joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a4d5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
lea eax, [ebp - 4]
push edi
push eax
push 0x20019
push 0
push 0x1002e44
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100a53a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x20a
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1002e2c
mov dword [ebp - 0xc], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x100a53e
xor eax, eax
jmp 0x100a550
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
call sub.MFC42u.DLL_CString::operator
push 1
pop eax
pop edi
leave
ret 4

Function at 0x100a9f2
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x100cca0
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x1c]
call sub.MFC42u.DLL_CString::CString
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.0100abae
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::CString
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push ebx
push 0x10035e8
push eax
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::CString
mov edi, 0x3e8
lea ecx, [ebp - 0x10]
push edi
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::GetBuffer
push dword [ebp - 0x1c]
push edi
push eax
push 0x1001874
push 0x10035d8
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::ReleaseBuffer
push 0x10035c8
lea ecx, [ebp - 0x14]
call sub.MFC42u.DLL_CString::CString_1
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea eax, [esi + 0x130]
push eax
lea eax, [ebp + 8]
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.0100b582
call sub.MFC42u.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42u.DLL_CCmdTarget::BeginWaitCursor
xor eax, eax
lea ecx, [esi + 0xe4]
push eax
push eax
push eax
push eax
push dword [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.0100aef8
lea eax, [ebx + 1]
cmp eax, dword [esi + 0x124]
jle 0x100aae8
push 1
pop eax
lea edi, [esi + 0x12c]
xor ecx, ecx
cmp eax, dword [edi]
setne cl
push ecx
lea ecx, [esi + 0xa0]
call sub.MFC42u.DLL_CWnd::EnableWindow
xor eax, eax
cmp ebx, dword [edi]
lea ecx, [esi + 0x60]
setne al
push eax
call sub.MFC42u.DLL_CWnd::EnableWindow
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42u.DLL_CCmdTarget::EndWaitCursor
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0100b582
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0100b582
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0100b582
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0100b582
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x100abae
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x100ccb4
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x21c
lea eax, [ebp - 0x14]
push edi
push eax
push 0x20019
push 0
push 0x1002e44
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ac67
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x20a
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x1002e2c
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100ac67
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::CString
and dword [ebp - 4], edi
push 0xef2a
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::LoadStringW
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x228]
push eax
call sub.MFC42u.DLL_CString::operator
mov ecx, dword [ebp + 8]
push 0x5c
call fcn.0100b85e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call sub.MFC42u.DLL_CString::operator_1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0100b582
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x100ac76
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push 1
call sub.MFC42u.DLL_CWnd::UpdateData
mov eax, dword [esi + 0xe0]
xor ebx, ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20006
mov edi, 0x1002b1c
push ebx
mov esi, 0x80000001
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x100acd4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push 0x1001874
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x100acf4
lea eax, [ebp - 8]
push 4
push eax
push 4
push ebx
push 0x10035f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100ad1b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 1
pop esi
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1002b1c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ad79
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10035f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100ad70
mov esi, dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x100bae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003788
push 0x100bdc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
or ebx, 0xffffffff
mov dword [0x1010594], ebx
mov dword [0x1010598], ebx
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x1010584]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x1010580]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x1010590], ecx
call fcn.0100bdb0
mov eax, dword [0x1010420]
test eax, eax
jne 0x100bb6c
push 0x100bda0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.0100bd80
push 0x101001c
push 0x1010018
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x101057c]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x1010578]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___wgetmainargs]
add esp, 0x14
push 0x1010014
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.dll__wcmdln]
mov esi, dword [edx]
test esi, esi
jne 0x100bbde
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x74], esi
cmp word [esi], 0x22
jne 0x100bcb7
add esi, 2
mov dword [ebp - 0x74], esi
mov ax, word [esi]
test ax, ax
je 0x100bbff
cmp ax, 0x22
jne 0x100bbeb
cmp word [esi], 0x22
jne 0x100bc0b
add esi, 2
mov dword [ebp - 0x74], esi
mov ax, word [esi]
test ax, ax
je 0x100bc21
cmp ax, 0x20
ja 0x100bc21
add esi, 2
mov dword [ebp - 0x74], esi
jmp 0x100bc0b
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x30], 1
je 0x100bc42
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x100bc47
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
add esp, 4
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [esi], 0x20
jbe 0x100bc0b
add esi, 2
mov dword [ebp - 0x74], esi
jmp 0x100bcb7
Function at 0x4ee4a3
Capabilities:
Encode data using xor

Disassembly:
or al, 0xbc
mov byte [ebp - 0xaf3b26], dh
or al, 0x77
invalid
mov eax, 0x88975d09
jne 0x4ee501
mov byte [ebp + 0x57], dh
js 0x4ee488
movsb byte es:[edi], byte [esi]
sub al, 3
add eax, 0x30f6fc67
pop ecx
test ah, dl
lodsd eax, dword [esi]
lodsb al, byte [esi]
mov bh, 0xdb
dec edx
xor dword [ebx - 0x7b0b84dc], edi
jns 0x4ee4a7
push esp
dec eax
push 0xcada2f5b
imul ebx, dword [ecx], 0x72dfacf8
cmp ch, byte [ecx - 0x13a48e8e]
in eax, dx
call 0x65eb1127
jp 0x4ee53b
mov al, 0x26
fabs
mov bl, byte [ecx + 0xfb9d6a8]
mov dword [edi + 0x78e469a4], eax
and al, 0xf
xor dword [eax + 0x79], ebx
jns 0x4ee4e4
cdq
test al, 0xd6
mov ecx, 0xa784890f
movsb byte es:[edi], byte [esi]
imul esp, esp, 0x310f2478
pop eax
jns 0x4ee56f
in eax, dx
xor al, 0xe7
xchg ecx, eax
xchg ebp, eax
loope 0x4ee572
insd dword es:[edi], dx
push 0xcf0b1cef
or ecx, edi
cmp dword [ecx + 0x23ea6589], edx
and eax, 0xb7d0c885
xor dword [ebp + 0x54cc31d], ecx
or eax, 0x121475b1
cmc
dec edx
pop ecx
add eax, 0xb5160971
invalid
jg 0x4ee564
fist word [eax + ecx*4]
dec cx
mov ebp, dword [eax - 0x7aef863a]
leave
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
mov esp, 0xb9a7117a
jo 0x4ee585
sub dword [eax], 0x6e
pop ecx
sbb al, 0x8a
adc dword [esi + 0xe9e6bd4], edx
xchg ebp, edi
sbb eax, esp
stc
ret
js 0x4ee585
push ebx
xchg ebx, ebx
in al, 0x9a
pop ecx
and eax, 0x9976cc10
mov ecx, 0x9f1090b4
add al, 0x21
hlt
and esp, esi
pop eax
xor eax, 0x49c0223
pushfd
add al, 0x63
mov bh, 0x98
mov esi, 0xf6cae4e8
invalid

Function at 0x58e477
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x5c
invalid
cmp byte [eax], 0x59
sub dl, cl
enter 0xffffffffffffccfb, 0x55
jno 0x58e4b4
xlatb
adc al, 0x6e
push edi
jae 0x58e4eb
or cl, byte [ecx + 0x2b]
dec esi
test al, 0x5e
and al, 0xae
je 0x58e426
mov es, word fs:[eax - 0x46ee39ce]
jg 0x58e4c6
arpl word [ebx + edx*8 + 0x8f62399], si
in al, 0x7f
adc eax, 0x14a8b2d2
mov edi, 0x775d53ff
lds edx, [ebx - 0x5c]
mov dl, 0xa8
adc al, 0xbf
call dword [ebx + 0x5d]
ja 0x58e467
push ebx
movsb byte es:[edi], byte [esi]
dec eax
fsubr qword [esi]
rol byte [edi + edi*8 + 0x6c90408b], cl
lodsd eax, dword [esi]
xor dword [esi - 0x47], esp
dec esp
out dx, eax
mov edi, dword [eax - 0x31]
stosd dword es:[edi], eax
inc esi
jl 0x58e499
dec eax
hlt
sal dword [ebx + 0x683502fb], cl
mov al, 0x1b
invalid
push 0xd3c41bb0
lahf
popal
into
xor dword [0x593e7ed0], edx
ret
xchg ebp, eax
and eax, edi
pop esi
test word [edx - 0x11], 0x790
nop
pop es
mov eax, 0x9414a12a
sbb byte [ebp + 0x7e], 0x8b
outsb dx, byte [esi]
dec esp
mov ebx, 0x3e46d8c7
wait
xchg esi, eax
jns 0x58e4c1
jb 0x58e4e3
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x40221f
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ce99d
jg 0x402243
inc edi
cmp edi, 0x1f6502b0
jl 0x40222b
cmp dword [0x431e1c], 0x400
jne 0x40229c
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [0x41e160]
push esi
call dword [0x41e170]
push 0x41fb08
push esi
call dword [0x41e004]
push esi
push esi
call dword [section..rdata]
push str.digehogacisicaxafoxanet
push esi
call fcn.004025de
push esi
push esi
call fcn.00402734
push esi
call fcn.004027e1
push esi
call fcn.004027f0
add esp, 0x18
xor edi, edi
cmp edi, 0xd0fe
jge 0x4022ad
push esi
call dword [0x41e164]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x58bc6e
jg 0x4022cc
inc edi
cmp edi, 0xe52f
jl 0x40229e
mov eax, dword [0x421eb4]
mov dword [0x431e1c], eax
call fcn.00402004
mov edi, 0x3078f
cmp dword [0x431e1c], 0x51f
jne 0x4022f8
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x4022e0
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10
Function at 0x40768e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x421b90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403a46
and dword [ebp - 0x14], 0
cmp dword [0x42c9dc], 0
mov dword [ebp - 0x18], eax
jne 0x407741
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4077e9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4077e9
mov esi, dword [0x41e088]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c9dc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c9e0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42c9e4], eax
call edi
push eax
call esi
mov dword [0x42c9ec], eax
test eax, eax
je 0x407741
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c9e8], eax
mov eax, dword [0x42c9e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x41e084]
cmp eax, ecx
je 0x40779a
cmp dword [0x42c9ec], ecx
je 0x40779a
push eax
call esi
push dword [0x42c9ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40779a
test ebx, ebx
je 0x40779a
call edi
test eax, eax
je 0x407791
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407791
test byte [ebp - 8], 1
jne 0x40779a
or dword [ebp + 0x10], 0x200000
jmp 0x4077cd
mov eax, dword [0x42c9e0]
cmp eax, dword [ebp - 0x18]
je 0x4077cd
push eax
call esi
test eax, eax
je 0x4077cd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4077cd
mov eax, dword [0x42c9e4]
cmp eax, dword [ebp - 0x18]
je 0x4077cd
push eax
call esi
test eax, eax
je 0x4077cd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c9dc]
call esi
test eax, eax
je 0x4077e9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4077eb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040614e
leave
ret
Function at 0xa99b43
Capabilities:
Encode data using xor

Disassembly:
dec esi
xchg esp, eax
cmpsb byte [esi], byte es:[edi]
dec si
imul eax, dword [ebx + 0x4c], 0x68
jae 0xa99b6b
push 0xa3774744
xchg ebx, eax
mov esi, 0xcce98f82
xchg edi, eax
in al, dx
call [esi - 0x600aae89]
sub dword [edx], eax
and byte [edi], al
xchg edi, eax
in al, dx
pushfd
lea esp, [esp + 0x30]
je 0xd15da2
push 0xbf0a4f8a
add eax, edi
pushfd
test dl, cl
pushfd
pushfd
cmp eax, edx
pushal
call fcn.00a9be99
pop esp
out 0xf, al
dec edi
in eax, dx
pop esp
in eax, 0x8b
xchg ebp, eax
dec eax
cli
mov bl, 0xc7
arpl word [edi + ecx + 0x49d25b2], ax
stosb byte es:[edi], al
add eax, 0x3d9a37b2
sbb dword [eax], 0xffffffbe
or dword [edx + 0x50915c7c], ebp
push 0x55
lcall 0x17f3, 0x560f5b31
cmp esi, edi
or eax, 0x6696e747
js 0xa99bdc
jp 0xa99b1f
jle 0xa99b66
stosd dword es:[edi], eax
xlatb
iretd
outsd dx, dword [esi]
sbb dh, byte [edx]
jl 0xa99bfc
adc eax, 0x7f1a9890
mov ebx, 0xf99abaf
cli
push esp
mov ebp, 0xc1d9527a
or eax, 0x1cbb52b
retf 0x2f32
pop ss
xor byte es:[eax + ebx*4 + 0x65], ch
aad 0x23
cwde
aad 0x23
popal
adc eax, 0x36de735
adc eax, 0x1420fa78
and eax, 0x8bb83409
stosd dword es:[edi], eax
dec edi
jno 0xa99c80
invalid
pop esp
stosd dword es:[edi], eax
sub byte [ecx + 0x7a117f75], ah
mov dword [ecx + 0x45], esp
mov ah, 0xfc
jbe 0xa99c00
sets bh
dec esp
or al, 0xb7
adc ch, byte [ebp - 0x52d36fe1]
adc cl, byte [edi + 0x110b352e]
dec ecx
stc
adc dword [ecx - 7], ecx
daa
or byte [ebp - 0x48ff5920], ch
push ds
mov cl, 0xe
xchg edi, eax
xor esi, dword [edx - 0x7a]
call 0x5f77844
stosd dword es:[edi], eax
pop esi
sub dl, byte [ebp + 0x18df6735]
push 0xe1f804d9
imul ebp, dword [ebx - 0x4b], 0x5b
mov esp, 0xae5d0b4d
rcr bl, 0x4d
add eax, 0x952a5eab
xor eax, 0x6818df67
fld dword [eax + edi*8]
loope 0xa99cfd
imul esi, dword [ebp + 0xb4dbc5b], 0x5d
scasb al, byte es:[edi]
push 0x48
jp 0xa99c6e
imul edx, edx, 0x75ced075
pop eax
je 0xa99c4e
invalid
pushal
cmp eax, 0xeab60eb1
push ebp
in eax, dx
sub al, 0x8f
xor edx, 0x2c5b7bb3
push edx
test dword [edx], edi
sbb byte [ebx], 0xb9
nop
add byte [edi], dl
xor eax, 0x1b213ea
cmpsd dword [esi], dword es:[edi]
hlt
Function at 0xd1bb17
Capabilities:
Authenticate hmac

Disassembly:
bt bp, di
add eax, edi
cmc
clc
cmp al, bl
cmc
cmp eax, edx
pushfd
lea esp, [esp + 4]
jb 0xd15db1
pushfd
cmp eax, dword [ebp - 0x10]
call fcn.00d1d68a
dec edi
dec esi
imul eax, dword [ebx], 0xffffffc1
xchg ebp, eax
pop esp
jae 0xd164fc
rol dword [esi - 5], 0x7d
test byte [0x29a40782], dh
xchg dword [eax], ebp
invalid
popfd
xchg ebx, eax
sal dl, 0x5a
and edx, ecx
les edx, [edi - 0x3e98f25b]
add eax, 0xb498250f
mov dh, 0x77
in eax, 0x2a
or byte [ebp - 0x3a378e36], bh
pop edi
in eax, 0x1c
cli
inc esp
adc al, 0x79
adc dh, byte [ebx + edx - 0x6fd76217]
lahf
sbb esi, dword [eax]
adc dh, byte [0x405975a3]
je 0xd16590
outsd dx, dword [esi]
mov ebx, 0x91b4929d
mov cl, 0xa6
xchg esp, eax
dec esi
insb byte es:[edi], dx
lahf
in al, dx
inc ebp
inc edx
loope 0xd165fb
aaa
mov cl, 0xbc
sahf
movsb byte es:[edi], byte [esi]
lds ebp, [edi - 0x38]
bound ebp, qword [esi + ecx*8]
mov ebp, 0x6b7d9e3d
push edx
fbld tbyte es:[ebx + 0x5f]
in eax, dx
retf 0xddfa
jl 0xd1664f
inc ebp
jnp 0xd1663a
fnsave dword [ebx - 0x60]
enter 0xffffffffffff95c3, 0x5c
invalid
mov cl, 0x67
inc ebp
dec esp
popal
hlt
inc ebp
imul esp, dword [0xd7d5aaf7], 0xffffffd7
push ds
or byte [esi - 0x43], dh
pop es
cmp eax, 0x56e7a19
cmpsd dword [esi], dword es:[edi]
mov al, 0x8a
dec ebx
sub ch, ch
push ebp
shl ebx, cl
hlt
test edi, edi
push 0xb507998a
lea esp, [esp + 0x3c]
je 0xd15da2
test di, si
jmp 0xd16462
Function at 0x440b6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e97
add esp, 0xc
jno 0x440b87
xchg esi, ebx
xchg esi, ebx
stc
jg 0x440b95
jno 0x440b90
xchg ebx, ebx
jle 0x440b95
call 0x5430515f
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
cld
ror esi, 0x14
rol esi, 0x14
jne 0x440bdf
xchg ebx, eax
xchg ebx, eax
je 0x440bdf
mov eax, 0x80ec4d8a
jmp 0xec9193e9
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.004423e4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x440c6c
jmp 0x440cf3
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0044ec8a
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x440cf3
and edi, edi
jb 0x440c96
call fcn.00440c9b
Function at 0x444f55
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e97
add esp, 0xc
test edi, 0x6f57
rol edx, 0x13
rol edx, 0xd
jns 0x444f83
jge 0x444f92
pushf
mov esp, esp
popf
jns 0x444f8d
jo 0x444f8f
jl 0x444f92
mov esi, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004423e4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44505a
xor eax, eax
jmp 0x4450d9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0044ec8a
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x445084
xor eax, eax
jmp 0x4450d9
ror esp, 0
jb 0x445089
ja 0x4450a1
lea esp, [esp]
lea esi, [esi + 0x1c01]
lea esi, [esi - 0x1c01]
jl 0x44509c
jb 0x44509e
jbe 0x4450a1
call 0x512c9630
mov eax, dword [ebp - 0x18]
push eax
call fcn.0044cd1d
add esp, 4
js 0x4450af
lea ecx, [ecx + 0x5183]
sub ecx, 0x5183
lea eax, [eax]
jg 0x4450ce
pushf
rol ebx, 5
rol ebx, 0x1b
popf
mov edi, edi
jle 0x4450ce
add eax, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8