joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f542
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0044555f
add esp, 0xc
cmp ecx, 0x256b
xchg edi, ecx
xchg edi, ecx
ror ebx, 3
ror ebx, 0x1d
jg 0x42f572
lea edx, [edx]
jle 0x42f572
mov ebp, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
jg 0x42f5a4
cmp esp, 0x30d3
jl 0x42f5c1
pushf
dec ecx
inc ecx
xchg ebx, ebx
cmp esi, 0x6c60
popf
lea edi, [edi]
jo 0x42f5be
jge 0x42f5c1
ljmp 0x1e9:0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
xchg edx, edi
xchg edx, edi
and eax, 0xffffffff
ja 0x42f63c
pushf
rol edx, 9
rol edx, 0x17
popf
nop
jl 0x42f637
je 0x42f639
jbe 0x42f63c
add eax, 0x1605de8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x44569e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42f654
mov eax, 1
jmp 0x42f6fa
not edx
not edx
and ecx, 0xffffffff
rol esi, 0
shl eax, 0
jge 0x42f670
pushf
jne 0x42f667
popf
jle 0x42f66b
jle 0x42f66d
jl 0x42f670
mov ecx, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00445369
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0044555f
add esp, 0xc
rol ecx, 0x18
rol ecx, 8
rol edi, 0
jge 0x42f6b0
jge 0x42f69d
mov esp, esp
lea esi, [esi]
lea ecx, [ecx + 0x4a59]
lea ecx, [ecx - 0x4a59]
jl 0x42f6b0
call 0x12f7437
cmp dword [ebp - 0x14], 0
jne 0x42f6bd
mov eax, 1
jmp 0x42f6fa
jbe 0x42f6bf
push ebx
add ebx, 0x59ba
ror ebx, 0x11
pop ebx
cmp ebx, edx
jae 0x42f6d3
jne 0x42f6d0
jb 0x42f6d3
sub eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.0043101d
add esp, 4
inc ebx
dec ebx
jae 0x42f6f3
lea ebx, [ebx + 0x7187]
lea ebx, [ebx - 0x7187]
nop
jb 0x42f6f3
sub eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4354f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x41fa84], 1
jne 0x43566f
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044555f
add esp, 0xc
cmp edi, eax
jp 0x435531
pushf
xchg esp, esp
jge 0x435524
ror esp, 0
cld
popf
jbe 0x43552c
mov esp, esp
jnp 0x435531
xor eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
lea esi, [esi + 0x6918]
lea esi, [esi - 0x6918]
cmc
and esp, 0xffffffff
js 0x435578
js 0x435575
jns 0x435578
mov esi, 0x80e84d8a
jmp 0xe890dd82
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0044987a
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4355ed
xor eax, eax
jmp 0x4356c5
add edi, dword [esp]
sub edi, dword [esp]
jns 0x4355f5
test dword [esp + 8], ebx
jae 0x435609
pushf
js 0x4355ff
cmc
popf
jne 0x435604
jg 0x435606
jb 0x435609
mov eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00445369
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0044555f
add esp, 0xc
nop
jbe 0x43562c
jp 0x43562e
jns 0x435659
pushf
call 0x435637
add esp, 4
shl esp, 0
lea esi, [esi + 0x2b6]
sub esi, 0x2b6
call 0x43564e
add esp, 4
popf
lea esp, [esp]
js 0x435659
add dword [ebx + 0x7400f87d], 0xf8458b0a
cmp dword [ebp - 8], 0
je 0x435669
mov eax, dword [ebp - 8]
mov dword [0x41fa84], eax
jmp 0x43566d
xor eax, eax
jmp 0x4356c5
jmp 0x435678
mov ecx, dword [0x41fa84]
mov dword [ebp - 8], ecx
or edx, edx
xchg edi, esi
xchg edi, esi
jbe 0x43568f
pushf
jo 0x435684
shr esp, 0
popf
jbe 0x43568b
nop
ja 0x43568f
mov ebp, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
lea esp, [esp]
and eax, eax
call 0x43569f
lea esp, [esp + 4]
and ebx, 0xffffffff
je 0x4356ae
jae 0x4356aa
jne 0x4356ae
mov edi, 0xfc458bb0
mov eax, dword [ebp - 4]
push eax
call fcn.0043101d
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43ad26
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x41fa88], 1
jne 0x43ae84
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044555f
add esp, 0xc
jle 0x43ad4e
inc edi
dec edi
je 0x43ad5f
pushf
cmp eax, edx
popf
lea ebx, [ebx]
jl 0x43ad5c
jne 0x43ad5f
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
cmp esp, 0x3f47
shr esp, 0
jb 0x43adb7
lea esi, [esi + 0x6040]
lea esi, [esi - 0x6040]
jmp 0x43ada4
lea edi, [edi + 0x3c86]
lea edi, [edi - 0x3c86]
jge 0x43adb2
jae 0x43adb7
jmp 0x4dcdb465
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0044987a
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43ae24
mov eax, dword [ebp + 8]
jmp 0x43af13
jno 0x43ae26
jge 0x43ae28
test ecx, 0x2793
jbe 0x43ae49
pushf
rol eax, 0xe
rol eax, 0x12
popf
lea ebx, [ebx + 0x2365]
lea ebx, [ebx - 0x2365]
ja 0x43ae49
mov edx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00445369
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0044555f
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x43ae7a
mov edx, dword [ebp - 8]
mov dword [0x41fa88], edx
jmp 0x43ae82
mov eax, dword [ebp + 8]
jmp 0x43af13
jmp 0x43ae8c
mov eax, dword [0x41fa88]
mov dword [ebp - 8], eax
push edx
pop edx
rol esp, 0
jnp 0x43ae93
jp 0x43ae95
jo 0x43aeac
pushf
rol esp, 0
call fcn.0043aea1
Function at 0x43af9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044555f
add esp, 0xc
shr esi, 0
lea ebx, [ebx]
jnp 0x43afbf
jl 0x43afbc
jp 0x43afbf
call 0x4733f589
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
add esp, 0
push eax
add eax, 0x7dac
ror eax, 0x1b
pop eax
jo 0x43b006
xchg esp, esp
jp 0x43b002
jno 0x43b006
add eax, 0xf04d8adf
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
xchg edx, ecx
xchg edx, ecx
je 0x43b06c
jno 0x43b07e
lea edi, [edi + 0x5b1f]
lea edi, [edi - 0x5b1f]
jo 0x43b07e
lcall 0, 0xe7f7e865
call fcn.0044987a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43b090
xor eax, eax
jmp 0x43b0c1
xchg ebx, ebx
cmp esi, dword [esp]
jb 0x43b09e
jb 0x43b099
lea ebx, [ebx]
jae 0x43b09e
mov ebx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00445369
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0044555f
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e4b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044555f
add esp, 0xc
ror ecx, 0x1c
ror ecx, 4
clc
jb 0x43e4fc
pushf
test ebx, esi
call 0x43e4e9
add esp, 4
cld
test dword [esp + 0x10], edx
popf
je 0x43e4f5
lea ebx, [ebx]
jb 0x43e4f9
jae 0x43e4fc
mov esp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
test eax, edi
add eax, 0
jae 0x43e5d1
pushf
mov esp, esp
not ebx
not ebx
call 0x43e5b9
add esp, 4
popf
jnp 0x43e5c0
lea eax, [eax + 0x4f9f]
lea eax, [eax - 0x4f9f]
jb 0x43e5ce
jb 0x43e5d1
sub eax, 0xb2a4e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 4], dh
call fcn.0044987a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43e5e3
xor eax, eax
jmp 0x43e662
nop
jnp 0x43e5fa
pushf
cld
test esp, 0x3890
popf
jae 0x43e5f3
mov edi, edi
jno 0x43e5f7
jp 0x43e5fa
lcall 0x458b, 0x52e8558d
clc
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00445369
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0044555f
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x43e624
xor eax, eax
jmp 0x43e662
jl 0x43e626
lea esi, [esi + 0x705d]
sub esi, 0x705d
je 0x43e63b
xchg ecx, ecx
jl 0x43e638
jne 0x43e63b
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0043101d
add esp, 4
and esp, 0xffffffff
js 0x43e657
jp 0x43e64e
jne 0x43e650
jo 0x43e652
ja 0x43e654
jns 0x43e657
or dword [ebx - 0x74aff3bb], 0xff51084d
push ebp
cld
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44081d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044555f
add esp, 0xc
or esi, esi
jno 0x440846
pushf
add ecx, 0
popf
mov eax, eax
jo 0x440846
mov esp, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
xor eax, ecx
xor eax, ecx
shr esp, 0
jle 0x440887
ja 0x440881
jg 0x440883
jg 0x440887
jmp 0xec9192d2
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0044987a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4408f9
xor eax, eax
jmp 0x440976
shr esp, 0
xor ecx, 0x7944
xor ecx, 0x7944
test esi, edx
jae 0x440913
nop
jo 0x44090f
jb 0x440913
mov edi, 0xec458d7d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00445369
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0044555f
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x44093d
xor eax, eax
jmp 0x440976
jle 0x44093f
jns 0x44094a
jnp 0x440943
xchg ebx, edx
xchg ebx, edx
js 0x44094a
mov ebp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0043101d
add esp, 4
ror esi, 0x1c
ror esi, 4
neg edi
neg edi
shl esi, 0
jno 0x44096f
mov esp, esp
jne 0x440969
jne 0x44096b
jo 0x44096f
mov eax, 0x84d8bc1
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x442e86
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0044555f
add esp, 0xc
push ebx
add ebx, 0x6923
ror ebx, 9
pop ebx
neg esi
neg esi
jno 0x442eb0
add ebx, 0x28b1
sub ebx, 0x28b1
jae 0x442ed6
pushf
add eax, 0x43be
sub eax, 0x43be
stc
jbe 0x442ecd
popf
jne 0x442ed1
xchg ecx, eax
xchg ecx, eax
jb 0x442ed6
lcall 0x45c6, 0x7aec45c6
call 0xe989f529
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
je 0x442f10
xchg ebx, ebx
jge 0x442f25
pushf
jp 0x442f18
cld
std
cld
cmp eax, dword [esp]
popf
jge 0x442f22
jl 0x442f25
lcall 0x1e9, 0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
and edx, edx
jge 0x442fa0
jmp 0x442f9c
jl 0x442fa0
mov eax, 0x68d5e85e
add byte [eax], al
call fcn.0044987a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x442fb3
jmp 0x44303b
mov esp, esp
jns 0x442fcd
pushf
jbe 0x442fbb
jmp 0x442fbd
nop
not ebx
not ebx
popf
je 0x442fc6
jmp 0x442fc8
xchg esp, esp
js 0x442fcd
add eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00445369
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0044555f
add esp, 0xc
ror ecx, 0
add esp, 0
jns 0x443001
pushf
jbe 0x442ff9
popf
nop
jo 0x442ffe
js 0x443001
mov ecx, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x443009
jmp 0x44303b
std
cld
neg esi
neg esi
jg 0x443011
jns 0x44301a
jg 0x443015
mov edx, edx
js 0x44301a
xor eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0043101d
add esp, 4
sub esp, 0
lea ebx, [ebx]
jae 0x443034
jno 0x44302f
jp 0x443031
jb 0x443034
ljmp 0x55ff:0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4498cb
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x4210c8
call fcn.004464b1
add esp, 0xc
mov byte [0x4210c8], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x40c4a4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c31c
mov eax, dword [0x469c04]
cmp byte [eax], 0
je 0x40c520
mov eax, dword [0x4699fc]
call fcn.004030bc
call fcn.00402e70
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004094e8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c568
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c556
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4699a0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46c7f8]
call fcn.00405b28
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40ce08
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cede
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004047b8
lea eax, [ebp - 4]
call fcn.00404c34
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404be4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40cec8
mov eax, ebx
call fcn.00402d14
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cec1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404be4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40ceab
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cef0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40ceab
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cec8
mov eax, dword [ebp - 0x10]
call fcn.00402d30
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cee5
lea eax, [ebp - 4]
call fcn.00404720
ret
Function at 0x41ee10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x46d304
cmp dword [edi], 0
jne 0x41ee8c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x46d300]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x468ae8
mov ecx, 2
call fcn.00402f04
mov edx, 0x41ede8
lea eax, [esi + 5]
call fcn.0041ee08
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041ee08
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41ee61
mov dword [0x46d300], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4213c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404be4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x421418
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x469d3c]
mov dl, 1
mov eax, dword [0x420ee4]
call fcn.0040c670
call fcn.00404168
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00420fec
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x422648
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42264e
ret