joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a928e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a51c9
add esp, 0xc
xchg ecx, ecx
or esi, esi
ja 0x4a92c5
pushf
lea ebx, [ebx + 0x2c48]
lea ebx, [ebx - 0x2c48]
sub esp, 0
popf
jno 0x4a92c2
jbe 0x4a92c5
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
lea eax, [eax + 0x1f1]
lea eax, [eax - 0x1f1]
xor ebx, edx
xor ebx, edx
jnp 0x4a9311
jge 0x4a930d
jp 0x4a9311
mov ebp, 0xe84d8a42
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
ror edx, 0xb
rol edx, 0xb
neg eax
neg eax
shl eax, 0
je 0x4a939f
pushf
jnp 0x4a938c
cmp eax, 0x7079
cmp edi, esi
neg eax
neg eax
popf
lea esp, [esp]
jne 0x4a939f
call 0x13aa8b
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.004a5cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a93b4
xor eax, eax
jmp 0x4a946d
test ecx, 0x17cc
add esp, 0
jns 0x4a93cd
pushf
add edi, 0
popf
jbe 0x4a93c8
jbe 0x4a93ca
js 0x4a93cd
call 0x5232e15e
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004bcc60
mov dword [ebp - 4], eax
xor ebx, dword [esp + 4]
xor ebx, dword [esp + 4]
or ecx, ecx
test esi, eax
call 0x4a93ee
lea esp, [esp + 4]
jns 0x4a93fc
jne 0x4a93f6
jae 0x4a93f8
js 0x4a93fc
mov edi, 0x6a0d6a0a
add byte [ebp - 0x17af17bb], cl
sar byte [ebp - 0x3b7c0001], 0xc
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a51c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4a9416
xor eax, eax
jmp 0x4a946d
rol ebx, 0x19
ror ebx, 0x19
ror edx, 4
rol edx, 4
xor esi, 0
add edi, 0
je 0x4a9441
pushf
jmp 0x4a942e
lea esi, [esi + 0x1235]
lea esi, [esi - 0x1235]
popf
mov edx, edx
jne 0x4a9441
mov ebx, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ba301
add esp, 4
nop
xor edi, eax
xor edi, eax
jg 0x4a9454
je 0x4a946a
lea ecx, [ecx + 0x55cd]
lea ecx, [ecx - 0x55cd]
jo 0x4a9464
jbe 0x4a9466
jne 0x4a946a
lcall 0x5e5f, 0xfc55ff59
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a984f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004a51c9
add esp, 0xc
lea esp, [esp]
ror ebx, 0x1f
rol ebx, 0x1f
jbe 0x4a9881
jl 0x4a9875
nop
jge 0x4a9878
xchg edi, edx
xchg edi, edx
ja 0x4a9881
xor eax, 0x45c61b18
in al, 0x52
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
jae 0x4a98cf
test dword [esp], edx
xchg ecx, ecx
jne 0x4a98e9
pushf
lea edx, [edx]
call fcn.004a98df
Function at 0x4abe0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004a51c9
add esp, 0xc
cld
cmp esp, 0x54dc
jo 0x4abe3b
pushf
jns 0x4abe30
popf
jno 0x4abe34
xchg esp, esp
jne 0x4abe38
jno 0x4abe3b
mov ebp, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
jmp 0x4abe85
xchg ecx, ebx
xchg ecx, ebx
je 0x4abe8b
test dword [esp], edi
jno 0x4abe98
lea ecx, [ecx]
jo 0x4abe94
jo 0x4abe98
adc esi, 0x80e44d8a
jmp 0xe49846a2
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.004a5cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4abf46
xor eax, eax
jmp 0x4abfbd
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004bcc60
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004a51c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4abfbb
and edx, edx
jnp 0x4abf87
lea esp, [esp]
jmp 0x4abf75
jns 0x4abf77
lea ebx, [ebx + 0x2988]
lea ebx, [ebx - 0x2988]
jp 0x4abf87
ljmp 0xe851:0xfc4d8b16
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ba301
add esp, 4
jle 0x4abf95
std
cld
xchg esp, esp
jb 0x4abfa2
xchg ecx, eax
xchg ecx, eax
jbe 0x4abf9f
jae 0x4abfa2
mov ebp, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4abfbd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4ae2a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a51c9
add esp, 0xc
jnp 0x4ae2c2
jo 0x4ae2e3
pushf
xor edx, dword [esp]
xor edx, dword [esp]
jge 0x4ae2ce
popf
mov edx, edx
lea ecx, [ecx + 0x87b]
lea ecx, [ecx - 0x87b]
lea esi, [esi]
jno 0x4ae2e3
mov esp, 0x50ec45c6
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
jg 0x4ae315
add esp, 0
jno 0x4ae32e
pushf
or edx, 0
jbe 0x4ae321
jno 0x4ae323
jp 0x4ae325
popf
mov esp, esp
jne 0x4ae32b
jo 0x4ae32e
sub eax, 0x80ec4d8a
jmp 0xec986b38
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004a5cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ae3a3
xor eax, eax
jmp 0x4ae42d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004bcc60
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004a51c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4ae42b
jo 0x4ae3cb
nop
nop
jp 0x4ae3cf
jb 0x4ae3f7
pushf
lea ebx, [ebx + 0x4b55]
sub ebx, 0x4b55
or ecx, 0
jnp 0x4ae3e4
lea edi, [edi + 0x5d62]
sub edi, 0x5d62
popf
jle 0x4ae3f4
jae 0x4ae3f7
mov ecx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004ba301
add esp, 4
cmp edi, dword [esp + 4]
std
cld
je 0x4ae41a
pushf
shr esi, 0
ror ebx, 0
popf
jae 0x4ae417
jne 0x4ae41a
mov eax, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4ae42d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ae850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a51c9
add esp, 0xc
test dword [esp], edx
xchg esp, esp
ror eax, 0x1d
ror eax, 3
shl eax, 0
jp 0x4ae8a3
pushf
jl 0x4ae87d
lea ecx, [ecx + 0x42c1]
lea ecx, [ecx - 0x42c1]
lea eax, [eax + 0x6a0e]
lea eax, [eax - 0x6a0e]
jge 0x4ae897
popf
lea esp, [esp]
jae 0x4ae89e
je 0x4ae8a0
jnp 0x4ae8a3
mov esp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x55
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0
and edx, edx
jno 0x4ae8e7
je 0x4ae8dd
mov ebx, ebx
xchg ebx, ebx
xchg esp, esp
jo 0x4ae8e7
mov edx, 0xe84d8a28
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
call fcn.004a5cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ae962
jmp 0x4ae9e7
lea edi, [edi]
xor edi, dword [esp]
xor edi, dword [esp]
mov esp, esp
jns 0x4ae979
nop
jmp 0x4ae971
jge 0x4ae973
xchg esi, esi
js 0x4ae979
lcall 0x8b51, 0xe84d8da2
push ebp
clc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004bcc60
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a51c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4ae9e7
lea edx, [edx]
or esp, 0
jle 0x4ae9be
pushf
xchg esp, esp
test dword [esp], edi
neg ecx
neg ecx
test edx, 0x141c
popf
jnp 0x4ae9bb
jg 0x4ae9be
mov edi, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ba301
add esp, 4
xor ecx, esi
xor ecx, esi
std
cld
cld
dec edi
inc edi
jg 0x4ae9e0
pushf
std
cld
popf
jl 0x4ae9dd
jle 0x4ae9e0
mov esi, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b5352
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.004a51c9
add esp, 0xc
push 0x21
push 0x49be18
lea ecx, [ebp - 0x138]
push ecx
call fcn.004bd080
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4b545a
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.004a51c9
add esp, 0xc
push 0xb
push 0x49be3c
lea edx, [ebp - 0x138]
push edx
call fcn.004bd080
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4b544d
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004bd080
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4b545c
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4b993a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x49bb40], 1
jne 0x4b9a65
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a51c9
add esp, 0xc
xor esp, 0
jl 0x4b996d
jns 0x4b9967
mov ebx, ebx
jge 0x4b996d
mov ebp, 0xe845c6a6
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
cld
or edx, edx
jl 0x4b99b3
pushf
je 0x4b99a2
xor edi, dword [esp + 0x10]
xor edi, dword [esp + 0x10]
lea esi, [esi]
popf
jp 0x4b99b0
jge 0x4b99b3
or dword [edx - 0x167f17b3], 0xe84d8801
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.004a5cba
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b9a20
mov eax, dword [ebp + 8]
jmp 0x4b9adc
jp 0x4b9a22
xchg esp, esp
jnp 0x4b9a2d
mov esp, esp
jp 0x4b9a2a
jp 0x4b9a2d
mov edi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004bcc60
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004a51c9
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x4b9a5e
mov edx, dword [ebp - 8]
mov dword [0x49bb40], edx
jmp 0x4b9a63
mov eax, dword [ebp + 8]
jmp 0x4b9adc
jmp 0x4b9a6d
mov eax, dword [0x49bb40]
mov dword [ebp - 8], eax
nop
rol ebx, 3
rol ebx, 0x1d
xor edi, 0
test edx, 0x32d4
jl 0x4b9a8b
xchg ecx, eax
xchg ecx, eax
jns 0x4b9a83
jno 0x4b9a85
jge 0x4b9a87
jge 0x4b9a8b
mov esi, 0xf84d8b7a
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp ecx, esi
xchg esp, esp
ja 0x4b9aa4
pushf
jg 0x4b9a9b
popf
xchg edi, edi
xchg ecx, ecx
jbe 0x4b9aa4
mov edx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004ba301
add esp, 4
test esp, 0x157b
jo 0x4b9ad5
pushf
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
cmc
call 0x4b9ac8
add esp, 4
popf
nop
jbe 0x4b9ad0
ja 0x4b9ad2
jno 0x4b9ad5
mov ebx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ba606
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a51c9
add esp, 0xc
jae 0x4ba628
lea esi, [esi + 0x69db]
lea esi, [esi - 0x69db]
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
jg 0x4ba64d
pushf
jnp 0x4ba642
stc
popf
ja 0x4ba647
nop
jle 0x4ba64a
jle 0x4ba64d
sub eax, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
ror edx, 0x1e
rol edx, 0x1e
jge 0x4ba709
jne 0x4ba700
nop
jae 0x4ba703
jp 0x4ba705
jl 0x4ba709
mov esi, 0xb5ace80e
invalid
call fcn.004a5cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ba71e
xor eax, eax
jmp 0x4ba7a9
inc ebx
dec ebx
jg 0x4ba722
mov edx, edx
test esp, 0x1ab3
je 0x4ba736
jmp 0x4ba72e
xchg edi, eax
xchg edi, eax
lea esp, [esp]
jne 0x4ba736
call 0x5333fcc7
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004bcc60
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004a51c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4ba760
xor eax, eax
jmp 0x4ba7a9
lea esi, [esi + 0x4511]
lea esi, [esi - 0x4511]
xor esi, ecx
xor esi, ecx
ja 0x4ba777
xchg ecx, ecx
jbe 0x4ba777
ljmp 0x81e8:0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004ba301
add esp, 4
call 0x4ba788
lea esp, [esp + 4]
mov eax, eax
jle 0x4ba790
je 0x4ba79e
je 0x4ba794
jmp 0x4ba796
jg 0x4ba798
ja 0x4ba79a
jne 0x4ba79e
add eax, 0xc458b6e
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c352b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a51c9
add esp, 0xc
jmp 0x4c3546
cld
jge 0x4c3554
pushf
jge 0x4c354d
popf
xchg ecx, ecx
jl 0x4c3554
mov ecx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jl 0x4c3586
stc
or edx, 0
cmc
jns 0x4c359d
pushf
jle 0x4c3591
test dword [esp], edx
popf
xchg esi, edx
xchg esi, edx
js 0x4c359d
mov esp, 0x80ec4d8a
jmp 0xec99bda7
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004a5cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c360f
xor eax, eax
jmp 0x4c3689
rol esp, 0
shl esp, 0
shr edx, 0
cmp edi, 0x5798
je 0x4c3625
xchg esi, esi
jne 0x4c3625
mov ebp, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004bcc60
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004a51c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4c364f
xor eax, eax
jmp 0x4c3689
mov esp, esp
je 0x4c3660
pushf
jb 0x4c3657
popf
jns 0x4c365b
jbe 0x4c365d
jne 0x4c3660
mov edi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004ba301
add esp, 4
jae 0x4c366e
xor ebx, 0x7bb
xor ebx, 0x7bb
js 0x4c3682
nop
xchg esp, esp
jns 0x4c3682
call 0x51548411
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c56c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a51c9
add esp, 0xc
ror eax, 8
ror eax, 0x18
jg 0x4c56fa
jne 0x4c56f0
jns 0x4c56f2
lea edi, [edi]
lea esp, [esp]
jle 0x4c56fa
mov esi, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004a5cba
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4c57c2
xor eax, eax
jmp 0x4c582f
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004bcc60
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004a51c9
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x4c57ec
xor eax, eax
jmp 0x4c582f
jg 0x4c57ee
js 0x4c580c
pushf
jl 0x4c57f4
jo 0x4c57f6
popf
jo 0x4c57fa
lea ecx, [ecx + 0x2a55]
lea ecx, [ecx - 0x2a55]
lea esp, [esp]
jns 0x4c580c
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.004ba301
add esp, 4
test eax, esi
mov esp, esp
jge 0x4c5824
jae 0x4c5820
jl 0x4c5824
sub eax, 0xc4d8b2f
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8