joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e30
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x20c
xor eax, eax
lea edx, [esp + 4]
push esi
mov esi, ecx
push edi
mov ecx, 0x82
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x218]
lea ecx, [esi + 4]
push eax
push ecx
push str._s_s
push edx
call fcn.00404144
mov edx, dword [esi]
add esp, 0x10
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push 0x20006
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x403ea7
mov eax, dword [esp + 0x21c]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop edi
and eax, 0xff
pop esi
add esp, 0x20c
ret 8

Function at 0x403f00
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20c
xor eax, eax
lea edx, [esp + 4]
push esi
mov esi, ecx
push edi
mov ecx, 0x82
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x218]
lea ecx, [esi + 4]
push eax
push ecx
push str._s_s
push edx
call fcn.00404144
add esp, 0x10
mov edx, dword [esi]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x403f94
mov edx, dword [esp + 0x220]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
mov eax, dword [esp + 0x22c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop edi
and eax, 0xff
pop esi
add esp, 0x20c
ret 0xc

Function at 0x404100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404120
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004052ae
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x404141
test byte [esp + 8], 2
je 0x404141
mov dword [0x40e108], 0xd
mov dword [0x40e10c], 5
jmp 0x40411c
xor eax, eax
ret
Function at 0x40855d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40dcb8
cmp edx, dword [eax]
je 0x40857f
add eax, 8
inc ecx
cmp eax, 0x40dd48
jl 0x408570
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40dcb8]
jne 0x4086ad
mov eax, dword [0x40e104]
cmp eax, 1
je 0x408687
test eax, eax
jne 0x4085b0
cmp dword [0x40d768], 1
je 0x408687
cmp edx, 0xfc
je 0x4086ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4085e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409850
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406540
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40862a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406540
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40a584
push edi
call fcn.004099d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409850
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409860
lea eax, [ebp - 0xa0]
push 0x40a564
push eax
call fcn.00409860
push dword [esi + 0x40dcbc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409860
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00409940
add esp, 0x2c
pop edi
jmp 0x4086ad
lea eax, [ebp + 8]
lea esi, [esi + 0x40dcbc]
push 0
push eax
push dword [esi]
call fcn.00406540
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x43cd73
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0x19
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.00447718
add esp, 0xc
rol eax, 0
add esp, 0
cmp ecx, ebx
xchg esp, esp
ja 0x43cda4
xchg esi, esi
jbe 0x43cda4
mov ecx, 0x44dc45c6
mov byte [ebp - 0x24], 0x44
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x1e], 0x55
mov byte [ebp - 0x19], 0x66
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x22], 0x66
mov byte [ebp - 0x1d], 0x70
mov byte [ebp - 0x18], 0x6d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
and esp, 0xffffffff
lea esp, [esp]
jb 0x43cdef
jmp 0x43cdea
jg 0x43cdec
jae 0x43cdef
mov eax, 0x62df45c6
mov byte [ebp - 0x21], 0x62
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1b], 0x6d
mov byte [ebp - 0x16], 0x34
mov byte [ebp - 0x11], 0x71
mov byte [ebp - 0xc], 0
mov cl, byte [ebp - 0x24]
sub cl, 1
mov byte [ebp - 0x24], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x23]
sub al, 1
mov byte [ebp - 0x23], al
mov cl, byte [ebp - 0x1e]
sub cl, 1
mov byte [ebp - 0x1e], cl
mov dl, byte [ebp - 0x19]
sub dl, 1
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x22]
sub dl, 1
mov byte [ebp - 0x22], dl
mov al, byte [ebp - 0x1d]
sub al, 1
mov byte [ebp - 0x1d], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
jo 0x43ce9b
jl 0x43cea6
jge 0x43ce9f
mov edx, edx
ja 0x43cea3
jge 0x43cea6
mov esp, 0x80df4d8a
jmp 0xdf9156b0
mov cl, byte [ebp - 0x21]
sub cl, 1
mov byte [ebp - 0x21], cl
mov dl, byte [ebp - 0x1c]
sub dl, 1
mov byte [ebp - 0x1c], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x20]
sub al, 1
mov byte [ebp - 0x20], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
jo 0x43cef6
jae 0x43cf0a
pushf
add esp, 0
ja 0x43ceff
popf
xchg ebx, eax
xchg ebx, eax
jne 0x43cf05
ja 0x43cf07
jb 0x43cf0a
mov esi, 0xa136e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 8], dh
call fcn.00447045
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43cf20
or eax, 0xffffffff
jmp 0x43cfbe
jle 0x43cf22
call fcn.0043cf27
Function at 0x43d390
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x431cb0
call fcn.00437544
add esp, 0xc
mov byte [0x431cb0], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x43d417
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x431a64], 1
jne 0x43d56f
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00447718
add esp, 0xc
rol esp, 0
test dword [esp + 0xc], edi
jnp 0x43d454
pushf
jmp 0x43d44a
shr eax, 0
popf
ja 0x43d451
jp 0x43d454
lcall 0x45c6, 0x48e845c6
in eax, dx
insd dword es:[edi], dx
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
jl 0x43d486
cmc
rol esp, 0
jns 0x43d4a1
pushf
shr edi, 0
xor edx, 0
neg esi
neg esi
popf
jno 0x43d49c
je 0x43d49e
js 0x43d4a1
mov esp, 0x80e84d8a
jmp 0xe8915cab
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00447045
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43d516
xor eax, eax
jmp 0x43d5d1
xchg ebx, ebx
test dword [esp + 0xc], edi
jg 0x43d529
pushf
std
cld
popf
mov eax, eax
jle 0x43d529
lcall 0x4d8b, 0x50e8458d
hlt
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00442cb5
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00447718
add esp, 0xc
xor edi, 0
test edi, esi
or ecx, ecx
jl 0x43d559
xchg ecx, ecx
jge 0x43d559
mov ebx, 0x7d8388a0
clc
add byte [edx + ecx - 0x75], dh
inc ebp
clc
cmp dword [ebp - 8], 0
je 0x43d569
mov eax, dword [ebp - 8]
mov dword [0x431a64], eax
jmp 0x43d56d
xor eax, eax
jmp 0x43d5d1
jmp 0x43d578
mov ecx, dword [0x431a64]
mov dword [ebp - 8], ecx
neg edi
neg edi
xchg edi, edi
nop
je 0x43d593
pushf
jno 0x43d585
or ecx, ecx
rol ebx, 0
popf
jnp 0x43d58e
mov esi, esi
jne 0x43d593
or dword [ebx + 0x5589f855], 0x560071fc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jno 0x43d59b
push esi
add esi, 0x6d87
ror esi, 1
pop esi
jbe 0x43d5ba
pushf
jb 0x43d5ab
jg 0x43d5ad
or eax, eax
popf
jge 0x43d5b3
xchg ecx, edx
xchg ecx, edx
ja 0x43d5ba
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00439ef9
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x441fed
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
in al, dx
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00447718
add esp, 0xc
or ecx, ecx
jns 0x442020
pushf
cmp edx, esi
popf
xchg ecx, esi
xchg ecx, esi
js 0x44201d
js 0x442020
lcall 0x45c6, 0x51e845c6
in eax, dx
je 0x441fef
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
xchg edx, edx
xchg ebx, eax
xchg ebx, eax
je 0x4420df
pushf
xor esp, 0
popf
jno 0x4420d8
jmp 0x4420da
jne 0x4420dc
jne 0x4420df
jmp 0x9382cb
call fcn.00447045
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4420f1
xor eax, eax
jmp 0x44216c
xchg esp, esp
je 0x4420fa
jno 0x4420f7
jne 0x4420fa
ljmp 0x458b:0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00442cb5
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00447718
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x442124
xor eax, eax
jmp 0x44216c
shr eax, 0
ror esp, 0
mov esi, esi
add esp, 0
jbe 0x44213e
jbe 0x442133
jge 0x442135
xchg esi, eax
xchg esi, eax
xchg ecx, esi
xchg ecx, esi
ja 0x44213e
mov eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00439ef9
add esp, 4
jno 0x44214c
jg 0x44214e
jg 0x442161
pushf
stc
xchg edi, edi
dec edx
inc edx
jge 0x442159
popf
nop
jne 0x44215e
jle 0x442161
mov ebx, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x442992
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00447718
add esp, 0xc
mov ebx, ebx
jb 0x4429b6
cmp ecx, 0x85f
shl ecx, 0
je 0x4429ca
jg 0x4429c3
xchg edi, eax
xchg edi, eax
jne 0x4429c7
jne 0x4429ca
sub eax, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.00447045
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x442a92
xor eax, eax
jmp 0x442aef
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00442cb5
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00447718
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x442abc
xor eax, eax
jmp 0x442aef
xor esp, 0
jge 0x442ac8
nop
jg 0x442ac4
jl 0x442ac8
mov ebx, 0xe8458b50
mov eax, dword [ebp - 0x18]
push eax
call fcn.00439ef9
add esp, 4
shl esi, 0
cmp ecx, edi
jae 0x442ae4
mov ebx, ebx
jno 0x442adf
jae 0x442ae1
jb 0x442ae4
sub eax, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44610f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00447718
add esp, 0xc
add esp, 0
ror edi, 0
js 0x446148
pushf
sub esp, 0
or eax, eax
shr esp, 0
popf
jge 0x446145
jns 0x446148
mov ebx, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
mov ecx, ecx
shl ecx, 0
jns 0x446190
pushf
push edx
pop edx
popf
jb 0x446187
mov esp, esp
xchg ecx, esi
xchg ecx, esi
js 0x446190
mov ecx, 0x80f04d8a
jmp 0xf091e99a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
cmp esp, 0x54b5
cld
je 0x446200
jno 0x4461fb
jns 0x4461fd
jne 0x446200
mov eax, 0xffafade8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.004411b2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x446212
xor eax, eax
jmp 0x446257
add esp, 0
cmp edx, 0x54a9
clc
jge 0x446234
pushf
rol eax, 0
rol edi, 0
sub eax, 0
popf
xchg edi, eax
xchg edi, eax
xchg ecx, edi
xchg ecx, edi
jl 0x446234
mov ebx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00442cb5
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00447718
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44693e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00447718
add esp, 0xc
cmp edi, dword [esp]
add edi, dword [esp]
sub edi, dword [esp]
test esp, 0x667d
je 0x44697b
jge 0x446971
xchg esp, esp
xchg ebx, edi
xchg ebx, edi
jne 0x44697b
mov edx, 0xec45c658
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x42
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xb], 0x78
add esp, 0
lea esi, [esi + 0x24e8]
lea esi, [esi - 0x24e8]
rol edi, 0x12
ror edi, 0x12
js 0x4469cf
pushf
push esi
pop esi
popf
ja 0x4469ca
jl 0x4469cc
jns 0x4469cf
mov ecx, 0x80ec4d8a
jmp 0xec91f1d9
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004411b2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x446a44
xor eax, eax
jmp 0x446c89
cmp esi, ebx
jno 0x446a48
jne 0x446a4a
jno 0x446a5b
pushf
shl esp, 0
or edi, 0
popf
xchg edi, edi
jo 0x446a5b
mov edi, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00442cb5
mov dword [ebp - 0x18], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00447718
add esp, 0xc
shr esp, 0
xor edx, 0
ror edx, 0x14
ror edx, 0xc
jge 0x446aa5
pushf
test dword [esp], ebx
jae 0x446a90
xor edi, 0x2183
xor edi, 0x2183
popf
ja 0x446aa0
jge 0x446aa2
jl 0x446aa5
add eax, 0xe87d83
cmp dword [ebp - 0x18], 0
jne 0x446ab2
xor eax, eax
jmp 0x446c89
xor edx, 0x96
xor edx, 0x96
shl esp, 0
jns 0x446ac8
lea edx, [edx]
js 0x446ac8
ljmp 0x28e8:0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00439ef9
add esp, 4
push 0xc
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00447718
add esp, 0xc
shr esp, 0
jo 0x446b0f
pushf
nop
call fcn.00446af1
Function at 0x44792e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00447718
add esp, 0xc
nop
ja 0x44794a
xor ebx, 0x2b8f
xor ebx, 0x2b8f
jns 0x44795d
jbe 0x44795a
js 0x44795d
mov edi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
cld
rol ecx, 0
cld
je 0x4479a4
pushf
cmp edx, dword [esp]
popf
jo 0x4479a1
jne 0x4479a4
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jns 0x447a0e
jb 0x447a1d
xchg ecx, ebx
xchg ecx, ebx
mov ecx, ecx
xchg ecx, ecx
jg 0x447a1a
jae 0x447a1d
add eax, 0xfff623e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.00447045
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x447a32
xor eax, eax
jmp 0x447aba
and ecx, 0xffffffff
ror esp, 0
jae 0x447a45
mov esp, esp
xchg edx, eax
xchg edx, eax
jp 0x447a40
jg 0x447a42
jb 0x447a45
add eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00442cb5
mov dword [ebp - 4], eax
jmp 0x447a57
jnp 0x447a59
jo 0x447a63
xchg esp, esp
mov edi, edi
jno 0x447a63
mov esp, 0x6a0d6a8c
add byte [ebp - 0x17af17bb], cl
test al, 0xfc
invalid
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00447718
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x447a7d
xor eax, eax
jmp 0x447aba
jns 0x447a7f
jp 0x447a8c
jp 0x447a83
jno 0x447a85
mov ecx, ecx
xchg esp, esp
jnp 0x447a8c
mov eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00439ef9
add esp, 4
call 0x447a9d
lea esp, [esp + 4]
je 0x447ab7
pushf
xchg edx, edi
xchg edx, edi
cmp eax, dword [esp]
popf
js 0x447ab0
jge 0x447ab2
jne 0x447ab4
jne 0x447ab7
lcall 0x5b5e, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret