joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d755d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004d41c9
add esp, 0xc
push edi
pop edi
jb 0x4d757a
jns 0x4d758c
pushf
xchg edi, esi
xchg edi, esi
and ecx, 0xffffffff
popf
jg 0x4d7589
js 0x4d758c
add eax, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
xor esp, 0
jle 0x4d75c9
jge 0x4d75de
pushf
lea eax, [eax]
je 0x4d75d1
jl 0x4d75d3
popf
jl 0x4d75d7
mov eax, eax
jp 0x4d75db
jl 0x4d75de
mov ebp, 0x80ec4d8a
jmp 0xec9afde8
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.004d29fc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d7661
xor eax, eax
jmp 0x4d76cd
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004ebc60
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.004d41c9
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4d76cb
xchg edx, edx
nop
jp 0x4d769b
pushf
jge 0x4d7690
popf
jns 0x4d7694
jb 0x4d7696
xchg esp, esp
jnp 0x4d769b
mov edx, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.004e9301
add esp, 4
push esi
pop esi
cmp esi, dword [esp]
jbe 0x4d76ba
pushf
and ebx, 0xffffffff
popf
lea ebx, [ebx]
ja 0x4d76ba
mov edi, 0x5010458b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x4d76cd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d828e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d41c9
add esp, 0xc
xchg ecx, ecx
or esi, esi
ja 0x4d82c5
pushf
lea ebx, [ebx + 0x2c48]
lea ebx, [ebx - 0x2c48]
sub esp, 0
popf
jno 0x4d82c2
jbe 0x4d82c5
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
lea eax, [eax + 0x1f1]
lea eax, [eax - 0x1f1]
xor ebx, edx
xor ebx, edx
jnp 0x4d8311
jge 0x4d830d
jp 0x4d8311
mov ebp, 0xe84d8a42
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
ror edx, 0xb
rol edx, 0xb
neg eax
neg eax
shl eax, 0
je 0x4d839f
pushf
jnp 0x4d838c
cmp eax, 0x7079
cmp edi, esi
neg eax
neg eax
popf
lea esp, [esp]
jne 0x4d839f
call 0x169a8b
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.004d4cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d83b4
xor eax, eax
jmp 0x4d846d
test ecx, 0x17cc
add esp, 0
jns 0x4d83cd
pushf
add edi, 0
popf
jbe 0x4d83c8
jbe 0x4d83ca
js 0x4d83cd
call 0x5235d15e
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004ebc60
mov dword [ebp - 4], eax
xor ebx, dword [esp + 4]
xor ebx, dword [esp + 4]
or ecx, ecx
test esi, eax
call 0x4d83ee
lea esp, [esp + 4]
jns 0x4d83fc
jne 0x4d83f6
jae 0x4d83f8
js 0x4d83fc
mov edi, 0x6a0d6a0a
add byte [ebp - 0x17af17bb], cl
sar byte [ebp - 0x3b7c0001], 0xc
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d41c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4d8416
xor eax, eax
jmp 0x4d846d
rol ebx, 0x19
ror ebx, 0x19
ror edx, 4
rol edx, 4
xor esi, 0
add edi, 0
je 0x4d8441
pushf
jmp 0x4d842e
lea esi, [esi + 0x1235]
lea esi, [esi - 0x1235]
popf
mov edx, edx
jne 0x4d8441
mov ebx, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.004e9301
add esp, 4
nop
xor edi, eax
xor edi, eax
jg 0x4d8454
je 0x4d846a
lea ecx, [ecx + 0x55cd]
lea ecx, [ecx - 0x55cd]
jo 0x4d8464
jbe 0x4d8466
jne 0x4d846a
lcall 0x5e5f, 0xfc55ff59
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d884f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004d41c9
add esp, 0xc
lea esp, [esp]
ror ebx, 0x1f
rol ebx, 0x1f
jbe 0x4d8881
jl 0x4d8875
nop
jge 0x4d8878
xchg edi, edx
xchg edi, edx
ja 0x4d8881
xor eax, 0x45c61b18
in al, 0x52
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
jae 0x4d88cf
test dword [esp], edx
xchg ecx, ecx
jne 0x4d88e9
pushf
lea edx, [edx]
call fcn.004d88df
Function at 0x4dae0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004d41c9
add esp, 0xc
cld
cmp esp, 0x54dc
jo 0x4dae3b
pushf
jns 0x4dae30
popf
jno 0x4dae34
xchg esp, esp
jne 0x4dae38
jno 0x4dae3b
mov ebp, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
jmp 0x4dae85
xchg ecx, ebx
xchg ecx, ebx
je 0x4dae8b
test dword [esp], edi
jno 0x4dae98
lea ecx, [ecx]
jo 0x4dae94
jo 0x4dae98
adc esi, 0x80e44d8a
jmp 0xe49b36a2
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.004d4cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4daf46
xor eax, eax
jmp 0x4dafbd
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004ebc60
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004d41c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4dafbb
and edx, edx
jnp 0x4daf87
lea esp, [esp]
jmp 0x4daf75
jns 0x4daf77
lea ebx, [ebx + 0x2988]
lea ebx, [ebx - 0x2988]
jp 0x4daf87
ljmp 0xe851:0xfc4d8b16
mov ecx, dword [ebp - 4]
push ecx
call fcn.004e9301
add esp, 4
jle 0x4daf95
std
cld
xchg esp, esp
jb 0x4dafa2
xchg ecx, eax
xchg ecx, eax
jbe 0x4daf9f
jae 0x4dafa2
mov ebp, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4dafbd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4dd2a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004d41c9
add esp, 0xc
jnp 0x4dd2c2
jo 0x4dd2e3
pushf
xor edx, dword [esp]
xor edx, dword [esp]
jge 0x4dd2ce
popf
mov edx, edx
lea ecx, [ecx + 0x87b]
lea ecx, [ecx - 0x87b]
lea esi, [esi]
jno 0x4dd2e3
mov esp, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
jg 0x4dd315
add esp, 0
jno 0x4dd32e
pushf
or edx, 0
jbe 0x4dd321
jno 0x4dd323
jp 0x4dd325
popf
mov esp, esp
jne 0x4dd32b
jo 0x4dd32e
sub eax, 0x80ec4d8a
jmp 0xec9b5b38
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004d4cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4dd3a3
xor eax, eax
jmp 0x4dd42d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004ebc60
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004d41c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4dd42b
jo 0x4dd3cb
nop
nop
jp 0x4dd3cf
jb 0x4dd3f7
pushf
lea ebx, [ebx + 0x4b55]
sub ebx, 0x4b55
or ecx, 0
jnp 0x4dd3e4
lea edi, [edi + 0x5d62]
sub edi, 0x5d62
popf
jle 0x4dd3f4
jae 0x4dd3f7
mov ecx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004e9301
add esp, 4
cmp edi, dword [esp + 4]
std
cld
je 0x4dd41a
pushf
shr esi, 0
ror ebx, 0
popf
jae 0x4dd417
jne 0x4dd41a
mov eax, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4dd42d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4dd850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d41c9
add esp, 0xc
test dword [esp], edx
xchg esp, esp
ror eax, 0x1d
ror eax, 3
shl eax, 0
jp 0x4dd8a3
pushf
jl 0x4dd87d
lea ecx, [ecx + 0x42c1]
lea ecx, [ecx - 0x42c1]
lea eax, [eax + 0x6a0e]
lea eax, [eax - 0x6a0e]
jge 0x4dd897
popf
lea esp, [esp]
jae 0x4dd89e
je 0x4dd8a0
jnp 0x4dd8a3
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x55
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0
and edx, edx
jno 0x4dd8e7
je 0x4dd8dd
mov ebx, ebx
xchg ebx, ebx
xchg esp, esp
jo 0x4dd8e7
mov edx, 0xe84d8a28
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
call fcn.004d4cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4dd962
jmp 0x4dd9e7
lea edi, [edi]
xor edi, dword [esp]
xor edi, dword [esp]
mov esp, esp
jns 0x4dd979
nop
jmp 0x4dd971
jge 0x4dd973
xchg esi, esi
js 0x4dd979
lcall 0x8b51, 0xe84d8da2
push ebp
clc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004ebc60
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d41c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4dd9e7
lea edx, [edx]
or esp, 0
jle 0x4dd9be
pushf
xchg esp, esp
test dword [esp], edi
neg ecx
neg ecx
test edx, 0x141c
popf
jnp 0x4dd9bb
jg 0x4dd9be
mov edi, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.004e9301
add esp, 4
xor ecx, esi
xor ecx, esi
std
cld
cld
dec edi
inc edi
jg 0x4dd9e0
pushf
std
cld
popf
jl 0x4dd9dd
jle 0x4dd9e0
mov esi, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e4352
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.004d41c9
add esp, 0xc
push 0x21
push 0x4c8e18
lea ecx, [ebp - 0x138]
push ecx
call fcn.004ec080
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4e445a
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.004d41c9
add esp, 0xc
push 0xb
push 0x4c8e3c
lea edx, [ebp - 0x138]
push edx
call fcn.004ec080
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4e444d
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ec080
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4e445c
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4e893a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4c8b40], 1
jne 0x4e8a65
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d41c9
add esp, 0xc
xor esp, 0
jl 0x4e896d
jns 0x4e8967
mov ebx, ebx
jge 0x4e896d
mov ebp, 0xe845c6a6
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
cld
or edx, edx
jl 0x4e89b3
pushf
je 0x4e89a2
xor edi, dword [esp + 0x10]
xor edi, dword [esp + 0x10]
lea esi, [esi]
popf
jp 0x4e89b0
jge 0x4e89b3
or dword [edx - 0x167f17b3], 0xe84d8801
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.004d4cba
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4e8a20
mov eax, dword [ebp + 8]
jmp 0x4e8adc
jp 0x4e8a22
xchg esp, esp
jnp 0x4e8a2d
mov esp, esp
jp 0x4e8a2a
jp 0x4e8a2d
mov edi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004ebc60
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004d41c9
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x4e8a5e
mov edx, dword [ebp - 8]
mov dword [0x4c8b40], edx
jmp 0x4e8a63
mov eax, dword [ebp + 8]
jmp 0x4e8adc
jmp 0x4e8a6d
mov eax, dword [0x4c8b40]
mov dword [ebp - 8], eax
nop
rol ebx, 3
rol ebx, 0x1d
xor edi, 0
test edx, 0x32d4
jl 0x4e8a8b
xchg ecx, eax
xchg ecx, eax
jns 0x4e8a83
jno 0x4e8a85
jge 0x4e8a87
jge 0x4e8a8b
mov esi, 0xf84d8b7a
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp ecx, esi
xchg esp, esp
ja 0x4e8aa4
pushf
jg 0x4e8a9b
popf
xchg edi, edi
xchg ecx, ecx
jbe 0x4e8aa4
mov edx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004e9301
add esp, 4
test esp, 0x157b
jo 0x4e8ad5
pushf
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
cmc
call 0x4e8ac8
add esp, 4
popf
nop
jbe 0x4e8ad0
ja 0x4e8ad2
jno 0x4e8ad5
mov ebx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e9606
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d41c9
add esp, 0xc
jae 0x4e9628
lea esi, [esi + 0x69db]
lea esi, [esi - 0x69db]
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
jg 0x4e964d
pushf
jnp 0x4e9642
stc
popf
ja 0x4e9647
nop
jle 0x4e964a
jle 0x4e964d
sub eax, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
ror edx, 0x1e
rol edx, 0x1e
jge 0x4e9709
jne 0x4e9700
nop
jae 0x4e9703
jp 0x4e9705
jl 0x4e9709
mov esi, 0xb5ace80e
invalid
call fcn.004d4cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4e971e
xor eax, eax
jmp 0x4e97a9
inc ebx
dec ebx
jg 0x4e9722
mov edx, edx
test esp, 0x1ab3
je 0x4e9736
jmp 0x4e972e
xchg edi, eax
xchg edi, eax
lea esp, [esp]
jne 0x4e9736
call 0x5336ecc7
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004ebc60
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004d41c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4e9760
xor eax, eax
jmp 0x4e97a9
lea esi, [esi + 0x4511]
lea esi, [esi - 0x4511]
xor esi, ecx
xor esi, ecx
ja 0x4e9777
xchg ecx, ecx
jbe 0x4e9777
ljmp 0x81e8:0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004e9301
add esp, 4
call 0x4e9788
lea esp, [esp + 4]
mov eax, eax
jle 0x4e9790
je 0x4e979e
je 0x4e9794
jmp 0x4e9796
jg 0x4e9798
ja 0x4e979a
jne 0x4e979e
add eax, 0xc458b6e
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f252b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004d41c9
add esp, 0xc
jmp 0x4f2546
cld
jge 0x4f2554
pushf
jge 0x4f254d
popf
xchg ecx, ecx
jl 0x4f2554
mov ecx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jl 0x4f2586
stc
or edx, 0
cmc
jns 0x4f259d
pushf
jle 0x4f2591
test dword [esp], edx
popf
xchg esi, edx
xchg esi, edx
js 0x4f259d
mov esp, 0x80ec4d8a
jmp 0xec9cada7
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004d4cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4f260f
xor eax, eax
jmp 0x4f2689
rol esp, 0
shl esp, 0
shr edx, 0
cmp edi, 0x5798
je 0x4f2625
xchg esi, esi
jne 0x4f2625
mov ebp, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004ebc60
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004d41c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4f264f
xor eax, eax
jmp 0x4f2689
mov esp, esp
je 0x4f2660
pushf
jb 0x4f2657
popf
jns 0x4f265b
jbe 0x4f265d
jne 0x4f2660
mov edi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004e9301
add esp, 4
jae 0x4f266e
xor ebx, 0x7bb
xor ebx, 0x7bb
js 0x4f2682
nop
xchg esp, esp
jns 0x4f2682
call 0x51577411
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4