joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4507d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450900
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
mov dword [ebp - 0x1c], 1
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 8
call fcn.00402a38
mov eax, 0x64
call fcn.00402e60
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 8
call fcn.00402a38
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 4
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x4b
cmp eax, edx
jge 0x450861
mov dword [ebp - 0x20], 1
jmp 0x4508e5
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x28], fcn.0044f3c4
mov dword [ebp - 0x2c], fcn.0044f4f0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, 0xf4240
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450907
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403e98
ret
Function at 0x45090c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450a72
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
mov eax, 0x64
call fcn.00402e60
mov dword [ebp - 0x20], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], 6
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 0xc]
add edx, 0x4b
cmp eax, edx
jge 0x45097e
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x450a57
mov dword [ebp - 0x28], 1
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov ecx, 8
call fcn.00402a38
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x28]
mov ecx, 4
call fcn.00402a38
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov ecx, 8
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x40370000
mov dword [ebp - 0x1c], 0x66666666
mov dword [ebp - 0x18], 0x400a6666
fld qword [ebp - 0x14]
fdiv qword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
wait
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, 4
call fcn.00402a38
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, 4
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x40370000
mov dword [ebp - 0x1c], 0x66666666
mov dword [ebp - 0x18], 0x400a6666
fld qword [ebp - 0x14]
fdiv qword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
wait
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x36
cmp eax, edx
jl 0x450a57
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450a79
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403e98
ret
Function at 0x4517cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451921
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, 4
call fcn.00402a38
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
mov ecx, 4
call fcn.00402a38
mov dword [ebp - 0x28], fcn.0044fa20
mov dword [ebp - 0x2c], fcn.0044e2dc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, 0x1f4
call fcn.00402a38
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
mov ecx, 4
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
mov eax, 0x64
call fcn.00402e60
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x20], 6
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x4b
cmp eax, edx
jge 0x4518e4
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x451906
mov dword [ebp - 0x24], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
mov ecx, 4
call fcn.00402a38
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451928
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403e98
ret
Function at 0x45192c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451a75
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
mov eax, 0x64
call fcn.00402e60
mov dword [ebp - 0x1c], eax
mov eax, 0x64
call fcn.00402e60
mov dword [ebp - 0x1c], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x4b
cmp eax, edx
jge 0x4519c4
mov dword [ebp - 0x20], 2
jmp 0x451a5a
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, 4
call fcn.00402a38
mov dword [ebp - 0x24], 1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 8
call fcn.00402a38
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
mov ecx, 4
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451a7c
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403e98
ret
Function at 0x451e8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451fec
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
mov dword [ebp - 0x1c], 1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
mov eax, 0x64
call fcn.00402e60
mov dword [ebp - 0x1c], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x4b
cmp eax, edx
jge 0x451f16
mov dword [ebp - 0x20], 2
jmp 0x451fd1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov ecx, 4
call fcn.00402a38
mov dword [ebp - 0x24], fcn.004502e4
mov dword [ebp - 0x28], fcn.0044fb28
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov ecx, 0x9c40
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ff3
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403e98
ret
Function at 0x452318
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452473
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, 4
call fcn.00402a38
mov eax, 0x64
call fcn.00402e60
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, 4
call fcn.00402a38
mov dword [ebp - 0x1c], 1
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x20], eax
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x5f
cmp eax, edx
jge 0x4523c2
mov dword [ebp - 0x24], 5
jmp 0x452458
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0x74bc6a7f
mov dword [ebp - 0x14], 0x40b29b93
fld qword [ebp - 0x18]
fdiv dword [0x452480]
fstp qword [ebp - 0x10]
wait
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, 4
call fcn.00402a38
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45247a
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403e98
ret
Function at 0x452804
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452943
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
mov dword [ebp - 0x1c], 1
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
mov ecx, 4
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, 4
call fcn.00402a38
mov dword [ebp - 0x28], fcn.0044f3c4
mov dword [ebp - 0x2c], fcn.0044f4f0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, 0xf4240
call fcn.00402a38
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 4
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x4b
cmp eax, edx
jge 0x4528ff
mov dword [ebp - 0x20], 1
jmp 0x452928
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
mov ecx, 4
call fcn.00402a38
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x24], 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45294a
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403e98
ret
Function at 0x453278
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453406
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
mov dword [ebp - 0x1c], 1
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
mov ecx, 4
call fcn.00402a38
mov dword [ebp - 0x28], fcn.0044e1e0
mov dword [ebp - 0x2c], fcn.0044f2b0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40120000
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, 0x2710
call fcn.00402a38
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, 4
call fcn.00402a38
mov eax, 0x64
call fcn.00402e60
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
mov ecx, 4
call fcn.00402a38
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 4
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x4b
cmp eax, edx
jge 0x45336c
mov dword [ebp - 0x20], 1
jmp 0x4533eb
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, 4
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 8
call fcn.00402a38
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45340d
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403e98
ret
Function at 0x453414
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453533
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 1
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x20], eax
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x5f
cmp eax, edx
jge 0x453477
mov dword [ebp - 0x24], 5
jmp 0x453518
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 8
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40370000
mov dword [ebp - 0x18], 0x66666666
mov dword [ebp - 0x14], 0x400a6666
fld qword [ebp - 0x10]
fdiv qword [ebp - 0x18]
fstp qword [ebp - 0x18]
wait
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, 0x64
call fcn.00402e60
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 8
call fcn.00402a38
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, 4
call fcn.00402a38
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45353a
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403e98
ret

Function at 0x4538c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4539f3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], eax
inc ebp
fmul dword [ebp + 0x4589dc45]
aam 0x8b
push ebp
aam 0x8b
inc ebp
fdivr dword [ecx + 4]
Function at 0x454168
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4542a2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov ecx, 8
call fcn.00402a38
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], 6
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 0xc]
add edx, 0x4b
cmp eax, edx
jge 0x4541dd
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x454287
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x40370000
mov dword [ebp - 0x1c], 0x66666666
mov dword [ebp - 0x18], 0x400a6666
fld qword [ebp - 0x14]
fdiv qword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
wait
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x40370000
mov dword [ebp - 0x1c], 0x66666666
mov dword [ebp - 0x18], 0x400a6666
fld qword [ebp - 0x14]
fdiv qword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
wait
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x36
cmp eax, edx
jl 0x454287
xor eax, eax
mov dword [ebp - 0x24], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x36
cmp eax, edx
jl 0x454287
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x40370000
mov dword [ebp - 0x1c], 0x66666666
mov dword [ebp - 0x18], 0x400a6666
fld qword [ebp - 0x14]
fdiv qword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
wait
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4542a9
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.00403e98
ret
Function at 0x4544b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4545fe
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
mov dword [ebp - 0x20], 1
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x28]
mov ecx, 4
call fcn.00402a38
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 0xc]
add edx, 0x4b
cmp eax, edx
jge 0x454519
mov dword [ebp - 0x24], 3
jmp 0x4545e3
xor eax, eax
mov dword [ebp - 0x24], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 8]
add edx, 0x36
cmp eax, edx
jl 0x4545e3
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x40370000
mov dword [ebp - 0x1c], 0x66666666
mov dword [ebp - 0x18], 0x400a6666
fld qword [ebp - 0x14]
fdiv qword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
wait
mov eax, 0x64
call fcn.00402e60
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x28]
mov ecx, 4
call fcn.00402a38
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x24]
mov ecx, 4
call fcn.00402a38
mov dword [ebp - 0x2c], fcn.0044e1e0
mov dword [ebp - 0x30], fcn.0044f2b0
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x40120000
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov ecx, 0x2710
call fcn.00402a38
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x40370000
mov dword [ebp - 0x1c], 0x66666666
mov dword [ebp - 0x18], 0x400a6666
fld qword [ebp - 0x14]
fdiv qword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
wait
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.004094a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454605
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403e98
ret