joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433d09
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0042ee6e
add esp, 0xc
ja 0x433d24
ja 0x433d2b
js 0x433d28
jbe 0x433d2b
mov edx, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
not esi
not esi
cmp esi, dword [esp]
jno 0x433d77
pushf
test dword [esp + 8], edx
test ecx, 0x35b8
popf
jp 0x433d74
jo 0x433d77
mov ebp, 0x80ec4d8a
jmp 0xec90c581
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
ror esp, 0
js 0x433ddc
call 0x433de1
lea esp, [esp + 4]
jge 0x433df1
xchg edx, edi
xchg edx, edi
jg 0x433ded
jl 0x433df1
jmp 0x5cc26d3
call fcn.0043437e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x433e06
xor eax, eax
jmp 0x433e9f
xor edi, dword [esp + 0xc]
xor edi, dword [esp + 0xc]
xor ecx, 0
jns 0x433e19
lea esp, [esp]
js 0x433e19
sub eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043505f
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0042ee6e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x433e88
cmp ebx, edi
xor ecx, 0
jno 0x433e5b
lea ebx, [ebx + 0x1bbd]
lea ebx, [ebx - 0x1bbd]
jge 0x433e54
mov esi, esi
jp 0x433e58
jo 0x433e5b
mov ebx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0042d94c
add esp, 4
cld
ror edx, 0
nop
jg 0x433e7f
pushf
add esp, 0
je 0x433e75
popf
nop
jb 0x433e7a
jo 0x433e7c
jle 0x433e7f
mov eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x433e9f
jl 0x433e8a
cmp esp, 0x757f
je 0x433e9d
xchg edx, edi
xchg edx, edi
jbe 0x433e98
js 0x433e9a
jne 0x433e9d
mov esp, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x434eb3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee6e
add esp, 0xc
add eax, 0
add ecx, 0x1452
sub ecx, 0x1452
add esp, 0
ror esp, 0
jbe 0x434ef5
pushf
xor esp, 0
nop
jle 0x434eeb
add esi, 0
popf
jb 0x434ef2
ja 0x434ef5
lcall 0x45c6, 0x48e845c6
jns 0x434ec4
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
inc ebp
cmc
inc edx
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
push ebx
add ebx, 0x5813
ror ebx, 8
pop ebx
mov edi, edi
test dword [esp + 8], ebx
jne 0x434f50
jne 0x434f46
js 0x434f48
mov eax, eax
nop
je 0x434f50
xor eax, 0x4d8a019d
call 0x884538d7
dec ebp
call 0x8136a4e7
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004287b0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x434fdc
xor eax, eax
jmp 0x435056
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043505f
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0042ee6e
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x435054
xor esp, 0
je 0x43501f
pushf
test esp, 0x4c25
cmp edi, dword [esp + 0x10]
and esp, 0xffffffff
popf
xchg edx, ecx
xchg edx, ecx
jne 0x43501f
add eax, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.0042d94c
add esp, 4
test esp, 0x5ae4
nop
jle 0x435043
pushf
js 0x435038
popf
jp 0x43503c
jb 0x43503e
jl 0x435040
jg 0x435043
ljmp 0x558b:0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x435056
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43553f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x435553
jmp 0x4356fb
test dword [esp], eax
shl eax, 0
mov esp, esp
jns 0x43555d
js 0x43556c
pushf
xchg esp, esp
js 0x435565
popf
je 0x435569
jns 0x43556c
mov edx, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x42096c], edx
stc
jg 0x435596
pushf
shl esp, 0
ror esi, 0x19
ror esi, 7
jne 0x43558d
clc
popf
nop
jne 0x435593
jle 0x435596
add eax, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x420974
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x420974], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x420970], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x4201b0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x4201b4], ecx
add esp, 0
jp 0x4355da
pushf
xor edx, 0
popf
jp 0x4355d3
jp 0x4355d5
jnp 0x4355d7
jnp 0x4355da
add eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
call 0x435613
add esp, 4
lea esp, [esp]
and eax, 0xffffffff
jb 0x435634
lea esp, [esp]
jnp 0x435623
jg 0x435625
lea ecx, [ecx + 0x2733]
lea ecx, [ecx - 0x2733]
jae 0x435634
mov esp, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
js 0x43569e
inc ebx
dec ebx
cmp ebx, 0x6970
test esp, 0x329
je 0x4356b5
jo 0x4356b0
jns 0x4356b2
jne 0x4356b5
sub eax, 0x9703d83
inc edx
add byte [eax], al
cmp dword [0x420970], 0
je 0x4356d2
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x420970]
push eax
call fcn.0043505f
mov dword [0x420968], eax
xor esp, 0
rol ebx, 0x19
ror ebx, 0x19
cmp esi, ecx
jle 0x4356eb
jne 0x4356e1
xchg edi, eax
xchg edi, eax
xchg esi, ebx
xchg esi, ebx
jg 0x4356eb
lcall 0x8d00, 0x6a0d6af4
dec ebp
invalid
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0042ee6e
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43b0ab
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x420ba4
call fcn.0043dca7
add esp, 0xc
mov byte [0x420ba4], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x43b8d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0042ee6e
add esp, 0xc
xor edx, dword [esp + 8]
xor edx, dword [esp + 8]
xchg ebx, edx
xchg ebx, edx
jo 0x43b914
lea edx, [edx + 0x296f]
lea edx, [edx - 0x296f]
jno 0x43b90d
xchg esi, ecx
xchg esi, ecx
jno 0x43b914
mov edx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
test dword [esp + 0x10], ecx
rol edx, 0x10
rol edx, 0x10
xor ebx, esi
xor ebx, esi
jg 0x43b954
jae 0x43b96b
pushf
xor esp, 0
lea edi, [edi]
jp 0x43b95f
nop
popf
xchg ecx, ebx
xchg ecx, ebx
jno 0x43b968
jb 0x43b96b
call 0x813006f9
jmp 0xec914175
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0043437e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43b9e0
xor eax, eax
jmp 0x43ba7e
xor ebx, dword [esp + 0xc]
xor ebx, dword [esp + 0xc]
clc
lea esp, [esp]
jle 0x43b9fd
pushf
jns 0x43b9f2
clc
nop
popf
lea esi, [esi]
jmp 0x43b9fa
jg 0x43b9fd
mov esi, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043505f
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0042ee6e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x43ba27
xor eax, eax
jmp 0x43ba7e
lea esi, [esi]
and esp, 0xffffffff
jae 0x43ba41
ja 0x43ba30
lea ebx, [ebx + 0x4614]
lea ebx, [ebx - 0x4614]
jp 0x43ba3e
jb 0x43ba41
mov ecx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0042d94c
add esp, 4
jg 0x43ba4f
jmp 0x43ba51
or esp, 0
jb 0x43ba77
pushf
inc eax
dec eax
jns 0x43ba5c
add esi, dword [esp]
sub esi, dword [esp]
popf
lea eax, [eax + 0x4e12]
lea eax, [eax - 0x4e12]
jbe 0x43ba72
je 0x43ba74
jae 0x43ba77
jmp 0x514c0806
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43cad1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0042ee6e
add esp, 0xc
jns 0x43caec
jb 0x43cafa
jbe 0x43caf0
mov eax, eax
jp 0x43caf4
jp 0x43caf6
jae 0x43cafa
add eax, 0xf445c6e2
push ebx
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
ror ecx, 0xf
rol ecx, 0xf
jns 0x43cb3d
jne 0x43cb34
xchg edi, eax
xchg edi, eax
jge 0x43cb38
jl 0x43cb3a
js 0x43cb3d
mov eax, 0x80f44d8a
jmp 0xf4915347
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
stc
test eax, 0x6f83
jns 0x43cbc1
pushf
rol esi, 0x16
ror esi, 0x16
push esi
add esi, 0x1246
ror esi, 0x15
pop esi
popf
jl 0x43cbbc
jge 0x43cbbe
js 0x43cbc1
lcall 0x89ff, 0xfeb9afe8
inc ebp
invalid
call 0x428575
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43cbd9
mov eax, 1
jmp 0x43cca8
ja 0x43cbdb
add ebx, 0x75a4
sub ebx, 0x75a4
jno 0x43cbe9
and edi, 0xffffffff
jnp 0x43cc01
je 0x43cbf0
lea edx, [edx + 0x13de]
lea edx, [edx - 0x13de]
jp 0x43cbfe
jp 0x43cc01
ljmp 0x4d8b:0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0043505f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0042ee6e
add esp, 0xc
lea edx, [edx + 0x143e]
lea edx, [edx - 0x143e]
stc
jae 0x43cc4e
pushf
test ebx, edx
mov esp, esp
ror esp, 0
add edi, 0x4d93
sub edi, 0x4d93
popf
xchg esi, edi
xchg esi, edi
jb 0x43cc4e
mov esp, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x43cc5b
mov eax, 1
jmp 0x43cca8
ror esi, 0x19
rol esi, 0x19
ror esi, 0
push eax
add eax, 0x6f9e
ror eax, 0x17
pop eax
jle 0x43cc7e
pushf
jg 0x43cc74
ror esp, 0
popf
je 0x43cc7b
jg 0x43cc7e
mov ebx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.0042d94c
add esp, 4
nop
jle 0x43cca1
pushf
call 0x43cc94
lea esp, [esp + 4]
popf
xchg esi, esi
xchg edi, eax
xchg edi, eax
jg 0x43cca1
mov esp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43cf38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee6e
add esp, 0xc
jg 0x43cf5a
jle 0x43cf70
js 0x43cf5e
jl 0x43cf60
lea edi, [edi + 0x7a30]
lea edi, [edi - 0x7a30]
jg 0x43cf70
mov edx, 0xe845c6c5
push ecx
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jg 0x43d01b
jl 0x43d02f
pushf
rol esp, 0
mov esp, esp
popf
lea eax, [eax]
jle 0x43d02a
mov ebx, ebx
jge 0x43d02f
add eax, 0xff734ae8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.0043437e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43d044
xor eax, eax
jmp 0x43d0e2
call 0x43d049
add esp, 4
je 0x43d04e
xor edx, dword [esp + 4]
xor edx, dword [esp + 4]
jno 0x43d06a
jne 0x43d05a
lea ebx, [ebx + 0x284b]
lea ebx, [ebx - 0x284b]
jo 0x43d06a
ljmp 0x8b52:0xe8558d34
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0043505f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0042ee6e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x43d094
xor eax, eax
jmp 0x43d0e2
mov ebx, ebx
jle 0x43d0aa
pushf
jne 0x43d09c
lea ecx, [ecx]
ror edi, 0
popf
jnp 0x43d0a5
mov esp, esp
jg 0x43d0aa
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0042d94c
add esp, 4
test dword [esp], edi
or esi, 0
and esp, 0xffffffff
jle 0x43d0d7
lea ebx, [ebx]
lea edx, [edx + 0x567]
lea edx, [edx - 0x567]
mov eax, eax
jp 0x43d0d3
jg 0x43d0d7
call 0xc895cb9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e74d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0042ee6e
add esp, 0xc
xor esi, 0x42d
xor esi, 0x42d
jl 0x43e77c
jo 0x43e776
lea edx, [edx]
jge 0x43e77c
mov ecx, 0xec45c6bc
push ebx
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
mov esp, esp
push ecx
pop ecx
test dword [esp + 4], edi
add ecx, dword [esp]
sub ecx, dword [esp]
jle 0x43e7e5
pushf
std
cld
lea eax, [eax + 0x77e7]
lea eax, [eax - 0x77e7]
popf
xchg ecx, edi
xchg ecx, edi
jnp 0x43e7e0
jb 0x43e7e2
jg 0x43e7e5
lcall 0x1e9, 0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0043437e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e86f
jmp 0x43e8e8
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043505f
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0042ee6e
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x43e8e8
jp 0x43e897
ja 0x43e899
jb 0x43e89b
jbe 0x43e8af
pushf
rol esi, 0xd
ror esi, 0xd
cmp ebx, dword [esp]
popf
lea ecx, [ecx]
ja 0x43e8af
mov eax, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.0042d94c
add esp, 4
ror edi, 0
jae 0x43e8c0
shr esp, 0
sub ebx, 0
je 0x43e8d5
jns 0x43e8ca
lea esp, [esp]
nop
jge 0x43e8d0
jne 0x43e8d5
mov ebx, 0x4d8bf5b4
adc al, 0x51
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44130b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0042ee6e
add esp, 0xc
jg 0x441326
and edx, 0xffffffff
je 0x441336
nop
jne 0x44132e
jbe 0x441330
jge 0x441332
jne 0x441336
mov ebx, 0xe845c6c2
inc edi
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
inc esi
dec esi
jb 0x441372
jo 0x441381
ja 0x441376
xchg esp, esp
jl 0x44137a
lea edx, [edx]
jno 0x441381
mov ecx, 0x4d8aeca1
call 0x8845fd08
dec ebp
call 0x81376918
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.004287b0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x441404
xor eax, eax
jmp 0x441483
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0043505f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0042ee6e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x441481
stc
je 0x441442
pushf
xor esi, dword [esp + 0xc]
xor esi, dword [esp + 0xc]
popf
xchg ecx, ecx
jne 0x44143d
je 0x44143f
jne 0x441442
mov ebp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0042d94c
add esp, 4
ror edi, 9
rol edi, 9
je 0x44146c
pushf
mov edx, edx
lea esp, [esp]
jae 0x44145f
xor esp, 0
popf
lea esp, [esp]
xchg edi, edi
jne 0x44146c
mov ecx, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x441483
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10