joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b8a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004363f0
add esp, 0xc
lea esp, [esp]
jnp 0x42b8e0
pushf
jb 0x42b8c4
ror esp, 0
test edi, 0x1d39
popf
lea edi, [edi]
lea edi, [edi + 0x2f63]
lea edi, [edi - 0x2f63]
jp 0x42b8e0
sub eax, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
rol edi, 0xf
ror edi, 0xf
test dword [esp + 8], ebx
shr esp, 0
jle 0x42b92f
jb 0x42b93b
jne 0x42b933
xchg esp, esp
jb 0x42b937
jae 0x42b93b
xor eax, 0xec4d8ad5
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.0041e25d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42b9d2
xor eax, eax
jmp 0x42ba5f
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0041deec
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004363f0
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x42ba5d
mov esp, esp
add edi, dword [esp]
sub edi, dword [esp]
add esp, 0
lea esi, [esi + 0x7a72]
lea esi, [esi - 0x7a72]
jno 0x42ba18
mov edx, edx
mov esp, esp
jo 0x42ba18
mov ebp, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004315ac
add esp, 4
and edi, edi
lea edi, [edi + 0x68cf]
lea edi, [edi - 0x68cf]
lea edx, [edx + 0x5b8e]
sub edx, 0x5b8e
jo 0x42ba54
jge 0x42ba42
lea edx, [edx + 0x26c3]
lea edx, [edx - 0x26c3]
jnp 0x42ba50
jno 0x42ba54
sub eax, 0x8558bf0
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x42ba5f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42ba68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.004363f0
add esp, 0xc
cmp edi, esi
or edi, 0
ror eax, 9
ror eax, 0x17
jp 0x42baa9
pushf
jae 0x42ba92
rol esi, 0x1d
rol esi, 3
popf
lea eax, [eax + 0x4dce]
lea eax, [eax - 0x4dce]
jnp 0x42baa9
call 0x54370073
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
not ebx
not ebx
jg 0x42baeb
lea esp, [esp]
nop
xchg ebx, edi
xchg ebx, edi
jle 0x42baeb
mov edi, 0xf44d8aac
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
xchg ecx, ecx
nop
jno 0x42bb56
xchg edi, edi
jo 0x42bb56
mov ecx, 0x2808e82a
add dword [eax], eax
call fcn.0043e363
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42bb6e
mov eax, 1
jmp 0x42bbff
jae 0x42bb70
jg 0x42bb7b
jae 0x42bb74
jbe 0x42bb76
xchg ebx, ebx
jle 0x42bb7b
mov edi, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0041deec
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.004363f0
add esp, 0xc
xor ebx, dword [esp]
xor ebx, dword [esp]
shr edx, 0
jo 0x42bbab
je 0x42bba8
jno 0x42bbab
add eax, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x42bbb8
mov eax, 1
jmp 0x42bbff
add esi, 0x3ab7
sub esi, 0x3ab7
jae 0x42bbd9
pushf
shr esp, 0
std
cld
stc
popf
mov ebx, ebx
xchg ecx, ecx
js 0x42bbd6
jb 0x42bbd9
add eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.004315ac
add esp, 4
not eax
not eax
jb 0x42bbf8
jle 0x42bbed
xchg esp, esp
mov eax, eax
lea esp, [esp]
jae 0x42bbf8
mov ecx, 0x84d8bf7
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42e448
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.004363f0
add esp, 0xc
push 0x21
push 0x417e38
lea ecx, [ebp - 0x138]
push ecx
call fcn.0042e58b
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x42e550
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.004363f0
add esp, 0xc
push 0xb
push 0x417e5c
lea edx, [ebp - 0x138]
push edx
call fcn.0042e58b
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x42e543
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042e58b
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x42e552
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42ecc7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004363f0
add esp, 0xc
ror esp, 0
sub esp, 0
js 0x42ecf3
jle 0x42ecea
jl 0x42ecec
xchg esi, esi
mov edx, edx
jns 0x42ecf3
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
xchg ecx, ecx
jbe 0x42ed45
lea esi, [esi]
ja 0x42ed45
add eax, 0xe84d8a84
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.004303a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42edee
xor eax, eax
jmp 0x42ee96
or esi, esi
jle 0x42edf2
je 0x42ee12
pushf
call 0x42edfb
add esp, 4
test esp, 0x277b
jp 0x42ee06
jl 0x42ee08
popf
lea esp, [esp]
jbe 0x42ee0f
jne 0x42ee12
lcall 0x4d8b, 0x50e8458d
cld
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041deec
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004363f0
add esp, 0xc
add edx, dword [esp]
sub edx, dword [esp]
and esi, esi
jnp 0x42ee57
pushf
jle 0x42ee40
push ecx
pop ecx
lea ebx, [ebx + 0x5ab6]
lea ebx, [ebx - 0x5ab6]
and esp, 0xffffffff
popf
nop
jp 0x42ee57
mov ebp, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x42ee61
xor eax, eax
jmp 0x42ee96
jne 0x42ee63
jl 0x42ee6c
xchg esp, esp
mov ecx, ecx
jge 0x42ee6c
mov esi, 0x50e4458b
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004315ac
add esp, 4
xchg esi, ebx
xchg esi, ebx
add edx, 0
and esp, 0xffffffff
jb 0x42ee93
pushf
xchg ebx, ebx
jo 0x42ee8a
popf
lea edi, [edi]
jge 0x42ee90
jae 0x42ee93
mov ecx, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430504
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004363f0
add esp, 0xc
rol ebx, 0xd
rol ebx, 0x13
jg 0x430544
pushf
lea ecx, [ecx + 0x5d1b]
lea ecx, [ecx - 0x5d1b]
dec esi
inc esi
rol eax, 0xe
ror eax, 0xe
jns 0x43053d
popf
jge 0x430541
jle 0x430544
add eax, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
lea ecx, [ecx]
jae 0x430594
jno 0x430582
lea esp, [esp]
lea esi, [esi + 0x78ac]
lea esi, [esi - 0x78ac]
jb 0x430594
mov edx, 0x80e84d8a
jmp 0xe8908d9e
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0041e25d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x430617
xor eax, eax
jmp 0x430691
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0041deec
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004363f0
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x43068f
push ebx
pop ebx
jle 0x430641
ror esp, 0
test ebx, edi
jge 0x43064e
jg 0x43064a
jl 0x43064e
mov ebx, 0xfc558b60
mov edx, dword [ebp - 4]
push edx
call fcn.004315ac
add esp, 4
jns 0x43065c
ror esp, 0
or esp, 0
or eax, 0
js 0x43067a
jae 0x430669
lea edi, [edi]
lea eax, [eax + 0x6207]
lea eax, [eax - 0x6207]
jns 0x43067a
lcall 0x4d8b, 0x5014458b
adc byte [ecx - 0x75], dl
push ebp
or al, 0x52
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x430691
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43124f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004363f0
add esp, 0xc
jno 0x431271
jno 0x43127f
jg 0x431275
mov edi, edi
lea esp, [esp]
mov edi, edi
jo 0x43127f
mov esi, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004303a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x431347
xor eax, eax
jmp 0x4313bb
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041deec
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004363f0
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x431371
xor eax, eax
jmp 0x4313bb
ror esi, 0x10
ror esi, 0x10
je 0x43138c
lea eax, [eax]
lea edi, [edi]
lea ecx, [ecx + 0xdad]
lea ecx, [ecx - 0xdad]
jne 0x43138c
mov edi, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.004315ac
add esp, 4
jns 0x43139a
jle 0x43139c
or esp, 0
sub ecx, 0
jae 0x4313b0
jle 0x4313a6
mov eax, eax
lea edi, [edi]
jne 0x4313ac
jb 0x4313b0
mov esi, 0xc4d8b50
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4313c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x417a5c], 1
jne 0x431553
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004363f0
add esp, 0xc
xchg edi, eax
xchg edi, eax
shr esp, 0
lea esp, [esp]
jns 0x4313f4
jno 0x43140f
pushf
stc
add ecx, 0
push ecx
add ecx, 0x589b
ror ecx, 4
pop ecx
popf
lea edx, [edx]
nop
jo 0x43140f
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
xor esi, dword [esp]
xor esi, dword [esp]
shl esi, 0
ror esp, 0
jnp 0x43144d
jnp 0x43146b
pushf
dec edi
inc edi
call 0x431458
lea esp, [esp + 4]
xor edi, dword [esp]
xor edi, dword [esp]
popf
mov ecx, ecx
je 0x431468
jp 0x43146b
add eax, 0x80e84d8a
jmp 0xe8909c75
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.004303a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4314e0
xor eax, eax
jmp 0x4315a3
mov esi, esi
je 0x4314e4
jle 0x4314ef
mov ecx, ecx
lea esi, [esi]
jo 0x4314ec
jg 0x4314ef
mov ebx, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0041deec
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004363f0
add esp, 0xc
add edx, 0x6165
sub edx, 0x6165
jl 0x43153d
pushf
rol ebx, 1
ror ebx, 1
call 0x431528
add esp, 4
cmp esp, 0x4aee
popf
lea esp, [esp]
jo 0x431538
jl 0x43153a
jge 0x43153d
mov ebx, 0xf87d83
cmp dword [ebp - 8], 0
je 0x43154d
mov eax, dword [ebp - 8]
mov dword [0x417a5c], eax
jmp 0x431551
xor eax, eax
jmp 0x4315a3
jmp 0x43155c
mov ecx, dword [0x417a5c]
mov dword [ebp - 8], ecx
and esp, 0xffffffff
je 0x431576
pushf
jmp 0x431565
xor eax, esi
xor eax, esi
and edi, 0xffffffff
jne 0x43156e
popf
jp 0x431572
nop
jne 0x431576
or dword [ebx + 0x5589f855], 0x8b007ffc
test byte [ebx - 0xdcff18], 0x73
add eax, 0x1720071
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jg 0x43157e
mov esi, esi
sub eax, 0
and edi, edi
jae 0x43158c
jno 0x431589
jb 0x43158c
mov edx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004315ac
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43218e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004363f0
add esp, 0xc
push esi
pop esi
jle 0x4321b2
js 0x4321ad
jnp 0x4321af
jg 0x4321b2
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
lea ebx, [ebx + 0x6b2d]
lea ebx, [ebx - 0x6b2d]
test esi, 0x40e3
and edi, edi
jl 0x43220f
jne 0x432206
lea esp, [esp]
nop
jns 0x43220c
jge 0x43220f
mov edi, 0x80e84d8a
jmp 0xe890aa19
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.0041e25d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43229b
xor eax, eax
jmp 0x43230d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041deec
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004363f0
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x43230b
xor esi, dword [esp]
xor esi, dword [esp]
lea eax, [eax]
nop
jl 0x4322d5
xchg esp, esp
xchg edx, edi
xchg edx, edi
jge 0x4322d5
sub eax, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.004315ac
add esp, 4
stc
jns 0x4322e4
xor esp, 0
push edi
pop edi
jb 0x4322fe
pushf
ror eax, 0xa
rol eax, 0xa
popf
xchg esp, esp
jns 0x4322f9
js 0x4322fb
jae 0x4322fe
xor eax, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x43230d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x432a16
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004363f0
add esp, 0xc
sub esp, 0
ja 0x432a34
ror edx, 0x16
rol edx, 0x16
jne 0x432a44
mov edx, edx
jns 0x432a40
je 0x432a44
xor eax, 0xf045c6ff
inc esi
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
mov esp, esp
je 0x432a87
pushf
cmp edi, 0x51d7
popf
jle 0x432a84
jne 0x432a87
jmp 0x81337815
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
or esp, 0
test dword [esp + 0xc], esi
jae 0x432af4
nop
jb 0x432af4
add eax, 0xffd8a7e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.004303a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x432b06
xor eax, eax
jmp 0x432b35
jl 0x432b08
jle 0x432b12
jnp 0x432b0c
xchg esi, esi
jg 0x432b12
ljmp 0x8b50:0xf0458dbb
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041deec
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004363f0
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret