joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d260
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x48d2a9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x48d720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c4710
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0048d2d0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0048d350
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0048d350
lea ecx, [esi + 0xc]
call fcn.004b4d9d
lea ecx, [esi + 0x10]
call fcn.004b4d9d
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0048e8e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0048e8e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0048e8e0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004b4e12
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004b4e12
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4aadd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4c5950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.0049fdad
mov eax, dword [0x4f2938]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.0049fcdf
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004ab8d0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4aae77
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4aae6e
cmp al, 0xff
je 0x4aae6e
dec al
mov byte [ecx], al
jmp 0x4aae77
push ecx
call fcn.004b4b7c
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4aaea8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4aae9f
cmp al, 0xff
je 0x4aae9f
dec al
mov byte [ecx], al
jmp 0x4aaea8
push ecx
call fcn.004b4b7c
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4b71e0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b7218
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b526d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b5245
jmp 0x4b7224
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b88d6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b8918
call fcn.004be656
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b8918
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b890f
xor eax, eax
jmp 0x4b8920
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b8926
pop edi
pop esi
pop ebx
ret 4

Function at 0x4beb86
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4bebb4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bebd2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004beaec
jmp 0x4bebd2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4bebd2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004beaec
test edi, edi
mov eax, edi
jne 0x4bebbc
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x54f04c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0054f0cb
jae 0x54f058
xor ecx, ecx
call fcn.0054f0cb
jae 0x54f082
xor eax, eax
call fcn.0054f0cb
jae 0x54f093
mov al, 0x10
call fcn.0054f0cb
adc al, al
jae 0x54f074
jne 0x54f0c0
stosb byte es:[edi], al
jmp 0x54f059
call fcn.0054f0d7
dec ecx
loop 0x54f09f
mov eax, ebp
call fcn.0054f0d5
jmp 0x54f0c1
lodsb al, byte [esi]
shr eax, 1
je 0x54f0e7
adc ecx, 2
mov ebp, eax
jmp 0x54f0c1
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0054f0d5
cmp eax, 0x7d00
jae 0x54f0bf
cmp eax, 0x500
jae 0x54f0c0
cmp eax, 0x7f
ja 0x54f0c1
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x54f059
pop ebp
ret 8
Function at 0x498df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00499b0b
add esp, 0xc
lea edx, [edx]
sub esp, 0
lea esi, [esi + 0x6b87]
lea esi, [esi - 0x6b87]
shr esp, 0
jle 0x498e24
jg 0x498e21
jg 0x498e24
mov edx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
add eax, dword [esp]
sub eax, dword [esp]
js 0x498e5c
js 0x498e78
pushf
test eax, 0x4d9e
lea esi, [esi + 0x667f]
sub esi, 0x667f
popf
jp 0x498e75
jns 0x498e78
mov edi, 0x80ec4d8a
jmp 0xec971682
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004a72c7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x498eea
xor eax, eax
jmp 0x498f64
jle 0x498eec
rol eax, 0
cmp esi, dword [esp + 0xc]
jne 0x498efb
xchg edx, eax
xchg edx, eax
nop
je 0x498efb
call 0x5135d48c
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0049db9f
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00499b0b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x498f25
xor eax, eax
jmp 0x498f64
or ebx, 0
jge 0x498f30
nop
ja 0x498f2d
jl 0x498f30
mov edi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.004aa525
add esp, 4
rol edi, 4
ror edi, 4
rol edx, 0
jle 0x498f5d
pushf
cld
popf
lea edi, [edi + 0x7e9f]
lea edi, [edi - 0x7e9f]
jne 0x498f5a
jg 0x498f5d
jmp 0x5151dcec
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x498f6d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00499b0b
add esp, 0xc
clc
jl 0x498fa3
pushf
jo 0x498f94
add eax, 0
inc edi
dec edi
stc
popf
jae 0x498f9e
lea edi, [edi]
jge 0x498fa3
lcall 0x45c6, 0x4ef045c6
cmc
push 0x66f145c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
xchg esi, esi
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
ja 0x498fe8
mov ecx, ecx
jge 0x498fe3
jmp 0x498fe5
jbe 0x498fe8
call 0x8139dd76
jmp 0xf09717f2
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
js 0x49904a
lea ebx, [ebx + 0x6ed4]
sub ebx, 0x6ed4
shl eax, 0
jg 0x49906d
pushf
xor edi, ebx
xor edi, ebx
std
cld
popf
nop
jnp 0x499068
jo 0x49906a
jle 0x49906d
add eax, 0xfff312e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.00498384
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49907f
xor eax, eax
jmp 0x4990af
jle 0x499081
je 0x49908c
jae 0x499085
mov ebx, ebx
xchg edi, eax
xchg edi, eax
jne 0x49908c
mov edx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049db9f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00499b0b
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c0cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleA
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00499b0b
add esp, 0xc
cmp ecx, dword [esp]
ja 0x49c0f5
lea esp, [esp]
jne 0x49c0ef
je 0x49c0f1
jbe 0x49c0f5
add eax, 0xec45c682
jp 0x49c0c0
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0xe98f8748
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
jg 0x49c12f
lea eax, [eax + 0x2149]
sub eax, 0x2149
jnp 0x49c13c
jns 0x49c144
xchg esp, esp
js 0x49c144
jmp 0xf4974bbe
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
lea edi, [edi + 0x747a]
sub edi, 0x747a
cmp esp, 0x4148
je 0x49c1e4
pushf
cmp ecx, edx
xor edx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
shr ecx, 0
cmc
popf
ja 0x49c1dd
jns 0x49c1df
xchg ebx, ebx
jne 0x49c1e4
mov edi, 0xb0dee8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
call fcn.004a72c7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49c1f7
jmp 0x49c291
clc
je 0x49c20a
pushf
cmc
xor ebx, 0
sub esp, 0
popf
xchg esi, esi
jne 0x49c20a
sub eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0049db9f
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00499b0b
add esp, 0xc
lea edi, [edi]
jle 0x49c23c
pushf
sub ecx, 0
popf
lea eax, [eax]
jns 0x49c239
jg 0x49c23c
mov esi, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x49c244
jmp 0x49c291
xchg ebx, esi
xchg ebx, esi
jg 0x49c255
pushf
jmp 0x49c24e
popf
mov esp, esp
jle 0x49c255
or dword [ebx - 0x17ad03ab], 0xe2c7
mov edx, dword [ebp - 4]
push edx
call fcn.004aa525
add esp, 4
jl 0x49c263
cmp edx, dword [esp + 0x10]
test dword [esp + 4], ebx
add esi, 0x7d67
sub esi, 0x7d67
js 0x49c28a
pushf
jo 0x49c27d
lea edi, [edi]
popf
mov edx, edx
jno 0x49c285
jno 0x49c287
jns 0x49c28a
mov eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49dc57
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00499b0b
add esp, 0xc
jne 0x49dc72
jns 0x49dc74
and ecx, 0xffffffff
mov eax, eax
jge 0x49dc8e
pushf
jle 0x49dc7f
jl 0x49dc81
popf
lea esp, [esp]
lea esp, [esp]
jmp 0x49dc8b
jl 0x49dc8e
mov edi, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
rol edi, 9
ror edi, 9
jl 0x49dcc6
rol esp, 0
jp 0x49dce1
pushf
jl 0x49dccf
std
cld
xor edi, ecx
xor edi, ecx
ror esp, 0
popf
js 0x49dcdc
xchg edx, edx
jnp 0x49dce1
jmp 0x813e2a6f
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
call fcn.0049dd46
Function at 0x4a53ab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x491b48], 1
jne 0x4a54f3
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00499b0b
add esp, 0xc
cmp esi, 0x674
js 0x4a53e9
pushf
lea esi, [esi]
nop
popf
jae 0x4a53e2
xchg esi, ecx
xchg esi, ecx
jns 0x4a53e9
sub eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
shl ecx, 0
inc eax
dec eax
jne 0x4a5422
jne 0x4a541e
je 0x4a5422
mov ecx, 0xe84d8a20
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.004a72c7
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a548f
mov eax, dword [ebp + 8]
jmp 0x4a558c
test dword [esp + 4], ebx
lea esi, [esi + 0x1933]
sub esi, 0x1933
call fcn.004a54a4
mov eax, dword [0x491b48]
mov dword [ebp - 8], eax
Function at 0x4a68df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.00499b0b
add esp, 0xc
xor esp, 0
ja 0x4a6906
mov edi, edi
jle 0x4a6901
jno 0x4a6903
jbe 0x4a6906
mov ebp, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
dec edx
inc edx
mov esi, esi
je 0x4a6951
jmp 0x4a693e
jno 0x4a6940
jb 0x4a6942
lea esi, [esi + 0x223c]
lea esi, [esi - 0x223c]
jne 0x4a6951
mov eax, 0x80f04d8a
jmp 0xf097f15b
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
je 0x4a69b3
nop
jnp 0x4a69c1
pushf
nop
popf
lea esp, [esp]
jp 0x4a69c1
mov ebp, 0x901e8
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 4], dh
call fcn.004a72c7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a69d3
xor eax, eax
jmp 0x4a6a0f
and esp, 0xffffffff
jmp 0x4a69d8
je 0x4a69ec
nop
xchg ebx, ebx
lea edx, [edx + 0x7052]
lea edx, [edx - 0x7052]
jne 0x4a69ec
mov ebx, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049db9f
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00499b0b
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a6da5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00499b0b
add esp, 0xc
rol edx, 0xf
rol edx, 0x11
rol edx, 0
je 0x4a6ddf
pushf
mov esp, esp
popf
mov esp, esp
jg 0x4a6dda
jge 0x4a6ddc
jne 0x4a6ddf
mov ecx, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x42
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xb], 0x78
jns 0x4a6e11
cmp esi, 0x392c
test dword [esp + 8], eax
jp 0x4a6e2a
pushf
dec ebx
inc ebx
jbe 0x4a6e23
popf
jne 0x4a6e27
jnp 0x4a6e2a
mov ecx, 0x80ec4d8a
jmp 0xec97f634
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00498384
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a6e9f
xor eax, eax
jmp 0x4a710a
rol edx, 0
jle 0x4a6ea4
je 0x4a6ec8
pushf
shr esp, 0
stc
or esp, 0
ror ebx, 0xb
rol ebx, 0xb
popf
jle 0x4a6eb9
lea ebx, [ebx + 0x7435]
lea ebx, [ebx - 0x7435]
jne 0x4a6ec8
xor eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049db9f
mov dword [ebp - 0x18], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00499b0b
add esp, 0xc
lea esp, [esp]
test edx, eax
jns 0x4a6f08
pushf
cmp esi, dword [esp]
xchg ebx, ebx
nop
call fcn.004a6efc