joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b14e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049baea
add esp, 0xc
shl edi, 0
inc esi
dec esi
jge 0x49b16e
jne 0x49b175
jl 0x49b172
je 0x49b175
mov ebx, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
shr ebx, 0
or eax, 0
js 0x49b1b9
pushf
shr esp, 0
popf
mov edx, edx
jns 0x49b1b9
add eax, 0x80ec4d8a
jmp 0xec9739c3
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
test esp, 0x7c25
jmp 0x49b221
nop
jnp 0x49b224
jb 0x49b23e
pushf
xchg edx, eax
xchg edx, eax
cmp edx, 0x927
or ebx, 0
popf
jae 0x49b237
mov edx, edx
jae 0x49b23b
jae 0x49b23e
sub eax, 0x11f07e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.004ad14a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49b253
xor eax, eax
jmp 0x49b2ef
xchg ecx, ecx
test esp, 0x6892
cmc
nop
jb 0x49b266
jmp 0x49b261
jl 0x49b263
jae 0x49b266
add eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004a7955
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0049baea
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x49b2cb
nop
cmp esi, dword [esp]
rol edx, 0x1f
ror edx, 0x1f
jl 0x49b29d
lea esi, [esi]
jge 0x49b29d
call 0x5145f82c
mov eax, dword [ebp - 4]
push eax
call fcn.0048e67b
add esp, 4
rol ecx, 0x10
ror ecx, 0x10
push edx
add edx, 0x6fc7
ror edx, 4
pop edx
jbe 0x49b2c2
je 0x49b2be
ja 0x49b2c2
sub eax, 0x84d8bd4
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x49b2ef
xchg esp, esp
jl 0x49b2cf
cmp esp, 0x3d4a
jo 0x49b2d7
jg 0x49b2ed
pushf
test edx, ebx
or ebx, 0
test dword [esp + 0xc], esi
popf
xchg edx, ecx
xchg edx, ecx
jle 0x49b2ed
mov edx, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49bf5d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049baea
add esp, 0xc
mov esp, esp
jo 0x49bf90
pushf
xchg esp, esp
jle 0x49bf87
popf
jbe 0x49bf8b
jbe 0x49bf8d
jno 0x49bf90
mov eax, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004ad14a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49c05b
xor eax, eax
jmp 0x49c0fa
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004a7955
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0049baea
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x49c085
xor eax, eax
jmp 0x49c0fa
mov esp, esp
shr esp, 0
sub esp, 0
push ebx
add ebx, 0x105a
ror ebx, 3
pop ebx
ja 0x49c0ba
pushf
nop
add esp, 0
xchg esp, esp
popf
xchg edi, ecx
xchg edi, ecx
lea eax, [eax + 0x76d4]
lea eax, [eax - 0x76d4]
lea esp, [esp]
jbe 0x49c0ba
lcall 0xb8e8, 0x50e8458b
and eax, 0xc483ffff
add al, 0x8d
and al, 0x24
mov eax, dword [ebp - 0x18]
push eax
call fcn.0048e67b
add esp, 4
lea esp, [esp]
jne 0x49c0ef
pushf
ror ebx, 0x17
ror ebx, 9
cmp edx, dword [esp + 8]
inc eax
dec eax
popf
lea ecx, [ecx + 0x517d]
lea ecx, [ecx - 0x517d]
lea esp, [esp]
jb 0x49c0ec
je 0x49c0ef
mov ebp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49cf53
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0049baea
add esp, 0xc
and eax, 0xffffffff
jnp 0x49cf71
jne 0x49cf8f
pushf
jnp 0x49cf77
jns 0x49cf79
xchg esi, ecx
xchg esi, ecx
push ecx
add ecx, 0x3e63
ror ecx, 4
pop ecx
popf
jae 0x49cf8c
je 0x49cf8f
mov ecx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
lea edx, [edx + 0x567e]
lea edx, [edx - 0x567e]
jge 0x49cfe4
pushf
jp 0x49cfd1
nop
clc
popf
lea eax, [eax + 0x1134]
lea eax, [eax - 0x1134]
jl 0x49cfe4
add eax, 0x80f44d8a
jmp 0xf49757ee
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
push eax
add eax, 0x14a
ror eax, 0xc
pop eax
rol esp, 0
jge 0x49d06a
pushf
jbe 0x49d057
jmp 0x49d059
js 0x49d05b
test esi, 0x1ac6
popf
jno 0x49d065
jns 0x49d067
jl 0x49d06a
mov esp, 0x5cfee8
add byte [ecx + 0x7d83f045], cl
lock add byte [ebp + 0xa], dh
call 0x4a2d6d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x49d082
mov eax, 1
jmp 0x49d14c
xor edx, 0x5933
xor edx, 0x5933
jns 0x49d090
jge 0x49d09e
jbe 0x49d094
mov esp, esp
mov esp, esp
xchg ebx, ebx
jl 0x49d09e
ljmp 0x8b50:0xf4458d03
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004a7955
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.0049baea
add esp, 0xc
test dword [esp], eax
mov esp, esp
jne 0x49d0c5
jp 0x49d0f7
pushf
xchg esp, esp
lea ebx, [ebx + 0x2e61]
sub ebx, 0x2e61
popf
lea esp, [esp]
lea esi, [esi + 0x119a]
lea esi, [esi - 0x119a]
lea ecx, [ecx + 0x7de9]
lea ecx, [ecx - 0x7de9]
jnp 0x49d0f7
ljmp 0x775:0xec7d83
cmp dword [ebp - 0x14], 0
jne 0x49d104
mov eax, 1
jmp 0x49d14c
jg 0x49d106
shl ebx, 0
std
cld
jo 0x49d115
nop
ja 0x49d110
xchg edx, eax
xchg edx, eax
jno 0x49d115
lcall 0x5de8, 0x50ec458b
adc eax, 0xc483ffff
add al, 0x8d
mov dh, 0x41
outsb dx, byte [esi]
add byte [eax], al
mov eax, dword [ebp - 0x14]
push eax
call fcn.0048e67b
add esp, 4
lea esi, [esi + 0x6e41]
sub esi, 0x6e41
shr eax, 0
jo 0x49d132
jne 0x49d145
pushf
or esp, 0
cmc
popf
je 0x49d13e
xchg edi, ecx
xchg edi, ecx
je 0x49d145
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49da7d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049baea
add esp, 0xc
cmp esp, 0x8c0
and ebx, ebx
add esi, 0
jno 0x49dab1
pushf
xchg edx, edx
popf
lea esp, [esp]
xchg ebx, ebx
jo 0x49dab1
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x4d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x42
test esp, 0x367c
add ebx, 0
jge 0x49db01
mov esp, esp
jbe 0x49dafc
jl 0x49dafe
jl 0x49db01
mov eax, 0x80e84d8a
jmp 0xe897630b
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
call fcn.004a3b08
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49db8d
xor eax, eax
jmp 0x49dbfa
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004a7955
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0049baea
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x49dbf8
xor ecx, dword [esp]
xor ecx, dword [esp]
jo 0x49dbc0
jnp 0x49dbbd
jno 0x49dbc0
mov ebx, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.0048e67b
add esp, 4
and edx, edx
ror esp, 0
rol ecx, 0xa
rol ecx, 0x16
test esp, 0x1e36
jbe 0x49dbeb
mov esi, esi
jae 0x49dbe3
jg 0x49dbe5
jo 0x49dbe7
ja 0x49dbeb
ljmp 0x8b51:0xc4d8b4e
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
jmp 0x49dbfa
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49eea8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0049baea
add esp, 0xc
jbe 0x49eec3
rol eax, 0x1a
rol eax, 6
jbe 0x49eecb
jge 0x49eee6
pushf
jnp 0x49eed1
nop
cmp esp, 0x3d3d
shr edi, 0
popf
jb 0x49eedf
jne 0x49eee1
jl 0x49eee3
jl 0x49eee6
mov edx, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
rol ecx, 0x19
ror ecx, 0x19
or esi, 0
shl eax, 0
jge 0x49ef59
pushf
call fcn.0049ef43
Function at 0x49f2a3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049baea
add esp, 0xc
shr esp, 0
cld
rol esp, 0
cmp esp, 0x2f66
jns 0x49f2de
pushf
nop
neg ecx
neg ecx
xchg edi, ecx
xchg edi, ecx
popf
je 0x49f2da
nop
js 0x49f2de
mov ecx, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
jbe 0x49f31c
js 0x49f31e
xor ebx, ecx
xor ebx, ecx
lea ecx, [ecx + 0x5f38]
lea ecx, [ecx - 0x5f38]
jge 0x49f344
lea ecx, [ecx + 0x27e6]
lea ecx, [ecx - 0x27e6]
nop
jb 0x49f33f
mov ebx, ebx
jl 0x49f344
sub eax, 0x80ec4d8a
jmp 0xec977b4e
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.004ad14a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49f3ce
jmp 0x49f43e
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004a7955
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0049baea
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x49f43e
shr eax, 0
jg 0x49f40e
pushf
ror edi, 8
ror edi, 0x18
add esi, dword [esp]
sub esi, dword [esp]
popf
jge 0x49f40b
jle 0x49f40e
add eax, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.0048e67b
add esp, 4
xor eax, ebx
xor eax, ebx
je 0x49f42b
js 0x49f422
jge 0x49f424
js 0x49f426
xchg ecx, eax
xchg ecx, eax
jne 0x49f42b
mov ebp, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a060e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049baea
add esp, 0xc
sub eax, 0
je 0x4a063b
xchg esp, esp
jmp 0x4a0637
jne 0x4a063b
add eax, 0xe845c6f6
push ecx
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
cmp ecx, ebx
jno 0x4a06e8
jb 0x4a06ea
push eax
pop eax
jb 0x4a0702
jmp 0x4a06f0
ja 0x4a06f2
lea eax, [eax + 0x6730]
lea eax, [eax - 0x6730]
jae 0x4a0702
mov eax, 0xca43e832
add byte [eax], al
call fcn.004ad14a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a0717
xor eax, eax
jmp 0x4a07a9
add esp, 0
jge 0x4a071c
add edx, 0x4d2e
sub edx, 0x4d2e
jle 0x4a0732
ja 0x4a072c
mov ebx, ebx
jg 0x4a0732
mov edi, 0xe8558d7f
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004a7955
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0049baea
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4a075c
xor eax, eax
jmp 0x4a07a9
or ecx, 0
neg esi
neg esi
jl 0x4a0772
pushf
js 0x4a0769
popf
jg 0x4a076d
jae 0x4a076f
jge 0x4a0772
mov edx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0048e67b
add esp, 4
xchg ebx, ebx
jl 0x4a0782
xor edi, dword [esp]
xor edi, dword [esp]
ja 0x4a079e
pushf
sub edx, 0
test edx, 0x16ab
cmp eax, edi
popf
jno 0x4a079b
jbe 0x4a079e
mov edx, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a143e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049baea
add esp, 0xc
je 0x4a1459
jnp 0x4a145b
jnp 0x4a146c
pushf
nop
test dword [esp], edi
popf
xchg ecx, ecx
jle 0x4a1469
jp 0x4a146c
mov ecx, 0x50e845c6
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xa], 0
call fcn.004a14ad
Function at 0x4a3965
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049baea
add esp, 0xc
sub esp, 0
test dword [esp], ecx
jge 0x4a399c
jne 0x4a3988
lea ecx, [ecx + 0x6787]
lea ecx, [ecx - 0x6787]
jbe 0x4a3996
lea edi, [edi]
jl 0x4a399c
add eax, 0xec45c625
dec edx
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
add edx, 0x2a8a
sub edx, 0x2a8a
test esp, 0x33e3
xchg edx, edx
jno 0x4a3a12
pushf
cmp esi, ebx
lea ebx, [ebx + 0x57a4]
lea ebx, [ebx - 0x57a4]
jnp 0x4a3a04
add esi, 0
popf
xchg edx, esi
xchg edx, esi
mov edx, edx
jo 0x4a3a12
sub eax, 0x80ec4d8a
jmp 0xec97c21c
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.004a3b08
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a3aa6
xor eax, eax
jmp 0x4a3aff
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004a7955
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049baea
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4a3afd
rol esp, 0
nop
js 0x4a3ad9
jbe 0x4a3ad4
xchg esp, esp
jns 0x4a3ad9
lcall 0x99e8, 0x51e84d8b
stosd dword es:[edi], eax
invalid
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0048e67b
add esp, 4
xor eax, dword [esp + 0xc]
xor eax, dword [esp + 0xc]
je 0x4a3af4
ja 0x4a3af1
jne 0x4a3af4
mov edi, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x4a3aff
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a3b39
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
mov ax, word [0x47eda4]
cmp eax, 1
jne 0x4a3b5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4a3d01
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0049baea
add esp, 0xc
jb 0x4a3b6c
sub edx, 0
lea eax, [eax + 0x1357]
lea eax, [eax - 0x1357]
jp 0x4a3b8b
xchg edx, ecx
xchg edx, ecx
lea edi, [edi]
lea esp, [esp]
jnp 0x4a3b8b
mov eax, 0x45c68278
call 0xe99001da
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
not edi
not edi
nop
or esp, 0
push ecx
add ecx, 0x69a8
ror ecx, 0x17
pop ecx
jne 0x4a3bd9
jnp 0x4a3bd6
je 0x4a3bd9
mov ebx, 0x80e8558a
ljmp 0x458a
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
jno 0x4a3c43
nop
jg 0x4a3c46
jp 0x4a3c53
pushf
xchg esp, esp
popf
jo 0x4a3c50
jnp 0x4a3c53
jmp 0xdf2f3f
call fcn.004ad14a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a3c68
xor eax, eax
jmp 0x4a3d01
lea eax, [eax]
lea ebx, [ebx]
jno 0x4a3c6e
lea esp, [esp]
jp 0x4a3c88
jae 0x4a3c75
jle 0x4a3c77
lea edi, [edi + 0x6dae]
lea edi, [edi - 0x6dae]
jnp 0x4a3c88
xor ebp, 0xe8558db3
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004a7955
mov dword [ebp - 4], eax
jae 0x4a3c9a
neg edi
neg edi
jnp 0x4a3caf
pushf
cmp ebx, 0x4fa8
popf
mov edi, edi
jp 0x4a3caf
add eax, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0049baea
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4a3cc9
xor eax, eax
jmp 0x4a3d01
jg 0x4a3ccb
jo 0x4a3cda
pushf
jb 0x4a3cd1
jns 0x4a3cd3
popf
jo 0x4a3cd7
jno 0x4a3cda
mov esp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0048e67b
add esp, 4
ror ecx, 0
js 0x4a3ceb
ror edx, 0x10
ror edx, 0x10
add esp, 0
jbe 0x4a3cfe
jno 0x4a3cf8
jge 0x4a3cfa
nop
ja 0x4a3cfe
mov eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret