joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470ac1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00480e68
add esp, 0xc
cmc
shr edi, 0
std
cld
lea esp, [esp]
ja 0x470afa
pushf
je 0x470ae9
sub ebx, 0
lea esp, [esp]
xor edx, ebx
xor edx, ebx
popf
jnp 0x470af7
jbe 0x470afa
mov ecx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
test dword [esp], ecx
jo 0x470b43
pushf
ror eax, 0x10
ror eax, 0x10
shl esp, 0
jle 0x470b3c
popf
jp 0x470b40
jno 0x470b43
call 0x813b58d1
jmp 0xf494934d
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
mov ecx, ecx
add esp, 0
je 0x470baa
jbe 0x470bba
mov ebx, ebx
xchg edi, esi
xchg edi, esi
jne 0x470bb4
jnp 0x470bb6
ja 0x470bba
add eax, 0xd4bae81c
invalid
call 0x46e079
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x470bd2
mov eax, 1
jmp 0x470c6a
push ebx
pop ebx
ror edi, 0
jnp 0x470be3
jmp 0x470bdb
mov edx, edx
xchg esi, eax
xchg esi, eax
jp 0x470be3
mov ebp, 0xf4458d4d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0048a3f7
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00480e68
add esp, 0xc
jb 0x470c05
xor esi, 0
dec esi
inc esi
jae 0x470c19
lea edx, [edx]
xchg ebx, edx
xchg ebx, edx
je 0x470c14
jmp 0x470c16
jb 0x470c19
mov edi, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x470c26
mov eax, 1
jmp 0x470c6a
test esp, 0x3bcb
jle 0x470c2e
xor esp, 0
ja 0x470c45
pushf
sub ecx, 0
js 0x470c3a
popf
mov ecx, ecx
mov eax, eax
jp 0x470c42
jbe 0x470c45
mov ebx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00472307
add esp, 4
je 0x470c53
xchg esp, esp
xchg esi, esi
jne 0x470c63
pushf
jb 0x470c5d
popf
nop
je 0x470c63
mov esi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x473af5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00480e68
add esp, 0xc
cmc
jbe 0x473b18
jg 0x473b13
lea eax, [eax]
ja 0x473b18
xor eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
and ebx, ebx
jo 0x473b50
je 0x473b5d
mov edx, edx
js 0x473b56
xchg edx, edx
mov eax, eax
jne 0x473b5d
add eax, 0x80e84d8a
jmp 0xe894c367
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
rol eax, 4
rol eax, 0x1c
xor ebx, dword [esp]
xor ebx, dword [esp]
ja 0x473bdb
jbe 0x473bd5
mov eax, eax
jbe 0x473bdb
mov edx, 0x31ede80c
add dword [eax], eax
call fcn.00486dcd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x473bf0
xor eax, eax
jmp 0x473c98
stc
ja 0x473c02
pushf
mov ebx, ebx
or esp, 0
popf
js 0x473bfe
nop
jbe 0x473c02
or dword [ebp - 0x74ae17b3], 0xe852f855
call 0x89473d77
inc ebp
cld
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0048a3f7
mov dword [ebp - 4], eax
test esp, 0x5666
jp 0x473c36
pushf
shr esp, 0
push ecx
add ecx, 0x51d9
ror ecx, 0xf
pop ecx
clc
push ebx
pop ebx
popf
mov esi, esi
js 0x473c33
jnp 0x473c36
add eax, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00480e68
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x473c50
xor eax, eax
jmp 0x473c98
shr ecx, 0
xchg ebx, eax
xchg ebx, eax
jge 0x473c6e
pushf
call 0x473c5e
add esp, 4
mov ebx, ebx
jp 0x473c65
std
cld
popf
jge 0x473c6b
jl 0x473c6e
mov ebp, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00472307
add esp, 4
jns 0x473c7c
xchg ecx, ecx
lea ebx, [ebx + 0x4712]
sub ebx, 0x4712
jne 0x473c95
jae 0x473c8e
lea eax, [eax]
je 0x473c95
mov esi, 0x55ff0302
cld
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475b78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00480e68
add esp, 0xc
ror edi, 0
jl 0x475b96
jl 0x475ba1
xchg esp, esp
jbe 0x475b9c
mov ecx, ecx
jge 0x475ba1
add eax, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
shr esp, 0
jge 0x475bd6
push edx
pop edx
ja 0x475be8
pushf
lea esp, [esp]
popf
js 0x475be3
je 0x475be5
jbe 0x475be8
xor eax, 0x80f04d8a
jmp 0xf094e3f2
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
and eax, eax
sub esi, 0
jns 0x475c4f
jge 0x475c67
pushf
neg esi
neg esi
inc edx
dec edx
cmp eax, ecx
or edi, 0
popf
jae 0x475c62
ja 0x475c64
jl 0x475c67
call 0x158be53
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.00486dcd
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x475c79
xor eax, eax
jmp 0x475cb8
add edi, dword [esp]
sub edi, dword [esp]
dec edi
inc edi
neg eax
neg eax
js 0x475c87
jns 0x475c95
xchg edi, edi
lea edx, [edx]
lea esi, [esi]
mov esp, esp
js 0x475c95
mov esi, 0xf0458d97
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048a3f7
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00480e68
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4785b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00480e68
add esp, 0xc
or esp, 0
shr edx, 0
jne 0x4785e3
pushf
jg 0x4785dc
popf
mov ebx, ebx
je 0x4785e3
xor eax, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0
jnp 0x478619
jbe 0x478629
xchg edi, edi
jns 0x47861f
je 0x478621
lea esp, [esp]
ja 0x478629
jmp 0x4dd20657
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
cmp edx, dword [esp + 8]
lea edx, [edx + 0x5e9a]
lea edx, [edx - 0x5e9a]
jg 0x4786b3
pushf
or esp, 0
jno 0x4786aa
popf
lea edx, [edx]
js 0x4786b0
jle 0x4786b3
sub eax, 0xe715e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.00486dcd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4786c8
xor eax, eax
jmp 0x478907
nop
nop
jle 0x4786e4
pushf
ror eax, 0x1e
ror eax, 2
cmp ebx, edx
add ecx, 0
popf
jge 0x4786dd
mov eax, eax
jmp 0x4786e1
jg 0x4786e4
mov esp, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0048a3f7
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00480e68
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x478711
xor eax, eax
jmp 0x478907
call fcn.00478716
Function at 0x47b992
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 4], eax
cmp ecx, 0x2fe0
and edx, edx
sub ebx, 0
jae 0x47b9b6
jnp 0x47b9c1
jmp 0x47b9ba
jp 0x47b9bc
lea esi, [esi]
jp 0x47b9c1
add eax, 0xfc7d83
cmp dword [ebp - 4], 0
je 0x47b9e0
ja 0x47b9c9
push edi
pop edi
jae 0x47b9d9
xchg edx, ecx
xchg edx, ecx
js 0x47b9d3
mov esp, esp
jb 0x47b9d9
mov esp, 0xfb876
add byte [eax], al
mov eax, 0xf
jmp 0x47b9fa
mov esp, esp
ror eax, 3
ror eax, 0x1d
jg 0x47b9ea
and esi, 0xffffffff
jp 0x47b9f5
jo 0x47b9f1
jnp 0x47b9f5
xor dword [ecx], 0x14b8
add byte [edi + 0x5e], bl
mov eax, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47dc51
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x467334
call fcn.0046c5a3
add esp, 0xc
mov byte [0x467334], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x47dd42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x47dd56
jmp 0x47df01
shl edx, 0
mov eax, eax
jbe 0x47dd6c
pushf
dec eax
inc eax
popf
jg 0x47dd65
jge 0x47dd67
jno 0x47dd69
ja 0x47dd6c
call 0x895022fb
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x465f84], edx
nop
jg 0x47dd8a
xchg ecx, ecx
jle 0x47dd84
lea esi, [esi]
jle 0x47dd8a
mov edx, 0xec458bd9
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x4660cc], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x4660c8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x467374], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x467378], ecx
push esi
add esi, 0x79a1
ror esi, 0x14
pop esi
jle 0x47ddc6
jl 0x47ddc8
jle 0x47dddc
pushf
test dword [esp + 0xc], edi
stc
popf
lea ecx, [ecx]
jle 0x47ddd7
ja 0x47ddd9
jg 0x47dddc
sub eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
shr eax, 0
xchg ecx, ecx
not eax
not eax
je 0x47de31
lea edx, [edx + 0x29f1]
lea edx, [edx - 0x29f1]
lea ecx, [ecx]
je 0x47de2b
jle 0x47de2d
jne 0x47de31
jmp 0xf09d68f4
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
shl esi, 0
xchg esp, esp
jne 0x47deaf
pushf
rol edi, 5
rol edi, 0x1b
popf
xchg esp, esp
je 0x47deaf
call 0x61101c36
inc esi
add byte [eax], al
cmp dword [0x4660c8], 0
je 0x47decc
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x4660c8]
push eax
call fcn.0048a3f7
mov dword [0x465f80], eax
cmc
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
or edx, edx
je 0x47def1
pushf
shr esp, 0
jg 0x47dee0
cmp edi, 0x6bc1
popf
jns 0x47deea
jge 0x47deec
js 0x47deee
jne 0x47def1
mov ebp, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00480e68
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47ec14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00480e68
add esp, 0xc
nop
ror eax, 0xe
rol eax, 0xe
and al, byte ds:[eax]
add byte [ebx - 0x3e6ff33c], al
enter 0xffffffffffffc10e, 0xffffffffffffffc0
push cs
nop
std
cld
jne 0x47ec3f
js 0x47ec3b
je 0x47ec3f
mov ebx, 0xe045c682
dec eax
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
add ecx, dword [esp]
sub ecx, dword [esp]
xchg esi, esi
xor edi, ecx
xor edi, ecx
jo 0x47eca2
xchg ecx, edi
xchg ecx, edi
jno 0x47eca2
sub eax, 0x4d8af096
loopne 0x47ec26
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
jg 0x47ed40
jmp 0xe09574ac
ja 0x47ed42
jne 0x47ed44
lea edi, [edi]
jge 0x47ed5b
lea eax, [eax + 0x55a9]
lea eax, [eax - 0x55a9]
lea ebx, [ebx]
jbe 0x47ed58
jl 0x47ed5b
mov edi, 0x806de8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.00486dcd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47ed70
xor eax, eax
jmp 0x47f012
call fcn.0047ed75
Function at 0x486c43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00480e68
add esp, 0xc
jbe 0x486c5e
test dword [esp + 4], esi
test esp, 0x2805
or edx, 0
jp 0x486c7a
jbe 0x486c6f
lea ebx, [ebx]
jae 0x486c73
xchg ecx, esi
xchg ecx, esi
jnp 0x486c7a
xor eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
test esp, 0x7197
test dword [esp + 0x10], eax
test edi, 0x126f
jl 0x486cd3
pushf
add edi, 0x60f6
sub edi, 0x60f6
popf
js 0x486cce
jl 0x486cd0
jge 0x486cd3
call 0x8134ba61
jmp 0xec95f4dd
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00486dcd
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x486d45
xor eax, eax
jmp 0x486dc4
and edx, 0xffffffff
cld
jne 0x486d54
js 0x486d4d
jno 0x486d4f
je 0x486d54
lcall 0x50ec, 0x458d00cb
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0048a3f7
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00480e68
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x486d7e
xor eax, eax
jmp 0x486dc4
lea ecx, [ecx]
shr ebx, 0
jle 0x486d95
pushf
ror edi, 0
popf
jne 0x486d8e
lea edx, [edx]
ja 0x486d92
jg 0x486d95
mov ebp, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00472307
add esp, 4
cmp ecx, dword [esp + 0x10]
call 0x486daa
add esp, 4
inc edi
dec edi
jns 0x486dbd
je 0x486db3
js 0x486db5
lea esp, [esp]
jnp 0x486dba
js 0x486dbd
mov ebp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48a1de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x465b84], 1
jne 0x48a37a
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00480e68
add esp, 0xc
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
ror edx, 0
and edi, 0xffffffff
jns 0x48a231
pushf
cmp ecx, dword [esp]
test edx, 0x51fa
push esi
add esi, 0x3aff
ror esi, 0x17
pop esi
popf
xchg ebx, ebx
js 0x48a231
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
add eax, dword [esp]
sub eax, dword [esp]
sub ecx, 0
add ebx, 0x7848
sub ebx, 0x7848
jb 0x48a27d
jl 0x48a27a
jae 0x48a27d
sub eax, 0x80e84d8a
jmp 0xe8962a87
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00486dcd
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48a2f2
xor eax, eax
jmp 0x48a3cb
shr ecx, 0
jb 0x48a2f7
ja 0x48a30e
pushf
add ebx, 0x3529
sub ebx, 0x3529
popf
xchg esi, eax
xchg esi, eax
jbe 0x48a30e
mov edx, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0048a3f7
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00480e68
add esp, 0xc
lea esp, [esp]
jl 0x48a364
pushf
call 0x48a33a
add esp, 4
jge 0x48a33f
lea edi, [edi + 0xb11]
sub edi, 0xb11
xchg esi, ebx
xchg esi, ebx
popf
jl 0x48a353
lea ebx, [ebx + 0x643d]
lea ebx, [ebx - 0x643d]
jle 0x48a361
jge 0x48a364
mov ebp, 0xf87d83
cmp dword [ebp - 8], 0
je 0x48a374
mov eax, dword [ebp - 8]
mov dword [0x465b84], eax
jmp 0x48a378
xor eax, eax
jmp 0x48a3cb
jmp 0x48a383
mov ecx, dword [0x465b84]
mov dword [ebp - 8], ecx
jno 0x48a385
jl 0x48a387
or eax, 0
js 0x48a3a1
pushf
rol ebx, 0x1c
rol ebx, 4
dec ebx
inc ebx
popf
jmp 0x48a39a
xchg edi, eax
xchg edi, eax
jns 0x48a39e
jns 0x48a3a1
mov ebp, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
lea esp, [esp]
jle 0x48a3b4
mov edi, edi
jne 0x48a3b0
jg 0x48a3b4
mov ebp, 0xfc458bb3
mov eax, dword [ebp - 4]
push eax
call fcn.00472307
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8