joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e8df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00441b0b
add esp, 0xc
xor esp, 0
ja 0x44e906
mov edi, edi
jle 0x44e901
jno 0x44e903
jbe 0x44e906
mov ebp, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
dec edx
inc edx
mov esi, esi
je 0x44e951
jmp 0x44e93e
jno 0x44e940
jb 0x44e942
lea esi, [esi + 0x223c]
lea esi, [esi - 0x223c]
jne 0x44e951
mov eax, 0x80f04d8a
jmp 0xf092715b
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
je 0x44e9b3
nop
jnp 0x44e9c1
pushf
nop
popf
lea esp, [esp]
jp 0x44e9c1
mov ebp, 0x901e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.0044f2c7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44e9d3
xor eax, eax
jmp 0x44ea0f
and esp, 0xffffffff
jmp 0x44e9d8
je 0x44e9ec
nop
xchg ebx, ebx
lea edx, [edx + 0x7052]
lea edx, [edx - 0x7052]
jne 0x44e9ec
mov ebx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00445b9f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00441b0b
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44eda5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00441b0b
add esp, 0xc
rol edx, 0xf
rol edx, 0x11
rol edx, 0
je 0x44eddf
pushf
mov esp, esp
popf
mov esp, esp
jg 0x44edda
jge 0x44eddc
jne 0x44eddf
mov ecx, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x42
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xb], 0x78
jns 0x44ee11
cmp esi, 0x392c
test dword [esp + 8], eax
jp 0x44ee2a
pushf
dec ebx
inc ebx
jbe 0x44ee23
popf
jne 0x44ee27
jnp 0x44ee2a
mov ecx, 0x80ec4d8a
jmp 0xec927634
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00440384
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44ee9f
xor eax, eax
jmp 0x44f10a
rol edx, 0
jle 0x44eea4
je 0x44eec8
pushf
shr esp, 0
stc
or esp, 0
ror ebx, 0xb
rol ebx, 0xb
popf
jle 0x44eeb9
lea ebx, [ebx + 0x7435]
lea ebx, [ebx - 0x7435]
jne 0x44eec8
xor eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00445b9f
mov dword [ebp - 0x18], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00441b0b
add esp, 0xc
lea esp, [esp]
test edx, eax
jns 0x44ef08
pushf
cmp esi, dword [esp]
xchg ebx, ebx
nop
call fcn.0044eefc
Function at 0x450b97
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x450bab
jmp 0x450d42
xor ecx, ebx
xor ecx, ebx
test esp, 0x67d1
cmc
jo 0x450bc5
pushf
cld
shl ebx, 0
popf
jg 0x450bc2
jno 0x450bc5
mov ebx, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x439b24], edx
and edx, 0xffffffff
and edx, 0xffffffff
cmc
jnp 0x450bea
xchg esp, esp
jns 0x450be3
nop
je 0x450be6
jp 0x450bea
mov esi, 0xec458be9
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x43b33c], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x43b338], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x439b18], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x439b1c], ecx
xchg edi, eax
xchg edi, eax
ror esi, 0
push ecx
pop ecx
jle 0x450c34
pushf
rol esp, 0
jp 0x450c29
popf
xchg esi, esi
jle 0x450c2f
jae 0x450c31
jg 0x450c34
call 0x4e3551fe
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
stc
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
sub esi, 0
or esi, esi
ja 0x450c89
pushf
ror esp, 0
xchg ebx, ebx
nop
popf
js 0x450c84
lea edx, [edx]
jbe 0x450c89
mov ecx, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
stc
jne 0x450cf4
xchg esp, esp
call 0x450cfb
add esp, 4
jp 0x450d04
nop
jnp 0x450d04
ljmp 0x43:0xb3383d83
cmp dword [0x43b338], 0
je 0x450d21
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x43b338]
push eax
call fcn.00445b9f
mov dword [0x439b20], eax
std
cld
jo 0x450d32
pushf
jp 0x450d29
popf
xchg edx, esi
xchg edx, esi
jno 0x450d32
add eax, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00441b0b
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45554d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00441b0b
add esp, 0xc
jle 0x45556f
inc edx
dec edx
shl esp, 0
jo 0x45557c
mov esp, esp
jno 0x45557c
xor eax, 0xec45c608
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0044f2c7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x455644
xor eax, eax
jmp 0x4556b8
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00445b9f
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00441b0b
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x45566e
xor eax, eax
jmp 0x4556b8
xor ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x10]
ror ebx, 0x1f
ror ebx, 1
jge 0x455694
pushf
test ebx, 0xb78
not ebx
not ebx
dec ebx
inc ebx
popf
jle 0x45568f
jmp 0x455691
jl 0x455694
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00452525
add esp, 4
and eax, eax
or esp, 0
jp 0x4556ad
nop
jne 0x4556aa
jnp 0x4556ad
xor eax, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4556c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00441b0b
add esp, 0xc
jns 0x4556dc
jle 0x4556f7
pushf
xor esp, 0
jbe 0x4556e5
add ebx, dword [esp]
sub ebx, dword [esp]
lea esp, [esp]
popf
je 0x4556f2
lea esi, [esi]
jg 0x4556f7
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
ja 0x45572d
test dword [esp], edi
jae 0x455743
pushf
rol eax, 1
rol eax, 0x1f
or esp, 0
popf
js 0x455740
jb 0x455743
xor eax, 0x80e84d8a
jmp 0xe892df4d
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jle 0x4557ad
add ecx, 0
ror esp, 0
jge 0x4557ba
jbe 0x4557b7
jl 0x4557ba
mov eax, 0xff9b08e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.0044f2c7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4557cf
xor eax, eax
jmp 0x45585d
push ebx
pop ebx
lea ebx, [ebx]
ja 0x4557e7
pushf
std
cld
xchg ebx, ebx
ror esp, 0
jge 0x4557e0
popf
xchg esp, esp
jbe 0x4557e7
xor eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00445b9f
mov dword [ebp - 4], eax
test ecx, edi
nop
je 0x4557fc
xchg esp, esp
jne 0x455809
xchg edi, edi
ja 0x455804
jmp 0x455806
je 0x455809
lcall 0x458d, 0x6a0d6a
call 0xc33b4064
invalid
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00441b0b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x455823
xor eax, eax
jmp 0x45585d
nop
jno 0x455826
js 0x455828
jnp 0x455840
pushf
jl 0x45582e
xchg edi, esi
xchg edi, esi
jg 0x455834
cmc
popf
jo 0x455839
xchg esi, edx
xchg esi, edx
jp 0x455840
call 0x5241a5cf
mov ecx, dword [ebp - 4]
push ecx
call fcn.00452525
add esp, 4
shl esi, 0
jl 0x45585a
jnp 0x455853
jns 0x455855
lea edx, [edx]
jge 0x45585a
sub eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4576e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x43b078
call fcn.0044540f
add esp, 0xc
mov byte [0x43b078], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x457738
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00441b0b
add esp, 0xc
lea eax, [eax + 0x2f]
lea eax, [eax - 0x2f]
mov eax, eax
sub esp, 0
jne 0x457769
jle 0x457760
nop
lea esp, [esp]
jmp 0x457766
je 0x457769
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
lea ecx, [ecx + 0x201e]
lea ecx, [ecx - 0x201e]
lea esp, [esp]
jbe 0x4577d3
pushf
cmp esp, 0x7b3b
popf
xchg esi, esi
jle 0x4577d0
ja 0x4577d3
mov edx, 0x80e84d8a
jmp 0xe892ffdd
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.0044f2c7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45787c
xor eax, eax
jmp 0x45790c
and esi, 0xffffffff
xor esp, 0
xchg esi, esi
jg 0x45788b
nop
jle 0x45788b
jmp 0xe88b0614
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00445b9f
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00441b0b
add esp, 0xc
xchg esp, esp
shl eax, 0
jno 0x4578c8
pushf
rol edx, 0xa
ror edx, 0xa
ror esp, 0
mov ebx, ebx
inc edi
dec edi
popf
lea eax, [eax]
jo 0x4578c8
mov esp, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x4578d2
xor eax, eax
jmp 0x45790c
ror edx, 0xf
ror edx, 0x11
jno 0x4578da
and ecx, ecx
jle 0x4578f0
pushf
xchg esi, esi
jno 0x4578e4
popf
lea esp, [esp]
mov esp, esp
mov esp, esp
jg 0x4578f0
jmp 0x5129be7f
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00452525
add esp, 4
rol esi, 0
or edi, edi
jg 0x457909
mov eax, eax
nop
jle 0x457909
mov esi, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45952b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
Function at 0x45985b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x439b44], 1
jne 0x4599da
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00441b0b
add esp, 0xc
xchg esi, edi
xchg esi, edi
lea eax, [eax]
jp 0x459889
xor edi, 0x577c
xor edi, 0x577c
jl 0x45989d
jno 0x459899
jge 0x45989d
lcall 0xc648, 0xe845c665
inc ebp
in eax, dx
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
inc ecx
dec ecx
shr edx, 0
add esi, 0
jge 0x4598eb
pushf
lea esp, [esp]
xor edi, 0
ja 0x4598e1
popf
je 0x4598e5
jne 0x4598e7
nop
jl 0x4598eb
mov ebx, 0x80e84d8a
jmp 0xe89320f5
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0044f2c7
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x459960
xor eax, eax
jmp 0x459a49
xchg edi, edi
test esp, 0x57ec
stc
neg eax
neg eax
ja 0x45997b
xchg edx, eax
xchg edx, eax
jo 0x459973
jae 0x459975
jge 0x459977
jbe 0x45997b
mov eax, 0xe8458d1e
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00445b9f
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00441b0b
add esp, 0xc
cmc
call 0x4599a1
add esp, 4
shr eax, 0
jno 0x4599c4
pushf
lea esi, [esi + 0x775b]
sub esi, 0x775b
lea esi, [esi]
popf
lea esp, [esp]
nop
jb 0x4599c1
jo 0x4599c4
add dword [ebx + 0x7400f87d], 0xf8458b0a
cmp dword [ebp - 8], 0
je 0x4599d4
mov eax, dword [ebp - 8]
mov dword [0x439b44], eax
jmp 0x4599d8
xor eax, eax
jmp 0x459a49
jmp 0x4599e3
mov ecx, dword [0x439b44]
mov dword [ebp - 8], ecx
call 0x4599e8
lea esp, [esp + 4]
jnp 0x459a07
pushf
add edi, 0x1aa8
sub edi, 0x1aa8
popf
jp 0x459a00
ja 0x459a02
xchg esi, eax
xchg esi, eax
jp 0x459a07
mov esi, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
xor eax, ecx
xor eax, ecx
ror eax, 0x19
rol eax, 0x19
rol esi, 0x1e
ror esi, 0x1e
xchg ebx, edi
xchg ebx, edi
jl 0x459a32
pushf
xchg esp, esp
xor edi, ecx
xor edi, ecx
popf
jl 0x459a2f
jge 0x459a32
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00452525
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45a8c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00441b0b
add esp, 0xc
lea ecx, [ecx]
cmp esp, 0x7795
lea esi, [esi + 0x5a83]
sub esi, 0x5a83
add esp, 0
js 0x45a915
pushf
lea eax, [eax]
cmp esi, dword [esp + 8]
not edx
not edx
shr esp, 0
popf
xchg ebx, eax
xchg ebx, eax
jg 0x45a912
jns 0x45a915
add esi, 0xc651e845
inc ebp
in eax, dx
je 0x45a8e4
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
test dword [esp], ebx
xchg edi, eax
xchg edi, eax
xor esp, 0
stc
je 0x45a9cf
nop
jne 0x45a9cf
mov edi, 0xf3e80075
dec eax
invalid
call fcn.0044f2c7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45a9e4
xor eax, eax
jmp 0x45aa82
push ecx
pop ecx
inc esi
dec esi
jns 0x45a9fc
pushf
xor edx, 0
jl 0x45a9f1
add edi, 0
stc
popf
xchg ecx, eax
xchg ecx, eax
js 0x45a9fc
add eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00445b9f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00441b0b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x45aa26
xor eax, eax
jmp 0x45aa82
xor edi, dword [esp + 0xc]
xor edi, dword [esp + 0xc]
test dword [esp], esi
not edx
not edx
shr edx, 0
je 0x45aa58
pushf
jbe 0x45aa3e
and edi, 0xffffffff
push eax
add eax, 0x5959
ror eax, 0x14
pop eax
jbe 0x45aa4d
popf
lea edi, [edi]
jb 0x45aa53
jbe 0x45aa55
jne 0x45aa58
sub eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00452525
add esp, 4
mov esi, esi
lea ecx, [ecx]
jnp 0x45aa77
pushf
jge 0x45aa6e
ja 0x45aa70
popf
mov esp, esp
jp 0x45aa77
sub eax, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45b948
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00441b0b
add esp, 0xc
lea eax, [eax]
xchg edx, esi
xchg edx, esi
bnd js 0x45b969