joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40521a
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
push 3
pop edi
lea ecx, [ebp - 0x30]
call fcn.0040174b
push dword [ebp + 0x10]
call fcn.00407830
mov esi, eax
pop ecx
lea eax, [ebp - 0x18]
add esi, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
and word [ebp - 0x16], 0xfffe
xor ebx, ebx
push ebx
call fcn.004047aa
pop ecx
xor edx, edx
push 0x1e
pop ecx
div ecx
sub word [ebp - 0xe], dx
cmp word [ebp - 0xe], 0x3c
jb 0x405270
mov word [ebp - 0xe], 1
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0x10]
and eax, 0x3f
shl ecx, 6
or eax, ecx
mov cl, byte [ebp - 0xc]
shr cl, 1
shl eax, 5
and ecx, 0x1f
or eax, ecx
mov cl, byte [ebp - 2]
mov word [ebp - 4], ax
mov eax, dword [ebp - 0x18]
add eax, 0x44
and ecx, 0x1f
shl eax, 9
xor eax, ecx
mov cl, byte [ebp - 0x16]
and ecx, 0xf
and ax, 0xfe1f
shl ecx, 5
or eax, ecx
mov cl, byte [ebp - 0x12]
mov word [ebp - 2], ax
xor cl, byte [ebp - 2]
and ecx, 0x1f
xor ax, cx
cmp dword [ebp + 0x14], ebx
mov word [ebp - 2], ax
je 0x4052cb
push 2
pop edi
push 0x20
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push 0x20
push edi
push ebx
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 8], edi
je 0x40531f
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x1c]
push 1
push eax
lea ecx, [ebp - 0x30]
push dword [ebp + 0xc]
call fcn.0040174e
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x405326
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x405419
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 0x14e], 0x74
push eax
mov word [ebp - 0x14d], 0x8000
push dword [ebp + 0xc]
mov word [ebp - 0x14b], si
mov dword [ebp - 0x149], eax
mov dword [ebp - 0x145], eax
mov byte [ebp - 0x141], bl
call fcn.004051b2
push dword [ebp + 0x10]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 4]
mov byte [ebp - 0x138], 0x14
mov dword [ebp - 0x13c], eax
mov byte [ebp - 0x137], 0x30
call fcn.00407830
push dword [ebp + 0x10]
mov word [ebp - 0x136], ax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x134], ebx
push eax
call fcn.00407740
movzx edi, si
lea eax, [edi - 2]
push eax
lea eax, [ebp - 0x14e]
push eax
call fcn.004051b2
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x1c
cmp dword [ebp + 0x14], ebx
mov word [ebp - 0x150], ax
je 0x4053d5
lea eax, [ebp - 0x20]
push ebx
push eax
push 0x14
push str.O_K_F
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x20]
push ebx
push eax
lea eax, [ebp - 0x150]
push edi
push eax
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x1c]
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
lea ecx, [ebp - 0x30]
call fcn.00401808
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], ebx
je 0x405416
push dword [ebp + 8]
call fcn.00405516
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b6a5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004c4eb6
add esp, 0xc
std
cld
xor esi, 0
xchg esp, esp
js 0x4b6a95
pushf
rol esi, 0x1d
ror esi, 0x1d
jb 0x4b6a88
push edi
pop edi
and edx, 0xffffffff
popf
nop
ja 0x4b6a92
jns 0x4b6a95
mov ebx, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
add esp, 0
stc
jae 0x4b6acb
jne 0x4b6adc
pushf
test ecx, 0x3165
popf
jp 0x4b6ad9
je 0x4b6adc
call 0x813bb86a
jmp 0xf098f2e6
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
ror esi, 0x1f
rol esi, 0x1f
jnp 0x4b6b5d
pushf
add edx, 0x4b8b
sub edx, 0x4b8b
popf
jne 0x4b6b56
jg 0x4b6b58
lea ecx, [ecx]
jp 0x4b6b5d
ljmp 0x8900:0x22ba2e8
call fcn.004d9704
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b6b6f
xor eax, eax
jmp 0x4b6ba9
or esp, 0
ror ebx, 0x15
ror ebx, 0xb
jae 0x4b6b86
xchg esi, esi
xchg esp, esp
jno 0x4b6b80
mov eax, eax
jb 0x4b6b86
mov eax, 0xf0458d17
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004c1700
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004c4eb6
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b9755
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004c4eb6
add esp, 0xc
call fcn.004b977a
Function at 0x4b9eae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004c4eb6
add esp, 0xc
jnp 0x4b9ec9
jbe 0x4b9ed2
nop
jmp 0x4b9ece
ja 0x4b9ed2
mov ebp, 0xe845c65d
push eax
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0
lea edx, [edx]
js 0x4b9f12
jg 0x4b9f1f
jnp 0x4b9f16
xchg esi, ecx
xchg esi, ecx
ja 0x4b9f1c
jle 0x4b9f1f
jmp 0x8133ecad
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
lea edx, [edx + 0x3ac]
lea edx, [edx - 0x3ac]
sub edx, 0
jnp 0x4b9fcb
pushf
rol ecx, 0x11
ror ecx, 0x11
add ebx, 0xa18
sub ebx, 0xa18
add ecx, dword [esp]
sub ecx, dword [esp]
popf
jne 0x4b9fc8
jp 0x4b9fcb
mov ebp, 0x13673e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 7], dh
call 0x4cd643
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b9fe0
xor eax, eax
jmp 0x4ba26d
add ecx, 0
std
cld
jno 0x4b9ffa
lea ecx, [ecx + 0x2f4d]
lea ecx, [ecx - 0x2f4d]
mov esp, esp
jo 0x4b9ffa
mov edi, 0x458dec16
call 0xfc992b51
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004c1700
mov dword [ebp - 0x1c], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004c4eb6
add esp, 0xc
add eax, dword [esp]
sub eax, dword [esp]
jne 0x4ba034
pushf
jns 0x4ba026
test esi, 0x243c
popf
lea esp, [esp]
je 0x4ba034
lcall 0x775, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x4ba041
xor eax, eax
jmp 0x4ba26d
add edx, 0
and esp, 0xffffffff
jp 0x4ba051
jne 0x4ba04b
jb 0x4ba04d
jnp 0x4ba051
xor dword [edi - 0x75], 0xe850e445
rcr al, 1
add byte [eax], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004c792a
add esp, 4
push 0xf
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004c4eb6
add esp, 0xc
shl esi, 0
jge 0x4ba08d
pushf
inc edi
dec edi
test ecx, edx
call fcn.004ba07d
Function at 0x4bae3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004c4eb6
add esp, 0xc
and edx, edx
jle 0x4bae62
xchg esi, eax
xchg esi, eax
js 0x4bae5d
jb 0x4bae5f
jg 0x4bae62
mov esp, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
test ecx, 0x4499
nop
xchg esi, ecx
xchg esi, ecx
add esp, 0
ja 0x4baeb9
jmp 0x4baeb4
jle 0x4baeb6
jbe 0x4baeb9
add eax, 0x80ec4d8a
jmp 0xec9936c3
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.004d9704
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4baf50
xor eax, eax
jmp 0x4bb022
rol edi, 7
rol edi, 0x19
shl esp, 0
jp 0x4baf77
pushf
ror esi, 0xe
ror esi, 0x12
or edx, 0
add eax, dword [esp]
sub eax, dword [esp]
jno 0x4baf6e
popf
xchg esp, esp
xchg ecx, ecx
jnp 0x4baf77
mov ecx, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004c1700
mov dword [ebp - 0x18], eax
lea edi, [edi]
shl ecx, 0
jb 0x4baf8e
jge 0x4baf97
nop
lea esp, [esp]
jl 0x4baf97
mov edx, 0x6a106a
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004c4eb6
add esp, 0xc
inc eax
dec eax
stc
jle 0x4bafac
cmp esp, 0x67d2
js 0x4bafc8
pushf
mov esi, esi
sub esp, 0
or edi, 0
popf
lea esp, [esp]
je 0x4bafc5
jns 0x4bafc8
add dword [ebx + 0x7500e87d], 0xebc03304
push eax
cmp dword [ebp - 0x18], 0
jne 0x4bafd2
xor eax, eax
jmp 0x4bb022
dec eax
inc eax
je 0x4bafd6
jbe 0x4bafea
pushf
mov esp, esp
jo 0x4bafde
jae 0x4bafe0
shr esp, 0
popf
jp 0x4bafe7
ja 0x4bafea
xor eax, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004c792a
add esp, 4
and esp, 0xffffffff
jg 0x4baffb
call fcn.004bb000
Function at 0x4bfe01
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4bfe15
jmp 0x4bffbc
lea edx, [edx + 0x35db]
sub edx, 0x35db
dec edx
inc edx
jns 0x4bfe36
pushf
test ebx, edi
ror ebx, 8
rol ebx, 8
popf
mov esp, esp
js 0x4bfe36
mov ebx, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x4b12dc], edx
jae 0x4bfe49
xor ecx, 0
je 0x4bfe59
jne 0x4bfe50
ja 0x4bfe52
xchg ecx, ecx
mov edx, edx
jne 0x4bfe59
mov edi, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x4b10bc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x4b10bc], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x4b10b8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x4b12d0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x4b12d4], ecx
and esp, 0xffffffff
jl 0x4bfe9b
pushf
js 0x4bfe91
clc
popf
ja 0x4bfe96
jne 0x4bfe98
jge 0x4bfe9b
xor eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
ror edx, 0
jo 0x4bfedd
je 0x4bfed6
js 0x4bfed8
xchg edi, edi
jno 0x4bfedd
jmp 0x813c546b
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
ror eax, 4
ror eax, 0x1c
neg ebx
neg ebx
clc
jns 0x4bff52
jle 0x4bff68
mov esp, esp
lea edx, [edx + 0x2a0a]
lea edx, [edx - 0x2a0a]
ja 0x4bff64
jg 0x4bff68
xor eax, 0xb83d8356
adc byte [ebx], cl
add byte [esp + edx - 0x73], dh
push ebp
invalid
cmp dword [0x4b10b8], 0
je 0x4bff85
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x4b10b8]
push eax
call fcn.004c1700
mov dword [0x4b12d8], eax
xchg ebx, edx
xchg ebx, edx
jns 0x4bffac
pushf
xor ebx, 0
rol esi, 0
xor edx, 0xabb
xor edx, 0xabb
shr ebx, 0
popf
nop
jnp 0x4bffa7
xchg ebx, ebx
js 0x4bffac
mov esi, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004c4eb6
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c0273
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x4b0d38
call fcn.004c8b13
add esp, 0xc
mov byte [0x4b0d38], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x4c3fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004c4eb6
add esp, 0xc
lea ebx, [ebx]
jg 0x4c3fee
pushf
xor ecx, dword [esp]
xor ecx, dword [esp]
popf
mov esi, esi
ja 0x4c3feb
jle 0x4c3fee
call 0x7b3885b8
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
lea ebx, [ebx + 0x4b8e]
sub ebx, 0x4b8e
inc edx
dec edx
or eax, eax
shl esp, 0
js 0x4c4042
je 0x4c403d
mov esp, esp
jns 0x4c4042
jmp 0x81408dd0
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
ror edi, 0
mov edx, edx
and edi, edi
xchg edx, eax
xchg edx, eax
js 0x4c40c7
mov edi, edi
jge 0x4c40c2
jle 0x4c40c4
jns 0x4c40c7
mov esi, 0x15638e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.004d9704
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c40da
jmp 0x4c4189
call fcn.004c40df
Function at 0x4c4cb5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.004c4eb6
add esp, 0xc
neg ebx
neg ebx
test esp, 0x5523
lea edx, [edx + 0x5713]
lea edx, [edx - 0x5713]
rol esi, 0
jne 0x4c4cf2
jae 0x4c4ceb
js 0x4c4ced
xchg ecx, eax
xchg ecx, eax
je 0x4c4cf2
mov ecx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
xchg esi, edi
xchg esi, edi
jae 0x4c4d44
pushf
xor ebx, 0x53eb
xor ebx, 0x53eb
xchg esp, esp
xchg edx, ebx
xchg edx, ebx
nop
popf
jo 0x4c4d41
jb 0x4c4d44
or dword [edx - 0x167f0bb3], 0xf44d8801
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
push ebp
test dword [eax + 0x558801ea], 0xfc458af7
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
xor esp, 0
add edi, 0
jae 0x4c4dac
jno 0x4c4db5
xchg esp, esp
xchg esi, esi
jo 0x4c4db5
mov edx, 0x8889e8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x4cd643
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4c4dcd
mov eax, 1
jmp 0x4c4e96
xor eax, 0x12f
xor eax, 0x12f
xchg ebx, ebx
test dword [esp], ebx
shr esp, 0
jns 0x4c4dee
pushf
inc ebx
dec ebx
popf
jb 0x4c4de9
jae 0x4c4deb
js 0x4c4dee
add eax, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004c1700
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.004c4eb6
add esp, 0xc
cld
stc
lea edi, [edi]
jo 0x4c4e1c
jl 0x4c4e16
xchg edx, edx
jno 0x4c4e1c
sub eax, 0xec7d83bc
add byte [ebp + 7], dh
cmp dword [ebp - 0x14], 0
jne 0x4c4e29
mov eax, 1
jmp 0x4c4e96
cmp edx, 0x68cf
test dword [esp + 8], edx
jl 0x4c4e58
pushf
add esp, 0
cmc
cmp edi, 0x322c
Function at 0x4c4ee5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4b24d0], 1
jne 0x4c5039
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004c4eb6
add esp, 0xc
test dword [esp + 4], esi
mov ecx, ecx
je 0x4c4f26
pushf
rol esi, 7
ror esi, 7
jo 0x4c4f1d
popf
xchg edx, edx
mov ebx, ebx
jne 0x4c4f26
mov edi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
sub esi, 0
clc
and esp, 0xffffffff
ror ecx, 9
ror ecx, 0x17
jbe 0x4c4f79
pushf
sub ecx, 0
push eax
add eax, 0x4289
ror eax, 0xb
pop eax
jno 0x4c4f72
popf
jae 0x4c4f76
ja 0x4c4f79
mov esi, 0x80e84d8a
jmp 0xe899d783
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.004d9704
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4c4fe6
mov eax, dword [ebp + 8]
jmp 0x4c509e
cmp ebx, dword [esp]
jno 0x4c5001
lea edi, [edi + 0x23c2]
lea edi, [edi - 0x23c2]
lea ebx, [ebx]
jle 0x4c4ffb
jns 0x4c4ffd
jo 0x4c5001
lcall 0x8b52, 0xe8558d9e
inc ebp
hlt
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004c1700
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004c4eb6
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x4c5032
mov edx, dword [ebp - 8]
mov dword [0x4b24d0], edx
jmp 0x4c5037
mov eax, dword [ebp + 8]
jmp 0x4c509e
jmp 0x4c5041
mov eax, dword [0x4b24d0]
mov dword [ebp - 8], eax
std
cld
call fcn.004c5048
Function at 0x4c547e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004c4eb6
add esp, 0xc
jno 0x4c5499
rol edi, 0xf
ror edi, 0xf
or ecx, ecx
lea ebx, [ebx + 0x37fb]
lea ebx, [ebx - 0x37fb]
jge 0x4c54be
pushf
xor edi, eax
xor edi, eax
xchg esp, esp
popf
jb 0x4c54bb
jl 0x4c54be
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
rol ecx, 0x18
rol ecx, 8
xchg esp, esp
jne 0x4c54fc
not eax
not eax
jl 0x4c550e
xchg edi, edi
jns 0x4c5506
jge 0x4c5508
jl 0x4c550a
jge 0x4c550e
xor eax, 0xe84d8ac9
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
dec ecx
inc ecx
add esp, 0
mov ecx, ecx
jb 0x4c5589
mov esp, esp
jb 0x4c5583
jp 0x4c5585
jae 0x4c5589
call 0x41c33da5
add dword [eax], eax
call fcn.004d9704
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c559e
xor eax, eax
jmp 0x4c5638
cmp esp, 0x1d98
jnp 0x4c55b1
jns 0x4c55a8
lea edi, [edi]
jnp 0x4c55ac
jo 0x4c55ae
jp 0x4c55b1
or dword [ebp - 0x74ae17b3], 0xe852f855
inc edx
sar edi, 0xff
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004c1700
mov dword [ebp - 4], eax
cld
add edx, 0x184c
sub edx, 0x184c
jo 0x4c55e7
pushf
xchg ebx, ebx
rol edi, 0x19
ror edi, 0x19
cld
shr esp, 0
popf
js 0x4c55e2
xchg edx, edx
jno 0x4c55e7
mov edi, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004c4eb6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4c5601
xor eax, eax
jmp 0x4c5638
jnp 0x4c5603
rol esp, 0
jns 0x4c561c
pushf
ror edx, 0x11
ror edx, 0xf
ror esp, 0
popf
je 0x4c5617
jno 0x4c5619
js 0x4c561c
xor eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.004c792a
add esp, 4
xor ecx, 0
je 0x4c5635
mov esp, esp
mov ebx, ebx
jne 0x4c5635
mov ebp, 0xfc55ff83
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret