joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0b58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
je 0x4b0bb6
lea edx, [esp + 0xd8]
push 0xc8
push edx
push 0x93d2f0
push esi
push 0x93d2d8
call ebx
lea eax, [esp + 0xd8]
push 0x9341f8
push eax
call 0x4ef8e6
mov edi, eax
add esp, 8
test edi, edi
je 0x4b0ba3
push 0x9341f8
push 0
call 0x4ef8e6
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4b0ba3
push 0x93d2d0
push ebp
call 0x4f0258
add esp, 8
test eax, eax
je 0x4b0ba3
mov eax, dword [esp + 0x30]
push esi
push eax
lea ecx, [esp + 0x30]
mov ebx, eax
call 0x4fdb30
mov ecx, dword [esp + 0x58]
push edi
push ecx
lea ecx, [esp + 0x58]
call 0x4fdb30
add al, 0
add al, 0
mov edx, dword [esp + 0x44]
push ebp
push edx
lea ecx, [esp + 0x44]
call 0x4fdb30
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4b0b83
push eax
push esi
call 0x4f0258
add esp, 8
test eax, eax
jne 0x4b0b83
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0xb4]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4b0ba3
push eax
push esi
call 0x4f0258
add esp, 8
test eax, eax
jne 0x4b0ba3
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x24]
mov ebx, dword [0x4ec264]
lea esi, [esi + eax + 1]
jmp 0x4b0ac4
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xffffffff
jne 0x4b0bcc
mov eax, dword [esp + 0x18]
mov ebx, eax
inc ebx
neg ebx
sbb ebx, ebx
and ebx, eax
mov ecx, dword [esp + 0x30]
dec ecx
cmp ebx, ecx
jle 0x4b0c34
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1430], 3
call 0x4fd987
lea ecx, [esp + 0x50]
mov byte [esp + 0x1430], 2
call 0x4fd987
lea ecx, [esp + 0x28]
mov byte [esp + 0x1430], 1
call 0x4fd987
lea ecx, [esp + 0x10]
mov byte [esp + 0x1430], 0
call 0x4feb59
lea ecx, [esp + 0x78]
mov dword [esp + 0x1430], 0xffffffff
call fcn.004b14a8
xor eax, eax
jmp 0x4b0d98
add dword fs:[eax], eax
invalid
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1430], 3
call 0x4fd987
lea ecx, [esp + 0x50]
mov byte [esp + 0x1430], 2
call 0x4fd987
lea ecx, [esp + 0x28]
mov byte [esp + 0x1430], 1
call 0x4fd987
lea ecx, [esp + 0x10]
mov byte [esp + 0x1430], 0
call 0x4feb59
lea ecx, [esp + 0x78]
mov dword [esp + 0x1430], 0xffffffff
and al, 0x30
adc al, 0
add bh, bh
invalid
invalid
invalid
call fcn.004b14a8
mov eax, esi
mov ecx, dword [esp + 0x1428]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1424
ret
Function at 0x4b54a8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [pe_dos_header]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x48]
push ebp
push eax
push ecx
lea ecx, [edi + 0x104]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.004b03a0
test eax, eax
jne 0x4b550c
push ebp
push 0x937fe0
mov ecx, edi
call fcn.004b4720
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
mov dword [0], ecx
mov edx, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x50]
push esi
push ebp
push ebp
push ebx
lea ecx, [edx + 0x14]
call fcn.004afdd0
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.0049b810
push ebx
mov dword [esp + 0x4c], ebp
dec esp

Function at 0x4b8788
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, edi
push edx
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.004b7b38
mov ecx, dword [eax]
mov dword [esp + 0x3c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x94], ebp
mov dword [esp + 0x40], edx
mov dword [esp + 0x90], 0x925a34
lea eax, [esp + 0x90]
mov ecx, esi
push eax
mov byte [esp + 0x288], 8
call fcn.004b7f38
push 0xf
call dword [0x4ec528]
push eax
lea ecx, [esp + 0x178]
call 0x50b19d
push 0xffffff
push ebp
push ebp
lea ecx, [esp + 0x144]
mov byte [esp + 0x290], 9
call 0x50b14d
push 0x808080
push ebp
push ebp
lea ecx, [esp + 0x11c]
mov byte [esp + 0x290], 0xa
call 0x50b14d
push ebp
push ebp
push ebp
lea ecx, [esp + 0x1d0]
mov byte [esp + 0x290], 0xb
call 0x50b14d
mov eax, 5
mov dword [esp + 0x164], ebp
mov dword [esp + 0x16c], ebp
mov dword [esp + 0x168], ebp
mov dword [esp + 0x170], eax
mov dword [esp + 0x17c], ebp
mov dword [esp + 0x184], ebp
mov dword [esp + 0x180], ebp
mov dword [esp + 0x188], eax
lea ecx, [esp + 0x1ec]
mov byte [esp + 0x284], 0xe
call fcn.004b6eb8
mov ecx, dword [0x93f294]
mov dword [esp + 0xb0], ecx
mov byte [esp + 0x284], 0x10
mov dword [esp + 0x54], 1

Function at 0x4b9018
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 5
add byte [ebp + 0x6a], dl
add byte [ebp + 0xc4248c], cl
add byte [eax], al
Function at 0x4b9d08
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4e8e68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x74]
push edi
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x14]
dec esp
and al, 0x14

Function at 0x4ba3a0
Capabilities:
Access peb ldr_data

Disassembly:
push edx
push eax
mov dword [esp + 0x70], 0
call fcn.004c91e8
add esp, 0xc
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x18]
call fcn.004b7948
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x38]
push 2
push edx
push eax
mov byte [esp + 0x70], 1
call dword [0x4ec16c]
mov ecx, ebx
call fcn.004b5198
mov ebx, eax
mov eax, edi
cmp eax, ebx
jge 0x4ba40c
push edi
mov ecx, esi
call fcn.004b7a58
push eax
push ebp
mov ecx, esi
call fcn.004b7c18
cmp eax, dword [esp + 0x40]
jg 0x4ba408
inc edi
mov ebp, eax
cmp edi, ebx
jl 0x4ba3e6
mov eax, ebx
jmp 0x4ba412
cmp edi, ebx
jl 0x4ba410
mov eax, ebx
jmp 0x4ba412
mov eax, edi
lea ecx, [eax - 1]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jle 0x4ba423
mov dword [esp + 0x30], eax
jmp 0x4ba42e
cmp edi, ebx
jl 0x4ba429
mov edi, ebx
dec edi
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
call fcn.004b5158
mov ebp, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebp
mov edi, eax
jge 0x4ba475
push edi
mov ecx, esi
call fcn.004b7978
push eax
push ebx
mov ecx, esi
call fcn.004b7d48
cmp eax, dword [esp + 0x44]
jg 0x4ba46d
inc edi
mov ebx, eax
cmp edi, ebp
jl 0x4ba447
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x4ba47f
cmp edi, ebp
jl 0x4ba479
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x4ba47f
mov eax, dword [esp + 0x2c]
mov ecx, edi
dec ecx
cmp eax, ecx
jle 0x4ba488
mov ecx, eax
jmp 0x4ba491
cmp edi, ebp
jl 0x4ba48e
mov edi, ebp
lea ecx, [edi - 1]
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x28]
mov edx, esi
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x14]
call fcn.004b7968
lea ecx, [esp + 0x48]
mov dword [esp + 0x64], 0xffffffff
call 0x50aeaa
mov ecx, dword [esp + 0x5c]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
Function at 0x4bb1c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec esp
and al, 0x2c
push ecx
call dword [0x4ec188]
push eax
lea ecx, [esp + 0x50]
call 0x50b0e0
lea edx, [esp + 0x4c]
push 1
push edx
mov ecx, esi
call 0x50ad1e
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x64]
push eax
push ecx
push esi
call fcn.004b08f8
cmp eax, 1
jne 0x4bb45a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
sub ebx, ebp
sub ecx, eax
cmp edi, 0xa
mov dword [esp + 0x48], ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], ecx
jne 0x4bb25b
push 0xcc0020
push ecx
mov edx, eax
push ebx
push edx
lea eax, [esp + 0x74]
push ebp
push eax
jmp 0x4bb440
cmp edi, 0xd
je 0x4bb320
cmp edi, 0xe
je 0x4bb320
cmp edi, 0xc
Function at 0x4c6858
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x950238]
xor edx, edx
cmp eax, edx
jne 0x4c687e
xor eax, eax
mov byte [eax + 0x950138], al
inc eax
cmp eax, 0x100
jl 0x4c6866
mov dword [0x950238], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x950138
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4c690f
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4c68e2
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4c68b0
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4c6988
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4c69db
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4c69c2
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cc230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop esi
push eax
mov dword [esi + 0x4c], edx
mov dword [esi + 0x7c], ebx
add eax, 2
mov dword [esi + 0x78], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
dec eax
inc ecx
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x40]
inc eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x40], eax
mov dword [esi + 0x64], edx
mov dword [esi + 0x68], ebx
Function at 0x4cc638
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esi + 0x58]
cmp ecx, edx
jl 0x4cc64f
lea ecx, [eax + 1]
mov edx, 0x10
sar edx, cl
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], edx
Function at 0x4d4b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x4d4d21
cmp eax, 8
jg 0x4d4d21
cmp dword [esp + 0x8c], 2
jl 0x4d4d21
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x4d4d21
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x4d4d21
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4d4b87
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x4d4d0a
mov ebp, dword [0x4ec510]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x4d4bb9
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x4d4cf1
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x4d4bd9
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x4ec4f4]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4d4c18
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x4ec4f8]
lea ecx, [esp + 0x28]
push ecx
call dword [0x4ec544]
test eax, eax
jne 0x4d4cd8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.004d4110
cmp eax, 1
jne 0x4d4d02
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.004d49c0
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x4d4bcd
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x4d4d0a
jmp 0x4d4ba4
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.004d3d10
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c
Function at 0x4d72a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x4d7438
cmp ebp, ebx
jle 0x4d7438
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x4d72fe
dec eax
or eax, 0xfffffff8
inc eax
je 0x4d7305
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, 0x80000001
jns 0x4d7314
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x4d731b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call 0x528e62
add esp, 4
cmp eax, ebx
je 0x4d733c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call 0x528e62
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x4d742e
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x4db590
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4db5c3
push esi
call fcn.004de6a0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4db5bc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4db649
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4db632
mov eax, dword [esi + 8]
test eax, eax
je 0x4db5e7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4db62e
cmp eax, 2
je 0x4db632
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4db5da
cmp eax, 3
je 0x4db60d
cmp eax, 1
jne 0x4db5da
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4db5da
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4db5da
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004db670
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4db658
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004db670
add esp, 4
pop esi
ret

Function at 0x4e00bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esi
or byte [ebx], bh
jle 0x4e0099
nop
nop
nop
nop
nop
nop
nop
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e895b
push eax
mov dword fs:[0], esp
sub esp, 0x634
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4e0576
mov eax, dword [ecx]
push edi
call dword [eax + 0x5c]
push 0
lea ecx, [esp + 0xc]
mov edi, eax
call 0x4f1dd0
test edi, edi
mov dword [esp + 0x644], 0
je 0x4e00f8
push edi
lea ecx, [esp + 0x5cc]
call fcn.004e1380
lea ecx, [esp + 8]
call 0x52fa3b
cmp eax, 1
pop edi
je 0x4e0318
lea ecx, [esp + 0x624]
mov dword [esp + 0x640], 0x19
call 0x52d73f
lea ecx, [esp + 0x5c4]
mov byte [esp + 0x640], 0x18
call fcn.004e1260
lea ecx, [esp + 0x588]
mov byte [esp + 0x640], 0x17
call 0x536d5e
lea ecx, [esp + 0x54c]
mov byte [esp + 0x640], 0x16
call 0x536d5e
lea ecx, [esp + 0x510]
mov byte [esp + 0x640], 0x15
call 0x536ab0
lea ecx, [esp + 0x4d4]
mov byte [esp + 0x640], 0x14
call 0x536ab0
invalid
invalid
Function at 0x4e0790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x4e07a3
xor eax, eax
jmp 0x4e0b50
lea ecx, [esp + 0x78]
call fcn.004e11f0
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1430], 0
mov eax, dword [ecx]
call dword [eax + 0x5c]
test eax, eax
je 0x4e07cd
push eax
lea ecx, [esp + 0x7c]
call fcn.004e1380
mov ebx, dword [0x4ec264]
lea ecx, [esp + 0x234]
push 0x1f4
push ecx
push 0x93d2f0
push 0x93d2e8
push 0x93d2e0
call ebx
lea edx, [esp + 0x234]
push 0x9341f8
push edx
call 0x51f69e
add esp, 8
mov dword [esp + 0x20], eax
lea eax, [esp + 0x428]
push 0x1000
push eax
push 0x943b84
push 0
push 0x93d2d8
call ebx
mov ecx, dword [0x93f294]
or eax, 0xffffffff
lea esi, [esp + 0x428]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1430], 1
call 0x52d70c
lea ecx, [esp + 0x50]
mov byte [esp + 0x1430], 2
call 0x52d70c
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1430], 3
call 0x52d70c
mov byte [esp + 0x1430], 4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
je 0x4e096e
lea edx, [esp + 0xd8]
push 0xc8
push edx
push 0x93d2f0
push esi
push 0x93d2d8
call ebx
lea eax, [esp + 0xd8]
push 0x9341f8
push eax
call 0x51f69e
mov edi, eax
add esp, 8
test edi, edi
je 0x4e095b
push 0x9341f8
push 0
call 0x51f69e
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4e095b
push 0x93d2d0
push ebp
call 0x520010
add esp, 8
test eax, eax
je 0x4e095b
mov eax, dword [esp + 0x30]
push esi
push eax
lea ecx, [esp + 0x30]
mov ebx, eax
call 0x52d8e8
mov ecx, dword [esp + 0x58]
push edi
push ecx
lea ecx, [esp + 0x58]
call 0x52d8e8
mov edx, dword [esp + 0x44]
push ebp
push edx
lea ecx, [esp + 0x44]
call 0x52d8e8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4e093b
push eax
push esi
call 0x520010
add esp, 8
test eax, eax
jne 0x4e093b
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0xb4]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4e095b
push eax
push esi
call 0x520010
add esp, 8
test eax, eax
jne 0x4e095b
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x24]
mov ebx, dword [0x4ec264]
lea esi, [esi + eax + 1]
jmp 0x4e087c
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xffffffff
jne 0x4e0984
mov eax, dword [esp + 0x18]
mov ebx, eax
inc ebx
neg ebx
sbb ebx, ebx
and ebx, eax
mov ecx, dword [esp + 0x30]
dec ecx
cmp ebx, ecx
jle 0x4e09ec
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1430], 3
call 0x52d73f
lea ecx, [esp + 0x50]
mov byte [esp + 0x1430], 2
call 0x52d73f
lea ecx, [esp + 0x28]
mov byte [esp + 0x1430], 1
call 0x52d73f
lea ecx, [esp + 0x10]
mov byte [esp + 0x1430], 0
call 0x52e911
lea ecx, [esp + 0x78]
mov dword [esp + 0x1430], 0xffffffff
call fcn.004e1260
xor eax, eax
jmp 0x4e0b50
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
lea eax, [edx + ebx*4]
push eax
call 0x52ea4a
mov edx, dword [esp + 0x10]
xor esi, esi
lea ecx, [esp + 0x14]
push esi
push ecx
push edx
call 0x514f4a
Function at 0x4e5192
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ror dword [ecx + 0x9424b4], 0
add byte [edi + 0x4e], bh
mov edx, dword [edi + 0x1b0]
mov ebx, dword [edx + 0x14]
test ebx, ebx
jne 0x4e51ea
cmp eax, ecx
jne 0x4e51cc
mov ebp, dword [edi + 0x18c]
mov ebx, dword [edi + 0x9c]
add byte [ebx + 0x948f], cl
add byte [ebx], dh
rol byte [ebp - 0x3f6bf013], 3
ret
cmp ecx, eax
ja 0x4e51ea
push edi
call dword [edx]
add esp, 4
test eax, eax
je 0x4e525a
mov eax, dword [edi + 0x90]
mov ecx, dword [edi + 0x98]
cmp eax, ecx
jle 0x4e519c
mov ecx, dword [edi + 0x20]
mov ebp, dword [edi + 0xd8]
xor eax, eax
mov dword [esp + 0x2c], ebp
cmp ecx, eax
mov dword [esp + 0x68], eax
jle 0x4e57a2
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x54], eax
mov eax, 0xffffffbc
lea ebx, [esi + 0x48]
sub eax, esi
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x8c], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret

Function at 0x4e51b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x948f], cl
add byte [ebx], dh
rol byte [ebp - 0x3f6bf013], 3
ret

Function at 0x4e52fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ecx, ecx
mov cx, word [eax + 2]
mov dword [esp + 0x6c], ecx
xor ecx, ecx
mov cx, word [eax + 0x10]
mov dword [esp + 0x7c], ecx
xor ecx, ecx
mov cx, word [eax + 0x20]
mov dword [esp + 0x74], ecx
xor ecx, ecx
mov cx, word [eax + 0x12]
mov dword [esp + 0x84], ecx
xor ecx, ecx
mov cx, word [eax + 4]
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x5c]
add edx, eax
mov eax, dword [edx + ebx]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x90], eax
xor eax, eax
mov dword [esp + 0x44], edx
test ecx, ecx