joyce8/EMBER2024-capa huggingface dataset:
Function at 0x204750bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
cmc
ror edi, 0
jb 0x204750ee
lea esi, [esi + 0x2224]
lea esi, [esi - 0x2224]
mov ebx, ebx
jae 0x204750ee
add eax, 0x45c65e8a
call 0xd8d1739
push esp
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
jmp 0x2047513c
jl 0x20475153
pushf
stc
xchg ebx, eax
xchg ebx, eax
ror ebx, 0x17
ror ebx, 9
and edi, 0xffffffff
popf
jmp 0x20475150
jge 0x20475153
sub eax, 0x80e84d8a
jmp 0x894d95d
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
jno 0x204751f1
cld
jb 0x204751f4
jge 0x20475216
lea ebx, [ebx + 0x2497]
lea ebx, [ebx - 0x2497]
lea edx, [edx + 0x7e6d]
lea edx, [edx - 0x7e6d]
jbe 0x20475210
jg 0x20475212
jl 0x20475216
mov esi, 0x854ae8d5
invalid
call 0x2046d765
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2047522b
xor eax, eax
jmp 0x204752cf
cmp edi, dword [esp + 0xc]
xchg esp, esp
jne 0x20475233
test dword [esp + 8], edx
jle 0x20475243
jno 0x2047523b
jb 0x2047523d
lea esp, [esp]
jg 0x20475243
or dword [ebp - 0x74ae17b3], 0xe852fc55
pushal
add byte [eax], 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.2047d2b0
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x2047526d
xor eax, eax
jmp 0x204752cf
test edx, 0x4e4d
call fcn.20475278
Function at 0x2047a67b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
stc
xor eax, dword [esp + 8]
xor eax, dword [esp + 8]
jge 0x2047a69f
sub ecx, 0
jg 0x2047a6b5
pushf
mov esp, esp
ror ecx, 1
rol ecx, 1
popf
jb 0x2047a6b0
jne 0x2047a6b2
jle 0x2047a6b5
mov eax, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
xor esi, dword [esp]
xor esi, dword [esp]
cmp ebx, 0x1635
jae 0x2047a718
pushf
not ecx
not ecx
add edx, 0x4023
sub edx, 0x4023
popf
mov esp, esp
xchg edx, esi
xchg edx, esi
jb 0x2047a718
jmp 0xa12ff4a6
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.2048492c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x2047a79b
xor eax, eax
jmp 0x2047a813
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.2047d2b0
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.20480c68
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x2047a811
jne 0x2047a7c3
not ebx
not ebx
xor esp, 0
jae 0x2047a7d5
jnp 0x2047a7ce
xchg ebx, edx
xchg ebx, edx
jb 0x2047a7d5
or dword [ebx - 0x17ad03ab], 0xfffeaed4
mov edx, dword [ebp - 4]
push edx
call fcn.204656b2
add esp, 4
xor esp, 0
rol edx, 0
std
cld
nop
jae 0x2047a7fc
pushf
rol ebx, 0
jle 0x2047a7f3
jb 0x2047a7f5
popf
lea ebx, [ebx]
jb 0x2047a7fc
ljmp 0x4d8b:0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x2047a813
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2047cb42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x20460444], 1
jne 0x2047ccb0
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
lea edi, [edi + 0x1578]
sub edi, 0x1578
or edx, 0
jp 0x2047cb79
jae 0x2047cb86
je 0x2047cb7d
mov esi, esi
nop
ja 0x2047cb82
jb 0x2047cb86
xor eax, 0xe845c669
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
stc
rol ecx, 0x14
rol ecx, 0xc
xor esp, 0
jle 0x2047cbcf
pushf
jle 0x2047cbc6
mov esp, esp
popf
js 0x2047cbcc
jg 0x2047cbcf
lcall 0x1e9, 0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.2046af52
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x2047cc44
xor eax, eax
jmp 0x2047cd15
jge 0x2047cc46
js 0x2047cc52
jb 0x2047cc4a
mov esi, esi
jle 0x2047cc4e
jns 0x2047cc52
sub eax, 0xe8458d7a
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.2047d2b0
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.20480c68
add esp, 0xc
add esi, 0
cmp ecx, dword [esp + 8]
and edi, 0xffffffff
cmp ecx, 0x4b0a
jg 0x2047cc9a
pushf
or eax, 0
or edi, edi
xchg esi, esi
jo 0x2047cc8f
popf
jae 0x2047cc93
jle 0x2047cc95
jl 0x2047cc97
jle 0x2047cc9a
add eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0x2047ccaa
mov eax, dword [ebp - 8]
mov dword [0x20460444], eax
jmp 0x2047ccae
xor eax, eax
jmp 0x2047cd15
jmp 0x2047ccb9
mov ecx, dword [0x20460444]
mov dword [ebp - 8], ecx
call 0x2047ccbe
add esp, 4
jno 0x2047ccd3
pushf
and eax, eax
clc
popf
jle 0x2047cccc
ja 0x2047ccce
jp 0x2047ccd0
jo 0x2047ccd3
ljmp 0xfc55:0x89f8558b
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
inc ebx
dec ebx
test eax, 0x17d7
cmc
jno 0x2047ccfe
pushf
rol ebx, 0x12
ror ebx, 0x12
jns 0x2047cced
test esi, 0x387a
ror esp, 0
popf
nop
jnp 0x2047ccfb
jo 0x2047ccfe
lcall 0xabe8, 0x50fc458b
mov esi, edi
inc dword [ebx + 0x4d8b04c4]
or al, 0x51
mov eax, dword [ebp - 4]
push eax
call fcn.204656b2
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2047e37e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.20480c68
add esp, 0xc
cmp edi, 0x43b4
jns 0x2047e3a6
js 0x2047e3b6
pushf
xor ecx, 0
popf
jae 0x2047e3b1
jge 0x2047e3b3
jns 0x2047e3b6
mov ecx, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.2046af52
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2047e47e
xor eax, eax
jmp 0x2047e4fc
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2047d2b0
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.20480c68
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x2047e4a8
xor eax, eax
jmp 0x2047e4fc
jae 0x2047e4aa
xchg ecx, ecx
sub esp, 0
xchg edx, edx
jnp 0x2047e4c2
lea ecx, [ecx + 0x1d95]
lea ecx, [ecx - 0x1d95]
jp 0x2047e4c2
mov eax, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.204656b2
add esp, 4
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
sub ebx, 0
xor edi, 0x444b
xor edi, 0x444b
shr esp, 0
jp 0x2047e4f1
jb 0x2047e4ec
ja 0x2047e4ee
jnp 0x2047e4f1
add eax, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x204817d5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
call fcn.204817f3
Function at 0x20484a89
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.20480c68
add esp, 0xc
rol edi, 0
jp 0x20484ab3
jae 0x20484aa9
jp 0x20484aab
js 0x20484aad
lea esi, [esi]
jnp 0x20484ab3
xor eax, 0xec45c6a6
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
jl 0x20484ae5
mov esp, esp
jns 0x20484ae9
lea ebx, [ebx]
jge 0x20484afb
pushf
add edx, 0
popf
js 0x20484af6
jae 0x20484af8
jl 0x20484afb
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
jns 0x20484b5d
xchg ebx, eax
xchg ebx, eax
stc
jmp 0x20484b62
ja 0x20484b74
pushf
nop
neg edi
neg edi
popf
lea ebx, [ebx]
jns 0x20484b71
jbe 0x20484b74
add eax, 0xfe63d9e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.2046af52
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20484b89
xor eax, eax
jmp 0x20484c33
jae 0x20484b8b
cmc
jp 0x20484b99
jae 0x20484b90
je 0x20484b92
jae 0x20484b94
jp 0x20484b96
jnp 0x20484b99
mov ebp, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.2047d2b0
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.20480c68
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x20484c1b
or ebx, ebx
rol ecx, 0
cmp ecx, 0x7e41
jg 0x20484bf2
pushf
call fcn.20484bd3
cmp eax, ebx
ja 0x20484c31
jge 0x20484c21
lea ecx, [ecx + 0x6318]
lea ecx, [ecx - 0x6318]
jbe 0x20484c31
sbb dword [edi], 0x5e5fc033
xor eax, eax
Function at 0x20485c4a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.20480c68
add esp, 0xc
test esp, 0x5521
add edx, dword [esp]
sub edx, dword [esp]
jp 0x20485c79
je 0x20485c73
lea esi, [esi]
jnp 0x20485c79
mov esp, 0xec45c67f
push ebx
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
lea edi, [edi + 0x27aa]
sub edi, 0x27aa
lea edi, [edi]
jp 0x20485cd7
pushf
add edx, 0
jge 0x20485ccc
popf
jmp 0x20485cd0
xchg ebx, ebx
jno 0x20485cd4
jnp 0x20485cd7
jmp 0xa134aa65
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.2046af52
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20485d61
jmp 0x20485dd8
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.2047d2b0
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.20480c68
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x20485dd8
add edi, dword [esp]
sub edi, dword [esp]
jg 0x20485d94
xchg esp, esp
jle 0x20485d94
mov edi, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.204656b2
add esp, 4
rol esi, 0
shl esp, 0
jg 0x20485dc5
pushf
sub eax, 0
cmp ebx, dword [esp]
lea ecx, [ecx + 0x469f]
lea ecx, [ecx - 0x469f]
popf
jge 0x20485dc0
jle 0x20485dc2
jle 0x20485dc5
mov edx, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2048657a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.20480c68
add esp, 0xc
and esp, 0xffffffff
add edi, 0
push ebx
add ebx, 0x25cc
ror ebx, 2
pop ebx
jl 0x204865b1
lea edi, [edi]
jno 0x204865aa
jb 0x204865ac
lea edi, [edi]
jge 0x204865b1
mov edx, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x4c
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x42
mov byte [ebp - 0xf], 0
and eax, 0xffffffff
nop
rol eax, 6
ror eax, 6
js 0x20486600
je 0x204865f7
jg 0x204865f9
jl 0x204865fb
jns 0x20486600
lcall 0x80e4, 0x4d8a0c92
jmp 0x495ee0a
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x1a]
sub cl, 1
mov byte [ebp - 0x1a], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
not ecx
not ecx
jb 0x20486689
lea edi, [edi + 0x1c45]
lea edi, [edi - 0x1c45]
jne 0x20486685
jae 0x20486689
xor eax, 0x70d7e81a
invalid
call 0x2046d765
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x204866a1
mov eax, 1
jmp 0x2048692b
add eax, 0
and esp, 0xffffffff
nop
jo 0x204866c3
lea edx, [edx + 0x2ae6]
lea edx, [edx - 0x2ae6]
mov ecx, ecx
xchg edi, ebx
xchg edi, ebx
xchg ebx, esi
xchg ebx, esi
jno 0x204866c3
mov esi, 0x52e4558d
lea edx, [ebp - 0x1c]
push edx
Function at 0x20486fa9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.20480c68
add esp, 0xc
rol esp, 0
add edi, dword [esp]
sub edi, dword [esp]
jl 0x20486fe9
pushf
lea edi, [edi + 0x277b]
lea edi, [edi - 0x277b]
popf
je 0x20486fe6
jge 0x20486fe9
mov edx, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
add ebx, 0
stc
js 0x204870a9
pushf
xor ebx, ecx
xor ebx, ecx
popf
jns 0x204870a2
xchg esp, esp
lea ebx, [ebx]
jns 0x204870a9
jmp 0x1e871595
call fcn.2046af52
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x204870be
xor eax, eax
jmp 0x20487149
sub esi, 0
jbe 0x204870ce
jmp 0x204870c5
xchg esp, esp
jle 0x204870c9
jne 0x204870cb
ja 0x204870ce
jmp 0x7330c65f
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.2047d2b0
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.20480c68
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x204870f8
xor eax, eax
jmp 0x20487149
add esi, dword [esp]
sub esi, dword [esp]
push edx
add edx, 0x201d
ror edx, 1
pop edx
dec edi
inc edi
jo 0x20487112
jge 0x2048710e
jno 0x20487112
mov edi, 0xfc558ba1
mov edx, dword [ebp - 4]
push edx
call fcn.204656b2
add esp, 4
xchg esi, edx
xchg esi, edx
shl esp, 0
jne 0x2048713e
pushf
jg 0x2048712b
popf
lea ebx, [ebx + 0x688]
lea ebx, [ebx - 0x688]
mov ebx, ebx
je 0x2048713e
sub eax, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2048a8d0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret