joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019f0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4390c0], 0x24e1
mov eax, dword [0x4390c0]
sub eax, 0x24e1
mov dword [0x4390c0], eax
mov ecx, 1
test ecx, ecx
je 0x401a9b
mov edx, dword [0x4390c0]
cmp edx, dword [ebp + 0xc]
jb 0x401a27
jmp 0x401a9b
cmp dword [0x4390c0], 0
jne 0x401a45
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401a45
xor eax, eax
jmp 0x401a9b
mov eax, dword [ebp + 8]
add eax, dword [0x4390c0]
mov ecx, dword [eax]
add ecx, dword [0x4390c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4390c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x263fa
mov eax, dword [0x4390c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4390c0]
push eax
call fcn.004011d0
add esp, 8
mov ecx, dword [0x4390c0]
add ecx, 4
mov dword [0x4390c0], ecx
jmp 0x401a0d
mov esp, ebp
pop ebp
ret

Function at 0x401aa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401b1a
cmp dword [ebp - 0x118], 0
je 0x401b1a
jmp 0x401b7c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401b7c
mov dword [ebp - 0x120], 0x7dc35
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4390b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4390d0], edx
mov dword [ebp - 0x120], 0x7dc35
mov dword [ebp - 0x120], 0x7dc35
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4390cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.004019b0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401b1a
mov esp, ebp
pop ebp
ret

Function at 0x5df8ba
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
Function at 0x425000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004514ee
add esp, 0xc
xchg ebx, ecx
xchg ebx, ecx
dec ebx
inc ebx
jnp 0x42502a
jmp 0x425023
lea esi, [esi]
je 0x425027
jp 0x42502a
mov esp, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
test esp, 0x464e
cmp eax, 0x3d46
jo 0x425090
pushf
jle 0x425073
add edi, 0x1068
sub edi, 0x1068
jae 0x425081
rol ecx, 0xb
rol ecx, 0x15
popf
xchg esp, esp
jnp 0x42508d
jno 0x425090
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0043828f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x425113
xor eax, eax
jmp 0x42518a
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00452033
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004514ee
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x425188
xchg edi, esi
xchg edi, esi
and edx, edx
or edx, 0
cmc
ja 0x425152
ja 0x425147
mov edi, edi
mov edi, edi
jno 0x42514d
jbe 0x425152
ljmp 0x52fc:0x558bc437
mov edx, dword [ebp - 4]
push edx
call fcn.004545ec
add esp, 4
cmc
ror ecx, 1
ror ecx, 0x1f
ja 0x425166
js 0x425173
mov ebx, ebx
jle 0x42516c
jo 0x42516e
xchg edx, eax
xchg edx, eax
jns 0x425173
sub eax, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x42518a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x425193
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004514ee
add esp, 0xc
xchg esp, esp
dec edi
inc edi
jg 0x4251c0
jle 0x4251b4
xchg ecx, edi
xchg ecx, edi
jns 0x4251ba
jb 0x4251bc
jle 0x4251c0
mov edi, 0xf045c661
inc esi
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
xchg esp, esp
or edi, edi
and ecx, ecx
jno 0x425215
pushf
shl esi, 0
shr esp, 0
popf
xchg edx, esi
xchg edx, esi
jnp 0x425210
jge 0x425212
jo 0x425215
mov eax, 0x80f04d8a
jmp 0xf08fda1f
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
shl esp, 0
jle 0x42527a
jne 0x42528f
pushf
test dword [esp + 0xc], edx
nop
js 0x425285
popf
lea esp, [esp]
lea ebx, [ebx]
je 0x42528f
mov eax, 0x1380e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.00426614
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4252a1
xor eax, eax
jmp 0x4252e9
lea esp, [esp]
jmp 0x4252a6
call fcn.004252ab

Function at 0x429616
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004514ee
add esp, 0xc
cmp esi, ebx
sub esp, 0
ja 0x42965c
pushf
or edx, edx
call fcn.0042963f
Function at 0x432747
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004514ee
add esp, 0xc
cmp esi, dword [esp + 4]
js 0x432773
jnp 0x432768
jno 0x43276a
xchg ebx, edi
xchg ebx, edi
xchg edi, edi
jns 0x432773
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
mov ecx, ecx
jg 0x4327b7
jl 0x4327ad
jne 0x4327af
mov ebx, ebx
jbe 0x4327b3
jle 0x4327b7
mov eax, 0xe84d8a43
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jno 0x432821
lea esp, [esp]
jge 0x43282f
js 0x432828
jl 0x43282a
jl 0x43282f
add eax, 0xe0e8a6af
cmp eax, 0x4589ffff
clc
call fcn.00426614
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x432844
xor eax, eax
jmp 0x4328d5
push ecx
add ecx, 0x3550
ror ecx, 0x18
pop ecx
jno 0x432851
jno 0x43285d
ja 0x432855
jle 0x432857
jne 0x432859
jo 0x43285d
mov ebp, 0xe84d8d9c
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00452033
mov dword [ebp - 4], eax
jg 0x43286f
rol edx, 0
xor ebx, 0x20b
xor ebx, 0x20b
jl 0x432889
jg 0x432882
nop
jnp 0x432885
jge 0x432889
mov esp, 0x6a0d6ace
add byte [ebp - 0x17af17bb], cl
pop eax
in al, dx
add dword [eax], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004514ee
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4328a3
xor eax, eax
jmp 0x4328d5
std
cld
std
cld
cld
jb 0x4328bb
pushf
xchg edx, edx
jmp 0x4328b0
and ecx, ecx
push edx
pop edx
popf
xchg esi, esi
jae 0x4328bb
lcall 0x28e8, 0x51fc4d8b
sbb eax, 0xc4830002
add al, 0x77
add byte [ebp], dh
mov ecx, dword [ebp - 4]
push ecx
call fcn.004545ec
add esp, 4
ja 0x4328c9
jne 0x4328cb
jns 0x4328d2
xchg ebx, ebx
js 0x4328d2
xor eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435103
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x421960], 1
je 0x43513e
clc
test dword [esp + 8], ebx
xchg edx, edi
xchg edx, edi
jns 0x435134
pushf
cmp esp, 0xd3f
cmp esi, ebx
add esp, 0
popf
mov edx, edx
js 0x435134
call 0x425cb1d9
add byte [ecx + 0x27ebfc45], cl
mov eax, dword [0x421960]
mov dword [ebp - 4], eax
jmp 0x435165
ror ebx, 0x14
rol ebx, 0x14
js 0x43515e
pushf
lea eax, [eax + 0x2597]
lea eax, [eax - 0x2597]
lea esp, [esp]
popf
je 0x43515b
jns 0x43515e
mov ebx, 0x29e9c033
add al, byte [eax]
add byte [edi], dh
xor eax, eax
jmp 0x43538e
ja 0x435167
jae 0x435187
pushf
stc
mov esp, esp
call fcn.00435173

Function at 0x435fb6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004514ee
add esp, 0xc
jo 0x435fd8
nop
jp 0x435fed
jp 0x435fdd
lea ecx, [ecx + 0x52e5]
lea ecx, [ecx - 0x52e5]
jnp 0x435fed
xor eax, 0xec45c656
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.00426614
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4360b5
xor eax, eax
jmp 0x436127
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00452033
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004514ee
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x4360df
xor eax, eax
jmp 0x436127
xchg edx, edx
je 0x4360eb
mov ecx, ecx
jl 0x4360e7
jne 0x4360eb
mov esp, 0xe8458be7
mov eax, dword [ebp - 0x18]
push eax
call fcn.004545ec
add esp, 4
je 0x4360f9
cmp edx, dword [esp]
jno 0x43611c
pushf
add esi, 0xa38
sub esi, 0xa38
jb 0x43610e
cmp ebx, dword [esp]
jnp 0x436113
popf
jne 0x436117
lea edi, [edi]
jo 0x43611c
jmp 0x514faeab
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x437a39
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004514ee
add esp, 0xc
rol esi, 0x16
ror esi, 0x16
jp 0x437a5f
jo 0x437a5c
jnp 0x437a5f
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
push edi
pop edi
jno 0x437ab5
pushf
jne 0x437aa3
test edx, 0x22d6
rol esi, 0
popf
jle 0x437ab0
jle 0x437ab2
jo 0x437ab5
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0043828f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x437b44
xor eax, eax
jmp 0x437bd4
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00452033
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004514ee
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x437bd2
inc ecx
dec ecx
jl 0x437b9b
pushf
xor ecx, 0x5702
xor ecx, 0x5702
push ebx
pop ebx
cmp eax, dword [esp]
rol esp, 0
popf
xchg ecx, edx
xchg ecx, edx
lea edx, [edx + 0x1f52]
lea edx, [edx - 0x1f52]
mov edi, edi
jge 0x437b9b
mov edx, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.004545ec
add esp, 4
jge 0x437ba9
jp 0x437bab
jbe 0x437bad
test dword [esp], ebx
jae 0x437bc1
pushf
xchg ecx, eax
xchg ecx, eax
add esp, 0
popf
jb 0x437bbd
nop
jb 0x437bc1
mov esp, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x437bd4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x439262
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4216bc], 1
jne 0x4393a5
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004514ee
add esp, 0xc
dec esi
inc esi
ja 0x43928c
jl 0x4392a3
lea esi, [esi]
xchg ecx, ebx
xchg ecx, ebx
lea eax, [eax + 0x23b]
lea eax, [eax - 0x23b]
jge 0x4392a3
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
lea eax, [eax]
jp 0x4392d9
jp 0x4392d5
jnp 0x4392d9
ljmp 0xe980:0xe84d8ad9
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.00426614
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x439346
mov eax, dword [ebp + 8]
jmp 0x439419
cmp edx, ecx
rol ecx, 0
xchg edi, edi
clc
jno 0x43936d
pushf
jae 0x439354
mov edx, edx
lea ebx, [ebx + 0x611b]
sub ebx, 0x611b
jo 0x439364
popf
jae 0x439368
jae 0x43936a
jo 0x43936d
mov esi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00452033
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004514ee
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x43939e
mov edx, dword [ebp - 8]
mov dword [0x4216bc], edx
jmp 0x4393a3
mov eax, dword [ebp + 8]
jmp 0x439419
jmp 0x4393ad
mov eax, dword [0x4216bc]
mov dword [ebp - 8], eax
jns 0x4393af
jge 0x4393c3
pushf
rol edx, 0
popf
xchg ecx, edi
xchg ecx, edi
jg 0x4393be
jae 0x4393c0
jl 0x4393c3
lcall 0xfc4d, 0x89f84d8b
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
neg edx
neg edx
je 0x4393e7
pushf
cmc
add esp, 0
rol eax, 9
ror eax, 9
cmp ecx, dword [esp]
popf
js 0x4393e2
mov ecx, ecx
jne 0x4393e7
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004545ec
add esp, 4
add esi, dword [esp]
sub esi, dword [esp]
jne 0x4393fb
js 0x4393fd
jae 0x4393ff
ja 0x439412
pushf
lea ecx, [ecx]
sub esp, 0
add edx, 0
popf
je 0x43940f
jbe 0x439412
or dword [ebx - 0xaff7bb], 0x5e5ffc55
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43f7ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004514ee
add esp, 0xc
lea esi, [esi + 0x70e9]
lea esi, [esi - 0x70e9]
test dword [esp], ecx
jns 0x43f829
pushf
and edi, 0xffffffff
popf
jp 0x43f824
jl 0x43f826
js 0x43f829
mov esp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
ror edx, 0x1d
ror edx, 3
je 0x43f883
pushf
cmp edi, edx
call fcn.0043f86a
Function at 0x441131
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004514ee
add esp, 0xc
lea edx, [edx]
jo 0x44115e
pushf
lea edi, [edi]
ror esp, 0
popf
jg 0x441159
jno 0x44115b
jno 0x44115e
mov ebx, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
sub esp, 0
jle 0x4411a7
jnp 0x44119d
jp 0x44119f
jne 0x4411a1
jne 0x4411a3
jg 0x4411a7
mov edi, 0xec4d8afc
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.0043828f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44122a
xor eax, eax
jmp 0x441291
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00452033
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.004514ee
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x44128f
or edx, edx
sub edx, 0
mov ecx, ecx
jge 0x441259
jb 0x441263
lea ecx, [ecx]
xchg esp, esp
jae 0x441263
mov ebp, 0xe8558be1
mov edx, dword [ebp - 0x18]
push edx
call fcn.004545ec
add esp, 4
std
cld
cmp edi, dword [esp]
jno 0x44127e
xchg ebx, eax
xchg ebx, eax
js 0x44127a
jo 0x44127e
mov ebx, 0x10458b0d
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x441291
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc