joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d051e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add eax, 0x4bde10
add byte [eax], al
add byte [eax], al
jle 0x4d0514
jg 0x4d0514
call 0x60494aa3
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004d9ce8
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
jne 0x4d057b
je 0x4d057b
jne 0x4d0506
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
jp 0x4d05e0
dec ebp
invalid
jnp 0x4d05e0
xor eax, 0xff7619e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.004c7bfe
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d05f2
xor eax, eax
jmp 0x4d061a
jo 0x4d05f7
jno 0x4d05f7
call 0x513d4b88
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004d66a8
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004d9ce8
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d18eb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
invalid
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
jb 0x4d1909
jae 0x4d1909
call 0x7b395ed3
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
jb 0x4d1946
jae 0x4d1946
jmp 0x4d18d1
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
int1
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
jo 0x4d19bc
jno 0x4d19bc
jmp 0x4d19a5
call fcn.004d348d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d19cc
jmp 0x4d1a1b
jb 0x4d19d1
jae 0x4d19d1
call 0x53356f62
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004d66a8
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004d9ce8
add esp, 0xc
jo 0x4d19f6
jno 0x4d19f6
jmp 0x4d197a
cmp dword [ebp - 4], 0
jne 0x4d19fe
jmp 0x4d1a1b
jne 0x4d1a03
je 0x4d1a03
jmp 0x4d198f
mov edx, dword [ebp - 4]
push edx
call fcn.004d0bd7
add esp, 4
jo 0x4d1a14
jno 0x4d1a14
jmp 0x4d19a0
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d1a24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0
jb 0x4d1a7e
jae 0x4d1a7e
pop ds
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
in eax, dx
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
jne 0x4d1aeb
je 0x4d1aeb
jmp 0x4d1ad4
call fcn.004d348d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d1b00
xor eax, eax
jmp 0x4d1c67
jbe 0x4d1b05
ja 0x4d1b05
call 0x52356896
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004d66a8
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4d1b32
xor eax, eax
jmp 0x4d1c67
jbe 0x4d1b37
ja 0x4d1b37
call 0x524968c6
mov ecx, dword [ebp - 4]
push ecx
call fcn.004d0bd7
add esp, 4
push 0xd
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004d9ce8
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0xe], 0x79
invalid
inc ebp
Function at 0x4d34a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004d9ce8
add esp, 0xc
jb 0x4d34c0
jae 0x4d34c0
call 0x76407a8a
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x67
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 6], 0x42
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 5], 0
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0xa], 0x4a
mov byte [ebp - 7], 0x70
jb 0x4d3505
jae 0x4d3505
jmp 0x4d3490
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
cmc
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
jo 0x4d358c
jno 0x4d358c
jmp 0x4d3575
call fcn.004d348d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d359c
jmp 0x4d35eb
jb 0x4d35a1
jae 0x4d35a1
call 0x52398332
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004d66a8
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004d9ce8
add esp, 0xc
jo 0x4d35c6
jno 0x4d35c6
jmp 0x4d354a
cmp dword [ebp - 0x18], 0
jne 0x4d35ce
jmp 0x4d35eb
jne 0x4d35d3
je 0x4d35d3
jmp 0x4d355f
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004d0bd7
add esp, 4
jo 0x4d35e4
jno 0x4d35e4
jmp 0x4d3570
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d3e07
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
jo 0x4d3e25
jno 0x4d3e25
call 0x453583ef
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
jne 0x4d3e76
je 0x4d3e76
call 0x81358c04
jmp 0xe89ac680
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
jb 0x4d3f17
jae 0x4d3f17
aaa
call fcn.004d3f7e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d3f29
xor eax, eax
jmp 0x4d3f75
jl 0x4d3f2e
jge 0x4d3f2e
call 0x52358cbf
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004d66a8
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x4d3f58
xor eax, eax
jmp 0x4d3f75
jb 0x4d3f5d
jae 0x4d3f5d
call 0x52318cec
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004d0bd7
add esp, 4
jo 0x4d3f6e
jno 0x4d3f6e
call 0x525594fd
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
Function at 0x4d41c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004d9ce8
add esp, 0xc
jl 0x4d41e4
jge 0x4d41e4
call 0x533187ae
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
Function at 0x4d47f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x17
pop ss
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004d9ce8
add esp, 0xc
jb 0x4d4812
jae 0x4d4812
call 0x7b358ddc
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 6], 0
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 8], 0x4a
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 0x19], 0x54
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 7], 0x45
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x67
mov byte [ebp - 0x15], 0x66
mov byte [ebp - 0x13], 0x45
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x10], 0x62
mov byte [ebp - 9], 0x68
jb 0x4d4873
jae 0x4d4873
jmp 0x4d47fe
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x1a]
sub cl, 1
mov byte [ebp - 0x1a], cl
mov dl, byte [ebp - 0x19]
sub dl, 1
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xa]
dec ebp
in al, 0x80
jmp 0xe49ad119
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
jo 0x4d4937
jno 0x4d4937
jmp 0x4d4920
call fcn.004d348d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d494a
xor ax, ax
jmp 0x4d4998
jb 0x4d494f
jae 0x4d494f
call 0x53319ee0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004d66a8
mov dword [ebp - 0x20], eax
push 0x17
push 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004d9ce8
add esp, 0xc
jo 0x4d4974
jno 0x4d4974
jmp 0x4d48f8
cmp dword [ebp - 0x20], 0
jne 0x4d497f
xor ax, ax
jmp 0x4d4998
jne 0x4d4984
je 0x4d4984
jmp 0x4d4910
mov edx, dword [ebp - 0x20]
push edx
call fcn.004d0bd7
add esp, 4
jo 0x4d4995
jno 0x4d4995
jmp 0x4d4995
call dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d5db1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004d9ce8
add esp, 0xc
jb 0x4d5dd6
jae 0x4d5dd6
call 0x5239a3a0
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004d348d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d5e9e
xor eax, eax
jmp 0x4d5ee9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004d66a8
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004d9ce8
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x4d5ec8
xor eax, eax
jmp 0x4d5ee9
jb 0x4d5ecd
jae 0x4d5ecd
call 0x5135a45c
mov eax, dword [ebp - 0x18]
push eax
call fcn.004d0bd7
add esp, 4
jb 0x4d5ede
jae 0x4d5ede
call 0x5159ac6d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d5fd0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x4bd638
call fcn.004ca80c
add esp, 0xc
mov byte [0x4bd638], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x4d6810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004d9ce8
add esp, 0xc
cmp dword [esp + 4], 0x1730372
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cmp dword [esp + 4], 0x1770376
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
jbe 0x4d68ce
ja 0x4d68ce
ljmp 0x89ff:0xffcbbae8
call fcn.004d348d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d68e0
xor eax, eax
jmp 0x4d6908
jns 0x4d68e5
js 0x4d68e5
or dword [ebp - 0x74af0fbb], 0xe851fc4d
mov dh, 0xfd
invalid
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004d66a8
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004d9ce8
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d7c71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4d7c85
jmp 0x4d7daf
jne 0x4d7c8a
je 0x4d7c8a
call 0x8955c219
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x4bdb54], edx
jb 0x4d7ca0
jae 0x4d7ca0
adc cl, byte [ebx + 0x488bec45]
add al, 0x89
or eax, 0x4bd4e4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x4bd4e4], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x4bd4e0], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x4bd630], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x4bd634], ecx
jbe 0x4d7cd4
ja 0x4d7cd4
mov dl, 0xc6
inc ebp
invalid
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jne 0x4d7d0d
je 0x4d7d0d
call 0x813dd29b
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jl 0x4d7d7a
jge 0x4d7d7a
call 0xd52dbb01
dec ebx
add byte [eax], al
cmp dword [0x4bd4e0], 0
je 0x4d7d97
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x4bd4e0]
push eax
call fcn.004d66a8
mov dword [0x4bdb50], eax
cmp dword [esp + 8], 0x1740375
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004d9ce8
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d9138
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [eax + 8], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edx
push 0x40
push 0
lea ecx, [ebp - 0x50]
push ecx
call fcn.004ca80c
add esp, 0xc
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xb
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004d9ce8
add esp, 0xc
jb 0x4d9156
jae 0x4d9156
call 0x4939d720
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x6a
mov byte [ebp - 0x11], 0x57
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6f
jb 0x4d9187
jae 0x4d9187
jmp 0x4d9112
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
sub cl, 1
mov byte [ebp - 0xe], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
jo 0x4d91e3
hlt
jno 0x4d91e3
jmp 0x4d91cc
call fcn.004d348d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d91f5
xor eax, eax
jmp 0x4d9242
jb 0x4d91fa
jae 0x4d91fa
call 0x5339e78b
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004d66a8
mov dword [ebp - 4], eax
push 0xb
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.004d9ce8
add esp, 0xc
jo 0x4d921f
jno 0x4d921f
jmp 0x4d91a3
cmp dword [ebp - 4], 0
jne 0x4d9229
xor eax, eax
jmp 0x4d9242
jne 0x4d922e
je 0x4d922e
jmp 0x4d91ba
mov edx, dword [ebp - 4]
push edx
call fcn.004d0bd7
add esp, 4
jo 0x4d923f
jno 0x4d923f
jmp 0x4d923f
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret