joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4372f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0042b43b
add esp, 0xc
ror ebx, 0x11
ror ebx, 0xf
rol ebx, 0
test ebx, 0x7d41
jle 0x437335
je 0x437323
lea edx, [edx + 0x279d]
lea edx, [edx - 0x279d]
jp 0x437331
jg 0x437335
mov edi, 0xf445c6bc
push ebx
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
nop
jl 0x437368
jbe 0x43736a
jl 0x437377
js 0x43736e
jg 0x437370
lea ecx, [ecx]
jmp 0x437374
jge 0x437377
mov eax, 0x80f44d8a
jmp 0xf490fb81
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
or ecx, 0
mov esp, esp
or esi, 0
ror esp, 0
ja 0x4373e9
jmp 0x4373e6
jbe 0x4373e9
add eax, 0xffda0be8
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call 0x434df9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x437401
mov eax, 1
jmp 0x4374b5
shl ebx, 0
or edx, edx
ror esi, 0x11
rol esi, 0x11
lea eax, [eax + 0x3e8]
lea eax, [eax - 0x3e8]
jne 0x437425
jmp 0x43741c
jne 0x43741e
mov esp, esp
js 0x437422
je 0x437425
mov ecx, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0042e450
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0042b43b
add esp, 0xc
ror edx, 0
jb 0x437452
mov esp, esp
jb 0x43744e
jae 0x437452
mov edi, 0xec7d831d
add byte [ebp + 7], dh
cmp dword [ebp - 0x14], 0
jne 0x43745f
mov eax, 1
jmp 0x4374b5
std
cld
lea esi, [esi + 0x75bd]
lea esi, [esi - 0x75bd]
jg 0x437478
jo 0x437471
je 0x437473
jo 0x437475
jle 0x437478
jmp 0x512fba07
mov eax, dword [ebp - 0x14]
push eax
call fcn.004384ea
add esp, 4
xor eax, dword [esp]
xor eax, dword [esp]
test dword [esp + 0x10], ecx
clc
nop
jnp 0x4374ae
pushf
and edx, edx
lea edi, [edi + 0xff3]
lea edi, [edi - 0xff3]
xor esi, 0
popf
jp 0x4374a9
jmp 0x4374ab
jp 0x4374ae
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x438c3b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0042b43b
add esp, 0xc
std
cld
rol ebx, 0
and eax, eax
nop
jno 0x438c6d
jle 0x438c60
jns 0x438c62
xchg edx, edx
xchg edi, edx
xchg edi, edx
jo 0x438c6d
add eax, 0x45c640ad
in al, dx
inc esp
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
ror edx, 0x1a
ror edx, 6
jns 0x438ca5
jl 0x438cb7
pushf
test dword [esp + 0xc], eax
js 0x438caf
cmc
popf
jne 0x438cb4
jge 0x438cb7
lcall 0x1e9, 0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00431195
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x438d2c
xor eax, eax
jmp 0x438dc5
lea edi, [edi + 0x5518]
lea edi, [edi - 0x5518]
jb 0x438d3a
jb 0x438d4b
pushf
jbe 0x438d40
jns 0x438d42
popf
jnp 0x438d46
lea ebx, [ebx]
jae 0x438d4b
jmp 0x512fd2dc
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0042e450
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0042b43b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x438d75
xor eax, eax
jmp 0x438dc5
sub esp, 0
jp 0x438d7a
cmp edx, 0x56a
jp 0x438d8f
pushf
jne 0x438d86
popf
mov esi, esi
jae 0x438d8c
jnp 0x438d8f
mov esi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004384ea
add esp, 4
mov esp, esp
jmp 0x438d9f
xor edx, dword [esp]
xor edx, dword [esp]
jle 0x438da7
je 0x438dbe
jl 0x438dab
jl 0x438dad
lea edx, [edx + 0x3cad]
lea edx, [edx - 0x3cad]
jp 0x438dbb
jne 0x438dbe
lcall 0x55ff, 0x51084d8b
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43e699
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0042b43b
add esp, 0xc
test dword [esp + 0x10], edx
xchg edx, ecx
xchg edx, ecx
jge 0x43e6c6
jp 0x43e6be
jnp 0x43e6c0
mov esp, esp
jl 0x43e6c6
xor eax, 0xe845c6f7
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
jnp 0x43e6fc
jp 0x43e711
pushf
xor esp, 0
lea esp, [esp]
popf
xchg ecx, ecx
lea esi, [esi]
jae 0x43e70e
jnp 0x43e711
mov edi, 0x80e84d8a
jmp 0xe8916f1b
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
ror esp, 0
xor edi, 0
jno 0x43e788
lea esp, [esp]
jo 0x43e788
mov ecx, 0x2a08e843
invalid
call fcn.00431195
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43e79d
xor eax, eax
jmp 0x43e836
lea esp, [esp]
jle 0x43e7a2
mov ecx, ecx
jp 0x43e7a6
jle 0x43e7bd
pushf
mov eax, eax
cmp edx, dword [esp + 4]
jg 0x43e7b2
jne 0x43e7b4
popf
js 0x43e7b8
xchg ecx, ecx
jg 0x43e7bd
mov esi, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0042e450
mov dword [ebp - 4], eax
push edi
add edi, 0x3842
ror edi, 5
pop edi
std
cld
jns 0x43e7dc
je 0x43e7e4
lea esp, [esp]
jne 0x43e7e4
jmp 0xadf552
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0042b43b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x43e7fe
xor eax, eax
jmp 0x43e836
test esi, 0x12db
ja 0x43e811
pushf
std
cld
popf
lea edi, [edi]
jbe 0x43e811
mov ebp, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.004384ea
add esp, 4
js 0x43e81f
and eax, 0xffffffff
ja 0x43e833
pushf
cmp esi, dword [esp + 4]
dec edx
inc edx
popf
ja 0x43e830
jbe 0x43e833
mov eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e83d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x419a54], 1
jne 0x43e9bd
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0042b43b
add esp, 0xc
jno 0x43e865
ror ecx, 0xb
rol ecx, 0xb
jl 0x43e86d
jge 0x43e87d
pushf
inc eax
dec eax
cmp edx, dword [esp]
popf
jb 0x43e87a
jl 0x43e87d
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
call 0x43e8b2
add esp, 4
xchg edi, edi
ja 0x43e8b9
or esi, 0
je 0x43e8c8
pushf
nop
popf
jno 0x43e8c5
jne 0x43e8c8
mov edx, 0x80e84d8a
jmp 0xe89170d2
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00431195
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43e93d
xor eax, eax
jmp 0x43ea06
rol edi, 7
rol edi, 0x19
rol esi, 0xd
rol esi, 0x13
lea ecx, [ecx]
jno 0x43e965
pushf
or ebx, ebx
shr esp, 0
popf
lea esi, [esi + 0x3565]
lea esi, [esi - 0x3565]
jo 0x43e965
mov edi, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0042e450
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0042b43b
add esp, 0xc
shr esp, 0
je 0x43e9a7
pushf
lea eax, [eax + 0x7779]
lea eax, [eax - 0x7779]
xor ebx, 0
add ecx, 0
popf
je 0x43e9a2
jno 0x43e9a4
jne 0x43e9a7
mov ebp, 0xf87d83
cmp dword [ebp - 8], 0
je 0x43e9b7
mov eax, dword [ebp - 8]
mov dword [0x419a54], eax
jmp 0x43e9bb
xor eax, eax
jmp 0x43ea06
jmp 0x43e9c6
mov ecx, dword [0x419a54]
mov dword [ebp - 8], ecx
ror esp, 0
xchg esp, esp
jl 0x43e9cd
jno 0x43e9d9
jnp 0x43e9d1
jo 0x43e9d3
jae 0x43e9d5
jo 0x43e9d9
mov ecx, 0xf8558bff
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
dec edx
inc edx
xor edx, dword [esp]
xor edx, dword [esp]
je 0x43e9ef
jae 0x43e9eb
jne 0x43e9ef
mov ebx, 0xfc458bce
mov eax, dword [ebp - 4]
push eax
call fcn.004384ea
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43f931
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
in al, dx
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0042b43b
add esp, 0xc
cmp edx, 0x1f93
test edx, 0x4298
shr esp, 0
stc
jb 0x43f968
lea edx, [edx]
jl 0x43f960
jae 0x43f962
mov ecx, ecx
jae 0x43f968
mov eax, 0xec45c61a
jp 0x43f933
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0xe989bfbb
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
xchg edx, ebx
xchg edx, ebx
jp 0x43f9b1
js 0x43f9a8
mov edi, edi
xchg edx, edx
xchg esi, eax
xchg esi, eax
jnp 0x43f9b1
add eax, 0x80f44d8a
jmp 0xf49181bb
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
cmp edx, 0x780c
mov edx, edx
dec eax
inc eax
jp 0x43fa3f
pushf
test dword [esp + 0xc], ecx
std
cld
popf
jno 0x43fa3a
lea ebx, [ebx]
jnp 0x43fa3f
mov eax, 0xff1751e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 5], dh
call fcn.00431195
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43fa52
jmp 0x43faf6
mov edx, edx
xor edx, 0
jns 0x43fa59
jae 0x43fa72
pushf
push ebx
add ebx, 0x31eb
ror ebx, 6
pop ebx
ror ebx, 0
popf
jno 0x43fa6f
jb 0x43fa72
or dword [ebp - 0x74ad17ab], 0xe850f845
shr ecx, 1
invalid
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0042e450
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0042b43b
add esp, 0xc
jg 0x43fa94
stc
xor esp, 0
jo 0x43faad
jo 0x43fa9c
lea eax, [eax + 0x224a]
lea eax, [eax - 0x224a]
lea eax, [eax]
jno 0x43faad
mov edx, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x43fab5
jmp 0x43faf6
jge 0x43fab7
jne 0x43fac2
jg 0x43fabb
jbe 0x43fabd
jp 0x43fabf
je 0x43fac2
mov ebp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004384ea
add esp, 4
add edi, 0
and esi, 0xffffffff
lea edx, [edx]
nop
je 0x43faef
pushf
cmp edx, dword [esp + 8]
nop
mov edi, edi
cmp ecx, 0x1f54
popf
jne 0x43faec
jne 0x43faef
mov esi, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43fd4c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0042b43b
add esp, 0xc
cmp eax, dword [esp + 0x10]
ror edx, 0
xor ebx, 0
jns 0x43fd97
pushf
ror ebx, 9
ror ebx, 0x17
call 0x43fd85
lea esp, [esp + 4]
jle 0x43fd8b
js 0x43fd8d
popf
jp 0x43fd91
mov esi, esi
nop
js 0x43fd97
add eax, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jp 0x43fe42
jg 0x43fe53
pushf
cmp edi, eax
popf
jns 0x43fe4c
mov esp, esp
jge 0x43fe50
jle 0x43fe53
mov esp, 0xff133de8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 4], dh
call fcn.00431195
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43fe65
xor eax, eax
jmp 0x43feda
jge 0x43fe67
cmp ebx, eax
neg ebx
neg ebx
cmp edx, esi
jnp 0x43fe80
xchg edx, esi
xchg edx, esi
jmp 0x43fe77
jo 0x43fe79
mov esp, esp
jp 0x43fe80
add eax, 0x558d499e
call 0xf88989d9
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0042e450
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0042b43b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x43feaa
xor eax, eax
jmp 0x43feda
cmc
jge 0x43fead
jg 0x43feb7
je 0x43feb1
jp 0x43feb3
jle 0x43feb7
sub eax, 0xfc558b56
mov edx, dword [ebp - 4]
push edx
call fcn.004384ea
add esp, 4
shr esp, 0
jge 0x43fecf
jno 0x43feca
jl 0x43fecf
mov edi, 0x458b7bd7
or al, 0x50
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4402c0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x8d99c8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x8d99d2
pushal
call 0x8d99d8
pop ebp
sub ebp, 0x10
sub ebp, 0x4d99c8
jmp 0x8d99ee
mov eax, 0x4d99c8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bf
mov edx, 0xcd28d774
xor byte [eax], dl
inc eax
dec ecx
jne 0x8d9a05
jmp 0x8d9a18
invalid
Function at 0x41a000
Capabilities:
Packed with generic packer

Disassembly:
add al, 0x6f
or eax, 0x1968087d
insb byte es:[edi], dx
sub byte [ecx + eax], bl
add byte [eax + eax], cl
add dword [eax], eax
adc al, 2
add byte [eax], al
cld
mov dword [ecx], 0x1900000
add byte [eax], al
rol byte [ecx], 1
add byte [ecx], cl
nop
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x51], ah
jb 0x41a080
outsd dx, dword [esi]
inc ebp
inc bp
dec edx
insd dword es:[edi], dx
inc esi
imul eax, dword [esi + 0x73], 0x46
add byte [eax], al
add byte [ebp + 0x6e], ah
je 0x41a0c2
jns 0x41a0c2
push ebp
mov ebp, esp
pushal
mov ebx, 0x419052
xor ecx, ecx
mov cl, byte [0x419035]
test ecx, ecx
je 0x41a073
mov eax, 0x4190b8
sub eax, ebx
sub eax, 5
jmp 0x41a081
push ecx
mov ecx, 0x4190f1
mov eax, ecx
sub eax, ebx
add eax, dword [ecx + 1]
pop ecx
mov byte [ebx], 0xe9
mov dword [ebx + 1], eax
push 0x419009
xor eax, eax
test ecx, ecx
je 0x41a097
mov eax, dword [ebp + 8]
jmp 0x41a097
push eax
call fcn.0041a0f6
add esp, 8
cmp eax, 0
je 0x41a0b4
mov byte [ebx], 0xc2
mov byte [ebx + 1], 0xc
push eax
mov eax, dword [0x419029]
call eax
popal
pop ebp
jmp 0x41a0f1
and al, 4
mov dword [0x4190eb], ecx
mov ecx, 0x4190d6
mov dword [esp + 4], ecx
pop ecx
jmp 0x41a0f1
jmp 0x4087df

Function at 0x41a052
Capabilities:
Packed with generic packer

Disassembly:
add al, 0x6f
or eax, 0x1968087d
insb byte es:[edi], dx
sub byte [ecx + eax], bl
add byte [eax + eax], cl
add dword [eax], eax
adc al, 2
add byte [eax], al
cld
mov dword [ecx], 0x1900000
add byte [eax], al
rol byte [ecx], 1
add byte [ecx], cl
nop
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x51], ah
jb 0x41a080
outsd dx, dword [esi]
inc ebp
inc bp
dec edx
insd dword es:[edi], dx
inc esi
imul eax, dword [esi + 0x73], 0x46
add byte [eax], al
add byte [ebp + 0x6e], ah
je 0x41a0c2
jns 0x41a0c2
push ebp
mov ebp, esp
pushal
mov ebx, 0x419052
xor ecx, ecx
mov cl, byte [0x419035]
test ecx, ecx
je 0x41a073
mov eax, 0x4190b8
sub eax, ebx
sub eax, 5
jmp 0x41a081
push ecx
mov ecx, 0x4190f1
mov eax, ecx
sub eax, ebx
add eax, dword [ecx + 1]
pop ecx
mov byte [ebx], 0xe9
mov dword [ebx + 1], eax
push 0x419009
xor eax, eax
test ecx, ecx
je 0x41a097
mov eax, dword [ebp + 8]
jmp 0x41a097
push eax
call fcn.0041a0f6
add esp, 8
cmp eax, 0
je 0x41a0b4
mov byte [ebx], 0xc2
mov byte [ebx + 1], 0xc
push eax
mov eax, dword [0x419029]
call eax
popal
pop ebp
jmp 0x41a0f1
and al, 4
mov dword [0x4190eb], ecx
mov ecx, 0x4190d6
mov dword [esp + 4], ecx
pop ecx
jmp 0x41a0f1
jmp 0x4087df
Function at 0x698120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22c000]
push edi
or ebp, 0xffffffff
jmp 0x698142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x698149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x698138
mov eax, 1
add ebx, ebx
jne 0x69815b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x69816c
jne 0x69818b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69818b
dec eax
add ebx, ebx
jne 0x698178
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x698150
add ebx, ebx
jne 0x698187
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6981dd
xor ecx, ecx
sub eax, 3
jb 0x6981a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x698212
sar eax, 1
mov ebp, eax
jmp 0x6981ae
add ebx, ebx
jne 0x6981ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69817c
inc ecx
add ebx, ebx
jne 0x6981bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69817c
add ebx, ebx
jne 0x6981c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6981be
jne 0x6981da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6981be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6981fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6981ee
jmp 0x69813e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6981fc
add edi, ecx
jmp 0x69813e
pop esi
mov edi, esi
mov ecx, 0x41c4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x69821a
cmp byte [edi], 0x22
jne 0x69821a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x69821f
lea edi, [esi + 0x295000]
mov eax, dword [edi]
or eax, eax
je 0x698297
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a7674]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2a77a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x69824c
mov ecx, edi
jns 0x69827b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2a77a4]
or eax, eax
je 0x698291
mov dword [ebx], eax
add ebx, 4
jmp 0x698269
call dword [esi + 0x2a77b4]
mov ebp, dword [esi + 0x2a77a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6982cb
sub esp, 0xffffff80
jmp 0x487a0f