joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6620a750
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x34], 0
jmp 0x6620a793
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
cmp dword [ebp - 0x34], 4
jae 0x6620a7be
cmp dword [ebp + 0x10], 0
jbe 0x6620a7be
mov ecx, dword [ebp - 8]
add ecx, 8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov dword [ebp + edx*8 - 0x30], ecx
mov eax, dword [eax - 4]
mov dword [ebp + edx*8 - 0x2c], eax
jmp 0x6620a781
mov ecx, dword [ebp - 8]
add ecx, 8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 8
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
and eax, 1
je 0x6620a7e1
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 4], esp
and esp, 0xfffffff0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x6620a807
mov edi, dword [ebp - 0xc]
lea edi, [edi + eax*8 - 8]
push dword [edi + 4]
push dword [edi]
sub edi, 8
dec eax
jne 0x6620a7fc
mov eax, 4
lea edi, [ebp - 0x18]
push dword [edi + 4]
push dword [edi]
sub edi, 8
dec eax
jne 0x6620a80f
xor ecx, ecx
xor edx, edx
lea esi, [ebp + 8]
push 0x33
call fcn.6620a828

Function at 0x6620a870
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
xor eax, eax
xor edx, edx
push 0x33
call fcn.6620a882

Function at 0x6620ae10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov bl, byte [eax]
push esi
cmp bl, 0xd8
je 0x6620ae41
cmp bl, 0xd7
je 0x6620ae41
mov esi, dword [esp + 0x14]
lea ecx, [eax + 1]
test esi, esi
jbe 0x6620ae69
mov eax, dword [esp + 0x10]
sub ecx, eax
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
sub esi, 1
jne 0x6620ae33
pop esi
pop ebx
ret
mov esi, dword [esp + 0x10]
push esi
inc eax
push eax
call fcn.6620af20
cmp bl, 0xd8
jne 0x6620ae69
mov ecx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
jbe 0x6620ae69
lea esp, [esp]
xor byte [eax + esi], 0xf0
inc eax
cmp eax, ecx
jb 0x6620ae60
pop esi
pop ebx
ret

Function at 0x6620ed9b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6621cd88]
jne 0x6620eda5
repz ret
jmp fcn.66212fb7
Function at 0x66214e18
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.6620cf26
and dword [ebp - 4], 0
cmp dword [0x6621e778], 0
mov ebx, eax
jne 0x66214ec9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x66214f7a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x66214f7a
push eax
call fcn.6620ceb4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6621e778], eax
call esi
push eax
call fcn.6620ceb4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6621e77c], eax
call esi
push eax
call fcn.6620ceb4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x6621e780], eax
call esi
push eax
call fcn.6620ceb4
pop ecx
mov dword [0x6621e788], eax
test eax, eax
je 0x66214ec9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.6620ceb4
pop ecx
mov dword [0x6621e784], eax
mov eax, dword [0x6621e784]
cmp eax, ebx
je 0x66214f21
cmp dword [0x6621e788], ebx
je 0x66214f21
push eax
call fcn.6620cf2f
push dword [0x6621e788]
mov esi, eax
call fcn.6620cf2f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x66214f21
test edi, edi
je 0x66214f21
call esi
test eax, eax
je 0x66214f18
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x66214f18
test byte [ebp - 0xc], 1
jne 0x66214f21
or dword [ebp + 0x10], 0x200000
jmp 0x66214f5a
mov eax, dword [0x6621e77c]
cmp eax, ebx
je 0x66214f5a
push eax
call fcn.6620cf2f
pop ecx
test eax, eax
je 0x66214f5a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x66214f5a
mov eax, dword [0x6621e780]
cmp eax, ebx
je 0x66214f5a
push eax
call fcn.6620cf2f
pop ecx
test eax, eax
je 0x66214f5a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6621e778]
call fcn.6620cf2f
pop ecx
test eax, eax
je 0x66214f7a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x66214f7c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c1000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4bdb50], 1
je 0x4c1021
jb 0x4c1017
jae 0x4c1017
push cs
mov eax, dword [0x4bdb50]
mov dword [ebp - 4], eax
jmp 0x4c102d
jb 0x4c1026
jae 0x4c1026
adc esi, dword [ebx]
shr cl, 0x2a
add dword [eax], eax
add byte [edx + 3], dh
xor eax, eax
jmp 0x4c1157
jb 0x4c1032
jae 0x4c1032
pop ss
mov ecx, dword [ebp - 4]
push ecx
call fcn.004d0bd7
add esp, 4
push 0xd
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004d9ce8
add esp, 0xc
jb 0x4c1053
jae 0x4c1053
call 0x4e34561d
mov byte [ebp - 0x18], 0x4d
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x7a
mov byte [ebp - 0x17], 0x70
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x16], 0x62
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x10], 0x62
mov byte [ebp - 0x14], 0x4d
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 0xc], 0
jb 0x4c108c
jae 0x4c108c
sub dword [edx + 0x12ce845], ecx
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
jb 0x4c10f9
jae 0x4c10f9
cmp dword ss:[0x4bd4e0], 0
cmp dword [0x4bd4e0], 0
je 0x4c111a
jb 0x4c1107
jae 0x4c1107
cmp dword [ebp - 0x74af17bb], ecx
or eax, 0x4bd4e0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x4bd4e0]
push ecx
call fcn.004d66a8
mov dword [ebp - 8], eax
jne 0x4c111f
je 0x4c111f
jnp 0x4c118a
push 0xd
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004d9ce8
or eax, 0x558d006a
call 0x8c08f97c
add dword [eax], eax
add esp, 0xc
jb 0x4c1134
jae 0x4c1134
add al, 0x83
jge 0x4c112f
cmp dword [ebp - 8], 0
je 0x4c114b
add byte [ecx + edx + 0x72], dh
add esi, dword [ebx + 1]
jb 0x4c113f
jae 0x4c113f
or byte [ebx - 0x17af07bb], cl
invalid
mov eax, dword [ebp - 8]
push eax
call fcn.004d0bd7
add esp, 4
jb 0x4c1150
jae 0x4c1150
or al, 0x8b
dec ebp
or byte [ecx - 1], dl
push ebp
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
dec ebp
or byte [ecx + 0xcebfc4d], cl
Function at 0x4c2437
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0
jb 0x4c244c
jae 0x4c244c
call 0xb636ba
push 0x12
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.004d9ce8
add esp, 0xc
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x74
mov byte [ebp - 0x1e], 0x45
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x63
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x68
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x51
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xf], 0
jns 0x4c24a9
js 0x4c24a9
call 0x812c7237
jmp 0xe099acb3
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x1d]
sub al, 1
mov byte [ebp - 0x1d], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x1c]
sub al, 1
mov byte [ebp - 0x1c], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
jl 0x4c2542
jge 0x4c2542
call 0x4c22a9e7
add byte [ecx + 0x37ef445], cl
mov eax, dword [0x4bd684]
mov dword [ebp - 0xc], eax
jle 0x4c254f
jg 0x4c254f
call 0x140a2d6
cmp dword [ebp - 0xc], 0
je 0x4c258b
jb 0x4c255a
jae 0x4c255a
call 0xe80c32e9
dec ebx
add byte [ecx + 0x37cdc4d], cl
mov ecx, dword [0x4be7c0]
mov dword [ebp - 0x24], ecx
jl 0x4c2568
jge 0x4c2568
call 0x532c7af9
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [ebp - 0x24]
mov dword [ebp - 8], eax
jle 0x4c257b
jg 0x4c257b
push 0x51e04d8d
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004d66a8
mov dword [ebp - 4], eax
jl 0x4c2590
jge 0x4c2590
call 0xb637fe
push 0x12
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.004d9ce8
add esp, 0xc
jns 0x4c25a5
js 0x4c25a5
call 0x3c487334
dec ebp
clc
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
je 0x4c25b9
jb 0x4c25b2
jae 0x4c25b2
pop eax
mov eax, 0xd
jmp 0x4c25c3
jl 0x4c25be
jge 0x4c25be
call fcn.004c4d7a
add byte [edi + 0x5e], bl
mov eax, 0x27
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c6860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
jb 0x4c6885
jae 0x4c6885
call 0x5234ae4f
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jb 0x4c6933
jae 0x4c6933
call 0x117bf1f
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 4], dh
call fcn.004d348d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c6945
xor eax, eax
jmp 0x4c6995
jb 0x4c694a
jae 0x4c694a
call 0x5334bedb
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004d66a8
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004d9ce8
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4c6974
xor eax, eax
jmp 0x4c6995
jb 0x4c6979
jae 0x4c6979
call 0x5348bf08
mov edx, dword [ebp - 4]
push edx
call fcn.004d0bd7
add esp, 4
jb 0x4c698a
jae 0x4c698a
mov eax, dword [ebp + 0xc]
push eax
Function at 0x4c918a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004d9ce8
add esp, 0xc
cmp dword [esp + 8], 0x1740375
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jb 0x4c91e0
jae 0x4c91e0
and eax, 0x80ec4d8a
jmp 0xec9a19ea
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004d348d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c9252
xor eax, eax
jmp 0x4c92a1
cmp dword [esp + 4], 0x1770376
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004d66a8
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004d9ce8
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4c9284
xor eax, eax
jmp 0x4c92a1
jb 0x4c9289
jae 0x4c9289
add al, 0x8b
inc ebp
cld
mov eax, dword [ebp - 4]
push eax
call fcn.004d0bd7
add esp, 4
jne 0x4c929a
je 0x4c929a
jmp 0x4c9226
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4caaec
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
jb 0x4cab08
jae 0x4cab08
call 0x149288f
cmp dword [ebp - 4], 0
je 0x4cab1d
cmp dword [esp + 4], 0x1770376
cmp dword [esp + 4], 0x1730372
mov eax, 0x14

Function at 0x4cab31
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.004d9ce8
add esp, 0xc
jne 0x4cab4f
je 0x4cab4f
call 0x542cf119
Function at 0x4cc4d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
jle 0x4cc4f4
jg 0x4cc4f4
call 0x49350abe
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
jbe 0x4cc541
ja 0x4cc541
call 0x813512cf
jmp 0xe89a4d4b
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.004d348d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4cc5e7
xor eax, eax
jmp 0x4cc637
jbe 0x4cc5ec
ja 0x4cc5ec
call 0x51350b7d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004d66a8
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004d9ce8
add esp, 0xc
jns 0x4cc611
js 0x4cc611
call 0x1314398
cmp dword [ebp - 0x1c], 0
jne 0x4cc61b
xor eax, eax
jmp 0x4cc637
cmp dword [esp + 4], 0x1770376
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004d0bd7
add esp, 4
jbe 0x4cc634
ja 0x4cc634
call 0x60311c37
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cc6d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb byte [ebx + 0x4bf8240d], cl
add byte [ecx + 0x4ba8f00d], cl
add byte [ebx + 0x4be2a415], cl
add byte [ecx + 0x4ba8f415], cl
add byte [edi + 0x5e], bl
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
jb 0x4cc6f7
jae 0x4cc6f7
call 0x49350cc1
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0
jb 0x4cc730
jae 0x4cc730
jmp 0x4cc6bb
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
inc ebp
out dx, eax
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
push ebp
invalid
int1
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
jo 0x4cc79d
jno 0x4cc79d
jmp 0x4cc786
call fcn.004d348d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4cc7af
xor eax, eax
jmp 0x4cc800
jb 0x4cc7b4
jae 0x4cc7b4
call 0x52351545
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004d66a8
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
jo 0x4cc7d9
jno 0x4cc7d9
jmp 0x4cc75d
cmp dword [ebp - 4], 0
jne 0x4cc7e3
xor eax, eax
jmp 0x4cc800
jne 0x4cc7e8
je 0x4cc7e8
jmp 0x4cc774
mov ecx, dword [ebp - 4]
push ecx
call fcn.004d0bd7
add esp, 4
jb 0x4cc7f9
jae 0x4cc7f9
cmp cl, byte [ebx - 0xadf7ab]
push ebp
cld
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4cef1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x24], 0x48
mov byte [ebp - 0x1f], 0x77
mov byte [ebp - 0x1a], 0x6e
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0x23], 0x66
mov byte [ebp - 0x1e], 0x6a
mov byte [ebp - 0x19], 0x66
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0xf], 0
mov byte [ebp - 0x22], 0x75
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0x21], 0x46
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x16], 0x54
mov byte [ebp - 0x11], 0x68
jb 0x4cef78
jae 0x4cef78
and al, 0x8a
dec ebp
fadd qword [eax + 0x4d8801e9]
fmul qword [edx - 0x157f1eab]
add dword [eax + 0x458ae155], ecx
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x23]
sub cl, 1
mov byte [ebp - 0x23], cl
mov dl, byte [ebp - 0x1e]
sub dl, 1
mov byte [ebp - 0x1e], dl
mov al, byte [ebp - 0x19]
sub al, 1
mov byte [ebp - 0x19], al
mov cl, byte [ebp - 0x22]
sub cl, 1
mov byte [ebp - 0x22], cl
mov dl, byte [ebp - 0x1d]
sub dl, 1
mov byte [ebp - 0x1d], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x21]
sub cl, 1
mov byte [ebp - 0x21], cl
mov cl, byte [ebp - 0x24]
sub cl, 1
mov byte [ebp - 0x24], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
Function at 0x4cfa30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
jb 0x4cfa4e
jae 0x4cfa4e
call 0x76424018
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 8], 0x4a
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xd], 0x76
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x11], 0x45
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x67
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 7], 0x45
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 9], 0x44
mov byte [ebp - 0x15], 0x56
mov byte [ebp - 6], 0
mov byte [ebp - 0xa], 0x4d
jb 0x4cfa9f
jae 0x4cfa9f
jmp 0x4cfa2a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
add dword [eax + 0x558ae84d], ecx
in eax, dx
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
inc ebp
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
push ebp
jmp 0x4cfaa4
stc
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
jo 0x4cfb40
jno 0x4cfb40
jmp 0x4cfb29
call fcn.004d348d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4cfb52
xor eax, eax
jmp 0x4cfb9f
jb 0x4cfb57
jae 0x4cfb57
call 0x523548e8
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004d66a8
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d9ce8
add esp, 0xc
jo 0x4cfb7c
jno 0x4cfb7c
jmp 0x4cfb00
cmp dword [ebp - 0x1c], 0
jne 0x4cfb86
xor eax, eax
jmp 0x4cfb9f
jne 0x4cfb8b
je 0x4cfb8b
jmp 0x4cfb17
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004d0bd7
add esp, 4
jo 0x4cfb9c
jno 0x4cfb9c
jmp 0x4cfb9c
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret