joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a24f2
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push edi
add edi, 0x942
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push edx
or edx, 0x345a
sub edx, 0x116ca
add edx, 0xfc9f
pop edx
push ebx
jmp 0x4a2358
jmp 0x4a2360
or ebx, 0x12318
pop ebx
push eax
and eax, 0x93c7
pop eax
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push esi
push esi
add esp, 4
or esi, 0xcd7d
jmp 0x4a23dd
or esi, 0x3a34
jmp 0x4a23e8
pop esi
push esi
push eax
add esp, 4
sub esi, 0x14382
add esi, 0x5bc4
pop esi
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x4a241e
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x4a2481
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x4a233d
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x4a233d
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x4a246b
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x4a2475
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x4a24ca
push edx
jmp 0x4a2490
pop edx
push ebx
call 0x4a249f
add byte [eax + 0x35], dl
aaa
cmp eax, 0x834e463d
les eax, [ebx + ebx*2]
push edx
call 0x4a24b2
add byte [edi + 0x35], al
dec edx
inc eax
cmp eax, 0x8336354d
les eax, [ecx + eax*4]
retf 0x6acb
push ecx
jmp 0x4a24d2
pop ecx
push eax
call 0x4a24e1
add byte [0x3948363a], dh
dec edx
push eax
add esp, 4
call 0x4a24f2
add byte [eax + eax*2 + 0x3b], cl
inc edx
inc ecx
cmp eax, dword ss:[ecx - 0x7d]
les eax, [ecx + eax*4]
enter 0x40a2, 1
add byte [eax - 0x75], bl
lea ebp, [ebx + edi*8]
invalid
Function at 0x4a3db3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4a3dc4
add byte [ebx + 0x3c], cl
dec edi
inc edi
push eax
aas
xor al, byte [ecx - 0x7d]
les eax, [edx + ebx*2]
push edi
push ebx
add esp, 4
add edi, 0xfe8
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4a3df1
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x4a3e4b
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4a3d19
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x4a3d19
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x4a3e35
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x4a3e3f
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4a3e94
push ebx
sub ebx, 0xaa72
call 0x4a3e69
add byte [esi + ecx*2 + 0x4e], cl
dec edi
dec ecx
cmp dh, byte [edx]
inc esi
add esp, 4
pop ebx
push esi
push ebx
add esp, 4
call 0x4a3e82
add byte [edi], bh
xor al, 0x40
inc edx
xor ecx, dword [edi + 0x41]
cmp dword [esi + 0x45], ecx
add esp, 4
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x4a3efc
push eax
push edx
add esp, 4
xor eax, 0x85d5
sub eax, 0x2e33
sub eax, 0xbb9c
pop eax
push edi
and edi, 0x8247
and edi, 0x15dbf
add edi, 0x87f3
sub edi, 0xa72c
pop edi
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x4a3ef2
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x4a3cbd
mov dword [ebp - 0x710], 0
Function at 0x4a3dc4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4a3dc4
add byte [ebx + 0x3c], cl
dec edi
inc edi
push eax
aas
xor al, byte [ecx - 0x7d]
les eax, [edx + ebx*2]
push edi
push ebx
add esp, 4
add edi, 0xfe8
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4a3df1
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x4a3e4b
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4a3d19
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x4a3d19
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x4a3e35
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x4a3e3f
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4a3e94
push ebx
sub ebx, 0xaa72
call 0x4a3e69
add byte [esi + ecx*2 + 0x4e], cl
dec edi
dec ecx
cmp dh, byte [edx]
inc esi
add esp, 4
pop ebx
push esi
push ebx
add esp, 4
call 0x4a3e82
add byte [edi], bh
xor al, 0x40
inc edx
xor ecx, dword [edi + 0x41]
cmp dword [esi + 0x45], ecx
add esp, 4
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x4a3efc
push eax
push edx
add esp, 4
xor eax, 0x85d5
sub eax, 0x2e33
sub eax, 0xbb9c
pop eax
push edi
and edi, 0x8247
and edi, 0x15dbf
add edi, 0x87f3
sub edi, 0xa72c
pop edi
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x4a3ef2
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x4a3cbd
mov dword [ebp - 0x710], 0
Function at 0x4a3e69
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4a3dc4
add byte [ebx + 0x3c], cl
dec edi
inc edi
push eax
aas
xor al, byte [ecx - 0x7d]
les eax, [edx + ebx*2]
push edi
push ebx
add esp, 4
add edi, 0xfe8
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4a3df1
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x4a3e4b
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4a3d19
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x4a3d19
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x4a3e35
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x4a3e3f
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4a3e94
push ebx
sub ebx, 0xaa72
call 0x4a3e69
add byte [esi + ecx*2 + 0x4e], cl
dec edi
dec ecx
cmp dh, byte [edx]
inc esi
add esp, 4
pop ebx
push esi
push ebx
add esp, 4
call 0x4a3e82
add byte [edi], bh
xor al, 0x40
inc edx
xor ecx, dword [edi + 0x41]
cmp dword [esi + 0x45], ecx
add esp, 4
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x4a3efc
push eax
push edx
add esp, 4
xor eax, 0x85d5
sub eax, 0x2e33
sub eax, 0xbb9c
pop eax
push edi
and edi, 0x8247
and edi, 0x15dbf
add edi, 0x87f3
sub edi, 0xa72c
pop edi
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x4a3ef2
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x4a3cbd
mov dword [ebp - 0x710], 0
Function at 0x4a3e82
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4a3dc4
add byte [ebx + 0x3c], cl
dec edi
inc edi
push eax
aas
xor al, byte [ecx - 0x7d]
les eax, [edx + ebx*2]
push edi
push ebx
add esp, 4
add edi, 0xfe8
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4a3df1
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x4a3e4b
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4a3d19
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x4a3d19
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x4a3e35
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x4a3e3f
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4a3e94
push ebx
sub ebx, 0xaa72
call 0x4a3e69
add byte [esi + ecx*2 + 0x4e], cl
dec edi
dec ecx
cmp dh, byte [edx]
inc esi
add esp, 4
pop ebx
push esi
push ebx
add esp, 4
call 0x4a3e82
add byte [edi], bh
xor al, 0x40
inc edx
xor ecx, dword [edi + 0x41]
cmp dword [esi + 0x45], ecx
add esp, 4
pop esi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x4a3efc
push eax
push edx
add esp, 4
xor eax, 0x85d5
sub eax, 0x2e33
sub eax, 0xbb9c
pop eax
push edi
and edi, 0x8247
and edi, 0x15dbf
add edi, 0x87f3
sub edi, 0xa72c
pop edi
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x4a3ef2
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x4a3cbd
mov dword [ebp - 0x710], 0
Function at 0x4a44e9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edi, 0xfda2
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ebx
xor ebx, 0x77ea
xor ebx, 0xa2ee
xor ebx, 0x10f5a
pop ebx
push edx
push ecx
add esp, 4
add edx, 0xe70b
pop edx
push esi
push ebx
add esp, 4
or esi, 0x6a09
xor esi, 0x1bd7
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
push edi
add esp, 4
jmp 0x4a45b4
jmp 0x4a45bd
pop edi
push edx
or edx, 0x120b
or edx, 0x130df
and edx, 0x2d40
sub edx, 0xa8db
pop edx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4a45f5
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x4a464f
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4a451d
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4a451d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4a4639
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4a4643
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x4a4698
push eax
push edx
add esp, 4
jmp 0x4a4664
pop eax
push edx
push edx
add esp, 4
call 0x4a4677
add byte [ecx], bh
dec ecx
push eax
cmp edi, dword [edi]
dec edx
cmp dword [ebx - 0x1d7efb3c], eax
pop ss
push cs
add byte [eax], al
pop edx
push edi
jmp 0x4a4689
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4a4700
push edx
push ebx
add esp, 4
xor edx, 0x6441
jmp 0x4a46ac
and edx, 0xc167
pop edx
push edx
call 0x4a46c0
add byte [eax + edx*2], bh
inc esi
inc ecx
cmp eax, dword [ebx - 0x1d7efb3c]
push edi
sub byte [eax], al
add byte [edx - 0x75], bl
test dword [ebx + edi*8], edx
invalid
Function at 0x4a4677
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edi, 0xfda2
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ebx
xor ebx, 0x77ea
xor ebx, 0xa2ee
xor ebx, 0x10f5a
pop ebx
push edx
push ecx
add esp, 4
add edx, 0xe70b
pop edx
push esi
push ebx
add esp, 4
or esi, 0x6a09
xor esi, 0x1bd7
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
push edi
add esp, 4
jmp 0x4a45b4
jmp 0x4a45bd
pop edi
push edx
or edx, 0x120b
or edx, 0x130df
and edx, 0x2d40
sub edx, 0xa8db
pop edx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4a45f5
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x4a464f
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4a451d
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4a451d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4a4639
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4a4643
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x4a4698
push eax
push edx
add esp, 4
jmp 0x4a4664
pop eax
push edx
push edx
add esp, 4
call 0x4a4677
add byte [ecx], bh
dec ecx
push eax
cmp edi, dword [edi]
dec edx
cmp dword [ebx - 0x1d7efb3c], eax
pop ss
push cs
add byte [eax], al
pop edx
push edi
jmp 0x4a4689
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4a4700
push edx
push ebx
add esp, 4
xor edx, 0x6441
jmp 0x4a46ac
and edx, 0xc167
pop edx
push edx
call 0x4a46c0
add byte [eax + edx*2], bh
inc esi
inc ecx
cmp eax, dword [ebx - 0x1d7efb3c]
push edi
sub byte [eax], al
add byte [edx - 0x75], bl
test dword [ebx + edi*8], edx
invalid
Function at 0x4a46c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edi, 0xfda2
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ebx
xor ebx, 0x77ea
xor ebx, 0xa2ee
xor ebx, 0x10f5a
pop ebx
push edx
push ecx
add esp, 4
add edx, 0xe70b
pop edx
push esi
push ebx
add esp, 4
or esi, 0x6a09
xor esi, 0x1bd7
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
push edi
add esp, 4
jmp 0x4a45b4
jmp 0x4a45bd
pop edi
push edx
or edx, 0x120b
or edx, 0x130df
and edx, 0x2d40
sub edx, 0xa8db
pop edx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4a45f5
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x4a464f
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4a451d
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4a451d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4a4639
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4a4643
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x4a4698
push eax
push edx
add esp, 4
jmp 0x4a4664
pop eax
push edx
push edx
add esp, 4
call 0x4a4677
add byte [ecx], bh
dec ecx
push eax
cmp edi, dword [edi]
dec edx
cmp dword [ebx - 0x1d7efb3c], eax
pop ss
push cs
add byte [eax], al
pop edx
push edi
jmp 0x4a4689
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4a4700
push edx
push ebx
add esp, 4
xor edx, 0x6441
jmp 0x4a46ac
and edx, 0xc167
pop edx
push edx
call 0x4a46c0
add byte [eax + edx*2], bh
inc esi
inc ecx
cmp eax, dword [ebx - 0x1d7efb3c]
push edi
sub byte [eax], al
add byte [edx - 0x75], bl
test dword [ebx + edi*8], edx
invalid
Function at 0x4c4c40
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c4cde
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4c4ca2
cmp byte [ebx + 0x11], 0
jne 0x4c4ca2
cmp byte [ebx + 0x3c], 0
jne 0x4c4ca2
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4c4cc3
lea edx, [ebp - 4]
mov eax, dword [0x616ab8]
call fcn.0040d0d8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x496174]
call fcn.00427b80
call fcn.004089e0
jmp 0x4c4cc3
lea edx, [ebp - 8]
mov eax, dword [0x616ab8]
call fcn.0040d0d8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x496174]
call fcn.00427b80
call fcn.004089e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4ce5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409338
ret

Function at 0x4c568c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4c56da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004c4ac0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c56f3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c56fc
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004c4ac0
dec esi
jne 0x4c571e
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4c7f40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x61c014
cmp dword [edi], 0
jne 0x4c7fbc
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x61c010]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x6147d4
mov ecx, 2
call fcn.004068a4
mov edx, 0x4c7f18
lea eax, [esi + 5]
call fcn.004c7f38
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004c7f38
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4c7f91
mov dword [0x61c010], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4f1924
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4f1adf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409700
mov eax, dword [ebp - 4]
call fcn.004f1274
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4f1976
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a40c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004f2560
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4f1a55
xor eax, eax
push ebp
push 0x4f1a4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004f1514
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004f1b14
test al, al
je 0x4f1a2c
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00409460
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4f1a2c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00409fe8
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004f1474
test al, al
je 0x4f1a26
mov eax, dword [ebp - 8]
call fcn.00409fe8
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040a050
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004f1924
dec ebx
cmp ebx, 0xffffffff
jne 0x4f19d5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1a55
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004f1514
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
cmp byte [0x61c03c], 0
je 0x4f1a95
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00409fe8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004f1500
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004f1474
mov ebx, eax
jmp 0x4f1abc
mov eax, dword [ebp - 4]
call fcn.00409fe8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004f1500
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004f1474
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1ae6
lea eax, [ebp - 0x3c]
call fcn.004092d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409338
ret
Function at 0x4f243c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004f128c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00409fe8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004f1474
test al, al
jne 0x4f24a4
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6169c8]
mov dl, 1
mov eax, dword [0x4f0058]
call fcn.00427d84
call fcn.004089e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4f24b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00409fe8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.004f1474
test al, al
jne 0x4f2511
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x616d20]
mov dl, 1
mov eax, dword [0x4f0058]
call fcn.00427d84
call fcn.004089e0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004f12bc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8