joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491cd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
test edx, edx
push edi
je 0x491da9
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x491da9
ja 0x491ced
ror esp, 0
cmp esp, 0x76e3
add ebx, 0x238a
sub ebx, 0x238a
je 0x491d21
pushf
std
cld
neg eax
neg eax
popf
lea ebx, [ebx + 0x50d7]
lea ebx, [ebx - 0x50d7]
xchg esp, esp
jb 0x491d1e
jne 0x491d21
jmp 0x4a16a6
cmp ecx, 0x10000
jae 0x491d4f
jns 0x491d2b
ja 0x491d46
pushf
add esp, 0
jno 0x491d34
ror ebx, 0x1a
ror ebx, 6
popf
lea esp, [esp]
jmp 0x491d41
jbe 0x491d43
jbe 0x491d46
add eax, 0xd3e85251
test eax, 0x30ebffff
push ecx
push edx
call 0x48c720
jmp 0x491d7f
jno 0x491d51
xchg edi, edi
jo 0x491d55
jle 0x491d57
jb 0x491d78
lea edi, [edi + 0x19e2]
lea edi, [edi - 0x19e2]
lea edi, [edi + 0x1e41]
lea edi, [edi - 0x1e41]
jle 0x491d73
jg 0x491d75
jae 0x491d78
mov ebp, 0x91e85251
rol dword [eax], cl
add byte [ebx - 0x3f7af73c], al
push ecx
push edx
call fcn.0049f110
add esp, 8
test eax, eax
je 0x491db4
or edi, 0
lea ebx, [ebx + 0x2b8c]
sub ebx, 0x2b8c
jl 0x491d97
shl edx, 0
js 0x491da3
jp 0x491d9e
jns 0x491da3
mov esi, 0x5b5f3e50
pop edi
pop ebx
pop ebp
ret 8
push 0x488534
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop ebx
pop ebp
ret 8
jp 0x4a16a9
mov ebp, 0x3174ff85
test edi, edi
je 0x4a16de
test esp, 0x73d2
cmp eax, ecx
jno 0x4a16d5
pushf
ja 0x4a16bb
push ecx
pop ecx
ja 0x4a16bf
xor ecx, 0
popf
lea ebx, [ebx + 0x1656]
lea ebx, [ebx - 0x1656]
jle 0x4a16d2
jo 0x4a16d5
add eax, 0x9765e857
add byte [eax], al
push edi
call fcn.004aae40
add esp, 4
sub esp, 0
lea edx, [edx]
shl ecx, 0
shr esi, 0
jl 0x4a16f0
jp 0x4a16ed
jge 0x4a16f0
add eax, 0x8b104d8b
push ebp
or al, 0x8b
inc ebp
or byte [ecx + 0x52], dl
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x492b90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x48a084]
push esi
push edi
push eax
push 0x489fa9
mov byte [0x489fa8], 0x45
call fcn.0048fad0
mov edx, dword [0x48a084]
mov al, 0x2d
mov byte [0x489fae], al
mov byte [0x489faf], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x489fad], cl
mov byte [0x489fb0], cl
mov esi, 0x489fb1
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x478a69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x492bdf
mov byte [esi], 0
pop edi
mov eax, 0x489fa8
pop esi
ret
Function at 0x4956d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.004932f0
add esp, 0xc
push eax
add eax, 0x6fa
ror eax, 4
pop eax
add eax, dword [esp]
sub eax, dword [esp]
jns 0x495703
jnp 0x4956fd
xchg ecx, ecx
js 0x495703
mov ebx, 0xb166b08b
insd dword es:[edi], dx
mov al, 0x66
mov cl, 0x6d
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x6e
mov byte [ebp - 0x17], al
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xc], al
mov byte [ebp - 8], al
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], cl
mov byte [ebp - 0xd], cl
mov byte [ebp - 7], 0x58
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x4f
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xf], 0x47
mov byte [ebp - 0xa], 0x62
lea esi, [esi]
mov ecx, ecx
and esp, 0xffffffff
jnp 0x495760
xchg edi, esi
xchg edi, esi
xchg edx, eax
xchg edx, eax
jp 0x495760
mov edx, 0xe8558a94
mov dl, byte [ebp - 0x18]
mov cl, byte [ebp - 0x13]
mov al, byte [ebp - 0xe]
mov bl, byte [ebp - 9]
dec dl
dec cl
mov byte [ebp - 0x18], dl
mov dl, byte [ebp - 0x17]
dec al
mov byte [ebp - 0x13], cl
mov cl, byte [ebp - 0x12]
dec bl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 9], bl
mov bl, byte [ebp - 8]
dec dl
dec cl
mov byte [ebp - 0x17], dl
mov dl, byte [ebp - 0x16]
dec al
mov byte [ebp - 0x12], cl
mov cl, byte [ebp - 0x11]
dec bl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xc]
mov byte [ebp - 8], bl
mov bl, byte [ebp - 7]
dec dl
dec cl
mov byte [ebp - 0x16], dl
mov dl, byte [ebp - 0x15]
dec al
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 0x10]
dec bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0xb]
mov byte [ebp - 7], bl
mov bl, byte [ebp - 0x14]
dec dl
dec cl
dec al
dec bl
mov byte [ebp - 0x15], dl
mov dl, byte [ebp - 0xf]
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xb], al
mov byte [ebp - 0x14], bl
mov cl, byte [ebp - 0xa]
dec dl
dec cl
mov byte [ebp - 0xf], dl
mov byte [ebp - 0xa], cl
dec edi
inc edi
jg 0x4957f9
lea eax, [eax]
jle 0x4957f9
jmp 0xf1ae5
call fcn.00491dc0
mov ecx, eax
test ecx, ecx
jne 0x49580d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00495812
Function at 0x498410
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4886f4
call edi
test dword [esp + 0xc], edi
jg 0x498434
mov edx, edx
xchg ebx, eax
xchg ebx, eax
jle 0x498434
jmp 0x8d52eedc
push 9
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.004932f0
mov al, 0x5d
add esp, 0xc
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4a
mov byte [ebp - 0xb], al
mov byte [ebp - 6], 0x44
mov byte [ebp - 0xa], 0x2f
mov byte [ebp - 5], 0x46
mov byte [ebp - 9], al
mov byte [ebp - 4], 0
mov byte [ebp - 8], 0x54
shl esp, 0
nop
js 0x498480
jp 0x49846f
lea ebx, [ebx + 0x1a5]
lea ebx, [ebx - 0x1a5]
jp 0x49847d
jns 0x498480
mov esp, 0x8af4558a
dec ebp
stc
mov dl, byte [ebp - 0xc]
mov cl, byte [ebp - 7]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 6]
dec dl
dec cl
mov byte [ebp - 0xc], dl
mov dl, byte [ebp - 0xa]
dec al
mov byte [ebp - 7], cl
mov cl, byte [ebp - 5]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 9]
mov byte [ebp - 6], bl
mov bl, byte [ebp - 8]
dec dl
dec cl
dec al
dec bl
mov byte [ebp - 0xa], dl
mov byte [ebp - 5], cl
mov byte [ebp - 9], al
mov byte [ebp - 8], bl
shl ebx, 0
xchg esi, esi
rol esp, 0
jl 0x4984dc
pushf
jnp 0x4984ce
mov esp, esp
or edx, 0
popf
jns 0x4984d7
jle 0x4984d9
jge 0x4984dc
mov ebx, 0x8068006a
add byte [eax], al
add byte [edx + 3], ch
push 0
push 0x80
push 3
push 0
push 3
lea ecx, [ebp - 0xc]
push 0xc0000000
push ecx
call fcn.0049a360
push 9
lea edx, [ebp - 0xc]
push 0
push edx
mov esi, eax
call fcn.004932f0
add esp, 0xc
cmp esi, 0xffffffff
je 0x498554
xchg edi, edi
xor ebx, eax
xor ebx, eax
ror edi, 0
jno 0x49852c
pushf
jno 0x49851d
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
popf
js 0x498529
jo 0x49852c
call 0x5ac86d86
add byte [eax], al
push esi
call fcn.0049dfb0
push esi
add esi, 0x329f
ror esi, 0x16
pop esi
jns 0x49853f
je 0x498548
jb 0x498543
xchg ecx, eax
xchg ecx, eax
jne 0x498548
xor eax, 0x1b8
add byte [edi + 0x5e], bl
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add edx, dword [esp]
sub edx, dword [esp]
test edi, ecx
jno 0x49856b
pushf
jo 0x498562
jb 0x498564
popf
xchg esp, esp
jo 0x49856b
mov esp, 0x4886e468
add bh, bh
xlatb
push 0x4886e4
call edi
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xf
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004932f0
add esp, 0xc
jae 0x4986ab
je 0x4986ad
nop
or eax, eax
jae 0x4986cb
pushf
ror ecx, 0xa
ror ecx, 0x16
cmc
lea ebx, [ebx]
and esp, 0xffffffff
popf
jo 0x4986c4
jp 0x4986c6
jp 0x4986c8
jb 0x4986cb
mov ecx, 0x72b173b0
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], al
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], cl
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 8], al
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0xc], 0x32
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 7], 0x74
call fcn.00491dc0
test eax, eax
jne 0x498718
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00491cd0
push 0xf
lea edx, [ebp - 0x14]
mov esi, eax
push 0
push edx
mov dword [ebp - 4], esi
call fcn.004932f0
add esp, 0xc
test esi, esi
jne 0x498746
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
jns 0x498748
xchg esi, ecx
xchg esi, ecx
rol edi, 0xe
rol edi, 0x12
xchg edi, esi
xchg edi, esi
jp 0x498760
je 0x49875a
mov ebx, ebx
jnp 0x498760
lcall 0xe856, 0xfc758b15
xlatb
add dword es:[eax], eax
mov esi, dword [ebp - 4]
push esi
call fcn.004aae40
add esp, 4
jae 0x49876e
rol edi, 0xc
ror edi, 0xc
cmc
je 0x49877d
js 0x498779
jne 0x49877d
or dword [eax - 0x75], 0x4d8b0c45
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x499de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004932f0
add esp, 0xc
je 0x499dfb
jle 0x499e04
mov esp, esp
je 0x499e01
jg 0x499e04
mov ebx, 0x75b066b1
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 7], 0x4a
mov byte [ebp - 8], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 0xa], al
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], al
mov byte [ebp - 4], 0x70
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 9], cl
mov byte [ebp - 6], 0x6f
add eax, 0
xor edx, dword [esp]
xor edx, dword [esp]
cld
js 0x499e48
jb 0x499e51
js 0x499e4c
jae 0x499e51
mov esi, 0x4d8a0a5c
cld
mov cl, byte [ebp - 4]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 0xf]
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 4], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0xf], bl
mov bl, byte [ebp - 0xa]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 6]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
dec al
dec bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 7]
dec cl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 5]
mov byte [ebp - 8], cl
mov cl, byte [ebp - 0xe]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0x10], al
mov byte [ebp - 7], bl
mov byte [ebp - 5], dl
mov byte [ebp - 0xe], cl
inc esi
dec esi
shr edx, 0
inc esi
dec esi
js 0x499ed0
pushf
ror esp, 0
popf
jmp 0x499ecb
jg 0x499ecd
jns 0x499ed0
sub eax, 0xffff7eeb
call fcn.00491dc0
mov ecx, eax
test ecx, ecx
je 0x499f77
add eax, 0x3adf
sub eax, 0x3adf
je 0x499eeb
jge 0x499f06
pushf
jbe 0x499ef1
shl esp, 0
shr esp, 0
xchg edx, esi
xchg edx, esi
popf
ja 0x499eff
xchg ebx, ebx
lea ebx, [ebx]
jl 0x499f06
add eax, 0x52f0558d
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.00491cd0
mov edi, eax
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004932f0
add esp, 0xc
jnp 0x499f24
jle 0x499f30
jno 0x499f28
jl 0x499f2a
jp 0x499f2c
jg 0x499f30
mov ebx, 0x74ff857e
inc ebx
test edi, edi
je 0x499f77
lea edx, [edx + 0x2ad0]
lea edx, [edx - 0x2ad0]
jnp 0x499f42
sub esp, 0
test dword [esp + 0xc], ebx
jne 0x499f52
jg 0x499f4d
nop
je 0x499f52
mov ebp, 0xe8e857bf
push cs
add dword [eax], eax
push edi
call fcn.004aae40
add esp, 4
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
js 0x499f71
mov eax, eax
jle 0x499f69
xchg edx, esi
xchg edx, esi
jns 0x499f71
mov edx, 0x84d8ba3
mov ecx, dword [ebp + 8]
push ecx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a70a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004932f0
add esp, 0xc
or esp, 0
ror edi, 0
test esp, 0x5de9
stc
jnp 0x4a70d9
pushf
lea esp, [esp]
popf
lea esp, [esp]
xchg esp, esp
jne 0x4a70d6
jp 0x4a70d9
mov ebp, 0x45c666b0
invalid
mov al, 0x66
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
rol esi, 0x1b
ror esi, 0x1b
jp 0x4a711d
jle 0x4a7117
nop
jnp 0x4a711d
mov ebx, 0x4d8a16b4
invalid
mov cl, byte [ebp - 0x10]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 6]
mov dl, byte [ebp - 0xf]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
dec dl
mov byte [ebp - 6], bl
mov bl, byte [ebp - 0xe]
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
dec dl
mov byte [ebp - 0xe], bl
mov bl, byte [ebp - 0xc]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0xd], cl
mov byte [ebp - 8], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], dl
call fcn.00491dc0
test eax, eax
je 0x4a7226
rol edx, 8
ror edx, 8
lea edi, [edi + 0x954]
lea edi, [edi - 0x954]
xor edi, dword [esp]
xor edi, dword [esp]
js 0x4a71b4
pushf
lea esp, [esp]
popf
jl 0x4a71ad
xchg esp, esp
jne 0x4a71b1
jns 0x4a71b4
sub eax, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00491cd0
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov edi, eax
call fcn.004932f0
add esp, 0xc
test edi, edi
je 0x4a7226
ja 0x4a71d6
mov esp, esp
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
sub ecx, 0
jle 0x4a71fa
pushf
ror eax, 0
xor ecx, 0
cmp esi, dword [esp + 4]
popf
jb 0x4a71f5
xchg ebx, ebx
jg 0x4a71fa
mov ecx, 0x3c40e857
add byte [eax], al
push edi
call fcn.004aae40
add esp, 4
xor esi, dword [esp]
xor esi, dword [esp]
rol esi, 1
rol esi, 0x1f
push ebx
pop ebx
js 0x4a7212
jle 0x4a7220
jae 0x4a7216
xchg esi, ecx
xchg esi, ecx
jno 0x4a721c
jg 0x4a7220
add eax, 0x8458b1f
mov eax, dword [ebp + 8]
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4aae40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
shl esp, 0
jl 0x4aae4b
jo 0x4aae59
pushf
jge 0x4aae51
popf
lea esp, [esp]
jno 0x4aae59
add eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call fcn.004ae3d0
add esp, 4
cmp eax, 2
jne 0x4aaeb9
xor eax, dword [esp]
xor eax, dword [esp]
jnp 0x4aae87
pushf
xchg esp, esp
add ecx, dword [esp]
sub ecx, dword [esp]
test edi, ecx
popf
lea esi, [esi]
jmp 0x4aae84
jp 0x4aae87
mov esp, 0x48891868
add bh, al
add eax, 0x488004
add al, byte [eax]
add byte [eax], al
push 0x488918
mov dword [0x488004], 2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jge 0x4aae9e
ja 0x4aaeaf
pushf
jnp 0x4aaea4
jp 0x4aaea6
rol ebx, 0
popf
nop
jbe 0x4aaeaf
add eax, 0x1b8
add byte [edi + 0x5e], bl
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
test esp, 0x773
jg 0x4aaec1
jb 0x4aaed6
lea edi, [edi + 0x5c6c]
lea edi, [edi - 0x5c6c]
jle 0x4aaed1
jae 0x4aaed6
mov esp, 0x5e5f8a74
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4acea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004932f0
add esp, 0xc
nop
je 0x4acec3
jno 0x4acebe
nop
jne 0x4acec3
xor eax, 0xb073b136
mov byte gs:[ebp - 3], 0
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4e
add edi, dword [esp]
sub edi, dword [esp]
shr eax, 0
lea eax, [eax + 0x2f94]
lea eax, [eax - 0x2f94]
jo 0x4acf23
pushf
and esp, 0xffffffff
jb 0x4acf19
add edi, 0
popf
lea ebx, [ebx]
jno 0x4acf23
mov ebx, 0xfe4e98e8
dec dword [ebx + 0x75c985c8]
or dword [edi + 0x5e], ebx
call fcn.00491dc0
mov ecx, eax
test ecx, ecx
jne 0x4acf37
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ebx, [ebx + 0x4967]
sub ebx, 0x4967
rol eax, 5
rol eax, 0x1b
push eax
add eax, 0x5399
ror eax, 8
pop eax
cmc
jo 0x4acf63
pushf
jbe 0x4acf5a
popf
xchg edi, ebx
xchg edi, ebx
jno 0x4acf63
ljmp 0xe851:0x52f0558d
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.00491cd0
mov esi, eax
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004932f0
add esp, 0xc
test esi, esi
jne 0x4acf8e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
js 0x4acf90
call fcn.004acf95
Function at 0x438cb1
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop esi
sub edi, ecx
call fcn.00438cf6
add ecx, 0x1cd5785f
mov ecx, 0x9ad9ffd
xor dword [ebx], esi
or edi, edi
add ebx, 1
sub ecx, 0x559a9f49
cmp ebx, eax
jne fcn.00438cb1
sub esp, 4
mov dword [esp], 0x240b7b02
mov ecx, dword [esp]
add esp, 4
sub ecx, edi
ret
Function at 0x4398c6
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4351b8
push 0x43b048
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x35
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.0043af30
add esp, 4
test eax, eax
je 0x43990a
mov ecx, eax
call fcn.0043abb0
mov dword [ebp - 0x1c], eax
jmp 0x439911
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x24], eax
call fcn.0043ab10
test eax, eax
je 0x439952
cmp dword [ebp - 0x1c], 0
je 0x439948
mov ecx, dword [ebp - 0x1c]
call fcn.0043ac20
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0043af40
add esp, 4
mov eax, 0x7895
jmp 0x439a85
wait
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.0043a2a0
mov ecx, dword [ebp - 0x1c]
call fcn.00439df0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
call fcn.0043a120
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x4399b0
mov esi, eax
test esi, esi
je 0x43999e
mov ecx, esi
call fcn.0043ac20
push esi
call fcn.0043af40
add esp, 4
mov eax, 0x7895
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x439a85
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x4399cc
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00439bc0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x439a10
mov esi, eax
test esi, esi
je 0x439a01
mov ecx, esi
call fcn.0043ac20
push esi
call fcn.0043af40
add esp, 4
mov eax, 0x7895
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x439a85
cmp dword [ebp - 0x2c], 0
jne 0x439a1c
mov eax, dword ds:[0]
mov ecx, dword [ebp - 0x1c]
call fcn.00439f90
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x7895
wait
jmp 0x439a54
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x439a68
mov dword [ebp - 0x20], 0x7895
cmp dword [ebp - 0x1c], 0
je 0x439a82
mov ecx, dword [ebp - 0x1c]
call fcn.0043ac20
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0043af40
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x439aa0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov dword [ecx + 0xc], 0x45f479d7
mov dword [ecx], 0
mov esi, ecx
mov dword [ecx + 0x18], 0xf3cb3e57
mov dword [esi + 0x1c], 0x40092ee0
mov dword [esi + 8], 0x75bbf938
mov dword [esi + 0x10], 0xfd3371b0
mov dword [esi + 0x20], 0x8a4406c7
mov dword [esi + 0x24], 0x2cc8e4f
mov dword [esi + 0x28], 0xd12c3bc9
mov dword [esi + 0x30], 0xebcc478b
mov dword [esi + 0x34], 0x489225be
mov dword [esi + 0x38], 0xafda13f8
mov dword [esi + 0x10], 0x3f4cdc6c
mov dword [esi + 0x28], 0xea71e659
mov dword [esi + 8], 0x1d6efe4e
mov dword [esi + 0x30], 0x5a92a305
mov dword [esi + 0x34], 0x412b44f5
xor eax, eax
mov ecx, eax
inc eax
xor ecx, 0x3c2d1e0f
cmp eax, 0x1e
not ecx
mov dword [esi + eax*4 + 0x38], ecx
jl 0x439b1c
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x28]
mov edx, eax
or edx, edi
and eax, edi
and edx, dword [esi + 0x10]
or edx, eax
mov eax, ecx
shl eax, 5
shr ecx, 0x1b
or eax, ecx
add edx, eax
mov eax, edi
shr eax, 2
add edx, dword [esi + 0x24]
shl edi, 0x1e
add edx, 0x5a837999
or eax, edi
add dword [esi + 0x20], edx
mov dword [esi + 0x38], eax
call fcn.00439890
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 8]
xor ecx, dword [esi + 0x38]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x20]
xor ecx, edi
mov edx, eax
shl edx, 5
shr eax, 0x1b
or edx, eax
mov eax, edi
shr eax, 2
add ecx, edx
shl edi, 0x1e
add ecx, dword [esi + 0x24]
add ecx, 0x5a837999
or eax, edi
pop edi
add dword [esi + 0x10], ecx
mov dword [esi + 0x28], eax
mov eax, esi
pop esi
ret

Function at 0x43a1c0
Capabilities:
Resolve function by hash

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x1c]
push edi
push 0xec0e4e8e
call fcn.00439eb0
mov ecx, dword [esi + 0x14]
push edi
push 0xffd97fb
mov dword [ecx], eax
call fcn.00439eb0
mov ecx, dword [esi + 0x14]
push edi
push 0x7c0017a5
mov dword [ecx + 4], eax
call fcn.00439eb0
mov ecx, dword [esi + 0x14]
push edi
push 0x4dc9d5a0
mov dword [ecx + 8], eax
call fcn.00439eb0
mov ecx, dword [esi + 0x14]
lea edx, [esp + 8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x434a44]
mov edi, dword [0x434a48]
mov ecx, 0x434a44
push edx
mov dword [edx], eax
mov eax, dword [ecx + 8]
mov dword [edx + 4], edi
mov cl, byte [ecx + 0xc]
mov dword [edx + 8], eax
mov byte [edx + 0xc], cl
mov ecx, esi
call fcn.0043a0d0
mov ecx, dword [esi + 0x14]
lea eax, [esp + 8]
push eax
mov edx, dword [ecx]
mov dword [0x434a10], edx
call fcn.00439f10
mov dword [esi], eax
test eax, eax
je 0x43a28d
push eax
push 0xa84aeb81
call fcn.00439eb0
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [esi]
push eax
push 0xfcba95ab
call fcn.00439eb0
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi]
push edx
push 0x35e273e6
call fcn.00439eb0
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
pop edi
pop esi
add esp, 0x10
ret 4