joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487693
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 3
pop ebx
mov eax, dword [esi + 0x10]
mov edi, dword [eax]
mov eax, dword [ebp + 0xc]
sub eax, ebx
je 0x4877fb
dec eax
dec eax
je 0x4877a3
dec eax
je 0x487739
dec eax
je 0x4876d7
push 0x40ab30
push 0x413b24
push edi
call fcn.00476566
add esp, 0xc
push 0x47
jmp 0x4878ae
inc dword [esi + 0x18]
movzx eax, word [esi + 0x40]
push dword [esi + 0x18]
inc eax
and eax, 0xffff
push eax
push 0x40aafc
push edi
call fcn.004765fc
mov eax, dword [esi + 0x18]
add esp, 0x10
cmp eax, dword [esi + 0x20]
jle 0x48770c
mov dword [esi + 8], 0xffffff9d
mov dword [esi], ebx
jmp 0x4878d5
push dword [esi + 0x148]
lea eax, [esi + 0xc8]
push eax
push 0
push 4
push dword [esi + 0x160]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x4878d5
jmp 0x48788e
xor eax, eax
xor ebx, ebx
mov word [esi + 0x40], ax
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0x160]
mov byte [eax], bl
mov eax, dword [esi + 0x160]
mov byte [eax + 1], 4
movzx edx, word [esi + 0x40]
mov eax, dword [esi + 0x160]
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov eax, dword [esi + 0x160]
mov byte [eax + 3], dl
lea eax, [esi + 0xc8]
push dword [esi + 0x148]
push eax
push ebx
push 4
push dword [esi + 0x160]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x48788e
mov dword [esi], 1
jmp 0x4878cb
mov eax, dword [esi + 0x160]
xor ebx, ebx
mov byte [eax], bl
mov eax, dword [esi + 0x160]
mov byte [eax + 1], 5
movzx edx, word [esi + 0x40]
mov eax, dword [esi + 0x160]
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov eax, dword [esi + 0x160]
mov byte [eax + 3], dl
lea eax, [esi + 0xc8]
push dword [esi + 0x148]
push eax
push ebx
push 4
push dword [esi + 0x160]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
push 3
pop eax
mov dword [esi], eax
jmp 0x4878d5
mov ecx, dword [esi + 0x15c]
movzx eax, byte [ecx + 2]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 3]
or edx, eax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, edx
je 0x487835
push eax
push edx
push 0x40aabc
push edi
call fcn.004765fc
add esp, 0x10
jmp 0x4878d5
mov word [esi + 0x40], dx
xor ebx, ebx
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0x160]
mov byte [eax], bl
mov eax, dword [esi + 0x160]
mov byte [eax + 1], 4
movzx edx, word [esi + 0x40]
mov eax, dword [esi + 0x160]
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov eax, dword [esi + 0x160]
mov byte [eax + 3], dl
lea eax, [esi + 0xc8]
push dword [esi + 0x148]
push eax
push ebx
push 4
push dword [esi + 0x160]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x4878b1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [esi + 0x10]
call fcn.0046bb65
push eax
push 0x413b24
push edi
call fcn.00476566
add esp, 0x14
push 0x37
pop eax
jmp 0x4878d7
mov eax, dword [esi + 0x154]
xor ecx, ecx
add eax, 4
inc ecx
cmp dword [esi + 0x14c], eax
push 3
pop eax
cmovl ecx, eax
mov dword [esi], ecx
lea eax, [esi + 0x38]
push eax
call fcn.0049262f
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x48a2a3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [eax + 0x2c]
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a4]
test esi, esi
jne 0x48a2be
mov esi, dword [eax + 0x28]
push dword [eax + 0x24]
push dword [eax + 0x20]
call fcn.004781cd
push edx
push eax
call fcn.00478177
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x48a308
push dword [ebx + 0x124]
push dword [ebx + 0x120]
call fcn.004781cd
push edx
push eax
call fcn.00478177
mov ecx, dword [edi + 0x19c]
add esp, 0x10
sub ecx, eax
cmp esi, ecx
cmovl ecx, esi
mov esi, ecx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x48af47
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x4b1370]
mov edi, eax
pop ecx
test edi, edi
je 0x48b031
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x48afb0
push ecx
call dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [esi + 4]
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
call dword [esi + 8]
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x48afb6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
call dword [esi]
push dword [edi + 8]
call dword [esi]
mov eax, dword [ebp + 0x10]
xor ebx, ebx
pop ecx
pop ecx
test eax, eax
je 0x48b029
mov dword [ebp - 8], eax
mov ebx, eax
mov eax, dword [ebp - 4]
push 1
mov al, byte [eax]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
call dword [esi + 4]
mov ecx, dword [ebp - 4]
push 1
mov al, byte [ecx]
xor al, 0x5c
inc ecx
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
mov dword [ebp - 4], ecx
call dword [esi + 4]
add esp, 0x18
dec ebx
jne 0x48afd0
mov ebx, dword [ebp - 8]
jmp 0x48b029
push 1
push 0x40b804
push dword [edi + 4]
call dword [esi + 4]
push 1
push 0x40b805
push dword [edi + 8]
call dword [esi + 4]
add esp, 0x18
inc ebx
cmp ebx, dword [esi + 0x10]
jb 0x48b00b
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48b088
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x48c16d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x48c197
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x48c188
xor eax, eax
jmp 0x48c1ea
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x48c1c8
cmp dword [esi + 8], 0
jne 0x48c1b8
push 0x412de4
push dword [eax + 8]
call fcn.004958e8
mov dword [esi + 8], eax
pop ecx
pop ecx
test eax, eax
jne 0x48c1b8
or eax, 0xffffffff
jmp 0x48c1ea
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00493e0a
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x48c1e8
cmp dword [esi + 8], eax
je 0x48c1e2
push dword [esi + 8]
call fcn.004942d8
and dword [esi + 8], edi
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4a6046
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b1810]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00498b87
mov dword [ebp - 0x14], eax
cmp dword [0x4b6edc], esi
jne 0x4a6139
push 0x800
push esi
push 0x404fe4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4a60c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4a6219
push esi
push esi
push 0x404fe4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4a6219
push 0x40ff50
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a6219
push eax
call ebx
push 0x40ff5c
push edi
mov dword [0x4b6edc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x40ff6c
push edi
mov dword [0x4b6ee0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x40ff80
push edi
mov dword [0x4b6ee4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b6eec], eax
test eax, eax
je 0x4a6136
push 0x40ff9c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b6ee8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4a615e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4a6151
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4a6173
push 4
pop eax
jmp 0x4a621b
cmp dword [ebp - 0x14], esi
je 0x4a6173
push dword [0x4b6edc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4a6158
mov eax, dword [0x4b6ee8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4a61d1
cmp dword [0x4b6eec], edi
je 0x4a61d1
push eax
call ebx
push dword [0x4b6eec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4a61d1
test eax, eax
je 0x4a61d1
call ecx
test eax, eax
je 0x4a61c6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4a61c6
test byte [ebp - 8], 1
jne 0x4a61d1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4a6201
mov eax, dword [0x4b6ee0]
cmp eax, edi
je 0x4a61fe
push eax
call ebx
test eax, eax
je 0x4a61fe
call eax
mov esi, eax
test esi, esi
je 0x4a61fe
mov eax, dword [0x4b6ee4]
cmp eax, edi
je 0x4a61fe
push eax
call ebx
test eax, eax
je 0x4a61fe
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b6edc]
call ebx
test eax, eax
je 0x4a6219
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4a621b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00491511
mov esp, ebp
pop ebp
ret
Function at 0x41d371
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004363f0
add esp, 0xc
xchg esp, esp
add esp, 0
sub ecx, 0
shr esi, 0
jb 0x41d3a3
mov edi, edi
jae 0x41d3a3
mov ebp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
ror edi, 5
ror edi, 0x1b
je 0x41d3f0
pushf
jl 0x41d3df
nop
rol esp, 0
rol esp, 0
popf
jge 0x41d3ea
nop
ja 0x41d3ed
jne 0x41d3f0
lcall 0x1e9, 0x80f04d8a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
lea edx, [edx]
jns 0x41d461
pushf
jnp 0x41d458
popf
jne 0x41d45c
jle 0x41d45e
js 0x41d461
ljmp 0x8900:0xdf7e8
call fcn.0041e25d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41d473
xor eax, eax
jmp 0x41d4a0
cmp eax, esi
jno 0x41d47d
js 0x41d479
jo 0x41d47d
mov edx, 0xf0458d37
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041deec
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004363f0
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41dba8
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x417934
call fcn.004329e7
add esp, 0xc
mov byte [0x417934], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x420e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.004363f0
add esp, 0xc
xor esp, 0
xchg ecx, eax
xchg ecx, eax
cmp edi, edx
js 0x420e8a
jo 0x420e84
jp 0x420e86
jns 0x420e8a
mov esi, 0xe045c6f8
push ebx
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x52
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x7a
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x62
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x46
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0
xor edx, 0
xor eax, 0x1ba8
xor eax, 0x1ba8
jg 0x420ee3
jg 0x420edf
jle 0x420ee3
mov esp, 0xe04d8ae7
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x1e]
sub dl, 1
mov byte [ebp - 0x1e], dl
mov al, byte [ebp - 0x19]
sub al, 1
mov byte [ebp - 0x19], al
mov cl, byte [ebp - 0x14]
Function at 0x42202e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x417a60], 1
jne 0x422160
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004363f0
add esp, 0xc
xor edi, 0
je 0x422060
xchg edi, edi
jl 0x42205d
jne 0x422060
mov ebp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
push esi
pop esi
not ecx
not ecx
rol esi, 4
ror esi, 4
jge 0x4220ae
jns 0x42209c
jp 0x42209e
lea ecx, [ecx + 0xd8c]
lea ecx, [ecx - 0xd8c]
jl 0x4220ae
jmp 0xe88fab65
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.004303a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42211b
mov eax, dword [ebp + 8]
jmp 0x4221b7
and esi, 0xffffffff
jge 0x422128
ja 0x422122
jge 0x422124
jl 0x422128
mov ecx, 0xe8558dc0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0041deec
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004363f0
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x422159
mov edx, dword [ebp - 8]
mov dword [0x417a60], edx
jmp 0x42215e
mov eax, dword [ebp + 8]
jmp 0x4221b7
jmp 0x422168
mov eax, dword [0x417a60]
mov dword [ebp - 8], eax
cmc
jb 0x422170
xchg ecx, eax
xchg ecx, eax
jae 0x422170
mov ebp, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
or esp, 0
test dword [esp], ebx
xor ecx, dword [esp + 4]
xor ecx, dword [esp + 4]
js 0x42218d
xchg esp, esp
jge 0x42218a
jns 0x42218d
mov ecx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004315ac
add esp, 4
add esi, 0x4308
sub esi, 0x4308
xor esp, 0
jl 0x4221b0
lea edi, [edi]
jge 0x4221b0
mov ebx, 0x8458b68
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4297ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004363f0
add esp, 0xc
xor eax, dword [esp]
xor eax, dword [esp]
jo 0x429825
pushf
jge 0x429811
popf
lea esp, [esp]
lea ecx, [ecx + 0x3db9]
lea ecx, [ecx - 0x3db9]
jno 0x429825
mov ecx, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
sub esp, 0
push edi
add edi, 0x66e1
ror edi, 3
pop edi
lea ecx, [ecx]
je 0x42986d
nop
jne 0x42986d
mov ecx, 0x4d8aec60
in al, dx
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004303a0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4298df
xor eax, eax
jmp 0x42994b
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0041deec
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004363f0
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x429949
test ebx, eax
ror edx, 0x18
ror edx, 8
mov esp, esp
test dword [esp], eax
je 0x429922
pushf
lea esi, [esi]
nop
popf
jb 0x42991d
mov eax, eax
jne 0x429922
jmp 0x513edeb1
mov eax, dword [ebp - 4]
push eax
call fcn.004315ac
add esp, 4
lea esp, [esp]
je 0x429938
jb 0x429935
jne 0x429938
ljmp 0x558b:0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x42994b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42a2b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004363f0
add esp, 0xc
ror ebx, 0x14
ror ebx, 0xc
jg 0x42a2df
xchg edi, edi
jle 0x42a2df
mov ecx, 0xe445c69f
push ebx
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
inc edx
dec edx
lea ecx, [ecx + 0x346e]
sub ecx, 0x346e
jo 0x42a33d
jns 0x42a339
jno 0x42a33d
mov esp, 0xe44d8a80
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.004303a0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42a3ee
xor eax, eax
jmp 0x42a478
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0041deec
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004363f0
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x42a476
test esp, 0x600a
jne 0x42a41c
jl 0x42a43d
nop
lea edx, [edx + 0x18a]
lea edx, [edx - 0x18a]
lea esi, [esi + 0x3818]
lea esi, [esi - 0x3818]
xchg edx, edx
jge 0x42a43d
mov esp, 0xfc4d8ba3
mov ecx, dword [ebp - 4]
push ecx
call fcn.004315ac
add esp, 4
or esp, 0
je 0x42a45d
pushf
lea eax, [eax]
xchg ecx, edi
xchg ecx, edi
popf
lea ebx, [ebx]
jne 0x42a45d
ljmp 0x458b:0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x42a478
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14