joyce8/EMBER2024-capa huggingface dataset:
Function at 0x616fc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x616ff1
dec al
je 0x61702c
dec al
je 0x617070
dec al
je 0x6170e2
jmp 0x61717d
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x61717d
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x617001
jmp 0x61717d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x61717d
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x61703c
jmp 0x61717d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x61717d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x6170a3
xor edx, edx
mov dword [esp + 4], edx
jmp 0x6170b8
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x6170d0
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x617080
jmp 0x61717d
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x61717d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x617149
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.00613fa4
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6170fe
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61d374
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
call fcn.00409de0
mov eax, dword [ebp - 0xc]
call fcn.00409de0
xor eax, eax
push ebp
push 0x61d443
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
je 0x61d3ea
mov dl, 1
mov eax, dword [0x500770]
call fcn.00501e30
mov dword [ebp - 0x10], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00501f18
xor ecx, ecx
mov edx, 0x61d45c
mov eax, dword [ebp - 0x10]
call fcn.00502070
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.005029cc
mov eax, dword [ebp - 0x10]
call fcn.00407ea0
jmp 0x61d428
mov dl, 1
mov eax, dword [0x500770]
call fcn.00501e30
mov dword [ebp - 0x10], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00501f18
xor ecx, ecx
mov edx, 0x61d45c
mov eax, dword [ebp - 0x10]
call fcn.00502070
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00502558
mov eax, dword [ebp - 0x10]
call fcn.00407ea0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d44a
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00409d5c
ret
Function at 0x437e73
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.004482bc
add esp, 0xc
call fcn.00437e91

Function at 0x43833f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cld
je 0x438352
jo 0x43834d
ja 0x43834f
jne 0x438352
call 0x1b9fc0d9
inc ebx
add byte [ecx], al
cmp dword [0x431b5c], 1
jne 0x438490
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004482bc
add esp, 0xc
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 6], 0x42
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x47
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 7], 0x66
add ecx, dword [esp]
sub ecx, dword [esp]
inc esi
dec esi
xor edx, 0x26aa
xor edx, 0x26aa
or edx, edx
jno 0x4383c0
jg 0x4383b9
jge 0x4383bb
jo 0x4383c0
mov ebx, 0x4d8a20cf
invalid
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
push eax
add eax, 0x5f78
ror eax, 9
pop eax
jne 0x43842c
ror esp, 0
jae 0x438437
ja 0x438433
jb 0x438437
mov ebp, 0xc83d83a5
sbb al, 0x43
add byte [eax], al
cmp dword [0x431cc8], 0
jne 0x438448
or eax, 0xffffffff
jmp 0x43866d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x431cc8]
push ecx
call fcn.0043bdcc
mov dword [ebp - 4], eax
jne 0x43845d
test dword [esp], esi
jns 0x438466
nop
js 0x438466
mov ebx, 0x6a0c6a
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004482bc
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x438486
mov eax, dword [ebp - 4]
mov dword [0x431b5c], eax
jmp 0x43848e
or eax, 0xffffffff
jmp 0x43866d
jmp 0x438499
mov ecx, dword [0x431b5c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
std
cld
and esi, 0xffffffff
jl 0x4384b0
jo 0x4384a8
jnp 0x4384aa
jge 0x4384ac
nop
jge 0x4384b0
lcall 0x18e8, 0x50ec458b
dec edx
add byte [eax], al
mov eax, dword [ebp - 0x14]
push eax
call fcn.0043ced1
add esp, 4
push 0xc
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004482bc
add esp, 0xc
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 6], 0x58
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x47
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 7], 0x66
add eax, 0
rol esp, 0
jp 0x438504
call fcn.00438509
Function at 0x438f45
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x433020
call fcn.0044cd3a
add esp, 0xc
mov byte [0x433020], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x438f9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004482bc
add esp, 0xc
xchg edx, ebx
xchg edx, ebx
jg 0x438fc3
jns 0x438fce
xchg ecx, edi
xchg ecx, edi
js 0x438fcb
js 0x438fce
xor eax, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
clc
xor esp, 0
push eax
pop eax
je 0x439087
mov esp, esp
jae 0x439083
jne 0x439087
mov eax, 0x1b92e8c9
add byte [eax], al
call fcn.0043ac1e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43909c
xor eax, eax
jmp 0x439134
test esp, 0x1b3d
jl 0x4390af
je 0x4390a6
mov ecx, ecx
jl 0x4390aa
jp 0x4390ac
jge 0x4390af
add eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0043bdcc
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004482bc
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4390d9
xor eax, eax
jmp 0x439134
ror ecx, 6
rol ecx, 6
xchg edx, eax
xchg edx, eax
xor edi, 0x788
xor edi, 0x788
ror ebx, 0
jl 0x439104
pushf
xchg ecx, eax
xchg ecx, eax
lea eax, [eax]
nop
popf
mov edi, edi
jb 0x4390ff
jb 0x439101
jge 0x439104
mov esi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0043ced1
add esp, 4
ror eax, 0x1d
ror eax, 3
jbe 0x439129
pushf
add esi, dword [esp]
sub esi, dword [esp]
popf
xchg esi, esi
ja 0x439126
ja 0x439129
or dword [ebx - 0x74aff3bb], 0xff51084d
push ebp
cld
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43a424
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x431b64], 1
jne 0x43a57d
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004482bc
add esp, 0xc
jp 0x43a44c
add esp, 0
and edx, 0xffffffff
jo 0x43a470
pushf
call 0x43a45b
lea esp, [esp + 4]
cmp esi, edi
rol edi, 4
ror edi, 4
inc ecx
dec ecx
popf
jl 0x43a46d
jno 0x43a470
call 0x492bea3a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
jno 0x43a4a2
jb 0x43a4b7
pushf
and esp, 0xffffffff
xor esp, 0
jns 0x43a4ae
mov esp, esp
popf
lea ebx, [ebx]
jae 0x43a4b7
add eax, 0x80e84d8a
jmp 0xe8912cc1
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0043ac1e
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43a52c
xor eax, eax
jmp 0x43a5de
inc ecx
dec ecx
test dword [esp], edx
je 0x43a538
xchg ebx, ebx
jne 0x43a538
mov ebp, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0043bdcc
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004482bc
add esp, 0xc
cld
jg 0x43a55b
jle 0x43a567
pushf
nop
popf
jb 0x43a564
jg 0x43a567
ljmp 0xa74:0xf87d83
cmp dword [ebp - 8], 0
je 0x43a577
mov eax, dword [ebp - 8]
mov dword [0x431b64], eax
jmp 0x43a57b
xor eax, eax
jmp 0x43a5de
jmp 0x43a586
mov ecx, dword [0x431b64]
mov dword [ebp - 8], ecx
sub esi, 0
not edi
not edi
jns 0x43a58f
xor ebx, dword [esp + 4]
xor ebx, dword [esp + 4]
jno 0x43a5a6
jb 0x43a59b
lea esp, [esp]
xchg ecx, ecx
jb 0x43a5a2
jo 0x43a5a6
sub eax, 0xf8558b35
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
ja 0x43a5ae
jmp 0x43a5b0
test ecx, eax
xor edx, 0
jo 0x43a5c7
pushf
xchg ebx, esi
xchg ebx, esi
clc
popf
mov eax, eax
xchg ebx, ebx
jno 0x43a5c7
ljmp 0x1e8:0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0043ced1
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43afb6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004482bc
add esp, 0xc
cmp edi, dword [esp]
jne 0x43afe9
xchg edx, esi
xchg edx, esi
mov esp, esp
lea edx, [edx + 0x773f]
lea edx, [edx - 0x773f]
je 0x43afe9
mov edx, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
jnp 0x43b023
add esp, 0
jno 0x43b028
jle 0x43b046
pushf
jp 0x43b02e
add edi, 0xa37
sub edi, 0xa37
rol esp, 0
jae 0x43b03f
popf
jno 0x43b043
jg 0x43b046
mov edx, 0x80f44d8a
jmp 0xf4913850
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
jge 0x43b0b9
jno 0x43b0dc
pushf
lea ebx, [ebx + 0x2118]
lea ebx, [ebx - 0x2118]
add edx, dword [esp]
sub edx, dword [esp]
and esi, 0xffffffff
popf
ja 0x43b0d6
lea esp, [esp]
jo 0x43b0dc
mov ecx, 0xfffb3de8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 5], dh
call fcn.0043ac1e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43b0ef
jmp 0x43b1b1
xor ecx, edx
xor ecx, edx
and esi, esi
call fcn.0043b0fa
Function at 0x43beaa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.004482bc
add esp, 0xc
mov esp, esp
js 0x43becd
lea ebx, [ebx]
jns 0x43becd
adc dword [edi + 0x48e045c6], 0x65e545c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
nop
test eax, edi
je 0x43bf3b
pushf
jge 0x43bf22
test esi, ebx
lea ecx, [ecx + 0x2575]
lea ecx, [ecx - 0x2575]
popf
mov eax, eax
jnp 0x43bf36
jge 0x43bf38
jne 0x43bf3b
add eax, 0x80e04d8a
jmp 0xe0914745
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
jnp 0x43bfd9
jl 0x43bfe5
jnp 0x43bfdd
jle 0x43bfdf
lea eax, [eax]
jge 0x43bfe5
mov ecx, 0xec34e89a
invalid
call fcn.0043ac1e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43bffa
xor eax, eax
jmp 0x43c2a2
jle 0x43bffc
jb 0x43c015
pushf
clc
call fcn.0043c006
Function at 0x43ea89
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004482bc
add esp, 0xc
mov eax, eax
dec ecx
inc ecx
sub esi, 0
jmp 0x43eaab
jle 0x43eacb
pushf
rol edx, 0
ror edi, 0x1c
ror edi, 4
popf
jae 0x43eabc
lea edx, [edx + 0x57b2]
lea edx, [edx - 0x57b2]
jg 0x43eacb
call 0x49303095
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
shr ebx, 0
jnp 0x43eb29
pushf
xor edi, ecx
xor edi, ecx
jbe 0x43eb18
xor ebx, dword [esp + 8]
xor ebx, dword [esp + 8]
mov esp, esp
popf
js 0x43eb26
jp 0x43eb29
sub eax, 0x80ec4d8a
jmp 0xec917333
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.0043ac1e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43ebc0
xor eax, eax
jmp 0x43ecc1
cmp edx, dword [esp]
ror ecx, 0
cmp eax, dword [esp]
xchg esi, esi
jne 0x43ebe3
pushf
add esp, 0
rol eax, 0x19
rol eax, 7
popf
jl 0x43ebdc
ja 0x43ebde
lea ebx, [ebx]
je 0x43ebe3
add eax, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0043bdcc
mov dword [ebp - 0x18], eax
and esi, esi
rol esi, 0x1a
rol esi, 6
jge 0x43ec2a
pushf
push esi
pop esi
nop
ror esp, 0
rol ebx, 0xa
ror ebx, 0xa
popf
lea ecx, [ecx + 0x1f11]
lea ecx, [ecx - 0x1f11]
je 0x43ec1b
lea edi, [edi + 0x8d2]
lea edi, [edi - 0x8d2]
jl 0x43ec2a
mov edi, 0x6a106a
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004482bc
add esp, 0xc
dec esi
inc esi
push ecx
pop ecx
and edx, edx
cmp ecx, 0x5134
jle 0x43ec5d
pushf
test esp, 0x4acd
jnp 0x43ec52
js 0x43ec54
popf
jmp 0x43ec58
jb 0x43ec5a
jg 0x43ec5d
mov ebp, 0xe87d83
cmp dword [ebp - 0x18], 0
jne 0x43ec67
xor eax, eax
jmp 0x43ecc1
or eax, eax
jne 0x43ec6b
jns 0x43ec77
jb 0x43ec6f
je 0x43ec71
jno 0x43ec73
js 0x43ec77
mov edi, 0xe84d8b7b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0043ced1
add esp, 4
call fcn.0043ec88
Function at 0x4480e1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4480f5
jmp 0x4482b3
call fcn.004480fa
Function at 0x449b7a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x431b68], 1
jne 0x449cd5
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004482bc
add esp, 0xc
jb 0x449ba2
call fcn.00449ba7
mov eax, dword [0x431b68]
mov dword [ebp - 8], eax

Function at 0x44a8a3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004482bc
add esp, 0xc
je 0x44a8be
and esp, 0xffffffff
jnp 0x44a8cf
lea edi, [edi]
jmp 0x44a8c7
lea esp, [esp]
mov esp, esp
jp 0x44a8cf
mov edx, 0x52e445c6
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
add esp, 0
jns 0x44a920
je 0x44a922
sub esp, 0
jae 0x44a937
pushf
je 0x44a92b
rol esp, 0
jp 0x44a930
popf
xchg esp, esp
jb 0x44a937
mov esp, 0x80e44d8a
jmp 0xe4923141
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
jmp 0x44a9d5
ja 0x44a9d7
xchg esp, esp
je 0x44a9e1
mov esp, esp
jne 0x44a9e1
ljmp 0xffff:0xe73ce86f
call 0x449122
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44a9f6
xor eax, eax
jmp 0x44aabb
rol esp, 0
xor esi, 0x873
xor esi, 0x873
jge 0x44aa14
pushf
jg 0x44aa0b
popf
xchg ebx, esi
xchg ebx, esi
jl 0x44aa14
jmp 0x5228f7a5
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0043bdcc
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004482bc
add esp, 0xc
call fcn.0044aa39