joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4397a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00451fdc
add esp, 0xc
push 0x21
push 0x426d60
lea ecx, [ebp - 0x138]
push ecx
call fcn.00430caa
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4398b0
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.00451fdc
add esp, 0xc
push 0xb
push 0x426d84
lea edx, [ebp - 0x138]
push edx
call fcn.00430caa
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4398a3
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00430caa
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4398b2
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43e0fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00451fdc
add esp, 0xc
add edi, 0
add ebx, 0
neg edi
neg edi
jg 0x43e130
pushf
shl esp, 0
lea edx, [edx]
popf
jns 0x43e12c
nop
jle 0x43e130
mov esp, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
sub esp, 0
jp 0x43e17d
xchg ecx, edx
xchg ecx, edx
jne 0x43e173
xchg esi, ebx
xchg esi, ebx
mov esp, esp
jnp 0x43e17d
add eax, 0xe84d8a4c
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0043bd14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43e200
xor eax, eax
jmp 0x43e27d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00452398
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00451fdc
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x43e27b
lea esi, [esi + 0x13ad]
lea esi, [esi - 0x13ad]
xor esi, ebx
xor esi, ebx
test dword [esp], edi
clc
jno 0x43e244
xchg edi, eax
xchg edi, eax
jp 0x43e240
jo 0x43e244
add eax, 0xfc558b3b
mov edx, dword [ebp - 4]
push edx
call fcn.0045b8ce
add esp, 4
jbe 0x43e252
jne 0x43e266
pushf
jno 0x43e258
jne 0x43e25a
jns 0x43e25c
add edi, 0
popf
ja 0x43e263
je 0x43e266
ljmp 0x4d8b:0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x43e27d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x446996
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00451fdc
add esp, 0xc
mov ebx, ebx
jne 0x4469b3
ja 0x4469b5
je 0x4469d8
pushf
lea ebx, [ebx + 0x2d78]
sub ebx, 0x2d78
cmp esp, 0x781a
ror esi, 0x1c
ror esi, 4
popf
lea eax, [eax]
jne 0x4469d8
call 0x4924afa2
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
jmp 0x446a26
clc
jns 0x446a32
lea edx, [edx]
jne 0x446a2d
jl 0x446a2f
js 0x446a32
mov eax, 0x80e04d8a
jmp 0xe091f23c
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
call fcn.00446ad3
Function at 0x448758
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x426604], 1
jne 0x4488ce
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00451fdc
add esp, 0xc
jns 0x448780
je 0x448798
pushf
jp 0x448786
rol esp, 0
xchg ebx, edi
xchg ebx, edi
popf
jle 0x448791
je 0x448793
xchg ebx, ebx
jne 0x448798
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
not ecx
not ecx
jne 0x4487e7
pushf
jge 0x4487d2
add esp, 0
ror esi, 1
ror esi, 0x1f
js 0x4487dc
popf
jp 0x4487e0
mov edi, edi
jno 0x4487e4
je 0x4487e7
mov ecx, 0x80e84d8a
jmp 0xe8920ff1
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0043e844
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44885c
xor eax, eax
jmp 0x44892d
xchg esp, esp
xchg esi, ebx
xchg esi, ebx
or eax, 0
jle 0x44886c
mov ebx, ebx
jg 0x44886c
sub eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00452398
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00451fdc
add esp, 0xc
cmc
sub ecx, 0
test esp, 0x6aac
xor esp, 0
jb 0x4488b8
pushf
sub esi, 0
not ebx
not ebx
sub esp, 0
popf
lea esi, [esi + 0x6365]
lea esi, [esi - 0x6365]
jae 0x4488b8
mov edi, 0xf87d83
cmp dword [ebp - 8], 0
je 0x4488c8
mov eax, dword [ebp - 8]
mov dword [0x426604], eax
jmp 0x4488cc
xor eax, eax
jmp 0x44892d
jmp 0x4488d7
mov ecx, dword [0x426604]
mov dword [ebp - 8], ecx
test ecx, edx
rol edi, 2
ror edi, 2
rol edi, 0x12
rol edi, 0xe
jns 0x4488f2
ja 0x4488e9
mov esp, esp
mov ecx, ecx
jnp 0x4488ef
js 0x4488f2
jmp 0x8a3cde81
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
shl esi, 0
shr edi, 0
sub eax, 0
test esi, edi
jo 0x448916
xchg ebx, ebx
lea edi, [edi + 0x7bc]
lea edi, [edi - 0x7bc]
jno 0x448916
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0045b8ce
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44aa23
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00451fdc
add esp, 0xc
nop
add ebx, dword [esp]
sub ebx, dword [esp]
ror edi, 0
ror esp, 0
jns 0x44aa5c
pushf
add edi, dword [esp]
sub edi, dword [esp]
popf
jp 0x44aa57
jg 0x44aa59
js 0x44aa5c
mov edi, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
jbe 0x44aa96
lea ebx, [ebx]
xchg edi, esi
xchg edi, esi
jl 0x44aaae
pushf
ror esp, 0
popf
jae 0x44aaa7
xchg ebx, eax
xchg ebx, eax
jbe 0x44aaab
jge 0x44aaae
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.0043bd14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44ab34
xor eax, eax
jmp 0x44abcb
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00452398
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00451fdc
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x44abc9
jns 0x44ab5c
mov eax, eax
add ebx, 0x1d04
sub ebx, 0x1d04
lea ecx, [ecx + 0x2bc4]
lea ecx, [ecx - 0x2bc4]
jae 0x44ab87
pushf
lea eax, [eax]
js 0x44ab7e
popf
jge 0x44ab82
jns 0x44ab84
jb 0x44ab87
add eax, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.0045b8ce
add esp, 4
clc
and esp, 0xffffffff
and esp, 0xffffffff
ror ebx, 0x11
ror ebx, 0xf
jle 0x44abb8
lea ebx, [ebx + 0x66cf]
lea ebx, [ebx - 0x66cf]
mov edi, edi
lea edi, [edi]
xchg esp, esp
jg 0x44abb8
xor edi, 0x5010458b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x44abcb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44c78b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x426608], 1
jne 0x44c8d3
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00451fdc
add esp, 0xc
jno 0x44c7b3
xchg ecx, edx
xchg ecx, edx
shr ecx, 0
xor ebx, ecx
xor ebx, ecx
jae 0x44c7cb
jp 0x44c7c2
jne 0x44c7c4
jb 0x44c7c6
jnp 0x44c7c8
jb 0x44c7cb
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
clc
shl esp, 0
jb 0x44c805
xchg esp, esp
nop
jge 0x44c802
jae 0x44c805
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0043e844
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44c872
mov eax, dword [ebp + 8]
jmp 0x44c931
ror edi, 0x17
ror edi, 9
cmp ebx, 0x4a31
jl 0x44c89b
pushf
neg esi
neg esi
xor esi, dword [esp]
xor esi, dword [esp]
xchg esp, esp
popf
xchg esi, eax
xchg esi, eax
xchg edx, esi
xchg edx, esi
jmp 0x44c898
jge 0x44c89b
mov edx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00452398
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00451fdc
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x44c8cc
mov edx, dword [ebp - 8]
mov dword [0x426608], edx
jmp 0x44c8d1
mov eax, dword [ebp + 8]
jmp 0x44c931
jmp 0x44c8db
mov eax, dword [0x426608]
mov dword [ebp - 8], eax
xchg esp, esp
stc
je 0x44c8e9
xchg esp, esp
lea esp, [esp]
jne 0x44c8e9
add eax, 0xf84d8b05
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
lea edx, [edx + 0x7966]
sub edx, 0x7966
jbe 0x44c906
xchg esp, esp
jne 0x44c901
lea eax, [eax]
ja 0x44c906
jmp 0x53411e95
mov edx, dword [ebp - 4]
push edx
call fcn.0045b8ce
add esp, 4
xchg ebx, ecx
xchg ebx, ecx
shr esi, 0
cmp edx, dword [esp]
jnp 0x44c92a
pushf
nop
popf
jne 0x44c925
jl 0x44c927
jp 0x44c92a
lcall 0x55ff, 0x5008458b
cld
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44ea44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00451fdc
add esp, 0xc
add esp, 0
cmp esi, 0x5f7d
jne 0x44ea7a
pushf
cmp ebx, edx
nop
stc
stc
popf
lea ebx, [ebx]
xchg ebx, ebx
jns 0x44ea77
je 0x44ea7a
sub eax, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
lea esi, [esi]
nop
rol esp, 0
dec edx
inc edx
jb 0x44eabe
pushf
sub esp, 0
popf
lea esi, [esi]
jae 0x44eab7
xchg edi, esi
xchg edi, esi
jae 0x44eabe
mov edi, 0x80f04d8a
jmp 0xf09272c8
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.0043bd14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44eb1e
xor eax, eax
jmp 0x44eb8d
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00452398
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00451fdc
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x44eb8b
dec edx
inc edx
mov esp, esp
jl 0x44eb4a
clc
jnp 0x44eb5c
pushf
xchg edi, edi
popf
jne 0x44eb55
jae 0x44eb57
ja 0x44eb59
jp 0x44eb5c
mov ebx, 0x51ec4d8b
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0045b8ce
add esp, 4
jne 0x44eb6a
and esp, 0xffffffff
add eax, dword [esp]
sub eax, dword [esp]
jg 0x44eb7e
lea edx, [edx]
jg 0x44eb79
jo 0x44eb7b
jle 0x44eb7e
call 0x5251410d
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x44eb8d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44fbe1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00451fdc
add esp, 0xc
or esp, 0
not edi
not edi
xchg esi, ecx
xchg esi, ecx
jge 0x44fc0e
jl 0x44fc15
xchg esi, eax
xchg esi, eax
jge 0x44fc15
mov ebx, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0043e844
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44fce0
xor eax, eax
jmp 0x44fd6b
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00452398
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00451fdc
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x44fd0a
xor eax, eax
jmp 0x44fd6b
xor edx, 0
and edx, edx
cmp esi, 0x7429
ja 0x44fd34
pushf
je 0x44fd1b
clc
cmp edx, dword [esp]
popf
ja 0x44fd23
mov edi, edi
lea edx, [edx + 0x774a]
lea edx, [edx - 0x774a]
jbe 0x44fd34
lcall 0x91e8, 0x50e8458b
mov ebx, 0xc4830000
add al, 0x73
add byte [ebp], dh
mov eax, dword [ebp - 0x18]
push eax
call fcn.0045b8ce
add esp, 4
jae 0x44fd42
jne 0x44fd44
cmp edx, 0x41f2
mov edx, edx
jl 0x44fd60
pushf
ror ebx, 0xa
rol ebx, 0xa
nop
jb 0x44fd59
popf
jne 0x44fd5d
jge 0x44fd60
jmp 0x51514aef
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44fdde
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00451fdc
add esp, 0xc
xchg ebx, ecx
xchg ebx, ecx
stc
test dword [esp], esi
jb 0x44fe10
lea esi, [esi + 0x44f]
lea esi, [esi - 0x44f]
jae 0x44fe10
mov edx, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
shl esp, 0
ror eax, 0x1c
rol eax, 0x1c
xor esi, eax
xor esi, eax
jge 0x44fe58
jns 0x44fe51
xchg edx, ebx
xchg edx, ebx
jl 0x44fe58
sub eax, 0x80f04d8a
jmp 0xf0928662
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
xor eax, 0
mov esp, esp
jle 0x44fed8
pushf
shl edi, 0
cmp esp, 0x70c2
shl esp, 0
popf
jp 0x44fed1
lea edi, [edi]
jl 0x44fed5
jg 0x44fed8
mov esp, 0xfee967e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.0043e844
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44feea
xor eax, eax
jmp 0x44ff28
shr edx, 0
jne 0x44ff05
pushf
test dword [esp], esi
jg 0x44fef6
jg 0x44fef8
inc ecx
dec ecx
popf
xchg edx, edx
lea ebx, [ebx]
jmp 0x44ff02
je 0x44ff05
mov ebp, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00452398
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00451fdc
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret