joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0a4d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.004a5bec
add esp, 0xc
add edx, 0x20a4
sub edx, 0x20a4
and esp, 0xffffffff
inc edi
dec edi
jge 0x4a0a86
pushf
shl ecx, 0
nop
popf
xchg edi, edi
jl 0x4a0a86
xor eax, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
ror ebx, 0xe
rol ebx, 0xe
mov esp, esp
jne 0x4a0ac5
xchg esp, esp
je 0x4a0ac5
mov ebp, 0x80f44d8a
jmp 0xf49792cf
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
jo 0x4a0b27
ja 0x4a0b29
je 0x4a0b36
pushf
cmc
jle 0x4a0b30
popf
nop
jne 0x4a0b36
jmp 0x1a4e622
call 0x4b6615
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4a0b4e
mov eax, 1
jmp 0x4a0be3
ror esp, 0
jae 0x4a0b53
js 0x4a0b55
jo 0x4a0b5d
ja 0x4a0b59
jno 0x4a0b5d
xor eax, 0xf4458ded
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004b7254
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.004a5bec
add esp, 0xc
shl edx, 0
nop
jo 0x4a0b97
lea edx, [edx + 0x1201]
lea edx, [edx - 0x1201]
xchg edx, ebx
xchg edx, ebx
jno 0x4a0b97
jmp 0xecc78f12
cmp dword [ebp - 0x14], 0
jne 0x4a0ba4
mov eax, 1
jmp 0x4a0be3
cmp edi, 0x1a1a
jns 0x4a0bb8
pushf
mov eax, eax
cld
popf
lea esi, [esi]
js 0x4a0bb8
mov ebp, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.004939ae
add esp, 4
mov ecx, ecx
jns 0x4a0bdc
pushf
std
cld
lea eax, [eax]
cmp esi, dword [esp]
popf
mov edi, edi
jp 0x4a0bd7
mov esi, esi
js 0x4a0bdc
lcall 0x55ff, 0x51084d8b
in al, dx
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a4294
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a5bec
add esp, 0xc
add eax, 0x11d4
sub eax, 0x11d4
cld
xor edi, dword [esp]
xor edi, dword [esp]
lea edx, [edx + 0x56f9]
sub edx, 0x56f9
jl 0x4a42e3
pushf
lea edi, [edi + 0x3d8c]
sub edi, 0x3d8c
cmp ecx, edi
popf
xchg esp, esp
jge 0x4a42e3
mov esi, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
jae 0x4a4325
and ebx, ebx
xor esp, 0
js 0x4a4331
jnp 0x4a432e
jns 0x4a4331
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.004a5c1b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a43c5
xor eax, eax
jmp 0x4a4425
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004b7254
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a5bec
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4a4423
jo 0x4a43ed
jp 0x4a43f5
jle 0x4a43f1
jnp 0x4a43f5
add eax, 0xe84d8b91
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004939ae
add esp, 4
jnp 0x4a4403
je 0x4a441a
pushf
nop
lea esi, [esi]
shl esp, 0
ror eax, 0xb
rol eax, 0xb
popf
jns 0x4a4417
jne 0x4a441a
lcall 0x55ff, 0x5208558b
call 0xc07d4710
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x4a4425
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a47a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004a5bec
add esp, 0xc
shr esp, 0
lea esi, [esi + 0x5a47]
lea esi, [esi - 0x5a47]
or edi, edi
jno 0x4a47d3
jno 0x4a47f4
pushf
lea esp, [esp]
lea esp, [esp]
test dword [esp], edx
popf
js 0x4a47e4
nop
lea ebx, [ebx + 0x5e7d]
lea ebx, [ebx - 0x5e7d]
jo 0x4a47f4
mov ebx, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
ror esi, 0
jno 0x4a483e
pushf
push edi
add edi, 0x2297
ror edi, 6
pop edi
cmp esi, dword [esp]
popf
mov ecx, ecx
js 0x4a4837
xchg edi, edx
xchg edi, edx
jo 0x4a483e
mov esp, 0x80f04d8a
jmp 0xf097d048
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.004a5c1b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a489e
xor eax, eax
jmp 0x4a490c
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004b7254
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004a5bec
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x4a490a
std
cld
ja 0x4a48da
jle 0x4a48ca
lea esi, [esi + 0x60f5]
lea esi, [esi - 0x60f5]
jbe 0x4a48da
xor eax, 0xec4d8bad
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004939ae
add esp, 4
sub eax, 0
jne 0x4a48eb
neg edi
neg edi
test dword [esp + 0xc], esi
je 0x4a48fd
jns 0x4a48f7
lea edi, [edi]
jne 0x4a48fd
mov ebp, 0xc558b9d
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x4a490c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a5483
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a5bec
add esp, 0xc
test edx, 0x56dc
add edi, dword [esp]
sub edi, dword [esp]
neg eax
neg eax
shr ecx, 0
jle 0x4a54ba
jg 0x4a54b3
jbe 0x4a54b5
jg 0x4a54b7
jg 0x4a54ba
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
je 0x4a54f0
jne 0x4a54f2
lea eax, [eax + 0xc96]
lea eax, [eax - 0xc96]
jo 0x4a550e
lea edi, [edi]
lea esp, [esp]
jns 0x4a5507
jno 0x4a5509
jno 0x4a550e
ljmp 0x80e8:0x4d8ac2ef
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
cmc
shl esp, 0
je 0x4a557c
js 0x4a557e
jb 0x4a558f
pushf
xchg edi, ecx
xchg edi, ecx
popf
jae 0x4a558a
xchg ecx, eax
xchg ecx, eax
jae 0x4a558f
mov ebp, 0xfea4c1e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.0048fa55
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a55a4
xor eax, eax
jmp 0x4a5632
std
cld
jbe 0x4a55ad
lea edx, [edx]
ja 0x4a55ad
mov esp, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004b7254
mov dword [ebp - 4], eax
nop
add esi, 0x5071
sub esi, 0x5071
push ebx
add ebx, 0x3465
ror ebx, 0xe
pop ebx
jo 0x4a55e5
pushf
clc
inc ecx
dec ecx
and edx, edx
popf
jp 0x4a55e2
jno 0x4a55e5
mov edx, 0x6a0d6a
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a5bec
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4a55ff
xor eax, eax
jmp 0x4a5632
shr esp, 0
jb 0x4a5608
nop
jae 0x4a5608
or dword [ebx - 0x17ae03b3], 0xfffee39d
mov ecx, dword [ebp - 4]
push ecx
call fcn.004939ae
add esp, 4
je 0x4a5616
test dword [esp], edi
jp 0x4a562f
pushf
inc esi
dec esi
cmc
popf
jb 0x4a5624
xchg edx, ebx
xchg edx, ebx
xchg edi, esi
xchg edi, esi
jnp 0x4a562f
add eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5fdf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a5bec
add esp, 0xc
and esp, 0xffffffff
ja 0x4a6004
je 0x4a5fff
jmp 0x4a6001
jbe 0x4a6004
xor eax, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
cld
jo 0x4a603e
nop
jb 0x4a603a
jno 0x4a603e
mov ecx, 0xec4d8aed
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
xchg esp, esp
jb 0x4a60b0
pushf
nop
popf
jno 0x4a60a9
lea ebx, [ebx]
jns 0x4a60ad
jae 0x4a60b0
call 0xfee4019c
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.0048fa55
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a60c5
xor eax, eax
jmp 0x4a6156
add esi, dword [esp]
sub esi, dword [esp]
jo 0x4a60d8
jno 0x4a60cf
xchg edx, edx
lea esp, [esp]
jno 0x4a60d8
jmp 0xec8fee20
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004b7254
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004a5bec
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4a6147
nop
je 0x4a6101
nop
xchg ebx, eax
xchg ebx, eax
jle 0x4a610b
jg 0x4a6108
jg 0x4a610b
mov ebx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004939ae
add esp, 4
shl ebx, 0
js 0x4a613e
pushf
xchg esi, esi
jb 0x4a6122
neg eax
neg eax
lea eax, [eax + 0x5afb]
sub eax, 0x5afb
popf
shr esp, 0
jbe 0x4a6154
nop
jns 0x4a614f
mov edi, edi
ja 0x4a6154
mov ebp, 0x5e5fc033
xor eax, eax
Function at 0x4a6632
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.004a5bec
add esp, 0xc
push 0x21
push 0x485d64
lea ecx, [ebp - 0x138]
push ecx
call fcn.004b7f07
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4a673a
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.004a5bec
add esp, 0xc
push 0xb
push 0x485d88
lea edx, [ebp - 0x138]
push edx
call fcn.004b7f07
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x4a672d
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004b7f07
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4a673c
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4abca1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a5bec
add esp, 0xc
xor edi, ebx
xor edi, ebx
ja 0x4abcd1
mov esp, esp
jae 0x4abccb
xchg esp, esp
jbe 0x4abcd1
add eax, 0xec45c6f0
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0048fa55
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4abd9c
xor eax, eax
jmp 0x4abe25
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b7254
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004a5bec
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x4abdc6
xor eax, eax
jmp 0x4abe25
test edi, eax
je 0x4abdca
inc ecx
dec ecx
or eax, eax
jge 0x4abdfc
pushf
add esp, 0
xchg ecx, edi
xchg ecx, edi
lea edi, [edi + 0x16ee]
lea edi, [edi - 0x16ee]
mov esi, esi
popf
lea eax, [eax + 0x2bf]
lea eax, [eax - 0x2bf]
jns 0x4abdf7
xchg ebx, ebx
jl 0x4abdfc
mov esi, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.004939ae
add esp, 4
xchg edi, eax
xchg edi, eax
stc
rol esp, 0
jae 0x4abe1a
jg 0x4abe12
jno 0x4abe14
xchg ecx, eax
xchg ecx, eax
jb 0x4abe1a
mov esp, 0xc4d8b5d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4abe2e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004a5bec
add esp, 0xc
and edi, 0xffffffff
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
jbe 0x4abe6c
pushf
or ecx, 0
xor ecx, 0
popf
xchg esp, esp
xchg esp, esp
ja 0x4abe6c
add eax, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
nop
cmc
clc
jp 0x4abea7
jmp 0x4abea3
jnp 0x4abea7
mov edi, 0xf04d8ab1
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
rol edx, 0x10
rol edx, 0x10
jns 0x4abf24
pushf
cmp edx, dword [esp]
cmp eax, ecx
cmp edx, dword [esp + 4]
cmp edx, dword [esp]
popf
jnp 0x4abf21
js 0x4abf24
ljmp 0x89ff:0xff9cf2e8
call fcn.004a5c1b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4abf36
xor eax, eax
jmp 0x4abf6c
test edi, eax
je 0x4abf49
pushf
xor edi, esi
xor edi, esi
popf
jns 0x4abf44
jb 0x4abf46
jne 0x4abf49
mov esi, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b7254
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004a5bec
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4acb65
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a5bec
add esp, 0xc
jle 0x4acb87
jns 0x4acb89
ror edx, 0
jp 0x4acba3
jmp 0x4acb90
jg 0x4acb92
xchg ebx, eax
xchg ebx, eax
lea eax, [eax + 0x40ea]
lea eax, [eax - 0x40ea]
jnp 0x4acba3
mov edx, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
ror esp, 0
jo 0x4acc57
jl 0x4acc53
jno 0x4acc57
lcall 0xfffe, 0x2df9e8a9
call fcn.0048fa55
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4acc6c
xor eax, eax
jmp 0x4accfd
xor eax, 0
jb 0x4acc84
pushf
add ecx, 0
rol eax, 0
jbe 0x4acc7b
popf
jle 0x4acc7f
js 0x4acc81
jae 0x4acc84
mov edx, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004b7254
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004a5bec
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4accae
xor eax, eax
jmp 0x4accfd
rol ecx, 7
rol ecx, 0x19
add esp, 0
not eax
not eax
or ebx, 0
jae 0x4accd3
pushf
jge 0x4accc4
nop
xchg edi, edx
xchg edi, edx
stc
popf
jne 0x4accce
ja 0x4accd0
jb 0x4accd3
ljmp 0xd2e8:0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004939ae
add esp, 4
lea edx, [edx]
cld
sub esp, 0
jns 0x4accf2
jns 0x4acce9
jns 0x4acceb
lea edx, [edx]
js 0x4accf2
cmp ebx, 0xc458b2b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4addee
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x484284
call fcn.004996fc
add esp, 0xc
mov byte [0x484284], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret