joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40288e
pop dword [ebp - 0x38]
mov eax, 0x54069a52
sub eax, 0x53c671c4
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa5fa4df6
add dword [ebp - 0x48], 0xa857f755
mov dword [ebp - 0x44], 0x25945182
add dword [ebp - 0x44], 0xc9efac3
mov dword [ebp - 0x40], 0xafc6ed20
sub dword [ebp - 0x40], 0x637aa8f2
mov dword [ebp - 0x3c], 0x28cc5d09
sub dword [ebp - 0x3c], 0x28cc5d09
lea eax, [ebp - 0x48]
push eax
mov eax, 0x54f87d67
sub eax, 0x54b80d03
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xd8867ea0
add dword [ebp - 0x48], 0x9bebeab6
mov dword [ebp - 0x44], 0x3ae0ca2e
sub dword [ebp - 0x44], 0xf97468b9
mov dword [ebp - 0x40], 0xac69f7de
add dword [ebp - 0x40], 0xb705748e
mov dword [ebp - 0x3c], 0x4f54b0ac
add dword [ebp - 0x3c], 0xb0ab4f54
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xabe1a7a0
sub eax, 0xaba136f8
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3393e
push 0
call eax
mov ecx, 0x22315d0b
sub ecx, 0x2231211e
xor ebx, ebx
add ebx, eax
mov esi, 0x248a08fd
add esi, 0xdbb6f703
add esi, dword [ebp - 0x38]
mov edi, 0xf4582d33
add edi, 0xbcbb22ba
sub dword [ebp - 0x14], ecx
mov edx, dword [esi]
add dword [ebp - 0x18], 0x5354de1d
sub edx, edi
add dword [ebp - 4], 0x506e2a1
mov dword [ebx], edx
xor dword [ebp - 0x10], 0x11e473af
add ebx, 4
add esi, 0xc2d5a1b5
add esi, 0x3d2a5e4f
loop 0x4029b2
add eax, 0x767c7b3f
sub eax, 0x767b98b8
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40e3f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40e412
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40e419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x40e408
mov eax, 1
add ebx, ebx
jne 0x40e42d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40e422
jne 0x40e43e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e422
xor ecx, ecx
sub eax, 3
jb 0x40e452
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40e4c6
mov ebp, eax
add ebx, ebx
jne 0x40e45d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40e46a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40e48e
inc ecx
add ebx, ebx
jne 0x40e47a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40e46f
jne 0x40e48b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e46f
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x40e4b0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40e4a2
jmp 0x40e40e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40e4b0
add edi, ecx
jmp 0x40e40e
pop esi
mov edi, esi
mov ecx, 0x1a3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40e4ce
cmp byte [edi], 0
jne 0x40e4ce
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40e4d3
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x40e542
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40e500
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe118]
or eax, eax
je 0x40e53c
mov dword [ebx], eax
add ebx, 4
jmp 0x40e51d
call dword [esi + 0xe11c]
popal
jmp 0x4042ac
Function at 0x6adcc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x199000]
push edi
jmp 0x6adcda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6adce1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6adcd0
mov eax, 1
add ebx, ebx
jne 0x6adcf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6add04
jne 0x6add23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6add23
dec eax
add ebx, ebx
jne 0x6add10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6adce8
add ebx, ebx
jne 0x6add1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6add75
xor ecx, ecx
sub eax, 3
jb 0x6add3b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6addaa
sar eax, 1
mov ebp, eax
jmp 0x6add46
add ebx, ebx
jne 0x6add46
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6add14
inc ecx
add ebx, ebx
jne 0x6add54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6add14
add ebx, ebx
jne 0x6add61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6add56
jne 0x6add72
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6add56
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6add94
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6add86
jmp 0x6adcd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6add94
add edi, ecx
jmp 0x6adcd6
pop esi
mov edi, esi
mov ecx, 0x5d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6addb2
cmp byte [edi], 1
jne 0x6addb2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6addb7
lea edi, [esi + 0x2ab000]
mov eax, dword [edi]
or eax, eax
je 0x6ade26
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2ca730]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2ca780]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6adde4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2ca784]
or eax, eax
je 0x6ade20
mov dword [ebx], eax
add ebx, 4
jmp 0x6ade01
call dword [esi + 0x2ca794]
mov ebp, dword [esi + 0x2ca788]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6ade5a
sub esp, 0xffffff80
jmp 0x402c61
Function at 0x404cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0xc], 0
call fcn.00404640
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404e0a
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x24], 0x6d
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x24], 0x45
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x24], 0x69
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x24], 0x6e
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x24], 0x43
mov eax, 1
imul ecx, eax, 0x11
mov byte [ebp + ecx - 0x24], 0x73
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x24], 0x74
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x24], 0x49
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x24], 0x43
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x24], 0x72
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x24], 0x6c
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x24], 0x6f
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x24], 0x6f
mov edx, 1
imul eax, edx, 0x13
mov byte [ebp + eax - 0x24], 0x78
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x24], 0x6d
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x24], 0x6f
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x24], 0x74
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x24], 0x6e
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x24], 0x6f
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x24], 0x6e
mov edx, 1
imul eax, edx, 0x14
mov byte [ebp + eax - 0x24], 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404e00
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x404e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0xc], 0
call fcn.00404740
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405040
mov eax, 1
imul ecx, eax, 0x15
mov byte [ebp + ecx - 0x30], 0x64
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x30], 0x76
mov ecx, 1
imul edx, ecx, 0x17
mov byte [ebp + edx - 0x30], 0x6c
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x30], 0x67
mov edx, 1
imul eax, edx, 0x1f
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
imul edx, ecx, 0x1d
mov byte [ebp + edx - 0x30], 0x69
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x30], 0x55
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x30], 0x74
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x30], 0x69
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x30], 0x46
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x30], 0x72
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x30], 0x72
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x30], 0x64
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x30], 0x50
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x30], 0x75
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x30], 0x6c
mov ecx, 1
imul edx, ecx, 0x18
mov byte [ebp + edx - 0x30], 0x61
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x30], 0x41
mov edx, 1
imul eax, edx, 0x16
mov byte [ebp + eax - 0x30], 0x50
mov ecx, 1
imul edx, ecx, 0x21
mov byte [ebp + edx - 0x30], 0x57
mov eax, 1
shl eax, 5
mov byte [ebp + eax - 0x30], 0x73
mov ecx, 1
imul edx, ecx, 0x1a
mov byte [ebp + edx - 0x30], 0x44
mov eax, 1
imul ecx, eax, 0x1b
mov byte [ebp + ecx - 0x30], 0x65
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x30], 0x6f
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x30], 0x72
mov eax, 1
imul ecx, eax, 0x14
mov byte [ebp + ecx - 0x30], 0x6e
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
imul edx, ecx, 0x19
mov byte [ebp + edx - 0x30], 0x79
mov eax, 1
imul ecx, eax, 0x1e
mov byte [ebp + ecx - 0x30], 0x63
mov edx, 1
imul eax, edx, 0x22
mov byte [ebp + eax - 0x30], 0
mov ecx, 1
imul edx, ecx, 0x1c
mov byte [ebp + edx - 0x30], 0x76
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x30], 0x61
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x30], 0x70
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x30], 0x44
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405036
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x405050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call fcn.00404820
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40519d
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x20], 0x64
mov edx, 1
imul eax, edx, 0x13
mov byte [ebp + eax - 0x20], 0
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x20], 0x6e
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x20], 0x45
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x20], 0x6b
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x20], 0x6b
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x20], 0x48
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x20], 0x57
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x68
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x20], 0x77
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x20], 0x55
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x20], 0x73
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x20], 0x69
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x20], 0x78
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x20], 0x6e
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405193
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4051b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
call fcn.00404820
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4052ae
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x1c], 0x73
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x1c], 0x67
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x1c], 0x61
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x1c], 0x73
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x1c], 0x74
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x1c], 0x73
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x1c], 0x57
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x1c], 0x50
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x6f
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x1c], 0x4d
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4052a4
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4052c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x18], 0x43
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x18], 0x47
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x18], 0x74
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x18], 0x6e
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x18], 0x4c
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
imul eax, edx, 0xe
mov byte [ebp + eax - 0x18], 0x57
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x18], 0x6d
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x64
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x18], 0x6e
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x18], 0x61
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x18], 0x6d
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x6f
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0x69
lea ecx, [ebp - 0x18]
push ecx
call fcn.00404900
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4053bb
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4053d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.00404a00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4054ce
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x18], 0x43
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x18], 0x69
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x18], 0x7a
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x18], 0x74
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x18], 0x55
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x18], 0x6f
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x18], 0x69
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x18], 0x61
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x18], 0x6e
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], 0x6e
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x18], 0x69
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x69
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x18], 0x6c
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4054c4
call dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esp, ebp
pop ebp
ret

Function at 0x4054e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 1
call fcn.00404a00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4055d2
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x1c], 0x69
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x1c], 0
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x1c], 0x61
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x1c], 0x7a
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x1c], 0x74
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x1c], 0x69
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x1c], 0x69
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x1c], 0x49
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x1c], 0x6e
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x1c], 0x6f
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x1c], 0x43
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x1c], 0x6c
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x1c], 0x65
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4055c8
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4055e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 1
call fcn.00404a00
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405716
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x20], 0x63
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x20], 0x61
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x20], 0x49
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x20], 0x73
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x20], 0x61
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x43
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x20], 0x6e
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x20], 0x74
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x20], 0x43
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x20], 0x72
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x20], 0x74
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x20], 0
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x20], 0x6e
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40570c
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x405720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
call fcn.00404820
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405809
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x18], 0x69
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x18], 0x46
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x18], 0x57
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], 0x64
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x18], 0x6f
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x18], 0x6e
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x77
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x57
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x18], 0x6e
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x18], 0x64
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x18], 0x69
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4057ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret