joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ecd5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x49ece9
jmp 0x49ee91
jl 0x49eceb
and edx, edx
jae 0x49ecfc
lea edi, [edi]
xchg esi, ecx
xchg esi, ecx
jbe 0x49ecf7
nop
jb 0x49ecfc
call 0x88f78c5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x48b3dc], edx
cmp eax, dword [esp + 4]
cmp ecx, dword [esp]
jp 0x49ed1d
jnp 0x49ed18
je 0x49ed1a
jnp 0x49ed1d
add eax, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x48b294
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x48b294], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x48b290], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x48ae30], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x48ae34], ecx
cmp edx, dword [esp + 0xc]
shl esp, 0
xor esp, 0
jbe 0x49ed60
mov esp, esp
jmp 0x49ed5c
ja 0x49ed60
mov edi, 0xf045c6d1
dec ebp
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
neg ecx
neg ecx
shr esp, 0
and esp, 0xffffffff
test ebx, esi
jno 0x49edb1
pushf
cmc
clc
lea ebx, [ebx]
popf
jge 0x49edac
jl 0x49edae
jo 0x49edb1
mov edx, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
xor ecx, 0
cmp esi, dword [esp + 4]
mov esp, esp
jp 0x49ee24
jnp 0x49ee41
pushf
jl 0x49ee2a
lea edi, [edi + 0xd98]
sub edi, 0xd98
popf
jp 0x49ee3a
jne 0x49ee3c
ja 0x49ee3e
jp 0x49ee41
mov ebp, 0xb2903d83
dec eax
add byte [eax], al
cmp dword [0x48b290], 0
je 0x49ee5e
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x48b290]
push eax
call fcn.0049b743
mov dword [0x48b3d8], eax
jge 0x49ee60
jl 0x49ee62
xor ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0xc]
jo 0x49ee81
xchg esp, esp
jg 0x49ee70
ja 0x49ee72
lea edi, [edi + 0x3251]
lea edi, [edi - 0x3251]
jno 0x49ee81
mov edi, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004aed4a
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a982e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004aed4a
add esp, 0xc
and esi, 0xffffffff
jge 0x4a984c
cmp esi, edi
je 0x4a986d
pushf
add esp, 0
shl eax, 0
popf
mov esi, esi
lea ebx, [ebx + 0x2cf7]
lea ebx, [ebx - 0x2cf7]
jmp 0x4a986a
jne 0x4a986d
mov ebp, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
shl esp, 0
std
cld
je 0x4a98bd
jae 0x4a98b6
jp 0x4a98b8
mov esp, esp
jne 0x4a98bd
mov esp, 0x80ec4d8a
jmp 0xec9820c7
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.0049d842
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a9951
xor eax, eax
jmp 0x4a99c7
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0049b743
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004aed4a
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4a99c5
shr esi, 0
jno 0x4a9987
mov ecx, ecx
mov esp, esp
jg 0x4a9982
jo 0x4a9987
mov edx, 0x4d8ba718
call 0x475c81df
invalid
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0049e0a1
add esp, 4
add eax, 0x1fb8
sub eax, 0x1fb8
test dword [esp], edx
test ebx, edx
ror esi, 0
js 0x4a99bc
pushf
jp 0x4a99ab
add esp, 0
jp 0x4a99b0
and esp, 0xffffffff
popf
jg 0x4a99b7
jbe 0x4a99b9
jns 0x4a99bc
jmp 0x5252ef4b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x4a99c7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a9d44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004aed4a
add esp, 0xc
cmp eax, dword [esp + 0x10]
cmp esp, 0x1924
jge 0x4a9d70
jg 0x4a9d7f
jl 0x4a9d74
jne 0x4a9d76
je 0x4a9d78
jne 0x4a9d7a
jle 0x4a9d7f
mov edx, 0x45c64a15
invalid
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
jns 0x4a9db1
lea edi, [edi]
js 0x4a9db5
jp 0x4a9db7
jb 0x4a9dd3
pushf
sub esp, 0
xchg esi, eax
xchg esi, eax
ror eax, 0x17
ror eax, 9
push ebx
pop ebx
popf
jo 0x4a9dcc
jbe 0x4a9dce
jg 0x4a9dd0
jae 0x4a9dd3
xor eax, 0x80f04d8a
jmp 0xf09825dd
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
ja 0x4a9e35
je 0x4a9e37
and esi, 0xffffffff
js 0x4a9e52
pushf
xor esi, edx
xor esi, edx
or edx, 0
mov edi, edi
popf
jae 0x4a9e4b
lea edx, [edx]
lea ebx, [ebx]
jns 0x4a9e52
mov edx, 0xff39ebe8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.0049d842
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a9e64
xor eax, eax
jmp 0x4a9ea9
xor esi, 0x2882
xor esi, 0x2882
rol ecx, 0x16
rol ecx, 0xa
jbe 0x4a9e86
pushf
dec ebx
inc ebx
inc ebx
dec ebx
mov eax, eax
popf
nop
ja 0x4a9e86
jmp 0x513ae417
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049b743
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004aed4a
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aa949
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004aed4a
add esp, 0xc
cmc
inc edi
dec edi
jmp 0x4aa967
jns 0x4aa974
xchg ebx, esi
xchg ebx, esi
lea esp, [esp]
nop
js 0x4aa974
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
test edx, ecx
add eax, dword [esp]
sub eax, dword [esp]
xchg edx, edx
ja 0x4aa9eb
pushf
push edi
add edi, 0xe94
ror edi, 0x17
pop edi
cmc
popf
lea eax, [eax + 0x5fb6]
lea eax, [eax - 0x5fb6]
js 0x4aa9e6
ja 0x4aa9e8
jbe 0x4aa9eb
mov ecx, 0x80e84d8a
jmp 0xe89831f5
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.00493c28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4aaa94
xor eax, eax
jmp 0x4aab25
jne 0x4aaa96
jbe 0x4aaa9f
nop
jbe 0x4aaa9b
ja 0x4aaa9f
ljmp 0x8b50:0xe8458d69
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049b743
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004aed4a
add esp, 0xc
jge 0x4aaac1
call 0x4aaac6
lea esp, [esp + 4]
xchg ecx, ebx
xchg ecx, ebx
ja 0x4aaadb
jl 0x4aaad2
jo 0x4aaad4
jae 0x4aaad6
jo 0x4aaad8
jbe 0x4aaadb
sub eax, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x4aaae5
xor eax, eax
jmp 0x4aab25
cmp edi, 0x51a3
lea ebx, [ebx + 0x7ecf]
lea ebx, [ebx - 0x7ecf]
jl 0x4aaaf9
jo 0x4aab02
jae 0x4aaafd
jb 0x4aaaff
jno 0x4aab02
call 0x512ef091
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0049e0a1
add esp, 4
rol esp, 0
cmc
je 0x4aab22
pushf
and edx, 0xffffffff
popf
jge 0x4aab1d
jb 0x4aab1f
jne 0x4aab22
mov edx, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aace8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x48b274], 1
jne 0x4aae7b
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004aed4a
add esp, 0xc
shl ebx, 0
jle 0x4aad18
jbe 0x4aad15
jg 0x4aad18
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
call 0x4aad4d
lea esp, [esp + 4]
ror ebx, 8
ror ebx, 0x18
lea ecx, [ecx + 0x577d]
lea ecx, [ecx - 0x577d]
lea eax, [eax + 0x79f4]
lea eax, [eax - 0x79f4]
jge 0x4aad89
pushf
add esp, 0
js 0x4aad78
popf
lea edi, [edi + 0x701b]
lea edi, [edi - 0x701b]
jl 0x4aad89
add eax, 0x80e84d8a
jmp 0xe8983593
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00493c28
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4aadfe
xor eax, eax
jmp 0x4aaef6
xchg ebx, edi
xchg ebx, edi
shr esp, 0
je 0x4aae25
pushf
add edi, 0x3b1a
sub edi, 0x3b1a
stc
and edx, edx
cmp esp, 0x3e76
popf
jnp 0x4aae22
jne 0x4aae25
add eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0049b743
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004aed4a
add esp, 0xc
lea esp, [esp]
lea edi, [edi + 0xd59]
lea edi, [edi - 0xd59]
cmp esp, 0x37fa
shl esp, 0
je 0x4aae65
jb 0x4aae61
jne 0x4aae65
ljmp 0x7400:0xf87d834e
cmp dword [ebp - 8], 0
je 0x4aae75
mov eax, dword [ebp - 8]
mov dword [0x48b274], eax
jmp 0x4aae79
xor eax, eax
jmp 0x4aaef6
jmp 0x4aae84
mov ecx, dword [0x48b274]
mov dword [ebp - 8], ecx
neg eax
neg eax
jg 0x4aae8a
jl 0x4aaebe
pushf
je 0x4aae90
xor ecx, dword [esp]
xor ecx, dword [esp]
xor esi, dword [esp]
xor esi, dword [esp]
cmp eax, dword [esp]
popf
lea ecx, [ecx + 0x62cc]
lea ecx, [ecx - 0x62cc]
lea ecx, [ecx + 0x114d]
lea ecx, [ecx - 0x114d]
jnp 0x4aaebb
jge 0x4aaebe
lcall 0xfc55, 0x89f8558b
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jne 0x4aaec6
jb 0x4aaedf
pushf
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
add edi, 0
popf
jo 0x4aaed9
lea esp, [esp]
jae 0x4aaedf
jmp 0x5146f46e
mov eax, dword [ebp - 4]
push eax
call fcn.0049e0a1
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ac900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004aed4a
add esp, 0xc
sub ecx, 0
jnp 0x4ac934
pushf
lea eax, [eax + 0x5fb5]
sub eax, 0x5fb5
js 0x4ac92d
popf
xchg ebx, ebx
jp 0x4ac934
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
neg ebx
neg ebx
test dword [esp], edi
jl 0x4ac98c
pushf
cmp edi, 0x49df
popf
jae 0x4ac985
jae 0x4ac987
mov esp, esp
jge 0x4ac98c
mov ecx, 0x80e84d8a
jmp 0xe8985196
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0049d842
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4aca18
xor eax, eax
jmp 0x4aca92
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049b743
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004aed4a
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x4aca90
jp 0x4aca40
lea esi, [esi]
je 0x4aca4a
jge 0x4aca46
jne 0x4aca4a
mov edx, 0xf8458b24
mov eax, dword [ebp - 8]
push eax
call fcn.0049e0a1
add esp, 4
rol esp, 0
cmp edi, dword [esp + 0x10]
je 0x4aca7f
lea edi, [edi + 0x6cb]
lea edi, [edi - 0x6cb]
jp 0x4aca6d
lea eax, [eax + 0x21ee]
lea eax, [eax - 0x21ee]
jmp 0x4aca7b
jne 0x4aca7f
add eax, 0x104d8b0a
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x4aca92
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ad078
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004aed4a
add esp, 0xc
cmp ebx, dword [esp]
call 0x4ad099
lea esp, [esp + 4]
je 0x4ad0a6
jnp 0x4ad0a1
js 0x4ad0a3
jne 0x4ad0a6
mov eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
lea edx, [edx]
jne 0x4ad0f6
pushf
lea esp, [esp]
xchg edx, esi
xchg edx, esi
jl 0x4ad0e5
popf
lea eax, [eax + 0x5ad7]
lea eax, [eax - 0x5ad7]
je 0x4ad0f6
mov edx, 0x80f04d8a
jmp 0xf0985900
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
cld
jb 0x4ad177
pushf
sub esp, 0
add esi, 0x3a91
sub esi, 0x3a91
xor eax, dword [esp]
xor eax, dword [esp]
popf
jp 0x4ad174
jae 0x4ad177
lcall 0x89ff, 0xfe6aace8
inc ebp
cld
call fcn.00493c28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4ad189
xor eax, eax
jmp 0x4ad1be
sub edi, 0
and edx, edx
lea eax, [eax]
jno 0x4ad19b
jmp 0x4ad194
jb 0x4ad196
jae 0x4ad198
jo 0x4ad19b
mov ecx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049b743
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004aed4a
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ad596
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004aed4a
add esp, 0xc
rol edi, 1
ror edi, 1
shl esp, 0
xchg ebx, ebx
push eax
add eax, 0x50c7
ror eax, 0x1e
pop eax
jns 0x4ad5d0
lea esp, [esp]
jae 0x4ad5c9
jns 0x4ad5cb
xchg ecx, ecx
js 0x4ad5d0
add esi, 0xc647e845
inc ebp
inc esi
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
and ecx, ecx
mov ecx, ecx
jg 0x4ad617
jns 0x4ad610
xchg edi, edi
mov esi, esi
jle 0x4ad617
mov ecx, 0x80e84d8a
jmp 0xe8985e21
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0049d842
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ad69d
xor eax, eax
jmp 0x4ad71e
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0049b743
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004aed4a
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4ad71c
and esp, 0xffffffff
xor edi, 0
xor esp, 0
jno 0x4ad6d7
jns 0x4ad6d0
jne 0x4ad6d2
jo 0x4ad6d7
xor eax, 0x558baada
cld
mov edx, dword [ebp - 4]
push edx
call fcn.0049e0a1
add esp, 4
xor ebx, 0x3a36
xor ebx, 0x3a36
jo 0x4ad6f1
sub esp, 0
js 0x4ad707
pushf
add ebx, dword [esp]
sub ebx, dword [esp]
popf
jl 0x4ad702
jmp 0x4ad704
jns 0x4ad707
xor eax, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4ad71e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10