joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0a90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4b0af6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4b0af6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4b0ad7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4b39e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x8b11b4]
xor edx, edx
cmp eax, edx
jne 0x4b3a06
xor eax, eax
mov byte [eax + 0x8b10b4], al
inc eax
cmp eax, 0x100
jl 0x4b39ee
mov dword [0x8b11b4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x8b10b4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4b3a97
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4b3a6a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4b3a38
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4b3b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4b3b63
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4b3b4a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ba520
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53788e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004bae40
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x841364
call fcn.005284d9
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4ba5b3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005284d9
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4ba5ac
push 0
mov ecx, eax
call fcn.004b1620
mov dword [esi + 0xc], eax
jmp 0x4ba5b5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4ba5b5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4c7d40
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4c7d73
push esi
call fcn.004ccbe0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4c7d6c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4c7df9
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4c7de2
mov eax, dword [esi + 8]
test eax, eax
je 0x4c7d97
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4c7dde
cmp eax, 2
je 0x4c7de2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4c7d8a
cmp eax, 3
je 0x4c7dbd
cmp eax, 1
jne 0x4c7d8a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4c7d8a
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4c7d8a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004c7e30
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4c7e19
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004c7e30
add esp, 4
pop esi
ret
Function at 0x4f8620
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4f862b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4f872e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x842ad0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x842ad0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x842ad0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x842ad0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x842ad0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x842ad0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x842ad0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x842ad0]
xor eax, edx
inc ecx
dec edi
jne 0x4f8646
pop edi
test esi, esi
je 0x4f8750
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x842ad0]
xor eax, edx
inc ecx
dec esi
jne 0x4f8732
pop esi
pop ebx
not eax
ret

Function at 0x52ab69
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x52aba1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00528bf3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00528bcb
jmp 0x52abad
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x52c257
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x52c299
call fcn.00531dd0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x52c299
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x52c290
xor eax, eax
jmp 0x52c2a1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0052c2a7
pop edi
pop esi
pop ebx
ret 4
Function at 0x532300
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x53232e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53234c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00532266
jmp 0x53234c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x53234c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00532266
test edi, edi
mov eax, edi
jne 0x532336
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x2004433e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2004f9af
add esp, 0xc
xchg ecx, ecx
lea esi, [esi]
cld
xor edx, dword [esp]
xor edx, dword [esp]
ja 0x20044379
lea ebx, [ebx]
xchg edx, edx
lea ecx, [ecx]
lea edi, [edi + 0x641a]
lea edi, [edi - 0x641a]
jbe 0x20044379
xor eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
test dword [esp + 4], edi
jne 0x200443af
rol esp, 0
jg 0x200443b4
jge 0x200443d0
pushf
lea ecx, [ecx + 0x14a3]
lea ecx, [ecx - 0x14a3]
shr esp, 0
popf
jg 0x200443cb
jp 0x200443cd
jl 0x200443d0
sub eax, 0x80ec4d8a
jmp 0xc51cbda
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.2005b8d3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20044442
xor eax, eax
jmp 0x200444ae
sub edi, 0
test dword [esp + 8], eax
jnp 0x20044455
xchg esp, esp
xchg ecx, edi
xchg ecx, edi
jp 0x20044455
mov esp, 0xec458df5
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.2004d43e
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2004f9af
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x2004447f
xor eax, eax
jmp 0x200444ae
jle 0x20044481
sub ebx, 0
je 0x2004448b
xchg esi, eax
xchg esi, eax
jne 0x2004448b
mov edx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.2006a497
add esp, 4
jbe 0x20044499
shl edi, 0
jbe 0x200444a7
jmp 0x200444a0
jnp 0x200444a2
ja 0x200444a7
mov edi, 0x4d8b674b
or byte [ecx - 1], dl
push ebp
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x200444b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2004f9af
add esp, 0xc
shr esp, 0
stc
lea ebx, [ebx]
jae 0x200444e6
pushf
sub ecx, 0
cmc
cmp eax, edi
popf
nop
jb 0x200444e6
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
lea esi, [esi + 0x3875]
sub esi, 0x3875
jge 0x2004453e
pushf
stc
popf
lea esi, [esi]
lea ecx, [ecx + 0x5490]
lea ecx, [ecx - 0x5490]
jl 0x2004453e
mov edx, 0x80e84d8a
jmp 0x851cd48
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
sub esp, 0
jns 0x200445b3
lea edi, [edi]
xchg ecx, ecx
js 0x200445b3
mov ecx, 0x731be847
add dword [eax], eax
call fcn.2005b8d3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x200445c8
xor eax, eax
jmp 0x20044656
shr ebx, 0
jl 0x200445dc
pushf
or esi, esi
popf
jae 0x200445d5
lea esp, [esp]
nop
jge 0x200445dc
sub eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.2004d43e
mov dword [ebp - 4], eax
shr esp, 0
jne 0x200445f1
jg 0x20044610
pushf
call fcn.200445fa
Function at 0x200449b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.2004f9af
add esp, 0xc
lea edi, [edi + 0x29c8]
lea edi, [edi - 0x29c8]
and edi, 0xffffffff
lea esp, [esp]
sub eax, 0
jns 0x20044a00
pushf
add eax, 0x48c1
sub eax, 0x48c1
xor esp, 0
popf
nop
jl 0x200449fb
jg 0x200449fd
js 0x20044a00
add eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
jno 0x20044a32
cmp esi, 0x6cf6
js 0x20044a42
jg 0x20044a3c
jge 0x20044a3e
nop
jns 0x20044a42
call 0xa0f897d0
jmp 0x1451d24c
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
cmp esp, 0x2778
xchg edi, edi
and edx, 0xffffffff
add esp, 0
jno 0x20044ac1
xchg ebx, ecx
xchg ebx, ecx
jp 0x20044ab8
xchg ecx, edi
xchg ecx, edi
jb 0x20044abe
jo 0x20044ac1
mov ecx, 0x26b75e8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x2006b63b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x20044ad9
mov eax, 1
jmp 0x20044b9b
push eax
pop eax
cmp esp, 0x4831
sub esp, 0
jg 0x20044aec
mov esp, esp
jle 0x20044aec
lcall 0x8b50, 0xf4458d15
dec ebp
invalid
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.2004d43e
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.2004f9af
add esp, 0xc
std
cld
add esi, 0x7a3a
sub esi, 0x7a3a
ror edi, 0
jo 0x20044b1f
je 0x20044b37
pushf
xchg edi, ebx
xchg edi, ebx
test esp, 0x7e42
nop
popf
mov edx, edx
ja 0x20044b34
jne 0x20044b37
add dword [ebx + 0x7500ec7d], 0x1b807
add byte [eax], al
cmp dword [ebp - 0x14], 0
jne 0x20044b44
mov eax, 1
jmp 0x20044b9b
shr esp, 0
rol esp, 0
test esp, 0x796d
rol ecx, 0xf
ror ecx, 0xf
jae 0x20044b6e
pushf
lea edi, [edi]
rol ebx, 0x10
ror ebx, 0x10
jl 0x20044b64
mov esi, esi
popf
nop
jge 0x20044b6b
jb 0x20044b6e
lcall 0x20e8, 0x50ec458b
pop ecx
add al, byte [eax]
mov eax, dword [ebp - 0x14]
push eax
call fcn.2006a497
add esp, 4
jb 0x20044b7c
jg 0x20044b94
pushf
clc
popf
jg 0x20044b85
lea esi, [esi + 0x5f59]
lea esi, [esi - 0x5f59]
jle 0x20044b94
sub eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20044ba4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x20040084], 1
jne 0x20044d15
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.2004f9af
add esp, 0xc
xchg esi, edx
xchg esi, edx
jbe 0x20044bd0
rol ebx, 0x1a
ror ebx, 0x1a
add edx, dword [esp]
sub edx, dword [esp]
jae 0x20044bef
pushf
test esp, 0x578e
and esp, 0xffffffff
popf
nop
jb 0x20044bef
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
neg ebx
neg ebx
rol esp, 0
cmp esp, 0x4e43
xchg edi, edi
ja 0x20044c49
pushf
jg 0x20044c34
popf
jle 0x20044c38
lea edi, [edi + 0x6741]
lea edi, [edi - 0x6741]
jns 0x20044c46
jbe 0x20044c49
mov edi, 0x80e84d8a
jmp 0x851d453
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.2005b8d3
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x20044cbe
xor eax, eax
jmp 0x20044d63
js 0x20044cc0
not eax
not eax
rol ecx, 0xc
ror ecx, 0xc
jno 0x20044ccc
jns 0x20044cd6
lea ebx, [ebx]
lea edx, [edx]
js 0x20044cd6
mov eax, 0xe8458da6
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.2004d43e
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.2004f9af
add esp, 0xc
clc
jno 0x20044cff
jne 0x20044cfb
jo 0x20044cff
call 0x1881d05a
add byte [edx + ecx - 0x75], dh
inc ebp
clc
cmp dword [ebp - 8], 0
je 0x20044d0f
mov eax, dword [ebp - 8]
mov dword [0x20040084], eax
jmp 0x20044d13
xor eax, eax
jmp 0x20044d63
jmp 0x20044d1e
mov ecx, dword [0x20040084]
mov dword [ebp - 8], ecx
jae 0x20044d20
jge 0x20044d30
mov edi, edi
xchg esi, ebx
xchg esi, ebx
lea esp, [esp]
jl 0x20044d2d
jl 0x20044d30
mov esp, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
rol esp, 0
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
and ecx, ecx
jns 0x20044d4c
js 0x20044d47
jl 0x20044d49
js 0x20044d4c
mov esp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.2006a497
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x20044d6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.2004f9af
add esp, 0xc
push 0x21
push 0x20041480
lea ecx, [ebp - 0x138]
push ecx
call fcn.200476a2
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x20044e74
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.2004f9af
add esp, 0xc
push 0xb
push 0x200414a4
lea edx, [ebp - 0x138]
push edx
call fcn.200476a2
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x20044e67
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.200476a2
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x20044e76
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x20046ed6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.2004f9af
add esp, 0xc
jne 0x20046ef1
rol esi, 0x1d
ror esi, 0x1d
jne 0x20046f01
jl 0x20046efb
jno 0x20046efd
je 0x20046f01
mov ebx, 0xec45c617
push eax
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
cmp esi, ecx
dec ebx
inc ebx
mov eax, eax
jae 0x20046f4a
pushf
cmp esp, 0xf3b
popf
je 0x20046f45
jl 0x20046f47
jb 0x20046f4a
add eax, 0x80ec4d8a
jmp 0xc51f754
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.2005b8d3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20046fbf
xor eax, eax
jmp 0x20047049
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.2004d43e
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.2004f9af
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x20047047
je 0x20046fe7
rol ecx, 0xd
ror ecx, 0xd
jp 0x2004700e
pushf
test esp, 0x6a10
jo 0x20046ff9
popf
jl 0x20046ffd
lea ecx, [ecx + 0x50eb]
lea ecx, [ecx - 0x50eb]
jne 0x2004700b
jnp 0x2004700e
mov eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.2006a497
add esp, 4
lea ecx, [ecx + 0x6059]
lea ecx, [ecx - 0x6059]
jns 0x20047028
jnp 0x20047036
xchg ebx, ebx
lea edx, [edx]
jge 0x20047030
jae 0x20047032
jp 0x20047036
mov esp, 0x104d8bfe
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x20047049
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc