joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439f4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00453cf9
add byte [ebp - 0x17af17bb], cl
xchg ecx, eax
popfd
add dword [eax], eax
add esp, 0xc
jb 0x439f6d
lea esp, [esp]
rol edx, 9
rol edx, 0x17
je 0x439f8f
pushf
jmp 0x439f7c
cmp eax, esi
test dword [esp + 8], ebx
xchg ebx, ebx
popf
jnp 0x439f88
mov ecx, ecx
jne 0x439f8c
jne 0x439f8f
lcall 0x45c6, 0x51e845c6
in eax, dx
je 0x439f5e
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
test dword [esp], edx
jge 0x43a049
xchg ebx, edi
xchg ebx, edi
jg 0x43a043
jns 0x43a045
jl 0x43a049
mov ebp, 0xd813e8d6
invalid
call fcn.00437861
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43a05e
xor eax, eax
jmp 0x43a0ed
jp 0x43a060
ja 0x43a06b
jo 0x43a064
xchg esi, esi
jnp 0x43a068
jbe 0x43a06b
mov esp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0044dbc2
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00453cf9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x43a095
xor eax, eax
jmp 0x43a0ed
rol esp, 0
or esp, 0
push ecx
pop ecx
jne 0x43a0c1
pushf
rol esp, 0
add eax, 0x7c94
sub eax, 0x7c94
lea esi, [esi + 0x1030]
lea esi, [esi - 0x1030]
popf
mov esp, esp
je 0x43a0c1
xor eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00443a02
add esp, 4
std
cld
xor eax, dword [esp + 8]
xor eax, dword [esp + 8]
jno 0x43a0e2
xchg esi, esi
jns 0x43a0dd
jo 0x43a0e2
mov edx, 0x458bcdd0
or al, 0x50
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43a319
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00453cf9
add esp, 0xc
ror ecx, 0
jo 0x43a34e
pushf
lea edx, [edx]
rol esp, 0
test dword [esp], eax
ror eax, 2
ror eax, 0x1e
popf
jo 0x43a34b
jno 0x43a34e
mov edx, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x4c
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x42
mov byte [ebp - 0xf], 0
ja 0x43a388
add eax, 0
jge 0x43a38d
nop
jle 0x43a3a6
pushf
lea esi, [esi]
test esp, 0x7ba4
cmp ebx, dword [esp + 8]
cmc
popf
xchg edi, edi
jg 0x43a3a6
add eax, 0x80e44d8a
jmp 0xe4912bb0
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x1a]
sub cl, 1
mov byte [ebp - 0x1a], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
dec esi
inc esi
stc
jnp 0x43a436
pushf
rol edi, 0
ror esi, 0
xchg edi, eax
xchg edi, eax
call fcn.0043a42b
Function at 0x43fb89
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00453cf9
add esp, 0xc
jbe 0x43fba4
je 0x43fbab
xchg esi, esi
jne 0x43fbab
mov esi, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
jb 0x43fbdd
std
cld
mov edx, edx
je 0x43fbf8
pushf
std
cld
neg esi
neg esi
popf
xchg esi, ecx
xchg esi, ecx
xchg esi, ebx
xchg esi, ebx
jne 0x43fbf8
mov edi, 0x80f44d8a
jmp 0xf4918402
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
and esi, 0xffffffff
shl esp, 0
xchg esp, esp
jg 0x43fc69
jp 0x43fc64
jb 0x43fc66
jle 0x43fc69
ljmp 0x8900:0xdf05e8
call 0x44db73
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43fc81
mov eax, 1
jmp 0x43fd01
xchg ecx, ecx
jl 0x43fc85
jge 0x43fc87
lea edi, [edi]
je 0x43fc91
nop
jne 0x43fc8e
jne 0x43fc91
mov esi, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0044dbc2
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00453cf9
add esp, 0xc
test ecx, edi
jmp 0x43fcb5
jl 0x43fcbb
nop
jge 0x43fcbb
lcall 0x775, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x43fcc8
mov eax, 1
jmp 0x43fd01
clc
call fcn.0043fcce
Function at 0x44000e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00453cf9
add esp, 0xc
nop
dec ecx
inc ecx
je 0x440049
pushf
test esp, 0x418e
rol ebx, 0x13
ror ebx, 0x13
popf
jne 0x440045
nop
jne 0x440049
mov ebx, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
xor edi, 0x478e
xor edi, 0x478e
inc edi
dec edi
jo 0x44009d
pushf
not ecx
not ecx
ror eax, 0
popf
xchg esi, esi
jl 0x440098
xchg esp, esp
jno 0x44009d
mov eax, 0x80f04d8a
jmp 0xf09188a7
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jb 0x4400ff
nop
jne 0x440110
pushf
dec edi
inc edi
add esi, 0
popf
jge 0x44010d
je 0x440110
mov ecx, 0xff7357e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.0043746c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x440122
xor eax, eax
jmp 0x440164
cmp eax, ecx
and esp, 0xffffffff
lea esi, [esi]
jle 0x440141
pushf
xor ebx, dword [esp + 0xc]
xor ebx, dword [esp + 0xc]
add ecx, 0
popf
je 0x44013c
jmp 0x44013e
jg 0x440141
mov edx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0044dbc2
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00453cf9
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441697
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4333b0], 1
jne 0x4417e2
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00453cf9
add esp, 0xc
jp 0x4416bf
lea edi, [edi]
xor ebx, dword [esp]
xor ebx, dword [esp]
cld
jg 0x4416da
pushf
xor ebx, eax
xor ebx, eax
popf
xchg edx, eax
xchg edx, eax
nop
jne 0x4416d7
jle 0x4416da
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
jbe 0x441708
jae 0x441715
xchg edx, esi
xchg edx, esi
jne 0x441710
mov esi, esi
jb 0x441715
mov eax, 0x80e84d8a
jmp 0xe8919f1f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.00437861
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x441782
mov eax, dword [ebp + 8]
jmp 0x441871
test dword [esp + 8], edx
jno 0x4417a7
pushf
js 0x44178c
add eax, 0x4898
sub eax, 0x4898
or eax, eax
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
popf
jge 0x4417a4
jo 0x4417a7
call 0x532c6d38
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0044dbc2
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00453cf9
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x4417d8
mov edx, dword [ebp - 8]
mov dword [0x4333b0], edx
jmp 0x4417e0
mov eax, dword [ebp + 8]
jmp 0x441871
jmp 0x4417ea
mov eax, dword [0x4333b0]
mov dword [ebp - 8], eax
mov ebx, ebx
inc edi
dec edi
jnp 0x44180d
pushf
test esi, edi
rol eax, 0x1e
rol eax, 2
ja 0x4417fc
jg 0x4417fe
popf
xchg esi, ecx
xchg esi, ecx
jle 0x441806
xchg ecx, edx
xchg ecx, edx
jp 0x44180d
mov eax, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp edx, eax
lea esp, [esp]
test dword [esp], ebx
mov ecx, ecx
jns 0x441846
pushf
cmp esi, eax
dec eax
inc eax
jmp 0x441827
popf
lea eax, [eax + 0x782e]
lea eax, [eax - 0x782e]
je 0x441837
lea esi, [esi + 0x20de]
lea esi, [esi - 0x20de]
js 0x441846
xor eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00443a02
add esp, 4
xor edi, edx
xor edi, edx
xor eax, dword [esp]
xor eax, dword [esp]
jae 0x44186a
pushf
jp 0x441862
popf
mov eax, eax
nop
jb 0x44186a
jmp 0x504c5df9
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4484c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00453cf9
add esp, 0xc
jo 0x4484df
xor ecx, 0
jne 0x4484f0
jge 0x4484e6
jle 0x4484e8
jno 0x4484ea
mov eax, eax
je 0x4484f0
xor dword [ebp - 0x3a], 0xc67aec45
inc ebp
call 0xe98a4b43
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
ror esi, 0x12
ror esi, 0xe
je 0x44853b
jo 0x448532
jno 0x448534
jnp 0x448536
lea esi, [esi]
jne 0x44853b
mov ebx, 0x80f44d8a
jmp 0xf4920d45
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
cmp eax, dword [esp]
nop
jp 0x4485b9
jg 0x4485b4
jo 0x4485b6
jnp 0x4485b9
mov ebx, 0xfef2a3e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 5], dh
call fcn.00437861
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4485cc
jmp 0x448664
shl esp, 0
jne 0x4485d7
mov edi, edi
je 0x4485d7
mov ecx, 0xe8558dbe
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0044dbc2
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00453cf9
add esp, 0xc
or eax, 0
jle 0x448605
xchg esp, esp
lea esi, [esi]
jb 0x448602
jg 0x448605
add eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x44860d
jmp 0x448664
xor edx, 0x42ae
xor edx, 0x42ae
jns 0x44861b
cmp edi, eax
jae 0x44861f
jae 0x448634
pushf
test dword [esp], ebx
std
cld
shl ebx, 0
popf
jae 0x44862f
jl 0x448631
jb 0x448634
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00443a02
add esp, 4
mov esp, esp
add edi, 0x5722
sub edi, 0x5722
jp 0x44865d
xchg ecx, eax
xchg ecx, eax
jbe 0x448654
mov esi, esi
lea esp, [esp]
jnp 0x44865d
mov edi, 0x8458bdb
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44a1ad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00453cf9
add esp, 0xc
jb 0x44a1c8
std
cld
jo 0x44a1dc
pushf
jg 0x44a1d0
jbe 0x44a1d2
nop
jl 0x44a1d5
popf
jb 0x44a1d9
jno 0x44a1dc
add eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
nop
lea ecx, [ecx]
jns 0x44a225
pushf
clc
nop
or esi, esi
ror esp, 0
popf
jno 0x44a21e
jno 0x44a220
jbe 0x44a222
js 0x44a225
add eax, 0x80f04d8a
jmp 0xf0922a2f
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
shr esp, 0
cld
jl 0x44a28b
lea ecx, [ecx + 0x52ae]
lea ecx, [ecx - 0x52ae]
jp 0x44a2a2
jno 0x44a29b
jp 0x44a29d
jl 0x44a29f
jnp 0x44a2a2
lcall 0x89ff, 0xfed5bae8
inc ebp
cld
call fcn.00437861
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44a2b4
xor eax, eax
jmp 0x44a2f1
test ecx, 0x496a
jle 0x44a2ce
pushf
lea esp, [esp]
jle 0x44a2c3
mov esp, esp
popf
jle 0x44a2c9
mov eax, eax
jg 0x44a2ce
ljmp 0x4d8b:0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0044dbc2
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00453cf9
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451281
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x451295
jmp 0x451436
dec ecx
inc ecx
test dword [esp + 0x10], ebx
shr esp, 0
je 0x4512a5
xchg ebx, ebx
jne 0x4512a5
or dword [ebx + 0x45890845], 0xec4d8bec
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x431ba4], edx
cmp eax, ecx
cmc
cmp esp, 0x26f6
jno 0x4512cb
mov ecx, ecx
jbe 0x4512c5
jnp 0x4512c7
nop
jo 0x4512cb
or dword [ebx + 0x488bec45], 0xac0d8904
sbb eax, dword [ebx]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x431bac], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x431ba8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x431a14], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x431a18], ecx
jno 0x4512fc
sub edx, 0
jle 0x451308
xchg ebx, ebx
jge 0x451305
jg 0x451308
mov edi, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
lea ebx, [ebx + 0x5842]
lea ebx, [ebx - 0x5842]
inc esi
dec esi
and ecx, ecx
jle 0x45136c
jbe 0x451350
lea ebx, [ebx + 0x77a1]
lea ebx, [ebx - 0x77a1]
lea eax, [eax + 0x302c]
lea eax, [eax - 0x302c]
jg 0x45136c
add eax, 0xf0558a97
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jbe 0x4513d6
je 0x4513f2
pushf
rol esi, 0x1b
rol esi, 5
push ebx
add ebx, 0xcc2
ror ebx, 0xe
pop ebx
popf
jb 0x4513ef
jne 0x4513f2
mov eax, 0x1ba83d83
inc ebx
add byte [eax], al
cmp dword [0x431ba8], 0
je 0x45140f
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x431ba8]
push eax
call fcn.0044dbc2
mov dword [0x431ba0], eax
jno 0x451411
xchg ebx, ebx
test esp, 0x4c6f
xor edx, eax
xor edx, eax
ja 0x451426
jae 0x451421
xchg esp, esp
jbe 0x451426
lcall 0x4d8d, 0x6a0d6a
invalid
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00453cf9
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45143f
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x431f94
call fcn.00451a78
add esp, 0xc
mov byte [0x431f94], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x451497
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00453cf9
add esp, 0xc
jbe 0x4514b2
and eax, 0xffffffff
jno 0x4514c4
pushf
mov edi, edi
popf
jp 0x4514bf
lea ebx, [ebx]
jo 0x4514c4
mov esp, 0x48e045c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
lea eax, [eax]
push esi
pop esi
mov esp, esp
jb 0x451520
mov edx, edx
jno 0x45151c
jae 0x451520
add eax, 0xe04d8ab3
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
not esi
not esi
rol esi, 0x18
rol esi, 8
js 0x4515c8
jg 0x4515dd
jns 0x4515cc
lea eax, [eax + 0x7757]
lea eax, [eax - 0x7757]
jl 0x4515da
jle 0x4515dd
lcall 0x89ff, 0xfe627fe8
inc ebp
clc
call fcn.00437861
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4515f2
xor eax, eax
jmp 0x45188a
and eax, eax
je 0x4515ff
xchg ebx, ecx
xchg ebx, ecx
mov esi, esi
jne 0x4515ff
mov esi, 0x51e04d8d
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0044dbc2
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00453cf9
add esp, 0xc
or ecx, 0
add edi, 0
or esp, 0
lea edi, [edi + 0x1b5f]
lea edi, [edi - 0x1b5f]
jae 0x451647
pushf
ja 0x45163a
js 0x45163c
jno 0x45163e
popf
jp 0x451642
lea edi, [edi]
jb 0x451647
xor eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x451654
xor eax, eax
jmp 0x45188a
call fcn.00451659