joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f4a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044b0b2
add esp, 0xc
add edi, 0
js 0x44f4dc
pushf
and esi, 0xffffffff
add ecx, dword [esp]
sub ecx, dword [esp]
push edi
pop edi
popf
ja 0x44f4d5
mov edx, edx
jne 0x44f4d9
jns 0x44f4dc
mov ebp, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
xchg esi, esi
jo 0x44f51a
lea esi, [esi + 0x19d8]
lea esi, [esi - 0x19d8]
jbe 0x44f516
jno 0x44f51a
jmp 0xf0927fef
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.0046a083
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44f57a
xor eax, eax
jmp 0x44f5f9
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0046cd83
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044b0b2
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x44f5f7
call fcn.0044f5a5
xor eax, eax
Function at 0x44fa6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044b0b2
add esp, 0xc
jne 0x44fa87
mov esp, esp
jb 0x44faa6
pushf
shr esp, 0
lea ebx, [ebx + 0x723d]
lea ebx, [ebx - 0x723d]
popf
jns 0x44faa0
lea esp, [esp]
jae 0x44faa6
call 0x49314070
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
test dword [esp], ebx
nop
add esp, 0
jg 0x44faf8
jne 0x44faf1
jno 0x44faf3
jne 0x44faf5
jle 0x44faf8
lcall 0x1e9, 0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.0044db86
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44fb8f
xor eax, eax
jmp 0x44fc65
jne 0x44fb91
xchg edi, ebx
xchg edi, ebx
ja 0x44fba8
pushf
add edx, dword [esp]
sub edx, dword [esp]
popf
jae 0x44fba3
jp 0x44fba5
jbe 0x44fba8
mov ebx, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0046cd83
mov dword [ebp - 0x18], eax
jns 0x44fbba
call fcn.0044fbbf
Function at 0x4572ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044b0b2
add esp, 0xc
cmp esp, 0x2d33
jns 0x4572dc
pushf
push esi
pop esi
mov esp, esp
popf
jne 0x4572d7
jle 0x4572d9
js 0x4572dc
add eax, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
xor esi, ebx
xor esi, ebx
rol eax, 0
nop
jg 0x45732e
mov esi, esi
jbe 0x457326
xchg ecx, ebx
xchg ecx, ebx
jle 0x45732e
mov edi, 0xec4d8acd
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0044db86
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4573bb
jmp 0x457440
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046cd83
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0044b0b2
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x457440
mov ecx, ecx
mov esp, esp
xchg ebx, eax
xchg ebx, eax
jo 0x457400
pushf
lea edx, [edx]
popf
lea eax, [eax + 0x16ab]
lea eax, [eax - 0x16ab]
je 0x4573fd
jno 0x457400
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00468812
add esp, 4
xchg esp, esp
add esp, 0
jge 0x45742d
pushf
xor edx, 0xb0b
xor edx, 0xb0b
lea eax, [eax]
popf
xchg edx, edx
lea esp, [esp]
jl 0x45742d
mov ebx, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x457449
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x43d964
call fcn.00454511
add esp, 0xc
mov byte [0x43d964], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x4587e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044b0b2
add esp, 0xc
lea esi, [esi + 0x23d7]
sub esi, 0x23d7
test eax, 0x7e2c
ror ecx, 0xd
rol ecx, 0xd
jl 0x458821
jle 0x45881c
js 0x45881e
jge 0x458821
mov ebx, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
call fcn.00458872
Function at 0x4589e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044b0b2
add esp, 0xc
rol esp, 0
jns 0x458a1f
pushf
lea edx, [edx + 0x425c]
lea edx, [edx - 0x425c]
or esi, esi
jb 0x458a16
popf
jns 0x458a1a
jle 0x458a1c
js 0x458a1f
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
xor esp, 0
nop
cmc
jnp 0x458a76
pushf
and esi, 0xffffffff
lea ebx, [ebx + 0x7fa6]
sub ebx, 0x7fa6
mov esp, esp
popf
jg 0x458a71
jge 0x458a73
jp 0x458a76
mov eax, 0x80e84d8a
jmp 0xe8931280
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
cmp edx, 0x3c28
jns 0x458aee
xchg ecx, ecx
ja 0x458aea
js 0x458aee
lcall 0xffff, 0x5093e85d
call fcn.0044db86
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x458b03
xor eax, eax
jmp 0x458bad
mov esp, esp
test dword [esp + 0x10], eax
xchg edi, edi
ror esi, 0
jbe 0x458b15
mov esp, esp
ja 0x458b15
mov edx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0046cd83
mov dword [ebp - 4], eax
jbe 0x458b27
jne 0x458b40
pushf
lea edi, [edi + 0x7da4]
lea edi, [edi - 0x7da4]
nop
cld
popf
jb 0x458b3d
je 0x458b40
add eax, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044b0b2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x458b5a
xor eax, eax
jmp 0x458bad
jb 0x458b5c
ror edx, 0
jae 0x458b6c
pushf
cmp edi, ebx
popf
ja 0x458b69
jb 0x458b6c
mov edi, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00468812
add esp, 4
xor ecx, 0x48bb
xor ecx, 0x48bb
not eax
not eax
or esp, 0
add esi, 0x9d5
sub esi, 0x9d5
jnp 0x458baa
pushf
rol eax, 0
ror ecx, 0
popf
je 0x458ba5
jnp 0x458ba7
jp 0x458baa
cmp edi, 0x5e5ffc55
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4636b5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044b0b2
add esp, 0xc
or esp, 0
jge 0x4636da
xchg edx, edx
xchg edx, eax
xchg edx, eax
jnp 0x4636eb
lea esp, [esp]
mov esi, esi
je 0x4636e7
jp 0x4636eb
mov edx, 0xf045c649
dec esi
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
and esp, 0xffffffff
jb 0x46372b
jo 0x463722
jb 0x463724
jge 0x463726
jmp 0x463728
jae 0x46372b
ljmp 0x1e9:0x80f04d8a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
inc esi
dec esi
or esp, 0
ror esp, 0
jmp 0x463795
je 0x46379f
js 0x463799
xchg esp, esp
jne 0x46379f
mov esi, 0x68dfe8a1
add byte [eax], al
call fcn.0046a083
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4637b1
xor eax, eax
jmp 0x4637f0
xor ebx, 0
clc
ja 0x4637cd
pushf
rol ecx, 0
test eax, 0x3c0f
and eax, 0xffffffff
lea ebx, [ebx]
popf
jae 0x4637ca
jbe 0x4637cd
ljmp 0x4d8b:0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046cd83
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0044b0b2
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463835
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0044b0b2
add esp, 0xc
jge 0x463850
jae 0x463870
pushf
cmp eax, esi
ja 0x463858
xor ecx, 0x83c
xor ecx, 0x83c
mov esi, esi
popf
xchg esp, esp
nop
xchg esp, esp
jb 0x463870
lcall 0x45c6, 0x53f445c6
cmc
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
je 0x4638a2
mov edi, edi
lea eax, [eax]
jge 0x4638b2
ja 0x4638aa
jnp 0x4638ac
xchg esp, esp
jl 0x4638b2
mov esp, 0xf44d8a99
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
rol edx, 0
lea esi, [esi]
lea edi, [edi + 0x4b00]
sub edi, 0x4b00
jno 0x463936
pushf
sub edx, 0
or esp, 0
popf
jbe 0x463931
jae 0x463933
jo 0x463936
sub eax, 0xff3ea7e8
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call fcn.004577e2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x46394e
mov eax, 1
jmp 0x4639fe
test dword [esp + 0x10], eax
or edi, edi
nop
push ecx
pop ecx
jg 0x463979
pushf
not ebx
not ebx
or edx, 0
cmp edx, dword [esp]
popf
lea edi, [edi + 0x722a]
lea edi, [edi - 0x722a]
nop
mov eax, eax
jle 0x463979
mov esi, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0046cd83
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0044b0b2
add esp, 0xc
mov ebx, ebx
ror eax, 0x16
ror eax, 0xa
std
cld
xor esp, 0
jge 0x4639c4
pushf
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
jp 0x4639b4
and esi, esi
ror esp, 0
popf
jnp 0x4639bd
nop
lea esp, [esp]
jl 0x4639c4
mov eax, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x4639d1
mov eax, 1
jmp 0x4639fe
clc
and eax, eax
jae 0x4639dd
lea edx, [edx]
jae 0x4639da
jb 0x4639dd
mov ebx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00468812
add esp, 4
shl esp, 0
jno 0x4639f7
jl 0x4639f0
xchg edi, edi
jb 0x4639f4
jo 0x4639f7
mov ebp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46490e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0044b0b2
add esp, 0xc
clc
jbe 0x46494c
pushf
and edi, edi
ror edx, 7
rol edx, 7
shr edi, 0
jae 0x464939
popf
lea eax, [eax + 0x5ac7]
lea eax, [eax - 0x5ac7]
jg 0x464949
ja 0x46494c
mov esp, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
or ecx, ecx
je 0x4649a6
pushf
jmp 0x46499c
xor esp, 0
popf
jle 0x4649a3
jne 0x4649a6
mov esi, 0x80e44d8a
jmp 0xe493d1b0
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0044db86
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x464a54
xor eax, eax
jmp 0x464acb
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0046cd83
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0044b0b2
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x464ac9
xor esp, 0
xchg edx, esi
xchg edx, esi
cmp ebx, dword [esp + 8]
jno 0x464a90
mov esi, esi
xchg esp, esp
jo 0x464a90
call 0x4dd22847
cld
mov ecx, dword [ebp - 4]
push ecx
call fcn.00468812
add esp, 4
and ecx, ecx
inc edi
dec edi
ja 0x464aa2
jmp 0x464aa4
jl 0x464ab0
jo 0x464aa8
jg 0x464aaa
je 0x464aac
jge 0x464ab0
jmp 0x189bd692
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x464acb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x466c6b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044b0b2
add esp, 0xc
rol ebx, 3
ror ebx, 3
jns 0x466ca1
ja 0x466c95
xchg edi, esi
xchg edi, esi
mov esp, esp
jnp 0x466c9d
js 0x466ca1
mov ebp, 0xec45c6fa
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0044db86
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x466d69
xor eax, eax
jmp 0x466dd2
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046cd83
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0044b0b2
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x466d93
xor eax, eax
jmp 0x466dd2
and esp, 0xffffffff
shr ebx, 0
xchg esp, esp
jp 0x466da5
jno 0x466d9f
jbe 0x466da1
jnp 0x466da5
mov esi, 0xe8458bd0
mov eax, dword [ebp - 0x18]
push eax
call fcn.00468812
add esp, 4
cmp ebx, 0x4426
ror esp, 0
jge 0x466dc7
js 0x466dbe
mov esp, esp
je 0x466dc2
jp 0x466dc4
jl 0x466dc7
call 0x5152bb56
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4680c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0044b0b2
add esp, 0xc
js 0x4680e0
jbe 0x4680ed
jns 0x4680e4
jae 0x4680e6
xchg ebx, edi
xchg ebx, edi
ja 0x4680ed
mov edx, 0x52e445c6
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
add ebx, 0x49e3
sub ebx, 0x49e3
call fcn.0046814a
Function at 0x46c429
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0044b0b2
add esp, 0xc
push 0x21
push 0x43ebc0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0044f6dd
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x46c531
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0044b0b2
add esp, 0xc
push 0xb
push 0x43ebe4
lea edx, [ebp - 0x138]
push edx
call fcn.0044f6dd
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x46c524
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0044f6dd
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x46c533
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret