joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4905bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [0x4af9a0]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x4af9a4]
mov dword [ebp - 0x28], ecx
mov edx, dword [0x4af9a8]
mov dword [ebp - 0x24], edx
mov eax, dword [0x4af9ac]
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov cl, byte [0x4af9a0]
xor ecx, 0x7e
mov byte [ebp - 0xc], cl
mov edx, dword [ebp - 0xc]
and edx, 0xff
test edx, edx
jne 0x490610
mov byte [ebp - 0xc], 0x7e
mov eax, dword [ebp + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 0xe
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, 1
push eax
call fcn.0048c0a4
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0048c7e2
add esp, 0xc
cmp dword [ebp - 0x14], 8
jl 0x4906af
mov ecx, dword [ebp - 0x14]
and ecx, 0x80000007
jns 0x490666
dec ecx
or ecx, 0xfffffff8
inc ecx
mov edx, dword [ebp - 0x14]
sub edx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], 0
jmp 0x490680
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [ebp - 0x1c], eax
jge 0x4906af
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx*8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.00494def
add esp, 8
jmp 0x490677
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1c], 0
jmp 0x4906c8
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x14]
jge 0x4906fc
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
xor ecx, ecx
mov cl, byte [eax]
cmp edx, ecx
je 0x4906fa
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x1c]
mov al, byte [edx]
xor al, byte [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
mov byte [ecx], al
jmp 0x4906bf
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x490732
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x492de3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov edx, dword [eax + 0x7c]
test edx, edx
mov dword [ebp - 0x10], edx
je 0x492e61
mov esi, dword [eax + 0x78]
mov eax, dword [esi + ecx + 0x20]
add esi, ecx
add eax, ecx
mov edi, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
add edi, ecx
add ebx, ecx
mov ecx, dword [esi + 0x18]
test ecx, ecx
mov dword [ebp - 0xc], ecx
je 0x492e61
and dword [ebp - 4], 0
test ecx, ecx
jbe 0x492e4e
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.00492d96
pop ecx
test eax, eax
pop ecx
je 0x492e65
inc dword [ebp - 4]
add dword [ebp - 8], 4
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x492e28
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 4], ecx
je 0x492e61
sub eax, dword [esi + 0x10]
cmp dword [esi + 0x14], eax
ja 0x492e71
xor eax, eax
jmp 0x492eb7
mov eax, dword [ebp - 4]
movzx eax, word [edi + eax*2]
add eax, dword [esi + 0x10]
jmp 0x492e51
mov ebx, dword [ebx + eax*4]
test ebx, ebx
je 0x492e7b
add ebx, dword [ebp + 8]
cmp ebx, esi
jb 0x492eb5
mov eax, dword [ebp - 0x10]
add esi, eax
cmp ebx, esi
jae 0x492eb5
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.00492d69
push ebx
call fcn.00492dcd
add esp, 0xc
lea ecx, [ebp - 0x24]
lea esi, [eax + ebx + 1]
mov eax, dword [0x4ae7d8]
push ecx
call eax
push esi
push eax
call fcn.00492de3
pop ecx
mov ebx, eax
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x492f5a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [0x4ae828]
cmp esi, 1
jne 0x492fd7
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 9], 0
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], 0x43
push dword [0x4ae814]
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
call fcn.00492f33
mov esi, eax
add esp, 0x14
test esi, esi
je 0x492fc7
mov dword [0x4ae828], esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0xc
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret 0x1c
Function at 0x49302a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 7], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x53
mov byte [ebp - 0x10], 0x79
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0xb], 0x54
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x65
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
je 0x4930a7
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x4930b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 8], 0
and byte [ebp - 7], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x63
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x54
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 9], 0x65
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
je 0x49312d
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x493130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 1], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x43
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x6e
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x50
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x73
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x64
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
je 0x4931c4
push esi
call fcn.00492d4b
pop ecx
call esi
jmp 0x4931c7
push 1
pop eax
pop esi
leave
ret
Function at 0x4931ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 2], 0
and byte [ebp - 1], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x43
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x6e
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x54
mov byte [ebp - 9], 0x68
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x61
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x64
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
mov eax, fcn.004931ca
add esp, 0x20
test eax, eax
je 0x493263
push esi
call fcn.00492d4b
pop ecx
call esi
jmp 0x493266
push 1
pop eax
pop esi
leave
ret

Function at 0x493269
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [0x4ae834]
cmp esi, 1
jne 0x4932df
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 0xa], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x65
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
je 0x4932df
mov dword [0x4ae834], esi
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x4932ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [0x4ae830]
cmp esi, 1
jne 0x493368
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 9], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x6f
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
je 0x493368
mov dword [0x4ae830], esi
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret
Function at 0x49337a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 9], 0
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x48
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6c
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
jne 0x4933e7
xor eax, eax
jmp 0x4933f3
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x4933f6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [0x4ae82c]
cmp esi, 1
jne 0x493476
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 8], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x63
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6b
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x43
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xb], 0x75
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
jne 0x49347e
and dword [0x4ae82c], esi
jmp 0x49347a
test esi, esi
jne 0x49347e
xor eax, eax
jmp 0x493487
push esi
call fcn.00492d4b
pop ecx
call esi
pop esi
leave
ret

Function at 0x49348a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 4], 0
push esi
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 7], 0x65
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 9], 0x75
mov byte [ebp - 6], 0x78
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 8], 0x74
mov byte [ebp - 5], 0x41
call fcn.004930aa
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00492ffa
add esp, 0x14
test esi, esi
jne 0x4934ee
xor eax, eax
jmp 0x493500
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret
Function at 0x493503
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 4], 0
push esi
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 7], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 9], 0x4d
mov byte [ebp - 6], 0x65
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 8], 0x75
mov byte [ebp - 5], 0x78
call fcn.004930aa
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00492ffa
add esp, 0x14
test esi, esi
jne 0x493567
xor eax, eax
jmp 0x493573
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x493576
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and byte [ebp - 1], 0
push esi
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xa], 0x67
mov byte [ebp - 5], 0x6a
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 9], 0x6c
mov byte [ebp - 4], 0x65
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 8], 0x65
mov byte [ebp - 3], 0x63
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 7], 0x4f
mov byte [ebp - 2], 0x74
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 6], 0x62
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x14
test esi, esi
jne 0x4935f7
or eax, 0xffffffff
jmp 0x493606
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x49368b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 9], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xb], 0x7a
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
jne 0x4936f8
xor eax, eax
jmp 0x493707
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret
Function at 0x493960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 5], bl
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x45
mov byte [ebp - 9], 0x41
mov byte [ebp - 4], bl
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x76
mov byte [ebp - 8], bl
mov byte [ebp - 3], bl
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], bl
mov byte [ebp - 2], bl
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 6], bl
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
add esp, 0x20
cmp esi, ebx
jne 0x4939e3
xor eax, eax
jmp 0x4939f8
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
pop ebx
leave
ret

Function at 0x4939fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 5], bl
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 9], 0x64
mov byte [ebp - 4], bl
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x68
mov byte [ebp - 8], bl
mov byte [ebp - 3], bl
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 7], bl
mov byte [ebp - 2], bl
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 6], bl
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
add esp, 0x20
cmp esi, ebx
jne 0x493a7f
xor eax, eax
jmp 0x493a9a
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
pop ebx
leave
ret
Function at 0x493d1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 9], 0x6e
mov byte [ebp - 4], bl
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 8], 0x64
mov byte [ebp - 3], bl
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x6c
mov byte [ebp - 2], bl
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x48
mov byte [ebp - 6], 0x65
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
add esp, 0x20
cmp esi, ebx
jne 0x493da2
xor eax, eax
jmp 0x493dae
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 8]
call esi
pop esi
pop ebx
leave
ret

Function at 0x493e9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
and byte [ebp - 2], 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 5], 0x6d
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 8], 0x65
mov byte [ebp - 4], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 3], 0x41
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x4e
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 6], 0x61
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00492ffa
add esp, 0x20
test esi, esi
jne 0x493f28
push 1
pop eax
jmp 0x493f3a
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x493f6b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 5], 0x6d
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 8], bl
mov byte [ebp - 4], 0x65
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 9], bl
mov byte [ebp - 3], 0x41
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x4e
mov byte [ebp - 2], bl
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x61
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
add esp, 0x20
cmp esi, ebx
je 0x493ffa
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 8]
call esi
pop esi
pop ebx
leave
ret 4
Function at 0x494000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [0x4b31b4]
push edi
xor edi, edi
push 1
push edi
push edi
push dword [ebp + 8]
or ebx, 0xffffffff
call esi
push edi
push edi
push 0x1e
mov dword [ebp - 8], eax
push dword [ebp + 8]
call esi
mov dword [ebp - 4], edi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x1c]
push 0xa
push eax
push dword [ebp + 8]
call fcn.00493609
cmp byte [ebp - 0x1c], 0x54
jne 0x494057
cmp byte [ebp - 0x1b], 0x44
je 0x494062
cmp byte [ebp - 0x1b], 0x64
je 0x494062
cmp byte [ebp - 0x1b], 0x53
je 0x494062
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x49402c
jmp 0x4940b6
mov eax, dword [ebp - 0x13]
mov ecx, dword [ebp + 0x10]
push eax
mov byte [ecx], al
call fcn.004945aa
cmp byte [ebp - 0x1b], 0x64
pop ecx
jne 0x494092
mov dword [0x4aeb52], 1
xor eax, eax
mov cl, byte [ebp - 0x13]
xor byte [ebp + eax - 0x1a], cl
inc eax
cmp eax, 7
jl 0x494083
jmp 0x494098
mov dword [0x4aeb52], edi
mov ebx, dword [ebp - 0x16]
mov eax, dword [ebp - 0x1a]
mov ecx, dword [ebp + 0xc]
xor ebx, 0x198931
xor eax, 0x19611225
and ebx, 0xffffff
mov dword [ecx], eax
add ebx, eax
push edi
push edi
push dword [ebp - 8]
push dword [ebp + 8]
call esi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x4940c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0xf], 0x68
mov byte [ebp - 0xa], bl
mov byte [ebp - 5], 0x6d
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 8], bl
mov byte [ebp - 4], 0x65
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 9], bl
mov byte [ebp - 3], 0x41
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 7], 0x4e
mov byte [ebp - 2], bl
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 6], 0x61
call fcn.004930aa
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00492f33
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00492ffa
add esp, 0x20
cmp esi, ebx
je 0x494155
push esi
call fcn.00492d4b
pop ecx
push dword [ebp + 8]
call esi
pop esi
pop ebx
leave
ret 4