joyce8/EMBER2024-capa huggingface dataset:
Function at 0x504c68
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x504c99
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x504c81
add dl, dl
jne 0x504ca4
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x504cf5
xor eax, eax
add dl, dl
jne 0x504cb1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x504d92
add dl, dl
jne 0x504cc0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x504ccb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x504cd6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x504ce1
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x504ceb
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x504c90
mov eax, 1
add dl, dl
jne 0x504d03
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x504d0e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x504cfa
sub eax, ebx
mov ebx, 1
jne 0x504d41
mov ecx, 1
add dl, dl
jne 0x504d27
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x504d32
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x504d1e
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x504c90
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x504d58
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x504d63
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x504d4f
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x504c90
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x504db3
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x504c90
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x42ffc0], 0x24e1
mov eax, dword [0x42ffc0]
sub eax, 0x24e1
mov dword [0x42ffc0], eax
mov ecx, 1
test ecx, ecx
je 0x4010ab
mov edx, dword [0x42ffc0]
cmp edx, dword [ebp + 0xc]
jb 0x401037
jmp 0x4010ab
cmp dword [0x42ffc0], 0
jne 0x401055
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401055
xor eax, eax
jmp 0x4010ab
mov eax, dword [ebp + 8]
add eax, dword [0x42ffc0]
mov ecx, dword [eax]
add ecx, dword [0x42ffc0]
mov edx, dword [ebp + 8]
add edx, dword [0x42ffc0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x1091
mov eax, dword [0x42ffc0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x42ffc0]
push eax
call fcn.004012b0
add esp, 8
mov ecx, dword [0x42ffc0]
add ecx, 4
mov dword [0x42ffc0], ecx
jmp 0x40101d
mov esp, ebp
pop ebp
ret
Function at 0x54acfa
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x54ad54
push eax
push 0x54985e
call fcn.0054ad92
push 7
push 0x5c30bc
push dword [eax + 0x30]
call fcn.0054b0eb
cmp eax, 0
jne 0x54ad2e
inc eax
jmp 0x54ad56
push 0x549876
call fcn.0054ad92
push 7
push 0x5c30bc
push dword [eax + 0x30]
call fcn.0054b0eb
cmp eax, 0
jne 0x54ad4f
inc eax
jmp 0x54ad56
pop eax
mov eax, dword [eax]
jmp 0x54ad08
xor eax, eax
ret

Function at 0x54ad6c
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x54ad80
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x54ad92
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x5c30bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xee
stosw word es:[edi], ax
cmp ax, 0
jne 0x54ada0
pop edi
pop esi
leave
ret 4

Function at 0x54adb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x5c30bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xee
stosb byte es:[edi], al
cmp al, 0
jne 0x54adc2
pop edi
pop esi
leave
ret 4

Function at 0x54aff6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x54b047
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x54b047
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x54b04e
add edx, 4
loop 0x54b00e
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x54b055
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x54b0a1
cmp dx, 0x41
jb 0x54b086
cmp dx, 0x5a
jbe 0x54b08c
cmp dx, 0x61
jb 0x54b098
cmp dx, 0x7a
ja 0x54b098
xor dx, 0x20
jmp 0x54b09a
jmp 0x54b0b4
cmp dx, word [edi]
je 0x54b0a1
jmp 0x54b0b4
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x54b072
mov eax, dword [eax + 0x18]
jmp 0x54b0bc
mov eax, dword [eax]
cmp ebp, eax
jne 0x54b067
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x54c5be
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x401526
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push 0x4c
pop eax
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401288
push 0x5aab2f
call fcn.0054c4ff
mov ecx, dword [0x5c324c]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x18]
push eax
call sub.MSVBVM60.DLL_VarPtr
mov dword [ebp - 0x58], eax
push 4
mov eax, dword [0x5c324c]
push dword [eax + 0xc]
push dword [ebp - 0x58]
call fcn.0054b16f
push 0x40
push 0x3000
push dword [ebp - 0x18]
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 0x20], eax
push 0
mov eax, dword [ebp - 0x18]
dec eax
push eax
push 1
push 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
push pe_nt_image_headers32
call sub.MSVBVM60.DLL___vbaRedim
add esp, 0x1c
push dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push eax
call sub.MSVBVM60.DLL___vbaAryLock
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub ecx, dword [eax + 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0xc]
add eax, ecx
push eax
call sub.MSVBVM60.DLL_VarPtr
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x34]
push eax
call sub.MSVBVM60.DLL___vbaAryUnlock
push dword [ebp - 0x18]
mov eax, dword [0x5c324c]
mov eax, dword [eax + 0xc]
add eax, 4
push eax
push dword [ebp - 0x58]
call fcn.0054b16f
push dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push eax
call sub.MSVBVM60.DLL___vbaAryLock
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub ecx, dword [eax + 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0xc]
add eax, ecx
push eax
call sub.MSVBVM60.DLL_VarPtr
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x34]
push eax
call sub.MSVBVM60.DLL___vbaAryUnlock
push dword [ebp - 0x18]
push dword [ebp - 0x58]
push dword [ebp - 0x20]
call fcn.0054b16f
push dword [ebp + 0x10]
lea eax, [ebp - 0x44]
push eax
call fcn.0054c517
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x34]
push eax
call sub.MSVBVM60.DLL___vbaAryLock
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub ecx, dword [eax + 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0xc]
add eax, ecx
push eax
call sub.MSVBVM60.DLL_VarPtr
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x34]
push eax
call sub.MSVBVM60.DLL___vbaAryUnlock
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
not eax
not eax
push eax
call fcn.0054b161
push eax
push dword [ebp - 0x58]
lea eax, [ebp - 0x44]
push eax
call sub.MSVBVM60.DLL___vbaI4Var
push eax
push dword [ebp - 0x20]
call fcn.005b2332
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x54], 3
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x30]
call sub.MSVBVM60.DLL___vbaVarMove
lea ecx, [ebp - 0x44]
call sub.MSVBVM60.DLL___vbaFreeVar
push 0x54c785
jmp 0x54c779
lea eax, [ebp - 0x1c]
push eax
push 0
call sub.MSVBVM60.DLL___vbaAryDestruct
ret
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x15955f3e
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7a3a1115
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x50b7751e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..rsrc_1
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x69a6353e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x439eb7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
in al, dx
sbb byte [ebx + 0x56], dl
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004473d7
add esp, 0xc
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
js 0x439eda
lea eax, [eax]
je 0x439ee8
jmp 0x439ee0
xchg ebx, eax
xchg ebx, eax
jns 0x439ee4
jne 0x439ee8
xor dword [ebp - 0x3a], 0xc653ec45
inc ebp
clc
jo fcn.00439eb7
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
ror esp, 0
mov edi, edi
jnp 0x439f3a
inc ebp
cmc
jno 0x439ebb
inc ebp
out dx, eax
je 0x439ebf
inc ebp
invalid
pushf
jno 0x439f2f
popf
jb 0x439f33
jge 0x439f35
xchg esi, esi
jp 0x439f3a
mov eax, 0x80ec4d8a
jmp 0xec912744
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0044972d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x439fc4
jmp 0x43a03a
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004407fd
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004473d7
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x43a03a
ror ecx, 0x12
rol ecx, 0x12
lea ebx, [ebx + 0x58b1]
lea ebx, [ebx - 0x58b1]
and ebx, 0xffffffff
jns 0x43a00a
jne 0x43a003
ja 0x43a005
jle 0x43a007
js 0x43a00a
or dword [ebx - 0x17af17bb], 0xffffd20a
mov eax, dword [ebp - 0x18]
push eax
call fcn.0043721d
add esp, 4
mov ebx, ebx
jle 0x43a027
pushf
lea ebx, [ebx]
jmp 0x43a020
popf
jg 0x43a024
jg 0x43a027
mov esp, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43a1ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004473d7
add esp, 0xc
jl 0x43a1e9
jo 0x43a202
pushf
xchg edx, edx
cmp edx, dword [esp + 0x10]
dec esi
inc esi
jge 0x43a1f7
popf
jne 0x43a1fb
jmp 0x43a1fd
js 0x43a1ff
jno 0x43a202
lcall 0x45c6, 0x53e445c6
in eax, 0x66
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x4c
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x42
mov byte [ebp - 0xf], 0
je 0x43a23c
lea esi, [esi + 0x6146]
sub esi, 0x6146
ror ecx, 0x1b
rol ecx, 0x1b
ja 0x43a25c
jnp 0x43a252
lea edx, [edx]
mov edx, edx
jae 0x43a258
jbe 0x43a25c
xor eax, 0xe44d8ad9
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x1a]
sub cl, 1
mov byte [ebp - 0x1a], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov esp, esp
xchg ebx, edi
xchg ebx, edi
ror edi, 2
rol edi, 2
jne 0x43a2eb
pushf
lea esp, [esp]
js 0x43a2e2
popf
jns 0x43a2e6
jb 0x43a2e8
je 0x43a2eb
add eax, 0x21a24e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 0xa], dh
call fcn.0045bd14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43a303
mov eax, 1
jmp 0x43a54b
nop
call fcn.0043a309
Function at 0x440e91
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x440ea5
jmp 0x441062
inc ecx
dec ecx
je 0x440ebe
pushf
jl 0x440ead
jge 0x440eaf
push edx
pop edx
cmp edx, ebx
popf
jle 0x440eb7
jb 0x440eb9
jno 0x440ebb
jne 0x440ebe
xor eax, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x42fc4c], edx
cmp esi, dword [esp]
ror edx, 0
jns 0x440edf
js 0x440ed9
jo 0x440edb
js 0x440edf
mov ebp, 0xec458b34
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x430d4c], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x430d48], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x4312c0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x4312c4], ecx
cmp eax, ecx
xor ebx, 0
call 0x440f18
add esp, 4
jle 0x440f23
lea esp, [esp]
jg 0x440f23
mov ebp, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jb 0x440f59
dec esi
inc esi
cld
jge 0x440f73
pushf
ror eax, 0x11
ror eax, 0xf
xchg edx, edx
cmc
popf
jns 0x440f6d
mov ebx, ebx
nop
jl 0x440f73
call 0x81346501
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jns 0x440fdd
cmc
test edi, 0x387f
xchg ecx, edx
xchg ecx, edx
jbe 0x44100b
lea esi, [esi + 0x7fd8]
lea esi, [esi - 0x7fd8]
jae 0x440ff8
lea edx, [edx + 0x444d]
lea edx, [edx - 0x444d]
xchg esi, edi
xchg esi, edi
ja 0x44100b
call 0xd8c4d92
inc ebx
add byte [eax], al
cmp dword [0x430d48], 0
je 0x441028
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x430d48]
push eax
call fcn.004407fd
mov dword [0x42fc48], eax
jmp 0x44102a
xor eax, 0xa97
xor eax, 0xa97
test edx, ecx
jl 0x441052
pushf
and esp, 0xffffffff
popf
js 0x441041
jge 0x441043
lea ecx, [ecx + 0x2cca]
lea ecx, [ecx - 0x2cca]
jge 0x441052
mov esp, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004473d7
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x441570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.004473d7
add esp, 0xc
xchg edx, edx
jno 0x4415ab
pushf
or esp, 0
jne 0x441594
nop
test ecx, edi
popf
nop
lea edx, [edx + 0x1915]
lea edx, [edx - 0x1915]
jnp 0x4415a8
jo 0x4415ab
mov ebx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
cmp edi, 0xa59
and esp, 0xffffffff
inc esi
dec esi
jb 0x441603
pushf
lea esi, [esi + 0x3558]
lea esi, [esi - 0x3558]
jbe 0x4415f8
popf
ja 0x4415fc
jno 0x4415fe
je 0x441600
jae 0x441603
mov ecx, 0x80f44d8a
jmp 0xf4919e0d
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
test dword [esp], edi
jo 0x441675
xchg esi, ecx
xchg esi, ecx
js 0x44166e
jmp 0x441670
jno 0x441675
mov esp, 0x9ae809a7
cmpsb byte [esi], byte es:[edi]
add dword [eax], eax
call fcn.0045bd14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x44168d
mov eax, 1
jmp 0x441728
xor ecx, 0
jp 0x4416aa
pushf
add esp, 0
popf
xchg ebx, ebx
lea eax, [eax + 0xf7e]
lea eax, [eax - 0xf7e]
jnp 0x4416aa
mov esi, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004407fd
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.004473d7
add esp, 0xc
push ebx
pop ebx
or edi, edi
js 0x4416d0
jge 0x4416dd
pushf
mov esp, esp
popf
jnp 0x4416da
jl 0x4416dd
call 0x1309464
cmp dword [ebp - 0x14], 0
jne 0x4416ea
mov eax, 1
jmp 0x441728
neg ecx
neg ecx
jns 0x4416f5
mov ecx, ecx
js 0x4416f5
xor eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.0043721d
add esp, 4
shl esp, 0
js 0x441706
neg esi
neg esi
cld
je 0x441721
pushf
ror ebx, 5
ror ebx, 0x1b
clc
jge 0x441718
js 0x44171a
popf
jmp 0x44171e
jne 0x441721
sub eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4