joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4710ab
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x456ba4
call fcn.00473ca7
add esp, 0xc
mov byte [0x456ba4], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x4718d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e6e
add esp, 0xc
xor edx, dword [esp + 8]
xor edx, dword [esp + 8]
xchg ebx, edx
xchg ebx, edx
jo 0x471914
lea edx, [edx + 0x296f]
lea edx, [edx - 0x296f]
jno 0x47190d
xchg esi, ecx
xchg esi, ecx
jno 0x471914
mov edx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
test dword [esp + 0x10], ecx
rol edx, 0x10
rol edx, 0x10
xor ebx, esi
xor ebx, esi
jg 0x471954
jae 0x47196b
pushf
xor esp, 0
lea edi, [edi]
jp 0x47195f
nop
popf
xchg ecx, ebx
xchg ecx, ebx
jno 0x471968
jb 0x47196b
call 0x813366f9
jmp 0xec94a175
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0046a37e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4719e0
xor eax, eax
jmp 0x471a7e
xor ebx, dword [esp + 0xc]
xor ebx, dword [esp + 0xc]
clc
lea esp, [esp]
jle 0x4719fd
pushf
jns 0x4719f2
clc
nop
popf
lea esi, [esi]
jmp 0x4719fa
jg 0x4719fd
mov esi, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0046b05f
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x471a27
xor eax, eax
jmp 0x471a7e
lea esi, [esi]
and esp, 0xffffffff
jae 0x471a41
ja 0x471a30
lea ebx, [ebx + 0x4614]
lea ebx, [ebx - 0x4614]
jp 0x471a3e
jb 0x471a41
mov ecx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0046394c
add esp, 4
jg 0x471a4f
jmp 0x471a51
or esp, 0
jb 0x471a77
pushf
inc eax
dec eax
jns 0x471a5c
add esi, dword [esp]
sub esi, dword [esp]
popf
lea eax, [eax + 0x4e12]
lea eax, [eax - 0x4e12]
jbe 0x471a72
je 0x471a74
jae 0x471a77
jmp 0x514f6806
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x472ad1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00464e6e
add esp, 0xc
jns 0x472aec
jb 0x472afa
jbe 0x472af0
mov eax, eax
jp 0x472af4
jp 0x472af6
jae 0x472afa
add eax, 0xf445c6e2
push ebx
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
ror ecx, 0xf
rol ecx, 0xf
jns 0x472b3d
jne 0x472b34
xchg edi, eax
xchg edi, eax
jge 0x472b38
jl 0x472b3a
js 0x472b3d
mov eax, 0x80f44d8a
jmp 0xf494b347
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
stc
test eax, 0x6f83
jns 0x472bc1
pushf
rol esi, 0x16
ror esi, 0x16
push esi
add esi, 0x1246
ror esi, 0x15
pop esi
popf
jl 0x472bbc
jge 0x472bbe
js 0x472bc1
lcall 0x89ff, 0xfeb9afe8
inc ebp
invalid
call 0x45e575
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x472bd9
mov eax, 1
jmp 0x472ca8
ja 0x472bdb
add ebx, 0x75a4
sub ebx, 0x75a4
jno 0x472be9
and edi, 0xffffffff
jnp 0x472c01
je 0x472bf0
lea edx, [edx + 0x13de]
lea edx, [edx - 0x13de]
jp 0x472bfe
jp 0x472c01
ljmp 0x4d8b:0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0046b05f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00464e6e
add esp, 0xc
lea edx, [edx + 0x143e]
lea edx, [edx - 0x143e]
stc
jae 0x472c4e
pushf
test ebx, edx
mov esp, esp
ror esp, 0
add edi, 0x4d93
sub edi, 0x4d93
popf
xchg esi, edi
xchg esi, edi
jb 0x472c4e
mov esp, 0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x472c5b
mov eax, 1
jmp 0x472ca8
ror esi, 0x19
rol esi, 0x19
ror esi, 0
push eax
add eax, 0x6f9e
ror eax, 0x17
pop eax
jle 0x472c7e
pushf
jg 0x472c74
ror esp, 0
popf
je 0x472c7b
jg 0x472c7e
mov ebx, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.0046394c
add esp, 4
nop
jle 0x472ca1
pushf
call 0x472c94
lea esp, [esp + 4]
popf
xchg esi, esi
xchg edi, eax
xchg edi, eax
jg 0x472ca1
mov esp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x472f38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00464e6e
add esp, 0xc
jg 0x472f5a
jle 0x472f70
js 0x472f5e
jl 0x472f60
lea edi, [edi + 0x7a30]
lea edi, [edi - 0x7a30]
jg 0x472f70
mov edx, 0xe845c6c5
push ecx
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jg 0x47301b
jl 0x47302f
pushf
rol esp, 0
mov esp, esp
popf
lea eax, [eax]
jle 0x47302a
mov ebx, ebx
jge 0x47302f
add eax, 0xff734ae8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.0046a37e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x473044
xor eax, eax
jmp 0x4730e2
call 0x473049
add esp, 4
je 0x47304e
xor edx, dword [esp + 4]
xor edx, dword [esp + 4]
jno 0x47306a
jne 0x47305a
lea ebx, [ebx + 0x284b]
lea ebx, [ebx - 0x284b]
jo 0x47306a
ljmp 0x8b52:0xe8558d34
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046b05f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x473094
xor eax, eax
jmp 0x4730e2
mov ebx, ebx
jle 0x4730aa
pushf
jne 0x47309c
lea ecx, [ecx]
ror edi, 0
popf
jnp 0x4730a5
mov esp, esp
jg 0x4730aa
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0046394c
add esp, 4
test dword [esp], edi
or esi, 0
and esp, 0xffffffff
jle 0x4730d7
lea ebx, [ebx]
lea edx, [edx + 0x567]
lea edx, [edx - 0x567]
mov eax, eax
jp 0x4730d3
jg 0x4730d7
call 0xc8cbcb9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47474d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e6e
add esp, 0xc
xor esi, 0x42d
xor esi, 0x42d
jl 0x47477c
jo 0x474776
lea edx, [edx]
jge 0x47477c
mov ecx, 0xec45c6bc
push ebx
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
mov esp, esp
push ecx
pop ecx
test dword [esp + 4], edi
add ecx, dword [esp]
sub ecx, dword [esp]
jle 0x4747e5
pushf
std
cld
lea eax, [eax + 0x77e7]
lea eax, [eax - 0x77e7]
popf
xchg ecx, edi
xchg ecx, edi
jnp 0x4747e0
jb 0x4747e2
jg 0x4747e5
lcall 0x1e9, 0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0046a37e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47486f
jmp 0x4748e8
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046b05f
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4748e8
jp 0x474897
ja 0x474899
jb 0x47489b
jbe 0x4748af
pushf
rol esi, 0xd
ror esi, 0xd
cmp ebx, dword [esp]
popf
lea ecx, [ecx]
ja 0x4748af
mov eax, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.0046394c
add esp, 4
ror edi, 0
jae 0x4748c0
shr esp, 0
sub ebx, 0
je 0x4748d5
jns 0x4748ca
lea esp, [esp]
nop
jge 0x4748d0
jne 0x4748d5
mov ebx, 0x4d8bf5b4
adc al, 0x51
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47730b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00464e6e
add esp, 0xc
jg 0x477326
and edx, 0xffffffff
je 0x477336
nop
jne 0x47732e
jbe 0x477330
jge 0x477332
jne 0x477336
mov ebx, 0xe845c6c2
inc edi
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
inc esi
dec esi
jb 0x477372
jo 0x477381
ja 0x477376
xchg esp, esp
jl 0x47737a
lea edx, [edx]
jno 0x477381
mov ecx, 0x4d8aeca1
call 0x88495d08
dec ebp
call 0x813ac918
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0045e7b0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x477404
xor eax, eax
jmp 0x477483
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046b05f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x477481
stc
je 0x477442
pushf
xor esi, dword [esp + 0xc]
xor esi, dword [esp + 0xc]
popf
xchg ecx, ecx
jne 0x47743d
je 0x47743f
jne 0x477442
mov ebp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0046394c
add esp, 4
ror edi, 9
rol edi, 9
je 0x47746c
pushf
mov edx, edx
lea esp, [esp]
jae 0x47745f
xor esp, 0
popf
lea esp, [esp]
xchg edi, edi
jne 0x47746c
mov ecx, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x477483
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4819f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x456638], 1
jne 0x481b57
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00464e6e
add esp, 0xc
nop
add ebx, 0x6335
sub ebx, 0x6335
jns 0x481a32
je 0x481a2e
js 0x481a32
sbb eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
nop
xchg esp, esp
shr esp, 0
shr edx, 0
jp 0x481a79
pushf
lea eax, [eax]
popf
jnp 0x481a71
jb 0x481a73
lea esp, [esp]
jnp 0x481a79
mov edi, 0x80e84d8a
jmp 0xe895a283
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0046a37e
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x481ae6
mov eax, dword [ebp + 8]
jmp 0x481bc1
jle 0x481ae8
ror ecx, 0
ja 0x481aed
add ecx, 0x5c18
sub ecx, 0x5c18
ja 0x481b1f
pushf
push edx
add edx, 0x35a7
ror edx, 0xc
pop edx
add edx, 0x41f5
sub edx, 0x41f5
lea ebx, [ebx]
popf
jg 0x481b1a
mov esi, esi
jbe 0x481b1f
mov edi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0046b05f
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x481b50
mov edx, dword [ebp - 8]
mov dword [0x456638], edx
jmp 0x481b55
mov eax, dword [ebp + 8]
jmp 0x481bc1
jmp 0x481b5f
mov eax, dword [0x456638]
mov dword [ebp - 8], eax
jl 0x481b61
xor edx, dword [esp]
xor edx, dword [esp]
jge 0x481b72
xchg ebx, ecx
xchg ebx, ecx
lea ebx, [ebx]
jl 0x481b72
jmp 0x8a406901
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
add esi, 0
jo 0x481b7d
jmp 0x481b7f
inc esi
dec esi
jg 0x481b9f
pushf
lea esp, [esp]
jle 0x481b8a
xor esi, 0x7c42
xor esi, 0x7c42
popf
js 0x481b9a
jl 0x481b9c
jle 0x481b9f
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0046394c
add esp, 4
jno 0x481bad
nop
jnp 0x481bba
xchg esi, esi
jo 0x481bb4
nop
jp 0x481bb7
jp 0x481bba
sub eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x485c4d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00464e6e
add esp, 0xc
cmp edx, 0x2421
jnp 0x485c75
xor esp, 0
jmp 0x485c7a
jne 0x485c88
jne 0x485c7e
lea esi, [esi]
jmp 0x485c82
jbe 0x485c84
je 0x485c88
mov ecx, 0xec45c680
push ecx
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0046a37e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x485d50
xor eax, eax
jmp 0x485db7
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046b05f
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x485d7a
xor eax, eax
jmp 0x485db7
mov edi, edi
or esi, 0
mov edi, edi
and esi, 0xffffffff
jge 0x485d92
pushf
jg 0x485d8a
lea ebx, [ebx]
popf
nop
jl 0x485d92
mov esi, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.0046394c
add esp, 4
lea esp, [esp]
je 0x485dac
lea esp, [esp]
jl 0x485da8
jne 0x485dac
mov ecx, 0xc4d8bcb
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x402ee4
pop dword [ebp - 0x18]
mov eax, 0x402ee4
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xdcdf27c5
add dword [ebp - 0x28], 0x71731d86
mov dword [ebp - 0x24], 0x71a4b91e
sub dword [ebp - 0x24], 0x3f716cd9
mov dword [ebp - 0x20], 0xb8c8402
add dword [ebp - 0x20], 0x40bfc02c
mov dword [ebp - 0x1c], 0x6b3cd3cb
add dword [ebp - 0x1c], 0x94c32c35
lea eax, [ebp - 0x28]
push eax
mov eax, 0xf7ccc01a
add eax, 0x873c0ea
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x5dbbd1da
add dword [ebp - 0x28], 0x16b6977c
mov dword [ebp - 0x24], 0xc553725b
sub dword [ebp - 0x24], 0x83e710e6
mov dword [ebp - 0x20], 0x9b52cb88
add dword [ebp - 0x20], 0xc81ca0e4
mov dword [ebp - 0x1c], 0x28880d
add dword [ebp - 0x1c], 0xffd777f3
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xa9d23de3
sub eax, 0xa991bce3
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x372ff
push 0
call eax
mov ecx, 0x8e3d3d49
sub ecx, 0x8e3cf4ae
mov ebx, eax
mov edi, 0x46e400
add edi, dword [ebp - 0x18]
mov edx, 0x6f832a3f
sub dword [ebp - 4], eax
mov esi, dword [edi]
sub dword [ebp - 8], 0xecbe3e50
xor esi, edx
xor dword [ebp - 0x14], 0x8be7bc4f
mov dword [ebx], esi
sub dword [ebp - 8], edi
add ebx, 0x3674c952
sub ebx, 0x3674c94e
add edi, 0x4796f552
sub edi, 0x4796f54e
loop 0x402ff5
add eax, 0x43da6ec6
sub eax, 0x43d95987
xor ebx, ebx
add ebx, eax
add eax, 0x99117725
sub eax, 0x99117720
mov ecx, 0x548b3d30
add ecx, 0xabb4c2d0
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10