joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483b7d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048801b
add esp, 0xc
ja 0x483b98
je 0x483bb7
pushf
xor ecx, 0x7d36
xor ecx, 0x7d36
shl ecx, 0
test dword [esp], eax
nop
popf
nop
jp 0x483bb4
jne 0x483bb7
mov ecx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
nop
jge 0x483bf4
xchg ebx, edi
xchg ebx, edi
jmp 0x483bf0
jl 0x483bf4
mov eax, 0xec4d8a54
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004980f3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x483c69
xor eax, eax
jmp 0x483cf3
or esp, 0
jl 0x483c6e
jbe 0x483c77
jb 0x483c72
js 0x483c74
ja 0x483c77
jmp 0x51348208
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00488963
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0048801b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x483ca1
xor eax, eax
jmp 0x483cf3
ja 0x483ca3
mov esp, esp
jle 0x483cb7
lea esi, [esi + 0xf98]
lea esi, [esi - 0xf98]
jg 0x483cb7
add eax, 0xfc458b2f
mov eax, dword [ebp - 4]
push eax
call fcn.00496b37
add esp, 4
cmp esp, 0x6633
jne 0x483ccb
ror esi, 0x14
rol esi, 0x14
jno 0x483cd3
jbe 0x483cec
pushf
test ecx, esi
shl esp, 0
add eax, 0
ror edx, 0x12
rol edx, 0x12
popf
jae 0x483ce9
ja 0x483cec
lcall 0x55ff, 0x51084d8b
cld
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4864e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048801b
add esp, 0xc
clc
jp 0x48650e
jo 0x486507
jnp 0x486509
jg 0x48650b
jnp 0x48650e
call 0x5434aad8
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
jnp 0x48654c
je 0x48654e
js 0x486550
je 0x48655a
lea esi, [esi]
jb 0x486556
jne 0x48655a
lcall 0xe980, 0xec4d8ae0
add dword [eax + 0x558aec4d], ecx
test dword [eax + 0x558801ea], 0xf3458af7
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.004980f3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4865e4
jmp 0x48664f
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00488963
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0048801b
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x48664f
not eax
not eax
je 0x486618
ja 0x486612
jnp 0x486614
jne 0x486618
mov edx, 0xe8458b31
mov eax, dword [ebp - 0x18]
push eax
call fcn.00496b37
add esp, 4
jae 0x486626
jg 0x486628
xor edi, eax
xor edi, eax
jnp 0x48663c
pushf
and eax, eax
popf
jge 0x486636
lea esp, [esp]
jp 0x48663c
jmp 0x515cb3cb
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x489417
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0048801b
add esp, 0xc
jmp 0x489432
not eax
not eax
or esi, 0
jns 0x489450
pushf
xchg edi, eax
xchg edi, eax
xor esi, 0
xor esp, 0
popf
jge 0x489449
je 0x48944b
jmp 0x48944d
js 0x489450
mov eax, 0x48e045c6
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
xchg esi, eax
xchg esi, eax
jge 0x4894a9
jnp 0x4894a2
jno 0x4894a4
lea esi, [esi]
jl 0x4894a9
call 0x8128e237
jmp 0xe0961cb3
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
xchg esp, esp
jb 0x489554
jle 0x48954b
lea eax, [eax]
jle 0x48954f
jae 0x489554
mov ebp, 0x9ae8b3ce
jmp 0x489558
call fcn.004980f3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x489569
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
xor eax, eax
jmp 0x489835
xchg esp, esp
jl 0x489593
pushf
lea esi, [esi + 0x7e5a]
lea esi, [esi - 0x7e5a]
jge 0x48957d
or ebx, 0
lea ecx, [ecx + 0x5ebd]
sub ecx, 0x5ebd
popf
jg 0x489590
jge 0x489593
mov eax, 0x51e04d8d
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00488963
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0048801b
add esp, 0xc
mov esi, esi
call fcn.004895ba
Function at 0x48b7aa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048801b
add esp, 0xc
test dword [esp + 8], ecx
cld
nop
xor eax, 0x812
xor eax, 0x812
ja 0x48b7ff
pushf
shl esp, 0
or esp, 0
rol esp, 0
jp 0x48b7e2
popf
lea ecx, [ecx + 0x95f]
lea ecx, [ecx - 0x95f]
lea edx, [edx + 0x66f2]
lea edx, [edx - 0x66f2]
jbe 0x48b7ff
xor eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
mov esp, esp
not ecx
not ecx
jge 0x48b850
pushf
jl 0x48b843
test esp, 0x6775
popf
jp 0x48b84d
jl 0x48b850
ljmp 0x1e9:0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
shr ecx, 0
cmp esi, ecx
js 0x48b8ea
pushf
cmp esi, 0x7478
ror ecx, 0
add ecx, 0x2161
sub ecx, 0x2161
popf
jns 0x48b8e3
jno 0x48b8e5
jbe 0x48b8e7
jns 0x48b8ea
call fcn.004980f3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48b8fd
xchg esi, esi
jle 0x48b901
jg 0x48b90b
je 0x48b905
nop
lea edi, [edi]
jle 0x48b90b
call 0x53310e9c
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00488963
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0048801b
add esp, 0xc
ror esp, 0
jne 0x48b930
jnp 0x48b932
lea esi, [esi]
jo 0x48b94a
pushf
or esp, 0
test dword [esp + 0xc], edi
push edx
pop edx
popf
jno 0x48b945
jno 0x48b947
jno 0x48b94a
mov ebx, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x48b952
jmp 0x48b9a8
cmp edx, dword [esp + 0x10]
push edx
add edx, 0x38c0
ror edx, 0x1a
pop edx
ja 0x48b968
mov eax, eax
jbe 0x48b968
mov ebp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00496b37
add esp, 4
cmp edi, esi
lea ecx, [ecx + 0x4a1e]
lea ecx, [ecx - 0x4a1e]
test esp, 0x715c
xor esi, edx
xor esi, edx
jae 0x48b9a1
lea ebx, [ebx + 0x5d3f]
lea ebx, [ebx - 0x5d3f]
jno 0x48b99c
xchg esp, esp
jb 0x48b9a1
ljmp 0x55ff:0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
Function at 0x4940ee
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dword [esp + 0xc], ebx
add eax, dword [esp]
sub eax, dword [esp]
std
cld
cmp esi, dword [esp]
jp 0x494114
pushf
rol ebx, 0
ror edi, 0
popf
lea edi, [edi]
jnp 0x494114
mov ebp, 0x2968006a
scasb al, byte es:[edi]
dec ecx
add bh, bh
adc eax, sym.imp.USER32.dll_EnumWindows
push 0
push 0x49ae29
call dword [sym.imp.USER32.dll_EnumWindows]
jne 0x494123
lea eax, [eax + 0x6938]
sub eax, 0x6938
test dword [esp], edi
jle 0x49414e
pushf
lea ebx, [ebx + 0x2481]
sub ebx, 0x2481
ror ecx, 0xd
rol ecx, 0xd
popf
jno 0x49414b
jg 0x49414e
mov eax, 0x56283d83
inc edi
add byte [eax], al
cmp dword [0x475628], 0
jle 0x49419f
add eax, 0
std
cld
jb 0x494178
pushf
xor ecx, dword [esp + 4]
xor ecx, dword [esp + 4]
push eax
pop eax
test esp, 0x67ce
popf
lea esp, [esp]
jae 0x494178
mov edi, 0x17b8
add bl, ch
and eax, 0xcbc10073
adc eax, ecx
retf
mov eax, 0x17
jmp 0x4941a4
mov eax, 0x45
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x495080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048801b
add esp, 0xc
jle 0x49509b
and esp, 0xffffffff
and ebx, ebx
jbe 0x4950a8
mov esp, esp
ja 0x4950a8
mov ebx, 0xe845c69d
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
xor eax, 0
not ebx
not ebx
or edx, 0
jne 0x495107
js 0x4950fe
jo 0x495100
jae 0x495102
xchg ebx, ebx
je 0x495107
mov eax, 0x80e84d8a
jmp 0xe896d911
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.004980f3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4951b0
xor eax, eax
jmp 0x495243
sub esp, 0
jns 0x4951b5
jp 0x4951c1
pushf
stc
popf
jb 0x4951be
jnp 0x4951c1
call 0x51319752
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00488963
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0048801b
add esp, 0xc
rol edi, 0xc
rol edi, 0x14
cmc
push esi
pop esi
jl 0x4951ec
jns 0x495204
lea esi, [esi + 0x4924]
lea esi, [esi - 0x4924]
je 0x4951fc
mov ebx, ebx
jp 0x495200
js 0x495204
mov edi, 0xe47d83c6
add byte [ebp + 4], dh
cmp dword [ebp - 0x1c], 0
jne 0x49520e
xor eax, eax
jmp 0x495243
test edx, ecx
sub eax, 0
ja 0x495220
jp 0x495217
lea esp, [esp]
jns 0x49521c
jbe 0x495220
mov esi, 0xe4458b3e
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00496b37
add esp, 4
test ebx, 0x1ac
jle 0x495234
jle 0x495236
inc eax
dec eax
jg 0x495240
lea esp, [esp]
jle 0x495240
cmp edi, 0x5e5fe455
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048801b
add esp, 0xc
cmp ebx, dword [esp + 0x10]
lea eax, [eax]
jbe 0x4968b7
jae 0x4968a3
jmp 0x4968a5
mov esp, esp
lea ebx, [ebx + 0x58e3]
lea ebx, [ebx - 0x58e3]
ja 0x4968b7
mov ebp, 0xe845c687
inc esp
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
add edx, dword [esp]
sub edx, dword [esp]
jne 0x49690b
cmp esp, 0xcf6
jb 0x496913
jae 0x496923
jmp 0x496917
jge 0x496919
xchg ebx, edi
xchg ebx, edi
mov edi, edi
jb 0x496923
xor eax, 0xe84d8a01
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
Function at 0x49bf21
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
inc ebp
clc
add byte [eax], al
add byte [eax], al
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048801b
add esp, 0xc
stc
jae 0x49bf5c
pushf
cmc
popf
xchg edx, eax
xchg edx, eax
lea esi, [esi + 0x1230]
lea esi, [esi - 0x1230]
jp 0x49bf59
jb 0x49bf5c
lcall 0x45c6, 0x51e845c6
in eax, dx
je 0x49bf2b
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
inc ebp
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
or esi, 0
and eax, 0xffffffff
shl esp, 0
jnp 0x49c010
js 0x49c027
pushf
cmp edi, dword [esp + 8]
cmp edx, eax
lea esp, [esp]
popf
lea edx, [edx]
nop
jae 0x49c024
jns 0x49c027
xor eax, 0xffc0c7e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 4], dh
call fcn.004980f3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49c039
xor eax, eax
jmp 0x49c0ae
shr edx, 0
jae 0x49c04b
pushf
or ebx, ebx
popf
ja 0x49c046
jmp 0x49c048
jb 0x49c04b
lcall 0x458b, 0x52e8558d
clc
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00488963
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0048801b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x49c075
xor eax, eax
jmp 0x49c0ae
xor eax, dword [esp]
xor eax, dword [esp]
jbe 0x49c086
jle 0x49c07f
jge 0x49c081
xchg ecx, eax
xchg ecx, eax
ja 0x49c086
lcall 0xa8e8, 0x52fc558b
stosb byte es:[edi], al
invalid
mov edx, dword [ebp - 4]
push edx
call fcn.00496b37
add esp, 4
xor esi, 0
nop
jae 0x49c0a3
jl 0x49c09a
jmp 0x49c09c
jns 0x49c09e
jnp 0x49c0a0
jb 0x49c0a3
mov ebx, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49c0b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048801b
add esp, 0xc
cmc
or ecx, 0
jbe 0x49c0d6
jne 0x49c0d8
jge 0x49c0ee
pushf
mov edx, edx
test dword [esp + 0x10], ecx
shl eax, 0
popf
xchg edx, eax
xchg edx, eax
jl 0x49c0eb
jl 0x49c0ee
mov ecx, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
test esp, 0x3d99
test ebx, edi
xor edi, 0
and esp, 0xffffffff
je 0x49c140
mov edx, edx
jl 0x49c13a
xchg esp, esp
jne 0x49c140
mov edx, 0xe84d8a50
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.00481abc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49c1c6
xor eax, eax
jmp 0x49c25a
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00488963
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0048801b
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x49c258
cmp edx, dword [esp + 8]
je 0x49c1f2
xchg edi, edi
jbe 0x49c1f6
jle 0x49c210
pushf
ror esi, 0
cmp esp, 0x14bc
jg 0x49c205
popf
mov esp, esp
xchg esp, esp
jp 0x49c20d
jg 0x49c210
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00496b37
add esp, 4
rol esi, 0x16
rol esi, 0xa
rol ebx, 0x12
ror ebx, 0x12
jns 0x49c243
pushf
xchg ebx, ebx
lea eax, [eax]
lea edi, [edi + 0x52ca]
lea edi, [edi - 0x52ca]
popf
mov ebx, ebx
js 0x49c243
add eax, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x49c25a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a2b7c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x4726f8
call fcn.00499ec6
add esp, 0xc
mov byte [0x4726f8], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret