joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4713ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00491fdc
add esp, 0xc
push edi
pop edi
test ecx, ebx
lea ebx, [ebx + 0x12f9]
lea ebx, [ebx - 0x12f9]
jo 0x4713d7
je 0x4713e8
pushf
mov ecx, ecx
popf
jae 0x4713e1
xchg ecx, eax
xchg ecx, eax
mov edx, edx
jne 0x4713e8
add eax, 0x48e445c6
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6d
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0xe], 0x66
je 0x47142e
or ecx, ecx
jo 0x471447
pushf
jo 0x471436
lea edx, [edx]
ror esp, 0
jnp 0x47143d
popf
jbe 0x471441
nop
jbe 0x471444
jno 0x471447
jmp 0x812b61d5
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1a]
sub dl, 1
mov byte [ebp - 0x1a], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x19]
sub dl, 1
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
xchg ebx, edi
xchg ebx, edi
sub eax, 0
jns 0x4714e6
mov edx, edx
jle 0x4714df
jb 0x4714e1
js 0x4714e6
mov edx, 0x59e8a744
rol dword [eax], cl
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 7], dh
call fcn.0047e844
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4714fb
xor eax, eax
jmp 0x4717b5
jl 0x4714fd
cmp esi, 0x3e91
mov esi, esi
jp 0x471507
je 0x47152a
pushf
call fcn.00471510

Function at 0x471e19
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00491fdc
add esp, 0xc
test dword [esp], edx
stc
ja 0x471e4b
pushf
test ecx, edi
ror edx, 0x1e
ror edx, 2
popf
ja 0x471e46
jne 0x471e48
jbe 0x471e4b
mov esp, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
call fcn.00471e80
Function at 0x472442
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
cmp esp, 0x65aa
cmp esi, eax
clc
xchg esi, ecx
xchg esi, ecx
jnp 0x47246d
pushf
xor esi, dword [esp]
xor esi, dword [esp]
popf
jmp 0x472466
xchg ecx, ebx
xchg ecx, ebx
jp 0x47246d
sub eax, 0x13ec45c7
add byte [eax], al
add bh, al
inc ebp
call fcn.0047247b
mov dword [ebp - 0x14], 0x13
mov dword [ebp - 0x18], 0
Function at 0x477cd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esp, 0x45b8
add byte [edi + 0x5e], bl
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00491fdc
add esp, 0xc
push edi
pop edi
and ecx, ecx
je 0x477cfa
lea edi, [edi]
jne 0x477cfa
mov edi, 0x45c6f7dc
call 0xf38d4349
jns 0x477cc9
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
inc ebp
cmc
inc edx
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
sub eax, 0
jle 0x477d3b
and ebx, ebx
jl 0x477d48
jno 0x477d41
xchg esi, esi
jnp 0x477d45
jge 0x477d48
sub eax, 0x80e84d8a
jmp 0xe8950552
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0047bd14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x477dd4
xor eax, eax
jmp 0x477e4f
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00492398
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00491fdc
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x477e4d
xor ebx, dword [esp + 0xc]
xor ebx, dword [esp + 0xc]
jno 0x477e19
pushf
lea edi, [edi + 0x3cb4]
lea edi, [edi - 0x3cb4]
popf
xchg edi, eax
xchg edi, eax
jo 0x477e19
mov edx, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.0049b8ce
add esp, 4
test esp, 0x1e3e
jl 0x477e3c
pushf
test ecx, esi
jp 0x477e33
popf
xchg edx, edi
xchg edx, edi
jge 0x477e3c
call 0x5157cbcb
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x477e4f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4797a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00491fdc
add esp, 0xc
push 0x21
push 0x466d60
lea ecx, [ebp - 0x138]
push ecx
call fcn.00470caa
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4798b0
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.00491fdc
add esp, 0xc
push 0xb
push 0x466d84
lea edx, [ebp - 0x138]
push edx
call fcn.00470caa
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4798a3
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00470caa
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4798b2
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x47e0fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00491fdc
add esp, 0xc
add edi, 0
add ebx, 0
neg edi
neg edi
jg 0x47e130
pushf
shl esp, 0
lea edx, [edx]
popf
jns 0x47e12c
nop
jle 0x47e130
mov esp, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
sub esp, 0
jp 0x47e17d
xchg ecx, edx
xchg ecx, edx
jne 0x47e173
xchg esi, ebx
xchg esi, ebx
mov esp, esp
jnp 0x47e17d
add eax, 0xe84d8a4c
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0047bd14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47e200
xor eax, eax
jmp 0x47e27d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00492398
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00491fdc
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x47e27b
lea esi, [esi + 0x13ad]
lea esi, [esi - 0x13ad]
xor esi, ebx
xor esi, ebx
test dword [esp], edi
clc
jno 0x47e244
xchg edi, eax
xchg edi, eax
jp 0x47e240
jo 0x47e244
add eax, 0xfc558b3b
mov edx, dword [ebp - 4]
push edx
call fcn.0049b8ce
add esp, 4
jbe 0x47e252
jne 0x47e266
pushf
jno 0x47e258
jne 0x47e25a
jns 0x47e25c
add edi, 0
popf
ja 0x47e263
je 0x47e266
ljmp 0x4d8b:0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x47e27d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x486996
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00491fdc
add esp, 0xc
mov ebx, ebx
jne 0x4869b3
ja 0x4869b5
je 0x4869d8
pushf
lea ebx, [ebx + 0x2d78]
sub ebx, 0x2d78
cmp esp, 0x781a
ror esi, 0x1c
ror esi, 4
popf
lea eax, [eax]
jne 0x4869d8
call 0x4928afa2
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
jmp 0x486a26
clc
jns 0x486a32
lea edx, [edx]
jne 0x486a2d
jl 0x486a2f
js 0x486a32
mov eax, 0x80e04d8a
jmp 0xe095f23c
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
call fcn.00486ad3
Function at 0x488758
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x466604], 1
jne 0x4888ce
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00491fdc
add esp, 0xc
jns 0x488780
je 0x488798
pushf
jp 0x488786
rol esp, 0
xchg ebx, edi
xchg ebx, edi
popf
jle 0x488791
je 0x488793
xchg ebx, ebx
jne 0x488798
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
not ecx
not ecx
jne 0x4887e7
pushf
jge 0x4887d2
add esp, 0
ror esi, 1
ror esi, 0x1f
js 0x4887dc
popf
jp 0x4887e0
mov edi, edi
jno 0x4887e4
je 0x4887e7
mov ecx, 0x80e84d8a
jmp 0xe8960ff1
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0047e844
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48885c
xor eax, eax
jmp 0x48892d
xchg esp, esp
xchg esi, ebx
xchg esi, ebx
or eax, 0
jle 0x48886c
mov ebx, ebx
jg 0x48886c
sub eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00492398
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00491fdc
add esp, 0xc
cmc
sub ecx, 0
test esp, 0x6aac
xor esp, 0
jb 0x4888b8
pushf
sub esi, 0
not ebx
not ebx
sub esp, 0
popf
lea esi, [esi + 0x6365]
lea esi, [esi - 0x6365]
jae 0x4888b8
mov edi, 0xf87d83
cmp dword [ebp - 8], 0
je 0x4888c8
mov eax, dword [ebp - 8]
mov dword [0x466604], eax
jmp 0x4888cc
xor eax, eax
jmp 0x48892d
jmp 0x4888d7
mov ecx, dword [0x466604]
mov dword [ebp - 8], ecx
test ecx, edx
rol edi, 2
ror edi, 2
rol edi, 0x12
rol edi, 0xe
jns 0x4888f2
ja 0x4888e9
mov esp, esp
mov ecx, ecx
jnp 0x4888ef
js 0x4888f2
jmp 0x8a40de81
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
shl esi, 0
shr edi, 0
sub eax, 0
test esi, edi
jo 0x488916
xchg ebx, ebx
lea edi, [edi + 0x7bc]
lea edi, [edi - 0x7bc]
jno 0x488916
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0049b8ce
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48aa23
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00491fdc
add esp, 0xc
nop
add ebx, dword [esp]
sub ebx, dword [esp]
ror edi, 0
ror esp, 0
jns 0x48aa5c
pushf
add edi, dword [esp]
sub edi, dword [esp]
popf
jp 0x48aa57
jg 0x48aa59
js 0x48aa5c
mov edi, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
jbe 0x48aa96
lea ebx, [ebx]
xchg edi, esi
xchg edi, esi
jl 0x48aaae
pushf
ror esp, 0
popf
jae 0x48aaa7
xchg ebx, eax
xchg ebx, eax
jbe 0x48aaab
jge 0x48aaae
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.0047bd14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48ab34
xor eax, eax
jmp 0x48abcb
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00492398
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00491fdc
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x48abc9
jns 0x48ab5c
mov eax, eax
add ebx, 0x1d04
sub ebx, 0x1d04
lea ecx, [ecx + 0x2bc4]
lea ecx, [ecx - 0x2bc4]
jae 0x48ab87
pushf
lea eax, [eax]
js 0x48ab7e
popf
jge 0x48ab82
jns 0x48ab84
jb 0x48ab87
add eax, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.0049b8ce
add esp, 4
clc
and esp, 0xffffffff
and esp, 0xffffffff
ror ebx, 0x11
ror ebx, 0xf
jle 0x48abb8
lea ebx, [ebx + 0x66cf]
lea ebx, [ebx - 0x66cf]
mov edi, edi
lea edi, [edi]
xchg esp, esp
jg 0x48abb8
xor edi, 0x5010458b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x48abcb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48c78b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x466608], 1
jne 0x48c8d3
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00491fdc
add esp, 0xc
jno 0x48c7b3
xchg ecx, edx
xchg ecx, edx
shr ecx, 0
xor ebx, ecx
xor ebx, ecx
jae 0x48c7cb
jp 0x48c7c2
jne 0x48c7c4
jb 0x48c7c6
jnp 0x48c7c8
jb 0x48c7cb
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
clc
shl esp, 0
jb 0x48c805
xchg esp, esp
nop
jge 0x48c802
jae 0x48c805
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0047e844
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48c872
mov eax, dword [ebp + 8]
jmp 0x48c931
ror edi, 0x17
ror edi, 9
cmp ebx, 0x4a31
jl 0x48c89b
pushf
neg esi
neg esi
xor esi, dword [esp]
xor esi, dword [esp]
xchg esp, esp
popf
xchg esi, eax
xchg esi, eax
xchg edx, esi
xchg edx, esi
jmp 0x48c898
jge 0x48c89b
mov edx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00492398
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00491fdc
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x48c8cc
mov edx, dword [ebp - 8]
mov dword [0x466608], edx
jmp 0x48c8d1
mov eax, dword [ebp + 8]
jmp 0x48c931
jmp 0x48c8db
mov eax, dword [0x466608]
mov dword [ebp - 8], eax
xchg esp, esp
stc
je 0x48c8e9
xchg esp, esp
lea esp, [esp]
jne 0x48c8e9
add eax, 0xf84d8b05
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
lea edx, [edx + 0x7966]
sub edx, 0x7966
jbe 0x48c906
xchg esp, esp
jne 0x48c901
lea eax, [eax]
ja 0x48c906
jmp 0x53451e95
mov edx, dword [ebp - 4]
push edx
call fcn.0049b8ce
add esp, 4
xchg ebx, ecx
xchg ebx, ecx
shr esi, 0
cmp edx, dword [esp]
jnp 0x48c92a
pushf
nop
popf
jne 0x48c925
jl 0x48c927
jp 0x48c92a
lcall 0x55ff, 0x5008458b
cld
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48ea44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00491fdc
add esp, 0xc
add esp, 0
cmp esi, 0x5f7d
jne 0x48ea7a
pushf
cmp ebx, edx
nop
stc
stc
popf
lea ebx, [ebx]
xchg ebx, ebx
jns 0x48ea77
je 0x48ea7a
sub eax, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
lea esi, [esi]
nop
rol esp, 0
dec edx
inc edx
jb 0x48eabe
pushf
sub esp, 0
popf
lea esi, [esi]
jae 0x48eab7
xchg edi, esi
xchg edi, esi
jae 0x48eabe
mov edi, 0x80f04d8a
jmp 0xf09672c8
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.0047bd14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48eb1e
xor eax, eax
jmp 0x48eb8d
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00492398
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00491fdc
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x48eb8b
dec edx
inc edx
mov esp, esp
jl 0x48eb4a
clc
jnp 0x48eb5c
pushf
xchg edi, edi
popf
jne 0x48eb55
jae 0x48eb57
ja 0x48eb59
jp 0x48eb5c
mov ebx, 0x51ec4d8b
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0049b8ce
add esp, 4
jne 0x48eb6a
and esp, 0xffffffff
add eax, dword [esp]
sub eax, dword [esp]
jg 0x48eb7e
lea edx, [edx]
jg 0x48eb79
jo 0x48eb7b
jle 0x48eb7e
call 0x5255410d
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x48eb8d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8