joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428830
Capabilities:
Check for software breakpoints

Disassembly:
sti
cmp dword [edi], 4
mov ebp, 0x74663633
dec esi
std
sub ecx, edi
cmp esi, dword [0xbb8b127f]
and al, 0xe3
push eax
add byte [0xaf0523], dl
inc edi
add edi, edi
add bh, bh
call [ebp - 0x60]
pop esi
movsb byte es:[edi], byte [esi]
add esp, 8
cmp al, 0xcc
iretd
xor ecx, esp
xor ecx, esp
xor ecx, esp
xor ecx, esp
xor esi, dword [ebx]
xor ecx, esp
xor ecx, esp
cdq
xor esi, dword [esi]
push ebx
test eax, 0x24747457
adc byte [edx - 0x2b98b9a], ch
mov bh, 0x66
jp 0x42881c
adc dword [ebx + 0x66fe6972], 0x3999dd74
xchg ecx, eax
add al, byte [ecx + 0x3ebf0f52]
invalid

Function at 0x428e87
Capabilities:
Encode data using xor

Disassembly:
add bh, bh
add bh, bh
push edi
jl 0x428f0a
fninit
inc byte [ebx + 0x1500ff2c]
invalid
in eax, dx
pushal
inc dword [eax]
jl 0x428f15
xchg ebx, eax
insd dword es:[edi], dx
scasd eax, dword es:[edi]
add bh, bh
xor eax, 0xef24a339
je 0x428edb
push ebx
pop ss
pop ebp
stc
add byte [eax], al
cmp dword [ebx], 4
xchg ebp, eax
add byte [ecx + 1], al
inc dword [eax]
call dword [ebp - 0x58]
add dl, ch
mov al, 8
push eax
call dword [edi + 0x5e]
movsb byte es:[edi], byte [esi]
outsb dx, byte [esi]
push eax
call dword [eax - 1]
adc eax, 0xaffdef
je 0x428ed2
mov byte [0x7c5ba15f], al
cmp edi, ebx
ret
int3
Function at 0x42a608
Capabilities:
Check for software breakpoints

Disassembly:
xor ecx, esp
xor ecx, esp
xor ecx, esp
xor ecx, esp
xor ecx, esp
xor esi, dword [ebx]
xor ecx, esp
je 0x42a64e
inc esp
fisttp dword [eax]
jl 0x42a5fa
test dword [ebx + 0x1d7e3207], 0xdb4438
inc byte [eax]
inc dword [eax]
cdq
sub eax, 0x8b99ffcd
mov bl, 0x24
jbe 0x42a66c
fild dword [ecx + ebx*4]
mov dword [esp - 7], ecx
jmp 0x42a609
stc
mov dword [ebx + 0x7699ff24], edi
inc esp
fild dword [esp + esi*2]
inc esp
fild dword [eax]
je 0x42a6b2
fild dword [ebx + eax*4]
invalid
invalid
fisttp dword [eax]
jl 0x42a706
std
add byte [ebx + 0x5c11708], cl
add bh, bh
xor edi, dword [edi]
ret
test dword [ebx + 0x48741813], 0x17ad51fd
mov bh, 0xff
add bh, bh
jbe 0x42a706
fist dword [eax]
jl 0x42a68a
test dword [ecx + 0x52f32454], 0x4b9e8af
inc dword [eax]
jbe 0x42a718
invalid
jne 0x42a725
pop ss
pop ds
sti
add bh, bh
mov esi, dword [ebx - 0x447614dc]
invalid
mov eax, dword [0x7c0000ff]
invalid
lodsb al, byte [esi]
cmovo eax, dword [ebx + ebx*8 + 0xc]
push eax
inc esp
fisttp dword [eax + edx*2]
call 0x141a95f
jl 0x42a6e2
inc ebx
add bh, bh
add byte [esp + eax*8 - 5], bh
sti
xor edi, dword [edi]
cmp dword [ebx], 0xffffffe7
cmp al, 0xe8
and dword [ebx], eax
inc dword [eax]
call 0x141aa4b
je 0x42a778
fist dword [esi + esi*2]
inc esp
and al, 0
je 0x42a778
fist dword [eax]
scasb al, byte es:[edi]
mov dword [ebx + 0x7450f724], ebp
stosd dword es:[edi], eax
fisttp dword [eax]
je 0x42a786
fisttp dword [edi + ebp*4]
push edx
pop ss
sbb eax, 0x83ffff00
cmp edx, dword [eax]
jp 0x42a710
mov edx, dword [edx]
je 0x42a7a0
fisttp dword [eax]
je 0x42a713
fisttp dword [edi + ebp*4]
push ecx
pop ss
daa
cld
add bh, bh
cmp dword [ebx], 8
xor eax, eax
jl 0x42a72c
out 0xc3, eax
xor ecx, esp
xor ecx, esp
xor ecx, esp
xor esi, dword [ebx]
xor ecx, esp
xor ecx, esp
xor ecx, esp
je 0x42a7be
fild dword [edx + edi*2]
sal byte [ebx + ecx + 0x7c], 0xf8
add byte [ecx + edi*8 - 0x48], dh
inc byte [eax]
inc dword [eax]
cmp al, 0xcc
aas
ret
retf
mov eax, dword [ebx + ebx*8 + 0x10]
scasd eax, dword es:[edi]
push edi
pop ss
invalid
cmp esi, edi
je 0x42a7b2
test al, 0xe8
ffreep st(5)
test byte [eax], 0x7c
invalid

Function at 0x42a960
Capabilities:
Check for software breakpoints

Disassembly:
add bh, bh
add byte [ebx - 0x1751d149], cl
mov dword [0x8300f6c3], eax
invalid

Function at 0x42a9d8
Capabilities:
Check for software breakpoints

Disassembly:
xor esi, dword [ebx]
pop esi
add byte [ecx + 0x1750ff50], dl
cmc
test byte [edi], 0xff
add esp, 4
cmp al, 0xcc
jl 0x42a9c6
out dx, eax
add edx, 0
xchg ecx, eax
push eax
invalid

Function at 0x42b0d8
Capabilities:
Check for software breakpoints

Disassembly:
test eax, 0xf7248b8b
mov edi, dword [ecx - 0x321750f4]
add cl, bh
add byte [ecx - 0xff0639], bl
cmp dword [ebx], 4
cmp byte [esi + 0xc], al
add bh, bh
add bh, bh
pop esi
cmp al, 0xcc
Function at 0x431bb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [esp + 0x5c4], bl
mov byte [esp + 0x5c5], al
mov dword [esp + 0x5c6], ebp
mov dword [esp + 0x5bb], 0xa
mov dword [esp + 0x5ca], eax
mov byte [esp + 0x5d2], dl
mov byte [esp + 0x5d3], bl
mov byte [esp + 0x5d4], al
mov dword [esp + 0x5bf], 0x4b3240
mov byte [esp + 0x5c3], 8
mov dword [esp + 0x5ce], 0x4b4c40
mov dword [esp + 0x5d5], 0x50252c
mov dword [esp + 0x5dd], 0x4b3c10
mov byte [esp + 0x5e1], 8
mov dword [esp + 0x5d9], ecx
mov byte [esp + 0x5e2], cl
mov dword [esp + 0x5e4], 0x5024dc
mov byte [esp + 0x5e3], al
mov byte [esp + 0x5f1], bl
mov byte [esp + 0x5f2], al
mov dword [esp + 0x5f3], ebp
mov dword [esp + 0x5e8], 0xa
invalid
test byte [esp + ebp*8], ah
invalid
add byte [eax], al
invalid

Function at 0x431ca8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, 0xe
push es
add byte [eax], al
mov byte [esp + 0x60f], bl
mov byte [esp + 0x610], al
mov dword [esp + 0x611], edi
mov dword [esp + 0x615], ecx
mov dword [esp + 0x5f7], 0xa
mov byte [esp + 0x61d], dl
mov byte [esp + 0x61e], bl
mov byte [esp + 0x61f], al
mov dword [esp + 0x620], edi
mov dword [esp + 0x5fb], 0x45a4c0
mov dword [esp + 0x60a], 0x45a510
mov dword [esp + 0x624], ecx
mov byte [esp + 0x62d], cl
mov dword [esp + 0x619], 0x45a580
mov byte [esp + 0x62e], al
mov dword [esp + 0x633], eax
mov dword [esp + 0x628], 0x4b7210
mov byte [esp + 0x62c], 0x63
mov byte [esp + 0x63c], bl
mov byte [esp + 0x63d], al
mov dword [esp + 0x62f], 0x502568
mov dword [esp + 0x637], 0x4bd470
mov byte [esp + 0x63b], 5
mov dword [esp + 0x642], ecx
mov byte [esp + 0x64b], bl
mov dword [esp + 0x63e], 0x50252c
mov byte [esp + 0x64c], al
mov dword [esp + 0x651], ecx
mov dword [esp + 0x646], 0x4b8290
mov byte [esp + 0x64a], 5
mov byte [esp + 0x65a], cl
mov byte [esp + 0x65b], al
mov dword [esp + 0x64d], 0x5024d8
invalid
test byte [edx*2 - 0x7ffffffa], ah
invalid

Function at 0x431e68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [esp + 0x696], bl
mov byte [esp + 0x697], bl
mov dword [esp + 0x698], esi
mov dword [esp + 0x69c], eax
mov dword [esp + 0x682], 0x4b76d0
mov byte [esp + 0x6a4], dl
mov byte [esp + 0x6a5], bl
mov byte [esp + 0x6a6], al
mov dword [esp + 0x6a7], edi
mov byte [esp + 0x686], 0xa
mov dword [esp + 0x691], 0x4b4820
mov dword [esp + 0x6ab], eax
mov byte [esp + 0x6b4], bl
mov byte [esp + 0x6b5], bl
mov dword [esp + 0x6b6], edi
mov dword [esp + 0x6a0], 0x4b4ce0
mov dword [esp + 0x6af], 0x4b78c0
mov dword [esp + 0x6ba], eax
mov byte [esp + 0x6c3], bl
mov byte [esp + 0x6b3], 0xa
mov byte [esp + 0x6c4], al
mov dword [esp + 0x6c9], ecx
mov dword [esp + 0x6be], 0x4353c0
mov byte [esp + 0x6c2], 0x63
invalid

Function at 0x432018
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx], cl
mov dword [esp + 0x710], 0x5024f0
mov dword [esp + 0x714], eax
adc al, 7
add byte [eax], al
Function at 0x4320c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, 0x3d
pop es
add byte [eax], al
inc eax
and eax, 0x84c70050
and al, 0x45
pop es
add byte [eax], al
push eax
dec ecx
dec ebx
add dh, al
test byte [ecx + ecx*2], ah
pop es
add byte [eax], al
or eax, 0x50248489
pop es
add byte [eax], al

Function at 0x432128
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop es
add byte [eax], al
or eax, 0x69248488
pop es
add byte [eax], al

Function at 0x432208
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [esp + 0x7a6], 0x502548
mov byte [esp + 0x7a5], al
mov dword [esp + 0x7aa], 0xa
mov byte [esp + 0x7b3], cl
mov byte [esp + 0x7b4], al
invalid
test byte [esi + ebp*4], ah
pop es

Function at 0x432238
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
push eax
dec eax
dec ebx
add dh, al
test byte [edx + esi*4], ah
pop es
add byte [eax], al
arpl word [ecx + 0x7b92484], cx
add byte [eax], al

Function at 0x4322a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop es
add byte [eax], al
popal
mov dword [esp + 0x7d7], eax
mov byte [esp + 0x7e0], bl
mov dword [esp + 0x7d3], 0x502558
mov byte [esp + 0x7e1], al
mov dword [esp + 0x7e6], edx
mov dword [esp + 0x7db], 0x4b79c0
mov byte [esp + 0x7df], 0xa
mov byte [esp + 0x7ef], bl
mov byte [esp + 0x7f0], al
mov dword [esp + 0x7f1], edi
mov dword [esp + 0x7f5], ecx
invalid
test byte [edx], ah
pop es
invalid

Function at 0x432308
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [0x84c70050], ch
and al, 0xea
pop es
add byte [eax], al
loopne 0x432358
dec ebp
add byte [eax + 0x7fe249c], cl
add byte [eax], al
invd
add byte [eax], al
Function at 0x4325e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, 0xcb
or byte [eax], al
add byte [eax - 0x39ffb48e], dh
test byte [edi + ecx*8], ah
or byte [eax], al
add byte [edx], cl

Function at 0x4329e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc byte [esi + 0x4b], cl
add byte [eax + 0xa0c249c], cl
add byte [eax], al
mov dword [esp + 0xa11], eax
mov byte [esp + 0xa19], al
mov byte [esp + 0xa1a], bl
mov byte [esp + 0xa1b], al
mov dword [esp + 0xa1c], ebp
mov dword [esp + 0xa20], eax
mov dword [esp + 0xa0d], 0x502534
mov byte [esp + 0xa29], bl
mov byte [esp + 0xa2a], al
mov dword [esp + 0xa2b], esi
mov dword [esp + 0xa2f], eax
mov dword [esp + 0xa15], 0x4bc460
mov dword [esp + 0xa24], 0x4b7510
mov byte [esp + 0xa38], bl
mov byte [esp + 0xa39], al
mov dword [esp + 0xa3a], esi
mov dword [esp + 0xa3e], eax
mov byte [esp + 0xa28], 0xa
invalid
test byte [ebx + esi], ah
or al, byte [eax]
add byte [eax + 0x6d], dh
dec ebx

Function at 0x432de8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [eax*2 + 0xe00000b], ah
mov dword [esp + 0xb48], 0x5024fc
mov dword [esp + 0xb4c], ecx
mov byte [esp + 0xb56], al

Function at 0x4c0348
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
test byte [0x503dbc], 8
push ebx
push esi
push edi
jne 0x4c03f7
or dword [0x503dbc], 8
push 0x503dc0
lea eax, [ebp - 0x10]
and dword [0x503dbc], 0xffffffef
push 0x16
push 0x15
push 0x5f0
push 9
push eax
call fcn.0048e618
add esp, 0x18
cmp byte [ebp - 0x10], 0x30
je 0x4c0392
mov byte [ebp - 0x10], 0x31
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x10]
push eax
push 0x16
push 0x15
push 0x5f0
call fcn.0048e698
add esp, 0x10
cmp byte [ebp - 0x10], 0x30
je 0x4c03f7
lea eax, [ebp - 0x34]
push eax
call dword [0x50fab0]
cmp dword [ebp - 0x1c], 0x1e6
jbe 0x4c03f7
mov dword [ebp - 4], 0
pushaw
mov edx, 0
mov eax, 0
cpuid
cmp eax, 1
jl 0x4c03e8
mov eax, 1
cpuid
mov dword [ebp - 4], edx
popaw
test byte [ebp - 2], 0x80
je 0x4c03f7
or dword [0x503dbc], 0x10
mov eax, dword [0x503dbc]
pop edi
and eax, 0x10
pop esi
shr eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c2d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.004c4398
mov dword [esi + 0x2e], 0
add esp, 0xc
mov eax, dword [esi + 0x78]
push eax
call dword [case.0x4e0926.42]
mov dword [esp + 0x10], eax
push 0x4ab100
mov eax, dword [esi + 0x7c]
mov edx, dword [esp + 0x14]
push eax
xor edi, edi
push edx
call fcn.004c1f88
add esp, 0xc
mov edx, dword [esi + 0x7c]
test edx, edx
jle 0x4c2da0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
cmp dword [eax], ecx
jge 0x4c2da0
add eax, 8
inc edi
cmp edi, edx
jl 0x4c2d90
cmp edi, edx
jl 0x4c2db8
mov eax, dword [esi + 0x78]
push eax
call dword [0x50fadc]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x44
ret
mov eax, dword [esi + 0x10]
sub eax, dword [esp + 0x1c]
cmp eax, 0x40000
jl 0x4c2dcb
mov eax, 0x40000
push eax
push 0x200
call fcn.0049b308
mov dword [esp + 0x20], eax
add esp, 8
test eax, eax
jne 0x4c2dee
mov dword [esp + 0x14], 8
jmp 0x4c2f7d
mov edx, dword [esi + 8]
xor ebx, ebx
lea eax, [esi + 4]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], ebx
mov ecx, dword [eax]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x3c], ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
lea ebp, [ecx + edi*8]
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x34], edx
mov eax, dword [ebp]
push ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebx
call dword [case.0x4e0926.42]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
push ecx
call fcn.0049b1d8
mov dword [esp + 0x54], eax
add esp, 4
mov dword [0x50972c], ebx
mov ebx, edi
cmp dword [esi + 0x7c], edi
jle 0x4c2ea7
add ebp, 4
cmp dword [esp + 0x14], 0
jne 0x4c2ec5
mov eax, dword [ebp - 4]
add eax, dword [ebp]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x7c]
dec eax
cmp eax, ebx
jle 0x4c2e7c
mov eax, dword [ebp + 4]
jmp 0x4c2e7f
mov eax, dword [esi + 0x10]
sub eax, dword [esp + 0x38]
add ebp, 8
inc ebx
mov dword [esp + 0x40], eax
lea eax, [esp + 0x28]
push eax
push esi
call fcn.004c2f98
add esp, 8
mov eax, dword [0x50972c]
cmp dword [esi + 0x7c], ebx
mov dword [esp + 0x14], eax
jg 0x4c2e5e
cmp dword [esp + 0x14], 0
jne 0x4c2ec5
lea eax, [esp + 0x28]
push eax
push esi
call fcn.004c3058
add esp, 8
mov eax, dword [0x50972c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push eax
call dword [0x50fadc]
mov eax, dword [esp + 0x18]
push eax
call fcn.0049b018
add esp, 4
cmp dword [esp + 0x14], 0
jne 0x4c2f7d
lea ebx, [edi + 1]
cmp dword [esi + 0x7c], ebx
jle 0x4c2f07
mov edx, dword [esp + 0x10]
lea eax, [edx + ebx*8 + 4]
mov ecx, dword [eax - 8]
add eax, 8
inc ebx
add dword [eax - 8], ecx
cmp dword [esi + 0x7c], ebx
jg 0x4c2ef8
mov eax, dword [esi + 0x64]
xor ebx, ebx
push eax
call dword [case.0x4e0926.42]
cmp dword [esi + 0x2a], ebx
jle 0x4c2f55
add eax, 0x18
Function at 0x4c4698
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x10]
mov eax, esi
shr eax, 0x10
movsx ecx, ax
lea eax, [ecx + ecx*8]
shl eax, 4
lea edi, [eax + 0x509730]
test byte [edi + 0x50], 2
je 0x4c46c6
mov eax, 0x1396
pop edi
pop esi
add esp, 4
ret
mov eax, dword [edi + 0x64]
push eax
push esi
push edi
call fcn.004c4c88
mov dword [esp + 0x14], eax
add esp, 0xc
test eax, eax
jge 0x4c46f3
lea eax, [esp + 8]
mov ecx, dword [esp + 8]
push eax
push ecx
push edi
call fcn.004c4b58
add esp, 0xc
test eax, eax
jne 0x4c4749
mov eax, dword [edi + 0x64]
mov ecx, dword [esp + 8]
add ecx, ecx
mov edx, dword [eax]
lea eax, [ecx + ecx*2]
lea ecx, [eax + eax*4]
add ecx, edx
mov edx, dword [esp + 0x14]
movzx eax, si
mov dword [ecx], eax
mov si, word [edx + 0x1c]
mov word [ecx + 0x1c], si
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x18], eax
mov edi, dword [edx + 8]
mov dword [ecx + 8], edi
mov si, word [edx + 4]
mov word [ecx + 4], si
mov ax, word [edx + 6]
mov word [ecx + 6], ax
mov al, byte [edx + 0x12]
mov byte [ecx + 0x12], al
xor eax, eax
mov si, word [edx + 0x10]
mov word [ecx + 0x10], si
mov edx, dword [edx + 0xc]
mov dword [ecx + 0xc], edx
pop edi
pop esi
add esp, 4
ret
Function at 0x4da8a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [esp + esi*8], ah
add byte [eax], al
add byte [ecx], al
mov byte [esp + 0xf5], 1
mov dword [esp + 0xfc], ebx
mov byte [esp + 0x102], al
mov byte [esp + 0xf7], 0xd
mov dword [esp + 0x104], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0x100], 1
mov byte [esp + 0x101], 1
add byte [eax], al
add esi, eax
test byte [ebx + eax], ah
add dword [eax], eax
add byte [0xe249488], cl
add dword [eax], eax
add byte [ecx + 0x110249c], cl
add byte [eax], al
mov byte [esp + 0x10c], 1
mov byte [esp + 0x10d], 1
mov dword [esp + 0x114], ebx
mov byte [esp + 0x11a], dl
mov byte [esp + 0x11b], al
mov dword [esp + 0x11c], esi
mov byte [esp + 0x10f], 0xc
mov byte [esp + 0x118], 0x11
mov byte [esp + 0x119], 1
mov byte [esp + 0x124], 1
mov dword [esp + 0x120], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov byte [esp + 0x130], bl
add dh, al
test byte [0x1000001], ah
mov byte [esp + 0x126], 0x44
mov byte [esp + 0x133], bl
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov byte [esp + 0x13c], bl
mov byte [esp + 0x127], 0xc
mov byte [esp + 0x131], 1
mov byte [esp + 0x13f], bl
aas
add dword [eax], eax
add byte [ecx + 0x140249c], cl
add byte [eax], al
mov byte [esp + 0x132], 0x40
mov byte [esp + 0x13d], 1
mov byte [esp + 0x13e], 0x40
mov byte [esp + 0x148], 1
mov dword [esp + 0x144], ebx
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x149], 1
add esi, eax
test byte [edx + ecx*2], ah
add dword [eax], eax
add byte [eax - 0x3a], al
test byte [ebx + ecx*2], ah
add dword [eax], eax
add byte [esi + eax*8], cl
test byte [esp + edx*2], ah
add dword [eax], eax
add byte [ecx], al
mov dword [esp + 0x150], ebx
mov dword [esp + 0x158], ebx
mov byte [esp + 0x155], 1
mov byte [esp + 0x156], 0x40
mov byte [esp + 0x157], 0xc
mov byte [esp + 0x160], 1
mov byte [esp + 0x161], 1
mov byte [esp + 0x162], 0x40
mov dword [esp + 0x15c], ebx
mov byte [esp + 0x163], 0xc
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov byte [esp + 0x16c], 1
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov byte [esp + 0x16d], 1
add byte [ecx], al
Function at 0x4da8e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [esp + esi*8], ah
add byte [eax], al
add byte [ecx], al
mov byte [esp + 0xf5], 1
mov dword [esp + 0xfc], ebx
mov byte [esp + 0x102], al
mov byte [esp + 0xf7], 0xd
mov dword [esp + 0x104], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0x100], 1
mov byte [esp + 0x101], 1
add byte [eax], al
add esi, eax
test byte [ebx + eax], ah
add dword [eax], eax
add byte [0xe249488], cl
add dword [eax], eax
add byte [ecx + 0x110249c], cl
add byte [eax], al
mov byte [esp + 0x10c], 1
mov byte [esp + 0x10d], 1
mov dword [esp + 0x114], ebx
mov byte [esp + 0x11a], dl
mov byte [esp + 0x11b], al
mov dword [esp + 0x11c], esi
mov byte [esp + 0x10f], 0xc
mov byte [esp + 0x118], 0x11
mov byte [esp + 0x119], 1
mov byte [esp + 0x124], 1
mov dword [esp + 0x120], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov byte [esp + 0x130], bl
add dh, al
test byte [0x1000001], ah
mov byte [esp + 0x126], 0x44
mov byte [esp + 0x133], bl
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov byte [esp + 0x13c], bl
mov byte [esp + 0x127], 0xc
mov byte [esp + 0x131], 1
mov byte [esp + 0x13f], bl
aas
add dword [eax], eax
add byte [ecx + 0x140249c], cl
add byte [eax], al
mov byte [esp + 0x132], 0x40
mov byte [esp + 0x13d], 1
mov byte [esp + 0x13e], 0x40
mov byte [esp + 0x148], 1
mov dword [esp + 0x144], ebx
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x149], 1
add esi, eax
test byte [edx + ecx*2], ah
add dword [eax], eax
add byte [eax - 0x3a], al
test byte [ebx + ecx*2], ah
add dword [eax], eax
add byte [esi + eax*8], cl
test byte [esp + edx*2], ah
add dword [eax], eax
add byte [ecx], al
mov dword [esp + 0x150], ebx
mov dword [esp + 0x158], ebx
mov byte [esp + 0x155], 1
mov byte [esp + 0x156], 0x40
mov byte [esp + 0x157], 0xc
mov byte [esp + 0x160], 1
mov byte [esp + 0x161], 1
mov byte [esp + 0x162], 0x40
mov dword [esp + 0x15c], ebx
mov byte [esp + 0x163], 0xc
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov byte [esp + 0x16c], 1
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov byte [esp + 0x16d], 1
add byte [ecx], al
Function at 0x4da960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [esp + esi*8], ah
add byte [eax], al
add byte [ecx], al
mov byte [esp + 0xf5], 1
mov dword [esp + 0xfc], ebx
mov byte [esp + 0x102], al
mov byte [esp + 0xf7], 0xd
mov dword [esp + 0x104], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0x100], 1
mov byte [esp + 0x101], 1
add byte [eax], al
add esi, eax
test byte [ebx + eax], ah
add dword [eax], eax
add byte [0xe249488], cl
add dword [eax], eax
add byte [ecx + 0x110249c], cl
add byte [eax], al
mov byte [esp + 0x10c], 1
mov byte [esp + 0x10d], 1
mov dword [esp + 0x114], ebx
mov byte [esp + 0x11a], dl
mov byte [esp + 0x11b], al
mov dword [esp + 0x11c], esi
mov byte [esp + 0x10f], 0xc
mov byte [esp + 0x118], 0x11
mov byte [esp + 0x119], 1
mov byte [esp + 0x124], 1
mov dword [esp + 0x120], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov byte [esp + 0x130], bl
add dh, al
test byte [0x1000001], ah
mov byte [esp + 0x126], 0x44
mov byte [esp + 0x133], bl
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov byte [esp + 0x13c], bl
mov byte [esp + 0x127], 0xc
mov byte [esp + 0x131], 1
mov byte [esp + 0x13f], bl
aas
add dword [eax], eax
add byte [ecx + 0x140249c], cl
add byte [eax], al
mov byte [esp + 0x132], 0x40
mov byte [esp + 0x13d], 1
mov byte [esp + 0x13e], 0x40
mov byte [esp + 0x148], 1
mov dword [esp + 0x144], ebx
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x149], 1
add esi, eax
test byte [edx + ecx*2], ah
add dword [eax], eax
add byte [eax - 0x3a], al
test byte [ebx + ecx*2], ah
add dword [eax], eax
add byte [esi + eax*8], cl
test byte [esp + edx*2], ah
add dword [eax], eax
add byte [ecx], al
mov dword [esp + 0x150], ebx
mov dword [esp + 0x158], ebx
mov byte [esp + 0x155], 1
mov byte [esp + 0x156], 0x40
mov byte [esp + 0x157], 0xc
mov byte [esp + 0x160], 1
mov byte [esp + 0x161], 1
mov byte [esp + 0x162], 0x40
mov dword [esp + 0x15c], ebx
mov byte [esp + 0x163], 0xc
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov byte [esp + 0x16c], 1
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov byte [esp + 0x16d], 1
add byte [ecx], al
Function at 0x4da9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [esp + esi*8], ah
add byte [eax], al
add byte [ecx], al
mov byte [esp + 0xf5], 1
mov dword [esp + 0xfc], ebx
mov byte [esp + 0x102], al
mov byte [esp + 0xf7], 0xd
mov dword [esp + 0x104], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0x100], 1
mov byte [esp + 0x101], 1
add byte [eax], al
add esi, eax
test byte [ebx + eax], ah
add dword [eax], eax
add byte [0xe249488], cl
add dword [eax], eax
add byte [ecx + 0x110249c], cl
add byte [eax], al
mov byte [esp + 0x10c], 1
mov byte [esp + 0x10d], 1
mov dword [esp + 0x114], ebx
mov byte [esp + 0x11a], dl
mov byte [esp + 0x11b], al
mov dword [esp + 0x11c], esi
mov byte [esp + 0x10f], 0xc
mov byte [esp + 0x118], 0x11
mov byte [esp + 0x119], 1
mov byte [esp + 0x124], 1
mov dword [esp + 0x120], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov byte [esp + 0x130], bl
add dh, al
test byte [0x1000001], ah
mov byte [esp + 0x126], 0x44
mov byte [esp + 0x133], bl
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov byte [esp + 0x13c], bl
mov byte [esp + 0x127], 0xc
mov byte [esp + 0x131], 1
mov byte [esp + 0x13f], bl
aas
add dword [eax], eax
add byte [ecx + 0x140249c], cl
add byte [eax], al
mov byte [esp + 0x132], 0x40
mov byte [esp + 0x13d], 1
mov byte [esp + 0x13e], 0x40
mov byte [esp + 0x148], 1
mov dword [esp + 0x144], ebx
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x149], 1
add esi, eax
test byte [edx + ecx*2], ah
add dword [eax], eax
add byte [eax - 0x3a], al
test byte [ebx + ecx*2], ah
add dword [eax], eax
add byte [esi + eax*8], cl
test byte [esp + edx*2], ah
add dword [eax], eax
add byte [ecx], al
mov dword [esp + 0x150], ebx
mov dword [esp + 0x158], ebx
mov byte [esp + 0x155], 1
mov byte [esp + 0x156], 0x40
mov byte [esp + 0x157], 0xc
mov byte [esp + 0x160], 1
mov byte [esp + 0x161], 1
mov byte [esp + 0x162], 0x40
mov dword [esp + 0x15c], ebx
mov byte [esp + 0x163], 0xc
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov byte [esp + 0x16c], 1
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov byte [esp + 0x16d], 1
add byte [ecx], al