp + 8]
mov eax, edx
sub esi, edx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x49e870
lea eax, [edx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x49e89d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a1be0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x4a1bfc
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4a1d07
jmp 0x4a1c10
mov eax, ebx
cmp ebx, 0x15b0
jb 0x4a1c1f
mov eax, 0x15b0
sub ebx, eax
mov dword [ebp + 0x10], ebx
cmp eax, 0x10
jl 0x4a1ccc
mov edx, eax
shr edx, 4
mov ebx, edx
neg ebx
shl ebx, 4
add eax, ebx
jmp 0x4a1c40
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
dec edx
jne 0x4a1c40
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x4a1cdb
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
dec eax
jne 0x4a1cd0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
jne 0x4a1c10
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
pop ebp
ret
Function at 0x4a2330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esi + 0x24]
push edi
mov eax, dword [esi + 0x64]
mov edi, dword [esi + 0x34]
mov ecx, dword [esi + 0x6c]
sub edi, eax
sub edi, ecx
jne 0x4a2350
test eax, eax
jne 0x4a235c
test ecx, ecx
jne 0x4a235c
mov edi, ebx
jmp 0x4a23c9
cmp edi, 0xffffffff
jne 0x4a235c
mov edi, 0xfffffffe
jmp 0x4a23c9
mov ecx, dword [esi + 0x24]
lea edx, [ebx + ecx - 0x106]
cmp eax, edx
jb 0x4a23c9
mov eax, dword [esi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0059b910
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], ebx
sub dword [esi + 0x64], ebx
add esp, 0xc
sub dword [esi + 0x54], ebx
lea ecx, [eax + edx*2]
lea ecx, [ecx]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x4a239f
sub eax, ebx
jmp 0x4a23a1
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x4a2390
mov ecx, dword [esi + 0x38]
mov edx, ebx
lea ecx, [ecx + ebx*2]
nop
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x4a23bf
sub eax, ebx
jmp 0x4a23c1
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x4a23b0
add edi, ebx
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x4a2423
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x64]
mov ecx, edi
add edx, dword [esi + 0x30]
mov edi, eax
push edx
call fcn.004a20e0
add dword [esi + 0x6c], eax
mov edx, dword [esi + 0x6c]
add esp, 4
cmp edx, 3
jb 0x4a240f
mov edi, dword [esi + 0x64]
add edi, dword [esi + 0x30]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edi]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edi + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edx, 0x106
jae 0x4a2423
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x4a2335
pop edi
pop ebx
ret
Function at 0x4b1a53
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004b1174
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004b11bf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004b1174
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov eax, esi
test dword [ecx], esp
cld
invalid
jmp dword [esi - 0x3dd7a3a]
invalid
dec dword [edi - 0x3dc7a3a]
invalid
inc dword [eax - 0x3db7a3a]
invalid
dec dword [edx - 0x3da7a3a]
invalid
inc dword [edx - 0x3d97a3a]
invalid
dec dword [ebx - 0x3d87a3a]
test dword [edi], esp
cld
invalid
jmp [edi - 0x3d77a3a]
invalid
invalid
out dx, al
lea eax, [ebp - 0x3ec]
push eax
call fcn.004b11bf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004b1174
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004b11af
out 0x65, al
loope 0x4b1ba2
movsd dword es:[edi], dword [esi]
int3
Function at 0x4b1a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004b1174
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004b11bf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004b1174
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov eax, esi
test dword [ecx], esp
cld
invalid
jmp dword [esi - 0x3dd7a3a]
invalid
dec dword [edi - 0x3dc7a3a]
invalid
inc dword [eax - 0x3db7a3a]
invalid
dec dword [edx - 0x3da7a3a]
invalid
inc dword [edx - 0x3d97a3a]
invalid
dec dword [ebx - 0x3d87a3a]
test dword [edi], esp
cld
invalid
jmp [edi - 0x3d77a3a]
invalid
invalid
out dx, al
lea eax, [ebp - 0x3ec]
push eax
call fcn.004b11bf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004b1174
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004b11af
out 0x65, al
loope 0x4b1ba2
movsd dword es:[edi], dword [esi]
int3
Function at 0x4b20bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004b118d
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.004b11bf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004b1174
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004b11af
dec esp
scasb al, byte es:[edi]
rol dword [ebp + 0x10468], 0
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.004b11af
or esi, dword [ecx - 0x2a]
xchg ebx, eax
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.004b11bf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004b1174
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x4b225b
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x4b227b
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x4b2298
invalid

Function at 0x4b2645
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ecx
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
dec ecx
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.004b11af
xor edi, esi
invalid
push esi
test dword [ebp - 0x72b7b], 0x17e850ff
jmp 0x4b26a6
invalid