joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x11c
mov eax, dword [esp + 0x134]
mov dword [esp + 4], 1
lea edx, [eax + eax + 1]
mov eax, edx
sar eax, 0x1f
shr eax, 0x1e
lea ecx, [edx + eax]
and ecx, 3
sub eax, ecx
lea eax, [edx + eax + 4]
mov dword [esp], eax
call fcn.0047a380
test eax, eax
mov edi, eax
je 0x4192ae
mov ebx, dword [esp + 0x130]
mov ebp, edi
mov esi, dword [esp + 0x134]
mov eax, dword [esp + 0x134]
add esi, ebx
test eax, eax
je 0x4192a1
lea esi, [esi]
movzx eax, byte [ebx]
add ebx, 1
mov dword [esp], ebp
add ebp, 2
mov dword [esp + 4], str._02x
mov dword [esp + 8], eax
call fcn.004186c0
cmp ebx, esi
jne 0x419280
add esp, 0x11c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x10], 0x6c696146
mov dword [esp + 0x14], 0x74206465
mov dword [esp + 0x18], 0x6163206f
mov dword [esp + 0x1c], 0x636f6c6c
mov dword [esp + 0x20], 0x206e6920
mov dword [esp + 0x24], 0x326e6962
mov dword [esp + 0x28], 0x786568
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
jmp 0x41925f

Function at 0x419310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x144]
mov ebp, dword [esp + 0x140]
mov esi, dword [esp + 0x148]
movzx eax, byte [ebx]
test al, al
je 0x4193a6
test esi, esi
je 0x419400
movzx ecx, byte [ebx + 1]
test cl, cl
je 0x41940d
lea edi, [esp + 0x1c]
jmp 0x419364
test esi, esi
je 0x419400
movzx ecx, byte [ebx + 1]
test cl, cl
je 0x41940d
mov dword [edi], 0
mov byte [esp + 0x1c], al
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x484d13
mov dword [esp], edi
mov byte [esp + 0x1d], cl
call fcn.0047a330
cmp eax, 1
jne 0x4193b0
mov eax, dword [esp + 0x18]
add ebx, 2
sub esi, 1
mov byte [ebp], al
movzx eax, byte [ebx]
add ebp, 1
test al, al
jne 0x419350
test esi, esi
sete al
jmp 0x419402
cmp byte [0x4a2d14], 0
jne 0x4193cb
cmp byte [0x4a0b60], 0
jne 0x4193cb
cmp dword [0x47f720], 2
jle 0x419400
lea ebx, [esp + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.hex2bin_sscanf__s_failed
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call fcn.00471bd0
mov dword [esp + 4], ebx
mov dword [esp], 3
call fcn.0042ace0
nop
lea esi, [esi]
xor eax, eax
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [0x4a2d14], 0
jne 0x419429
cmp byte [0x4a0b60], 0
jne 0x419429
mov edx, dword [0x47f720]
test edx, edx
js 0x419400
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x20], 0x32786568
mov dword [esp + 0x24], 0x206e6962
mov dword [esp + 0x28], 0x20727473
mov dword [esp + 0x2c], 0x6e757274
mov dword [esp + 0x30], 0x65746163
mov word [esp + 0x34], 0x64
call fcn.0042ace0
jmp 0x419400
Function at 0x41e050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
push ebx
sub esp, 0x110
mov ebx, dword [esp + 0x120]
test ebx, ebx
je 0x41e0da
mov dword [esp], ebx
call fcn.0047a2e0
lea eax, [eax*4 + 5]
mov dword [esp], eax
call fcn.0047a2e8
test eax, eax
mov edi, eax
je 0x41e121
mov esi, eax
jmp 0x41e09f
mov byte [esi], al
movzx eax, byte [ebx]
add esi, 1
add ebx, 1
test al, al
je 0x41e0cb
movzx eax, byte [ebx]
lea edx, [eax - 0x20]
cmp dl, 0x5e
jbe 0x41e090
mov dword [esp], esi
add esi, 4
mov dword [esp + 8], eax
mov dword [esp + 4], str.0x_02x
call fcn.004186c0
movzx eax, byte [ebx]
add ebx, 1
test al, al
jne 0x41e09f
mov byte [esi], 0
add esp, 0x110
mov eax, edi
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0x485414
call fcn.00471b68
test eax, eax
jne 0x41e064
lea eax, [esp + 0x10]
mov esi, str.Failed_to_malloc_in_text_str_null
mov edi, eax
mov ecx, 0x22
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
jmp 0x41e064
lea eax, [esp + 0x10]
xor esi, esi
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x10], 0x6c696146
mov dword [esp + 0x14], 0x74206465
mov dword [esp + 0x18], 0x616d206f
mov dword [esp + 0x1c], 0x636f6c6c
mov dword [esp + 0x20], 0x206e6920
mov dword [esp + 0x24], 0x74786574
mov dword [esp + 0x28], 0x7274735f
mov dword [esp + 0x2c], 0x74787420
mov byte [esp + 0x30], 0
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
jmp 0x41e09f

Function at 0x41e1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x11c
mov eax, dword [esp + 0x120]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00460710
test eax, eax
je 0x41e22e
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x10], 0x6c696146
mov dword [esp + 0x14], 0x74206465
mov dword [esp + 0x18], 0x6573206f
mov dword [esp + 0x1c], 0x6e695f6d
mov dword [esp + 0x20], 0x69207469
mov dword [esp + 0x24], 0x6763206e
mov dword [esp + 0x28], 0x5f6d6573
mov dword [esp + 0x2c], 0x74696e69
mov byte [esp + 0x30], 0
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
add esp, 0x11c
ret

Function at 0x420b50
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret
Function at 0x420e40
Capabilities:
Hash data using sha256

Disassembly:
push ebx
sub esp, 0x108
mov eax, dword [esp + 0x114]
lea ebx, [esp + 0x18]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x110]
mov dword [esp + 0x20], 0x6a09e667
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0x3c6ef372
mov dword [esp + 4], eax
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0x510e527f
mov dword [esp + 0x34], 0x9b05688c
mov dword [esp + 0x38], 0x1f83d9ab
mov dword [esp + 0x3c], 0x5be0cd19
call fcn.00420ba0
mov eax, dword [esp + 0x118]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00420ca0
add esp, 0x108
pop ebx
ret

Function at 0x420f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, edx
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x12c
movzx edx, byte [eax]
test dl, dl
je 0x420fac
mov ecx, edx
mov ebx, eax
xor esi, esi
jmp 0x420f84
cmp cl, 0x22
je 0x420fc0
cmp cl, 0x2c
je 0x420f97
add ebx, 1
movzx ecx, byte [ebx]
test cl, cl
je 0x420fa8
cmp cl, 0x3d
je 0x420f97
jle 0x420f70
cmp cl, 0x5c
nop
je 0x420fd0
cmp cl, 0x7c
jne 0x420f7a
mov eax, ebp
cmp al, 1
adc esi, 0
add ebx, 1
movzx ecx, byte [ebx]
test cl, cl
jne 0x420f84
test esi, esi
jne 0x420fd5
add esp, 0x12c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebp
cmp al, 1
sbb esi, 0xffffffff
jmp 0x420f7a
add esi, 1
jmp 0x420f7a
mov dword [esp], edi
mov byte [esp + 0x1c], dl
call fcn.0047a2e0
lea eax, [esi + eax + 1]
mov dword [esp], eax
call fcn.0047a2e8
movzx edx, byte [esp + 0x1c]
test eax, eax
je 0x421072
mov ecx, eax
jmp 0x421012
cmp dl, 0x22
je 0x421051
cmp dl, 0x2c
je 0x421030
mov byte [ecx], dl
add ecx, 1
movzx edx, byte [edi]
add edi, 1
test dl, dl
je 0x421060
cmp dl, 0x3d
je 0x421030
jle 0x421000
cmp dl, 0x5c
je 0x421042
cmp dl, 0x7c
jne 0x42100a
lea esi, [esi]
mov ebx, ebp
test bl, bl
jne 0x42100a
mov byte [ecx], 0x5c
add ecx, 1
movzx edx, byte [edi - 1]
jmp 0x42100a
mov byte [ecx], 0x5c
movzx edx, byte [edi - 1]
mov byte [ecx + 1], dl
add ecx, 2
jmp 0x42100f
mov ebx, ebp
mov edx, 0x22
test bl, bl
je 0x42100a
jmp 0x421036
mov byte [ecx], 0
mov edi, eax
add esp, 0x12c
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
lea edx, [esp + 0x20]
mov dword [esp + 4], edx
mov dword [esp], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x6c696146
mov dword [esp + 0x24], 0x74206465
mov dword [esp + 0x28], 0x616d206f
mov dword [esp + 0x2c], 0x636f6c6c
mov dword [esp + 0x30], 0x63736520
mov dword [esp + 0x34], 0x20657061
mov dword [esp + 0x38], 0x667562
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
movzx edx, byte [edi]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
jmp 0x421012
Function at 0x421c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
sub esp, 0x118
mov dword [esp], 0x4a2c2c
call fcn.00463af0
test eax, eax
jne 0x421d54
mov eax, dword [0x4a2d84]
test eax, eax
jle 0x421cf6
mov edx, dword [0x4a2d6c]
xor ebx, ebx
lea ecx, [edx + eax*4]
nop
mov eax, dword [edx]
mov eax, dword [eax + 4]
cmp dword [eax], 5
sete al
add edx, 4
movzx eax, al
add ebx, eax
cmp edx, ecx
jne 0x421cc0
mov dword [esp], 0x4a2c2c
call fcn.00462840
test eax, eax
jne 0x421cfa
call fcn.0045fb60
add esp, 0x118
mov eax, ebx
pop ebx
ret
xor ebx, ebx
jmp 0x421cd7
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x10], 0x20465457
mov dword [esp + 0x14], 0x4f4c5752
mov dword [esp + 0x18], 0x45204b43
mov dword [esp + 0x1c], 0x524f5252
mov dword [esp + 0x20], 0x204e4f20
mov dword [esp + 0x24], 0x4f4c4e55
mov dword [esp + 0x28], 0x214b43
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
jmp 0x421ce7
call fcn.0047d620
lea esi, [esi]
jmp 0x421cab

Function at 0x421d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push ebx
sub esp, 0x114
mov dword [esp], 0x4a2c2c
call fcn.00463af0
test eax, eax
jne 0x421e4c
mov eax, dword [0x4a2d84]
test eax, eax
jle 0x421dd0
mov edx, dword [0x4a2d6c]
xor ebx, ebx
lea esi, [edx + eax*4]
jmp 0x421dac
add ebx, 1
add edx, 4
cmp edx, esi
je 0x421dd2
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov ecx, dword [eax]
cmp ecx, 2
je 0x421da2
cmp ecx, 1
je 0x421da2
cmp ecx, 4
je 0x421da2
cmp ecx, 3
je 0x421da2
jmp 0x421da5
xor ebx, ebx
mov dword [esp], 0x4a2c2c
call fcn.00462840
test eax, eax
jne 0x421df2
call fcn.0045fb60
add esp, 0x114
mov eax, ebx
pop ebx
pop esi
ret
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x10], 0x20465457
mov dword [esp + 0x14], 0x4f4c5752
mov dword [esp + 0x18], 0x45204b43
mov dword [esp + 0x1c], 0x524f5252
mov dword [esp + 0x20], 0x204e4f20
mov dword [esp + 0x24], 0x4f4c4e55
mov dword [esp + 0x28], 0x214b43
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
jmp 0x421de2
call fcn.0047d620
jmp 0x421d8c
Function at 0x433ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x11c
lea eax, [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 0x10], 0x20746547
mov dword [esp + 0x14], 0x726e6166
mov dword [esp + 0x18], 0x65676e61
mov dword [esp + 0x1c], 0x746f6e20
mov dword [esp + 0x20], 0x70757320
mov dword [esp + 0x24], 0x74726f70
mov dword [esp + 0x28], 0xa6465
call fcn.00406ff0
add esp, 0x11c
ret
Function at 0x434830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov eax, dword [ebp + 8]
mov edx, eax
shl edx, 0xa
lea eax, [edx + eax*8]
cmp byte [eax + 0x4a2f44], 0
je 0x434859
cmp byte [0x4a2d2a], 0
jne 0x4348d0
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov dword [ebp - 0x118], 0x20746553
mov dword [ebp - 0x114], 0x6f6d656d
mov dword [ebp - 0x110], 0x6c637972
mov dword [ebp - 0x10c], 0x206b636f
mov dword [ebp - 0x108], 0x20746f6e
mov dword [ebp - 0x104], 0x70707573
mov dword [ebp - 0x100], 0x6574726f
mov word [ebp - 0xfc], 0xa64
mov byte [ebp - 0xfa], 0
call fcn.00406ff0
lea esp, [ebp - 0xc]
mov edx, 1
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
add eax, 0x4a2f48
mov dword [ebp - 0x120], eax
mov eax, dword [eax + 0x140]
mov ebx, eax
sub ebx, 1
lea eax, [ebx + ebx*2]
shl eax, 2
lea edx, [eax + 0x14]
add eax, 0x32
and eax, 0xfffffff0
call fcn.004719c0
sub esp, eax
lea ecx, [esp + 0x1b]
and ecx, 0xfffffff0
mov dword [ecx], edx
mov dword [esp], 0x4a0be4
mov dword [ebp - 0x11c], ecx
call fcn.00460dd0
test eax, eax
jne 0x434a34
mov edx, dword [ebp - 0x11c]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x120]
mov eax, dword [edx + 8]
mov dword [esp], eax
call dword [0x4a0c00]
mov edx, 1
test eax, eax
jne 0x4349fd
mov edx, dword [ebp - 0x11c]
lea eax, [ebx + ebx*2]
imul esi, dword [ebp + 0xc], 0x64
mov dword [edx + eax*4 + 0xc], esi
mov eax, edx
xor edx, edx
test ebx, ebx
jle 0x434982
lea esi, [esi]
cmp esi, dword [eax + 0xc]
jge 0x434978
mov dword [eax + 0xc], esi
add edx, 1
add eax, 0xc
cmp ebx, edx
jne 0x434970
mov edx, dword [ebp - 0x11c]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x120]
mov eax, dword [edx + 8]
mov dword [esp], eax
call dword [0x4a0c04]
mov edx, dword [ebp - 0x11c]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x120]
mov eax, dword [edx + 8]
mov dword [esp], eax
call dword [0x4a0c00]
lea eax, [ebx + ebx*2]
mov ebx, dword [ebp - 0x11c]
xor edx, edx
lea eax, [ebx + eax*4]
mov ecx, dword [eax + 0xc]
mov ebx, dword [eax + 8]
mov eax, dword [eax + 0x10]
cmp esi, ecx
mov esi, dword [ebp - 0x120]
setne dl
mov dword [esi + 0x1b0], ebx
mov dword [esi + 0x1b4], ecx
mov dword [esi + 0x1b8], eax
mov byte [esi + 0x1c2], 1
mov dword [esp], 0x4a0be4
mov dword [ebp - 0x128], edx
call fcn.004603e0
mov edx, dword [ebp - 0x128]
test eax, eax
jne 0x434a69
mov dword [ebp - 0x128], edx
call fcn.0045fb60
mov edx, dword [ebp - 0x128]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
mov eax, edx
pop ebp
ret
lea eax, [ebp - 0x118]
mov esi, 0x4894bb
mov edi, eax
mov ecx, 0x19
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
jmp 0x43491f
lea eax, [ebp - 0x118]
mov esi, 0x4894a0
mov edi, eax
mov ecx, 0x1b
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [ebp - 0x128], edx
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
mov edx, dword [ebp - 0x128]
jmp 0x434a19
Function at 0x434d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov eax, dword [ebp + 8]
mov edx, eax
shl edx, 0xa
lea ebx, [edx + eax*8]
cmp byte [ebx + 0x4a2f44], 0
je 0x434db9
cmp byte [0x4a2d2a], 0
jne 0x434e12
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov dword [ebp - 0x118], 0x20746553
mov dword [ebp - 0x114], 0x63646476
mov dword [ebp - 0x110], 0x746f6e20
mov dword [ebp - 0x10c], 0x70757320
mov dword [ebp - 0x108], 0x74726f70
mov dword [ebp - 0x104], 0xa6465
call fcn.00406ff0
lea esp, [ebp - 0xc]
mov edx, 1
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
add ebx, 0x4a2f48
mov eax, dword [ebx + 0x140]
sub eax, 1
mov dword [ebp - 0x124], eax
lea eax, [eax + eax*2]
shl eax, 2
lea edx, [eax + 0x14]
add eax, 0x32
and eax, 0xfffffff0
call fcn.004719c0
sub esp, eax
lea eax, [esp + 0x1b]
and eax, 0xfffffff0
mov dword [eax], edx
mov dword [esp], 0x4a0be4
mov dword [ebp - 0x128], eax
call fcn.00460dd0
test eax, eax
jne 0x434f8d
mov edx, dword [ebp - 0x128]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [0x4a0c00]
mov edx, 1
test eax, eax
jne 0x434f56
fnstcw word [ebp - 0x11a]
fld dword [ebp + 0xc]
xor dl, dl
fmul dword [0x489f24]
mov edi, dword [ebp - 0x124]
movzx eax, word [ebp - 0x11a]
test edi, edi
mov ah, 0xc
mov word [ebp - 0x11c], ax
mov eax, dword [ebp - 0x128]
fldcw word [ebp - 0x11c]
fistp dword [ebp - 0x120]
fldcw word [ebp - 0x11a]
mov esi, dword [ebp - 0x120]
jle 0x434eea
cmp esi, dword [eax + 0x10]
jge 0x434edc
mov dword [eax + 0x10], esi
add edx, 1
add eax, 0xc
cmp dword [ebp - 0x124], edx
jne 0x434ed4
mov edx, dword [ebp - 0x124]
lea eax, [edx + edx*2]
mov edx, dword [ebp - 0x128]
lea edi, [edx + eax*4]
mov dword [edi + 0x10], esi
mov dword [esp + 4], edx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [0x4a0c04]
mov edx, dword [ebp - 0x128]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [0x4a0c00]
mov ecx, dword [edi + 8]
xor edx, edx
mov eax, dword [edi + 0x10]
mov byte [ebx + 0x1c2], 1
mov dword [ebx + 0x1b0], ecx
mov ecx, dword [edi + 0xc]
cmp esi, eax
setne dl
mov dword [ebx + 0x1b8], eax
mov dword [ebx + 0x1b4], ecx
mov dword [esp], 0x4a0be4
mov dword [ebp - 0x12c], edx
call fcn.004603e0
mov edx, dword [ebp - 0x12c]
test eax, eax
jne 0x434fc2
mov dword [ebp - 0x12c], edx
call fcn.0045fb60
mov edx, dword [ebp - 0x12c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
mov eax, edx
pop ebp
ret
lea eax, [ebp - 0x118]
mov esi, 0x4894bb
mov edi, eax
mov ecx, 0x19
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
jmp 0x434e60
lea eax, [ebp - 0x118]
mov esi, 0x4894a0
mov edi, eax
mov ecx, 0x1b
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [ebp - 0x12c], edx
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
mov edx, dword [ebp - 0x12c]
jmp 0x434f72
Function at 0x445130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, 1
push edi
xor edi, edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x12c
mov dword [esp], 0xa
mov dword [0x47e010], 0
call fcn.0041aa70
mov ecx, dword [0x4a2d84]
test ecx, ecx
jle 0x4451c4
mov eax, dword [0x4a2d6c]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 4]
cmp dword [eax], 6
ja 0x4451b5
mov ecx, dword [eax]
mov eax, ebp
shl eax, cl
mov ecx, eax
and ecx, 0x6e
je 0x4451b5
mov eax, dword [esi + 0x40]
mov dword [esp], eax
call fcn.00465930
test eax, eax
jne 0x445382
mov eax, esi
call fcn.00442380
mov eax, dword [esi + 0x40]
mov dword [esp], eax
call fcn.00462840
test eax, eax
jne 0x445325
call fcn.0045fb60
add edi, 1
add ebx, 1
cmp dword [0x4a2d84], ebx
jg 0x445163
test edi, edi
jne 0x4451e0
mov dword [esp], 0x4a2dac
call fcn.0041e380
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [esp + 0x10]
mov dword [esp], esi
lea ebx, [esp + 0x18]
call fcn.004199a0
jmp 0x44522d
mov dword [esp], ebx
call fcn.004199a0
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0041ac90
fld qword [0x48bac8]
fxch st(1)
fucompi st(1)
fstp st(0)
ja 0x445275
mov dword [esp], 0x4a2d78
call fcn.004603e0
test eax, eax
jne 0x445315
call fcn.0045fb60
mov dword [esp], 0x32
call fcn.0041aa70
mov dword [esp], 0x4a2d78
call fcn.00460dd0
test eax, eax
jne 0x445309
mov edx, dword [0x4a0c44]
test edx, edx
jne 0x4451f2
mov dword [esp], 0x4a2d78
call fcn.004603e0
test eax, eax
jne 0x44538c
call fcn.0045fb60
jmp 0x4451c4
cmp byte [0x4a2d14], 0
jne 0x445290
cmp byte [0x4a0b60], 0
jne 0x445290
mov eax, dword [0x47f720]
test eax, eax
jle 0x445257
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], 1
mov dword [esp + 0x20], 0x5f627375
mov dword [esp + 0x24], 0x61656c63
mov dword [esp + 0x28], 0x2070756e
mov dword [esp + 0x2c], 0x65766167
mov dword [esp + 0x30], 0x20707520
mov dword [esp + 0x34], 0x74696177
mov dword [esp + 0x38], 0x20676e69
mov dword [esp + 0x3c], 0x20726f66
mov dword [esp + 0x40], 0x6f736572
mov dword [esp + 0x44], 0x65637275
mov dword [esp + 0x48], 0x72687420
mov dword [esp + 0x4c], 0x646165
call fcn.0042ace0
jmp 0x445257
call fcn.0047d7b8
nop
jmp 0x44524d
call fcn.0047d7f7
lea esi, [esi]
jmp 0x445228
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x20], 0x20465457
mov dword [esp + 0x24], 0x4f4c5752
mov dword [esp + 0x28], 0x45204b43
mov dword [esp + 0x2c], 0x524f5252
mov dword [esp + 0x30], 0x204e4f20
mov dword [esp + 0x34], 0x4f4c4e55
mov dword [esp + 0x38], 0x214b43
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
jmp 0x4451ad
call fcn.0047d836
jmp 0x445193
lea esi, [esi]
call fcn.0047d7f7
jmp 0x44526b
Function at 0x4476f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x13c
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x150]
mov edi, dword [esp + 0x154]
mov esi, dword [esp + 0x158]
mov dword [esp + 0x2c], edx
test eax, eax
mov dword [edi], 0
mov dword [esi], 0
je 0x447732
cmp byte [eax], 0
jne 0x4477c0
xor eax, eax
cmp byte [0x4a0b61], 0
je 0x4477b4
cmp byte [0x4a2d14], 0
jne 0x447758
cmp byte [0x4a0b60], 0
jne 0x447758
cmp dword [0x47f720], 3
jle 0x4477b4
mov eax, dword [esp + 0x15c]
mov dword [esp], eax
call fcn.00441ae0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x14], ebx
lea ebx, [esp + 0x30]
mov dword [esp + 0x18], eax
mov eax, dword [edx]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [edx]
mov eax, dword [eax + 8]
mov dword [esp + 8], str.USB:__s_i:___d__empty__s
mov dword [esp + 4], 0x100
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.00471bd0
mov dword [esp + 4], ebx
mov dword [esp], 4
call fcn.0042ace0
xor eax, eax
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call fcn.00471b68
test eax, eax
mov ebp, eax
je 0x4478b6
cmp byte [eax], 0
jne 0x4477f8
jmp 0x4478b6
mov ebp, eax
add ebp, 1
mov byte [eax], 0
je 0x4478b6
cmp byte [eax + 1], 0
je 0x4478b6
mov eax, dword [edi]
add eax, 1
mov dword [edi], eax
shl eax, 2
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call fcn.0047a3b0
test eax, eax
mov dword [esi], eax
je 0x4478d4
mov edx, dword [edi]
mov dword [eax + edx*4 - 4], ebp
mov dword [esp + 4], 0xa
mov dword [esp], ebp
call fcn.0047a3f0
test eax, eax
jne 0x4477e0
cmp byte [0x4a0b61], 0
je 0x4478a9
cmp byte [0x4a2d14], 0
jne 0x44784f
cmp byte [0x4a0b60], 0
je 0x4478c6
mov edx, dword [esp + 0x15c]
mov dword [esp], edx
call fcn.00441ae0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x14], ebx
lea ebx, [esp + 0x30]
mov dword [esp + 0x18], eax
mov eax, dword [edx]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [edx]
mov eax, dword [eax + 8]
mov dword [esp + 8], str.USB:__s_i:___d__missing_lf_s__in__s
mov dword [esp + 4], 0x100
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.00471bd0
mov dword [esp + 4], ebx
mov dword [esp], 4
call fcn.0042ace0
add esp, 0x13c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x13c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [0x47f720], 3
jle 0x4478a9
jmp 0x44784f
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x30], 0x6c696146
mov dword [esp + 0x34], 0x74206465
mov dword [esp + 0x38], 0x6572206f
mov dword [esp + 0x3c], 0x6f6c6c61
mov dword [esp + 0x40], 0x5f702063
mov dword [esp + 0x44], 0x6d657469
mov dword [esp + 0x48], 0x6e692073
mov dword [esp + 0x4c], 0x6c6f7420
mov dword [esp + 0x50], 0x73656e69
mov byte [esp + 0x54], 0
call fcn.0042ace0
mov dword [esp], 1
call fcn.00404a60
mov eax, dword [esi]
jmp 0x44781a