joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e1a3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x14
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0046a31d
add esp, 0xc
mov edi, edi
je 0x45e1c9
mov edi, edi
jno 0x45e1c4
jne 0x45e1c9
mov eax, 0x45c614ad
in al, 0x48
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x15], 0x66
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0x12], 0x51
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x4a
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0
xor esi, 0
jno 0x45e21e
js 0x45e226
mov esp, esp
nop
jns 0x45e226
lcall 0x1e9, 0x80e44d8a
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xe]
sub cl, 1
mov byte [ebp - 0xe], cl
call fcn.0046c73b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45e2e0
xor eax, eax
jmp 0x45e3ad
jae 0x45e2e2
xor eax, 0x15a4
xor eax, 0x15a4
jb 0x45e2fa
xchg ecx, ecx
xchg ebx, ebx
je 0x45e2f4
jl 0x45e2f6
jae 0x45e2fa
lcall 0x8b52, 0xe4558d1e
inc ebp
clc
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046eef7
mov dword [ebp - 4], eax
push 0x14
push 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x45e377
xor edi, 0
stc
cmp edx, 0x4319
jo 0x45e341
pushf
xor esi, 0
jp 0x45e333
or edi, 0
popf
js 0x45e33a
jnp 0x45e33c
jb 0x45e33e
jno 0x45e341
mov edi, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004710d5
add esp, 4
xor ebx, 0x880
xor ebx, 0x880
call fcn.0045e35e
xchg esp, esp
push edx
add edx, 0x588
ror edx, 0x19
pop edx
cmp ebx, dword [esp + 4]
jne 0x45e3ab
lea edx, [edx + 0x1bd1]
lea edx, [edx - 0x1bd1]
lea ecx, [ecx + 0x56d5]
lea ecx, [ecx - 0x56d5]
lea ecx, [ecx]
jne 0x45e3a6
je 0x45e3ab
mov edi, 0xc033dce4
xor eax, eax
Function at 0x45e3d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046a31d
add esp, 0xc
sub esp, 0
rol ecx, 0x18
ror ecx, 0x18
shr esp, 0
ja 0x45e40f
pushf
jo 0x45e403
popf
lea esp, [esp]
xchg esp, esp
mov ebx, ebx
jbe 0x45e40f
sub eax, 0x7aec45c6
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
jne 0x45e449
add edi, 0
nop
ror esi, 0x17
rol esi, 0x17
jnp 0x45e45f
jg 0x45e457
jae 0x45e459
nop
jb 0x45e45c
jp 0x45e45f
mov ecx, 0x80f44d8a
jmp 0xf4936c69
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
dec ebx
inc ebx
jge 0x45e4e0
xchg ebx, ecx
xchg ebx, ecx
jmp 0x45e4da
nop
jl 0x45e4e0
mov esp, 0x56e8ae71
loop 0x45e4e4
call fcn.0046c73b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45e4f3
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 5], dh
jmp 0x45e5a7
push edi
pop edi
jne 0x45e50c
jo 0x45e4f9
xchg esi, esi
lea ecx, [ecx + 0x6587]
lea ecx, [ecx - 0x6587]
jle 0x45e509
je 0x45e50c
jmp 0x532e3a9d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046eef7
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0046a31d
add esp, 0xc
not eax
not eax
or ecx, 0
dec edi
inc edi
jb 0x45e537
jb 0x45e555
pushf
push edx
add edx, 0x7a6d
ror edx, 1
pop edx
je 0x45e547
shr esi, 0
nop
popf
nop
jmp 0x45e550
lea esi, [esi]
jae 0x45e555
xor eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x45e55d
jmp 0x45e5a7
test eax, 0x56d0
jb 0x45e570
jne 0x45e566
jnp 0x45e568
jne 0x45e56a
lea esp, [esp]
jae 0x45e570
or dword [ebx - 0x17ad03ab], 0x12b5c
mov edx, dword [ebp - 4]
push edx
call fcn.004710d5
add esp, 4
neg ebx
neg ebx
add ecx, 0
ror edi, 0xc
ror edi, 0x14
jne 0x45e5a0
xchg ecx, eax
xchg ecx, eax
lea ecx, [ecx + 0x275f]
lea ecx, [ecx - 0x275f]
mov ebx, ebx
jp 0x45e59d
je 0x45e5a0
call 0x504e2b2f
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45ed68
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x454758
call fcn.00472c6a
add esp, 0xc
mov byte [0x454758], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x45fe4c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0046a31d
add esp, 0xc
xchg esp, esp
sub esp, 0
jb 0x45fe73
ja 0x45fe6e
jae 0x45fe73
lcall 0x48f0, 0x45c61c7c
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 8], 0x78
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 9], 0x70
or esp, 0
shl esp, 0
jg 0x45fec5
lea ebx, [ebx + 0x7b47]
lea ebx, [ebx - 0x7b47]
jnp 0x45feb1
xchg esi, edi
xchg esi, edi
lea edi, [edi + 0x6ff6]
lea edi, [edi - 0x6ff6]
jle 0x45fec5
mov ebx, 0xf04d8aac
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
call fcn.00463b8f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45ff25
xor eax, eax
jmp 0x45ff9f
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0046eef7
mov dword [ebp - 0x14], eax
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x45ff9d
jle 0x45ff4d
rol esp, 0
jno 0x45ff52
jb 0x45ff5f
mov esp, esp
lea esp, [esp]
jns 0x45ff5b
jae 0x45ff5f
xor eax, 0xec4d8b34
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004710d5
add esp, 4
ror esi, 0
jle 0x45ff70
jae 0x45ff90
pushf
cmp edi, 0x5d5e
lea eax, [eax + 0xa74]
sub eax, 0xa74
jge 0x45ff87
xchg ecx, ecx
popf
jl 0x45ff8d
jb 0x45ff90
jmp 0x5252551f
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
jmp 0x45ff9f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x461626
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046a31d
add esp, 0xc
rol ecx, 0x16
rol ecx, 0xa
jmp 0x461647
nop
lea ecx, [ecx + 0x3c1f]
lea ecx, [ecx - 0x3c1f]
je 0x46165e
jo 0x461658
lea esi, [esi]
jne 0x46165e
sub eax, 0xe845c61a
inc edi
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
mov esp, esp
rol ebx, 0
or edi, edi
jno 0x46169f
je 0x4616c4
pushf
lea edi, [edi + 0x35c]
sub edi, 0x35c
popf
jmp 0x4616b3
lea esi, [esi + 0x57f1]
lea esi, [esi - 0x57f1]
jae 0x4616c1
jne 0x4616c4
add eax, 0x80e84d8a
jmp 0xe8939ece
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.00463b8f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x461747
xor eax, eax
jmp 0x4617b8
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0046eef7
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4617b6
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
and esp, 0xffffffff
shl esp, 0
js 0x46177d
je 0x461786
jle 0x461781
xchg edi, edi
jne 0x461786
mov ecx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.004710d5
add esp, 4
rol eax, 0x18
ror eax, 0x18
dec edi
inc edi
js 0x4617a1
jb 0x46179e
jns 0x4617a1
mov ebp, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x4617b8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x462ff2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0046a31d
add esp, 0xc
add esp, 0
push ecx
add ecx, 0x11b4
ror ecx, 0x1d
pop ecx
rol edx, 0x15
rol edx, 0xb
jnp 0x463027
xchg ecx, ecx
jp 0x463027
sub eax, 0xe045c608
dec eax
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
jo 0x463075
ja 0x46307e
nop
jle 0x46307a
jbe 0x46307e
mov eax, 0xe04d8a0f
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
shl edx, 0
test edx, 0x68c3
std
cld
jbe 0x463127
je 0x46313a
pushf
std
cld
neg ebx
neg ebx
popf
lea eax, [eax]
lea ebx, [ebx]
jne 0x46313a
ljmp 0x8900:0x95fce8
call fcn.0046c73b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46314f
xor eax, eax
jmp 0x4633e5
js 0x463151
jg 0x463153
stc
jg 0x46315c
lea edi, [edi]
jle 0x46315c
mov ebx, 0xe04d8d2d
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0046eef7
mov dword [ebp - 4], eax
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0046a31d
add esp, 0xc
test dword [esp], edx
jns 0x463181
xchg ebx, edi
xchg ebx, edi
jno 0x4631b4
pushf
rol esp, 0
call fcn.00463191
Function at 0x46aa60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0046a31d
add esp, 0xc
jo 0x46aa7b
sub edx, 0
shl edx, 0
jg 0x46aa8c
jnp 0x46aa85
xchg edi, eax
xchg edi, eax
jle 0x46aa8c
mov edx, 0x45c6b631
in al, 0x53
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
xchg ebx, ebx
push eax
pop eax
lea edi, [edi]
ja 0x46aaea
lea esp, [esp]
jp 0x46aae1
jns 0x46aae3
jnp 0x46aae5
jbe 0x46aaea
lcall 0x80e4, 0x4d8aaf8a
jmp 0xe49432f4
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0046c73b
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46ab9b
xor eax, eax
jmp 0x46ac2a
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0046eef7
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x46ac28
and esp, 0xffffffff
nop
rol ecx, 0xa
ror ecx, 0xa
jne 0x46abcd
jge 0x46abf1
pushf
jp 0x46abd3
xor ecx, ebx
xor ecx, ebx
add edx, 0x6af9
sub edx, 0x6af9
add esp, 0
popf
je 0x46abea
jnp 0x46abec
mov edi, edi
jl 0x46abf1
sub eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.004710d5
add esp, 4
cmc
jns 0x46ac0f
pushf
lea ebx, [ebx]
popf
mov edx, edx
jnp 0x46ac0a
jae 0x46ac0c
js 0x46ac0f
add eax, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x46ac2a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x470bf4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4544b4], 1
jne 0x470d27
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0046a31d
add esp, 0xc
test dword [esp + 0xc], eax
je 0x470c2a
xchg esp, esp
jbe 0x470c24
jno 0x470c26
jne 0x470c2a
mov esp, 0xe845c6cf
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
ja 0x470c58
rol esp, 0
clc
je 0x470c72
lea ecx, [ecx + 0x6194]
lea ecx, [ecx - 0x6194]
xchg ecx, edx
xchg ecx, edx
jne 0x470c72
mov edx, 0xe84d8add
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.0046c73b
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x470cdf
mov eax, dword [ebp + 8]
jmp 0x470dae
lea eax, [eax]
nop
jb 0x470ce4
jns 0x470cec
jns 0x470ce8
js 0x470cec
xor eax, 0xe8558dc1
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0046eef7
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x470d1d
mov edx, dword [ebp - 8]
mov dword [0x4544b4], edx
jmp 0x470d25
mov eax, dword [ebp + 8]
jmp 0x470dae
jmp 0x470d2f
mov eax, dword [0x4544b4]
mov dword [ebp - 8], eax
cmp esp, 0x47ec
shr esp, 0
add edx, dword [esp]
sub edx, dword [esp]
je 0x470d51
pushf
test esi, ecx
popf
xchg edi, edx
xchg edi, edx
mov esp, esp
jge 0x470d4e
jne 0x470d51
sub eax, 0x89f84d8b
dec ebp
cld
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
xor edi, dword [esp + 4]
xor edi, dword [esp + 4]
and eax, 0xffffffff
lea esp, [esp]
jnp 0x470d72
xchg esp, esp
jbe 0x470d6b
je 0x470d6d
jp 0x470d72
sub eax, 0x558b74ec
cld
mov edx, dword [ebp - 4]
push edx
call fcn.004710d5
add esp, 4
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
lea esp, [esp]
ror esp, 0
shl esp, 0
jle 0x470da7
pushf
push edx
pop edx
cmp ebx, edi
cmp edx, dword [esp]
jne 0x470d9c
popf
jae 0x470da0
xchg edx, ebx
xchg edx, ebx
jg 0x470da7
or dword [ebx - 0xaff7bb], 0x5e5ffc55
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47286a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046a31d
add esp, 0xc
sub edi, 0
or esp, 0
shl esp, 0
je 0x472898
xchg edi, edi
js 0x472892
jno 0x472894
jne 0x472898
mov esi, 0xec45c6b6
dec edx
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
or eax, eax
jg 0x4728f5
pushf
not eax
not eax
cmc
shr esp, 0
test eax, 0x4022
popf
nop
jg 0x4728f0
jne 0x4728f2
jle 0x4728f5
or dword [edx - 0x167f13b3], 0xec4d8801
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.00463b8f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x472989
xor eax, eax
jmp 0x4729f5
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0046eef7
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0046a31d
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x4729f3
push ebx
add ebx, 0x1f78
ror ebx, 7
pop ebx
rol esi, 0xf
ror esi, 0xf
or edi, 0
jns 0x4729ca
jae 0x4729c7
js 0x4729ca
mov ebp, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004710d5
add esp, 4
ror ebx, 0
test eax, ecx
jp 0x4729dd
add edx, 0
jb 0x4729ea
ja 0x4729e4
jnp 0x4729e6
nop
jae 0x4729ea
jmp 0x524f7f79
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x4729f5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4