joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4085eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x408619
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x408620
cmp ebx, dword [eax + 4]
jae 0x408620
xor eax, eax
jmp 0x408810
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x408631
xor eax, eax
inc eax
jmp 0x40880f
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x408647
cmp ecx, edx
jae 0x40878c
cmp dword [eax + 4], 0
je 0x408650
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x408638
cmp dword [ebp + 8], 0
je 0x408672
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40878c
cmp eax, esi
jae 0x40878c
mov eax, dword [0x1ccd908]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x408697
cmp dword [esi*4 + 0x1ccd910], edi
je 0x408790
inc esi
cmp esi, eax
jl 0x408685
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x1ccb0ac]
test eax, eax
je 0x40880c
cmp dword [ebp - 8], 0x1000000
jne 0x40880c
test byte [ebp - 0xc], 0xcc
je 0x408715
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40880c
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40880c
cmp word [eax + 0x18], 0x10b
jne 0x40880c
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40880c
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x408715
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x408715
test byte [ecx + 0x27], 0x80
jne 0x40878c
push 1
push 0x1ccd950
call dword [0x1ccb0a8]
test eax, eax
jne 0x408629
mov ecx, dword [0x1ccd908]
test ecx, ecx
mov edx, ecx
jle 0x408749
lea eax, [ecx*4 + 0x1ccd90c]
cmp dword [eax], edi
je 0x408749
dec edx
sub eax, 4
test edx, edx
jg 0x40873d
test edx, edx
jne 0x40877a
push 0xf
pop ebx
cmp ecx, ebx
jg 0x408756
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40876e
lea eax, [edx*4 + 0x1ccd910]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x40875c
cmp ecx, 0x10
jge 0x40877a
inc ecx
mov dword [0x1ccd908], ecx
push 0
push 0x1ccd950
call dword [0x1ccb0a8]
jmp 0x408629
xor eax, eax
jmp 0x40880f
test esi, esi
jle 0x408629
mov ebx, dword [0x1ccb0a8]
push 1
push 0x1ccd950
call ebx
test eax, eax
jne 0x408629
cmp dword [esi*4 + 0x1ccd910], edi
je 0x4087e6
mov eax, dword [0x1ccd908]
lea esi, [eax - 1]
test esi, esi
jl 0x4087d4
cmp dword [esi*4 + 0x1ccd910], edi
je 0x4087d0
dec esi
jns 0x4087c4
test esi, esi
jge 0x4087e4
cmp eax, 0x10
jge 0x4087df
inc eax
mov dword [0x1ccd908], eax
lea esi, [eax - 1]
jmp 0x4087e6
je 0x4087fe
xor ecx, ecx
test esi, esi
jl 0x4087fe
lea eax, [ecx*4 + 0x1ccd910]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4087ec
push 0
push 0x1ccd950
call ebx
jmp 0x408629
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x493510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049abe6
add esp, 0xc
inc esi
dec esi
je 0x493539
js 0x49352f
mov esp, esp
xchg ebx, ecx
xchg ebx, ecx
jne 0x493539
xor eax, 0xec45c62a
push eax
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
ror eax, 6
ror eax, 0x1a
jge 0x493578
jo 0x493573
jg 0x493575
jl 0x493578
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004a8bda
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4935ed
xor eax, eax
jmp 0x49366e
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0049918d
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0049abe6
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x49366c
xor edi, ebx
xor edi, ebx
rol edx, 0xe
ror edx, 0xe
je 0x493638
pushf
sub edi, 0
stc
push eax
add eax, 0x449d
ror eax, 0x15
pop eax
popf
je 0x493633
mov eax, eax
jne 0x493638
mov esi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004a26e9
add esp, 4
jne 0x493646
xor ecx, 0
jp 0x49365b
pushf
ror edi, 0
popf
jo 0x493654
jmp 0x493656
ja 0x493658
jnp 0x49365b
mov edx, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x49366e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x493677
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0049abe6
add esp, 0xc
xor edi, dword [esp]
xor edi, dword [esp]
cld
jle 0x4936a9
jge 0x4936a2
jo 0x4936a4
nop
jg 0x4936a9
mov ecx, 0xf045c6f6
dec esi
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
ja 0x4936db
lea eax, [eax + 0x4203]
lea eax, [eax - 0x4203]
or eax, eax
ja 0x4936ff
lea ebx, [ebx + 0x4e3f]
lea ebx, [ebx - 0x4e3f]
lea edi, [edi]
xchg ecx, ecx
jbe 0x4936ff
mov esi, 0xf04d8ae2
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
lea edi, [edi + 0xf8e]
lea edi, [edi - 0xf8e]
jne 0x49377e
pushf
jns 0x493771
and esi, 0xffffffff
and esp, 0xffffffff
popf
xchg edi, eax
xchg edi, eax
je 0x49377e
mov esi, 0xd32de8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.004a0ab0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x493790
xor eax, eax
jmp 0x4937c9
cmc
push ebx
pop ebx
xor ecx, dword [esp]
xor ecx, dword [esp]
jae 0x4937a6
xchg edx, edx
jge 0x49379f
jbe 0x4937a1
jb 0x4937a6
mov ebp, 0x458d023e
invalid
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049918d
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0049abe6
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494049
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049abe6
add esp, 0xc
or esi, 0
jnp 0x494087
pushf
add ecx, dword [esp]
sub ecx, dword [esp]
std
cld
cmp esp, 0x3459
popf
xchg ecx, ecx
mov ebx, ebx
jp 0x494087
mov ebx, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004a8bda
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x494152
xor eax, eax
jmp 0x4941e6
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049918d
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0049abe6
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x49417c
xor eax, eax
jmp 0x4941e6
lea edi, [edi + 0x676d]
sub edi, 0x676d
rol esi, 0x1e
rol esi, 2
cmp ebx, 0x444a
js 0x4941a5
pushf
jne 0x49419a
popf
jo 0x49419e
je 0x4941a0
lea ebx, [ebx]
jns 0x4941a5
add eax, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.004a26e9
add esp, 4
ror esp, 0
cld
cld
ja 0x4941db
pushf
jge 0x4941bc
popf
ja 0x4941c0
lea ebx, [ebx + 0x7af]
lea ebx, [ebx - 0x7af]
lea esi, [esi + 0x7d1d]
lea esi, [esi - 0x7d1d]
jbe 0x4941db
jmp 0x51558f6a
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x499280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049abe6
add esp, 0xc
rol esp, 0
cmp edx, dword [esp]
ja 0x4992b3
pushf
mov esp, esp
cmp esi, dword [esp]
xchg esp, esp
popf
js 0x4992ae
xchg edi, eax
xchg edi, eax
jbe 0x4992b3
mov esi, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
shr esp, 0
add ebx, 0
ja 0x4992f5
js 0x4992ed
jg 0x4992ef
jle 0x4992f1
jbe 0x4992f5
lcall 0xe980, 0xec4d8aaa
add dword [eax + 0x558aec4d], ecx
int1
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
jno 0x499357
push eax
pop eax
and edi, edi
js 0x49936d
pushf
add esi, dword [esp]
sub esi, dword [esp]
popf
nop
jbe 0x49936a
jns 0x49936d
add eax, 0xf868e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.004a8bda
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x499382
xor eax, eax
jmp 0x499428
xor ebx, 0x43b1
xor ebx, 0x43b1
cmp ecx, dword [esp]
lea eax, [eax + 0x17ee]
sub eax, 0x17ee
xchg edi, esi
xchg edi, esi
je 0x4993ad
pushf
xchg edi, edi
popf
lea ecx, [ecx]
jne 0x4993ad
or dword [ebp - 0x74af13bb], 0xe851f84d
sar ebp, cl
invalid
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0049918d
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0049abe6
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x499411
xchg esi, ecx
xchg esi, ecx
push edi
pop edi
stc
jo 0x4993dc
jo 0x4993f2
xchg esp, esp
xchg ecx, ecx
lea edx, [edx + 0x11ba]
lea edx, [edx - 0x11ba]
jno 0x4993f2
mov eax, 0xfc458bbd
mov eax, dword [ebp - 4]
push eax
call fcn.004a26e9
add esp, 4
push edx
pop edx
je 0x499408
jle 0x499404
jne 0x499408
xor dword [ebp + 0x51084d8b], 0xebfc55ff
pop ss
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x499428
jbe 0x499413
cmc
jl 0x499416
jo 0x499426
pushf
clc
popf
xchg esp, esp
lea ebx, [ebx]
mov esp, esp
jno 0x499426
lcall 0x8b5b, 0x5e5fc033
in eax, 0x5d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a1bcb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0049abe6
add esp, 0xc
and edx, edx
not eax
not eax
jg 0x4a1c08
pushf
lea eax, [eax + 0x2931]
sub eax, 0x2931
cmp esi, edx
jns 0x4a1bfd
popf
je 0x4a1c01
xchg edx, ecx
xchg edx, ecx
jle 0x4a1c08
call 0x542e61d2
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
lea ebx, [ebx + 0x7fd5]
lea ebx, [ebx - 0x7fd5]
jp 0x4a1c5e
and esp, 0xffffffff
xor ecx, dword [esp]
xor ecx, dword [esp]
jp 0x4a1c75
jno 0x4a1c6b
jne 0x4a1c6d
jp 0x4a1c6f
jnp 0x4a1c71
jnp 0x4a1c75
mov edx, 0xe44d8a36
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.004a8bda
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a1d23
xor eax, eax
jmp 0x4a1d9c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0049918d
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0049abe6
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4a1d9a
js 0x4a1d4b
cmp eax, dword [esp + 0xc]
rol esp, 0
test dword [esp + 0x10], edi
jne 0x4a1d60
lea esi, [esi]
js 0x4a1d5c
nop
je 0x4a1d60
mov edx, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.004a26e9
add esp, 4
js 0x4a1d6e
jno 0x4a1d70
ror edi, 0
and esi, esi
jp 0x4a1d81
mov esi, esi
jae 0x4a1d7b
ja 0x4a1d7d
jnp 0x4a1d81
call 0x189fa930
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4a1d9c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4a2199
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049abe6
add esp, 0xc
shr esp, 0
mov eax, eax
jmp 0x4a21b9
shl esp, 0
jge 0x4a21da
pushf
shl esp, 0
ror edx, 8
rol edx, 8
rol eax, 8
rol eax, 0x18
popf
jge 0x4a21d3
jnp 0x4a21d5
jge 0x4a21d7
jl 0x4a21da
mov ebp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
cmp edi, dword [esp]
sub esp, 0
lea ebx, [ebx + 0x3b0b]
sub ebx, 0x3b0b
jl 0x4a2227
mov edx, edx
jge 0x4a2227
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
jmp 0x4a2291
xor esi, 0xb3e
xor esi, 0xb3e
jb 0x4a22a4
mov esp, esp
jae 0x4a22a4
sub eax, 0x6931e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.004a8bda
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a22b9
xor eax, eax
jmp 0x4a2350
xor edi, dword [esp + 0xc]
xor edi, dword [esp + 0xc]
jae 0x4a22da
jb 0x4a22c5
jb 0x4a22c7
jmp 0x4a22c9
lea esi, [esi + 0x6287]
lea esi, [esi - 0x6287]
jb 0x4a22da
mov ebx, 0x4d8dfed7
call 0xf89fae32
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0049918d
mov dword [ebp - 4], eax
js 0x4a22ec
shl esp, 0
jge 0x4a22fb
mov esp, esp
jb 0x4a22f5
lea esp, [esp]
jl 0x4a22fb
jmp 0xb43069
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049abe6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4a2315
xor eax, eax
jmp 0x4a2350
ja 0x4a2317
jns 0x4a231f
jle 0x4a231b
js 0x4a231f
mov edi, 0xfc4d8bcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.004a26e9
add esp, 4
jge 0x4a232d
cmp edx, dword [esp + 4]
jp 0x4a234d
pushf
lea edx, [edx]
rol edi, 0x16
rol edi, 0xa
lea esp, [esp]
xor ebx, esi
xor ebx, esi
popf
lea edx, [edx]
js 0x4a234a
jnp 0x4a234d
mov ebx, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7efa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0049abe6
add esp, 0xc
rol ebx, 6
ror ebx, 6
jno 0x4a7f3b
lea eax, [eax + 0x724a]
lea eax, [eax - 0x724a]
lea esi, [esi + 0xdb1]
lea esi, [esi - 0xdb1]
lea ebx, [ebx]
mov esi, esi
jo 0x4a7f3b
call 0xf09045f1
inc esi
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
std
cld
not ebx
not ebx
mov edx, edx
add esi, 0x60a1
sub esi, 0x60a1
jo 0x4a7f99
pushf
test dword [esp], ecx
lea edx, [edx + 0x52ba]
sub edx, 0x52ba
popf
js 0x4a7f96
jno 0x4a7f99
sub eax, 0x80f04d8a
jmp 0xf09807a3
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
and ebx, 0xffffffff
ror edx, 0xe
rol edx, 0xe
mov edx, edx
jmp 0x4a8006
jp 0x4a800d
jns 0x4a800a
jnp 0x4a800d
mov ebx, 0xbc8e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.004a8bda
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a801f
xor eax, eax
jmp 0x4a8051
xor ecx, 0
ja 0x4a802e
xchg ebx, esi
xchg ebx, esi
xchg esi, esi
jbe 0x4a802e
add eax, 0xf0458d92
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049918d
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0049abe6
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b018e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049abe6
add esp, 0xc
not esi
not esi
jge 0x4b01c6
pushf
jp 0x4b01b1
lea ebx, [ebx]
push edx
add edx, 0xa64
ror edx, 0x12
pop edx
popf
js 0x4b01c2
nop
jl 0x4b01c6
mov ebp, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
and ebx, ebx
or esp, 0
rol edx, 0x10
rol edx, 0x10
and ebx, 0xffffffff
js 0x4b0212
mov eax, eax
xchg edi, edx
xchg edi, edx
ja 0x4b020e
jns 0x4b0212
mov edx, 0xec4d8a7d
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004a8bda
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b0287
xor eax, eax
jmp 0x4b031f
std
cld
nop
jbe 0x4b0299
pushf
jg 0x4b0290
popf
je 0x4b0294
xchg esp, esp
ja 0x4b0299
xor eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0049918d
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0049abe6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4b02c3
xor eax, eax
jmp 0x4b031f
ror ecx, 0x12
ror ecx, 0xe
nop
jg 0x4b02e1
je 0x4b02ce
jno 0x4b02d0
lea ecx, [ecx + 0x6691]
lea ecx, [ecx - 0x6691]
xchg esp, esp
jle 0x4b02e1
mov ecx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004a26e9
add esp, 4
jns 0x4b02ef
call 0x4b02f4
add esp, 4
add esp, 0
jno 0x4b02fc
jne 0x4b0318
pushf
sub edi, 0
popf
mov esp, esp
lea esi, [esi]
lea edx, [edx + 0xcbc]
lea edx, [edx - 0xcbc]
je 0x4b0318
xor eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4