joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4999f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
call fcn.004998e6
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x499a53
leave
ret
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x499a82
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
and byte [ebp - 5], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x49
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 8], 0x72
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 6], 0x6c
call fcn.004998e6
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x499aee
leave
ret
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x499b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x48
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6c
call fcn.004998e6
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x499b7c
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x499b99
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
push esi
push 0x80
push 3
push esi
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x18]
push 0xc0000000
push eax
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0x5c
mov byte [ebp - 0x16], 0x2e
mov byte [ebp - 0x15], 0x5c
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0x12], 0x53
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xf], 0x54
call fcn.004999f7
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x499c33
push ebx
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 4]
push 4
push eax
push esi
push esi
push 0x80002000
push edi
call fcn.00499a82
push edi
mov ebx, eax
call fcn.00499b20
add esp, 0x24
cmp ebx, esi
pop ebx
je 0x499c2c
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
mov byte [eax], cl
xor eax, eax
jmp 0x499c38
mov eax, 0xc358
jmp 0x499c38
mov eax, 0xc357
pop edi
pop esi
leave
ret

Function at 0x499c3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, ax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x499c52
pop es
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
test al, al
jne 0x499c65
add al, 0x55
mov ecx, dword [ebp + 8]
pop esi
mov byte [ecx], al
xor al, al
leave
ret
Function at 0x4a023c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x1c]
cmp ecx, 1
jle 0x4a0317
add eax, 0x32
push esi
dec ecx
movzx edx, byte [eax + 1]
movzx esi, byte [eax - 1]
mov edx, dword [edx*4 + 0x502564]
xor edx, dword [esi*4 + 0x501d64]
movzx esi, byte [eax]
add eax, 0x10
xor edx, dword [esi*4 + 0x502164]
movzx esi, byte [eax - 0x12]
xor edx, dword [esi*4 + 0x501964]
mov dword [eax - 0x12], edx
movzx edx, byte [eax - 0xb]
movzx esi, byte [eax - 0xc]
mov edx, dword [edx*4 + 0x502564]
xor edx, dword [esi*4 + 0x502164]
movzx esi, byte [eax - 0xd]
xor edx, dword [esi*4 + 0x501d64]
movzx esi, byte [eax - 0xe]
xor edx, dword [esi*4 + 0x501964]
mov dword [eax - 0xe], edx
movzx edx, byte [eax - 7]
movzx esi, byte [eax - 8]
mov edx, dword [edx*4 + 0x502564]
xor edx, dword [esi*4 + 0x502164]
movzx esi, byte [eax - 9]
xor edx, dword [esi*4 + 0x501d64]
movzx esi, byte [eax - 0xa]
xor edx, dword [esi*4 + 0x501964]
mov dword [eax - 0xa], edx
movzx edx, byte [eax - 3]
movzx esi, byte [eax - 4]
mov edx, dword [edx*4 + 0x502564]
xor edx, dword [esi*4 + 0x502164]
movzx esi, byte [eax - 5]
xor edx, dword [esi*4 + 0x501d64]
movzx esi, byte [eax - 6]
xor edx, dword [esi*4 + 0x501964]
dec ecx
mov dword [eax - 6], edx
jne 0x4a0251
pop esi
ret
Function at 0x4a0944
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp ebx, 0x40
push edi
jle 0x4a098f
lea eax, [ebp - 0xe8]
push eax
call fcn.004a0a61
push ebx
lea eax, [ebp - 0xe8]
push dword [ebp + 8]
push eax
call fcn.004a0a89
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004a0b38
add esp, 0x18
lea esi, [ebp - 0x10]
push 0x10
pop ebx
jmp 0x4a0992
mov esi, dword [ebp + 8]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
push 0x10
lea edi, [ebp - 0x50]
pop ecx
xor edx, edx
test ebx, ebx
rep stosd dword es:[edi], eax
jle 0x4a09c7
lea eax, [ebp - 0x50]
sub esi, eax
lea eax, [edx + ebp - 0x50]
inc edx
cmp edx, ebx
mov cl, byte [eax + esi]
mov byte [edx + ebp - 0x91], cl
mov byte [eax], cl
jl 0x4a09b2
xor eax, eax
jmp 0x4a09cc
xor byte [eax + ebp - 0x90], 0x36
xor byte [eax + ebp - 0x50], 0x5c
inc eax
cmp eax, 0x40
jl 0x4a09c9
lea eax, [ebp - 0xe8]
push eax
call fcn.004a0a61
lea eax, [ebp - 0x90]
push 0x40
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.004a0a89
mov esi, dword [ebp + 0x10]
add esp, 0x10
lea eax, [ebp - 0xe8]
mov ecx, esi
push 4
sub eax, esi
pop edi
mov edx, edi
jmp 0x4a0a18
mov ebx, dword [ecx + eax]
mov dword [ecx], ebx
add ecx, edi
dec edx
jne 0x4a0a15
lea eax, [ebp - 0xe8]
push eax
call fcn.004a0a61
lea eax, [ebp - 0x50]
push 0x40
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.004a0a89
add esp, 0x10
lea eax, [ebp - 0xe8]
lea ecx, [esi + 0x10]
mov edx, edi
jmp 0x4a0a51
mov esi, dword [eax]
add eax, edi
mov dword [ecx], esi
add ecx, edi
dec edx
jne 0x4a0a4e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a0a89
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 4
mov eax, esi
pop ecx
xor dword [eax], 0x41dfac36
add eax, 4
dec ecx
jne 0x4a0a97
mov ecx, dword [esi + 0x10]
mov edi, dword [ebp + 0x10]
mov eax, ecx
mov edx, edi
shr eax, 3
lea ecx, [ecx + edi*8]
and eax, 0x3f
shl edx, 3
cmp ecx, edx
mov dword [esi + 0x10], ecx
jae 0x4a0ac3
inc dword [esi + 0x14]
push 0x40
mov ecx, edi
pop ebx
shr ecx, 0x1d
add dword [esi + 0x14], ecx
sub ebx, eax
cmp edi, ebx
jb 0x4a0b16
push ebx
lea eax, [esi + eax + 0x18]
push dword [ebp + 0xc]
push eax
call fcn.004a160c
lea eax, [esi + 0x18]
push eax
push esi
call fcn.004a0b9c
add esp, 0x14
mov dword [ebp + 8], ebx
add ebx, 0x3f
cmp ebx, edi
jae 0x4a0b12
mov eax, dword [ebp + 0xc]
lea eax, [ebx + eax - 0x3f]
push eax
push esi
call fcn.004a0b9c
add dword [ebp + 8], 0x40
pop ecx
pop ecx
add ebx, 0x40
jmp 0x4a0af5
xor eax, eax
jmp 0x4a0b1a
and dword [ebp + 8], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
sub edi, ecx
add ecx, edx
push edi
lea eax, [esi + eax + 0x18]
push ecx
push eax
call fcn.004a160c
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4a2b44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x14
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.004998b7
and byte [ebp - 0x17], 0
add esp, 0xc
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x18], 0x65
call fcn.004998e6
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a2bac
lea ecx, [ebp - 0x10]
push ecx
call eax
push esi
push 0x14
movzx esi, word [ebp - 0x10]
movzx eax, word [ebp - 0xe]
imul esi, esi, 0xd
add esi, eax
push 0
movzx eax, word [ebp - 0xa]
imul esi, esi, 0x1e
add esi, eax
movzx eax, word [ebp - 8]
imul esi, esi, 0x1a
imul eax, eax, 0x3d
add esi, eax
movzx eax, word [ebp - 6]
add esi, eax
movzx eax, word [ebp - 4]
imul esi, esi, 0x3c
add esi, eax
movzx eax, word [ebp - 2]
imul esi, esi, 0x4d2
add esi, eax
lea eax, [ebp - 0x24]
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x4a2e9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
xor ebx, ebx
mov byte [ebp - 0x20], 0x2a
mov byte [ebp - 0x10], 0x67
mov byte [ebp - 0x1f], 0x2f
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x49
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x22
mov byte [ebp - 0x18], 0x40
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], bl
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], bl
mov byte [ebp - 0x15], 0x51
mov byte [ebp - 5], bl
mov byte [ebp - 0x14], 0xaa
mov byte [ebp - 4], bl
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], bl
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], bl
call fcn.004998e6
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x44]
push ecx
call eax
mov ax, word [ebp - 0x44]
xor ecx, ecx
mov cl, ah
mov byte [ebp - 7], al
mov ax, word [ebp - 0x42]
mov byte [ebp - 6], cl
xor ecx, ecx
mov byte [ebp - 4], al
mov cl, ah
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 5], 0x2d
mov byte [ebp - 3], cl
call fcn.004a0a61
lea eax, [ebp - 0x20]
push 0x1e
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.004a0a89
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 8]
call fcn.004a0b38
push 0x1f
push ebx
lea eax, [ebp - 0x20]
push eax
call fcn.004998b7
add esp, 0x24
pop ebx
leave
ret
Function at 0x4a2fc5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
lea eax, [ebp - 0x9c]
mov byte [ebp - 0x20], 0x2a
push eax
mov byte [ebp - 0x10], 0x67
mov byte [ebp - 0x1f], 0x2f
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x49
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x22
mov byte [ebp - 0x18], 0x40
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], 0x11
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], 0x2b
mov byte [ebp - 0x15], 0x51
mov byte [ebp - 5], 0x3c
mov byte [ebp - 0x14], 0xaa
mov byte [ebp - 4], 0x46
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], 0x5e
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
call fcn.004a0a61
lea eax, [ebp - 0x20]
push 0x1c
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.004a0a89
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 8]
call fcn.004a0b38
and byte [ebp - 0x27], 0
add esp, 0x18
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
call fcn.004998e6
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x44]
push ecx
call eax
mov cx, word [ebp - 0x44]
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dl, ch
mov byte [eax], cl
mov cx, word [ebp - 0x42]
mov byte [eax + 1], dl
xor edx, edx
mov byte [eax + 2], cl
mov dl, ch
mov byte [eax + 3], dl
leave
ret
Function at 0x4a386e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
and byte [ebp - 8], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x72
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x45
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x72
call fcn.004998e6
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4a38ce
leave
ret
push esi
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x4a39df
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
and byte [ebp - 0xa], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x65
call fcn.004998e6
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4a3a37
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x4a3a54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x6f
call fcn.004998e6
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4a3ab0
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x4a3ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0x1d], 0x75
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 8], 0x4c
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 5], 0x74
call fcn.004a3b83
test eax, eax
je 0x4a3b62
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4a3b66
xor eax, eax
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x4a3b83
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x4ff64c], 1
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 9], 0x6c
jne 0x4a3be5
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4ff64c], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004998b7
mov eax, dword [0x4ff64c]
add esp, 0xc
leave
ret
Function at 0x4a3bfc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and byte [ebp - 1], 0
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 4], 0x63
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0xb], 0x49
mov byte [ebp - 3], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 2], 0x73
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 7], 0x72
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 5], 0x61
call fcn.004a3b83
test eax, eax
je 0x4a3c8a
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4a3c8e
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1c
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x4a3cb7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and byte [ebp - 4], 0
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x11], 0x47
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 9], 0x44
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 7], 0x76
call fcn.004a3b83
test eax, eax
je 0x4a3d2e
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, fcn.004a3cb7
test ecx, ecx
jne 0x4a3d32
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x15
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x4a3def
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 4], 0
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 8], 0x61
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 6], 0x6c
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0xd], 0x63
call fcn.004a3b83
test eax, eax
je 0x4a3e91
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4a3e95
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x21
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.004998b7
add esp, 0xc
mov eax, esi
pop esi
leave
ret