joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8063
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004e01cb
add esp, 0xc
jae 0x4e807e
sub esp, 0
ror esp, 0
nop
je 0x4e8097
pushf
or esp, 0
popf
xchg edx, eax
xchg edx, eax
mov esp, esp
ja 0x4e8094
jne 0x4e8097
call 0x4536c661
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
and esi, 0xffffffff
je 0x4e80f3
jp 0x4e80ea
xchg esi, esi
jne 0x4e80ee
jge 0x4e80f0
jne 0x4e80f3
sub eax, 0x80e84d8a
jmp 0xe89c08fd
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
add esp, 0
mov esp, esp
jp 0x4e81a3
jne 0x4e8198
js 0x4e819a
js 0x4e819c
jl 0x4e819e
jnp 0x4e81a3
mov esp, 0xb6e84ca3
retf 0
call 0x4f4c5e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4e81b8
xor eax, eax
jmp 0x4e823f
jnp 0x4e81ba
xor edx, 0xa26
xor edx, 0xa26
add esp, 0
jae 0x4e81e0
pushf
not esi
not esi
jp 0x4e81d3
ja 0x4e81d5
popf
jbe 0x4e81d9
jno 0x4e81db
xchg esp, esp
jb 0x4e81e0
mov esi, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004f370f
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004e01cb
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x4e820a
xor eax, eax
jmp 0x4e823f
cmp ebx, 0x82a
and esp, 0xffffffff
test dword [esp], edi
jns 0x4e8220
jmp 0x4e821a
lea eax, [eax]
js 0x4e8220
jmp 0xe49c0dbf
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004f291c
add esp, 4
xchg ebx, esi
xchg ebx, esi
cld
jp 0x4e8238
jae 0x4e8235
jnp 0x4e8238
ljmp 0x55ff:0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ee745
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004e01cb
add esp, 0xc
test esp, 0x5155
xchg esp, esp
ror ecx, 0
jns 0x4ee779
jns 0x4ee774
jnp 0x4ee776
js 0x4ee779
lcall 0x45c6, 0x51e845c6
in eax, dx
je 0x4ee748
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
inc ebx
dec ebx
jae 0x4ee826
neg ebx
neg ebx
jbe 0x4ee835
jns 0x4ee82e
jne 0x4ee830
mov esp, esp
ja 0x4ee835
ljmp 0x89ff:0xfeeefbe8
call fcn.004dd735
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ee84a
xor eax, eax
jmp 0x4ee8e7
add esp, 0
jmp 0x4ee84f
jbe 0x4ee851
jle 0x4ee874
pushf
push edx
pop edx
mov eax, eax
inc eax
dec eax
test esp, 0x63cc
popf
lea edx, [edx + 0x1e58]
lea edx, [edx - 0x1e58]
xchg ebx, ebx
jg 0x4ee874
add eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004f370f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004e01cb
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4ee89e
xor eax, eax
jmp 0x4ee8e7
stc
jbe 0x4ee8a1
xchg edx, edi
xchg edx, edi
jle 0x4ee8b2
mov esp, esp
xchg edx, edx
xchg edi, edi
lea esi, [esi]
jg 0x4ee8b2
mov ebx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004f291c
add esp, 4
or eax, 0
jle 0x4ee8c3
xor edi, dword [esp]
xor edi, dword [esp]
je 0x4ee8dc
pushf
test esp, 0x5bdd
popf
ja 0x4ee8d7
jno 0x4ee8d9
jne 0x4ee8dc
or dword [ebx - 0x74aff3bb], 0xff51084d
push ebp
cld
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4eec6e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4d1368], 1
jne 0x4eedb1
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004e01cb
add esp, 0xc
rol edx, 0
jl 0x4eecb0
jb 0x4eec9b
lea esp, [esp]
lea eax, [eax + 0x3fcd]
lea eax, [eax - 0x3fcd]
jl 0x4eecac
jge 0x4eecb0
add eax, 0xe845c684
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
add ecx, 0x5576
sub ecx, 0x5576
jbe 0x4eecea
rol edx, 0
jae 0x4eecf6
mov edi, edi
jb 0x4eecf6
xor eax, 0x4d8a562c
call 0x8850d67d
dec ebp
call 0x813c428d
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.004dd735
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4eed63
mov eax, dword [ebp + 8]
jmp 0x4eee2b
nop
ja 0x4eed66
or ecx, 0
xchg esp, esp
jb 0x4eed79
xchg edx, eax
xchg edx, eax
jne 0x4eed71
je 0x4eed73
mov esp, esp
jae 0x4eed79
mov ebp, 0xe8558d1c
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004f370f
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004e01cb
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x4eedaa
mov edx, dword [ebp - 8]
mov dword [0x4d1368], edx
jmp 0x4eedaf
mov eax, dword [ebp + 8]
jmp 0x4eee2b
jmp 0x4eedb9
mov eax, dword [0x4d1368]
mov dword [ebp - 8], eax
add esp, 0
jmp 0x4eedbe
shr edi, 0
jo 0x4eedca
lea ecx, [ecx]
jmp 0x4eedc7
jno 0x4eedca
add eax, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jae 0x4eedd2
jp 0x4eedd4
jbe 0x4eede1
je 0x4eedd8
jle 0x4eedda
xchg ecx, ecx
jge 0x4eedde
ja 0x4eede1
lcall 0x32e8, 0x52fc558b
cmp eax, dword [eax]
add byte [ebx + 0xe804c4], al
add byte [eax], al
add byte [ebx + 0x7b04c4], al
mov edx, dword [ebp - 4]
push edx
call fcn.004f291c
add esp, 4
call 0x4eedf2
add esp, 4
jnp 0x4eedf7
call 0x4eedfc
add esp, 4
jns 0x4eee24
pushf
xor esp, 0
xor edx, dword [esp]
xor edx, dword [esp]
jmp 0x4eee0e
nop
popf
jp 0x4eee13
lea ecx, [ecx + 0x2ad1]
lea ecx, [ecx - 0x2ad1]
jne 0x4eee21
js 0x4eee24
mov esp, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4eee34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004e01cb
add esp, 0xc
lea esp, [esp]
push ecx
add ecx, 0x6bf
ror ecx, 0x1b
pop ecx
je 0x4eee66
xchg ebx, ebx
jae 0x4eee61
jns 0x4eee63
jne 0x4eee66
mov eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
ror esi, 0
jle 0x4eeeb7
pushf
lea edi, [edi]
or edi, 0
popf
jge 0x4eeea6
je 0x4eeea8
lea ecx, [ecx + 0x45c4]
lea ecx, [ecx - 0x45c4]
jg 0x4eeeb7
call 0x813f3c45
jmp 0xf09c76c1
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
jne 0x4eef19
dec esi
inc esi
xor ebx, 0xe43
xor ebx, 0xe43
ror edi, 3
ror edi, 0x1d
js 0x4eef39
je 0x4eef31
mov esp, esp
jno 0x4eef35
jns 0x4eef39
mov ebx, 0xe7f7e83f
invalid
call fcn.004dd735
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4eef4b
xor eax, eax
jmp 0x4eef78
lea ebx, [ebx]
jl 0x4eef55
jle 0x4eef51
jge 0x4eef55
mov esp, 0xf0458d48
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f370f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004e01cb
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f27dd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004e01cb
add esp, 0xc
mov eax, eax
jbe 0x4f280d
mov ebx, ebx
jle 0x4f2805
jne 0x4f2807
jle 0x4f2809
ja 0x4f280d
lcall 0xc64e, 0xf045c659
inc ebp
cmc
push 0x66f145c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
and edi, edi
jno 0x4f2841
mov ebx, ebx
cmp edx, dword [esp + 4]
jae 0x4f2850
jp 0x4f284b
jp 0x4f284d
jb 0x4f2850
ljmp 0x1e9:0x80f04d8a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
or esp, 0
add ecx, 0
je 0x4f28cd
mov eax, eax
lea edi, [edi + 0x3eb9]
lea edi, [edi - 0x3eb9]
jle 0x4f28c8
jg 0x4f28ca
jne 0x4f28cd
mov esp, 0xfefa77e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.004e2349
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4f28df
xor eax, eax
jmp 0x4f2915
mov edx, edx
xor ebx, edi
xor ebx, edi
lea ebx, [ebx]
nop
jo 0x4f28f2
jg 0x4f28ec
jmp 0x4f28ee
jno 0x4f28f2
ljmp 0x8b50:0xf0458d99
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f370f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004e01cb
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f3233
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004e01cb
add esp, 0xc
nop
je 0x4f324f
jae 0x4f325d
jno 0x4f3253
jne 0x4f3255
jae 0x4f3257
jns 0x4f3259
jb 0x4f325d
mov esp, 0xec45c695
push eax
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
xchg ecx, eax
xchg ecx, eax
rol edi, 0x14
ror edi, 0x14
call 0x4f329a
lea esp, [esp + 4]
js 0x4f32ab
pushf
sub eax, 0
popf
nop
jns 0x4f32ab
xor eax, 0x80ec4d8a
jmp 0xec9cbab5
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004dd735
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4f331d
xor eax, eax
jmp 0x4f338c
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004f370f
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004e01cb
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4f338a
xchg esp, esp
jnp 0x4f334c
jle 0x4f3349
jp 0x4f334c
ljmp 0xc7e8:0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004f291c
add esp, 4
nop
inc esi
dec esi
lea edi, [edi + 0x1612]
lea edi, [edi - 0x1612]
lea eax, [eax]
jns 0x4f3379
pushf
rol esp, 0
popf
ja 0x4f3374
je 0x4f3376
js 0x4f3379
sub eax, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4f338c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f6658
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004e01cb
add esp, 0xc
cmp edi, edx
jno 0x4f6685
pushf
lea eax, [eax]
jge 0x4f667b
test dword [esp], ebx
popf
jg 0x4f6682
jo 0x4f6685
call 0x7b3bac4f
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
stc
jne 0x4f66c0
cld
ja 0x4f66c3
je 0x4f66d3
pushf
jb 0x4f66c9
add edi, 0
popf
jne 0x4f66d0
jne 0x4f66d3
mov esp, 0x80f44d8a
jmp 0xf49ceedd
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
xchg edx, edx
jns 0x4f6748
jne 0x4f6760
pushf
and esp, 0xffffffff
sub ebx, 0
std
cld
rol ecx, 0
popf
jmp 0x4f675b
jge 0x4f675d
je 0x4f6760
mov ecx, 0xfe6fd0e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 5], dh
call fcn.004dd735
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4f6773
jmp 0x4f681f
xor ebx, dword [esp + 0xc]
xor ebx, dword [esp + 0xc]
lea esp, [esp]
jne 0x4f6780
jnp 0x4f6796
pushf
inc eax
dec eax
rol edx, 0
test dword [esp + 0x10], edx
popf
mov esp, esp
mov eax, eax
jp 0x4f6796
xor eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004f370f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004e01cb
add esp, 0xc
std
cld
shr esp, 0
cmc
clc
jns 0x4f67d1
pushf
cmp eax, 0x303e
mov edx, edx
popf
jbe 0x4f67cc
jl 0x4f67ce
js 0x4f67d1
add eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x4f67d9
jmp 0x4f681f
test esp, 0x41b4
lea esp, [esp]
ja 0x4f67eb
jne 0x4f67e6
jg 0x4f67e8
jbe 0x4f67eb
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004f291c
add esp, 4
xchg ebx, ebx
cmp esp, 0x1c7b
je 0x4f6801
cmp esi, 0xfce
jb 0x4f6818
pushf
test eax, ecx
xchg edx, edx
mov ecx, ecx
popf
jbe 0x4f6815
jae 0x4f6818
mov esp, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f6828
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004e01cb
add esp, 0xc
cmp esp, 0x5115
ja 0x4f6849
test dword [esp + 8], ecx
jbe 0x4f6871
pushf
push ebx
add ebx, 0xae2
ror ebx, 8
pop ebx
popf
lea esi, [esi + 0xa2f]
lea esi, [esi - 0xa2f]
mov esi, esi
jns 0x4f686e
ja 0x4f6871
mov ebx, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
test eax, 0x255
je 0x4f68bb
nop
jns 0x4f68b7
jne 0x4f68bb
mov ebx, 0xec4d8acd
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.004dd735
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4f6948
jmp 0x4f69e5
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f370f
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004e01cb
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4f69e5
rol ebx, 0
test dword [esp], ebx
lea ebx, [ebx + 0x192b]
lea ebx, [ebx - 0x192b]
jno 0x4f698a
jl 0x4f6984
nop
lea ecx, [ecx]
jo 0x4f698a
mov esi, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.004f291c
add esp, 4
call 0x4f699b
add esp, 4
lea eax, [eax]
xchg edx, edx
ja 0x4f69d2
pushf
lea eax, [eax + 0x47b8]
sub eax, 0x47b8
lea edi, [edi + 0x51e8]
lea edi, [edi - 0x51e8]
popf
jno 0x4f69c1
mov eax, eax
lea ecx, [ecx + 0x47cc]
lea ecx, [ecx - 0x47cc]
jbe 0x4f69d2
add eax, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10