joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a28f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00418252
add esp, 0xc
or edx, 0
jbe 0x41a2c1
pushf
shr esp, 0
jno 0x41a2b4
jns 0x41a2b6
mov ebx, ebx
popf
jnp 0x41a2bc
jne 0x41a2be
ja 0x41a2c1
mov edi, 0x48e045c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
test dword [esp], eax
je 0x41a312
rol ebx, 0x17
ror ebx, 0x17
jge 0x41a332
pushf
xor ecx, dword [esp]
xor ecx, dword [esp]
jle 0x41a324
lea esp, [esp]
popf
jne 0x41a32b
jle 0x41a32d
jno 0x41a32f
jl 0x41a332
mov esi, 0x80e04d8a
jmp 0xe08f2b3c
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
jae 0x41a3d0
jge 0x41a3ef
pushf
call fcn.0041a3d9
Function at 0x41ab62
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00418252
add esp, 0xc
lea edi, [edi]
shr esp, 0
jl 0x41ab91
pushf
xor ecx, esi
xor ecx, esi
popf
jl 0x41ab8c
xchg esp, esp
jge 0x41ab91
mov edi, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
xor esp, 0
xchg ebx, esi
xchg ebx, esi
jo 0x41abca
jne 0x41abe7
pushf
cmp edi, ecx
not edx
not edx
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
jno 0x41abde
popf
xchg edi, eax
xchg edi, eax
mov esp, esp
je 0x41abe7
lcall 0x1e9, 0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
and esp, 0xffffffff
xchg edi, edx
xchg edi, edx
cmc
xor edx, dword [esp + 8]
xor edx, dword [esp + 8]
jae 0x41ac5f
jb 0x41ac5b
jb 0x41ac5f
lcall 1, 0x7d78e8d3
call fcn.004329dc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41ac74
xor eax, eax
jmp 0x41ad54
jp 0x41ac76
test edi, 0x5411
je 0x41ac94
pushf
lea esp, [esp]
jbe 0x41ac85
and esp, 0xffffffff
ror esp, 0
popf
jge 0x41ac8f
lea eax, [eax]
jne 0x41ac94
xor eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00430b8f
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00418252
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x41ad29
or edi, edi
lea esi, [esi + 0x36a1]
lea esi, [esi - 0x36a1]
call fcn.0041accd
jns 0x41ad2b
xchg edi, edi
lea eax, [eax + 0x3864]
lea eax, [eax - 0x3864]
shl edi, 0
je 0x41ad52
pushf
shl esp, 0
or edx, edx
xchg edi, eax
xchg edi, eax
popf
jge 0x41ad4b
ja 0x41ad4d
mov edi, edi
jne 0x41ad52
add eax, 0x5e5fc033
xor eax, eax
Function at 0x41ad5d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00418252
add esp, 0xc
push 0x21
push 0x413d6c
lea ecx, [ebp - 0x138]
push ecx
call fcn.0042a3d2
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x41ae65
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.00418252
add esp, 0xc
push 0xb
push 0x413d90
lea edx, [ebp - 0x138]
push edx
call fcn.0042a3d2
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x41ae58
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042a3d2
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x41ae67
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41c286
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00418252
add esp, 0xc
and esi, esi
jge 0x41c2b1
jle 0x41c2ac
lea ebx, [ebx]
jl 0x41c2b1
mov esp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jg 0x41c35c
jle 0x41c36f
pushf
jg 0x41c362
popf
jno 0x41c366
jnp 0x41c368
xchg ecx, ebx
xchg ecx, ebx
jg 0x41c36f
jmp 0x1a82c5b
call fcn.004329dc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41c384
xor eax, eax
jmp 0x41c432
cmc
jbe 0x41c387
nop
clc
jp 0x41c3a4
pushf
xchg ebx, esi
xchg ebx, esi
xor ecx, 0x966
xor ecx, 0x966
popf
jl 0x41c3a1
jnp 0x41c3a4
mov esi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00430b8f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00418252
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x41c3ce
xor eax, eax
jmp 0x41c432
js 0x41c3d0
ror esi, 0
shr esp, 0
ror esi, 0
jp 0x41c3fe
pushf
xchg esi, esi
or eax, 0
shl esi, 0
neg edi
neg edi
popf
lea edx, [edx + 0xb06]
lea edx, [edx - 0xb06]
jnp 0x41c3f9
jge 0x41c3fb
jnp 0x41c3fe
mov ebp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00427d04
add esp, 4
jno 0x41c40c
xor eax, dword [esp]
xor eax, dword [esp]
jno 0x41c427
lea esi, [esi + 0xfb6]
lea esi, [esi - 0xfb6]
xchg edx, edi
xchg edx, edi
jo 0x41c427
mov edi, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41ce75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00418252
add esp, 0xc
ror eax, 8
ror eax, 0x18
rol esp, 0
cmc
jae 0x41ceb6
lea edi, [edi + 0x416f]
lea edi, [edi - 0x416f]
jnp 0x41ceaf
jmp 0x41ceb1
jp 0x41ceb3
jb 0x41ceb6
mov esp, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004329dc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41cf7e
xor eax, eax
jmp 0x41cff9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00430b8f
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00418252
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x41cfa8
xor eax, eax
jmp 0x41cff9
inc esi
dec esi
or esp, 0
jno 0x41cfbc
mov esi, esi
lea esp, [esp]
xchg esp, esp
xchg ecx, eax
xchg ecx, eax
jo 0x41cfbc
add eax, 0xe8458b30
mov eax, dword [ebp - 0x18]
push eax
call fcn.00427d04
add esp, 4
cmp esi, 0x610b
jl 0x41cfd0
shr ebx, 0
jge 0x41cfd5
jns 0x41cfee
pushf
xchg ebx, ebx
and ecx, ecx
cmp edi, eax
jg 0x41cfe1
popf
jno 0x41cfe5
jge 0x41cfe7
xchg ebx, ecx
xchg ebx, ecx
js 0x41cfee
mov esp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41e458
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00418252
add esp, 0xc
xchg edi, edi
cmp eax, 0x1dc6
rol ebx, 0x1b
ror ebx, 0x1b
jg 0x41e48b
js 0x41e482
lea ebx, [ebx]
mov eax, eax
jl 0x41e488
jle 0x41e48b
add eax, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
std
cld
xor esp, 0
jae 0x41e4d2
jnp 0x41e4e8
pushf
or ecx, 0
not edi
not edi
dec esi
inc esi
popf
jne 0x41e4e3
jb 0x41e4e5
jp 0x41e4e8
mov ecx, 0x80ec4d8a
jmp 0xec8f6cf2
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.004329dc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41e57f
call fcn.0041e584
Function at 0x41e66d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00418252
add esp, 0xc
jae 0x41e688
jge 0x41e68a
jno 0x41e69c
lea ecx, [ecx + 0x7776]
lea ecx, [ecx - 0x7776]
jo 0x41e69c
add eax, 0xe845c64a
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
cmp edx, esi
je 0x41e6e8
cld
and edi, edi
jl 0x41e6fa
pushf
lea edx, [edx]
popf
mov edi, edi
jne 0x41e6f7
jge 0x41e6fa
mov eax, 0x80e84d8a
jmp 0xe88f6f04
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.004329dc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41e7a3
xor eax, eax
jmp 0x41e82b
ror edx, 0
ror esp, 0
std
cld
jb 0x41e7b6
xchg edx, ebx
xchg edx, ebx
jne 0x41e7b3
jae 0x41e7b6
sub eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00430b8f
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00418252
add esp, 0xc
or esp, 0
jo 0x41e7e5
jge 0x41e7dd
mov esi, esi
mov eax, eax
jno 0x41e7e5
mov ebx, 0xe47d83cd
add byte [ebp + 4], dh
cmp dword [ebp - 0x1c], 0
jne 0x41e7ef
xor eax, eax
jmp 0x41e82b
cmp esp, 0x576c
shl esp, 0
je 0x41e808
pushf
stc
popf
lea ebx, [ebx]
lea eax, [eax]
jnp 0x41e805
jne 0x41e808
ljmp 0xf3e8:0x50e4458b
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00427d04
add esp, 4
jmp 0x41e816
jg 0x41e818
sub esp, 0
jl 0x41e828
mov edx, edx
jge 0x41e821
jle 0x41e823
jne 0x41e825
jge 0x41e828
mov ebp, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421c41
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00418252
add esp, 0xc
rol eax, 9
rol eax, 0x17
and esi, esi
jns 0x421c64
jb 0x421c7f
pushf
cmp edi, dword [esp]
or esp, 0
rol esi, 6
rol esi, 0x1a
jle 0x421c76
popf
jle 0x421c7a
jge 0x421c7c
jae 0x421c7f
call 0x54226249
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x52
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x73

Function at 0x4245e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00418252
add esp, 0xc
ja 0x42460a
jg 0x424615
jmp 0x42460e
lea edi, [edi]
jle 0x424615
lcall 0x4ef0, 0x45c6acef
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
mov ebx, ebx
jb 0x424649
jg 0x424658
pushf
test esi, eax
popf
lea edx, [edx]
xchg esi, esi
jle 0x424658
or dword [edx - 0x167f0fb3], 0xf04d8801
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
shr ebx, 0
js 0x4246bd
xchg edx, edi
xchg edx, edi
xor ebx, 0
jns 0x4246d1
xchg edx, edx
jmp 0x4246ca
jmp 0x4246cc
mov esp, esp
js 0x4246d1
xor eax, 0xe330e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.00432a06
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4246e3
xor eax, eax
jmp 0x424715
mov esp, esp
jne 0x4246f2
jns 0x4246e9
jne 0x4246eb
lea esi, [esi]
jl 0x4246ef
je 0x4246f2
call 0x51328c83
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00430b8f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00418252
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42471c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00418252
add esp, 0xc
shl esp, 0
jnp 0x42473a
jl 0x424741
jp 0x42473e
jge 0x424741
mov eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
cmp esp, 0xfe3
jae 0x424779
xchg esi, edx
xchg esi, edx
js 0x42479d
pushf
ja 0x424783
cmp esp, 0x4045
sub ebx, 0
popf
lea ebx, [ebx + 0x7084]
lea ebx, [ebx - 0x7084]
jns 0x42479d
mov esp, 0x80f44d8a
jmp 0xf48fcfa7
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
cmp ebx, dword [esp]
test edi, ebx
lea edx, [edx + 0x11db]
lea edx, [edx - 0x11db]
js 0x42481d
pushf
test dword [esp + 8], ecx
popf
xchg ebx, ebx
jns 0x42481d
mov ebp, 0xff3426e8
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call 0x417c48
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x424835
mov eax, 1
jmp 0x4248e7
jo 0x424837
jl 0x42484b
pushf
sub esi, 0
jae 0x424840
popf
xchg edx, ecx
xchg edx, ecx
jb 0x424848
jge 0x42484b
xor eax, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00430b8f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00418252
add esp, 0xc
test dword [esp + 4], ecx
jb 0x424871
xor edx, edi
xor edx, edi
mov ebx, ebx
jbe 0x424894
pushf
rol edx, 0x13
rol edx, 0xd
and edi, edi
or esp, 0
and edx, edx
popf
jbe 0x42488c
lea esp, [esp]
je 0x424891
ja 0x424894
mov esi, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x4248a1
mov eax, 1
jmp 0x4248e7
clc
rol ecx, 0x1a
ror ecx, 0x1a
and edx, 0xffffffff
jb 0x4248b3
lea esi, [esi]
jae 0x4248b3
mov esp, 0xec458b21
mov eax, dword [ebp - 0x14]
push eax
call fcn.00427d04
add esp, 4
jg 0x4248c1
push ebx
pop ebx
rol eax, 0xd
ror eax, 0xd
lea ebx, [ebx + 0x7c05]
lea ebx, [ebx - 0x7c05]
jle 0x4248e0
jle 0x4248d9
jae 0x4248db
jo 0x4248dd
jg 0x4248e0
mov ebx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42a406
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00418252
add esp, 0xc
xor eax, edi
xor eax, edi
xor edx, 0x5a24
xor edx, 0x5a24
and ebx, 0xffffffff
jbe 0x42a450
pushf
rol esi, 0x1a
ror esi, 0x1a
xor ecx, 0x91c
xor ecx, 0x91c
clc
popf
jle 0x42a44d
ja 0x42a450
add eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
and ebx, ebx
test edx, eax
jl 0x42a486
jle 0x42a488
jb 0x42a49f
jo 0x42a48c
ja 0x42a48e
jp 0x42a490
lea ecx, [ecx + 0x1a38]
lea ecx, [ecx - 0x1a38]
jae 0x42a49f
mov ebx, 0x80f04d8a
jmp 0xf0902ca9
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
lea esi, [esi]
jae 0x42a51a
lea ebx, [ebx + 0x211c]
lea ebx, [ebx - 0x211c]
jp 0x42a511
ja 0x42a513
mov esp, esp
jb 0x42a51a
add dword [edi + 8], 0x84bde8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.004329dc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42a52c
xor eax, eax
jmp 0x42a55d
jnp 0x42a52e
js 0x42a53a
mov esi, esi
jae 0x42a534
jae 0x42a536
jns 0x42a53a
mov esp, 0xf0458de4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00430b8f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00418252
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret