joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c563f
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
jg 0x4c564a
ja 0x4c5655
mov esp, esp
jns 0x4c5650
mov edi, edi
jbe 0x4c5655
sub eax, 0x8b0c458b
or byte [ecx - 0xfc407b3], cl
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp esi, eax
shr esp, 0
rol edi, 0
js 0x4c5677
pushf
and eax, 0xffffffff
std
cld
popf
je 0x4c5672
jno 0x4c5674
jns 0x4c5677
mov eax, 0x8b0c558b
inc edx
add al, 0x89
inc ebp
invalid
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
std
cld
xchg esp, esp
jne 0x4c569a
pushf
ror edi, 0x11
ror edi, 0xf
or esp, 0
xchg ebx, ebx
popf
mov edx, edx
je 0x4c569a
sub eax, 0xf445c7
add byte [eax], al
add bh, al
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
add esi, 0x338b
sub esi, 0x338b
add ecx, 0x1143
sub ecx, 0x1143
shl esp, 0
call fcn.004c56c8
Function at 0x4cc72e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004c4eb6
add esp, 0xc
mov esp, esp
lea edi, [edi]
call 0x4cc750
add esp, 4
jge 0x4cc75f
xchg edi, ebx
xchg edi, ebx
ja 0x4cc75b
jl 0x4cc75f
mov esp, 0xec45c69e
inc esp
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
mov esp, esp
rol ebx, 0
xor esp, 0
jo 0x4cc7b1
pushf
mov esp, esp
shr ecx, 0
popf
lea ecx, [ecx + 0x30c1]
lea ecx, [ecx - 0x30c1]
jno 0x4cc7b1
add eax, 0x80ec4d8a
jmp 0xec9a4fbb
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004d9704
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4cc826
xor eax, eax
jmp 0x4cc8ca
add esp, 0
shr esp, 0
js 0x4cc82e
cmc
jl 0x4cc842
pushf
cmp eax, esi
xchg esi, edi
xchg esi, edi
popf
jp 0x4cc83d
jle 0x4cc83f
jge 0x4cc842
add eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004c1700
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004c4eb6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4cc86c
xor eax, eax
jmp 0x4cc8ca
xchg esi, esi
shl esp, 0
nop
jge 0x4cc874
je 0x4cc88f
pushf
dec ecx
inc ecx
js 0x4cc87c
mov ecx, ecx
xor edi, ebx
xor edi, ebx
popf
xchg ecx, ecx
jle 0x4cc888
xchg edi, esi
xchg edi, esi
jne 0x4cc88f
mov edx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004c792a
add esp, 4
clc
test dword [esp], eax
cmp edx, edi
jne 0x4cc8c3
pushf
or ebx, 0
lea edx, [edx + 0x5b04]
lea edx, [edx - 0x5b04]
cmp edi, 0x2c51
std
cld
popf
lea esi, [esi]
je 0x4cc8c3
mov edx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4cd4e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004c4eb6
add esp, 0xc
jno 0x4cd502
jno 0x4cd509
jle 0x4cd506
jo 0x4cd509
mov esi, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004d9704
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4cd5d1
xor eax, eax
jmp 0x4cd63a
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004c1700
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004c4eb6
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x4cd5fb
xor eax, eax
jmp 0x4cd63a
test esi, 0x5fad
cmp ecx, 0x3c90
jae 0x4cd609
jne 0x4cd60b
jae 0x4cd619
jb 0x4cd60f
lea edx, [edx]
jb 0x4cd613
jbe 0x4cd615
jb 0x4cd619
lcall 0xe850, 0xe8458b1d
or byte [ebx - 0x3b7c0001], ah
add al, 0x90
mov eax, dword [ebp - 0x18]
push eax
call fcn.004c792a
add esp, 4
nop
jns 0x4cd62f
jnp 0x4cd62a
jle 0x4cd62c
js 0x4cd62f
call 0x515923be
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d1726
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004c4eb6
add esp, 0xc
neg edi
neg edi
cmp edx, dword [esp + 4]
jo 0x4d175e
pushf
lea esp, [esp]
popf
ja 0x4d1759
xchg ebx, ebx
jno 0x4d175e
add esi, 0xc651e845
inc ebp
in eax, dx
je 0x4d172d
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jg 0x4d1809
and ebx, 0xffffffff
jge 0x4d181b
pushf
je 0x4d1812
popf
jb 0x4d1816
xchg esp, esp
jl 0x4d181b
ljmp 0x8900:0x7ee4e8
call fcn.004d9704
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d1830
xor eax, eax
jmp 0x4d18bb
cmc
jl 0x4d1833
je 0x4d183d
xchg edi, esi
xchg edi, esi
jne 0x4d183d
xor eax, 0xe8558d04
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004c1700
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004c4eb6
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4d1867
xor eax, eax
jmp 0x4d18bb
lea esi, [esi + 0x4f]
lea esi, [esi - 0x4f]
ror esp, 0
js 0x4d1872
and esp, 0xffffffff
jne 0x4d1887
pushf
add esp, 0
je 0x4d187e
popf
jg 0x4d1882
xchg esp, esp
je 0x4d1887
mov ecx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004c792a
add esp, 4
je 0x4d1895
nop
or esp, 0
xor edi, 0x692c
xor edi, 0x692c
js 0x4d18b0
lea esp, [esp]
mov ebx, ebx
jns 0x4d18b0
mov ecx, 0xc458b91
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d7bd9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4b24cc], 1
jne 0x4d7d5a
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004c4eb6
add esp, 0xc
not eax
not eax
cmp esp, 0x3c49
lea edx, [edx + 0x4dfd]
sub edx, 0x4dfd
std
cld
jg 0x4d7c31
jns 0x4d7c1b
mov eax, eax
lea esi, [esi + 0x3cb4]
lea esi, [esi - 0x3cb4]
xchg ebx, ecx
xchg ebx, ecx
jle 0x4d7c31
xor eax, 0xe845c663
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
jb 0x4d7c63
jg 0x4d7c65
jae 0x4d7c6d
nop
jno 0x4d7c6a
jb 0x4d7c6d
mov esi, 0x80e84d8a
jmp 0xe89b0477
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.004d9704
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4d7ce2
xor eax, eax
jmp 0x4d7d9e
cmp edx, dword [esp + 0xc]
mov ebx, ebx
shr esp, 0
jl 0x4d7cf7
je 0x4d7cef
je 0x4d7cf1
mov esi, esi
nop
jge 0x4d7cf7
mov esi, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004c1700
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004c4eb6
add esp, 0xc
jmp 0x4d7d19
and edi, 0xffffffff
jle 0x4d7d1e
push ecx
add ecx, 0x642d
ror ecx, 0x1e
pop ecx
jne 0x4d7d44
pushf
xor edx, 0x1e02
xor edx, 0x1e02
jl 0x4d7d3b
popf
mov esp, esp
lea edi, [edi]
je 0x4d7d44
add eax, 0xf87d83
cmp dword [ebp - 8], 0
je 0x4d7d54
mov eax, dword [ebp - 8]
mov dword [0x4b24cc], eax
jmp 0x4d7d58
xor eax, eax
jmp 0x4d7d9e
jmp 0x4d7d63
mov ecx, dword [0x4b24cc]
mov dword [ebp - 8], ecx
sub ecx, 0
jge 0x4d7d6e
jo 0x4d7d6a
jl 0x4d7d6e
sub eax, 0xf8558bcc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cld
jbe 0x4d7d87
pushf
stc
add ebx, dword [esp]
sub ebx, dword [esp]
popf
lea ecx, [ecx]
ja 0x4d7d87
lcall 0x9ae8, 0x50fc458b
sti
invalid
mov eax, dword [ebp - 4]
push eax
call fcn.004c792a
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d8aca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004c4eb6
add esp, 0xc
jnp 0x4d8ae5
jb 0x4d8ae7
jo 0x4d8afb
pushf
cmp eax, dword [esp]
cmp edx, ebx
popf
jns 0x4d8af4
jns 0x4d8af6
mov ebx, ebx
jno 0x4d8afb
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x55
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0
lea ebx, [ebx + 0x167b]
lea ebx, [ebx - 0x167b]
jns 0x4d8b4f
pushf
or esp, 0
xor esi, 0
nop
popf
jns 0x4d8b4a
jl 0x4d8b4c
js 0x4d8b4f
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
call fcn.004d9704
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d8bc7
jmp 0x4d8c39
jge 0x4d8bc9
nop
xchg esp, esp
jge 0x4d8bda
jmp 0x4d8bd0
mov esi, esi
jne 0x4d8bd4
jno 0x4d8bd6
jl 0x4d8bda
add eax, 0xe84d8df5
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004c1700
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004c4eb6
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4d8c39
jnp 0x4d8c02
lea ebx, [ebx]
mov esp, esp
not edi
not edi
je 0x4d8c19
pushf
rol esp, 0
popf
nop
lea edx, [edx]
jne 0x4d8c19
mov edi, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.004c792a
add esp, 4
je 0x4d8c27
je 0x4d8c32
xchg edx, eax
xchg edx, eax
jbe 0x4d8c2d
jne 0x4d8c32
mov ecx, 0x558b193a
or byte [edx - 1], dl
push ebp
cld
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4da48a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004c4eb6
add esp, 0xc
lea ecx, [ecx + 0xe27]
lea ecx, [ecx - 0xe27]
jno 0x4da4c5
pushf
xor esi, dword [esp]
xor esi, dword [esp]
stc
popf
jns 0x4da4be
mov edx, edx
jg 0x4da4c2
jo 0x4da4c5
mov ecx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
xchg ebx, ebx
je 0x4da51e
pushf
std
cld
popf
mov ecx, ecx
lea ecx, [ecx]
jne 0x4da51e
jmp 0x8135f2ac
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.004d9704
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4da5c7
xor eax, eax
jmp 0x4da653
xor ecx, 0
add ebx, dword [esp]
sub ebx, dword [esp]
cmp esp, 0x3c6c
jno 0x4da5d8
jge 0x4da5ed
pushf
cmp edi, 0x2b6c
xchg edi, edi
xchg edx, edx
popf
jle 0x4da5ea
jl 0x4da5ed
mov ebp, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004c1700
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.004c4eb6
add esp, 0xc
nop
ror esi, 0x1c
rol esi, 0x1c
jle 0x4da621
pushf
jne 0x4da61a
popf
jno 0x4da61e
jg 0x4da621
xor eax, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x4da62b
xor eax, eax
jmp 0x4da653
mov eax, eax
and esp, 0xffffffff
jno 0x4da638
xchg esp, esp
jo 0x4da638
mov eax, 0xe4458b1a
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004c792a
add esp, 4
and esp, 0xffffffff
cld
jns 0x4da650
lea esp, [esp]
js 0x4da650
add eax, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fe13c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0xc], 2
mov dword [ebp - 0x38], 0x3f6e5466
mov dword [ebp - 0x34], 0xbfee5466
mov dword [ebp - 0x30], 0x3f6e5466
mov dword [ebp - 0x2c], 0xbfedf636
mov dword [ebp - 0x28], 0x3f5d652a
mov dword [ebp - 0x24], 0x3f782792
mov dword [ebp - 0x20], 0xbff82792
mov dword [ebp - 0x1c], 0x3f782792
mov dword [ebp - 0x18], 0xbff7c581
mov dword [ebp - 0x14], 0x3f711348
mov eax, dword [ebp + 0xc]
shl eax, 2
push eax
call fcn.00608111
add esp, 4
mov dword [ebp - 8], eax
fld dword [ebp + 0x10]
sub esp, 8
fstp qword [esp]
call fcn.006090d4
add esp, 8
fst dword [ebp - 0x40]
fdivr dword [0x65f908]
fstp dword [ebp - 4]
mov dword [ebp - 0x10], 0
jmp 0x4fe1d3
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jae 0x4fe1f9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + eax*2]
mov dword [ebp - 0x44], edx
fild dword [ebp - 0x44]
fmul dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
fstp dword [ecx + eax*4]
jmp 0x4fe1ca
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x3c]
call fcn.00501b40
mov dword [ebp - 0x10], 0
jmp 0x4fe227
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0xc]
jae 0x4fe249
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
fld dword [eax + edx*4]
call fcn.0060838c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov word [edx + ecx*2], ax
jmp 0x4fe21e
mov eax, dword [ebp - 8]
push eax
call fcn.0060824b
add esp, 4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51fdba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x2f], 0x10
mov byte [ebp - 0x2e], 0x18
mov byte [ebp - 0x2d], 0x20
mov byte [ebp - 0x2c], 0x28
mov byte [ebp - 0x2b], 0x30
mov byte [ebp - 0x2a], 0x38
mov byte [ebp - 0x29], 0x40
mov byte [ebp - 0x28], 0x48
mov byte [ebp - 0x27], 0x50
mov byte [ebp - 0x26], 0x58
mov byte [ebp - 0x25], 0x60
mov byte [ebp - 0x24], 0x68
mov byte [ebp - 0x23], 0x70
mov byte [ebp - 0x22], 0x78
mov byte [ebp - 0x21], 0x80
mov byte [ebp - 0x20], 0x88
mov byte [ebp - 0x1f], 0x90
mov byte [ebp - 0x1e], 0x98
mov byte [ebp - 0x1d], 0xa0
mov byte [ebp - 0x1c], 0xa8
mov byte [ebp - 0x1b], 0xb0
mov byte [ebp - 0x1a], 0xb8
mov byte [ebp - 0x19], 0xc0
mov byte [ebp - 0x18], 0xc8
mov byte [ebp - 0x17], 0xd0
mov byte [ebp - 0x16], 0xd8
mov byte [ebp - 0x15], 0xe0
mov byte [ebp - 0x14], 0xe8
mov byte [ebp - 0x13], 0xf0
mov byte [ebp - 0x12], 0xf8
mov byte [ebp - 0x11], 0xff
mov ax, word [ebp + 0xc]
mov word [ebp - 8], ax
mov cx, word [ebp + 0xc]
mov word [ebp - 0xc], cx
mov dx, word [ebp + 0xc]
mov word [ebp - 4], dx
mov ax, word [ebp - 8]
shl ax, 1
mov word [ebp - 8], ax
mov cx, word [ebp - 8]
shr cx, 0xb
mov word [ebp - 8], cx
mov dx, word [ebp - 0xc]
shl dx, 6
mov word [ebp - 0xc], dx
mov ax, word [ebp - 0xc]
shr ax, 0xb
mov word [ebp - 0xc], ax
mov cx, word [ebp - 4]
shl cx, 0xb
mov word [ebp - 4], cx
mov dx, word [ebp - 4]
shr dx, 0xb
mov word [ebp - 4], dx
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
and eax, 0xffff
mov cl, byte [ebp + eax - 0x30]
mov byte [ebp - 0x10], cl
mov edx, dword [ebp - 0xc]
and edx, 0xffff
mov al, byte [ebp + edx - 0x30]
mov byte [ebp - 0xf], al
mov ecx, dword [ebp - 8]
and ecx, 0xffff
mov dl, byte [ebp + ecx - 0x30]
mov byte [ebp - 0xe], dl
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x565167
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
call fcn.0040ebf0
mov eax, dword [eax + 0x1c]
mov dword [ebp - 4], eax
call fcn.005f7550
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x34]
push ecx
push 1
call fcn.005f7610
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c0]
cmp eax, dword [ebp - 0x34]
je 0x5651c4
push 0
push 0
xor ecx, ecx
mov cl, byte [0x6dfa28]
lea ecx, [ecx*4 + 0x72e364]
call fcn.0041e980
push eax
call fcn.006308c8
push 0xffffffffffffffff
call fcn.00607fcc
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + 0x1c9]
test eax, eax
je 0x5651e1
push 0
push 0
push 0x6bb994
call fcn.006308c8
mov esp, ebp
pop ebp
ret

Function at 0x572bec
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov dword [ebp - 0x98], 0x3e9
mov dword [ebp - 0x94], 1
mov dword [ebp - 0xb0], 1
mov dword [ebp - 4], 0x97
mov byte [ebp - 8], 0
mov ax, word [ebp + 8]
push eax
call fcn.005f77e0
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.00572a9c
add esp, 4
cmp dword [ebp - 0x90], 0
jne 0x572e1f
push 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xb0]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
mov edx, dword [ebp - 0x98]
push edx
call fcn.005fda40
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x572c88
mov eax, dword [ebp - 0x90]
push eax
call fcn.00572a9c
add esp, 4
cmp dword [ebp - 0x90], 0
jne 0x572e09
push 0x72e798
call fcn.005f7b80
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x572cbd
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.00572a9c
add esp, 4
cmp dword [ebp - 0x90], 0
jne 0x572ddf
push 0x80
push 0
lea edx, [ebp - 0x88]
push edx
call fcn.00607d60
add esp, 0xc
mov dword [ebp - 0x8c], 0x80
push 0
push 0
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x98]
push edx
call fcn.005fdb30
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x572d35
cmp dword [ebp - 0x90], 0x27
jne 0x572d26
mov byte [ebp - 8], 1
jmp 0x572d35
mov eax, dword [ebp - 0x90]
push eax
call fcn.00572a9c
add esp, 4
mov ecx, dword [ebp - 8]
and ecx, 0xff
test ecx, ecx
jne 0x572ddf
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x8c], 4
push 0
push 1
lea edx, [ebp - 0x8c]
push edx
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.005fdb30
mov dword [ebp - 0x90], eax
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x98]
push edx
call fcn.005fdbc0
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x572ddf
mov eax, dword [ebp - 0x90]
push eax
call fcn.00572a9c
add esp, 4
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.005fdaf0
mov dword [ebp - 0x90], eax
call fcn.005f7c90
mov dword [ebp - 0x90], eax
call fcn.005f7900
mov dword [ebp - 0x90], eax
push 0xffffffffffffffff
call fcn.00607fcc
mov edx, dword [ebp - 0x98]
push edx
call fcn.005fdaf0
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x572e09
mov eax, dword [ebp - 0x90]
push eax
call fcn.00572a9c
add esp, 4
call fcn.005f7c90
mov dword [ebp - 0x90], eax
call fcn.005f7900
mov dword [ebp - 0x90], eax
mov esp, ebp
pop ebp
ret