joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bb5c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x47bc65
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0047d380
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x47bc2b
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409580
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047c414
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409464
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047c488
jmp 0x47bc3d
xor edx, edx
mov eax, ebx
call fcn.0047c414
xor edx, edx
mov eax, ebx
call fcn.0047c488
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bc6c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404718
ret

Function at 0x47d5dc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x47d63a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0047d6b8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x47d622
lea eax, [ebp - 4]
call fcn.0047d6b8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x47d624
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d641
lea eax, [ebp - 4]
call fcn.004046f4
ret

Function at 0x47d648
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x47d6ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.0047d6b8
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.00409948
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d6b3
lea eax, [ebp - 4]
call fcn.004046f4
ret
Function at 0x482b20
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.00482d54
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.00482d54
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x482b94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x482bb9
inc esi
mov eax, edi
call fcn.00482b78
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.00482b20
inc ebx
dec esi
jne 0x482ba3
pop edi
pop esi
pop ebx
ret

Function at 0x482c48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404ba4
xor eax, eax
push ebp
push 0x482cbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00482bc0
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.00482b78
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00482b20
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x482c88
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482cc4
lea eax, [ebp - 4]
call fcn.004046f4
ret
Function at 0x483880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483a64
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x483a20
mov eax, dword [ebp - 4]
call fcn.004851d0
cmp ebx, eax
jge 0x483a20
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0047a158
mov edx, dword [0x47b4f4]
call fcn.00403ad0
mov esi, eax
mov eax, esi
call fcn.0047c3a8
test al, al
je 0x483a16
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x483a0a
xor eax, eax
push ebp
push 0x483a03
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00483e38
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.00417ba4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404d40
mov eax, dword [ebp - 8]
call fcn.00404c0c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00483bfc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483a4e
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x483a02
mov eax, dword [ebp - 4]
call fcn.00483ebc
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00409948
jmp 0x483a4e
mov eax, dword [ebp - 8]
call fcn.004046f4
jmp 0x483a4e
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00408eac
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x412b40]
call fcn.0040c7ec
call fcn.004040ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483a6b
lea eax, [ebp - 0x54]
call fcn.004046f4
ret
Function at 0x48a318
Capabilities:
Create process on windows

Disassembly:
push 1
push 0x48a328
call sub.kernel32.dll_WinExec
ret

Function at 0x48a330
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], edx
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x48a498
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x48a4b0
call fcn.0040478c
xor edx, edx
mov eax, 2
call fcn.00474300
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.00474320
jmp 0x48a46a
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404964
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409580
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004085c0
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004085c0
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404b00
je 0x48a44c
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404964
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004085c0
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004085c0
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404b00
jne 0x48a461
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, esi
mov eax, ebx
call fcn.00474340
test eax, eax
jne 0x48a3ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a49f
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404718
lea eax, [ebp - 4]
call fcn.004046f4
ret
Function at 0x446e66
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046cded
add esp, 0xc
or esi, esi
xor edi, dword [esp + 0x10]
xor edi, dword [esp + 0x10]
je 0x446ea3
pushf
jle 0x446e96
jge 0x446e98
lea ecx, [ecx]
popf
jno 0x446e9e
mov edx, edx
jne 0x446ea3
call 0x5230b46d
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.00447f00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x446f6b
xor eax, eax
jmp 0x446fda
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0045ad63
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0046cded
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x446f95
xor eax, eax
jmp 0x446fda
je 0x446f97
jg 0x446fb6
pushf
cmp eax, dword [esp]
sub esi, 0
popf
lea esi, [esi + 0x7356]
lea esi, [esi - 0x7356]
jae 0x446fb1
mov esp, esp
jle 0x446fb6
jmp 0x512cb545
mov eax, dword [ebp - 0x18]
push eax
call fcn.0044b39c
add esp, 4
je 0x446fc4
jnp 0x446fcf
xchg ebx, eax
xchg ebx, eax
jge 0x446fca
xchg esi, eax
xchg esi, eax
jp 0x446fcf
sub eax, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x449987
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046cded
add esp, 0xc
xor esi, dword [esp + 0x10]
xor esi, dword [esp + 0x10]
jnp 0x4499c5
pushf
ror edi, 0x16
ror edi, 0xa
inc ebx
dec ebx
rol eax, 6
rol eax, 0x1a
jns 0x4499bc
popf
jns 0x4499c0
jae 0x4499c2
jp 0x4499c5
mov eax, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
jne 0x4499f7
jo 0x4499f9
jns 0x449a0d
pushf
xor edi, dword [esp]
xor edi, dword [esp]
clc
jp 0x449a06
popf
mov esp, esp
js 0x449a0d
add eax, 0x80ec4d8a
jmp 0xec922217
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00447f00
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x449a7f
xor eax, eax
jmp 0x449af9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0045ad63
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0046cded
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x449af7
lea ebx, [ebx + 0x531e]
lea ebx, [ebx - 0x531e]
cld
jo 0x449acb
pushf
test ebx, esi
sub esp, 0
shr esp, 0
inc edi
dec edi
popf
jno 0x449ac4
jle 0x449ac6
jb 0x449ac8
jno 0x449acb
or dword [ebx - 0x17af03bb], 0x18c8
mov eax, dword [ebp - 4]
push eax
call fcn.0044b39c
add esp, 4
shr ecx, 0
jne 0x449adc
ror ecx, 0
jne 0x449ae6
nop
je 0x449ae6
mov ebx, 0x104d8b09
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x449af9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x449d42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046cded
add esp, 0xc
xchg ecx, ecx
jne 0x449d5f
test eax, 0x2fa9
je 0x449d6f
mov edx, edx
jbe 0x449d6a
jne 0x449d6f
mov ebx, 0x45c65c34
in al, dx
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
lea edi, [edi]
mov esp, esp
shr edx, 0
jle 0x449dc5
pushf
or esp, 0
lea ebx, [ebx]
push esi
add esi, 0x7da6
ror esi, 0x16
pop esi
jae 0x449dbc
popf
jl 0x449dc0
jno 0x449dc2
jg 0x449dc5
mov edi, 0x80ec4d8a
jmp 0xec9225cf
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
xchg esp, esp
lea esp, [esp]
ja 0x449e36
js 0x449e2e
lea eax, [eax]
jb 0x449e32
jbe 0x449e36
ljmp 0xffff:0xe0c5e816
call fcn.00447f00
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x449e4b
xor eax, eax
jmp 0x449ee1
cmp esi, 0x789e
jno 0x449e5b
mov eax, eax
jne 0x449e57
jo 0x449e5b
mov ecx, 0xec458d11
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0045ad63
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0046cded
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x449ed1
or esp, 0
jnp 0x449e86
jbe 0x449e88
jg 0x449eaa
pushf
xchg edx, edi
xchg edx, edi
test dword [esp], ebx
dec ebx
inc ebx
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
popf
mov ebx, ebx
xchg edx, ebx
xchg edx, ebx
xchg edx, eax
xchg edx, eax
jle 0x449eaa
sub eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0044b39c
add esp, 4
jnp 0x449eb8
sub esp, 0
jne 0x449ebd
jne 0x449ec8
jle 0x449ec1
jmp 0x449ec3
je 0x449ec8
mov esi, 0x4d8bdf34
or byte [ecx - 1], dl
push ebp
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x449ee1
and esp, 0xffffffff
jae 0x449edf
jl 0x449ed8
xchg edi, ebx
xchg edi, ebx
jb 0x449edf
sub eax, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x449ffb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046cded
add esp, 0xc
ror esp, 0
js 0x44a020
std
cld
call fcn.0044a027
Function at 0x452c6e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046cded
add esp, 0xc
nop
nop
jg 0x452c8b
jo 0x452c99
pushf
rol esp, 0
popf
mov esp, esp
jno 0x452c99
add eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
ror ecx, 0x1b
ror ecx, 5
neg edx
neg edx
lea ecx, [ecx]
jle 0x452cf5
pushf
call fcn.00452ce6
Function at 0x456b86
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046cded
add esp, 0xc
and ecx, ecx
add esp, 0
shl edi, 0
jnp 0x456bbf
pushf
rol ecx, 0
jne 0x456bb0
rol ebx, 7
rol ebx, 0x19
popf
jnp 0x456bba
jae 0x456bbc
jp 0x456bbf
lcall 0x45c6, 0x48e845c6
in eax, dx
jae 0x456b8e
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
inc ebp
push ecx
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
shr esp, 0
nop
jnp 0x456c0d
rol edx, 0x15
rol edx, 0xb
jge 0x456c1c
jnp 0x456c17
jmp 0x456c19
jl 0x456c1c
mov eax, 0x80e84d8a
jmp 0xe892f426
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.00447f00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x456cc5
xor eax, eax
jmp 0x456d5f
or eax, eax
test ecx, 0x31af
nop
jno 0x456cd5
nop
jo 0x456cd5
mov eax, 0xe8458d53
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0045ad63
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0046cded
add esp, 0xc
nop
cmp edx, dword [esp]
jb 0x456d0f
pushf
jmp 0x456cff
and eax, 0xffffffff
jne 0x456d04
jb 0x456d06
popf
mov esp, esp
mov eax, eax
jae 0x456d0f
mov ebx, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x456d19
xor eax, eax
jmp 0x456d5f
cmp edi, dword [esp]
ja 0x456d1e
test dword [esp + 0xc], ebx
or ebx, ebx
je fcn.00456d35
pushf
shl esp, 0
popf
jge 0x456d2f
lea esp, [esp]
jne fcn.00456d35
call 0x5129b2c4
Function at 0x458337
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0046cded
add esp, 0xc
jo 0x458352
xor ebx, ecx
xor ebx, ecx
and ebx, 0xffffffff
jmp 0x45835b
jge 0x458368
pushf
jmp 0x458361
popf
jne 0x458365
jl 0x458368
mov ebx, 0x52e445c6
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
jbe 0x4583b6
add edi, 0
js 0x4583c9
pushf
cmp edx, ebx
mov esp, esp
popf
jl 0x4583c5
nop
jns 0x4583c9
lcall 0x1e9, 0x80e44d8a
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
std
cld
jns 0x458475
pushf
sub esp, 0
popf
jae 0x458472
js 0x458475
mov esp, 0xbe23e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call 0x46429d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45848a
xor eax, eax
jmp 0x458548
or edi, edi
jo 0x45848e
jb 0x45849f
lea edi, [edi]
xchg esp, esp
xchg ebx, edx
xchg ebx, edx
mov edx, edx
jae 0x45849f
add eax, 0x4d8d3ad2
in al, 0x51
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0045ad63
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0046cded
add esp, 0xc
jmp 0x4584c1
cmp edx, dword [esp + 4]
je 0x4584c7
jnp 0x4584c9
jle 0x4584df
pushf
ror ecx, 5
rol ecx, 5
clc
popf
xchg ecx, eax
xchg ecx, eax
mov edi, edi
je 0x4584dc
jg 0x4584df
add eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x4584e9
xor eax, eax
jmp 0x458548
xor edi, 0x42a1
xor edi, 0x42a1
jb 0x458511
pushf
call fcn.004584fe