joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ccac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x790073
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x60]
push 1
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x53005c
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x730079
push eax
mov dword [ebp - 0x50], 0x650074
mov dword [ebp - 0x4c], 0x52006d
mov dword [ebp - 0x48], 0x6f006f
mov dword [ebp - 0x44], 0x5c0074
mov dword [ebp - 0x3c], 0x740073
mov dword [ebp - 0x38], 0x6d0065
mov dword [ebp - 0x34], 0x320033
mov dword [ebp - 0x30], 0x64005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x63005c
mov dword [ebp - 0x1c], 0x61006c
mov dword [ebp - 0x18], 0x730073
mov dword [ebp - 0x14], 0x6e0070
mov dword [ebp - 0x10], 0x2e0070
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x43cd8a
push ebx
push edi
push esi
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
call fcn.00405020
cmp al, 1
jne 0x43cd82
mov bl, al
push dword [ebp - 0x5c]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x43e470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, 0x730079
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x58], 0x53005c
mov edx, 0x790073
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], 0x650074
mov dword [ebp - 0x4c], 0x52006d
mov dword [ebp - 0x48], 0x6f006f
mov dword [ebp - 0x44], 0x5c0074
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x740073
mov dword [ebp - 0x38], 0x6d0065
mov dword [ebp - 0x34], 0x320033
mov dword [ebp - 0x30], 0x64005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x730072
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x43e521
mov dword [ebp - 0x20], 0x66005c
mov dword [ebp - 0x1c], 0x730061
mov dword [ebp - 0x18], 0x660074
mov dword [ebp - 0x14], 0x740061
mov dword [ebp - 0x10], 0x73002e
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
jmp 0x43e56e
cmp eax, 2
jne 0x43e547
mov dword [ebp - 0x20], 0x6e005c
mov dword [ebp - 0x1c], 0x660074
mov dword [ebp - 0x18], 0x2e0073
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x73
jmp 0x43e56e
cmp eax, 1
jne 0x43e56e
mov dword [ebp - 0x20], 0x65005c
mov dword [ebp - 0x1c], 0x660078
mov dword [ebp - 0x18], 0x740061
mov dword [ebp - 0x14], 0x73002e
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ebx
push 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00439b16
test eax, eax
jne 0x43e5a1
push ebx
push edi
push esi
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
call fcn.00405020
cmp al, 1
jne 0x43e599
mov bl, al
push dword [ebp - 0x5c]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43e5b6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x4b47
call fcn.004355f2
push 0x4b44
mov dword [ebp - 0x34], eax
call fcn.004355f2
push 0x4b4d
mov dword [ebp - 0x38], eax
call fcn.004355f2
mov esi, eax
push 0x4a8a
mov dword [ebp - 0x40], esi
call fcn.004355f2
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
test ecx, ecx
je 0x43e741
cmp dword [ebp - 0x38], ebx
je 0x43e741
test esi, esi
je 0x43e741
test eax, eax
je 0x43e741
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x2c], 0x46005c
mov dword [ebp - 0x28], 0x6c0069
mov dword [ebp - 0x24], 0x530065
mov dword [ebp - 0x20], 0x730079
mov dword [ebp - 0x1c], 0x650074
mov dword [ebp - 0x18], 0x5c006d
cmp eax, 2
jne 0x43e66d
mov dword [ebp - 0x14], 0x74004e
mov dword [ebp - 0x10], 0x730066
mov dword [ebp - 0xc], ebx
jmp 0x43e6a9
test eax, eax
jne 0x43e68f
mov dword [ebp - 0x14], 0x610046
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x610066
mov dword [ebp - 8], 0x74
jmp 0x43e6a9
cmp eax, 1
jne 0x43e6a9
mov dword [ebp - 0x14], 0x780065
mov dword [ebp - 0x10], 0x610066
mov dword [ebp - 0xc], 0x74
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call ecx
push 0xd
call fcn.00477546
mov byte [ebp - 0x34], al
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x3c]
push ebx
push ebx
push dword [eax]
lea eax, [ebp - 0x48]
push ebx
push ebx
push 0x40
push eax
call dword [ebp - 0x38]
push dword [ebp - 0x34]
mov esi, eax
push 0xd
call fcn.0047769a
test esi, esi
js 0x43e741
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x43e741
cmp byte [edi], bl
jne 0x43e706
mov eax, dword [edi + 0xc]
test eax, eax
je 0x43e73c
mov edx, dword [edi + 4]
cmp edx, 0x1b
ja 0x43e73c
push eax
lea eax, [ecx + 0x38]
lea eax, [eax + edx*4]
jmp 0x43e733
mov esi, dword [ecx + 0x28]
test esi, esi
je 0x43e73c
mov ebx, dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
push esi
call ebx
cmp al, 1
jne 0x43e739
lea eax, [esi + 0x6f]
push eax
call ebx
cmp al, 1
jne 0x43e739
mov eax, dword [edi + 4]
cmp eax, 0x1b
jae 0x43e739
push dword [edi + 0xc]
inc eax
lea eax, [esi + eax*4]
push eax
call fcn.004822a6
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x40]
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 4
Function at 0x43ed4a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x914
mov dword [ebp - 0x54], 0x53005c
mov dword [ebp - 0x50], 0x730079
mov dword [ebp - 0x4c], 0x650074
mov dword [ebp - 0x48], 0x52006d
mov dword [ebp - 0x44], 0x6f006f
mov dword [ebp - 0x40], 0x5c0074
mov dword [ebp - 0x3c], 0x790073
mov dword [ebp - 0x38], 0x740073
mov dword [ebp - 0x34], 0x6d0065
mov dword [ebp - 0x30], 0x320033
mov dword [ebp - 0x2c], 0x64005c
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x730072
call fcn.004355f2
mov dword [ebp - 0xc], 0x790073
mov dword [ebp - 8], 0x73
cmp eax, 0x1770
jae 0x43ee04
mov dword [ebp - 0x1c], 0x66005c
mov dword [ebp - 0x18], 0x640074
mov dword [ebp - 0x14], 0x730069
mov dword [ebp - 0x10], 0x2e006b
jmp 0x43ee20
mov dword [ebp - 0x1c], 0x76005c
mov dword [ebp - 0x18], 0x6c006f
mov dword [ebp - 0x14], 0x67006d
mov dword [ebp - 0x10], 0x2e0072
push 1
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00439b16
test eax, eax
jne 0x43ee53
push ebx
push edi
push esi
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
call fcn.00405020
cmp al, 1
jne 0x43ee4b
mov bl, al
push dword [ebp - 0x58]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x43f24e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0x914
call fcn.004355f2
cmp eax, 0x2800
jae 0x43f26b
call fcn.0043f27e
pop ebp
ret 8
cmp dword [ebp + 8], 0
je 0x43f267
cmp dword [ebp + 0xc], 0
je 0x43f267
pop ebp
jmp fcn.0043f2d0

Function at 0x43fe4a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x44005c
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x5c0072
mov dword [ebp - 0x18], 0x380069
mov dword [ebp - 0x14], 0x340030
mov dword [ebp - 0x10], 0x700032
mov dword [ebp - 0xc], 0x740072
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x4400a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x790073
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x60]
push 1
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x53005c
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x730079
push eax
mov dword [ebp - 0x50], 0x650074
mov dword [ebp - 0x4c], 0x52006d
mov dword [ebp - 0x48], 0x6f006f
mov dword [ebp - 0x44], 0x5c0074
mov dword [ebp - 0x3c], 0x740073
mov dword [ebp - 0x38], 0x6d0065
mov dword [ebp - 0x34], 0x320033
mov dword [ebp - 0x30], 0x64005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x69005c
mov dword [ebp - 0x1c], 0x300038
mov dword [ebp - 0x18], 0x320034
mov dword [ebp - 0x14], 0x720070
mov dword [ebp - 0x10], 0x2e0074
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x440182
push ebx
push edi
push esi
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
call fcn.00405020
cmp al, 1
jne 0x44017a
mov bl, al
push dword [ebp - 0x5c]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x440664
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push 0x20
mov byte [ebp - 1], 0
call fcn.004355f2
mov esi, eax
push 0x21
mov dword [ebp - 0x18], esi
call fcn.004355f2
mov ebx, eax
test esi, esi
je 0x440708
test ebx, ebx
je 0x440708
mov ecx, dword [esi + 0x3c]
add ecx, esi
xor edx, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
push edi
mov eax, dword [ecx + 0x34]
mov dword [ebp - 0x14], eax
movzx eax, word [ecx + 6]
mov dword [ebp - 0x10], eax
test edx, edx
jne 0x4406b8
and dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0x54494e49
jmp 0x4406c6
mov dword [ebp - 0x20], 0x7461642e
mov dword [ebp - 0x1c], 0x61
movzx eax, word [ecx + 0x14]
lea esi, [ecx + 0x18]
xor edi, edi
add esi, eax
cmp dword [ebp - 0x10], edi
jbe 0x4407b3
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0047d634
test eax, eax
je 0x440711
inc edi
add esi, 0x28
cmp edi, dword [ebp - 0x10]
jb 0x4406da
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp al, 1
je 0x440707
inc edx
mov dword [ebp - 8], edx
cmp edx, 2
jb 0x4406a8
pop edi
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0xc]
test edx, edx
je 0x4406f1
cmp edx, ebx
jae 0x4406f1
lea eax, [edx + 0xa000]
cmp eax, ebx
jae 0x4406f1
mov esi, dword [ebp - 0x18]
lea edi, [esi + 0x9fd8]
lea ecx, [edx + esi]
add edi, edx
jmp 0x440775
cmp dword [ecx + 4], 0x88e00
jne 0x440772
cmp dword [ecx + 0xc], 0x88e00
jne 0x440772
cmp dword [ecx + 0x14], 0x88e00
jne 0x440772
mov eax, 0x8ee00
cmp dword [ecx + 0x1c], eax
jne 0x440772
cmp dword [ecx + 0x24], eax
jne 0x440772
mov eax, dword [ecx]
test eax, eax
je 0x440772
cmp eax, dword [ebp - 0x14]
jbe 0x440772
sub eax, dword [ebp - 0x14]
cmp ebx, eax
ja 0x44077e
add ecx, 4
cmp ecx, edi
jb 0x440736
jmp 0x4406f1
sub ecx, esi
je 0x4406f1
cmp ecx, ebx
jae 0x4407ad
lea eax, [ecx + 0x800]
cmp eax, ebx
jae 0x4406f1
push ecx
push 0x1a3
call fcn.004356b2
mov al, 1
mov byte [ebp - 1], al
jmp 0x4406f4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
jmp 0x4406fa

Function at 0x440d0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
mov eax, 0x720065
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x44005c
mov dword [ebp - 0x30], 0x690072
mov dword [ebp - 0x2c], 0x650076
mov dword [ebp - 0x28], 0x5c0072
mov dword [ebp - 0x24], 0x700049
mov dword [ebp - 0x20], 0x690046
mov dword [ebp - 0x1c], 0x74006c
mov dword [ebp - 0x14], 0x720044
mov dword [ebp - 0x10], 0x760069
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x44106e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x790073
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x60]
push 1
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x53005c
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x730079
push eax
mov dword [ebp - 0x50], 0x650074
mov dword [ebp - 0x4c], 0x52006d
mov dword [ebp - 0x48], 0x6f006f
mov dword [ebp - 0x44], 0x5c0074
mov dword [ebp - 0x3c], 0x740073
mov dword [ebp - 0x38], 0x6d0065
mov dword [ebp - 0x34], 0x320033
mov dword [ebp - 0x30], 0x64005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x69005c
mov dword [ebp - 0x1c], 0x660070
mov dword [ebp - 0x18], 0x74006c
mov dword [ebp - 0x14], 0x720064
mov dword [ebp - 0x10], 0x2e0076
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x44114c
push ebx
push edi
push esi
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
call fcn.00405020
cmp al, 1
jne 0x441144
mov bl, al
push dword [ebp - 0x5c]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x441522
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x44005c
push eax
mov dword [ebp - 0x1c], 0x690072
mov dword [ebp - 0x18], 0x650076
mov dword [ebp - 0x14], 0x5c0072
mov dword [ebp - 0x10], 0x700049
mov dword [ebp - 0xc], 0x650073
mov dword [ebp - 8], 0x63
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x441772
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x730079
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x5c]
push 1
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x53005c
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x4c], 0x650074
push eax
mov dword [ebp - 0x48], 0x52006d
mov dword [ebp - 0x44], 0x6f006f
mov dword [ebp - 0x40], 0x5c0074
mov dword [ebp - 0x3c], 0x790073
mov dword [ebp - 0x38], 0x740073
mov dword [ebp - 0x34], 0x6d0065
mov dword [ebp - 0x30], 0x320033
mov dword [ebp - 0x2c], 0x64005c
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x730072
mov dword [ebp - 0x1c], 0x69005c
mov dword [ebp - 0x18], 0x730070
mov dword [ebp - 0x14], 0x630065
mov dword [ebp - 0x10], 0x73002e
mov dword [ebp - 8], ebx
call fcn.00439b16
test eax, eax
jne 0x441845
push ebx
push edi
push esi
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
call fcn.00405020
cmp al, 1
jne 0x44183d
mov bl, al
push dword [ebp - 0x58]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x4444e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x44005c
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x5c0072
mov dword [ebp - 0x18], 0x62004b
mov dword [ebp - 0x14], 0x430064
mov dword [ebp - 0x10], 0x61006c
mov dword [ebp - 0xc], 0x730073
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret

Function at 0x444666
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x790073
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x60]
push 1
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x53005c
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x730079
push eax
mov dword [ebp - 0x50], 0x650074
mov dword [ebp - 0x4c], 0x52006d
mov dword [ebp - 0x48], 0x6f006f
mov dword [ebp - 0x44], 0x5c0074
mov dword [ebp - 0x3c], 0x740073
mov dword [ebp - 0x38], 0x6d0065
mov dword [ebp - 0x34], 0x320033
mov dword [ebp - 0x30], 0x64005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x6b005c
mov dword [ebp - 0x1c], 0x640062
mov dword [ebp - 0x18], 0x6c0063
mov dword [ebp - 0x14], 0x730061
mov dword [ebp - 0x10], 0x2e0073
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x444744
push ebx
push edi
push esi
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
call fcn.00405020
cmp al, 1
jne 0x44473c
mov bl, al
push dword [ebp - 0x5c]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x4449f6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x44005c
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x5c0072
mov dword [ebp - 0x18], 0x6f006d
mov dword [ebp - 0x14], 0x430075
mov dword [ebp - 0x10], 0x61006c
mov dword [ebp - 0xc], 0x730073
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x444c3e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x790073
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x60]
push 1
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x53005c
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x730079
push eax
mov dword [ebp - 0x50], 0x650074
mov dword [ebp - 0x4c], 0x52006d
mov dword [ebp - 0x48], 0x6f006f
mov dword [ebp - 0x44], 0x5c0074
mov dword [ebp - 0x3c], 0x740073
mov dword [ebp - 0x38], 0x6d0065
mov dword [ebp - 0x34], 0x320033
mov dword [ebp - 0x30], 0x64005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x6d005c
mov dword [ebp - 0x1c], 0x75006f
mov dword [ebp - 0x18], 0x6c0063
mov dword [ebp - 0x14], 0x730061
mov dword [ebp - 0x10], 0x2e0073
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x444d1c
push ebx
push edi
push esi
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
call fcn.00405020
cmp al, 1
jne 0x444d14
mov bl, al
push dword [ebp - 0x5c]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x444fbe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x46005c
mov dword [ebp - 0x24], 0x6c0069
mov dword [ebp - 0x20], 0x530065
mov dword [ebp - 0x1c], 0x730079
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x5c006d
mov dword [ebp - 0x10], 0x73004d
mov dword [ebp - 0xc], 0x730066
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x44520a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x790073
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x58]
push 1
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], 0x53005c
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], 0x730079
push eax
mov dword [ebp - 0x48], 0x650074
mov dword [ebp - 0x44], 0x52006d
mov dword [ebp - 0x40], 0x6f006f
mov dword [ebp - 0x3c], 0x5c0074
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x6d0065
mov dword [ebp - 0x2c], 0x320033
mov dword [ebp - 0x28], 0x64005c
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x730072
mov dword [ebp - 0x18], 0x6d005c
mov dword [ebp - 0x14], 0x660073
mov dword [ebp - 0x10], 0x2e0073
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x4452da
push ebx
push edi
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x54]
call fcn.00405020
cmp al, 1
jne 0x4452d2
mov bl, al
push dword [ebp - 0x54]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x44540a
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x61
xor ebx, ebx
call fcn.004355f2
mov dword [ebp - 0x34], eax
test eax, eax
je 0x445435
lea ecx, [ebp - 0x1c]
push ecx
push eax
call sub.ntoskrnl.exe_KeStackAttachProcess
push esi
push edi
push 0x4bfa
call fcn.004355f2
push 0x20
mov edi, eax
call fcn.004355f2
push 0x21
mov dword [ebp - 0x24], eax
call fcn.004355f2
push 0x22
mov dword [ebp - 0x2c], eax
call fcn.004355f2
push 3
mov esi, eax
call fcn.004355f2
push 2
mov dword [ebp - 0x28], eax
call fcn.004355f2
mov ecx, eax
test edi, edi
je 0x4455a4
mov edx, dword [ebp - 0x2c]
cmp edi, edx
jae 0x4455a4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4455a4
test esi, esi
je 0x4455a4
test edx, edx
je 0x4455a4
cmp dword [ebp - 0x28], ebx
je 0x4455a4
test ecx, ecx
je 0x4455a4
mov esi, dword [esi + 0x34]
add edi, eax
add eax, edx
mov byte [ebp - 0x1f], bl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x1e], bl
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x58]
push ecx
push eax
push edi
call fcn.0041d7e6
test al, al
je 0x4455a4
mov eax, dword [ebp - 0x38]
add edi, dword [ebp - 0x40]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
cmp ecx, 0x10b8
jne 0x4454f9
cmp eax, 0xc000000d
jne 0x4454f9
mov dl, 1
mov byte [ebp - 0x1f], dl
jmp 0x4454fc
mov dl, byte [ebp - 0x1f]
cmp dl, 1
jne 0x44550e
cmp ecx, 0x10cd
jne 0x44550e
mov byte [ebp - 0x1e], dl
jmp 0x445511
mov dl, byte [ebp - 0x1e]
cmp dl, 1
jne 0x445526
cmp ecx, 0x10ab
jl 0x445526
cmp ecx, 0x10b2
jle 0x445539
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x100
jae 0x4455a4
mov eax, dword [ebp - 0x24]
jmp 0x4454c5
test eax, eax
jle 0x4455a4
cmp eax, esi
jbe 0x4455a4
sub eax, esi
cmp eax, dword [ebp - 0x2c]
jae 0x4455a4
add eax, dword [ebp - 0x28]
push eax
push 0x2b8
call fcn.004356b2
mov byte [ebp - 0x1d], bl
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x24]
push edi
call fcn.0041d7e6
test al, al
je 0x4455a1
mov eax, dword [ebp - 0x38]
add edi, dword [ebp - 0x40]
cmp dword [eax], 0x1151
jne 0x445598
cmp byte [ebp - 0x54], 1
jne 0x445598
cmp dword [ebp - 0x40], 8
jne 0x445598
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
jle 0x445598
cmp ecx, esi
jbe 0x445598
mov eax, ecx
sub eax, esi
cmp eax, dword [ebp - 0x2c]
jb 0x4455c6
inc ebx
cmp ebx, 0x300
jb 0x445559
mov bl, byte [ebp - 0x1d]
cmp dword [ebp - 0x34], 0
pop edi
pop esi
je 0x4455b5
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret
sub ecx, esi
add ecx, dword [ebp - 0x28]
push ecx
push 0x2ba
call fcn.004356b2
mov bl, 1
jmp 0x4455a4