joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451fb8
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da8
mov eax, dword [ebp - 8]
call fcn.00404da8
xor eax, eax
push ebp
push 0x45211d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00408cb4
test al, al
je 0x452023
mov eax, dword [ebp - 8]
call fcn.00404db8
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00404af0
mov eax, dword [ebp - 0x18]
call fcn.00408dd0
test al, al
jne 0x452023
xor ebx, ebx
jmp 0x4520f5
push 0x452130
mov eax, dword [ebp - 4]
call fcn.00404db8
push eax
mov eax, dword [0x455664]
push eax
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x4520f5
push esi
mov eax, dword [0x455664]
push eax
call sub.kernel32.dll_SizeofResource
mov edi, eax
test edi, edi
je 0x4520f5
push esi
mov eax, dword [0x455664]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
test esi, esi
je 0x4520f5
push esi
call sub.kernel32.dll_LockResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4520f5
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404f44
lea eax, [ebp - 0x14]
call fcn.00404e10
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, edi
call fcn.00402c94
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.00451358
mov eax, dword [ebp - 0x1c]
call fcn.00404db8
mov dword [ebp - 0xc], eax
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.00404db8
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4520f5
push 0
lea eax, [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452124
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040491c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040491c
ret
Function at 0x452134
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da8
mov eax, dword [ebp - 8]
call fcn.00404da8
xor eax, eax
push ebp
push 0x452253
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.00408cb4
test al, al
je 0x45219c
mov eax, dword [ebp - 8]
call fcn.00404db8
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00404af0
mov eax, dword [ebp - 0x18]
call fcn.00408dd0
test al, al
jne 0x45219c
mov byte [ebp - 9], 0
jmp 0x452230
push 0x452264
mov eax, dword [ebp - 4]
call fcn.00404db8
push eax
mov eax, dword [0x455664]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x452230
push ebx
mov eax, dword [0x455664]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
test esi, esi
je 0x452230
push ebx
mov eax, dword [0x455664]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
je 0x452230
push ebx
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x452230
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.00404db8
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x452230
push 0
lea eax, [ebp - 0x14]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45225a
lea eax, [ebp - 0x18]
call fcn.004048f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040491c
ret
Function at 0x4257b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x4257d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4257d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4257c8
mov eax, 1
add ebx, ebx
jne 0x4257eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4257e0
jne 0x4257fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4257e0
xor ecx, ecx
sub eax, 3
jb 0x425810
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x425882
mov ebp, eax
add ebx, ebx
jne 0x42581b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x425828
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42584c
inc ecx
add ebx, ebx
jne 0x425838
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42582d
jne 0x425849
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42582d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42586c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42585d
jmp 0x4257ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42586c
add edi, ecx
jmp 0x4257ce
pop esi
mov edi, esi
mov ecx, 0x61
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42588a
cmp byte [edi], 5
jne 0x42588a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42588f
lea edi, [esi + 0x23000]
mov eax, dword [edi]
or eax, eax
je 0x425907
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x25cf4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x25d30]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4258bc
mov ecx, edi
jns 0x4258eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x25d34]
or eax, eax
je 0x425901
mov dword [ebx], eax
add ebx, 4
jmp 0x4258d9
call dword [esi + 0x25d38]
popal
jmp 0x40157c
Function at 0x4327ff
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 1], ecx
setl dh
mov byte [esp + 1], ah
bswap edx
jmp 0x432772

Function at 0x43288c
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf dx, ax
jae 0x432837
mov dh, byte [esp]
mov eax, dword [esp]
jmp 0x4329e0
lea esp, [esp + 4]
add cl, 0x81
xchg dx, ax
jmp 0x432852
cmc
btc eax, edi
mov dx, 0x2451
jmp 0x43286c

Function at 0x43c6a0
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x43c6f6
push edx
lea esp, [esp + 4]
jmp 0x426c67

Function at 0x459c91
Capabilities:
Execute anti-debugging instructions

Disassembly:
and dword [esi + 8], 0
push word [esp + 3]
jmp 0x459ceb
lea esp, [esp + 4]
jmp 0x4269be
mov word [esp + 2], dx
mov dword [esp], esi
lea esp, [esp + 2]
mov dword [ecx], eax
jmp 0x459cd0
Function at 0x4f9ca2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, reloc.mscoree.dll__CorExeMain
rdtsc
xchg ah, bl
lea ecx, [ecx*4]
rdtsc
pop word [esp + 4]
jmp 0x4f9ccc
jmp 0x4f9c83
add esp, 0x1a
mov dword [esp + 4], eax
bsf si, ax
call fcn.004f9ca4
pop dword [esp + 4]
mov dword [esp + 3], esi
sub esp, 0x12
btr ecx, esp
lea ebp, [esp + ebx]
jmp 0x4f9ec4
btc esi, edi
mov byte [esp + 1], ch
mov cl, ch
btc ebp, ebx
cpuid
xchg ch, dl
call fcn.004f9d8e
mov di, 0xac4f
neg dh
not dh
mov di, dx
mov ch, byte [esp + 5]
lea esi, [ebx + edi]
jmp 0x4f9eaa
rdtsc
setno dh
mov edx, eax
mov dword [esp + 0x14], ecx
lea esp, [esp + 0x15]
mov word [esp], bx
jmp 0x4f9e33
pop dword [esp]
rol di, cl
lea ecx, [esi*4]
setl bh
xchg dword [esp + 0xe], ecx
clc
jmp 0x4f9ed6
xchg edi, eax
rcr eax, 0x15
mov edi, dword [esp + 0x1f]
mov bl, 0xb0
not cx
bswap edi
jmp 0x4f9e7e
xchg word [esp + 0x16], si
not esi
inc esi
mov dword [esp + 0x12], eax
cld
xchg di, si
jmp 0x4f9e69
xchg word [esp + 0x15], di
lea esi, [ecx*4]
rdtsc
xchg bp, bx
mov byte [esp + 0xf], dh
mov ecx, dword [esp + 7]
jmp 0x4f9f13
push esp
lea esp, [esp + 5]
call fcn.004f9f72
clc
insd dword es:[edi], dx
std
test byte [edi - 0x24], dh
ljmp 0xcf30

Function at 0x4f9d90
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edi, ebx
pop word [esp + 1]
pop ecx
jmp 0x4f9dba

Function at 0x4fa5b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
lea ecx, [ebp*4]
mov esi, 0xc5d1e096
not bh
bswap ebx
jmp 0x4fa662
mov edi, 0x45ff3aa0
xchg ecx, esi
add esp, 0
sub esp, 6
jmp 0x4fa597
mov esi, ebp
rdtsc
lea esi, [edi*4]
rdtsc
clc
inc dl
jmp 0x4fa637
lea esp, [esp + 6]
sete bh
add esp, 0xa
ror dh, 7
lea esp, [esp + 4]
lea esp, [esp]
jmp 0x4fa5e7
sub esp, 0x14
xchg ebp, ecx
btr ecx, esp
pop edi
mov word [esp + 0xe], di
lea ebx, [ebx + ebp]
jmp 0x4fa648
rdtsc
ror ah, 1
bsf bp, si
mov edi, eax
mov si, di
mov edx, ebp
jmp 0x4fa61f
lea eax, reloc.mscoree.dll__CorExeMain
bsf cx, si
bswap esi
mov byte [esp + 0xb], ah
jmp 0x4fa679
rdtsc
mov ebp, dword [esp + 2]
xchg dword [esp], edi
mov cx, 0x80e5
sub esp, 0xe
mov cx, word [esp + 2]
jmp 0x4fa609
push word [esp + 0xd]
push word [esp + 7]
mov bl, bh
mov dword [esp + 7], esi
mov ax, 0x52c1
xchg word [esp + 0xb], bp
jmp 0x4fa6fe
mov dl, dh
mov eax, ebp
call fcn.004fa6d9
mov ebx, ecx
xchg word [esp + 5], si
xchg dword [esp], edx
xchg edx, eax
push word [esp + 0xf]
cld
jmp 0x4fa764
lea ebx, [esi*4]
lea edi, [esi*4]
mov ebp, 0xa30f387e
mov word [esp + 0xa], dx
push esp
add esp, 5
call fcn.004fa74d
lea eax, reloc.mscoree.dll__CorExeMain
pop word [esp + 0x17]
sub esp, 0x1c
xchg dh, al
pop eax
xchg dword [esp + 0x1e], ebp
jmp 0x4fa7cf
xchg ah, bl
not ah
mov edx, ecx
stc
lea ebx, [ebx + esi]
mov cl, 0x1a
jmp 0x4faba3
Function at 0x4fa8f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
xchg word [esp + 6], cx
jmp 0x4fa94e
rdtsc
mov ah, byte [esp + 5]
not ah
xchg bh, cl
add esp, 0xa
sub bl, ah
jmp 0x4fa97f
rdtsc
add esp, 8
pop esi
xchg dword [esp + 2], edi
not si
push dword [esp + 0xc]
jmp 0x4fa962
push word [esp + 5]
inc bl
xchg ah, bl
xchg cx, dx
push dword [esp + 6]
pop cx
jmp 0x4fa925
inc bl
pop dword [esp + 7]
mov al, ah
mov cl, 0xea
not dh
xchg edx, ebp
jmp 0x4faa11
clc
neg ch
pop edi
mov eax, dword [esp]
add esi, ebp
sub esp, 0x1a
jmp 0x4fa936
mov ebp, esi
lea esp, [esp + 3]
lea esp, [esp + 0xc]
popal
call fcn.004fa9df

Function at 0x4fa911
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dl, ch
mov dl, 0x94
pop word [esp + 0x18]
popal
xchg word [esp + 0xa], bx
lea ebx, [edi*4]
jmp 0x4fa87b
bsr ax, cx
lea eax, [edi*4]
mov word [esp + 0x1f], bx
mov dword [esp + 0x25], ecx
mov word [esp + 0x17], sp
xchg ah, bl
jmp 0x4fa7fe
neg bp
bswap esi
mov cl, 0x2a
mov dh, byte [esp + 0xc]
xchg esi, ecx
pop word [esp + 4]
jmp 0x4fa8e4
pop word [esp + 7]
push word [esp + 0xd]
xor ecx, esi
lea esi, [ecx + 0x3b]
mov dl, dh
xchg word [esp + 4], bp
jmp 0x4fa841
xchg edi, eax
mov bp, word [esp + 0xd]
mov dx, bx
bsr bx, cx
mov di, 0x67cf
mov bl, pe_nt_image_headers32
jmp 0x4fa85f
rdtsc
lea esi, [edx + edi]
shr ecx, 0x15
pop word [esp + 0x20]
and cl, bh
mov si, word [esp + 0x1b]
jmp 0x4fa824
rdtsc
xchg edi, eax
cpuid
lea ebx, [ecx + 0x6b]
mov word [esp + 0x1b], sp
pop si
jmp 0x4fa899
mov cx, 0x487b
pop dword [esp + 7]
lea edi, [ecx*4]
xchg ah, bl
call fcn.004fa8f8
xor dword [eax], esi
xor ebp, dword [edx]
inc ebp
mov ax, 0xbd0f
inc ax
not ch
xchg word [esp + 3], bx
and cl, bh
setnp dh
jmp 0x4fa8c9
pop word [esp + 0x32]
xchg byte [esp + 0x12], bl
shl ax, cl
xchg ah, bl
mov ch, byte [esp + 0xd]
jmp 0x4fa8b7

Function at 0x4fac08
Capabilities:
Parse pe header

Disassembly:
push word [esp + 1]
lea esp, [esp + 5]
call 0x4fabd3
adc edx, dword [ecx + reloc.mscoree.dll__CorExeMain]
nop
adc ecx, dword [edx - reloc.mscoree.dll__CorExeMain]
jmp 0x4fabee
pop eax
jmp 0x4fabee

Function at 0x4fad9d
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.004fa052
push eax
jmp 0x4fa04d
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x4fac33
lea esp, [esp + 0x8c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x4fac51
mov byte [esp + 3], dh
mov dword [esp + 3], esi
pop word [esp + 3]
mov byte [esp + 4], ch
pop word [esp + 1]
mov dword [esp + 0x8c], edi
jmp 0x4facb3
jmp 0x4fad31
Function at 0x4a4773
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a802d
add esp, 0xc
rol esp, 0
ror edi, 0x1d
ror edi, 3
jns 0x4a47a0
lea ecx, [ecx]
jnp 0x4a479b
jo 0x4a479d
js 0x4a47a0
add eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
test edi, 0x6358
xor edx, ebx
xor edx, ebx
add edi, 0x4a1e
sub edi, 0x4a1e
jg 0x4a4805
xchg esi, edx
xchg esi, edx
lea ecx, [ecx + 0x358e]
lea ecx, [ecx - 0x358e]
jle 0x4a47fe
lea esp, [esp]
jle 0x4a4805
mov eax, 0xe84d8a3b
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
test dword [esp + 4], ecx
test esp, 0x1adb
neg eax
neg eax
jnp 0x4a4884
js 0x4a487f
xchg edx, edx
jp 0x4a4884
sub eax, 0xbc2ae8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.004b04b3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a4899
xor eax, eax
jmp 0x4a4935
nop
cmp esp, 0x23a8
jg 0x4a48a2
je 0x4a48af
jp 0x4a48a6
jmp 0x4a48a8
mov esp, esp
lea ebx, [ebx]
jne 0x4a48af
ljmp 0x558b:0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004b6106
mov dword [ebp - 4], eax
xor edx, dword [esp]
xor edx, dword [esp]
jnp 0x4a48c7
cmp edi, esi
jl 0x4a48d7
jge 0x4a48cd
jbe 0x4a48cf
xchg esp, esp
mov esp, esp
jge 0x4a48d7
mov esi, 0x6a0d6ad8
add byte [ebp - 0x17af17bb], cl
dec ecx
aaa
add byte [eax], al
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a802d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4a48f1
xor eax, eax
jmp 0x4a4935
jb 0x4a48f3
jo 0x4a4902
lea esp, [esp]
jg 0x4a48fa
lea esp, [esp]
js 0x4a48ff
jno 0x4a4902
call 0x52469691
mov ecx, dword [ebp - 4]
push ecx
call fcn.004a4a43
add esp, 4
test dword [esp + 4], eax
sub eax, 0
shl eax, 0
jae 0x4a4932
pushf
rol esp, 0
xchg ebx, eax
xchg ebx, eax
ror edx, 0x17
rol edx, 0x17
cmp esi, ebx
popf
jg 0x4a492d
xchg esp, esp
jb 0x4a4932
mov ebp, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a6a23
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004a802d
add esp, 0xc
jbe 0x4a6a3e
jp 0x4a6a40
add edi, 0x25bd
sub edi, 0x25bd
jne 0x4a6a59
pushf
mov esp, esp
popf
jb 0x4a6a56
je 0x4a6a59
sub eax, 0x52e445c6
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x1b], 0x76
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xe], 0x62
nop
jle 0x4a6ab9
lea edx, [edx + 0x773c]
lea edx, [edx - 0x773c]
xchg edx, edx
jg 0x4a6ab9
jmp 0x812eb847
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
xchg edx, esi
xchg edx, esi
xor ebx, 0
jo 0x4a6b77
pushf
call fcn.004a6b65
Function at 0x4a9331
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a802d
add esp, 0xc
xchg ecx, ecx
ror esp, 0
je 0x4a9366
pushf
std
cld
popf
jns 0x4a9360
lea esp, [esp]
jne 0x4a9366
mov ebp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
and eax, eax
je 0x4a9422
pushf
je 0x4a9417
mov eax, eax
jae 0x4a941b
popf
jp 0x4a941f
jne 0x4a9422
mov edi, 0x708ce8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.004b04b3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a9437
xor eax, eax
jmp 0x4a94e1
and eax, 0xffffffff
ror edx, 0x15
rol edx, 0x15
rol edx, 0
jns 0x4a944f
jae 0x4a9447
nop
jno 0x4a944a
js 0x4a944f
call 0x55d7996c
call 0xf8901fa8
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004b6106
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004a802d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4a9479
xor eax, eax
jmp 0x4a94e1
ror ecx, 1
ror ecx, 0x1f
rol eax, 0
cmp esi, dword [esp]
jns 0x4a94a8
pushf
clc
nop
sub ecx, 0
neg esi
neg esi
popf
lea ebx, [ebx + 0x6a41]
lea ebx, [ebx - 0x6a41]
xchg edx, ecx
xchg edx, ecx
jb 0x4a94a5
js 0x4a94a8
lcall 0x92e8, 0x52fc558b
mov ch, 0xff
inc dword [ebx - 0x4072fb3c]
cmp edi, dword [ecx]
add byte [ebp - 0x793a41], cl
push dword [eax + 0x14]
mov edx, dword [ebp - 4]
push edx
call fcn.004a4a43
add esp, 4
lea edi, [edi + 0x793b]
lea edi, [edi - 0x793b]
jo 0x4a94d6
jnp 0x4a94c4
lea esp, [esp]
lea ebx, [ebx + 0x680b]
lea ebx, [ebx - 0x680b]
jno 0x4a94d6
mov esp, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4abd9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add eax, 1
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004a802d
add esp, 0xc
lea ecx, [ecx + 0x6687]
lea ecx, [ecx - 0x6687]
jbe 0x4abdcc
je 0x4abdc5
jmp 0x4abdc7
ja 0x4abdcc
call 0x4610c6f9
in al, dx
jp 0x4abd97
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0xe990841f
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
lea esp, [esp]
lea esp, [esp]
ror edx, 3
ror edx, 0x1d
xchg edi, eax
xchg edi, eax
jns 0x4abe31
pushf
xchg edx, edx
lea edi, [edi + 0x7070]
lea edi, [edi - 0x7070]
xchg ecx, ecx
xchg ebx, eax
xchg ebx, eax
popf
mov esp, esp
xchg esp, esp
js 0x4abe31
sub eax, 0x80f44d8a
jmp 0xf498463b
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
Function at 0x4ada35
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a802d
add esp, 0xc
ja 0x4ada57
and edx, 0xffffffff
je 0x4ada6c
pushf
jae 0x4ada60
shr ecx, 0
popf
lea eax, [eax]
mov esp, esp
jne 0x4ada6c
mov esi, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004b04b3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4adb34
xor eax, eax
jmp 0x4adb9d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b6106
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004a802d
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x4adb5e
xor eax, eax
jmp 0x4adb9d
js 0x4adb60
mov edi, edi
cmc
jb 0x4adb65
jo 0x4adb6e
je 0x4adb69
jo 0x4adb6b
jno 0x4adb6e
or dword [ebx - 0x17af17bb], 0xffff6ecc
mov eax, dword [ebp - 0x18]
push eax
call fcn.004a4a43
add esp, 4
inc ebx
dec ebx
and esi, esi
jb 0x4adb92
pushf
ror esi, 0
jp 0x4adb87
popf
xchg edi, ecx
xchg edi, ecx
xchg edi, eax
xchg edi, eax
jae 0x4adb92
mov ebp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8