joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4776b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048e238
add esp, 0xc
ror edi, 0xa
rol edi, 0xa
add ecx, dword [esp]
or al, 0x24
sub ecx, dword [esp]
xor ecx, 0x692
and al, 0x81
int1
xchg edx, eax
push es
add byte [eax], al
xor ecx, 0x692
jnp 0x477704
pushf
or esp, 0
shl edx, 0
test dword [esp + 8], ebx
and ebx, 0xffffffff
popf
lea edx, [edx]
ja 0x4776ff
js 0x477701
jp 0x477704
add esi, 0xc653ec45
inc ebp
clc
jo 0x4776d3
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
neg ebx
neg ebx
clc
js 0x477751
inc ebp
cmc
jno 0x4776d7
inc ebp
out dx, eax
je 0x4776db
inc ebp
invalid
xchg esp, esp
jno 0x47774b
xchg ecx, ecx
jns 0x477751
jmp 0xec9501d2
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0047f014
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4777de
jmp 0x47785f
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047f2e9
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0048e238
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x47785f
xor esp, 0
cmp ebx, 0x36b4
jae 0x477819
jns 0x477811
jae 0x477813
xchg ecx, eax
xchg ecx, eax
jb 0x477819
add eax, 0xe8458b03
mov eax, dword [ebp - 0x18]
push eax
call fcn.00478641
add esp, 4
test ecx, 0x3312
call fcn.00477830
Function at 0x4784b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048e238
add esp, 0xc
not esi
not esi
jb 0x4784eb
pushf
rol edx, 0x14
rol edx, 0xc
and ecx, 0xffffffff
popf
lea esi, [esi]
xchg ecx, ecx
jae 0x4784eb
add eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
not edi
not edi
jns 0x478532
pushf
push eax
pop eax
jl 0x478527
popf
jnp 0x47852b
xchg edx, edx
jo 0x47852f
js 0x478532
mov ebp, 0x80ec4d8a
jmp 0xec950d3c
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0047f014
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4785a4
xor eax, eax
jmp 0x478621
shr esp, 0
jb 0x4785ba
pushf
cld
and ecx, ecx
cmp ecx, dword [esp + 4]
nop
popf
mov ecx, ecx
jae 0x4785ba
add eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0047f2e9
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0048e238
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4785e4
xor eax, eax
jmp 0x478621
mov edx, edx
xchg esi, ecx
xchg esi, ecx
jo 0x4785f8
jne 0x4785ee
mov ecx, ecx
jge 0x4785f2
jne 0x4785f4
jno 0x4785f8
lcall 0xe850, 0xfc458b3a
inc eax
add byte [eax], al
add byte [ebx - 0x383efb3c], al
add byte [edx], dh
mov eax, dword [ebp - 4]
push eax
call fcn.00478641
add esp, 4
rol edi, 0
jb 0x478609
jbe 0x47860b
xchg edi, edx
xchg edi, edx
jbe 0x47861a
js 0x478613
jnp 0x478615
jne 0x478617
ja 0x47861a
mov ebx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4790e1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048e238
add esp, 0xc
nop
jb 0x479109
xchg ecx, ecx
jae 0x479109
call 0x5233d6d3
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0047f014
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4791d4
xor eax, eax
jmp 0x47925c
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047f2e9
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0048e238
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x4791fe
xor eax, eax
jmp 0x47925c
xor esp, 0
add ebx, 0x69fe
sub ebx, 0x69fe
jp 0x47921e
pushf
cmc
jo 0x479214
cld
popf
jg 0x479219
jp 0x47921b
jnp 0x47921e
ljmp 0x1ae8:0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00478641
add esp, 4
xor edx, dword [esp]
xor edx, dword [esp]
add edx, 0x2adf
sub edx, 0x2adf
jge 0x479251
pushf
test edi, 0x6fc2
mov edi, edi
popf
xchg edi, eax
xchg edi, eax
jne 0x47924e
jl 0x479251
mov edi, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47a7a3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0048e238
add esp, 0xc
jno 0x47a7be
clc
jnp 0x47a7cc
jg 0x47a7c3
mov esp, esp
mov edx, edx
jo 0x47a7c9
jp 0x47a7cc
xor eax, 0x48f045c6
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
mov esp, esp
jno 0x47a80a
pushf
neg edi
neg edi
cmc
popf
jl 0x47a803
jbe 0x47a805
jb 0x47a807
jo 0x47a80a
add eax, 0x80f04d8a
jmp 0xf0953014
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.00474800
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47a86d
xor eax, eax
jmp 0x47a8f3
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0047f2e9
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0048e238
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x47a8f1
cmp edx, dword [esp]
je 0x47a898
jae 0x47a8b5
pushf
call 0x47a8a1
lea esp, [esp + 4]
add edi, 0
jp 0x47a8aa
jp 0x47a8ac
popf
jo 0x47a8b0
ja 0x47a8b2
jb 0x47a8b5
add eax, 0x51ec4d8b
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00478641
add esp, 4
rol edi, 0
test dword [esp], ecx
jle 0x47a8c9
ja 0x47a8cb
je 0x47a8e4
pushf
xor ecx, dword [esp + 4]
xor ecx, dword [esp + 4]
xchg edx, eax
xchg edx, eax
popf
jae 0x47a8dd
jb 0x47a8df
jns 0x47a8e1
jne 0x47a8e4
mov esi, 0x520c558b
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x47a8f3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47a8fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048e238
add esp, 0xc
xchg esi, esi
js 0x47a919
ror esp, 0
jg 0x47a929
xchg ecx, eax
xchg ecx, eax
xchg ecx, ecx
jae 0x47a924
lea ebx, [ebx]
jle 0x47a929
add esi, 0xc644e845
inc ebp
in eax, dx
push esp
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
jge 0x47a977
jae 0x47a98e
pushf
dec edi
inc edi
xchg edx, eax
xchg edx, eax
cmp edx, ecx
std
cld
popf
jno 0x47a987
jp 0x47a989
mov esp, esp
jb 0x47a98e
add eax, 0x80e84d8a
jmp 0xe8953198
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
ror ecx, 0x16
rol ecx, 0x16
jno 0x47aa32
add ebx, 0
add esp, 0
jo 0x47aa41
jg 0x47aa3c
jl 0x47aa3e
jno 0x47aa41
sub eax, 0xdf92e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 7], dh
call 0x4889d8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47aa56
xor eax, eax
jmp 0x47aae1
call fcn.0047aa5b
Function at 0x47d28d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0048e238
add esp, 0xc
lea edi, [edi + 0x27b6]
lea edi, [edi - 0x27b6]
jo 0x47d2b4
rol esp, 0
jp 0x47d2c7
pushf
test dword [esp], edx
popf
jbe 0x47d2c2
jne 0x47d2c4
jnp 0x47d2c7
mov edi, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
not edx
not edx
jge 0x47d2fd
js 0x47d2ff
je 0x47d31b
pushf
xor esi, dword [esp + 0x10]
xor esi, dword [esp + 0x10]
shr ebx, 0
add eax, 0
sub edx, 0
popf
ja 0x47d318
jne 0x47d31b
mov eax, 0x80f44d8a
jmp 0xf4955b25
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
xor eax, 0x33ec
xor eax, 0x33ec
cld
js 0x47d38f
jl 0x47d38a
jnp 0x47d38c
jns 0x47d38f
mov esi, 0xb644e8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x4889d8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47d3a7
mov eax, 1
jmp 0x47d47f
lea ebx, [ebx]
rol esi, 0
inc eax
dec eax
jne 0x47d3b0
jae 0x47d3bd
lea esp, [esp]
xchg ebx, eax
xchg ebx, eax
lea eax, [eax]
jb 0x47d3bd
xor eax, 0xf4458daf
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0047f2e9
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0048e238
add esp, 0xc
ror edi, 0x11
rol edi, 0x11
jle 0x47d40c
pushf
lea ebx, [ebx + 0x16a1]
lea ebx, [ebx - 0x16a1]
rol esi, 5
ror esi, 5
popf
jp 0x47d3fd
lea esi, [esi + 0x64e6]
lea esi, [esi - 0x64e6]
jg 0x47d40c
add dword [ebx + 0x7500ec7d], 0x1b807
add byte [eax], al
cmp dword [ebp - 0x14], 0
jne 0x47d419
mov eax, 1
jmp 0x47d47f
shr edi, 0
js 0x47d41e
xchg edi, ecx
xchg edi, ecx
clc
jp 0x47d43f
pushf
sub esp, 0
shr esp, 0
call 0x47d432
lea esp, [esp + 4]
popf
xchg esp, esp
xchg esi, esi
jnp 0x47d43f
add eax, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00478641
add esp, 4
add eax, 0x1680
sub eax, 0x1680
xor ebx, dword [esp]
xor ebx, dword [esp]
rol edx, 0x11
rol edx, 0xf
je 0x47d478
pushf
rol esi, 0
rol eax, 0x1b
ror eax, 0x1b
popf
nop
je 0x47d473
xchg edx, eax
xchg edx, eax
jne 0x47d478
mov ebp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48000f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048e238
add esp, 0xc
rol edi, 0
jp 0x48002d
ja 0x48002f
je 0x480036
lea edx, [edx]
jne 0x480036
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
push esi
add esi, 0x404d
ror esi, 8
pop esi
xchg esi, esi
add esp, 0
xor ecx, 0x2564
xor ecx, 0x2564
jnp 0x4800aa
jb 0x48009e
jae 0x4800a0
xchg edi, ecx
xchg edi, ecx
lea esp, [esp]
jp 0x4800aa
lcall 0x1e9, 0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.0047f014
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x480153
xor eax, eax
jmp 0x480209
cld
shr ecx, 0
jle 0x48016d
pushf
shr esp, 0
dec esi
inc esi
dec esi
inc esi
popf
jg 0x480166
jl 0x480168
xchg esi, esi
jg 0x48016d
mov ebx, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047f2e9
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0048e238
add esp, 0xc
add esi, 0x34eb
sub esi, 0x34eb
add eax, 0
add edx, 0x774b
sub edx, 0x774b
jns 0x4801c1
pushf
and esp, 0xffffffff
xchg ecx, ecx
cmc
shl eax, 0
popf
lea esp, [esp]
jnp 0x4801bc
jge 0x4801be
js 0x4801c1
mov ecx, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x4801cb
xor eax, eax
jmp 0x480209
test edi, 0x4759
push eax
pop eax
test edi, 0x2752
call fcn.004801de
Function at 0x480f61
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048e238
add esp, 0xc
je 0x480f7c
test dword [esp], ebx
cmp ecx, dword [esp + 0xc]
jbe 0x480f85
jnp 0x480f8c
jae 0x480f89
jp 0x480f8c
mov esp, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
test dword [esp], eax
je 0x480fe1
pushf
shr esp, 0
rol esp, 0
shr esp, 0
popf
jns 0x480fd0
lea esi, [esi + 0xa4a]
lea esi, [esi - 0xa4a]
lea edx, [edx]
jne 0x480fe1
mov edx, 0x80ec4d8a
jmp 0xec9597eb
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
and esp, 0xffffffff
add ebx, 0x79cd
sub ebx, 0x79cd
jo 0x481058
jnp 0x481054
jno 0x481058
mov esi, 0xdfb7e8ad
invalid
call fcn.0047f014
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48106d
xor eax, eax
jmp 0x481116
jmp 0x48106f
jo 0x481080
pushf
test esp, 0x167d
popf
jne 0x48107d
jno 0x481080
mov ebx, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0047f2e9
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0048e238
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4810fb
xor esp, 0
jnp 0x4810ab
add ebx, 0
or edx, edx
jbe 0x4810cf
pushf
neg eax
neg eax
jns 0x4810ba
dec edx
inc edx
popf
lea ecx, [ecx + 0x2412]
lea ecx, [ecx - 0x2412]
jae 0x4810cc
ja 0x4810cf
mov ebx, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00478641
add esp, 4
jbe 0x4810dd
jbe 0x4810df
jl 0x4810e1
xor ebx, dword [esp + 4]
xor ebx, dword [esp + 4]
jb 0x4810f2
jno 0x4810ed
xchg esp, esp
jae 0x4810f2
mov ecx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x481116
inc edi
dec edi
clc
jle 0x481114
lea edi, [edi + 0x31ca]
lea edi, [edi - 0x31ca]
jmp 0x48110e
jne 0x481110
jg 0x481114
jmp 0x6008449a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48181e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0048e238
add esp, 0xc
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
jl 0x48184d
jl 0x48184a
jge 0x48184d
mov eax, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
ror ecx, 0x1a
rol ecx, 0x1a
rol ecx, 0xd
rol ecx, 0x13
jb 0x481911
pushf
clc
rol eax, 0
popf
jle 0x48190e
jae 0x481911
call 0x1f17fd
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 4], dh
call fcn.0047f014
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x481923
xor eax, eax
jmp 0x4819a0
xchg esi, esi
test esp, 0x765e
jns 0x48193a
ja 0x48192f
jns 0x481931
mov esp, esp
jp 0x481935
js 0x48193a
add eax, 0x558d7b35
call 0xf88da493
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0047f2e9
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0048e238
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x481964
xor eax, eax
jmp 0x4819a0
and esp, 0xffffffff
je 0x481969
test dword [esp + 0xc], ecx
jb 0x481976
je 0x481971
js 0x481973
jae 0x481976
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00478641
add esp, 4
ror eax, 0
std
cld
cmc
jne 0x48198a
jae 0x481995
jge 0x48198e
jbe 0x481990
jl 0x481992
jb 0x481995
or dword [ebx - 0x74aff3bb], 0xff51084d
push ebp
cld
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8