joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476206
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046a31d
add esp, 0xc
je 0x476221
jmp 0x476223
add edx, dword [esp]
sub edx, dword [esp]
jge 0x476233
nop
jge 0x47622e
jp 0x476230
jl 0x476233
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
and edi, edi
shl esp, 0
ja 0x476287
jb 0x476278
lea eax, [eax + 0x130]
lea eax, [eax - 0x130]
jbe 0x476287
jmp 0x812fb015
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00463b8f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x476313
xor eax, eax
jmp 0x47638e
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046eef7
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x47638c
clc
xor eax, dword [esp]
xor eax, dword [esp]
lea ecx, [ecx]
jo 0x476344
jbe 0x47635a
pushf
jp 0x47634a
jge 0x47634c
test dword [esp], edx
popf
js 0x476353
mov eax, eax
jmp 0x476357
ja 0x47635a
xor eax, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.004710d5
add esp, 4
cld
cmp ebx, dword [esp + 8]
jns 0x47637b
mov edx, edx
lea esp, [esp]
je 0x476374
ja 0x476376
js 0x47637b
mov edi, 0x4d8b3d8a
adc byte [ecx - 0x75], dl
push ebp
or al, 0x52
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x47638e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x479de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0046a31d
add esp, 0xc
or edi, 0
push edx
add edx, 0x7083
ror edx, 0xf
pop edx
xor ebx, 0x27a1
xor ebx, 0x27a1
not esi
not esi
jp 0x479e2d
pushf
jp 0x479e24
xchg edi, eax
xchg edi, eax
popf
jle 0x479e2a
jnp 0x479e2d
mov eax, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
push ebx
add ebx, 0x4ad3
ror ebx, 0x11
pop ebx
jg 0x479e7d
pushf
ror ebx, 0x17
ror ebx, 9
popf
js 0x479e76
xchg esi, eax
xchg esi, eax
mov edi, edi
jle 0x479e7d
jmp 0x8137ec0b
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
or esp, 0
jne 0x479ee2
jae 0x479f04
pushf
ror eax, 9
rol eax, 9
cmp eax, dword [esp]
jle 0x479ef1
rol edi, 0x1d
rol edi, 3
popf
jmp 0x479efb
jns 0x479efd
xchg esi, edx
xchg esi, edx
jb 0x479f04
mov esi, 0xfe9c86e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.00463b8f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x479f16
xor eax, eax
jmp 0x479f53
xor ebx, dword [esp + 8]
xor ebx, dword [esp + 8]
push eax
pop eax
jae 0x479f22
jae 0x479f24
ja 0x479f30
jmp 0x479f28
xchg ecx, ecx
jns 0x479f2c
jbe 0x479f30
mov ebx, 0xf0458dcb
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046eef7
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0046a31d
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b761
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046a31d
add esp, 0xc
lea esi, [esi + 0x4931]
sub esi, 0x4931
ja 0x47b78f
jb 0x47b7c0
pushf
mov ecx, ecx
xor ebx, 0x6e6d
xor ebx, 0x6e6d
lea edx, [edx + 0x5c36]
lea edx, [edx - 0x5c36]
popf
lea edi, [edi + 0x7725]
lea edi, [edi - 0x7725]
mov esp, esp
jae 0x47b7c0
mov ebp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
shr ebx, 0
je 0x47b892
pushf
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
inc ebx
dec ebx
shr esp, 0
popf
jbe 0x47b881
lea edx, [edx + 0x670b]
lea edx, [edx - 0x670b]
jno 0x47b88f
jne 0x47b892
lcall 0x89ff, 0xff0ea4e8
inc ebp
clc
call fcn.0046c73b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47b8a4
xor eax, eax
jmp 0x47b919
jb 0x47b8a6
nop
jne 0x47b8af
xchg esp, esp
je 0x47b8af
add eax, 0xe8558de1
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046eef7
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x47b8d9
xor eax, eax
jmp 0x47b919
or esp, 0
ja 0x47b8de
jle 0x47b8f1
pushf
jno 0x47b8e4
or ecx, ecx
popf
lea esp, [esp]
lea edi, [edi]
nop
jg 0x47b8f1
call 0x53440e80
mov edx, dword [ebp - 4]
push edx
call fcn.004710d5
add esp, 4
xchg edi, edx
xchg edi, edx
shl esi, 0
jb 0x47b90e
ja 0x47b908
jmp 0x47b90a
jae 0x47b90e
mov esi, 0xc458b3f
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47c403
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046a31d
add esp, 0xc
jnp 0x47c41e
jg 0x47c43d
pushf
cmp ebx, dword [esp + 0xc]
popf
xchg esi, esi
xchg esi, ebx
xchg esi, ebx
lea ebx, [ebx + 0x3325]
lea ebx, [ebx - 0x3325]
jle 0x47c43d
mov ecx, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
add ecx, 0x2906
sub ecx, 0x2906
jae 0x47c487
or eax, eax
sub esp, 0
jno 0x47c49b
pushf
jnp 0x47c492
popf
jae 0x47c496
xchg ecx, ecx
jo 0x47c49b
call 0x81341229
jmp 0xec954ca5
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0046c73b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47c525
jmp 0x47c588
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046eef7
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x47c588
or esp, 0
je 0x47c559
xchg edx, edi
xchg edx, edi
jne 0x47c556
jne 0x47c559
lcall 0x73e8, 0x50e8458b
dec ebx
invalid
mov eax, dword [ebp - 0x18]
push eax
call fcn.004710d5
add esp, 4
xchg esp, esp
ror ecx, 7
rol ecx, 7
jg 0x47c575
lea ecx, [ecx]
jle 0x47c575
xor eax, 0x144d8b61
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47df84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046a31d
add esp, 0xc
lea eax, [eax + 0x113b]
lea eax, [eax - 0x113b]
test eax, esi
rol ebx, 7
rol ebx, 0x19
dec edx
inc edx
jne 0x47dfcb
lea eax, [eax + 0xfd]
lea eax, [eax - 0xfd]
je 0x47dfcb
mov ebx, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0046c73b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47e093
xor eax, eax
jmp 0x47e0ff
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046eef7
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x47e0bd
xor eax, eax
jmp 0x47e0ff
mov esp, esp
jae 0x47e0c1
jbe 0x47e0cf
jo 0x47e0c5
mov edx, edx
jp 0x47e0c9
jg 0x47e0cb
ja 0x47e0cf
mov ecx, 0xe8458b70
mov eax, dword [ebp - 0x18]
push eax
call fcn.004710d5
add esp, 4
ror esp, 0
test esp, 0x34a0
shl eax, 0
jo 0x47e0f4
pushf
jbe 0x47e0ed
popf
jno 0x47e0f1
jno 0x47e0f4
mov ebp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48037d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x480391
jmp 0x48054e
add esi, dword [esp]
sub esi, dword [esp]
xchg ecx, ecx
dec esi
inc esi
jbe 0x4803b0
pushf
xchg ecx, ebx
xchg ecx, ebx
ror eax, 0x17
rol eax, 0x17
popf
mov esp, esp
ja 0x4803b0
add eax, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x4548cc], edx
rol ebx, 0
cmp esp, 0x7f4e
jo 0x4803d6
xchg esi, ebx
xchg esi, ebx
xchg esp, esp
jno 0x4803d6
mov ebx, 0xec458bd1
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x45322c], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x453228], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x4548d0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x4548d4], ecx
xor edi, 0
jp 0x48041e
jge 0x48040c
jno 0x48040e
lea edi, [edi + 0x5283]
lea edi, [edi - 0x5283]
jnp 0x48041e
mov edi, 0xf045c65b
dec ebp
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
xchg edx, edx
lea esp, [esp]
jno 0x48046e
nop
lea edx, [edx + 0x971]
lea edx, [edx - 0x971]
ja 0x480468
jle 0x48046a
jo 0x48046e
sub eax, 0xf0558a9c
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
neg esi
neg esi
jno 0x4804dc
lea esi, [esi + 0x7dc6]
lea esi, [esi - 0x7dc6]
jno 0x4804fe
js 0x4804ec
jge 0x4804ee
lea ecx, [ecx + 0x28ec]
lea ecx, [ecx - 0x28ec]
jo 0x4804fe
lcall 0x4532, 0x283d83c3
add byte [eax], al
cmp dword [0x453228], 0
je 0x48051b
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x453228]
push eax
call fcn.0046eef7
mov dword [0x4548c8], eax
lea ebx, [ebx]
nop
or ecx, 0
jl 0x480523
jbe 0x48053e
pushf
cmp eax, dword [esp + 8]
xor esi, dword [esp + 8]
xor esi, dword [esp + 8]
popf
js 0x480537
xchg esi, esi
jg 0x48053b
ja 0x48053e
mov esp, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0046a31d
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x481e0f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046a31d
add esp, 0xc
push edi
pop edi
jae 0x481e2c
dec edi
inc edi
lea eax, [eax]
jl 0x481e47
pushf
or ecx, ecx
cmp esp, 0x6648
popf
jae 0x481e40
xchg ecx, ecx
jae 0x481e44
jge 0x481e47
add eax, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
push esi
pop esi
shr esi, 0
xor eax, dword [esp + 8]
xor eax, dword [esp + 8]
shr esp, 0
jp 0x481e90
jb 0x481e8b
jnp 0x481e90
lcall 0x80ec, 0x4d8a7d97
jmp 0xec95a69a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0046c73b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x481f02
xor eax, eax
jmp 0x481f65
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0046eef7
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x481f63
jle 0x481f2a
jl 0x481f34
lea esp, [esp]
xchg edx, edx
jge 0x481f34
sub eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004710d5
add esp, 4
cmp eax, dword [esp]
nop
je 0x481f52
jl 0x481f48
mov esp, esp
mov edx, edx
je 0x481f4e
jne 0x481f52
sub eax, 0x104d8b19
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x481f65
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4828ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0046a31d
add esp, 0xc
push 0x21
push 0x454e0c
lea ecx, [ebp - 0x138]
push ecx
call fcn.0045df18
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4829f4
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0046a31d
add esp, 0xc
push 0xb
push 0x454e30
lea edx, [ebp - 0x138]
push edx
call fcn.0045df18
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4829e7
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0045df18
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4829f6
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4801b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x10]
cmp eax, 0xca
jne 0x4801e1
push esi
call fcn.00483c80
add esp, 4
mov al, byte [esi + 0x40]
test al, al
je 0x4801da
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x480260
mov eax, dword [esi + 0x18c]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x48024c
mov eax, dword [esi + 8]
test eax, eax
je 0x480205
push esi
call dword [eax]
add esp, 4
push esi
mov eax, dword [esi + 0x18c]
call dword [eax]
add esp, 4
test eax, eax
je 0x480248
cmp eax, 2
je 0x48024c
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4801f8
cmp eax, 3
je 0x48022b
cmp eax, 1
jne 0x4801f8
inc dword [ecx + 4]
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 4]
cmp edx, eax
jl 0x4801f8
mov edx, dword [esi + 0x118]
add edx, eax
mov dword [ecx + 8], edx
jmp 0x4801f8
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00480290
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x480280
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x12
mov edx, dword [esi + 0x10]
mov eax, dword [esi]
mov dword [eax + 0x18], edx
mov eax, dword [esi]
call dword [eax]
add esp, 4
push esi
call fcn.00480290
add esp, 4
pop esi
ret

Function at 0x480290
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push ebp
mov eax, dword [esi + 0x10]
cmp eax, 0xcc
je 0x4802bc
push esi
mov eax, dword [esi + 0x17c]
call dword [eax]
mov dword [esi + 0x78], 0
mov dword [esi + 0x10], 0xcc
add esp, 4
xor ebx, ebx
mov eax, dword [esi + 0x17c]
mov cl, byte [eax + 8]
test cl, cl
je 0x480330
lea edi, [esi + 0x78]
mov ecx, dword [edi]
mov eax, dword [esi + 0x60]
cmp eax, ecx
jbe 0x480313
mov eax, dword [esi + 8]
test eax, eax
je 0x4802f4
push esi
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 8]
mov dword [ecx + 8], eax
mov ebp, dword [esi + 8]
call dword [ebp]
add esp, 4
mov ebp, dword [edi]
push ebx
push edi
mov eax, dword [esi + 0x180]
push ebx
push esi
call dword [eax + 4]
add esp, 0x10
mov eax, dword [edi]
cmp eax, ebp
jne 0x4802ce
xor al, al
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
mov eax, dword [esi + 0x17c]
call dword [eax + 4]
add esp, 4
mov eax, dword [esi + 0x17c]
push esi
call dword [eax]
add esp, 4
mov dword [edi], ebx
jmp 0x4802be
mov al, byte [esi + 0x41]
pop ebp
pop edi
cmp al, 1
sbb eax, eax
add eax, 0xce
mov dword [esi + 0x10], eax
mov al, 1
pop esi
pop ebx
ret