joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ea09
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x45895c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004587db

Function at 0x45af09
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045ae0e

Function at 0x45fb15
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f7d5
Function at 0xe9610a
Capabilities:
Encode data using xor

Disassembly:
push es
pop ebp
pop ebp
popfd
sub dword [ebp + 0x25c1f52], edx
sub dword [ebp + 0x25c1f52], edx
xchg ebp, eax
push edx
pop ds
pop esp
add dl, byte [edx - 0xa605429]
xchg edx, eax
xlatb
stosd dword es:[edi], eax
lahf
cmc
xor eax, 0xc462721b
jbe 0xe9170a
aam 0xf6
pop eax
and byte [esi - 0x60], 0x79
imul ecx, dword [ecx + 0xf], 0x830daa03
jae 0xe91781
xchg ecx, eax
lds edi, [eax + ebp*4 + 0x6373fd53]
inc ebp
mov eax, 0x157571e9
cmpsd dword [esi], dword es:[edi]
retf 0xafe
invalid
adc al, 0x64
jbe 0xe9170b
mov dl, 0x33
je 0xe91705
scasb al, byte es:[edi]
out dx, eax
xchg ecx, eax
lea edx, [ecx + 0x674f97d4]
lea ecx, [esi - 0x50]
add ebx, dword [ebp + 0xd209645]
dec ebp
xor ecx, dword [esi + 0x71d40076]
leave
dec esi
mov al, 3
popfd
inc ebp
xchg esi, eax
and byte [0x768e334d], cl
add ah, dl
jno 0xe9173e
mov dword [0xdc520531], eax
mov ecx, 0xb06b7710
jl 0xe91752
stc
fcomp dword [edx + 0x1b]
add eax, 0x79114ed6
sub al, 0xb4
jg 0xe91765
xchg edx, eax
pop esp
add al, ah
invalid
push ecx
stc
ror dl, 2
pushfd
pushal
dec dl
pushfd
cmc
neg dl
pushfd
stc
test ch, dh
pushfd
add dl, 0x8d
pushfd
push ebp
push dword [esp + 4]
push word [esp + 0x40]
popf
pushfd
inc esi
pushfd
push dword [esp + 4]
push dword [esp + 0x18]
call fcn.00e99687
imul edx, esp, 0xffffffd4
and eax, 0xdb5912cd
outsd dx, dword [si]
rcr byte [edx - 8], 1
dec eax
fistp word [ebp + 0x3d]
pop si
wait
imul ecx, eax, 0x58
mov dword [ecx - 0x36], esi
bound ecx, qword [edi - 0x3a872f81]
jne 0xe91782
sahf
out dx, eax
xchg edi, eax
mov esp, 0x300ffb4c
sub al, 0xc6
xor ah, byte [esi]
invalid
dec dl
clc
push ecx
cmc
neg dl
call fcn.014c6209
inc esi
rcr byte [ecx], 0x58
setns dl
pushf
pop word [esp + 2]
mov byte [esp], bh
ror dl, cl
ror dl, 5
pushal
mov dl, byte [esi]
push dword [esp]
lea esp, [esp + 0x26]
jg 0xe91798
ror dl, 2
pushfd
jmp 0xe93382
Function at 0x204645db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.20480c68
add esp, 0xc
cmp esp, 0x3fe7
lea eax, [eax]
sub edi, 0
call fcn.20464604

Function at 0x20465979
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.20480c68
add esp, 0xc
mov ecx, ecx
dec edx
inc edx
mov edi, edi
jns 0x204659bb
pushf
jno 0x2046599e
not eax
not eax
ror edx, 0x1f
rol edx, 0x1f
popf
jb 0x204659ac
lea edi, [edi + 0x624]
lea edi, [edi - 0x624]
js 0x204659bb
mov edx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
jl 0x204659ed
rol esi, 0xd
ror esi, 0xd
xchg edx, ebx
xchg edx, ebx
xchg esi, edi
xchg esi, edi
jl 0x20465a06
ja 0x204659ff
jmp 0x20465a01
mov esp, esp
jge 0x20465a06
call 0xa13aa794
jmp 0x1493e210
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
cmp eax, edi
xor ecx, eax
xor ecx, eax
jno 0x20465a85
pushf
xchg edi, edi
or esp, 0
xor esp, 0
popf
xchg ebx, edi
xchg ebx, edi
mov ecx, ecx
jne 0x20465a82
jo 0x20465a85
mov esp, 0x7cdbe8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x2046d765
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x20465a9d
mov eax, 1
jmp 0x20465b34
call fcn.20465aa2
Function at 0x2046a50c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
xor eax, dword [esp + 0xc]
xor eax, dword [esp + 0xc]
xchg esi, eax
xchg esi, eax
xchg esi, edx
xchg esi, edx
jnp 0x2046a54a
pushf
test esp, 0x506b
jp 0x2046a53f
popf
mov esp, esp
jno 0x2046a545
mov edx, edx
jp 0x2046a54a
mov edi, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
cmc
jge 0x2046a596
pushf
lea ecx, [ecx]
clc
popf
jnp 0x2046a58e
lea esp, [esp]
xchg ecx, ecx
jl 0x2046a596
mov ebp, 0x80f44d8a
jmp 0x14942da0
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
test dword [esp + 0xc], edi
jl 0x2046a60d
jae 0x2046a620
lea ebx, [ebx + 0x5672]
lea ebx, [ebx - 0x5672]
jbe 0x2046a61d
jb 0x2046a620
xor eax, 0x92de8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.2046af52
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2046a633
jmp 0x2046a6d7
jg 0x2046a635
rol esp, 0
jmp 0x2046a63a
nop
jge 0x2046a64a
pushf
mov esi, esi
jno 0x2046a643
popf
je 0x2046a647
jl 0x2046a64a
mov edi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.2047d2b0
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.20480c68
add esp, 0xc
test eax, 0x1dc
dec ebx
inc ebx
jl 0x2046a681
pushf
ror ecx, 0
popf
jg 0x2046a67c
jne 0x2046a67e
jge 0x2046a681
mov ebx, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x2046a689
jmp 0x2046a6d7
stc
jne 0x2046a68c
add ecx, dword [esp]
sub ecx, dword [esp]
neg edi
neg edi
jne 0x2046a6a4
pushf
cmp eax, dword [esp]
popf
mov ebx, ebx
je 0x2046a6a4
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.204656b2
add esp, 4
jne 0x2046a6b2
mov esp, esp
ja 0x2046a6d0
pushf
jge 0x2046a6ba
jge 0x2046a6bc
call fcn.2046a6c1
Function at 0x2046b806
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.20480c68
add esp, 0xc
jbe 0x2046b828
test edx, esi
clc
js 0x2046b82d
jo 0x2046b84b
pushf
clc
push edx
add edx, 0x3d9d
ror edx, 0x1f
pop edx
popf
lea esp, [esp]
xchg edx, esi
xchg edx, esi
jp 0x2046b848
jno 0x2046b84b
mov edi, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
lea edx, [edx]
mov ecx, ecx
jl 0x2046b881
jnp 0x2046b883
jle 0x2046b895
pushf
inc edx
dec edx
cmc
jne 0x2046b88c
popf
jne 0x2046b890
ja 0x2046b892
jg 0x2046b895
mov esi, 0x80f04d8a
jmp 0x1094409f
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jns 0x2046b8f7
xchg ebx, ebx
jge 0x2046b903
jne 0x2046b8fd
jle 0x2046b8ff
jl 0x2046b903
add eax, 0x9024e867
add dword [eax], eax
call fcn.2048492c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2046b915
xor eax, eax
jmp 0x2046b952
test edi, 0x6001
or ecx, 0
jno 0x2046b92f
pushf
jae 0x2046b924
popf
jl 0x2046b928
je 0x2046b92a
jae 0x2046b92c
jo 0x2046b92f
mov esp, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2047d2b0
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.20480c68
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2046b959
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.20480c68
add esp, 0xc
jnp 0x2046b974
cmp edi, eax
je 0x2046b989
pushf
and esp, 0xffffffff
clc
or ecx, ecx
popf
jg 0x2046b984
xchg edx, eax
xchg edx, eax
jne 0x2046b989
mov edx, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
cmp esp, 0x418b
sub esi, 0
lea eax, [eax]
and ecx, ecx
jp 0x2046b9ce
jnp 0x2046b9ca
jnp 0x2046b9ce
jmp 0xc9443e6
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.2046af52
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2046ba43
xor eax, eax
jmp 0x2046bae8
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.2047d2b0
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.20480c68
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x2046bae6
ror edi, 0xc
rol edi, 0xc
lea eax, [eax + 0x573a]
lea eax, [eax - 0x573a]
or eax, 0
shr eax, 0
jp 0x2046baab
pushf
cmp ebx, dword [esp]
rol esi, 0x1f
ror esi, 0x1f
xor edx, dword [esp]
xor edx, dword [esp]
je 0x2046ba96
popf
mov ebx, ebx
lea eax, [eax + 0x6dc]
lea eax, [eax - 0x6dc]
jmp 0x2046baa8
jnp 0x2046baab
xor eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.204656b2
add esp, 4
stc
jb 0x2046baba
jbe 0x2046babc
je 0x2046bad5
pushf
shr esi, 0
mov ebx, ebx
xor ecx, 0
popf
xchg ecx, ebx
xchg ecx, ebx
mov ecx, ecx
jb 0x2046bad2
jne 0x2046bad5
sub eax, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x2046bae8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x2046c2c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.20480c68
add esp, 0xc
test esp, 0x2383
add ebx, 0
std
cld
mov esp, esp
jbe 0x2046c2fa
jl 0x2046c2ee
mov edx, edx
xchg edi, esi
xchg edi, esi
jp 0x2046c2f6
ja 0x2046c2fa
mov edx, 0xe045c683
dec eax
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
mov edx, edx
jp 0x2046c367
pushf
and edi, 0xffffffff
xor ebx, 0
popf
lea edi, [edi + 0x5f66]
lea edi, [edi - 0x5f66]
xchg edx, eax
xchg edx, eax
jge 0x2046c364
jnp 0x2046c367
mov ecx, 0x80e04d8a
jmp 0x944b71
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
jle 0x2046c405
je 0x2046c407
js 0x2046c409
je 0x2046c410
xchg esp, esp
jne 0x2046c410
jmp 0x203201fc
call fcn.2046af52
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2046c425
xor eax, eax
jmp 0x2046c6c5
cmp esp, 0x57b4
mov edi, edi
jno 0x2046c436
je 0x2046c431
jmp 0x2046c433
jo 0x2046c436
mov edi, 0x51e04d8d
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.2047d2b0
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.20480c68
add esp, 0xc
rol edi, 0
jo 0x2046c45b
xor esp, 0
jbe 0x2046c476
pushf
ja 0x2046c464
call fcn.2046c469
Function at 0x2046e203
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
call fcn.2046e221
Function at 0x2047039e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x20460448], 1
jne 0x204704d8
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
xchg esp, esp
jbe 0x204703d8
pushf
add esi, 0
popf
mov esp, esp
jo 0x204703d3
mov eax, eax
ja 0x204703d8
mov ebp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
cmp ecx, 0x7e0f
js 0x2047041b
pushf
test eax, edi
jnp 0x20470412
popf
jnp 0x20470416
jp 0x20470418
jns 0x2047041b
mov esp, 0x80e84d8a
jmp 0x8948c25
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.2046af52
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x20470488
mov eax, dword [ebp + 8]
jmp 0x20470538
jbe 0x2047048a
shl esp, 0
jge 0x204704a0
pushf
js 0x20470493
cmc
rol ecx, 1
rol ecx, 0x1f
popf
lea ebx, [ebx]
jl 0x204704a0
mov ebx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.2047d2b0
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.20480c68
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x204704d1
mov edx, dword [ebp - 8]
mov dword [0x20460448], edx
jmp 0x204704d6
mov eax, dword [ebp + 8]
jmp 0x20470538
jmp 0x204704e0
mov eax, dword [0x20460448]
mov dword [ebp - 8], eax
xor eax, 0
and edi, edi
sub esp, 0
jbe 0x204704ff
pushf
cmp esp, 0x31b2
lea edi, [edi]
popf
jnp 0x204704f8
xchg edi, esi
xchg edi, esi
ja 0x204704ff
add eax, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
xchg ebx, ebx
jl 0x20470511
xchg esi, eax
xchg esi, eax
lea esi, [esi]
jge 0x20470511
jmp 0x1c9c907b
mov edx, dword [ebp - 4]
push edx
call fcn.204656b2
add esp, 4
jb 0x2047051f
jle 0x20470531
pushf
jge 0x20470525
nop
jae 0x20470528
popf
jbe 0x2047052c
lea eax, [eax]
jg 0x20470531
add eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x204726ca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.20480c68
add esp, 0xc
push 0x21
push 0x204604a0
lea ecx, [ebp - 0x138]
push ecx
call fcn.20486934
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x204727d2
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.20480c68
add esp, 0xc
push 0xb
push 0x204604c4
lea edx, [ebp - 0x138]
push edx
call fcn.20486934
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x204727c5
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.20486934
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x204727d4
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x204744d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
nop
jg 0x204744ec
add edi, dword [esp]
sub edi, dword [esp]
call 0x204744f7
add esp, 4
jae 0x20474502
nop
jo 0x204744ff
jb 0x20474502
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
jns 0x20474538
cmp edi, dword [esp]
xor ecx, 0
jg 0x2047455c
pushf
xchg ecx, ecx
shr esp, 0
jno 0x20474549
jl 0x2047454b
popf
lea ebx, [ebx + 0xa6b]
lea ebx, [ebx - 0xa6b]
jle 0x2047455c
mov edi, 0x80e84d8a
jmp 0x894cd66
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
add esi, 0
cmp esp, 0xac5
jb 0x204745d8
mov eax, eax
jle 0x204745d3
jns 0x204745d5
jae 0x204745d8
add eax, 0xff6975e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.2046af52
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x204745ed
xor eax, eax
jmp 0x20474687
and esp, 0xffffffff
xchg ebx, ecx
xchg ebx, ecx
jb 0x204745fb
jp 0x204745f8
jae 0x204745fb
add eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.2047d2b0
mov dword [ebp - 4], eax
ja 0x2047460d
shl esp, 0
js 0x20474631
pushf
sub esp, 0
mov edx, edx
and esp, 0xffffffff
jge 0x2047461e
popf
lea eax, [eax + 0x3ee7]
lea eax, [eax - 0x3ee7]
jle 0x2047462e
jns 0x20474631
mov eax, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x2047464b
xor eax, eax
jmp 0x20474687
call 0x20474650
add esp, 4
jle 0x20474666
lea eax, [eax + 0xb9]
lea eax, [eax - 0xb9]
jb 0x20474663
jg 0x20474666
mov eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.204656b2
add esp, 4
lea eax, [eax]
ror esp, 0
js 0x20474684
jb 0x2047467b
xchg ecx, edx
xchg ecx, edx
jns 0x20474684
xor eax, 0x55ff0019
cld
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret