joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442ffd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004514ee
add esp, 0xc
cmp esp, 0x647d
shr esp, 0
jg 0x443039
pushf
shl edi, 0
rol edx, 0x13
rol edx, 0xd
mov edx, edx
popf
jbe 0x443032
jl 0x443034
xchg esp, esp
jle 0x443039
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
test esp, 0x3392
je 0x443089
xchg edi, edi
lea esp, [esp]
jg 0x443084
jmp 0x443086
jne 0x443089
mov ebp, 0x80e84d8a
jmp 0xe891b893
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.0043828f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x443115
xor eax, eax
jmp 0x443181
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00452033
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004514ee
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x44317f
jns 0x44313d
xor edx, 0
jle 0x443142
xor edi, dword [esp + 0x10]
xor edi, dword [esp + 0x10]
jbe 0x443151
jnp 0x44314e
ja 0x443151
ljmp 0x92e8:0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.004545ec
add esp, 4
mov edi, edi
add esp, 0
jno 0x443172
pushf
dec edx
inc edx
xor esp, 0
popf
jne 0x44316f
jo 0x443172
mov esp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x443181
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4434ad
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x421540
call fcn.00443505
add esp, 0xc
mov byte [0x421540], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x443c97
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004514ee
add esp, 0xc
jmp 0x443cb2
xchg esp, esp
jl 0x443cc2
lea edi, [edi]
xchg ecx, edx
xchg ecx, edx
jge 0x443cbe
jge 0x443cc2
add eax, 0xe845c60b
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
xor ecx, 0
jnp 0x443d0f
nop
clc
jb 0x443d1d
jnp 0x443d15
xchg ebx, ebx
jae 0x443d19
jae 0x443d1d
add eax, 0xe84d8aa9
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.00426614
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x443dc6
xor eax, eax
jmp 0x443e6b
rol esp, 0
jnp 0x443ddb
pushf
ja 0x443dcf
jbe 0x443dd1
popf
nop
jg 0x443dd6
jns 0x443dd8
jp 0x443ddb
jmp 0x512c836c
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00452033
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004514ee
add esp, 0xc
xchg esi, edx
xchg esi, edx
jge 0x443e07
mov esp, esp
jl 0x443e07
mov esi, 0xe47d83aa
add byte [ebp + 4], dh
cmp dword [ebp - 0x1c], 0
jne 0x443e11
xor eax, eax
jmp 0x443e6b
and esp, 0xffffffff
mov esi, esi
or edi, edi
not esi
not esi
jle 0x443e33
pushf
je 0x443e22
shr edi, 0
test dword [esp], eax
push edx
pop edx
popf
jno 0x443e2e
ja 0x443e30
jg 0x443e33
mov esi, 0x50e4458b
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004545ec
add esp, 4
mov esi, esi
jo 0x443e43
ror ecx, 2
rol ecx, 2
xor edx, ebx
xor edx, ebx
jge 0x443e68
pushf
cld
cmc
popf
lea ebx, [ebx]
lea eax, [eax + 0x691]
lea eax, [eax - 0x691]
jg 0x443e65
jl 0x443e68
mov edi, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44532d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004514ee
add esp, 0xc
sub esp, 0
add ebx, 0x300c
sub ebx, 0x300c
jne 0x445357
std
cld
jo 0x445361
xchg esp, esp
jno 0x445361
xor eax, 0xec45c66d
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
lea esp, [esp]
shr esp, 0
jp 0x4453a9
pushf
mov esp, esp
std
cld
popf
lea edx, [edx]
nop
je 0x4453a6
jnp 0x4453a9
sub eax, 0x80ec4d8a
jmp 0xec91dbb3
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
test edi, ebx
and esp, 0xffffffff
jg 0x44541d
pushf
or edx, edx
or esi, esi
popf
jge 0x44541a
jle 0x44541d
add eax, 0xfe11f2e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.00426614
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x445432
xor eax, eax
jmp 0x4454e8
or esi, 0
jae 0x445437
je 0x445439
jge 0x44545f
pushf
lea eax, [eax + 0x544f]
sub eax, 0x544f
ror esi, 0x16
ror esi, 0xa
cmp esp, 0x78cb
lea ecx, [ecx]
popf
mov esp, esp
jae 0x44545c
jl 0x44545f
sub eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00452033
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004514ee
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4454d3
xchg esi, esi
call 0x44548c
lea esp, [esp + 4]
or esp, 0
mov esp, esp
je 0x4454a6
jb 0x445499
jne 0x44549b
jnp 0x44549d
xchg ecx, edx
xchg ecx, edx
jne 0x4454a6
mov edx, 0x458b894b
cld
mov eax, dword [ebp - 4]
push eax
call fcn.004545ec
add esp, 4
shr esp, 0
jle 0x4454ca
pushf
mov esp, esp
shr edi, 0
shl esi, 0
popf
jno 0x4454c5
jo 0x4454c7
jg 0x4454ca
jmp 0x514ca259
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x4454e8
rol esi, 0
ja 0x4454e6
pushf
cmp eax, 0x37c5
popf
mov esp, esp
jbe 0x4454e6
lcall 0x8b5b, 0x5e5fc033
in eax, 0x5d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x445bd1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004514ee
add esp, 0xc
js 0x445bec
jb 0x445bfb
jb 0x445bf0
jns 0x445bf2
mov eax, eax
lea edi, [edi]
jae 0x445bfb
mov edi, 0x45c61a67
call 0xed8a2246
push esp
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
or esp, 0
test dword [esp + 8], ecx
ror esi, 0x18
rol esi, 0x18
xchg ecx, edx
xchg ecx, edx
jle 0x445c5f
jmp 0x445c5c
jg 0x445c5f
mov esp, 0x80e84d8a
jmp 0xe891e469
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
call fcn.00445d00
Function at 0x447b27
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004514ee
add esp, 0xc
and esp, 0xffffffff
ja 0x447b4a
xchg edx, edx
jbe 0x447b4a
mov ebx, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
lea ebx, [ebx + 0x15b8]
lea ebx, [ebx - 0x15b8]
lea esp, [esp]
add ebx, 0x7189
sub ebx, 0x7189
jne 0x447bb0
js 0x447ba5
xchg ecx, esi
xchg ecx, esi
jnp 0x447bab
jne 0x447bad
je 0x447bb0
jmp 0x8130c93e
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.00426614
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x447c3a
jmp 0x447ca7
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00452033
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004514ee
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x447ca7
shr edi, 0
jg 0x447c71
jo 0x447c67
jno 0x447c69
js 0x447c6b
jbe 0x447c6d
jle 0x447c71
mov eax, 0xe8458ba5
mov eax, dword [ebp - 0x18]
push eax
call fcn.004545ec
add esp, 4
jl 0x447c7f
shr esp, 0
jg 0x447c94
pushf
shr esp, 0
ja 0x447c8b
popf
jp 0x447c8f
je 0x447c91
jle 0x447c94
mov edx, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x448536
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.004514ee
add esp, 0xc
push 0x21
push 0x421e1c
lea ecx, [ebp - 0x138]
push ecx
call fcn.0043a1f1
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x44863e
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.004514ee
add esp, 0xc
push 0xb
push 0x421e40
lea edx, [ebp - 0x138]
push edx
call fcn.0043a1f1
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x448631
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0043a1f1
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x448640
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x44a948
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004514ee
add esp, 0xc
shl esp, 0
jo 0x44a96e
lea esp, [esp]
jg 0x44a96b
jno 0x44a96e
mov ebx, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
jns 0x44a9a8
xor ebx, dword [esp]
xor ebx, dword [esp]
jbe 0x44a9cd
pushf
lea edi, [edi + 0x4b98]
lea edi, [edi - 0x4b98]
not edi
not edi
sub edx, 0
clc
popf
jb 0x44a9ca
ja 0x44a9cd
jmp 0x8138f75b
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
ror esi, 0xa
ror esi, 0x16
jnp 0x44aa4e
lea esp, [esp]
jp 0x44aa4e
mov esi, 0xc1e8ee4a
mov ebx, 0x4589fffd
clc
call fcn.00426614
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44aa61
jmp 0x44ab0b
rol edi, 0
xchg ebx, esi
xchg ebx, esi
test edi, eax
mov esp, esp
jne 0x44aa83
pushf
ja 0x44aa72
add eax, dword [esp]
sub eax, dword [esp]
dec edx
inc edx
popf
lea ebx, [ebx]
xchg ecx, ecx
je 0x44aa83
mov edx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00452033
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004514ee
add esp, 0xc
cmp edx, dword [esp]
jge 0x44aac3
pushf
rol esi, 0x13
rol esi, 0xd
popf
lea ecx, [ecx + 0x6732]
lea ecx, [ecx - 0x6732]
lea ecx, [ecx]
jl 0x44aac3
call 0x141284a
cmp dword [ebp - 4], 0
jne 0x44aacb
jmp 0x44ab0b
xchg edi, edi
jbe 0x44aacf
jl 0x44aad1
test eax, ebx
jge 0x44aade
lea esp, [esp]
jle 0x44aada
jl 0x44aade
jmp 0xfc9a36db
mov edx, dword [ebp - 4]
push edx
call fcn.004545ec
add esp, 4
jbe 0x44aaec
je 0x44ab04
lea ecx, [ecx + 0x5a28]
lea ecx, [ecx - 0x5a28]
xchg edx, ecx
xchg edx, ecx
je 0x44ab00
jne 0x44ab04
sub eax, 0x8458bfa
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44ff34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004514ee
add esp, 0xc
cmp ecx, ebx
std
cld
xor eax, edx
xor eax, edx
not edi
not edi
jno 0x44ff77
pushf
xchg ecx, ebx
xchg ecx, ebx
xor ecx, 0
rol edi, 0x10
ror edi, 0x10
xchg ecx, edx
xchg ecx, edx
popf
lea edx, [edx]
jbe 0x44ff74
jo 0x44ff77
mov edi, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
xchg esp, esp
rol ebx, 6
ror ebx, 6
xor edi, 0x1a30
xor edi, 0x1a30
add ecx, 0x7a18
sub ecx, 0x7a18
jnp 0x44ffce
jo 0x44ffcb
jp 0x44ffce
lcall 0x1e9, 0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00426614
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x450043
xor eax, eax
jmp 0x4500c6
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00452033
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004514ee
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4500c4
add edi, 0x4840
sub edi, 0x4840
jo 0x450077
jbe 0x450079
or edx, 0
js 0x45008d
pushf
push ecx
pop ecx
mov esp, esp
popf
lea ecx, [ecx]
jns 0x45008a
jns 0x45008d
mov edi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004545ec
add esp, 4
nop
call 0x45009f
lea esp, [esp + 4]
xor esp, 0
rol ebx, 0
je 0x4500b3
jns 0x4500ad
jae 0x4500af
jne 0x4500b3
mov ebp, 0x104d8bde
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4500c6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x450843
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.004514ee
add esp, 0xc
add edi, dword [esp]
sub edi, dword [esp]
jb 0x450864
jp 0x45086b
jl 0x450868
jnp 0x45086b
mov esp, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
sub ecx, 0
test edi, 0x6c05
neg ecx
neg ecx
jae 0x4508b1
xchg edx, eax
xchg edx, eax
jb 0x4508ae
jb 0x4508b1
mov edi, 0x80f44d8a
jmp 0xf49290bb
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
add ecx, 0
jl 0x45091c
jno 0x450918
jge 0x45091c
mov edx, 0x8c68e8e5
std
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call fcn.00429589
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x450934
mov eax, 1
jmp 0x4509e3
xchg esp, esp
jle 0x450938
call 0x45093d
lea esp, [esp + 4]
jbe 0x450951
pushf
and ecx, ecx
and edi, edi
popf
nop
ja 0x45094e
ja 0x450951
ljmp 0x4d8b:0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00452033
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.004514ee
add esp, 0xc
jge 0x450973
jne 0x450975
cmc
mov esi, esi
jp 0x450990
pushf
sub esp, 0
popf
lea edx, [edx + 0x74c]
lea edx, [edx - 0x74c]
jnp 0x450990
add eax, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x45099d
mov eax, 1
jmp 0x4509e3
neg ecx
neg ecx
cmc
ja 0x4509a4
jne 0x4509b9
pushf
mov ecx, ecx
jns 0x4509ac
clc
popf
lea edx, [edx]
js 0x4509b3
lea esp, [esp]
je 0x4509b9
ljmp 0x2ae8:0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.004545ec
add esp, 4
jp 0x4509c7
shr esp, 0
or esi, 0
jno 0x4509cf
jo 0x4509dc
nop
jbe 0x4509d4
jns 0x4509d6
lea esp, [esp]
jno 0x4509dc
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4