joyce8/EMBER2024-capa huggingface dataset:
Function at 0x877f55
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
bsr si, dx
jmp 0x877f60
mov word [esp + 0xc], sp
pop dword [esp + 0x13]
mov dx, word [esp + 0x29]
cpuid
jmp 0x877f91
mov byte [esp + 0xa], dl
rdtsc
mov dword [esp + 0x1e], ebx
rdtsc
pop edi
mov dword [esp + 3], ebx
jmp 0x877fe0
rdtsc
pop dx
rdtsc
cpuid
xchg edi, esi
jmp 0x87843b
rol cl, 2
cmc
lea ebx, [esi*4]
push dword [esp + 0x17]
mov byte [esp + 6], dh
sub esp, 2
jmp 0x877fca
lea edi, [ecx*4]
pop word [esp + 0x29]
call fcn.0087810f
push word [esp]
mov ch, byte [esp + 5]
dec dl
add esp, 4
not cl
mov cl, al
jmp 0x8784a3
xchg byte [esp], bh
mov dh, ah
mov cl, byte [esp]
mov dh, byte [esp]
mov al, dl
jmp 0x8784b6
lea esp, [esp + 1]
dec dh
setne ch
lea esp, [esp]
not bh
mov byte [esp], bh
jmp 0x87848d
sbb ebp, 0x39893f28
lea esp, [esp]
mov esi, esp
mov cx, word [esp]
mov ax, 0x7232
not bx
jmp 0x8785e1
setno ch
neg cx
cld
xchg cl, ch
btc bp, sp
bsr ax, dx
jmp 0x878546
bswap ecx
lea ebx, [eax + ebx]
push ebp
mov si, 0xd9fb
pop bp
xchg bx, ax
jmp 0x8784e4
mov ax, sp
bt edx, eax
call fcn.00878516
xlatb
push ebx
ret
mov ecx, edi
lea edi, [ecx + esi]
neg edx
mov al, byte [esp]
neg dx
mov al, bh
jmp 0x87852c
lea esp, [esp]
adc si, 0xef06
inc bp
cpuid
push bx
lea esp, [esp + 2]
jmp 0x878506

Function at 0x8781d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x87820b
rdtsc
shl ebx, 0x11
cpuid
cpuid
xchg ecx, edi
setb dh
jmp 0x87834d
lea esp, [esp + 4]
lea ebp, [edi*4]
bsr eax, esi
cpuid
jmp 0x878262
shl bx, cl
bswap eax
lea ebp, [esi*4]
pop word [esp]
lea esp, [esp]
pushal
jmp 0x878236
mov esi, 0x1cb3bee3
mov dword [esp + 0x14], esp
xchg dx, di
push dword [esp + 0xe]
jmp 0x8782a5
cpuid
std
neg edi
xchg edx, esi
pop edi
xchg di, bp
jmp 0x87824c
std
mov cl, 0x2d
inc ah
xchg dl, cl
mov bp, word [esp + 7]
pop word [esp + 0x1c]
jmp 0x8782d4
rdtsc
setns bh
cpuid
lea ebx, [ebp*4]
xchg byte [esp + 0xf], dh
mov word [esp + 0x16], cx
jmp 0x878285
xchg dl, bl
mov word [esp + 5], cx
push edi
mov dx, word [esp + 0xc]
rdtsc
jmp 0x878302
add esp, 0xc
xchg word [esp], bp
mov cx, word [esp + 0x12]
xchg dword [esp + 4], ecx
pop dword [esp + 5]
pop dx
jmp 0x8782be
push dword [esp + 9]
mov byte [esp + 0xe], al
mov al, 0x26
pushal
lea esp, [esp + 0x30]
jmp 0x87832e
dec ax
rdtsc
xchg word [esp + 4], si
xchg byte [esp + 8], cl
seto ah
xchg word [esp], ax
jmp 0x8782ec
stc
xchg byte [esp], dl
cpuid
xchg byte [esp + 1], al
mov bx, 0xc037
jmp 0x878363
xchg al, bl
mov ax, word [esp]
stc
mov word [esp + 3], bp
mov ah, bl
pop word [esp + 1]
jmp 0x878318
xchg dword [esp + 1], esi
mov esi, dword [esp + 4]
xchg edi, edx
mov ch, ah
mov cl, 1
bsf ebp, esp
jmp 0x878278
mov al, byte [esp]
mov ebx, 0x98e669d1
rdtsc
mov bp, 0xcaec
mov byte [esp + 1], ah
jmp 0x87839b
lea esp, [esp + 2]
xchg ebx, ebp
pushal
inc ebx
inc ch
rcl ah, 7
jmp 0x878385

Function at 0x8786b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0x14]
cld
seto al
jmp 0x8786f9
mov byte [esp + 0x16], ch
mov dl, byte [esp + 0x17]
lea ebp, [eax + esi]
mov ebx, 0xd18ae9b0
mov cl, 0x90
mov bl, byte [esp + 0x14]
jmp 0x8786d9
Function at 0x87a38e
Capabilities:
Access peb ldr_data

Disassembly:
pop word [esp]
lea esp, [esp]
mov word [esp], bx
lea esp, [esp + 2]
push ebp
jmp 0x87a390
jmp 0x87a378
push esp
mov byte [esp + 2], dl
mov dword [esp], esi
push edi
jmp 0x87a3e0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x87a3ca
Function at 0x48b116
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x48583c], 1
jne 0x48b294
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a5bec
add esp, 0xc
ror ebx, 3
rol ebx, 3
shl esp, 0
xor ecx, eax
xor ecx, eax
jb 0x48b156
pushf
jmp 0x48b14f
popf
jae 0x48b153
jae 0x48b156
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
lea ecx, [ecx + 0xd64]
lea ecx, [ecx - 0xd64]
cmp eax, 0x4b29
inc ecx
dec ecx
jno 0x48b1ba
pushf
lea ebx, [ebx + 0x5ca2]
lea ebx, [ebx - 0x5ca2]
add esp, 0
xor ebx, eax
xor ebx, eax
or esp, 0
popf
jnp 0x48b1b7
jo 0x48b1ba
mov edi, 0x80e84d8a
jmp 0xe89639c4
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0048fa55
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48b22f
xor eax, eax
jmp 0x48b2e3
and edx, edx
cmp eax, edx
cmp ebx, dword [esp + 0xc]
jl 0x48b243
pushf
js 0x48b23d
popf
nop
jge 0x48b243
or dword [ebp - 0x74af17bb], 0xe851f44d
add al, 0xc0
add al, byte [eax]
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004b7254
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004a5bec
add esp, 0xc
nop
neg esi
neg esi
je 0x48b27e
pushf
jbe 0x48b26e
sub esp, 0
xchg edx, edx
popf
mov ecx, ecx
xchg edi, edi
jg 0x48b27b
jne 0x48b27e
mov esi, 0xf87d83
cmp dword [ebp - 8], 0
je 0x48b28e
mov eax, dword [ebp - 8]
mov dword [0x48583c], eax
jmp 0x48b292
xor eax, eax
jmp 0x48b2e3
jmp 0x48b29d
mov ecx, dword [0x48583c]
mov dword [ebp - 8], ecx
push edx
pop edx
mov eax, eax
cmc
ror edi, 0
jo 0x48b2ac
jbe 0x48b2a9
jno 0x48b2ac
mov esi, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jp 0x48b2b4
jnp 0x48b2cc
jbe 0x48b2b8
lea eax, [eax]
xchg esp, esp
lea ebx, [ebx + 0x7b79]
lea ebx, [ebx - 0x7b79]
jp 0x48b2cc
mov ebp, 0xfc458b3b
mov eax, dword [ebp - 4]
push eax
call fcn.004939ae
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48cdfc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
neg edx
neg edx
sub esp, 0
cmp edx, dword [esp + 8]
jbe 0x48ce1b
xchg edi, eax
xchg edi, eax
jno 0x48ce16
je 0x48ce18
ja 0x48ce1b
add eax, 0x26dc45c7
add byte [eax], al
add bh, al
inc ebp
fadd dword [eax]
add byte [eax], al
add bl, ch
mov dword [ebp - 0x24], 0x26
mov dword [ebp - 0x28], 0
jmp 0x48ce34
Function at 0x48dd24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a5bec
add esp, 0xc
ror edi, 0x19
rol edi, 0x19
nop
shl ecx, 0
lea esi, [esi + 0x70be]
lea esi, [esi - 0x70be]
je 0x48dd66
pushf
inc esi
dec esi
jbe 0x48dd5b
popf
lea ebx, [ebx]
mov esp, esp
jnp 0x48dd63
jne 0x48dd66
mov esp, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
mov eax, eax
rol edx, 0xf
ror edx, 0xf
mov esp, esp
je 0x48ddc3
pushf
test dword [esp], esi
cmp edi, dword [esp + 0xc]
jno 0x48ddb5
ror esi, 0
popf
jle 0x48ddbc
xchg edi, edi
xchg edx, edx
jne 0x48ddc3
xor eax, 0x80f44d8a
jmp 0xf49665cd
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
sub ebx, 0
jne 0x48de39
jnp 0x48de3b
jg 0x48de5b
pushf
lea edx, [edx + 0x272a]
sub edx, 0x272a
dec edx
inc edx
stc
popf
jno 0x48de52
xchg edi, edx
xchg edi, edx
jle 0x48de58
jle 0x48de5b
ljmp 0x8900:0x1bf5e8
call fcn.0048fa55
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48de6e
jmp 0x48df12
std
cld
jo 0x48de72
cld
ja 0x48de80
ja 0x48de77
mov esi, esi
xchg ebx, ebx
jbe 0x48de80
mov edx, 0x558d77da
call 0xf88e69d9
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004b7254
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004a5bec
add esp, 0xc
ror eax, 0x14
ror eax, 0xc
not ecx
not ecx
dec edx
inc edx
sub esp, 0
jl 0x48dec1
pushf
cld
jnp 0x48deb6
popf
mov edx, edx
lea eax, [eax]
jle 0x48debe
jge 0x48dec1
jmp 0x1455c48
cmp dword [ebp - 4], 0
jne 0x48dec9
jmp 0x48df12
nop
jl 0x48dee3
pushf
test esp, 0x32aa
cmp esp, 0x27a
xchg edi, edi
popf
jl 0x48dee0
jge 0x48dee3
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004939ae
add esp, 4
xchg esi, esi
jg 0x48df0b
pushf
xor ebx, 0x591a
xor ebx, 0x591a
popf
jg 0x48df05
nop
mov esp, esp
jle 0x48df0b
xor eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48e0d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a5bec
add esp, 0xc
jge 0x48e0f1
jl 0x48e10b
pushf
sub esp, 0
popf
lea eax, [eax]
lea eax, [eax + 0x3a16]
lea eax, [eax - 0x3a16]
jge 0x48e10b
call 0x453526d5
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
cmp ebx, dword [esp]
ror edx, 6
rol edx, 6
js 0x48e15b
mov esp, esp
mov esi, esi
lea ebx, [ebx + 0x5620]
lea ebx, [ebx - 0x5620]
jb 0x48e158
jns 0x48e15b
mov ecx, 0x80ec4d8a
jmp 0xec966965
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0048fa55
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48e1d0
xor eax, eax
jmp 0x48e264
test ebx, 0x7650
clc
je 0x48e1e0
mov edi, edi
jno 0x48e1dd
jne 0x48e1e0
mov ebx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004b7254
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004a5bec
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x48e20a
xor eax, eax
jmp 0x48e264
clc
js 0x48e20d
jge 0x48e22e
pushf
xchg ebx, edi
xchg ebx, edi
test esp, 0x6242
rol edi, 0x19
ror edi, 0x19
jle 0x48e223
popf
lea eax, [eax]
jbe 0x48e229
jnp 0x48e22b
jl 0x48e22e
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004939ae
add esp, 4
jo 0x48e23c
rol edx, 0
jns 0x48e241
lea esi, [esi + 0x5a29]
lea esi, [esi - 0x5a29]
jnp 0x48e25d
pushf
mov esp, esp
rol edx, 0
popf
lea ebx, [ebx]
jp 0x48e25d
mov eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x491395
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a5bec
add esp, 0xc
stc
ja 0x4913c0
pushf
xchg esi, esi
and ebx, ebx
mov ecx, ecx
popf
jne 0x4913bd
jbe 0x4913c0
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
xor esp, 0
je 0x491422
pushf
shr ebx, 0
cld
add ebx, dword [esp]
sub ebx, dword [esp]
popf
jle 0x49141d
jg 0x49141f
jne 0x491422
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.0048fa55
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4914cb
xor eax, eax
jmp 0x49155b
not ecx
not ecx
jne 0x4914db
mov esi, esi
jle 0x4914d5
jge 0x4914d7
je 0x4914db
call 0xe88ea257
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b7254
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004a5bec
add esp, 0xc
or edx, edx
jnp 0x4914ff
ja 0x491514
js 0x491503
jbe 0x491505
lea edx, [edx + 0x4501]
lea edx, [edx - 0x4501]
jbe 0x491514
add eax, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x49151e
xor eax, eax
jmp 0x49155b
xchg ebx, edi
xchg ebx, edi
jne 0x491524
jb 0x491536
pushf
shl esp, 0
popf
xchg edx, eax
xchg edx, eax
mov eax, eax
xchg edx, eax
xchg edx, eax
jae 0x491536
sub eax, 0x50e4458b
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004939ae
add esp, 4
cld
call fcn.00491548
Function at 0x4991e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
shl ebx, 0
call fcn.004991fa

Function at 0x49c370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x485840], 1
jne 0x49c4be
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a5bec
add esp, 0xc
xor esp, 0
jo 0x49c39b
jae 0x49c3ba
pushf
rol ecx, 0x19
rol ecx, 7
jl 0x49c3a7
popf
lea ecx, [ecx + 0x7b36]
lea ecx, [ecx - 0x7b36]
jmp 0x49c3b7
jb 0x49c3ba
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
cmc
jo 0x49c3e9
je 0x49c3fd
pushf
test dword [esp + 0x10], ebx
je 0x49c3f3
stc
popf
jne 0x49c3f8
js 0x49c3fa
jne 0x49c3fd
lcall 0x1e9, 0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0048fa55
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49c46a
mov eax, dword [ebp + 8]
jmp 0x49c531
jg 0x49c46c
je 0x49c486
pushf
nop
or esp, 0
cmp esp, 0x7118
and esp, 0xffffffff
popf
jl 0x49c481
xchg esi, esi
jne 0x49c486
add eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004b7254
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004a5bec
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x49c4b7
mov edx, dword [ebp - 8]
mov dword [0x485840], edx
jmp 0x49c4bc
mov eax, dword [ebp + 8]
jmp 0x49c531
jmp 0x49c4c6
mov eax, dword [0x485840]
mov dword [ebp - 8], eax
ja 0x49c4c8
jle 0x49c4ca
lea edx, [edx]
jb 0x49c4d6
mov edx, edx
xchg ebx, ebx
jae 0x49c4d6
mov edx, 0xf84d8b33
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov esp, esp
jae 0x49c4eb
je 0x49c4e2
jle 0x49c4e4
jg 0x49c4e6
jb 0x49c4eb
mov esp, 0x558b3dee
cld
mov edx, dword [ebp - 4]
push edx
call fcn.004939ae
add esp, 4
cmp ebx, dword [esp]
inc edi
dec edi
jne 0x49c52a
pushf
add edx, 0x788c
sub edx, 0x788c
call 0x49c511
add esp, 4
or edx, 0
popf
je 0x49c51b
lea edx, [edx + 0x673e]
lea edx, [edx - 0x673e]
je 0x49c52a
mov edi, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49ec69
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x14
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004a5bec
add esp, 0xc
cmp eax, ebx
jb 0x49ec92
mov ebx, ebx
je 0x49ec8a
js 0x49ec8c
jne 0x49ec8e
jae 0x49ec92
add eax, 0xe445c630
dec eax
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x15], 0x66
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0x12], 0x51
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x4a
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0
lea ebx, [ebx + 0x3577]
lea ebx, [ebx - 0x3577]
jns 0x49ed01
jne 0x49ecf2
lea edi, [edi + 0x42bc]
lea edi, [edi - 0x42bc]
js 0x49ed01
mov ebx, 0x80e44d8a
jmp 0xe497750b
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
call fcn.0048fa55
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49edbb
xor eax, eax
jmp 0x49ee52
jg 0x49edbd
jo 0x49edcb
jbe 0x49edc1
jmp 0x49edc3
jle 0x49edc5
lea esp, [esp]
jno 0x49edcb
xor eax, 0x52e4558d
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004b7254
mov dword [ebp - 4], eax
push 0x14
push 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004a5bec
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x49ee34
mov eax, eax
xchg edi, edi
shl esi, 0
jp 0x49ee0b
pushf
cmc
js 0x49edff
popf
ja 0x49ee03
jne 0x49ee05
lea esp, [esp]
jnp 0x49ee0b
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004939ae
add esp, 4
stc
cld
call fcn.0049ee1e
Function at 0x4a05d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a5bec
add esp, 0xc
cld
jbe 0x4a05f9
js 0x4a05f2
jg 0x4a05f4
jmp 0x4a05f6
ja 0x4a05f9
sub eax, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
xchg esp, esp
inc edi
dec edi
ja 0x4a062f
jns 0x4a064c
pushf
cmp esi, 0x1556
popf
jno 0x4a063d
lea esi, [esi + 0x45e9]
lea esi, [esi - 0x45e9]
js 0x4a064c
mov esp, 0x80ec4d8a
jmp 0xec978e56
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0048fa55
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a06be
xor eax, eax
jmp 0x4a0726
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004b7254
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004a5bec
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4a0724
test dword [esp + 0x10], ecx
cld
je 0x4a06f5
nop
jnp 0x4a06ee
xchg esp, esp
jno 0x4a06f2
jne 0x4a06f5
mov edx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004939ae
add esp, 4
ror edx, 0xf
rol edx, 0xf
push esi
pop esi
jbe 0x4a0713
js 0x4a070d
mov edi, edi
ja 0x4a0713
mov esp, 0x104d8b80
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4a0726
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc