joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41adef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0043280d
add esp, 0xc
xor ecx, 0
js 0x41ae0d
jge 0x41ae2e
jns 0x41ae11
lea edx, [edx + 0x5885]
lea edx, [edx - 0x5885]
lea ebx, [ebx + 0x561c]
lea ebx, [ebx - 0x561c]
jmp 0x41ae2b
jl 0x41ae2e
mov ebp, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
rol esp, 0
or esi, 0
jae 0x41ae73
lea edx, [edx]
xchg edx, ebx
xchg edx, ebx
jns 0x41ae6e
jb 0x41ae70
jb 0x41ae73
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0043e8fe
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41aee8
xor eax, eax
jmp 0x41af7c
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00438b78
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0043280d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x41af7a
xchg ebx, ebx
lea esp, [esp]
jns 0x41af3d
pushf
jne 0x41af19
rol ebx, 0xd
ror ebx, 0xd
xchg edx, eax
xchg edx, eax
rol esi, 6
ror esi, 6
popf
lea esi, [esi + 0x1a78]
lea esi, [esi - 0x1a78]
js 0x41af37
lea esp, [esp]
js 0x41af3d
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0041b3b3
add esp, 4
xor ebx, eax
xor ebx, eax
jp 0x41af69
pushf
mov ebx, ebx
lea ebx, [ebx + 0x2c37]
lea ebx, [ebx - 0x2c37]
stc
xchg esp, esp
popf
jns 0x41af66
jnp 0x41af69
add eax, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x41af7c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b641
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0043280d
add esp, 0xc
cmc
stc
lea esi, [esi]
je 0x41b682
pushf
cmc
lea edx, [edx + 0x79f7]
lea edx, [edx - 0x79f7]
lea ecx, [ecx + 0x74ea]
lea ecx, [ecx - 0x74ea]
popf
ja 0x41b67f
jne 0x41b682
add eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
mov edi, edi
lea eax, [eax + 0xd59]
sub eax, 0xd59
ja 0x41b6c8
jno 0x41b6c3
jle 0x41b6c5
jbe 0x41b6c8
mov ebx, 0x80f44d8a
jmp 0xf48f3ed2
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
add eax, 0
lea ebx, [ebx + 0xde2]
lea ebx, [ebx - 0xde2]
xor ecx, edx
xor ecx, edx
jle 0x41b73d
ja 0x41b74a
jmp 0x41b741
jne 0x41b743
xchg esp, esp
jne 0x41b747
jbe 0x41b74a
mov eax, 0x148e2e8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call fcn.00430031
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41b762
mov eax, 1
jmp 0x41b80a
test ebx, ecx
jbe 0x41b766
jne 0x41b77d
pushf
rol esi, 1
rol esi, 0x1f
jae 0x41b771
cmp eax, ebx
and eax, 0xffffffff
popf
jl 0x41b77a
je 0x41b77d
call 0x5135fd0e
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00438b78
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0043280d
add esp, 0xc
add esp, 0
ror eax, 0
jge 0x41b7b3
pushf
lea edi, [edi]
popf
nop
xchg edx, edx
xchg edi, eax
xchg edi, eax
jl 0x41b7b3
call 0x12e353a
cmp dword [ebp - 0x14], 0
jne 0x41b7c0
mov eax, 1
jmp 0x41b80a
sub ecx, 0
jg 0x41b7c5
jae 0x41b7c7
jae 0x41b7dc
pushf
xor esi, 0
rol esi, 0
popf
xchg edx, edx
xchg edi, edi
jb 0x41b7d9
jb 0x41b7dc
mov ebx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.0041b3b3
add esp, 4
ror eax, 0xb
rol eax, 0xb
add esp, 0
and edi, 0xffffffff
je 0x41b803
jne 0x41b7f8
jo 0x41b7fa
xchg edi, eax
xchg edi, eax
jne 0x41b7fe
jne 0x41b803
mov ebx, 0x4d8b48ad
or byte [ecx - 1], dl
push ebp
in al, dx
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41b813
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0043280d
add esp, 0xc
jns 0x41b82e
call fcn.0041b833
Function at 0x41dc1f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x41dc33
jmp 0x41dde0
test dword [esp + 0x10], ecx
jb 0x41dc46
pushf
jle 0x41dc3d
popf
js 0x41dc41
jns 0x41dc43
jae 0x41dc46
add eax, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x4111e8], edx
nop
jg 0x41dc5a
ja 0x41dc70
ja 0x41dc5e
jbe 0x41dc60
lea eax, [eax + 0x708b]
lea eax, [eax - 0x708b]
jbe 0x41dc70
sub eax, 0xec458b17
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x411194], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x411190], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x412838], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x41283c], ecx
add esp, 0
lea esp, [esp]
jp 0x41dca7
jne 0x41dcb6
pushf
jo 0x41dcad
popf
jo 0x41dcb1
lea ebx, [ebx]
je 0x41dcb6
mov ebp, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
inc ecx
dec ecx
jo 0x41dd00
pushf
rol ebx, 0
neg ebx
neg ebx
popf
jno 0x41dcfb
jb 0x41dcfd
jno 0x41dd00
add eax, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
rol ebx, 0xa
ror ebx, 0xa
cmp esp, 0x2c74
test esp, 0x2432
and esp, 0xffffffff
jl 0x41dd84
ja 0x41dd81
jge 0x41dd84
mov ebp, 0x11903d83
inc ecx
add byte [eax], al
cmp dword [0x411190], 0
je 0x41dda1
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x411190]
push eax
call fcn.00438b78
mov dword [0x4111e4], eax
lea edi, [edi + 0x33c3]
lea edi, [edi - 0x33c3]
shr edx, 0
cmp esp, 0x7cdd
and esi, esi
jnp 0x41ddd0
xchg edx, edi
xchg edx, edi
lea edi, [edi + 0x5aa1]
lea edi, [edi - 0x5aa1]
jge 0x41ddcc
jp 0x41ddd0
mov esi, 0x6a0d6acc
add byte [ebp - 0x17ae0fb3], cl
xor byte [edx + 1], cl
add byte [ebx + 0x5e5f0cc4], al
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0043280d
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41e8fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0043280d
add esp, 0xc
lea ecx, [ecx + 0x2ded]
sub ecx, 0x2ded
call fcn.0041e928
Function at 0x422531
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
mov ax, word [0x40a5cc]
cmp eax, 1
jne 0x422552
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4226e2
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0043280d
add esp, 0xc
jmp 0x422564
cmp edi, edx
push edx
pop edx
jge 0x42256f
xchg edi, edi
jl 0x42256f
mov edx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
cmc
dec ecx
inc ecx
jo 0x4225a8
sub ebx, 0
jns 0x4225b8
jg 0x4225af
jo 0x4225b1
jge 0x4225b3
jnp 0x4225b5
js 0x4225b8
mov esp, 0x80e8558a
ljmp 0x458a
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
shr esi, 0
inc esi
dec esi
jae 0x42263a
pushf
neg ebx
neg ebx
test ecx, 0x73dc
popf
xchg esp, esp
jb 0x42263a
mov edx, 0x1c2bfe8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0043e8fe
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42264f
xor eax, eax
jmp 0x4226e2
xor eax, esi
xor eax, esi
test esi, 0x587d
jb 0x42265b
cmp ebx, dword [esp]
js 0x422666
jg 0x422662
jns 0x422666
mov esi, 0xe8558d92
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00438b78
mov dword [ebp - 4], eax
xor ecx, eax
xor ecx, eax
jmp 0x42267c
js 0x42267e
cmc
jns 0x422689
mov edx, edx
jge 0x422685
js 0x422689
mov ecx, 0x6a0d6a70
add byte [ebp - 0x17ae17b3], cl
ja 0x422695
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0043280d
add dword [eax], eax
add byte [ebx + 0x7d830cc4], al
cld
add byte [ebp + 4], dh
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4226a3
xor eax, eax
jmp 0x4226e2
rol edx, 0x1a
ror edx, 0x1a
add eax, 0
jo 0x4226c0
pushf
rol eax, 3
rol eax, 0x1d
clc
xchg esi, esi
popf
jmp 0x4226bd
jno 0x4226c0
mov edx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0041b3b3
add esp, 4
push edi
pop edi
and esp, 0xffffffff
shr esp, 0
jno 0x4226df
jl 0x4226d8
lea esp, [esp]
jo 0x4226df
call 0xfc982696
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42645c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0043280d
add esp, 0xc
lea eax, [eax + 0x7b4]
lea eax, [eax - 0x7b4]
test esi, 0x7415
jge 0x42649a
jo 0x42648b
lea ecx, [ecx + 0x5e2f]
lea ecx, [ecx - 0x5e2f]
jl 0x42649a
mov ecx, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cmp esp, 0x5906
jbe 0x4264d2
xor edx, dword [esp]
xor edx, dword [esp]
cmp ebx, edx
jp 0x4264f3
pushf
test dword [esp], ebx
jnp 0x4264e3
rol ebx, 0x12
rol ebx, 0xe
popf
lea esp, [esp]
jno 0x4264f0
jnp 0x4264f3
lcall 0x1e9, 0x80f04d8a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
lea esi, [esi + 0x23c3]
sub esi, 0x23c3
xchg ebx, ebx
jae 0x426574
pushf
shl esp, 0
cmp ebx, dword [esp]
js 0x42656d
popf
xchg edi, edi
jb 0x426574
call 0x1c5eb60
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.0043e8fe
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x426586
xor eax, eax
jmp 0x4265c9
jle 0x426588
cmp eax, ebx
cmp ebx, 0x4c8d
jl 0x4265a6
pushf
add ecx, 0
sub edx, 0
or edx, 0
jle 0x42659f
popf
mov ebx, ebx
jge 0x4265a6
lcall 0x4d8b, 0x50f0458d
cld
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00438b78
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0043280d
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4283a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0043280d
add esp, 0xc
jmp 0x4283c2
and ecx, ecx
not edi
not edi
je 0x4283d9
pushf
jbe 0x4283ce
popf
jno 0x4283d2
jnp 0x4283d4
js 0x4283d6
jne 0x4283d9
mov edx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
neg eax
neg eax
shr edx, 0
test dword [esp], eax
jae 0x42842f
pushf
mov esp, esp
popf
jp 0x428429
jbe 0x42842b
nop
jb 0x42842f
mov ebp, 0x80e84d8a
jmp 0xe8900c39
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.0042c19b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4284bb
xor eax, eax
jmp 0x428535
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00438b78
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0043280d
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x428533
jae 0x4284e3
lea esi, [esi]
add ecx, 0
jae 0x4284fa
pushf
rol esi, 0
jp 0x4284f1
popf
jl 0x4284f5
jmp 0x4284f7
jb 0x4284fa
or dword [ebx - 0x17af07bb], 0xffff2eb0
mov eax, dword [ebp - 8]
push eax
call fcn.0041b3b3
add esp, 4
test eax, ecx
xor eax, dword [esp]
xor eax, dword [esp]
nop
lea edi, [edi]
jne 0x428526
jb 0x428515
lea edx, [edx + 0x3558]
lea edx, [edx - 0x3558]
jae 0x428523
je 0x428526
mov esp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x428535
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42853e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0043280d
add esp, 0xc
js 0x428560
jo 0x42857b
pushf
jg 0x428566
and esp, 0xffffffff
add esp, 0
rol edi, 0x1b
ror edi, 0x1b
popf
ja 0x428576
ja 0x428578
jno 0x42857b
mov ebp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
test eax, edi
rol ecx, 3
ror ecx, 3
and ebx, ebx
jo 0x42863f
pushf
test esp, 0x54a8
popf
xchg ecx, eax
xchg ecx, eax
jno 0x42863f
ljmp 0x8900:0x162bae8
call fcn.0043e8fe
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x428654
xor eax, eax
jmp 0x4286fa
mov eax, eax
cmp edx, 0x1652
lea esp, [esp]
test dword [esp], ebx
jb 0x42867a
je 0x428666
lea ecx, [ecx + 0x1f48]
lea ecx, [ecx - 0x1f48]
jno 0x428674
jo 0x428676
jae 0x42867a
ljmp 0x8b52:0xe8558d03
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00438b78
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0043280d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4286a4
xor eax, eax
jmp 0x4286fa
push ebx
add ebx, 0x126a
ror ebx, 0x12
pop ebx
xor ebx, dword [esp + 8]
xor ebx, dword [esp + 8]
rol edi, 0
xor esp, 0
ja 0x4286d3
pushf
cmp ebx, dword [esp + 0xc]
cmp ebx, 0x45ec
popf
lea esi, [esi]
nop
jbe 0x4286d3
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0041b3b3
add esp, 4
mov esp, esp
jo 0x4286e3
ror eax, 0
jne 0x4286ef
jl 0x4286ea
je 0x4286ec
je 0x4286ef
mov esp, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x428a6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0043280d
add esp, 0xc
call 0x428a8a
lea esp, [esp + 4]
test dword [esp], edx
jo 0x428aae
pushf
or esi, 0
lea ebx, [ebx + 0x5e47]
sub ebx, 0x5e47
shr ecx, 0
popf
jle 0x428aab
jno 0x428aae
mov eax, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
jbe 0x428ae8
test ecx, 0x29e7
shr esp, 0
jge 0x428af3
jbe 0x428b0a
pushf
lea esi, [esi]
jnp 0x428afb
ror ecx, 2
ror ecx, 0x1e
jne 0x428b03
popf
mov esp, esp
ja 0x428b0a
call 0x812ad898
jmp 0xe8901314
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0042c19b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x428b90
xor eax, eax
jmp 0x428c14
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00438b78
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0043280d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x428c12
stc
je 0x428bcc
pushf
rol ecx, 3
rol ecx, 0x1d
popf
jb 0x428bc5
jle 0x428bc7
ja 0x428bc9
jne 0x428bcc
mov esi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0041b3b3
add esp, 4
stc
jno 0x428bdb
call 0x428be0
add esp, 4
jle 0x428bfd
pushf
neg esi
neg esi
ror ebx, 0x1b
rol ebx, 0x1b
xchg esi, eax
xchg esi, eax
jle 0x428bf5
popf
nop
xchg esp, esp
jg 0x428bfd
or dword [ebx - 0x74afebbb], 0x8b51104d
push ebp
or al, 0x52
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x428c14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10