joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454868
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x320033
push edi
mov edi, dword [ebp + 0xc]
mov ecx, 0x790073
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x54]
push 1
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], 0x53005c
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x48], 0x730079
push eax
mov dword [ebp - 0x44], 0x650074
mov dword [ebp - 0x40], 0x52006d
mov dword [ebp - 0x3c], 0x6f006f
mov dword [ebp - 0x38], 0x5c0074
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0x740073
mov dword [ebp - 0x2c], 0x6d0065
mov dword [ebp - 0x24], 0x77005c
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x18], 0x66006b
mov dword [ebp - 0x14], 0x6c0075
mov dword [ebp - 0x10], 0x2e006c
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x454937
push ebx
push edi
push esi
push dword [ebp - 0x54]
push dword [ebp - 0x50]
call fcn.00405020
cmp al, 1
jne 0x45492f
push dword [edi]
push dword [esi]
call fcn.00454a8c
mov bl, 1
push dword [ebp - 0x50]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x455842
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x61
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
je 0x45587a
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x42
call fcn.004355f2
mov ebx, eax
test ebx, ebx
je 0x4558d2
imul eax, ebx, 0x50
push eax
push 1
mov dword [ebp - 0x20], eax
call fcn.00478d6e
mov esi, eax
test esi, esi
je 0x4558d2
push dword [ebp - 0x20]
push 0
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push ebx
push esi
call fcn.00454e36
cmp al, 1
jne 0x4558cc
push ebx
push esi
call fcn.0045512c
cmp al, 1
jne 0x4558cc
push esi
push 0x23c
call fcn.004356b2
jmp 0x4558d2
push esi
call fcn.00478d8c
test edi, edi
pop edi
pop esi
pop ebx
je 0x4558e2
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret

Function at 0x455bdc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x44005c
push eax
mov dword [ebp - 0x1c], 0x690072
mov dword [ebp - 0x18], 0x650076
mov dword [ebp - 0x14], 0x5c0072
mov dword [ebp - 0x10], 0x630054
mov dword [ebp - 0xc], 0x690070
mov dword [ebp - 8], 0x70
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret

Function at 0x456028
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x44005c
push eax
mov dword [ebp - 0x18], 0x690072
mov dword [ebp - 0x14], 0x650076
mov dword [ebp - 0x10], 0x5c0072
mov dword [ebp - 0xc], 0x640074
mov dword [ebp - 8], 0x78
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x456272
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x730079
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x58]
push 1
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], 0x53005c
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x48], 0x650074
push eax
mov dword [ebp - 0x44], 0x52006d
mov dword [ebp - 0x40], 0x6f006f
mov dword [ebp - 0x3c], 0x5c0074
mov dword [ebp - 0x38], 0x790073
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x6d0065
mov dword [ebp - 0x2c], 0x320033
mov dword [ebp - 0x28], 0x64005c
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x730072
mov dword [ebp - 0x18], 0x74005c
mov dword [ebp - 0x14], 0x780064
mov dword [ebp - 0x10], 0x73002e
mov dword [ebp - 8], ebx
call fcn.00439b16
test eax, eax
jne 0x45633e
push ebx
push edi
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x54]
call fcn.00405020
cmp al, 1
jne 0x456336
mov bl, al
push dword [ebp - 0x54]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x4566a0
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x29e
push esi
call fcn.004355f2
mov ebx, eax
test ebx, ebx
jne 0x4566d8
call fcn.00456a56
push esi
call fcn.004355f2
mov ebx, eax
test ebx, ebx
je 0x45681f
push edi
push 0x61
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
je 0x4566fe
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x20
call fcn.004355f2
push 0x21
mov dword [ebp - 0x28], eax
call fcn.004355f2
push 3
mov esi, eax
call fcn.004355f2
push 0x4aef
mov dword [ebp - 0x24], eax
call fcn.004355f2
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
test ecx, ecx
je 0x456811
test esi, esi
je 0x456811
cmp dword [ebp - 0x24], 0
je 0x456811
test eax, eax
je 0x456811
cmp ebx, esi
jae 0x456811
lea eax, [esi + ecx]
mov dword [ebp - 0x40], eax
lea edx, [ecx + ebx]
mov eax, dword [ecx + 0x3c]
mov ebx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [eax + ecx + 0x34]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [esi + ebx]
push eax
push edx
call fcn.0041d7e6
test al, al
je 0x456811
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], edx
add edx, dword [ebp - 0x50]
mov dword [ebp - 0x34], edx
cmp dword [eax], 0x10cd
jne 0x4567c3
mov eax, dword [ebp - 0x5c]
sub eax, ebx
add eax, edx
cmp eax, dword [ebp - 0x3c]
je 0x4567d3
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x100
jb 0x45677b
jmp 0x456811
test ecx, ecx
je 0x456811
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x40]
push ecx
call fcn.0041d7e6
cmp al, 1
jne 0x456811
mov eax, dword [ebp - 0x48]
cmp dword [eax], 0x11b6
jne 0x456811
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x44]
cmp eax, ecx
jbe 0x456811
sub eax, ecx
cmp eax, esi
jae 0x456811
add eax, dword [ebp - 0x24]
push eax
push 0x29c
call fcn.004356b2
test edi, edi
pop edi
je 0x45681f
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x456830
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x61
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
mov dword [ebp - 0x34], edi
je 0x45686b
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x20
call fcn.004355f2
push 0x21
mov ebx, eax
call fcn.004355f2
mov esi, eax
push 3
mov dword [ebp - 0x24], esi
call fcn.004355f2
push 0x4be2
mov dword [ebp - 0x30], eax
call fcn.004355f2
mov ecx, eax
test ebx, ebx
je 0x456a37
test esi, esi
je 0x456a37
cmp dword [ebp - 0x30], 0
je 0x456a37
test ecx, ecx
je 0x456a37
cmp ecx, esi
jae 0x456a37
mov eax, dword [ebx + 0x3c]
lea esi, [ecx + ebx]
mov eax, dword [eax + ebx + 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
add eax, ebx
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov ebx, ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x58]
push ecx
push eax
push esi
call fcn.0041d7e6
test al, al
je 0x456a37
mov eax, dword [ebp - 0x38]
add esi, dword [ebp - 0x40]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
cmp ecx, 0x107c
jne 0x456906
test eax, eax
js 0x456921
cmp ecx, 0x1096
jne 0x456912
test eax, eax
js 0x456921
inc ebx
cmp ebx, 0x50
jae 0x456a37
mov eax, dword [ebp - 0x20]
jmp 0x4568dc
mov edi, dword [ebp - 0x24]
xor ecx, ecx
mov ebx, ecx
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x20]
push esi
call fcn.0041d7e6
test al, al
je 0x456a34
mov eax, dword [ebp - 0x38]
add esi, dword [ebp - 0x40]
mov eax, dword [eax]
cmp eax, 0x1024
je 0x456957
cmp eax, 0x1285
jne 0x456a2a
cmp dword [ebp - 0x48], 0x7f
mov dword [ebp - 0x24], 0x100
jne 0x45696b
mov dword [ebp - 0x24], 0x80
cmp dword [ebp - 0x48], 0x1ff
jne 0x45697b
mov al, 1
mov dword [ebp - 0x28], eax
jmp 0x45697e
mov eax, dword [ebp - 0x28]
test al, al
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x20]
push esi
jne 0x4569b4
call fcn.0041d7e6
cmp al, 1
jne 0x456a2a
mov eax, dword [ebp - 0x38]
cmp dword [eax], 0x1080
jne 0x456a2a
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
jbe 0x456a2a
sub eax, ecx
jmp 0x4569f6
call fcn.0041d7e6
cmp al, 1
jne 0x456a2a
mov eax, dword [ebp - 0x38]
add esi, dword [ebp - 0x40]
cmp dword [eax], 0x1270
jne 0x456a2a
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x20]
push esi
call fcn.0041d7e6
cmp al, 1
jne 0x456a2a
mov eax, dword [ebp - 0x38]
cmp dword [eax], 0x1037
jne 0x456a2a
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
jbe 0x456a2a
sub eax, ecx
sub eax, 0xc
test eax, eax
je 0x456a2a
cmp eax, edi
jae 0x456a2a
add eax, dword [ebp - 0x30]
push eax
push 0x299
call fcn.004356b2
push dword [ebp - 0x24]
push 0x29a
call fcn.004356b2
mov ecx, dword [ebp - 0x28]
movzx eax, cl
push eax
push 0x29b
call fcn.004356b2
inc ebx
cmp ebx, 0xa
jb 0x456928
mov edi, dword [ebp - 0x34]
test edi, edi
pop edi
pop esi
pop ebx
je 0x456a47
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x456a56
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x61
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
je 0x456a8e
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x20
call fcn.004355f2
mov ebx, eax
push 0x21
mov dword [ebp - 0x28], ebx
call fcn.004355f2
push 0x42
mov dword [ebp - 0x24], eax
call fcn.004355f2
push 3
mov dword [ebp - 0x2c], eax
call fcn.004355f2
push 0x62
mov dword [ebp - 0x20], eax
call fcn.004355f2
mov esi, eax
test esi, esi
jne 0x456ad3
call fcn.004554c0
push 0x62
call fcn.004355f2
mov esi, eax
test ebx, ebx
je 0x456b4e
cmp dword [ebp - 0x24], 0
je 0x456b4e
cmp dword [ebp - 0x20], 0
je 0x456b4e
test esi, esi
je 0x456b4e
mov eax, dword [ebx + 0x3c]
push 0x4be8
mov ebx, dword [eax + ebx + 0x34]
call fcn.004355f2
inc eax
cmp eax, 1
jbe 0x456b4e
mov edx, dword [ebp - 0x24]
lea ecx, [eax + 4]
cmp ecx, edx
jae 0x456b4e
mov ecx, dword [ebp - 0x28]
mov ecx, dword [eax + ecx]
test ecx, ecx
je 0x456b4e
cmp ecx, dword [ebp - 0x2c]
jae 0x456b4e
mov ecx, dword [esi + ecx*4]
cmp ecx, ebx
jbe 0x456b4e
mov esi, ecx
sub esi, ebx
cmp esi, edx
jae 0x456b4e
lea eax, [esi + ebx]
cmp ecx, eax
jne 0x456b4e
push esi
push 0x29e
call fcn.004356b2
add esi, dword [ebp - 0x20]
push esi
push 0x29f
call fcn.004356b2
push esi
push 0x67
call fcn.0047700e
test edi, edi
pop edi
pop esi
pop ebx
je 0x456b5e
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x457310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x8da
mov dword [ebp - 0x58], eax
mov edi, dword [esi + 0x3c]
mov byte [ebp - 0x45], 0
call fcn.004355f2
mov dword [ebp - 0x50], eax
test eax, eax
je 0x45751a
mov eax, dword [edi + esi + 0x34]
mov dword [ebp - 0x4c], eax
mov eax, 0x50425355
push 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
mov dword [ebp - 0x20], 0x5f54524f
mov dword [ebp - 0x1c], 0x69676552
mov dword [ebp - 0x18], 0x72657473
mov dword [ebp - 0x10], 0x4474726f
mov dword [ebp - 0xc], 0x65766972
mov dword [ebp - 8], 0x72
call fcn.0040487c
test eax, eax
je 0x45751a
cmp eax, ebx
jae 0x45751a
test ebx, ebx
je 0x45751a
lea edx, [esi + eax]
add esi, ebx
lea eax, [edx + 0x1000]
mov dword [ebp - 0x54], edx
cmp esi, eax
jbe 0x4573c0
mov esi, eax
push 8
xor eax, eax
lea edi, [ebp - 0x44]
pop ecx
rep stosd dword es:[edi], eax
cmp edx, esi
jae 0x45751a
mov edi, dword [ebp - 0x4c]
lea eax, [ebp - 0x7c]
push eax
push esi
push edx
call fcn.0041d7e6
test al, al
je 0x45751a
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
lea eax, [ecx - 0x10ab]
cmp eax, 7
ja 0x457426
mov edx, dword [ebp - 0x6c]
test edx, edx
jle 0x457509
mov edi, dword [ebp - 0x4c]
cmp edx, edi
jbe 0x457509
mov eax, edx
sub eax, edi
cmp ebx, eax
jbe 0x457509
mov dword [ebp + ecx*4 - 0x42f0], edx
jmp 0x457509
cmp ecx, 0x107c
jne 0x45748e
mov ecx, dword [ebp - 0x70]
lea eax, [ecx - 0x38]
cmp eax, 0x6c
ja 0x457509
test ecx, 3
jne 0x457509
add ecx, 0xffffffc8
shr ecx, 2
cmp ecx, 0x1b
ja 0x457509
movzx eax, byte [ebp - 0x74]
shr eax, 3
and eax, 7
mov eax, dword [ebp + eax*4 - 0x44]
test eax, eax
je 0x457509
mov edx, dword [ebp - 0x58]
imul ecx, ecx, 0x1c
cmp dword [ecx + edx + 4], 0
jne 0x457509
sub eax, edi
mov dword [ecx + edx + 4], eax
add eax, dword [ebp - 0x50]
mov dword [ecx + edx + 8], eax
jmp 0x4574e2
cmp ecx, 0x10b8
jne 0x4574eb
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
jle 0x457509
mov edi, dword [ebp - 0x4c]
cmp ecx, edi
jbe 0x457509
sub ecx, edi
cmp ebx, ecx
jbe 0x457509
mov edx, dword [ebp - 0x70]
lea eax, [edx - 0x38]
cmp eax, 0x6c
ja 0x457509
test edx, 3
jne 0x457509
lea eax, [edx - 0x38]
shr eax, 2
cmp eax, 0x1b
ja 0x4574e2
mov edi, dword [ebp - 0x58]
imul edx, eax, 0x1c
cmp dword [edx + edi + 4], 0
jne 0x4574e2
mov eax, dword [ebp - 0x50]
add eax, ecx
mov dword [edx + edi + 4], ecx
mov dword [edx + edi + 8], eax
mov edi, dword [ebp - 0x4c]
mov byte [ebp - 0x45], 1
jmp 0x457509
cmp ecx, 0x11b2
je 0x457503
cmp ecx, 0x11b3
je 0x457503
cmp ecx, 0x10cd
jne 0x457509
cmp byte [ebp - 0x45], 1
je 0x45751a
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x64]
mov dword [ebp - 0x54], edx
cmp edx, esi
jb 0x4573d5
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x45]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 0xc
Function at 0x457562
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x44005c
push eax
mov dword [ebp - 0x20], 0x690072
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x5c0072
mov dword [ebp - 0x14], 0x730075
mov dword [ebp - 0x10], 0x650062
mov dword [ebp - 0xc], 0x630068
mov dword [ebp - 8], 0x69
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret

Function at 0x4577a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x730079
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x60]
push 1
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x53005c
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x50], 0x650074
push eax
mov dword [ebp - 0x4c], 0x52006d
mov dword [ebp - 0x48], 0x6f006f
mov dword [ebp - 0x44], 0x5c0074
mov dword [ebp - 0x40], 0x790073
mov dword [ebp - 0x3c], 0x740073
mov dword [ebp - 0x38], 0x6d0065
mov dword [ebp - 0x34], 0x320033
mov dword [ebp - 0x30], 0x64005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x75005c
mov dword [ebp - 0x1c], 0x620073
mov dword [ebp - 0x18], 0x6f0070
mov dword [ebp - 0x14], 0x740072
mov dword [ebp - 0x10], 0x73002e
mov dword [ebp - 8], ebx
call fcn.00439b16
test eax, eax
jne 0x457880
push ebx
push edi
push esi
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
call fcn.00405020
cmp al, 1
jne 0x457878
mov bl, al
push dword [ebp - 0x5c]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x457b3e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0x914
call fcn.004355f2
cmp eax, 0x2800
jae 0x457b5b
call fcn.00457b6e
pop ebp
ret 8
cmp dword [ebp + 8], 0
je 0x457b57
cmp dword [ebp + 0xc], 0
je 0x457b57
pop ebp
jmp fcn.00457bc0

Function at 0x458b9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x44005c
push eax
mov dword [ebp - 0x20], 0x690072
mov dword [ebp - 0x1c], 0x650076
mov dword [ebp - 0x18], 0x5c0072
mov dword [ebp - 0x14], 0x6f0056
mov dword [ebp - 0x10], 0x73006c
mov dword [ebp - 0xc], 0x61006e
mov dword [ebp - 8], 0x70
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x458de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x730079
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x60]
push 1
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x53005c
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x50], 0x650074
push eax
mov dword [ebp - 0x4c], 0x52006d
mov dword [ebp - 0x48], 0x6f006f
mov dword [ebp - 0x44], 0x5c0074
mov dword [ebp - 0x40], 0x790073
mov dword [ebp - 0x3c], 0x740073
mov dword [ebp - 0x38], 0x6d0065
mov dword [ebp - 0x34], 0x320033
mov dword [ebp - 0x30], 0x64005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x76005c
mov dword [ebp - 0x1c], 0x6c006f
mov dword [ebp - 0x18], 0x6e0073
mov dword [ebp - 0x14], 0x700061
mov dword [ebp - 0x10], 0x73002e
mov dword [ebp - 8], ebx
call fcn.00439b16
test eax, eax
jne 0x458eba
push ebx
push edi
push esi
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
call fcn.00405020
cmp al, 1
jne 0x458eb2
mov bl, al
push dword [ebp - 0x5c]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x4592ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1c], 0
push esi
mov esi, dword [ebp + 8]
push 0x8fb
mov dword [ebp - 0x18], 0x63746150
mov dword [ebp - 0x14], 0x72685468
mov dword [ebp - 0x10], 0x57646165
mov dword [ebp - 0xc], 0x6f646e69
mov dword [ebp - 8], 0x7377
call fcn.004355f2
test eax, eax
jne 0x459343
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
call fcn.00404e08
cmp al, 1
jne 0x459343
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x459343
cmp eax, dword [ebp + 0xc]
jae 0x459343
push eax
push 0x90e
call fcn.004356b2
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x45bebe
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x58
push 0
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
pop ebp
ret 4

Function at 0x461654
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x20], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x4616e7
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x7369644e
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x65726544
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0x74736967
push edi
mov dword [ebp - 0x10], 0x72507265
mov dword [ebp - 0xc], 0x636f746f
mov dword [ebp - 8], 0x6c6f
call fcn.00404e08
cmp al, 1
jne 0x4616e7
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4616e7
cmp eax, dword [ebp + 0xc]
jae 0x4616e7
push eax
push 0x364
call fcn.004356b2
mov eax, dword [ebp - 0x20]
add eax, esi
push eax
push 0x365
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x4616fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x361
mov dword [ebp - 0x24], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x461796
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x7369644e
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x67655246
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 0x65747369
push edi
mov dword [ebp - 0x14], 0x6c694672
mov dword [ebp - 0x10], 0x44726574
mov dword [ebp - 0xc], 0x65766972
mov dword [ebp - 8], 0x72
call fcn.00404e08
cmp al, 1
jne 0x461796
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x461796
cmp eax, dword [ebp + 0xc]
jae 0x461796
push eax
push 0x367
call fcn.004356b2
mov eax, dword [ebp - 0x24]
add eax, esi
push eax
push 0x368
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8