joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4373af
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044f4cd
add esp, 0xc
push ecx
pop ecx
shr esp, 0
nop
neg eax
neg eax
jbe 0x4373dd
mov ebx, ebx
jg 0x4373d8
jp 0x4373da
ja 0x4373dd
mov ebx, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
dec ecx
inc ecx
xor esi, 0x4461
xor esi, 0x4461
jb 0x43742a
jl 0x437427
jae 0x43742a
sub eax, 0x80e84d8a
jmp 0xe890fc34
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.00444551
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4374b0
xor eax, eax
jmp 0x437539
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004372bc
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0044f4cd
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x437537
lea edi, [edi + 0x188]
lea edi, [edi - 0x188]
js 0x4374f9
pushf
rol esp, 0
cmp edi, 0x212c
popf
nop
jb 0x4374f4
lea eax, [eax]
jns 0x4374f9
mov eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0042cf45
add esp, 4
inc ebx
dec ebx
lea ebx, [ebx]
rol esi, 1
rol esi, 0x1f
cld
js 0x437522
pushf
test esp, 0x2dd3
popf
xchg edi, ecx
xchg edi, ecx
jns 0x437522
ljmp 0x4d8b:0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x437539
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x437e9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x425340], 1
jne 0x437fe9
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044f4cd
add esp, 0xc
nop
lea edi, [edi]
ror ecx, 0x1b
rol ecx, 0x1b
je 0x437edf
pushf
not eax
not eax
inc ebx
dec ebx
popf
mov esp, esp
jne 0x437edf
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
mov edi, edi
rol ebx, 0
jl 0x437f29
pushf
jge 0x437f16
cmp edx, dword [esp]
rol esp, 0
cmp edx, 0x4e73
popf
xchg ebx, ebx
jge 0x437f29
mov esp, 0x80e84d8a
jmp 0xe8910733
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.004482c6
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x437f96
mov eax, dword [ebp + 8]
jmp 0x438065
add esp, 0
je 0x437fb1
pushf
call fcn.00437fa2
mov eax, dword [0x425340]
mov dword [ebp - 8], eax
Function at 0x43b41a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044f4cd
add esp, 0xc
test edx, eax
or esp, 0
jge 0x43b43a
ja 0x43b44a
pushf
clc
popf
jmp 0x43b443
xchg esp, esp
jl 0x43b447
jbe 0x43b44a
mov ebp, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
jns 0x43b48c
jp 0x43b4a3
pushf
xor eax, edx
xor eax, edx
xor ebx, dword [esp]
xor ebx, dword [esp]
popf
mov edx, edx
jmp 0x43b4a0
jnp 0x43b4a3
xor eax, 0x80ec4d8a
jmp 0xec913cad
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.00444551
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43b53a
xor eax, eax
jmp 0x43b5c7
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004372bc
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044f4cd
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x43b5c5
lea edx, [edx + 0x1ef]
lea edx, [edx - 0x1ef]
push ebx
add ebx, 0x5e44
ror ebx, 0xe
pop ebx
cmp edi, dword [esp]
je 0x43b584
jg 0x43b57e
jbe 0x43b580
nop
jne 0x43b584
mov ebp, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0042cf45
add esp, 4
cmp ecx, 0x3c13
test dword [esp], ebx
stc
stc
jge 0x43b5bc
pushf
rol esp, 0
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
ror eax, 0
and edi, edi
popf
xchg esi, ebx
xchg esi, ebx
jo 0x43b5b7
jne 0x43b5b9
jl 0x43b5bc
ljmp 0x55ff:0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x43b5c7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x444386
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044f4cd
add esp, 0xc
ror esp, 0
rol ebx, 0
je 0x4443a7
ja 0x4443a9
jae 0x4443b6
mov esi, esi
jnp 0x4443af
mov eax, eax
js 0x4443b3
jb 0x4443b6
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
or ecx, 0
jb 0x4443ef
xor edi, edx
xor edi, edx
jo 0x4443f5
jp 0x444403
jmp 0x4443f9
xchg esp, esp
jae 0x4443fd
ja 0x4443ff
jnp 0x444403
add eax, 0xe84d8a11
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
test edx, 0x445a
jle 0x44448e
pushf
or eax, eax
push esi
pop esi
add eax, 0x37d0
sub eax, 0x37d0
popf
je 0x444487
js 0x444489
jnp 0x44448b
jg 0x44448e
mov ebx, 0x3e33e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.004482c6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4444a3
xor eax, eax
jmp 0x44454a
jl 0x4444a5
jg 0x4444c8
pushf
xor eax, ebx
xor eax, ebx
cmp edx, 0x5298
clc
nop
popf
xchg esp, esp
lea ebx, [ebx + 0x367b]
lea ebx, [ebx - 0x367b]
jle 0x4444c8
sub eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004372bc
mov dword [ebp - 4], eax
jb 0x4444da
jnp 0x4444e6
mov edx, edx
jbe 0x4444e0
jle 0x4444e2
jp 0x4444e6
mov ebx, 0x6a0d6ab7
add byte [ebp - 0x17af17bb], cl
fisubr dword [edi - 0x3b7d0000]
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044f4cd
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x444500
or al, 0x83
jge 0x4444f5
add byte [ebp + 4], dh
xor eax, eax
jmp 0x44454a
cmp ebx, dword [esp]
ja 0x444514
jns 0x444507
xchg esi, ecx
xchg esi, ecx
je 0x44450d
jo 0x44450f
jbe 0x444514
mov edi, 0x4d8b458c
cld
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042cf45
add esp, 4
jns 0x444522
add ecx, 0x1cbb
sub ecx, 0x1cbb
cmp eax, dword [esp]
jo 0x444547
lea edi, [edi + 0x68a0]
lea edi, [edi - 0x68a0]
je 0x444541
jnp 0x444543
jno 0x444547
jmp 0xfc9a446e
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a72f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044f4cd
add esp, 0xc
cmp edx, 0x7c37
jmp 0x44a757
jns 0x44a759
xor edi, dword [esp + 8]
xor edi, dword [esp + 8]
jl 0x44a784
pushf
jae 0x44a767
xor esi, dword [esp + 8]
xor esi, dword [esp + 8]
lea eax, [eax + 0x54b6]
lea eax, [eax - 0x54b6]
popf
xchg esp, esp
js 0x44a781
jge 0x44a784
mov ebx, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
xor esp, 0
nop
jo 0x44a7d0
pushf
mov edx, edx
xor edi, dword [esp]
xor edi, dword [esp]
jge 0x44a7c6
popf
nop
lea esi, [esi]
jno 0x44a7cd
jno 0x44a7d0
call 0x8134f55e
jmp 0xf0922fda
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov esp, esp
jp 0x44a834
jp 0x44a836
xor edi, ecx
xor edi, ecx
jb 0x44a844
mov esp, esp
ja 0x44a840
jae 0x44a844
add eax, 0x9d08e863
invalid
call fcn.00444551
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44a856
xor eax, eax
jmp 0x44a89f
rol esi, 0xd
ror esi, 0xd
lea edx, [edx + 0x1d01]
sub edx, 0x1d01
jae 0x44a86a
jne 0x44a87c
pushf
jo 0x44a870
shl esp, 0
popf
xchg ecx, ebx
xchg ecx, ebx
je 0x44a87c
call 0x5134ee0d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004372bc
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0044f4cd
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44beb1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044f4cd
add esp, 0xc
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
jg 0x44bee6
pushf
mov ecx, ecx
add ebx, dword [esp]
sub ebx, dword [esp]
popf
mov esi, esi
nop
jle 0x44bee6
add esi, 0xc648ec45
inc ebp
clc
inc edx
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
add edi, dword [esp]
sub edi, dword [esp]
jne 0x44bf2d
mov esi, esi
mov eax, eax
je 0x44bf2d
jmp 0x81310cbb
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.00444551
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44bfb0
xor eax, eax
jmp 0x44c02c
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004372bc
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0044f4cd
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x44c02a
cmc
jg 0x44bfeb
pushf
xor ebx, 0
rol edi, 0x10
ror edi, 0x10
popf
js 0x44bfe8
jle 0x44bfeb
mov ebp, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.0042cf45
add esp, 4
cmp edx, dword [esp + 8]
xchg esp, esp
xor ebx, edi
xor ebx, edi
ja 0x44c003
jbe 0x44c019
pushf
jne 0x44c009
add eax, dword [esp]
sub eax, dword [esp]
popf
lea esp, [esp]
mov esi, esi
ja 0x44c019
mov ecx, 0x5010458b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x44c02c
xor eax, eax
pop edi
Function at 0x44f4fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044f4cd
add esp, 0xc
and ebx, 0xffffffff
jo 0x44f51a
test esp, 0x6e2
jae 0x44f52e
pushf
nop
popf
jle 0x44f529
mov esp, esp
jb 0x44f52e
mov esp, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cmp eax, 0xc1d
cmp edi, 0x1152
je 0x44f57d
pushf
js 0x44f56f
lea esp, [esp]
jns 0x44f574
popf
js 0x44f578
xchg ebx, ebx
jne 0x44f57d
add eax, 0x80f04d8a
jmp 0xf0927d87
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
jo 0x44f5df
jnp 0x44f5e1
ror esp, 0
jnp 0x44f5fe
pushf
lea edi, [edi + 0x7775]
lea edi, [edi - 0x7775]
popf
lea esp, [esp]
jp 0x44f5fb
jp 0x44f5fe
jmp 0xffd1b9ea
call fcn.004482c6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44f610
xor eax, eax
jmp 0x44f650
std
cld
push edi
pop edi
jl 0x44f62d
pushf
lea esi, [esi]
lea ecx, [ecx + 0x6fb8]
lea ecx, [ecx - 0x6fb8]
popf
lea eax, [eax]
jge 0x44f62d
sub eax, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004372bc
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0044f4cd
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44fd30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0044f4cd
add esp, 0xc
rol edx, 0
jbe 0x44fd4e
jb 0x44fd5b
xchg esp, esp
mov eax, eax
xchg esp, esp
jl 0x44fd58
jae 0x44fd5b
mov ebx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
shl esp, 0
xor esp, 0
xchg edx, edx
ror esp, 0
jne 0x44fd9d
js 0x44fd9a
je 0x44fd9d
lcall 0x1e9, 0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
shr esp, 0
jno 0x44fe09
jns 0x44fe04
xchg esp, esp
jo 0x44fe09
jmp 0x10704f5
call 0x45c014
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x44fe21
mov eax, 1
jmp 0x44fea9
xchg edi, edi
xchg ecx, eax
xchg ecx, eax
jg 0x44fe27
mov esp, esp
ja 0x44fe36
mov ebx, ebx
mov ebx, ebx
xchg esp, esp
jbe 0x44fe36
call 0x45d296e5
hlt
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004372bc
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0044f4cd
add esp, 0xc
cmp ebx, 0x54e3
jo 0x44fe64
jge 0x44fe60
jno 0x44fe64
jmp 0xecc2819c
cmp dword [ebp - 0x14], 0
jne 0x44fe71
mov eax, 1
jmp 0x44fea9
mov esi, esi
jnp 0x44fe89
xchg esp, esp
nop
jmp 0x44fe7a
lea ebx, [ebx + 0x4360]
lea ebx, [ebx - 0x4360]
jp 0x44fe89
add eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.0042cf45
add esp, 4
ja 0x44fe97
cmc
je 0x44fea2
jns 0x44fe9c
jmp 0x44fe9e
jne 0x44fea2
mov eax, 0x84d8b58
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x451c8f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044f4cd
add esp, 0xc
jns 0x451cb1
test dword [esp + 4], ecx
lea esi, [esi + 0x61b0]
lea esi, [esi - 0x61b0]
je 0x451cd0
mov edx, edx
jns 0x451cc7
lea esp, [esp]
ja 0x451ccc
jne 0x451cd0
xor dword [edi], 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004482c6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x451d98
xor eax, eax
jmp 0x451df9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004372bc
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0044f4cd
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x451dc2
xor eax, eax
jmp 0x451df9
test ecx, esi
xor esp, 0
jg 0x451dc9
and edx, edx
jle 0x451dd7
lea esi, [esi]
ja 0x451dd1
jne 0x451dd3
jg 0x451dd7
mov ebx, 0xe8458bb2
mov eax, dword [ebp - 0x18]
push eax
call fcn.0042cf45
add esp, 4
mov esp, esp
jno 0x451dee
jp 0x451de9
jne 0x451deb
jo 0x451dee
mov ebp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8