joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f450
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 8
test eax, eax
push esi
push edi
jg 0x1000f466
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
push eax
mov eax, dword [esp + 0x20]
push eax
call fcn.1000f060
mov ecx, dword [esp + 0x1c]
push 0x1003a41c
push ecx
call fcn.1001bc35
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x1000f494
pop edi
mov eax, 0xfffffffe
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x18]
push 0x1003a418
push edx
call fcn.1001bc35
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000f4c0
push esi
call fcn.1001bb87
add esp, 4
mov eax, 0xfffffffd
pop edi
pop esi
add esp, 8
ret
push ebx
push 2
push 0
push esi
call fcn.1001bace
push esi
call fcn.1001b94b
push 0
push 0
push esi
mov ebx, eax
call fcn.1001bace
push esi
push 1
push 8
push 0x10040480
shr ebx, 3
call fcn.1001b61f
add ebx, 0xfffffffd
add esp, 0x2c
test ebx, ebx
jbe 0x1000f587
push esi
push 1
push 8
push 0x10040488
call fcn.1001b61f
mov eax, dword [0x10040488]
mov ecx, dword [0x1004048c]
push 0x1004048c
push 0x10040488
mov dword [0x10040478], eax
mov dword [0x1004047c], ecx
call fcn.1000eb50
mov edx, dword [0x10040480]
mov eax, dword [0x10040488]
mov ecx, dword [0x1004048c]
xor eax, edx
mov edx, dword [0x1004047c]
mov dword [0x10040488], eax
mov eax, dword [0x10040484]
push edi
xor ecx, eax
push 1
mov dword [0x1004048c], ecx
mov ecx, dword [0x10040478]
push 8
push 0x10040488
mov dword [0x10040480], ecx
mov dword [0x10040484], edx
call fcn.1001b736
add esp, 0x28
dec ebx
jne 0x1000f4fd
push esi
push 1
push 8
push 0x10040488
call fcn.1001b61f
mov eax, dword [0x10040488]
mov ecx, dword [0x1004048c]
push 0x1004048c
push 0x10040488
mov dword [0x10040478], eax
mov dword [0x1004047c], ecx
call fcn.1000eb50
mov eax, dword [0x10040488]
mov ecx, dword [0x10040480]
mov edx, dword [0x10040478]
mov ebx, dword [0x10040484]
xor eax, ecx
mov ecx, dword [0x1004048c]
push esi
mov dword [0x10040480], edx
mov edx, dword [0x1004047c]
push 1
xor ecx, ebx
push 8
push 0x10040488
mov dword [0x10040488], eax
mov dword [0x1004048c], ecx
mov dword [0x10040484], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
call fcn.1001b61f
push 0x1004048c
push 0x10040488
call fcn.1000eb50
mov eax, dword [0x10040480]
mov edx, dword [0x10040488]
mov ecx, dword [0x1004048c]
xor edx, eax
mov eax, dword [0x10040484]
push edi
xor eax, ecx
push 1
and eax, 7
lea ecx, [esp + 0x44]
push eax
push ecx
mov dword [0x10040488], edx
mov dword [0x1004048c], eax
call fcn.1001b736
add esp, 0x40
push esi
call fcn.1001bb87
push edi
call fcn.1001bb87
add esp, 8
mov eax, 1
pop ebx
pop edi
pop esi
add esp, 8
ret
Function at 0x1001a260
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x10040600
call fcn.1001a5a0
push 0x40
push 0x10035b74
push 0x10040600
push 0x10040600
call fcn.1001a4c0
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x1001a2eb
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x1003a56c]
mov ecx, 8
mov esi, eax
mov edi, 0x100405e0
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.1001a400
mov ecx, dword [0x1003a568]
mov edx, dword [0x1003a56c]
push 0x20
push ecx
push edx
call fcn.1001a510
mov edi, dword [0x1003a568]
add esp, 0x14
mov ecx, 8
mov esi, 0x100405e0
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x1001a29f
jmp 0x1001a344
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x1003a568]
mov ecx, 8
mov esi, eax
mov edi, 0x100405e0
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.1001a400
mov ecx, dword [0x1003a56c]
mov edx, dword [0x1003a568]
push 0x20
push ecx
push edx
call fcn.1001a510
mov edi, dword [0x1003a56c]
add esp, 0x14
mov ecx, 8
mov esi, 0x100405e0
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x1001a2fa
push 0x40
push 0x10035bb4
push 0x10040600
push 0x10040600
call fcn.1001a4c0
mov eax, dword [esp + 0x24]
push 0x40
push 0x10040600
push eax
call fcn.1001a5e0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1001a380
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x100405a0
call fcn.1001a5a0
push 0x38
push 0x10035c44
push 0x100405a0
push 0x100405a0
call fcn.1001a4c0
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x10035cac]
mov edx, dword [0x1003a570]
push ecx
push 0x1c
push edx
call fcn.1001a540
movsx eax, byte [esi + 0x10035cac]
mov ecx, dword [0x1003a574]
push eax
push 0x1c
push ecx
call fcn.1001a540
push 0x30
push 0x10035c7c
push 0x100405a0
push edi
call fcn.1001a4c0
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x1001a3b2
pop edi
pop esi
ret

Function at 0x1001a400
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x10035bf4
push esi
push 0x10040570
call fcn.1001a4c0
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x10040570
call fcn.1001a510
push 0x10040570
push esi
call fcn.1001a450
push 0x20
push 0x10035c24
push esi
push esi
call fcn.1001a4c0
add esp, 0x34
pop esi
ret

Function at 0x1001a510
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x1001a532
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x1001a524
pop ebx
pop esi
ret
Function at 0xa2861b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
mov al, ah
or ecx, 0xd9e8bfa2
setg ah
xchg dword [esp], esi
call fcn.00a285d7

Function at 0xa2874e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], esi
cmc
bswap edx
lea esi, [esi + 0x23]
setbe bh
btr dx, cx
jmp 0xa28786
mov ebx, 0xffaa3981
mov ax, word [esp]
mov dx, si
mov bl, byte [esp]
mov eax, dword [esp]
jmp 0xa28738
rcl ax, cl
mov ebx, 0x6468a002
mov eax, esi
xchg dword [esp], esi
mov dx, si
mov ebx, dword [esp]
call fcn.00a28770
pop ebp
aad 0x45
sub al, 0xdf
imul ecx, ebp, 0x46
aam 0xb3
dec esi
cli
ja 0xa2880a
test eax, 0x83826bc8
in al, dx
add dl, dl
invalid

Function at 0xa2a748
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa2a786
mov dx, 0x194e
mov dl, byte [esp]
lea edx, [edi*4]
mov dl, byte [esp]
mov dword [esp + 6], eax
lea esp, [esp + 1]
rol al, 0
mov dl, byte [esp]
lea edx, [esp + edi]
jmp 0xa2a74a

Function at 0xa3bbac
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0xa1569b
pushfd
or dword [esp], reloc.MSVCRT.dll_malloc
popfd
cpuid
nop
jmp 0xa156b2
pop ebx
ret
jmp 0xa1568f
jmp 0xa3bb96

Function at 0xa58e73
Capabilities:
Encrypt data using speck

Disassembly:
mov bl, byte [ecx + 2]
call fcn.00a12bf1
and eax, 0x12474ff
push dword [esp + 1]
cmp dl, 0x2b
jmp 0xa59595
cmp dl, 0x30
push si
lea esp, [esp + 2]
jmp 0xa594ef
lea esp, [esp + 4]
jae 0xa5948f
jb 0xa58f01
salc
arpl bx, si
xchg esi, eax
xlatb
push ecx
rcl byte [ebx + 0xf]
cmp byte [eax - 0x64], 0xfb
inc dword [ebx - reloc.MSVCRT.dll_malloc]
pop ecx
pushfd
sti
dec dword [edi]
cmp ch, 0xfe
invalid
lea ecx, [ebx + 0x41]
jmp fcn.00a5933c
cmp ebx, 0x34
call fcn.00a58ed5
lea esp, [esp + 4]
cmp dl, 0x61
jmp 0xa594d0
cmp dl, 0x7a
jmp 0xa594e3
jb 0xa12c3d
sub esp, 0x1b
lea esp, [esp + 3]
lea esp, [esp + 0x18]
jmp 0xa594ba
jbe 0xa12be8
ja 0xa12c3d
jb 0xa12c1f
jae 0xa59609
mov al, 0x36
movsb byte es:[edi], byte [esi]
ret
jne 0xa12bbc
je 0xa12be8
push ecx
aam 0x4a
sub eax, 0x41c96bdc
sal dword [eax + reloc.MSVCRT.dll_malloc], 1
nop
test dword [edx], reloc.MSVCRT.dll_malloc
cli
das
cmp dl, 0x2f
pushfd
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
jmp 0xa5952f
push bx
lea esp, [esp]
lea esp, [esp + 2]
je 0xa12be8
jmp 0xa5954f
cmp dl, 0x39
jbe 0xa12be8
ja 0xa12c1f

Function at 0xb36008
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x1d], ah
rdtsc
pop di
push word [esp + 0x19]
jmp 0xb36029
jmp 0xb35ff2
bswap ebx
rdtsc
push dword [esp + 0xc]
lea edx, [ecx*4]
sub cl, 0xd9
mov ax, cx
jmp 0xb36054
mov edx, dword [esp + 9]
bswap edi
std
btc di, dx
sub esp, 0xe
mov edi, 0x1162b506
jmp 0xb3600a
stc
popal
neg eax
push word [esp + 1]
mov dh, 0xc5
pop si
jmp 0xb36199
mov ax, word [esp + 2]
lea edi, [eax + edi]
lea esp, [esp + 0x11]
stc
clc
mov esi, dword [esp + 0x16]
jmp 0xb3603e
neg ebx
dec edi
call fcn.00b36090
bswap eax
cmc
add esp, 0
mov edx, esi
bswap edi
neg edi
jmp 0xb360a6
Function at 0xb36090
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
push word [esp + 6]
add esp, 5
xchg word [esp], bx
jmp 0xb360c4
lea esi, [edx*4]
rdtsc
mov ax, word [esp + 2]
jmp 0xb36144
xchg ch, ah
not ch
mov bx, 0xc118
lea ebp, [edi*4]
btc ebp, esp
mov word [esp + 1], bx
jmp 0xb360ae
rdtsc
push dx
sub esp, 0xe
xchg bl, al
sbb ecx, 0x67e20f15
jmp 0xb3611f
inc bp
neg ah
rdtsc
not dl
xchg bh, cl
xchg al, bh
jmp 0xb360dd
shr al, 3
mov dh, 0xe0
mov dl, byte [esp]
rdtsc
lea edx, [eax + 0x13]
cmc
jmp 0xb360f3
shl dx, cl
mov bx, 0xd78c
add esp, 1
mov di, bp
rdtsc
mov byte [esp + 8], dl
jmp 0xb3616c
add esp, 2
mov dx, bx
rdtsc
pop si
bt esi, edi
lea ebx, [ecx + edi]
jmp 0xb3610f
mov ecx, esi
mov ch, bh
xchg edi, eax
xchg al, ch
adc si, cx
push dword [esp + 4]
jmp 0xb3617f
xor dl, bh
mov byte [esp + 6], bh
neg edx
bswap esi
setge ch
pop dword [esp + 6]
jmp 0xb36156
rol dh, 4
xchg bp, cx
mov ebp, dword [esp + 7]
pop word [esp + 1]
bts ax, bx
jmp 0xb36281
xchg ebp, edx
stc
mov dword [esp + 2], ebp
mov ecx, dword [esp + 6]
mov edi, 0x669add5d
pop word [esp + 1]
jmp 0xb36232
lea eax, [esi + ebp]
mov dword [esp + 1], ecx
pop di
mov esi, edx
rdtsc
neg bx
jmp 0xb361aa
lea esp, [esp + 2]
btc di, sp
sub esp, 0x14
mov ax, 0x7544
jmp 0xb36210
mov ebx, esp
ror dl, cl
sub esp, 0
xchg ch, bl
lea edx, reloc.MSVCRT.dll_malloc
mov al, 0x3c
jmp 0xb361e7
mov word [esp + 0xc], ax
neg dx
lea eax, [ebx*4]
dec si
std
pop edi
jmp 0xb3625e
mov dword [esp], esi
xchg word [esp + 3], bx
add esp, 4
neg eax
mov bl, byte [esp + 2]
xchg byte [esp], dh
jmp 0xb361fd
mov bh, cl
xchg byte [esp + 1], bl
xchg dx, bx
pushal
xchg ebp, ecx
jmp 0xb36378
lea edi, [esp + ecx]
mov dh, 0xcb
bswap ebp
lea esp, [esp + 0xa]
adc ecx, 0x2c3fc933
pop eax
jmp 0xb36248
xchg di, bx
rol ebp, 0x14
mov ecx, 0x89150a9c
mov word [esp + 9], si
mov byte [esp], dl
pop word [esp + 3]
jmp 0xb361d5
pop word [esp + 0x11]
bt ebp, ebx
sub esp, 0x1c
call fcn.00b36332
rdtsc
pop bp
std
mov bl, 0x30
neg cx
or cl, 0xda
jmp 0xb363c9
rdtsc
mov eax, ebx
rdtsc
bswap ebp
rdtsc
mov dx, 0x98f3
jmp 0xb363f3
neg eax
btc ax, bp
bswap ecx
dec ch
mov dh, byte [esp]
mov eax, 0x290fabda
jmp 0xb363b3
shr edx, 0x12
sub esp, 0x1b
rol bl, cl
push ebp
rdtsc
ror ebx, 0x1e
jmp 0xb36406
mov dh, 0x49
not dh
mov di, ax
mov ax, 0xb51a
dec ebx
mov edi, 0x909e19ea
jmp 0xb363dd
xchg di, bx
mov cl, byte [esp + 0xf]
mov word [esp + 9], cx
stc
lea ebp, [ebx + ebp]
bsf ebp, edx
jmp 0xb364f0
clc
lea ecx, [edx + ebp]
mov edx, esi
inc ax
mov edi, 0x1d3f658
bsf esi, ebx
inc cx
jmp 0xb36489
Function at 0xb38670
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call fcn.00b38049
pushfd
lea esp, [esp + 2]
jmp 0xb386a1
push ebx
jmp 0xb386ef
mov dword [esp + 0x54], edi
lea esp, [esp + 0x54]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xb3868b
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xb387c7
mov ebx, eax
lea ebx, [ebx + 0x1c]
mov eax, dword [ebx]
pop ebx
jmp 0xb386d7
push eax
jmp 0xb38044

Function at 0x5a0463
Capabilities:
Parse pe header

Disassembly:
call 0x5a0463
rol byte [edi - 0x4972dbcc], 1
invalid
jne 0x5a0beb
jmp 0x5a05cd
push ebx
jmp 0x5a08b4
call dword [0x5a0244]
js 0x5a04c4
jns 0x5a04c4
dec esi
pop edi
jb 0x5a0c0d
jmp 0x5a07f8
push esp
jmp 0x5a0998
adc dl, dl
jmp 0x5a0ab1
pushal
jmp 0x5a054f
mov dword [0x5a0240], 1
jmp 0x5a0735
jne 0x5a0ab1
jmp 0x5a0c59
jmp 0x5a04c4
ret
push ebp
jmp 0x5a09b2
add dl, dl
jmp 0x5a066a
push edi
jmp 0x5a045d
jmp 0x5a0a52
sub esp, 0xc
jmp 0x5a0bde
call 0x5a099f
push ecx
mov ecx, 0x8d242c87
lodsd eax, dword [esi]
test dword [eax], eax
add byte [eax], al
xchg dword [esp], ebp
jmp 0x5a0943
push esi
jmp 0x5a08cf
inc esi
jmp 0x5a0567
call 0x5a0a58
xchg dword cs:[esp], eax
lea eax, [eax - 0x4db]
xchg dword [esp], eax
jmp 0x5a057c
ret
push eax
jmp 0x5a04ff
cmp dword [0x5a0240], 0
jmp 0x5a0477
mov eax, dword [esp + 0x10]
jmp 0x5a0b1e
call 0x5a0c14
fcom dword [esi - 0x72dbc379]
mov edi, 0xfffffd5c
xchg dword [esp], edi
jmp 0x5a08bd
mov dl, byte [esi]
jmp 0x5a09ee
Function at 0x46c404
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00491fdc
add esp, 0xc
xchg esp, esp
je 0x46c447
pushf
jg 0x46c425
call fcn.0046c42a

Function at 0x46c775
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00491fdc
add esp, 0xc
jp 0x46c790
test esp, 0x33bc
jmp 0x46c798
jae 0x46c79a
js 0x46c7a7
jno 0x46c79e
jnp 0x46c7a0
lea ebx, [ebx]
xchg esp, esp
jns 0x46c7a7
call 0x45330d71
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
std
cld
test dword [esp], eax
ja 0x46c7de
jb 0x46c7e6
jo 0x46c7e2
jae 0x46c7e6
lcall 0xe980, 0xec4d8ae6
add dword [eax + 0x558aec4d], ecx
int1
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0047e844
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46c85b
xor eax, eax
jmp 0x46c8e0
mov ecx, ecx
rol edi, 6
ror edi, 6
lea ecx, [ecx + 0x3273]
lea ecx, [ecx - 0x3273]
ror ebx, 0xb
rol ebx, 0xb
jl 0x46c87f
xchg ebx, ebx
jg 0x46c87b
jge 0x46c87f
xor eax, 0xec458d6a
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00492398
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00491fdc
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x46c8a9
xor eax, eax
jmp 0x46c8e0
je 0x46c8ab
cmp esp, 0x4632
jle 0x46c8b9
jne 0x46c8b5
jg 0x46c8b9
mov esp, 0xfc458b09
mov eax, dword [ebp - 4]
push eax
call fcn.0049b8ce
add esp, 4
test esp, 0x3c27
ror ecx, 9
rol ecx, 9
jns 0x46c8d9
jle 0x46c8d5
js 0x46c8d9
mov ecx, 0x84d8b54
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46d467
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00491fdc
add esp, 0xc
ror edx, 0x19
ror edx, 7
jo 0x46d495
xchg ebx, esi
xchg ebx, esi
jbe 0x46d48e
xchg esp, esp
xchg ebx, ebx
jno 0x46d495
sub eax, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
test ebx, edx
jge 0x46d4f2
pushf
add eax, 0x6cf9
sub eax, 0x6cf9
js 0x46d4e7
add esp, 0
stc
popf
jb 0x46d4ef
jl 0x46d4f2
mov ebx, 0x80ec4d8a
jmp 0xec945cfc
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.0047bd14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46d586
xor eax, eax
jmp 0x46d601
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00492398
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00491fdc
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x46d5ff
test edx, ecx
lea ebx, [ebx + 0x790d]
lea ebx, [ebx - 0x790d]
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
shl esp, 0
jae 0x46d5cc
jnp 0x46d5c9
jb 0x46d5cc
mov eax, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0049b8ce
add esp, 4
jp 0x46d5da
js 0x46d5f6
pushf
lea ecx, [ecx + 0x74b]
lea ecx, [ecx - 0x74b]
stc
popf
jg 0x46d5ef
jmp 0x46d5f1
jp 0x46d5f3
jns 0x46d5f6
mov eax, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x46d601
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46da0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00491fdc
add esp, 0xc
add ecx, 0
je 0x46da2e
je 0x46da2a
jne 0x46da2e
mov esp, 0xec45c6a7
push eax
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
cmc
add esp, 0
jb 0x46da64
jp 0x46da7b
pushf
add esp, 0
jl 0x46da6d
xor eax, 0
or ecx, ecx
popf
jp 0x46da76
jns 0x46da78
jnp 0x46da7b
mov edi, 0x80ec4d8a
jmp 0xec946285
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0047e844
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46daf0
xor eax, eax
jmp 0x46db84
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00492398
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00491fdc
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x46db82
xor ecx, dword [esp]
xor ecx, dword [esp]
cmp edx, eax
lea edx, [edx + 0x57ac]
sub edx, 0x57ac
jle 0x46db2c
jns 0x46db3a
pushf
lea ebx, [ebx]
popf
mov ecx, ecx
nop
js 0x46db3a
mov esp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0049b8ce
add esp, 4
call fcn.0046db4b
xor eax, eax

Function at 0x46ddca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
jno 0x46ddd5
clc
add eax, dword [esp]
sub eax, dword [esp]
jb 0x46ddf6
pushf
ror edi, 5
ror edi, 0x1b
jne 0x46dde8
inc edi
dec edi
shr esp, 0
popf
jb 0x46ddf1
jg 0x46ddf3
jae 0x46ddf6
mov ecx, 0x26dc45c7
add byte [eax], al
add bh, al
inc ebp
fadd dword [eax]
add byte [eax], al
add bl, ch
or dword [ebx - 0x3f7c27bb], ecx
add dword [ecx + 0x7d83d845], ecx
fadd dword [ebx]
mov dword [ebp - 0x24], 0x26
mov dword [ebp - 0x28], 0
jmp 0x46de0f
Function at 0x4711cf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and bh, bh
push ebp
loopne 0x471228
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00491fdc
add esp, 0xc
sub esp, 0
ja 0x4711f5
lea esp, [esp]
lea ebx, [ebx]
jbe 0x4711f5
lcall 0x45c6, 0x48e845c6
in eax, dx
jae 0x4711c4
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
inc ebp
push ecx
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
inc esp
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
shl esp, 0
jbe 0x47125d
pushf
xor eax, dword [esp]
xor eax, dword [esp]
call fcn.0047124f