joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a61
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4131c4], 0
jne 0x402a6f
call fcn.00402a37
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402a9c
test cl, 7
je 0x402a9c
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
dec esi
inc ecx
jmp 0x402a7d
cmp esi, 8
jb 0x402b20
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4131c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4131c0]
dec edi
jne 0x402aa6
xor edx, edx
test esi, esi
jbe 0x402b40
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4131c0]
inc edx
cmp edx, esi
jb 0x402b27
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x460ad7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00473db6
add esp, 0xc
xor esp, 0
jno 0x460af5
js 0x460af7
jb 0x460b03
jl 0x460afb
nop
jnp 0x460afe
xchg esp, esp
jae 0x460b03
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
jno 0x460b39
xor edx, eax
xor edx, eax
jnp 0x460b3f
je 0x460b6a
pushf
call fcn.00460b48
Function at 0x461212
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00473db6
add esp, 0xc
js 0x46122d
cmp esp, 0x4219
push eax
pop eax
je 0x461237
je 0x46124e
pushf
or ebx, ebx
mov edx, edx
ror edi, 0x14
rol edi, 0x14
popf
ja 0x461249
je 0x46124b
jne 0x46124e
lcall 0x45c6, 0x48e045c6
in eax, 0x65
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
lea esp, [esp]
dec edx
inc edx
xchg ecx, edx
xchg ecx, edx
ror edx, 0
je 0x4612b3
js 0x4612aa
lea ebx, [ebx]
xchg esp, esp
jns 0x4612b0
jne 0x4612b3
mov esi, 0x80e04d8a
jmp 0xe0939abd
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
stc
ja 0x461357
xchg edx, edx
jbe 0x461357
mov esp, 0x1136ae8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.004726c6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46136c
xor eax, eax
jmp 0x461603
nop
and edx, edx
lea esi, [esi]
jmp 0x461373
jp 0x46137b
jno 0x461377
jnp 0x46137b
mov esi, 0xe04d8d35
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0047260c
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00473db6
add esp, 0xc
push esi
add esi, 0xd3
ror esi, 0x12
pop esi
jle 0x4613c3
pushf
lea eax, [eax + 0x652e]
sub eax, 0x652e
shr esp, 0
popf
xchg esp, esp
jg 0x4613be
ja 0x4613c0
jg 0x4613c3
mov edx, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x4613d0
xor eax, eax
jmp 0x461603
call fcn.004613d5
Function at 0x4620d5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00473db6
add esp, 0xc
jne 0x4620f7
xchg edi, edi
jle 0x462111
pushf
sub ebx, 0
neg eax
neg eax
test edi, 0xeec
popf
jge 0x46210e
jg 0x462111
xor eax, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004726c6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4621d9
xor eax, eax
jmp 0x462238
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047260c
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00473db6
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x462203
xor eax, eax
jmp 0x462238
lea esi, [esi]
ja 0x462207
mov ebx, ebx
jbe 0x462215
nop
jb 0x46220e
jbe 0x462210
ja 0x462215
xor eax, 0x458be596
call 0x15c80a6c
add byte [eax], al
mov eax, dword [ebp - 0x18]
push eax
call fcn.0046379f
add esp, 4
jl 0x462223
jnp 0x46222d
jne 0x462227
ja 0x462229
jp 0x46222d
call 0xc93ae08
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x466fd9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00473db6
add esp, 0xc
lea ebx, [ebx]
not ecx
not ecx
add edi, dword [esp]
sub edi, dword [esp]
neg eax
neg eax
jns 0x46701c
pushf
jno 0x46700f
test ebx, esi
popf
xchg ebx, eax
xchg ebx, eax
mov esp, esp
jnp 0x467019
js 0x46701c
mov eax, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
jl 0x46704e
test edi, 0x3b55
jne 0x467063
pushf
push esi
pop esi
popf
jnp 0x46705e
jge 0x467060
je 0x467063
mov esi, 0x80f04d8a
jmp 0xf093f86d
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
test esi, 0x1ac1
jo 0x4670e7
pushf
rol esi, 0
cmp esp, 0x201d
popf
lea ebx, [ebx + 0x35b0]
lea ebx, [ebx - 0x35b0]
jno 0x4670e7
add eax, 0x1611e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.004686fd
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4670f9
xor eax, eax
jmp 0x467134
xchg ebx, ebx
test dword [esp + 4], edx
xchg ebx, ebx
cmp esi, 0x3ce6
jne 0x467111
jns 0x46710b
jnp 0x46710d
je 0x467111
mov esp, 0xf0458ddc
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047260c
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00473db6
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46757d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00473db6
add esp, 0xc
and ecx, ecx
test eax, edi
jl 0x4675af
jb 0x46759e
lea edx, [edx + 0x656b]
lea edx, [edx - 0x656b]
jle 0x4675ac
jge 0x4675af
mov ebp, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
jle 0x4675e1
xor eax, 0x5b5f
xor eax, 0x5b5f
jb 0x4675fe
pushf
neg edx
neg edx
neg edi
neg edi
popf
ja 0x4675fb
jae 0x4675fe
xor eax, 0x80f04d8a
jmp 0xf093fe08
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
xchg edx, edx
shr esp, 0
jo 0x467671
nop
js 0x467668
lea ebx, [ebx]
jno 0x46766c
jno 0x467671
xor eax, 0x50e82c71
mov al, 0
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.004726c6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x467683
xor eax, eax
jmp 0x4676bb
test esp, 0x68c8
jb 0x467698
pushf
jb 0x46768f
popf
lea edi, [edi]
jmp 0x467695
jae 0x467698
mov ebx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047260c
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00473db6
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fb46
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00473db6
add esp, 0xc
not ecx
not ecx
mov esi, esi
js 0x46fb73
pushf
cmc
popf
xchg esi, esi
xchg ecx, ecx
jns 0x46fb73
mov edi, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
and ebx, 0xffffffff
jne 0x46fbbd
pushf
shr ebx, 0
popf
jmp 0x46fbb9
nop
je 0x46fbbd
mov ebx, 0x80f44d8a
jmp 0xf49483c7
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
sub esp, 0
jl 0x46fc42
pushf
sub esp, 0
popf
jae 0x46fc3c
jnp 0x46fc3e
nop
jge 0x46fc42
mov ebx, 0x2a7fe8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.004726c6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46fc55
jmp 0x46fcec
add ebx, 0
jb 0x46fc69
pushf
jl 0x46fc5e
and ebx, 0xffffffff
popf
nop
jnp 0x46fc66
jae 0x46fc69
sub eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0047260c
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00473db6
add esp, 0xc
test edi, ebx
jne 0x46fca6
pushf
xor edx, dword [esp]
xor edx, dword [esp]
ror esi, 0
and esp, 0xffffffff
popf
xchg edi, edi
jns 0x46fca1
jle 0x46fca3
je 0x46fca6
xor eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x46fcae
jmp 0x46fcec
mov edi, edi
lea ecx, [ecx + 0x2fe0]
sub ecx, 0x2fe0
jb 0x46fcc7
xchg esi, edi
xchg esi, edi
jmp 0x46fcc4
jae 0x46fcc7
xor eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0046379f
add esp, 4
nop
rol esi, 0x1f
rol esi, 1
jge 0x46fce5
lea ecx, [ecx]
mov esp, esp
js 0x46fce1
jl 0x46fce5
call 0x88c88aa
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4718de
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x45b1ac
call fcn.004762e5
add esp, 0xc
mov byte [0x45b1ac], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x472a6f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00473db6
add esp, 0xc
lea edx, [edx]
test eax, ebx
jb 0x472a9d
pushf
je 0x472a92
popf
jp 0x472a96
jns 0x472a98
mov edx, edx
jae 0x472a9d
mov ecx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
ja 0x472acf
and esp, 0xffffffff
not ecx
not ecx
or esi, 0
je 0x472aed
lea ebx, [ebx + 0x680e]
lea ebx, [ebx - 0x680e]
xchg esp, esp
jne 0x472aed
mov esp, 0xec4d8abb
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004726c6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x472b62
xor eax, eax
jmp 0x472c12
cmp ecx, dword [esp]
cld
shr edi, 0
nop
jl 0x472b87
pushf
lea edi, [edi + 0x37b0]
sub edi, 0x37b0
ror eax, 0x1d
ror eax, 3
popf
jg 0x472b84
jge 0x472b87
add eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0047260c
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00473db6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x472bb1
xor eax, eax
jmp 0x472c12
ror edx, 0
jne 0x472bb6
or esi, 0
add edx, dword [esp]
sub edx, dword [esp]
je 0x472bd9
pushf
or eax, 0
popf
jl 0x472bca
lea ebx, [ebx + 0x6cba]
lea ebx, [ebx - 0x6cba]
jne 0x472bd9
mov eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0046379f
add esp, 4
stc
lea esi, [esi + 0x69d2]
lea esi, [esi - 0x69d2]
jo 0x472c0b
pushf
cmp esp, 0x4747
rol ecx, 4
ror ecx, 4
popf
jnp 0x472c06
mov edi, edi
jno 0x472c0b
mov ebp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x476314
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x476328
jmp 0x4764aa
shl esp, 0
or esi, 0
je 0x476330
jg 0x476332
jae 0x476343
pushf
xchg ebx, eax
xchg ebx, eax
jbe 0x47633a
popf
jg 0x47633e
jne 0x476340
jb 0x476343
mov esp, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x45afcc], edx
jge 0x476356
cmc
jns 0x47635e
jnp 0x47635b
js 0x47635e
mov edi, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x45afdc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x45afdc], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x45afd8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x459a9c], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x459aa0], ecx
call 0x476392
add esp, 4
jns 0x4763a3
pushf
nop
popf
jne 0x47639e
xchg edx, edx
js 0x4763a3
sub eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
ror esp, 0
rol esp, 0
jmp 0x4763df
and edi, 0xffffffff
js 0x4763fa
pushf
xor esp, 0
shr edi, 0
test eax, ebx
jg 0x4763f0
popf
jbe 0x4763f4
jg 0x4763f6
nop
jns 0x4763fa
call 0x8137b988
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
nop
cmc
and esi, 0xffffffff
jle 0x47646e
jae 0x47646b
jg 0x47646e
lcall 0x45, 0xafd83d83
add byte [esp + edx - 0x73], dh
push ebp
invalid
cmp dword [0x45afd8], 0
je 0x47648b
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x45afd8]
push eax
call fcn.0047260c
mov dword [0x45afc8], eax
and esp, 0xffffffff
add ecx, 0
xchg esp, esp
jg 0x47649a
mov edx, edx
jle 0x47649a
sub eax, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00473db6
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47d867
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x45b1f8], 1
jne 0x47d9d7
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00473db6
add esp, 0xc
xchg esi, esi
xor ebx, dword [esp]
xor ebx, dword [esp]
lea ebx, [ebx + 0x3737]
lea ebx, [ebx - 0x3737]
xchg ecx, ecx
jbe 0x47d8b1
jno 0x47d8a7
jae 0x47d8a9
jge 0x47d8ab
xchg esp, esp
ja 0x47d8b1
mov esi, 0xe845c6f9
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
dec ebx
inc ebx
je 0x47d8f2
pushf
test edx, edi
ror eax, 0
popf
nop
jne 0x47d8f2
mov edx, 0x80e84d8a
jmp 0xe89560fc
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.004726c6
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47d967
xor eax, eax
jmp 0x47da33
nop
stc
call fcn.0047d96e
mov ecx, dword [0x45b1f8]
mov dword [ebp - 8], ecx