joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445c58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00464e97
add esp, 0xc
dec ecx
inc ecx
lea edx, [edx + 0x772f]
lea edx, [edx - 0x772f]
or edi, edi
js 0x445c99
pushf
test dword [esp], ecx
inc ebx
dec ebx
and esp, 0xffffffff
popf
jge 0x445c91
jmp 0x445c93
lea esp, [esp]
jns 0x445c99
add eax, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
and esp, 0xffffffff
shl esp, 0
jne 0x445ce9
jb 0x445cfb
pushf
je 0x445cef
clc
popf
jle 0x445cf4
js 0x445cf6
ja 0x445cf8
jae 0x445cfb
ljmp 0x1e9:0x80e44d8a
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.004423e4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x445da9
xor eax, eax
jmp 0x445e17
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0044ec8a
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x445e15
jp 0x445dd1
jbe 0x445de6
pushf
rol ebx, 4
rol ebx, 0x1c
popf
jp 0x445ddf
jge 0x445de1
jbe 0x445de3
ja 0x445de6
mov ecx, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.0044cd1d
add esp, 4
jp 0x445df4
ja 0x445dfc
mov esi, esi
jbe 0x445dfc
xor eax, 0x18558b28
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x445e17
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4463d1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
mov ax, word [0x42f5cc]
cmp eax, 1
jne 0x4463f2
call dword [0x43a02c]
jmp 0x4465a2
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00464e97
add esp, 0xc
mov edx, edx
jno 0x446406
jbe 0x446408
push ebx
pop ebx
jle 0x446414
nop
jge 0x44640f
jbe 0x446411
jg 0x446414
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
xor eax, dword [esp]
xor eax, dword [esp]
jmp 0x446450
xchg edi, esi
xchg edi, esi
mov ecx, ecx
jle 0x44645e
lea ebx, [ebx]
jg 0x44645e
mov eax, 0xe8558a39
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
add ecx, 0x787e
sub ecx, 0x787e
inc ebx
dec ebx
ja 0x4464e7
pushf
mov esp, esp
jne 0x4464dc
jle 0x4464de
push ebx
pop ebx
popf
jae 0x4464e4
jbe 0x4464e7
mov esi, 0xffbef8e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.004423e4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4464fc
xor eax, eax
jmp 0x4465a2
xor ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0xc]
lea ebx, [ebx]
jle 0x446508
jg 0x446518
pushf
add eax, 0
popf
xchg ebx, ebx
jg 0x446515
jle 0x446518
mov ebx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0044ec8a
mov dword [ebp - 4], eax
nop
jge 0x446537
ja 0x44652d
jbe 0x44652f
jge 0x446531
xchg edx, edx
jl 0x446537
mov esi, 0x6a0d6abe
add byte [ebp - 0x17ae17b3], cl
push ebx
jmp 0xc4c76547
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x446551
xor eax, eax
jmp 0x4465a2
jg 0x446553
jb 0x446555
nop
jg 0x446569
pushf
add eax, dword [esp]
sub eax, dword [esp]
popf
jbe 0x446564
mov edx, edx
jle 0x446569
jmp 0x5340baf8
mov edx, dword [ebp - 4]
push edx
call fcn.0044cd1d
add esp, 4
je 0x446577
add ebx, dword [esp]
sub ebx, dword [esp]
jp 0x44659f
pushf
ror edx, 0
lea edi, [edi + 0x38c6]
lea edi, [edi - 0x38c6]
std
cld
dec eax
inc eax
popf
je 0x446598
jno 0x44659a
je 0x44659c
jnp 0x44659f
mov ebx, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x449343
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00464e97
add esp, 0xc
cmp edx, 0x540a
jns 0x44937a
jno 0x449366
lea edx, [edx]
lea esi, [esi + 0x119d]
lea esi, [esi - 0x119d]
lea edi, [edi]
js 0x44937a
mov esp, 0xe845c600
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
add esp, 0
not esi
not esi
je 0x4493dc
pushf
add eax, 0x45f7
sub eax, 0x45f7
cmp esi, 0x264
or edi, edi
popf
jnp 0x4493d7
lea edi, [edi]
jne 0x4493dc
mov esp, 0x80e84d8a
jmp 0xe8921be6
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.00443028
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44946b
xor eax, eax
jmp 0x4494f0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0044ec8a
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x4494ee
push edx
pop edx
mov esi, esi
jne 0x4494ab
pushf
sub esp, 0
js 0x44949e
stc
lea esp, [esp]
popf
mov edx, edx
jmp 0x4494a8
je 0x4494ab
xor eax, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.0044cd1d
add esp, 4
lea edi, [edi + 0x7c9d]
lea edi, [edi - 0x7c9d]
rol eax, 2
rol eax, 0x1e
jbe 0x4494e1
pushf
rol esp, 0
test esp, 0x15c4
popf
jne 0x4494da
xchg ecx, eax
xchg ecx, eax
jbe 0x4494de
ja 0x4494e1
mov ecx, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x4494f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44d85f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00464e97
add esp, 0xc
cmc
shr ebx, 0
jno 0x44d883
xchg edi, edi
jo 0x44d883
mov esp, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
jbe 0x44d8ad
jg 0x44d8b7
xchg edi, edi
xchg esp, esp
jle 0x44d8b7
mov edx, 0xf04d8afc
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.00443028
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44d91a
xor eax, eax
jmp 0x44d9a0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0044ec8a
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x44d99e
xor ecx, dword [esp]
xor ecx, dword [esp]
stc
not ebx
not ebx
jmp 0x44d94d
jno 0x44d961
pushf
nop
nop
xor ecx, edi
xor ecx, edi
add eax, 0
popf
mov esp, esp
jo 0x44d961
jmp 0x523126f0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0044cd1d
add esp, 4
or esp, 0
lea ecx, [ecx]
cmp esp, 0x40f8
jbe 0x44d991
pushf
xchg esi, esi
push eax
add eax, 0x4507
ror eax, 3
pop eax
popf
lea ebx, [ebx]
jle 0x44d98e
ja 0x44d991
xor eax, 0x520c558b
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x44d9a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4507d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x437bd8], 1
jne 0x45090b
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00464e97
add esp, 0xc
std
cld
std
cld
lea edx, [edx]
ja 0x450817
pushf
rol ecx, 0
stc
ja 0x45080c
popf
jo 0x450810
jmp 0x450812
lea ecx, [ecx]
jbe 0x450817
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
mov esp, esp
lea edi, [edi + 0x1b96]
lea edi, [edi - 0x1b96]
jae 0x450858
mov ebx, ebx
jb 0x450858
mov esp, 0x80e84d8a
jmp 0xe8929062
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.004423e4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4508c5
mov eax, dword [ebp + 8]
jmp 0x45096a
xor ebx, 0
jl 0x4508ca
clc
jnp 0x4508d3
jne 0x4508cf
jp 0x4508d3
mov eax, 0xe8558d15
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0044ec8a
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x450904
mov edx, dword [ebp - 8]
mov dword [0x437bd8], edx
jmp 0x450909
mov eax, dword [ebp + 8]
jmp 0x45096a
jmp 0x450913
mov eax, dword [0x437bd8]
mov dword [ebp - 8], eax
jns 0x450915
jns 0x450923
pushf
cmc
or esi, esi
popf
mov ecx, ecx
js 0x450923
mov edi, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jae 0x45092b
lea eax, [eax + 0x14b2]
lea eax, [eax - 0x14b2]
cmp esp, 0x488a
jne 0x45094c
pushf
nop
xor edx, 0
popf
jae 0x450949
je 0x45094c
mov ebx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0044cd1d
add esp, 4
neg edi
neg edi
jo 0x450963
lea ecx, [ecx]
jno 0x450963
xor eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4522c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0x19
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.00464e97
add esp, 0xc
lea edi, [edi]
xor ecx, dword [esp]
xor ecx, dword [esp]
call fcn.004522f3
Function at 0x4575c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e97
add esp, 0xc
and ebx, 0xffffffff
cmp edx, ecx
jns 0x4575ee
jge 0x4575e7
xchg ecx, ecx
js 0x4575eb
js 0x4575ee
add eax, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
test dword [esp + 0xc], edx
jo 0x457624
jb 0x45762f
jno 0x457628
js 0x45762a
jbe 0x45762c
jae 0x45762f
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004423e4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4576a1
xor eax, eax
jmp 0x45770a
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0044ec8a
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x457708
dec esi
inc esi
jle 0x4576d2
mov edx, edx
lea edi, [edi]
jg 0x4576d2
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0044cd1d
add esp, 4
ror edi, 0
lea eax, [eax]
jb 0x4576f7
pushf
test edx, edi
jne 0x4576eb
rol esp, 0
jae 0x4576f0
popf
jne 0x4576f4
jae 0x4576f7
mov edi, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x45770a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x457713
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00464e97
add esp, 0xc
clc
test ecx, ebx
jge 0x457740
pushf
jo 0x457735
popf
mov eax, eax
xchg esp, esp
lea eax, [eax]
jl 0x457740
add eax, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
rol edx, 0xe
ror edx, 0xe
test ebx, 0xa55
xor edx, 0
shl esp, 0
jle 0x4577a5
jnp 0x4577a2
jg 0x4577a5
mov eax, 0x80e84d8a
jmp 0xe892ffaf
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
nop
jle 0x45785c
pushf
or esp, 0
cld
xor ecx, dword [esp + 4]
xor ecx, dword [esp + 4]
jne 0x457854
popf
ja 0x457858
nop
jg 0x45785c
lcall 0x8900, 0xd45fe8
inc ebp
cld
call fcn.00464cc0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x457871
xor eax, eax
jmp 0x4578f9
test dword [esp + 4], ecx
call fcn.0045787a
Function at 0x458b4e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00464e97
add esp, 0xc
js 0x458b70
or ebx, ebx
mov ebx, ebx
jle 0x458b9f
pushf
xchg edi, edx
xchg edi, edx
test dword [esp + 8], ecx
ror ebx, 2
rol ebx, 2
cmp ecx, 0x6f16
popf
lea edi, [edi + 0x1eef]
lea edi, [edi - 0x1eef]
ja 0x458b9c
jg 0x458b9f
add eax, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
rol esp, 0
jb 0x458c66
pushf
xor ecx, 0x963
xor ecx, 0x963
mov edx, edx
popf
mov edx, edx
jae 0x458c63
jae 0x458c66
jmp 0xfedd0652
call fcn.004423e4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x458c7b
xor eax, eax
jmp 0x458d11
rol ecx, 0xf
rol ecx, 0x11
je 0x458ca1
lea ecx, [ecx + 0xa20]
lea ecx, [ecx - 0xa20]
lea esi, [esi + 0x43ca]
lea esi, [esi - 0x43ca]
lea esp, [esp]
jne 0x458ca1
mov edx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0044ec8a
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00464e97
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x458ccb
xor eax, eax
jmp 0x458d11
cmp esp, 0xfe1
ja 0x458ce9
pushf
test dword [esp + 0x10], ecx
jl 0x458cdb
cmc
ror eax, 0xe
rol eax, 0xe
popf
lea edi, [edi]
jbe 0x458ce9
mov ebx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0044cd1d
add esp, 4
test ecx, 0x2ca7
xor esp, 0
jae 0x458d00
jno 0x458d06
nop
jo 0x458d06
lcall 0x4d8b, 0x500c458b
or byte [ecx - 1], dl
push ebp
cld
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45ac72
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00464e97
add esp, 0xc
je 0x45ac8d
ror edx, 0
jnp 0x45ac97
jge 0x45ac94
jp 0x45ac97
mov eax, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x4c
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x42
mov byte [ebp - 0xf], 0
jns 0x45acd1
shl esi, 0
xchg edx, edx
jo 0x45acd8
jo 0x45acf0
pushf
push edi
add edi, 0x1cde
ror edi, 4
pop edi
popf
jp 0x45aceb
mov edx, edx
jno 0x45acf0
mov edx, 0x80e44d8a
jmp 0xe49334fa
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x1a]
sub cl, 1
mov byte [ebp - 0x1a], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
jbe 0x45ad63
jb 0x45ad70
jl 0x45ad67
lea edi, [edi]
xchg ecx, ebx
xchg ecx, ebx
jae 0x45ad70
mov edx, 0x9f4be8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 0xa], dh
call fcn.00464cc0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45ad88
mov eax, 1
jmp 0x45afd8
jge 0x45ad8a
add eax, 0
call fcn.0045ad92