joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441731
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004473d7
add esp, 0xc
test ecx, esi
lea ecx, [ecx]
shr ebx, 0
jl 0x44175a
je 0x441780
pushf
xor edx, dword [esp + 4]
xor edx, dword [esp + 4]
test eax, 0x28d0
add ebx, 0x4e42
sub ebx, 0x4e42
popf
jno 0x44177b
jnp 0x44177d
jne 0x441780
xor eax, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
cld
call 0x4417b6
add esp, 4
je 0x4417d3
pushf
cld
mov esp, esp
nop
add edi, dword [esp]
sub edi, dword [esp]
popf
xchg esp, esp
xchg esp, esp
lea esp, [esp]
jne 0x4417d3
xor eax, 0x80f04d8a
jmp 0xf0919fdd
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
xchg esp, esp
add esp, 0
and esp, 0xffffffff
ror ecx, 0
jnp 0x44184c
xchg edx, edx
jno 0x441844
lea edx, [edx]
jb 0x441848
jp 0x44184c
mov esp, 0x69f2e88a
add dword [eax], eax
call fcn.00458243
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44185e
xor eax, eax
jmp 0x441896
and edx, edx
jnp 0x441862
xchg esp, esp
jne 0x441866
jo 0x441873
jae 0x44186a
jg 0x44186c
xchg edx, esi
xchg edx, esi
xchg edx, esi
jno 0x441873
or dword [ebp - 0x74af0fbb], 0xe851fc4d
jge 0x44186d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004407fd
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004473d7
add esp, 0xc
mov eax, dword [ebp - 0x14]
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442358
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004473d7
add esp, 0xc
jno 0x442373
jp 0x442393
pushf
jno 0x442379
jg 0x44237b
jbe 0x44237d
push ebx
add ebx, 0x17e0
ror ebx, 0x13
pop ebx
popf
mov esi, esi
xchg esp, esp
jnp 0x442390
jnp 0x442393
mov esi, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
test ecx, 0x2d6b
test dword [esp + 0x10], esi
cmp eax, 0x54c3
or esp, 0
jl 0x4423de
xchg edx, edx
jge 0x4423de
or esi, 0xec4d8ae3
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
lea esp, [esp]
jb 0x442452
lea edx, [edx + 0x7f2]
lea edx, [edx - 0x7f2]
jae 0x442452
mov edi, 0x72d6e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0044972d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x442467
xor eax, eax
jmp 0x442507
xor edi, ecx
xor edi, ecx
rol esi, 0x18
rol esi, 8
jo 0x442473
lea esi, [esi]
jge 0x442488
pushf
sub edx, 0
ror edi, 0
jns 0x442481
popf
jns 0x442485
jl 0x442488
sub eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004407fd
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004473d7
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4424ee
lea ebx, [ebx]
jb 0x4424b2
dec esi
inc esi
lea eax, [eax + 0x4810]
lea eax, [eax - 0x4810]
jp 0x4424c9
xchg edx, edx
jnp 0x4424c9
call 0x45cf357e
cld
mov eax, dword [ebp - 4]
push eax
call fcn.0043721d
add esp, 4
jae 0x4424d7
shr eax, 0
jo 0x4424e5
ja 0x4424de
xchg edx, edx
jge 0x4424e2
jno 0x4424e5
mov edi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x442507
and edi, edi
jno 0x4424f2
jb 0x442505
pushf
jae 0x4424f8
cmp edi, 0x533a
popf
jnp 0x442502
jae 0x442505
mov ebx, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4440fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004473d7
add esp, 0xc
push ecx
pop ecx
jno 0x44411b
jno 0x444136
pushf
shl edx, 0
neg esi
neg esi
rol eax, 0x1e
ror eax, 0x1e
or eax, 0
popf
xchg esi, esi
jo 0x444136
mov esi, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
push edi
add edi, 0x43f
ror edi, 7
pop edi
test edx, eax
jg 0x44417e
mov edi, edi
xchg esp, esp
js 0x44417b
jle 0x44417e
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0044972d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4441f3
xor eax, eax
jmp 0x444273
test esi, edi
test dword [esp + 8], esi
js 0x4441fb
jae 0x44420e
pushf
jp 0x444201
ror esi, 2
rol esi, 2
popf
jns 0x44420b
jb 0x44420e
sub eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004407fd
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004473d7
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x444238
xor eax, eax
jmp 0x444273
nop
jg 0x44424a
pushf
test esp, 0x3ccd
popf
jge 0x444247
jle 0x44424a
mov ecx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0043721d
add esp, 4
shr esp, 0
neg edx
neg edx
add esp, 0
jp 0x44426c
lea esp, [esp]
jnp 0x444267
lea edx, [edx]
jnp 0x44426c
mov ecx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44440e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.004473d7
add esp, 0xc
push 0x21
push 0x431658
lea ecx, [ebp - 0x138]
push ecx
call fcn.004407b2
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x444516
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.004473d7
add esp, 0xc
push 0xb
push 0x43167c
lea edx, [ebp - 0x138]
push edx
call fcn.004407b2
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x444509
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004407b2
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x444518
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4453a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004473d7
add esp, 0xc
jg 0x4453c3
lea ecx, [ecx]
jp 0x4453ce
js 0x4453c9
jg 0x4453cb
jnp 0x4453ce
mov ecx, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
add esp, 0
xor ecx, 0
add esp, 0
je 0x445425
pushf
sub ebx, 0
add esi, 0
and esi, 0xffffffff
popf
lea ebx, [ebx]
mov edi, edi
jne 0x445425
mov esi, 0x80f44d8a
jmp 0xf491dc2f
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
jmp 0x445498
jb 0x4454a3
jg 0x44549c
jno 0x44549e
jmp 0x4454a0
jae 0x4454a3
call fcn.0086da8f
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.0044972d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4454b6
jmp 0x445569
nop
clc
rol esp, 0
jne 0x4454d3
pushf
mov edi, edi
lea esp, [esp]
cmp esi, edi
jb 0x4454c8
popf
js 0x4454cc
jmp 0x4454ce
mov eax, eax
je 0x4454d3
sub eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004407fd
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004473d7
add esp, 0xc
jb 0x4454f5
lea ecx, [ecx]
shr esp, 0
test edx, 0x3db0
jae 0x44551e
pushf
call 0x445509
add esp, 4
mov edi, edi
stc
xchg edi, edx
xchg edi, edx
popf
nop
mov ecx, ecx
lea esp, [esp]
jb 0x44551e
mov edi, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x445526
jmp 0x445569
test eax, ecx
js 0x44552a
jle 0x445540
pushf
ror esp, 0
js 0x445533
jb 0x445535
popf
jp 0x445539
jb 0x44553b
jb 0x44553d
jg 0x445540
mov ecx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0043721d
add esp, 4
jb 0x44554e
add eax, 0x2175
sub eax, 0x2175
jns 0x445562
jl 0x44555c
jae 0x44555e
js 0x445562
lcall 0xff50, 0x8458b39
push ebp
cld
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x446b47
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004473d7
add esp, 0xc
ror edi, 1
ror edi, 0x1f
call fcn.00446b71
Function at 0x447591
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004473d7
add esp, 0xc
test esi, 0x1378
test dword [esp], ecx
ror eax, 0
mov edi, edi
jno 0x4475c8
pushf
sub esp, 0
popf
jae 0x4475c3
jnp 0x4475c5
jo 0x4475c8
add esi, 0xc653e445
inc ebp
bnd jo 0x447597
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
inc ebp
out 0x65, eax
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
jl 0x447612
jo 0x447627
jbe 0x447616
lea esi, [esi + 0x350d]
lea esi, [esi - 0x350d]
lea edi, [edi]
jno 0x447627
lcall 0x1e9, 0x80e44d8a
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0044972d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4476d5
xor eax, eax
jmp 0x447745
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004407fd
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004473d7
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x447743
or ebx, 0
jb 0x447709
jbe 0x447702
js 0x447704
jae 0x447709
mov ebx, 0x4d8b38ec
cld
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043721d
add esp, 4
stc
jge 0x44772a
pushf
shr edx, 0
rol esi, 0x1f
ror esi, 0x1f
popf
jnp 0x447727
jl 0x44772a
mov eax, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x447745
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x449da5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x42fc68], 1
jne 0x449f22
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004473d7
add esp, 0xc
and edx, 0xffffffff
xchg esp, esp
jl 0x449dd2
jb 0x449ddd
ja 0x449dd6
jle 0x449dd8
jp 0x449dda
jae 0x449ddd
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
test dword [esp], ecx
rol eax, 0xc
rol eax, 0x14
add ebx, 0
jae 0x449e29
pushf
xchg edx, eax
xchg edx, eax
xor esi, 0
popf
jns 0x449e26
jb 0x449e29
xor eax, 0x80e84d8a
jmp 0xe8922633
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0044972d
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x449e9e
xor eax, eax
jmp 0x449f78
xchg ecx, edx
xchg ecx, edx
rol eax, 4
rol eax, 0x1c
jp 0x449eb5
ja 0x449eac
jp 0x449eae
jne 0x449eb0
jb 0x449eb2
jnp 0x449eb5
sub eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004407fd
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004473d7
add esp, 0xc
jg 0x449ed7
shr esp, 0
add ebx, 0
jge 0x449f0c
pushf
add ecx, 0x3909
sub ecx, 0x3909
call 0x449ef2
lea esp, [esp + 4]
xor edi, dword [esp]
xor edi, dword [esp]
ror edx, 0x12
ror edx, 0xe
popf
nop
mov eax, eax
jb 0x449f09
jl 0x449f0c
jmp 0x13d1c93
cmp dword [ebp - 8], 0
je 0x449f1c
mov eax, dword [ebp - 8]
mov dword [0x42fc68], eax
jmp 0x449f20
xor eax, eax
jmp 0x449f78
jmp 0x449f2b
mov ecx, dword [0x42fc68]
mov dword [ebp - 8], ecx
or esp, 0
lea edi, [edi + 0x5839]
lea edi, [edi - 0x5839]
jno 0x449f51
pushf
cmp ebx, dword [esp + 4]
not ecx
not ecx
popf
lea ebx, [ebx]
ja 0x449f4c
jle 0x449f4e
jo 0x449f51
xor eax, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
nop
jge 0x449f61
lea ecx, [ecx]
jp 0x449f5e
jl 0x449f61
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0043721d
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x449f81
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004473d7
add esp, 0xc
inc eax
dec eax
shl esp, 0
ror edx, 2
rol edx, 2
mov edx, edx
jle 0x449fc9
pushf
cmp edi, dword [esp]
or eax, eax
add esi, 0x2f66
sub esi, 0x2f66
popf
mov esi, esi
mov esp, esp
xchg esi, edi
xchg esi, edi
jg 0x449fc9
mov esi, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cmp edx, 0x5fda
shr esp, 0
jg 0x44a00f
pushf
jae 0x44a008
popf
jl 0x44a00c
jle 0x44a00f
jmp 0x8134ed9d
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
and eax, eax
rol esi, 0
ja 0x44a07f
jle 0x44a078
jp 0x44a07a
jbe 0x44a07f
sub eax, 0xa9e872b3
idiv bh
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.0044972d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44a091
xor eax, eax
jmp 0x44a0d5
lea ebx, [ebx + 0x811]
lea ebx, [ebx - 0x811]
lea ebx, [ebx]
jne 0x44a0a1
jae 0x44a0b2
pushf
clc
jno 0x44a0a8
stc
popf
xchg edi, edx
xchg edi, edx
jb 0x44a0b2
mov edi, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004407fd
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004473d7
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4506c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004473d7
add esp, 0xc
sub esp, 0
test dword [esp + 0xc], eax
jle 0x4506e3
cmc
je 0x4506ed
jnp 0x4506e8
jo 0x4506ea
jne 0x4506ed
mov ebx, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
test edx, edi
cmp ebx, dword [esp]
jge 0x450724
jp 0x450726
jnp 0x45073e
jl 0x45072a
xchg edi, edi
lea ebx, [ebx + 0x3550]
lea ebx, [ebx - 0x3550]
jne 0x45073a
jp 0x45073e
add eax, 0xec4d8af4
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0044972d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4507b3
xor eax, eax
jmp 0x45083b
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004407fd
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004473d7
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x450839
jmp 0x4507db
je 0x4507eb
pushf
shr ebx, 0
popf
jmp 0x4507e6
ja 0x4507e8
jne 0x4507eb
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0043721d
add esp, 4
push ecx
add ecx, 0x726b
ror ecx, 5
pop ecx
lea ecx, [ecx + 0x547b]
sub ecx, 0x547b
xor eax, dword [esp + 0xc]
xor eax, dword [esp + 0xc]
jbe 0x450828
pushf
xor esp, 0
popf
jo 0x450821
lea esi, [esi]
jae 0x450825
ja 0x450828
lcall 0x558b, 0x51104d8b
or al, 0x52
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x45083b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc