joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103a36d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.010399d6
add esp, 0xc
nop
jb 0x103a39c
jne 0x103a38b
xchg edi, edi
lea ebx, [ebx + 0x5a9]
lea ebx, [ebx - 0x5a9]
jae 0x103a39c
add eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
neg esi
neg esi
jns 0x103a3e9
pushf
sub ecx, 0
call 0x103a3dc
lea esp, [esp + 4]
popf
xchg edx, eax
xchg edx, eax
ja 0x103a3e6
js 0x103a3e9
ljmp 0x1e9:0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
xor edx, dword [esp + 4]
xor edx, dword [esp + 4]
nop
ror edi, 0x15
rol edi, 0x15
jno 0x103a468
pushf
jmp 0x103a45e
cmp edx, dword [esp]
popf
js 0x103a465
jo 0x103a468
mov edi, 0x67aee8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x1040c1b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x103a480
mov eax, 1
jmp 0x103a525
add eax, 0
add ecx, 0x6555
sub ecx, 0x6555
jl 0x103a496
nop
jge 0x103a496
call 0xf549327b
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0103a999
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.010399d6
add esp, 0xc
clc
xchg ebx, ebx
ror esi, 6
rol esi, 6
jo 0x103a4c7
jno 0x103a4c3
jno 0x103a4c7
mov edi, 0xec7d83af
add byte [ebp + 7], dh
cmp dword [ebp - 0x14], 0
jne 0x103a4d4
mov eax, 1
jmp 0x103a525
cmp esi, dword [esp + 0x10]
jg 0x103a4fd
pushf
ror edx, 0x10
rol edx, 0x10
ja 0x103a4e4
test esi, ebx
lea esi, [esi + 0x3978]
lea esi, [esi - 0x3978]
popf
mov esi, esi
xchg edx, eax
xchg edx, eax
jbe 0x103a4fa
jle 0x103a4fd
add eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.01036c45
add esp, 4
push esi
pop esi
je 0x103a51e
pushf
jae 0x103a511
je 0x103a513
cmp edx, ecx
popf
lea ecx, [ecx]
jae 0x103a51b
jne 0x103a51e
jmp 0x520bf2ad
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x103a52e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.010399d6
add esp, 0xc
lea esp, [esp]
std
cld
jo 0x103a555
lea edi, [edi]
jb 0x103a565
jbe 0x103a55b
jl 0x103a55d
lea esp, [esp]
jae 0x103a565
add eax, 0x45c6d834
in al, dx
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0102ddd7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x103a62d
xor eax, eax
jmp 0x103a69b
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0103a999
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.010399d6
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x103a657
xor eax, eax
jmp 0x103a69b
jb 0x103a659
jge 0x103a66a
pushf
jp 0x103a65f
or ebx, ebx
popf
lea edx, [edx]
jp 0x103a667
jl 0x103a66a
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.01036c45
add esp, 4
neg edi
neg edi
je 0x103a690
ja 0x103a67e
lea esi, [esi + 0x1b4a]
lea esi, [esi - 0x1b4a]
jg 0x103a68c
jne 0x103a690
mov edi, 0xc4d8b03
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x103e7dd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x103e7f1
jmp 0x103e997
jp 0x103e7f3
jo 0x103e808
pushf
cmp esp, 0x3a87
popf
xchg esp, esp
jns 0x103e803
jp 0x103e805
jno 0x103e808
sub eax, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x10290c4], edx
cmp eax, dword [esp + 8]
xor esi, 0x31d7
xor esi, 0x31d7
jns 0x103e831
jae 0x103e82d
js 0x103e831
mov edx, 0xec458bf5
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x1029434], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x1029430], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x1027bc8], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x1027bcc], ecx
js 0x103e862
jbe 0x103e87a
pushf
xchg edi, edi
jbe 0x103e86a
ja 0x103e86c
rol esp, 0
popf
lea esp, [esp]
nop
jno 0x103e877
ja 0x103e87a
call 0x4ef42e44
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
or esp, 0
jne 0x103e8c9
pushf
xchg edx, eax
xchg edx, eax
or edx, edx
js 0x103e8bb
cmp ebx, dword [esp]
popf
jge 0x103e8c2
jno 0x103e8c4
jnp 0x103e8c6
je 0x103e8c9
mov ecx, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
neg edx
neg edx
shl eax, 0
je 0x103e951
pushf
inc esi
dec esi
push edx
add edx, 0x511c
ror edx, 0x14
pop edx
popf
jp 0x103e94d
nop
jne 0x103e951
mov eax, 0x94303d83
add al, byte [ecx]
add byte [esp + edx - 0x73], dh
push ebp
invalid
cmp dword [0x1029430], 0
je 0x103e96e
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x1029430]
push eax
call fcn.0103a999
mov dword [0x10290c0], eax
add esp, 0
jo 0x103e973
lea ecx, [ecx]
test ebx, edx
jge 0x103e987
pushf
stc
jge 0x103e97e
popf
jne 0x103e982
mov ebx, ebx
jl 0x103e987
sub dword [edx + 0xd], 0x4d8d006a
invalid
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.010399d6
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1043cd6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.010399d6
add esp, 0xc
xchg esp, esp
lea ecx, [ecx]
test dword [esp + 4], eax
not ebx
not ebx
je 0x1043d11
lea edx, [edx + 0x2541]
lea edx, [edx - 0x2541]
jnp 0x1043d0b
jne 0x1043d0d
jne 0x1043d11
mov edi, 0xec45c6be
jp 0x1043cdc
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0xea4a0364
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
push edx
pop edx
jns 0x1043d55
nop
xchg ecx, ebx
xchg ecx, ebx
js 0x1043d55
add eax, 0x80f44d8a
jmp 0xf551c55f
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
push ebx
add ebx, 0x2b7c
ror ebx, 0x1d
pop ebx
cmp esi, dword [esp]
jno 0x1043de2
jb 0x1043dd8
jnp 0x1043dda
jge 0x1043ddc
jae 0x1043dde
jo 0x1043de2
mov esi, 0x9ff0e8cc
invalid
call fcn.0102ddd7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1043df5
jmp 0x1043ea2
lea esi, [esi + 0x2bc9]
sub esi, 0x2bc9
clc
ja 0x1043e04
lea edx, [edx + 0x5e82]
lea edx, [edx - 0x5e82]
jle 0x1043e1f
jne 0x1043e14
jae 0x1043e16
je 0x1043e18
lea esp, [esp]
jg 0x1043e1f
xor eax, 0xe8558d0f
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0103a999
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.010399d6
add esp, 0xc
add eax, 0
call 0x1043e47
add esp, 4
rol ebx, 0x19
rol ebx, 7
je 0x1043e58
nop
jns 0x1043e55
jne 0x1043e58
xor eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x1043e60
jmp 0x1043ea2
push edi
pop edi
nop
test dword [esp + 0xc], esi
add ecx, 0
jle 0x1043e71
xchg edi, edi
jg 0x1043e71
mov esi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.01036c45
add esp, 4
lea ecx, [ecx]
jno 0x1043e9b
pushf
jnp 0x1043e85
stc
je 0x1043e88
popf
lea edi, [edi + 0x1559]
lea edi, [edi - 0x1559]
jbe 0x1043e98
jo 0x1043e9b
add eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x104901f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.010399d6
add esp, 0xc
push esi
add esi, 0x2a8f
ror esi, 0x19
pop esi
jg 0x1049045
jns 0x104904c
mov eax, eax
js 0x104904c
mov ebp, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
test eax, 0x34
stc
jbe 0x1049084
jo 0x1049086
je 0x1049095
jl 0x104908a
jne 0x104908c
lea ebx, [ebx]
xchg esp, esp
jne 0x1049095
and dword [edi - 0x20], 0x80ec4d8a
jmp 0xed52189f
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0102ddd7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x104910a
xor eax, eax
jmp 0x10491a6
jb 0x104910c
jle 0x104910e
add esp, 0
cmp edx, 0x2f1a
jge 0x1049125
jb 0x104911b
jae 0x104911d
mov eax, eax
jno 0x1049121
jl 0x1049125
jmp 0xed4a1f20
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0103a999
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.010399d6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x104914f
xor eax, eax
jmp 0x10491a6
push ebx
pop ebx
nop
call 0x1049157
add esp, 4
cmc
jb 0x1049167
jns 0x104915f
jns 0x1049161
jg 0x1049163
jae 0x1049167
jmp 0xfd4a1d4e
mov eax, dword [ebp - 4]
push eax
call fcn.01036c45
add esp, 4
add ecx, dword [esp]
sub ecx, dword [esp]
add eax, 0x540c
sub eax, 0x540c
jne 0x1049185
jnp 0x1049187
jns 0x104919f
pushf
or esp, 0
jb 0x1049190
xchg ecx, edi
xchg ecx, edi
popf
jae 0x1049198
jne 0x104919a
xchg edi, edi
js 0x104919f
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1049aee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.010399d6
add esp, 0xc
shr ebx, 0
jae 0x1049b0c
jne 0x1049b0e
ja 0x1049b16
jle 0x1049b12
jbe 0x1049b16
or dword [esi + 0x50ec45c6], 0x73f145c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
ror esi, 0x15
rol esi, 0x15
stc
jle 0x1049b69
pushf
mov esp, esp
jg 0x1049b55
push ebx
add ebx, 0x1565
ror ebx, 6
pop ebx
jnp 0x1049b62
popf
js 0x1049b66
jg 0x1049b69
mov edi, 0x80ec4d8a
jmp 0xed522373
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0102ddd7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1049bdb
xor eax, eax
jmp 0x1049c48
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0103a999
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.010399d6
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1049c46
cmc
jg 0x1049c04
jbe 0x1049c06
je 0x1049c10
xchg esi, eax
xchg esi, eax
jns 0x1049c0c
jne 0x1049c10
add eax, 0xfc458be5
mov eax, dword [ebp - 4]
push eax
call fcn.01036c45
add esp, 4
add esp, 0
or esp, 0
not edi
not edi
ja 0x1049c35
pushf
std
cld
cmp edi, ecx
popf
xchg esp, esp
jbe 0x1049c35
or dword [ebx - 0x74aeefb3], 0x8b520c55
inc ebp
or byte [eax - 1], dl
push ebp
cld
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x1049c48
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x104b60b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.010399d6
add esp, 0xc
jns 0x104b626
ror esp, 0
jbe 0x104b63e
mov edi, edi
lea edi, [edi + 0x4ffa]
lea edi, [edi - 0x4ffa]
mov edi, edi
ja 0x104b63e
sub eax, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
and esp, 0xffffffff
add ebx, dword [esp]
sub ebx, dword [esp]
je 0x104b67c
jne 0x104b673
jb 0x104b675
jg 0x104b677
jge 0x104b679
jne 0x104b67c
xor eax, 0x80f04d8a
jmp 0xf1523e86
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.0103d2ca
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x104b6dc
xor eax, eax
jmp 0x104b751
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0103a999
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.010399d6
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x104b74f
jp 0x104b704
xor esp, 0
clc
jle 0x104b720
jle 0x104b70c
lea edx, [edx + 0x7bf9]
lea edx, [edx - 0x7bf9]
xchg esi, edi
xchg esi, edi
jg 0x104b720
mov ebx, 0xec4d8b81
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.01036c45
add esp, 4
nop
call 0x104b732
add esp, 4
or edi, edi
cmp esi, dword [esp]
jnp 0x104b742
jmp 0x104b73e
jp 0x104b742
lcall 0x8b52, 0xc558bd3
inc ebp
or byte [eax - 1], dl
push ebp
in al, dx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x104b751
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x104cdab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.010399d6
add esp, 0xc
inc eax
dec eax
add edi, dword [esp]
sub edi, dword [esp]
lea ecx, [ecx + 0x7318]
lea ecx, [ecx - 0x7318]
jge 0x104cde8
pushf
and esp, 0xffffffff
popf
jg 0x104cde3
je 0x104cde5
jl 0x104cde8
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
nop
jns 0x104ce27
or esp, 0
cmp edi, dword [esp]
jbe 0x104ce44
pushf
cmp ecx, dword [esp]
cmp edx, dword [esp + 0xc]
rol eax, 0
xchg esp, esp
popf
jnp 0x104ce41
ja 0x104ce44
sub eax, 0x80e84d8a
jmp 0xe952564e
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.0103d2ca
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x104ced3
xor eax, eax
jmp 0x104cf57
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0103a999
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.010399d6
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x104cf55
rol ebx, 0x13
rol ebx, 0xd
ror ebx, 0
mov esp, esp
ror edi, 0x1b
ror edi, 5
jle 0x104cf1e
pushf
cmp esp, 0x6750
clc
popf
xchg edi, edi
mov ebx, ebx
jg 0x104cf1e
mov eax, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.01036c45
add esp, 4
jnp 0x104cf2c
lea eax, [eax + 0x72ae]
sub eax, 0x72ae
lea edi, [edi]
and ebx, ebx
jl 0x104cf48
jl 0x104cf3f
mov esp, esp
jg 0x104cf43
lea eax, [eax]
jge 0x104cf48
mov ebx, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x104cf57
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x104e7bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.010399d6
add esp, 0xc
xor ecx, 0x176e
xor ecx, 0x176e
jnp 0x104e7e3
jne 0x104e7e5
jo 0x104e7e7
jns 0x104e80a
pushf
call 0x104e7f0
add esp, 4
rol esi, 0x16
rol esi, 0xa
xor ecx, dword [esp + 4]
xor ecx, dword [esp + 4]
popf
mov esp, esp
jl 0x104e807
js 0x104e80a
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
cld
sub esp, 0
cmp esi, dword [esp + 8]
jno 0x104e857
pushf
shr edx, 0
popf
nop
xchg esi, ecx
xchg esi, ecx
jo 0x104e857
sub eax, 0x80e84d8a
jmp 0xe9527061
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jl 0x104e8c1
jne 0x104e8c8
jle 0x104e8c5
je 0x104e8c8
ljmp 0x89ff:0xfdf50ae8
call fcn.0102ddd7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x104e8dd
xor eax, eax
jmp 0x104e97d
lea eax, [eax]
lea edx, [edx + 0x359]
sub edx, 0x359
jl 0x104e8fc
pushf
jno 0x104e8f1
popf
lea esp, [esp]
jb 0x104e8f8
nop
jge 0x104e8fc
sub eax, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0103a999
mov dword [ebp - 4], eax
jnp 0x104e90e
add ecx, 0
cmp eax, edi
jl 0x104e923
pushf
cmc
jl 0x104e91a
popf
lea esi, [esi]
jo 0x104e920
jge 0x104e923
mov ecx, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.010399d6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x104e93d
xor eax, eax
jmp 0x104e97d
test ecx, 0x26b2
jns 0x104e950
xchg esi, esi
xchg esp, esp
jne 0x104e94b
xchg edi, eax
xchg edi, eax
js 0x104e950
mov eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.01036c45
add esp, 4
inc edx
dec edx
cmp esp, 0x2da1
cmp edi, dword [esp + 4]
jg 0x104e97a
pushf
shl esp, 0
jg 0x104e971
jns 0x104e973
popf
lea edx, [edx]
jle 0x104e97a
cmp edi, 0x5e5ffc55
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret