joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49231c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004aed4a
add esp, 0xc
cmp esi, dword [esp]
xor esi, 0
jle 0x492356
pushf
not ecx
not ecx
lea esp, [esp]
popf
mov edi, edi
xchg esi, esi
jg 0x492356
lcall 0x45c6, 0x51e845c6
in eax, dx
je 0x492325
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jnp 0x492401
test dword [esp], edi
lea ecx, [ecx]
jns 0x49240e
mov ecx, ecx
js 0x49240e
mov ecx, 0x1815e8b7
add byte [eax], al
call fcn.00493c28
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x492423
xor eax, eax
jmp 0x4924ad
test edx, esi
jb 0x492427
jg 0x49242f
mov ebx, ebx
jle 0x49242f
mov eax, 0xe8558d92
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0049b743
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004aed4a
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x492459
xor eax, eax
jmp 0x4924ad
rol esi, 0
jae 0x492474
pushf
nop
popf
lea ecx, [ecx + 0x2731]
lea ecx, [ecx - 0x2731]
jno 0x492471
jb 0x492474
xor eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0049e0a1
add esp, 4
rol ebx, 0x1c
ror ebx, 0x1c
cmp edx, esi
shl ebx, 0
jbe 0x4924a2
pushf
ror esi, 2
rol esi, 2
popf
jno 0x492499
xchg ecx, ebx
xchg ecx, ebx
xchg edi, eax
xchg edi, eax
ja 0x4924a2
mov edi, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x492c0d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004aed4a
add esp, 0xc
jae 0x492c28
push ebx
add ebx, 0x2223
ror ebx, 2
pop ebx
jb 0x492c4a
pushf
xchg esp, esp
jne 0x492c3b
xor edi, 0
jp 0x492c40
popf
nop
jnp 0x492c45
mov ecx, ecx
jae 0x492c4a
add eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
std
cld
cmp edx, dword [esp]
lea ecx, [ecx + 0x68fc]
sub ecx, 0x68fc
sub esp, 0
jl 0x492c97
xchg edi, ecx
xchg edi, ecx
jge 0x492c97
mov ecx, 0x80ec4d8a
jmp 0xec96b4a1
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00493c28
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x492d0c
xor eax, eax
jmp 0x492da8
add ebx, 0x6eb3
sub ebx, 0x6eb3
and esi, esi
jmp 0x492d1c
je 0x492d2f
pushf
jb 0x492d22
js 0x492d24
popf
jnp 0x492d28
xchg ecx, edi
xchg ecx, edi
jne 0x492d2f
mov esp, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0049b743
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004aed4a
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x492d59
xor eax, eax
jmp 0x492da8
test dword [esp + 8], edx
jns 0x492d84
pushf
rol edx, 0xe
ror edx, 0xe
call 0x492d6c
add esp, 4
add ebx, 0
ror eax, 0xa
ror eax, 0x16
popf
jne 0x492d7c
lea edi, [edi]
lea esp, [esp]
js 0x492d84
mov esi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0049e0a1
add esp, 4
jb 0x492d92
jns 0x492da1
jne 0x492d96
jbe 0x492d98
jns 0x492d9a
xchg esi, esi
js 0x492da1
mov ecx, 0x4d8b27ec
or byte [ecx - 1], dl
push ebp
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x492f5e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004aed4a
add esp, 0xc
add eax, dword [esp]
sub eax, dword [esp]
lea edi, [edi + 0x14e]
sub edi, 0x14e
add esp, 0
jp 0x492f9d
jbe 0x492f97
je 0x492f99
jnp 0x492f9d
call 0xec8ef5f8
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.00493c28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x493065
xor eax, eax
jmp 0x4930de
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049b743
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004aed4a
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x49308f
xor eax, eax
jmp 0x4930de
ja 0x493091
jns 0x493093
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
xchg esi, edx
xchg esi, edx
jo 0x4930ad
xchg ebx, ebx
je 0x4930a5
jb 0x4930a7
xchg edi, edi
jno 0x4930ad
call 0xe88ebc44
mov eax, dword [ebp - 0x18]
push eax
call fcn.0049e0a1
add esp, 4
jg 0x4930bb
mov eax, eax
ror edx, 0x16
rol edx, 0x16
jl 0x4930c5
jno 0x4930d3
lea esp, [esp]
jp 0x4930cc
lea esi, [esi]
xchg ebx, ebx
jo 0x4930d3
mov ebp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4935d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
shr edx, 0
jbe 0x4935e6
je 0x4935ef
jge 0x4935ea
jmp 0x4935ec
jne 0x4935ef
lcall 0x48, 0xb26c3d83
add dword [edi], ecx
test dword [ebx + 1], eax
add byte [eax], al
cmp dword [0x48b26c], 1
jne 0x49373f
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004aed4a
add esp, 0xc
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 6], 0x42
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x47
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0xd], 0x62
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 7], 0x66
jp 0x49363e
shr esp, 0
ja 0x49364e
js 0x493645
jge 0x493647
jae 0x493649
xchg esi, eax
xchg esi, eax
jbe 0x49364e
mov edi, 0x80f04d8a
jmp 0xf096be58
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
shr eax, 0
jp 0x4936b3
xchg ebx, esi
xchg ebx, esi
jp 0x4936da
pushf
jl 0x4936bd
cmp esp, 0x7b92
and eax, 0xffffffff
rol edx, 0
popf
lea edi, [edi + 0x62a5]
lea edi, [edi - 0x62a5]
jnp 0x4936da
mov esp, 0xb2903d83
dec eax
add byte [eax], al
cmp dword [0x48b290], 0
jne 0x4936eb
or eax, 0xffffffff
jmp 0x49392f
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x48b290]
push ecx
call fcn.0049b743
mov dword [ebp - 4], eax
cmp edi, 0x41f1
jl 0x493715
pushf
cmp edx, dword [esp]
or esp, 0
popf
xchg edi, edi
jge 0x493715
mov esp, 0x6a0c6a
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004aed4a
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x493735
mov eax, dword [ebp - 4]
mov dword [0x48b26c], eax
jmp 0x49373d
or eax, 0xffffffff
jmp 0x49392f
jmp 0x493748
mov ecx, dword [0x48b26c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
cmc
push ecx
add ecx, 0x5122
ror ecx, 0x1c
pop ecx
call fcn.0049375f
Function at 0x493a3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004aed4a
add esp, 0xc
jnp 0x493a57
cmp edi, edx
jnp 0x493a64
jp 0x493a5d
js 0x493a5f
jge 0x493a61
jp 0x493a64
mov esi, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
cmp edx, dword [esp + 8]
add ecx, 0
jne 0x493aad
js 0x493ab5
lea ebx, [ebx]
jns 0x493ab5
sub eax, 0xec4d8ae5
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.00493c28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x493b4c
xor eax, eax
jmp 0x493c1f
mov esp, esp
cmp esp, 0x111e
jns 0x493b6b
xchg esi, esi
lea ebx, [ebx + 0x6197]
lea ebx, [ebx - 0x6197]
xchg esp, esp
jae 0x493b68
js 0x493b6b
mov esp, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0049b743
mov dword [ebp - 0x18], eax
cmc
lea eax, [eax]
jns 0x493b92
pushf
jae 0x493b84
xor esp, 0
popf
jg 0x493b8b
je 0x493b8d
jle 0x493b8f
js 0x493b92
call 0xb34c00
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004aed4a
add esp, 0xc
jno 0x493ba4
xor edx, dword [esp]
xor edx, dword [esp]
nop
lea esi, [esi]
jno 0x493bc0
pushf
cmp esp, 0x542f
popf
ja 0x493bbb
jns 0x493bbd
jo 0x493bc0
mov ebp, 0xe87d83
cmp dword [ebp - 0x18], 0
jne 0x493bca
xor eax, eax
jmp 0x493c1f
push ecx
add ecx, 0x75ce
ror ecx, 3
pop ecx
lea edi, [edi]
test edi, edx
je 0x493bea
pushf
rol esp, 0
jo 0x493be2
nop
popf
jne 0x493be7
jne 0x493bea
lcall 0xaee8, 0x51e84d8b
movsb byte es:[edi], byte [esi]
add byte [eax], al
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0049e0a1
add esp, 4
call fcn.00493bfb
Function at 0x49b1bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004aed4a
add esp, 0xc
dec edx
inc edx
xor ebx, esi
xor ebx, esi
xor edi, 0xfec
xor edi, 0xfec
jge 0x49b1fd
xchg edi, edi
xchg esp, esp
lea edx, [edx + 0x70a8]
lea edx, [edx - 0x70a8]
jl 0x49b1fd
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
cld
lea esp, [esp]
test dword [esp], edi
test dword [esp], ebx
je 0x49b24f
xchg edi, ebx
xchg edi, ebx
mov ebx, ebx
jne 0x49b24f
mov edi, 0xe84d8a68
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.0049d842
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49b2db
xor eax, eax
jmp 0x49b348
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049b743
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004aed4a
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x49b346
xor eax, 0
jne 0x49b306
cld
jne 0x49b310
ja 0x49b30b
lea edx, [edx]
je 0x49b310
add eax, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.0049e0a1
add esp, 4
nop
sub eax, 0
nop
ja 0x49b339
jp 0x49b325
mov edi, edi
xchg ecx, ecx
lea eax, [eax + 0x4b97]
lea eax, [eax - 0x4b97]
jbe 0x49b339
mov eax, 0xc4d8ba7
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x49b348
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49ccf4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004aed4a
add esp, 0xc
and edi, edi
jbe 0x49cd1c
jns 0x49cd13
nop
jge 0x49cd16
jp 0x49cd18
ja 0x49cd1c
adc dword [ecx + 0x53e445c6], 0x70f245c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
push ecx
pop ecx
jae 0x49cd7b
pushf
lea edx, [edx]
cmp esp, 0x50b3
popf
js 0x49cd76
jae 0x49cd78
jb 0x49cd7b
add eax, 0x80e44d8a
jmp 0xe4975585
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.00493c28
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49ce29
xor eax, eax
jmp 0x49cea5
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0049b743
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004aed4a
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x49cea3
cmp edx, 0x7ab0
mov esp, esp
jae 0x49ce62
xchg edx, edx
xchg edx, edx
jp 0x49ce5f
jb 0x49ce62
jmp 0x52461bf1
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049e0a1
add esp, 4
mov ecx, ecx
rol ecx, 0xd
rol ecx, 0x13
jmp 0x49ce78
shr esp, 0
jge 0x49ce8a
pushf
xchg esi, esi
popf
jbe 0x49ce85
jp 0x49ce87
jl 0x49ce8a
mov edx, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x49cea5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x49d3a5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004aed4a
add esp, 0xc
xchg esi, esi
and eax, 0xffffffff
jle 0x49d3c5
je 0x49d3d0
jge 0x49d3c9
jbe 0x49d3cb
nop
jne 0x49d3d0
mov edx, 0xec45c6db
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
stc
nop
lea ecx, [ecx + 0x1a06]
sub ecx, 0x1a06
or ecx, 0
jnp 0x49d430
pushf
jge 0x49d417
ror esp, 0
or esp, 0
popf
js 0x49d421
lea edx, [edx + 0x7ada]
lea edx, [edx - 0x7ada]
jp 0x49d430
mov edx, 0x80ec4d8a
jmp 0xec975c3a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
rol esi, 5
ror esi, 5
lea ecx, [ecx + 0x2f5]
sub ecx, 0x2f5
and ecx, 0xffffffff
jne 0x49d4c2
pushf
call fcn.0049d4ae

Function at 0x49e12b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004aed4a
add esp, 0xc
ja 0x49e146
xchg edx, eax
xchg edx, eax
add esp, 0
xor eax, 0x67e0
xor eax, 0x67e0
jg 0x49e16b
pushf
ror edx, 0
lea esp, [esp]
ror esi, 0
je 0x49e164
popf
xchg esp, esp
jle 0x49e16b
mov edx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6d

Function at 0x49e896
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004aed4a
add esp, 0xc
cmp esi, dword [esp]
je 0x49e8c3
pushf
jle 0x49e8b8
popf
mov esp, esp
mov edx, edx
jp 0x49e8c0
jne 0x49e8c3
mov esi, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
mov edx, edx
jmp 0x49e8f7
jge 0x49e91f
pushf
jp 0x49e8fd
lea edi, [edi + 0x68eb]
lea edi, [edi - 0x68eb]
jbe 0x49e90b
call fcn.0049e910