joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44163b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004379d6
add esp, 0xc
stc
mov esp, esp
cld
jge 0x44165a
jl 0x441667
pushf
jge 0x441660
popf
xchg esi, esi
jge 0x441667
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
sub edi, 0
jle 0x4416cc
jne 0x4416b6
xchg edx, edi
xchg edx, edi
lea esi, [esi + 0x2d30]
lea esi, [esi - 0x2d30]
mov eax, eax
jg 0x4416cc
mov ecx, 0xe84d8ac9
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.0044a2c8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x441775
xor eax, eax
jmp 0x441818
cld
add ecx, 0x288c
sub ecx, 0x288c
shl edx, 0
clc
je 0x441799
pushf
nop
nop
neg edx
neg edx
popf
jmp 0x441794
jg 0x441796
jne 0x441799
lcall 0x4d8b, 0x50e8458d
cld
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043b989
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004379d6
add esp, 0xc
xor esi, 0
xor edx, dword [esp]
xor edx, dword [esp]
jns 0x4417cb
jg 0x4417c6
mov edx, edx
js 0x4417cb
xor eax, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x4417d5
xor eax, eax
jmp 0x441818
add ebx, 0x22fa
sub ebx, 0x22fa
jb 0x4417e3
jl 0x4417eb
nop
jge 0x4417e8
jge 0x4417eb
mov ebp, 0x50e4458b
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0043edf4
add esp, 4
xchg esi, eax
xchg esi, eax
js 0x441815
pushf
jne 0x4417ff
nop
xchg esi, eax
xchg esi, eax
lea eax, [eax + 0x5868]
lea eax, [eax - 0x5868]
popf
jp 0x441812
jns 0x441815
add eax, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a12e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004379d6
add esp, 0xc
shl ecx, 0
shl esp, 0
mov edi, edi
jns 0x44a160
pushf
jp 0x44a155
inc edi
dec edi
popf
ja 0x44a15b
jo 0x44a15d
js 0x44a160
mov esp, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
lea edx, [edx + 0x57a8]
lea edx, [edx - 0x57a8]
or esp, 0
jl 0x44a1be
pushf
rol esi, 0
ror esp, 0
popf
jne 0x44a1b5
xchg edi, ebx
xchg edi, ebx
jnp 0x44a1bb
jge 0x44a1be
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0044a2c8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44a233
xor eax, eax
jmp 0x44a2bf
xor edx, 0xfab
xor edx, 0xfab
stc
xchg edx, esi
xchg edx, esi
lea edi, [edi + 0x5f56]
lea edi, [edi - 0x5f56]
jnp 0x44a262
pushf
jg 0x44a256
xor ecx, 0
jbe 0x44a25b
popf
jbe 0x44a25f
jp 0x44a262
lcall 0x4d8b, 0x50ec458d
clc
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043b989
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004379d6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x44a28c
xor eax, eax
jmp 0x44a2bf
and esp, 0xffffffff
xchg esi, esi
je 0x44a29a
ja 0x44a295
ja 0x44a297
jne 0x44a29a
mov eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0043edf4
add esp, 4
ror esp, 0
jno 0x44a2b8
pushf
or ebx, 0
popf
xchg edi, edi
nop
jo 0x44a2b8
mov esi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44bcf8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x44bd0c
jmp 0x44bec7
xor edx, 0x703e
xor edx, 0x703e
ja 0x44bd1a
jl 0x44bd29
mov ebx, ebx
mov esp, esp
xchg edi, ebx
xchg edi, ebx
je 0x44bd26
jge 0x44bd29
mov edx, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x4332ac], edx
or eax, eax
jl 0x44bd4b
jne 0x44bd40
mov edi, edi
xchg edi, ebx
xchg edi, ebx
je 0x44bd48
jge 0x44bd4b
xor eax, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x43330c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x43330c], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x433308], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x4332c8], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x4332cc], ecx
cmp ebx, ecx
ror edi, 0x1d
rol edi, 0x1d
test dword [esp], edi
je 0x44bd87
jg 0x44bda2
pushf
lea ecx, [ecx + 0x40ee]
sub ecx, 0x40ee
jae 0x44bd99
popf
mov ebx, ebx
mov edi, edi
jle 0x44bda2
mov eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
rol esp, 0
xor esp, 0
je 0x44bde9
mov ebx, ebx
jno 0x44bde2
lea ecx, [ecx]
nop
jne 0x44bde9
jmp 0xf09a47f0
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jge 0x44be53
xor ebx, dword [esp + 8]
xor ebx, dword [esp + 8]
or eax, 0
lea ebx, [ebx + 0x4c65]
lea ebx, [ebx - 0x4c65]
ja 0x44be8b
pushf
xchg edx, edx
add esi, 0x2f49
sub esi, 0x2f49
sub esp, 0
cmp esi, dword [esp]
popf
mov esi, esi
xchg esi, esi
jbe 0x44be8b
jmp 0x334cfc12
cmp dword [0x433308], 0
je 0x44bea8
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x433308]
push eax
call fcn.0043b989
mov dword [0x4332a8], eax
ror esi, 0
jg 0x44beb7
mov esp, esp
nop
lea esi, [esi]
mov edi, edi
jle 0x44beb7
jmp 0xaecc25
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004379d6
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44c2d2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4332e0], 1
jne 0x44c41c
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004379d6
add esp, 0xc
xor edi, edx
xor edi, edx
je 0x44c309
lea ebx, [ebx]
jge 0x44c302
jo 0x44c304
jg 0x44c306
jne 0x44c309
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
or ecx, ecx
jne 0x44c34c
pushf
ror esp, 0
xchg ebx, ebx
ror ecx, 0
popf
xchg ecx, esi
xchg ecx, esi
je 0x44c34c
mov eax, 0x80e84d8a
jmp 0xe8924b56
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0044a2c8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44c3b9
mov eax, dword [ebp + 8]
jmp 0x44c47e
lea edi, [edi + 0x40af]
sub edi, 0x40af
jae 0x44c3c7
test dword [esp + 0x10], ecx
js 0x44c3cd
jne 0x44c3e4
pushf
jge 0x44c3d3
mov esp, esp
jle 0x44c3d7
jle 0x44c3d9
popf
je 0x44c3dd
xchg edx, edx
xchg edi, eax
xchg edi, eax
je 0x44c3e4
mov ecx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0043b989
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004379d6
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x44c415
mov edx, dword [ebp - 8]
mov dword [0x4332e0], edx
jmp 0x44c41a
mov eax, dword [ebp + 8]
jmp 0x44c47e
jmp 0x44c424
mov eax, dword [0x4332e0]
mov dword [ebp - 8], eax
xor esp, 0
jp 0x44c429
jae 0x44c430
jae 0x44c42d
jb 0x44c430
mov ecx, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
ror eax, 0
jbe 0x44c43b
jae 0x44c453
js 0x44c43f
lea edx, [edx + 0x1838]
lea edx, [edx - 0x1838]
xchg ebx, ebx
jb 0x44c44f
jb 0x44c453
xor eax, 0xfc558b59
mov edx, dword [ebp - 4]
push edx
call fcn.0043edf4
add esp, 4
xchg ecx, ecx
js 0x44c463
xor esp, 0
jge 0x44c477
pushf
ja 0x44c46c
jmp 0x44c46e
jo 0x44c470
popf
jmp 0x44c474
jl 0x44c477
mov eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44d372
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004379d6
add esp, 0xc
ror eax, 0xd
rol eax, 0xd
jns 0x44d3a5
pushf
jg 0x44d397
mov ecx, ecx
sub ebx, 0
je 0x44d39e
popf
jnp 0x44d3a2
js 0x44d3a5
mov eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
call 0x44d3e2
lea esp, [esp + 4]
lea ecx, [ecx + 0x57b8]
lea ecx, [ecx - 0x57b8]
jno 0x44d3f4
jle 0x44d3ff
jno 0x44d3f8
mov edx, edx
js 0x44d3fc
jg 0x44d3ff
jmp 0x8139218d
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
or ebx, 0
neg esi
neg esi
jl 0x44d48f
pushf
shr esp, 0
jge 0x44d480
jbe 0x44d482
test dword [esp + 4], eax
popf
jnp 0x44d48a
jbe 0x44d48c
jge 0x44d48f
mov esp, 0xffce34e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 5], dh
call fcn.0044a2c8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44d4a2
jmp 0x44d535
jbe 0x44d4a4
test dword [esp + 8], edi
ja 0x44d4b4
xchg ecx, edx
xchg ecx, edx
lea edx, [edx]
jbe 0x44d4b4
mov edx, 0xe8558d52
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0043b989
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004379d6
add esp, 0xc
mov esi, esi
jnp 0x44d4e8
pushf
cmc
rol edx, 0
nop
popf
jae 0x44d4e3
je 0x44d4e5
jp 0x44d4e8
jmp 0x141526f
cmp dword [ebp - 4], 0
jne 0x44d4f0
jmp 0x44d535
je 0x44d4f2
add eax, 0
jge 0x44d4fd
jns 0x44d4f9
jl 0x44d4fd
sub eax, 0xfc558b15
mov edx, dword [ebp - 4]
push edx
call fcn.0043edf4
add esp, 4
xchg ecx, ecx
xchg ebx, ebx
add esi, dword [esp]
sub esi, dword [esp]
jle 0x44d515
jbe 0x44d52e
pushf
cmp edi, dword [esp + 0x10]
jl 0x44d51f
jo 0x44d521
shr esi, 0
popf
xchg edx, edx
xchg esp, esp
nop
ja 0x44d52e
mov ecx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44f36f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004379d6
add esp, 0xc
jle 0x44f38a
jno 0x44f39c
pushf
xor esp, 0
popf
xchg esi, esi
jmp 0x44f397
jle 0x44f399
jo 0x44f39c
xor eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
jp 0x44f3ce
test eax, esi
shr eax, 0
jne 0x44f3dd
jbe 0x44f3d7
js 0x44f3d9
je 0x44f3dd
mov eax, 0xf04d8a66
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
and eax, eax
cmp esp, 0x4f25
jo 0x44f45f
pushf
jns 0x44f44b
js 0x44f44d
test dword [esp + 0x10], edi
cmp eax, dword [esp]
popf
jb 0x44f458
js 0x44f45a
lea esi, [esi]
jno 0x44f45f
call 0xfff3594b
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.0044a2c8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44f471
xor eax, eax
jmp 0x44f4c4
shr esp, 0
jno 0x44f4a1
pushf
xor ecx, dword [esp]
xor ecx, dword [esp]
lea edx, [edx + 0x518c]
lea edx, [edx - 0x518c]
neg eax
Function at 0x45149a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004379d6
add esp, 0xc
jge 0x4514b5
je 0x4514c5
pushf
shl esp, 0
popf
jl 0x4514c0
xchg edx, edx
jne 0x4514c5
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
or esp, 0
not edi
not edi
ror esp, 0
jl 0x45151b
jmp 0x451507
jl 0x451509
lea esi, [esi + 0x7622]
lea esi, [esi - 0x7622]
mov esi, esi
jge 0x45151b
mov edx, 0xe84d8ad2
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
xchg ebx, edi
xchg ebx, edi
jno 0x451589
xchg esi, esi
rol ecx, 0
jne 0x45159b
lea edx, [edx]
jg 0x451594
jns 0x451596
je 0x45159b
mov ecx, 0x28e8786f
invalid
call fcn.0044a2c8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4515b0
xor eax, eax
jmp 0x451655
ror eax, 0
ror eax, 0
jl 0x4515c6
js 0x4515ba
jl 0x4515bc
js 0x4515be
xchg esi, ecx
xchg esi, ecx
jge 0x4515c6
mov ebp, 0xe84d8dfa
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0043b989
mov dword [ebp - 4], eax
nop
jne 0x4515fa
pushf
ror ebx, 0x1d
ror ebx, 3
cmp edi, 0x1be4
ror eax, 3
rol eax, 3
mov eax, eax
popf
lea esi, [esi]
jge 0x4515f5
ja 0x4515f7
je 0x4515fa
mov edx, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004379d6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x451614
xor eax, eax
jmp 0x451655
xchg ebx, ebx
ja 0x451628
pushf
lea esp, [esp]
jnp 0x45161f
popf
xchg ecx, edi
xchg ecx, edi
jbe 0x451628
mov ecx, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043edf4
add esp, 4
or esp, 0
cmc
std
cld
not edx
not edx
jbe 0x451652
pushf
mov esp, esp
test dword [esp], ebx
popf
jo 0x45164b
jno 0x45164d
jl 0x45164f
ja 0x451652
call 0x60416c55
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45165c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x432df4
call fcn.0044303b
add esp, 0xc
mov byte [0x432df4], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x451f13
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004379d6
add esp, 0xc
mov esi, esi
mov esp, esp
jl 0x451f4d
pushf
xor esp, 0
test dword [esp + 0xc], edx
popf
jno 0x451f46
jge 0x451f48
jg 0x451f4a
jge 0x451f4d
lcall 0x45c6, 0x4ef045c6
cmc
push 0x66f145c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
or edx, edx
jmp 0x451f81
jg 0x451f8a
lea esi, [esi]
jge 0x451f87
jle 0x451f8a
xor eax, 0x80f04d8a
jmp 0xf092a794
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
cmp ebx, esi
lea esi, [esi]
jnp 0x451ff0
jge 0x452007
pushf
not edx
not edx
call 0x451ffd
add esp, 4
popf
jne 0x452004
jl 0x452007
jmp 0x3bc8f3
call fcn.004516b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x452019
xor eax, eax
jmp 0x452057
std
cld
jnp 0x452034
jp 0x45201f
mov edi, edi
lea edx, [edx + 0x1c65]
lea edx, [edx - 0x1c65]
jl 0x45202f
jp 0x452034
add dword [eax + 0x67], 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043b989
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004379d6
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret