joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431d9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4e4014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x2e
pop eax
push 0x6e
mov word [ebp - 0x24], ax
mov esi, edx
pop eax
push 0x65
pop edx
push 0x32
mov word [ebp - 0x2e], ax
xor ebx, ebx
pop eax
push 0x6c
mov word [ebp - 0x26], ax
pop eax
push 0x64
pop ecx
push 0x72
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x2a], ax
pop eax
push 0x33
mov word [ebp - 0x30], ax
pop eax
mov word [ebp - 0x28], ax
push 0x4b
pop eax
mov word [ebp - 0x34], ax
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
mov word [ebp - 0x32], dx
push eax
mov word [ebp - 0x2c], dx
mov word [ebp - 0x22], cx
mov word [ebp - 0x12], 0x6c75
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xc], dl
mov word [ebp - 0x15], 0x6f4d
mov word [ebp - 0xe], 0x6c69
mov byte [ebp - 8], dl
mov word [ebp - 7], 0x57
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xf], 0x46
mov word [ebp - 0xa], 0x6d61
mov byte [ebp - 0xb], 0x4e
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x16], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x431e64
push 0x104
push esi
push ebx
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00430234
leave
ret
Function at 0x431f05
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x250
mov eax, 0x45e6a7
call fcn.00430a5a
mov esi, ecx
mov dword [ebp - 0x258], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x25c], esi
push 0x4ad448
mov dword [ebp - 0x254], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
push 0x208
lea eax, [ebp - 0x250]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x254], 1
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea edx, [ebp - 0x250]
call fcn.00432054
pop ecx
push 0x53
pop eax
push 0x69
mov word [ebp - 0x48], ax
pop eax
push 0x61
mov word [ebp - 0x3c], ax
pop eax
push 0x68
mov word [ebp - 0x40], ax
pop eax
push 0x6c
pop ecx
push 0x2e
mov word [ebp - 0x46], ax
pop eax
push 0x70
mov word [ebp - 0x3a], ax
pop eax
push 0x64
mov word [ebp - 0x3e], ax
pop eax
mov word [ebp - 0x38], ax
push 0x77
pop eax
mov word [ebp - 0x42], ax
xor eax, eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 0x44], cx
mov word [ebp - 0x36], cx
mov word [ebp - 0x34], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x43204c
push 0x65
pop ebx
lea eax, [ebp - 0x24]
mov byte [ebp - 0x19], bl
push eax
push edi
mov word [ebp - 0x18], 0x614e
mov dword [ebp - 0x24], 0x68746150
mov word [ebp - 0x1b], 0x6c69
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x14], 0x57
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x1c], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432045
lea ecx, [ebp - 0x250]
push ecx
call eax
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x78
pop eax
push 0x2e
mov word [ebp - 0x2c], ax
mov ecx, esi
pop eax
mov word [ebp - 0x30], ax
xor eax, eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x30]
push 0x4ad448
push eax
mov word [ebp - 0x2a], bx
mov word [ebp - 0x2e], bx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
call fcn.00430a04
ret
Function at 0x432054
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4e4014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x2e
pop eax
push 0x6e
mov word [ebp - 0x24], ax
mov esi, edx
pop eax
push 0x65
pop edx
push 0x32
mov word [ebp - 0x2e], ax
xor ebx, ebx
pop eax
push 0x6c
mov word [ebp - 0x26], ax
pop eax
push 0x64
pop ecx
push 0x72
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x2a], ax
pop eax
push 0x33
mov word [ebp - 0x30], ax
pop eax
mov word [ebp - 0x28], ax
push 0x4b
pop eax
mov word [ebp - 0x34], ax
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
mov word [ebp - 0x32], dx
push eax
mov word [ebp - 0x2c], dx
mov word [ebp - 0x22], cx
mov word [ebp - 0x12], 0x6c75
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xc], dl
mov word [ebp - 0x15], 0x6f4d
mov word [ebp - 0xe], 0x6c69
mov byte [ebp - 8], dl
mov word [ebp - 7], 0x57
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xf], 0x46
mov word [ebp - 0xa], 0x6d61
mov byte [ebp - 0xb], 0x4e
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x16], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43211c
push 0x104
push esi
push ebx
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00430234
leave
ret
Function at 0x43212c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x250
mov eax, 0x45e7f0
call fcn.00430a5a
mov esi, ecx
mov dword [ebp - 0x258], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x25c], esi
push 0x4ad448
mov dword [ebp - 0x254], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
push 0x208
lea eax, [ebp - 0x250]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x254], 1
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea edx, [ebp - 0x250]
call fcn.0043227b
pop ecx
push 0x53
pop eax
push 0x69
mov word [ebp - 0x48], ax
pop eax
push 0x61
mov word [ebp - 0x3c], ax
pop eax
push 0x68
mov word [ebp - 0x40], ax
pop eax
push 0x6c
pop ecx
push 0x2e
mov word [ebp - 0x46], ax
pop eax
push 0x70
mov word [ebp - 0x3a], ax
pop eax
push 0x64
mov word [ebp - 0x3e], ax
pop eax
mov word [ebp - 0x38], ax
push 0x77
pop eax
mov word [ebp - 0x42], ax
xor eax, eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 0x44], cx
mov word [ebp - 0x36], cx
mov word [ebp - 0x34], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x432273
push 0x65
pop ebx
lea eax, [ebp - 0x24]
mov byte [ebp - 0x19], bl
push eax
push edi
mov word [ebp - 0x18], 0x614e
mov dword [ebp - 0x24], 0x68746150
mov word [ebp - 0x1b], 0x6c69
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x14], 0x57
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x1c], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43226c
lea ecx, [ebp - 0x250]
push ecx
call eax
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x78
pop eax
push 0x2e
mov word [ebp - 0x2c], ax
mov ecx, esi
pop eax
mov word [ebp - 0x30], ax
xor eax, eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x30]
push 0x4ad448
push eax
mov word [ebp - 0x2a], bx
mov word [ebp - 0x2e], bx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
call fcn.00430a04
ret
Function at 0x43227b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4e4014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x2e
pop eax
push 0x6e
mov word [ebp - 0x24], ax
mov esi, edx
pop eax
push 0x65
pop edx
push 0x32
mov word [ebp - 0x2e], ax
xor ebx, ebx
pop eax
push 0x6c
mov word [ebp - 0x26], ax
pop eax
push 0x64
pop ecx
push 0x72
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x2a], ax
pop eax
push 0x33
mov word [ebp - 0x30], ax
pop eax
mov word [ebp - 0x28], ax
push 0x4b
pop eax
mov word [ebp - 0x34], ax
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
mov word [ebp - 0x32], dx
push eax
mov word [ebp - 0x2c], dx
mov word [ebp - 0x22], cx
mov word [ebp - 0x12], 0x6c75
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xc], dl
mov word [ebp - 0x15], 0x6f4d
mov word [ebp - 0xe], 0x6c69
mov byte [ebp - 8], dl
mov word [ebp - 7], 0x57
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xf], 0x46
mov word [ebp - 0xa], 0x6d61
mov byte [ebp - 0xb], 0x4e
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x16], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432343
push 0x104
push esi
push ebx
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00430234
leave
ret
Function at 0x432353
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x258
mov eax, 0x45ee2e
call fcn.00430a5a
mov esi, ecx
mov dword [ebp - 0x260], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x264], esi
push 0x4ad448
mov dword [ebp - 0x25c], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
push 0x208
lea eax, [ebp - 0x258]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x25c], 1
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea edx, [ebp - 0x258]
call fcn.004324ba
pop ecx
push 0x6c
pop ecx
push 0x70
pop eax
push 0x61
pop ebx
push 0x69
mov word [ebp - 0x46], ax
pop eax
push 0x77
mov word [ebp - 0x44], ax
pop eax
push 0x64
mov word [ebp - 0x4a], ax
pop eax
push 0x68
mov word [ebp - 0x40], ax
pop eax
push 0x2e
mov word [ebp - 0x4e], ax
pop eax
mov word [ebp - 0x42], ax
xor eax, eax
push 0x53
mov word [ebp - 0x3a], ax
pop eax
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x50]
push eax
mov word [ebp - 0x3e], cx
mov word [ebp - 0x48], bx
mov word [ebp - 0x4c], cx
mov word [ebp - 0x3c], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4324b2
lea eax, [ebp - 0x38]
mov byte [ebp - 0x37], bl
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edi
mov dword [ebp - 0x29], 0x57636570
mov dword [ebp - 0x33], 0x766f6d65
mov dword [ebp - 0x2e], 0x656c6946
mov word [ebp - 0x36], 0x6874
mov byte [ebp - 0x2a], 0x53
mov byte [ebp - 0x38], 0x50
mov byte [ebp - 0x34], 0x52
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x25], 0
call ebx
test eax, eax
je 0x432460
lea ecx, [ebp - 0x258]
push ecx
call eax
lea eax, [ebp - 0x24]
mov word [ebp - 0x20], 0x6946
push eax
push edi
mov dword [ebp - 0x1c], 0x656c6946
mov dword [ebp - 0x16], 0x57656d
mov word [ebp - 0x23], 0x7461
mov word [ebp - 0x1e], 0x646e
mov byte [ebp - 0x24], 0x50
mov word [ebp - 0x18], 0x614e
mov byte [ebp - 0x21], 0x68
call ebx
test eax, eax
je 0x4324ab
lea ecx, [ebp - 0x258]
push ecx
call eax
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
call fcn.00430a04
ret
Function at 0x4324ba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4e4014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x2e
pop eax
push 0x6e
mov word [ebp - 0x24], ax
mov esi, edx
pop eax
push 0x65
pop edx
push 0x32
mov word [ebp - 0x2e], ax
xor ebx, ebx
pop eax
push 0x6c
mov word [ebp - 0x26], ax
pop eax
push 0x64
pop ecx
push 0x72
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x2a], ax
pop eax
push 0x33
mov word [ebp - 0x30], ax
pop eax
mov word [ebp - 0x28], ax
push 0x4b
pop eax
mov word [ebp - 0x34], ax
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
mov word [ebp - 0x32], dx
push eax
mov word [ebp - 0x2c], dx
mov word [ebp - 0x22], cx
mov word [ebp - 0x12], 0x6c75
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xc], dl
mov word [ebp - 0x15], 0x6f4d
mov word [ebp - 0xe], 0x6c69
mov byte [ebp - 8], dl
mov word [ebp - 7], 0x57
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xf], 0x46
mov word [ebp - 0xa], 0x6d61
mov byte [ebp - 0xb], 0x4e
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x16], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432582
push 0x104
push esi
push ebx
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00430234
leave
ret
Function at 0x432592
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x250
mov eax, 0x45ee79
call fcn.00430a5a
mov esi, ecx
mov dword [ebp - 0x258], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x25c], esi
push 0x4ad448
mov dword [ebp - 0x254], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
push 0x208
lea eax, [ebp - 0x250]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x254], 1
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea edx, [ebp - 0x250]
call fcn.004324ba
pop ecx
push 0x53
pop eax
push 0x69
mov word [ebp - 0x48], ax
pop eax
push 0x61
mov word [ebp - 0x3c], ax
pop eax
push 0x68
mov word [ebp - 0x40], ax
pop eax
push 0x6c
pop ecx
push 0x2e
mov word [ebp - 0x46], ax
pop eax
push 0x70
mov word [ebp - 0x3a], ax
pop eax
push 0x64
mov word [ebp - 0x3e], ax
pop eax
mov word [ebp - 0x38], ax
push 0x77
pop eax
mov word [ebp - 0x42], ax
xor eax, eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 0x44], cx
mov word [ebp - 0x36], cx
mov word [ebp - 0x34], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4326d9
push 0x65
pop ebx
lea eax, [ebp - 0x24]
mov byte [ebp - 0x19], bl
push eax
push edi
mov word [ebp - 0x18], 0x614e
mov dword [ebp - 0x24], 0x68746150
mov word [ebp - 0x1b], 0x6c69
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x14], 0x57
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x1c], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4326d2
lea ecx, [ebp - 0x250]
push ecx
call eax
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x78
pop eax
push 0x2e
mov word [ebp - 0x2c], ax
mov ecx, esi
pop eax
mov word [ebp - 0x30], ax
xor eax, eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x30]
push 0x4ad448
push eax
mov word [ebp - 0x2a], bx
mov word [ebp - 0x2e], bx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
call fcn.00430a04
ret
Function at 0x432784
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x250
mov eax, 0x460ed1
call fcn.00430a5a
mov esi, ecx
mov dword [ebp - 0x258], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x25c], esi
push 0x4ad448
mov dword [ebp - 0x254], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
push 0x208
lea eax, [ebp - 0x250]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x254], 1
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea edx, [ebp - 0x250]
call fcn.004328d3
pop ecx
push 0x53
pop eax
push 0x69
mov word [ebp - 0x48], ax
pop eax
push 0x61
mov word [ebp - 0x3c], ax
pop eax
push 0x68
mov word [ebp - 0x40], ax
pop eax
push 0x6c
pop ecx
push 0x2e
mov word [ebp - 0x46], ax
pop eax
push 0x70
mov word [ebp - 0x3a], ax
pop eax
push 0x64
mov word [ebp - 0x3e], ax
pop eax
mov word [ebp - 0x38], ax
push 0x77
pop eax
mov word [ebp - 0x42], ax
xor eax, eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 0x44], cx
mov word [ebp - 0x36], cx
mov word [ebp - 0x34], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4328cb
push 0x65
pop ebx
lea eax, [ebp - 0x24]
mov byte [ebp - 0x19], bl
push eax
push edi
mov word [ebp - 0x18], 0x614e
mov dword [ebp - 0x24], 0x68746150
mov word [ebp - 0x1b], 0x6c69
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x14], 0x57
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x1c], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4328c4
lea ecx, [ebp - 0x250]
push ecx
call eax
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x78
pop eax
push 0x2e
mov word [ebp - 0x2c], ax
mov ecx, esi
pop eax
mov word [ebp - 0x30], ax
xor eax, eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x30]
push 0x4ad448
push eax
mov word [ebp - 0x2a], bx
mov word [ebp - 0x2e], bx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
call fcn.00430a04
ret
Function at 0x4328d3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4e4014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x2e
pop eax
push 0x6e
mov word [ebp - 0x24], ax
mov esi, edx
pop eax
push 0x65
pop edx
push 0x32
mov word [ebp - 0x2e], ax
xor ebx, ebx
pop eax
push 0x6c
mov word [ebp - 0x26], ax
pop eax
push 0x64
pop ecx
push 0x72
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x2a], ax
pop eax
push 0x33
mov word [ebp - 0x30], ax
pop eax
mov word [ebp - 0x28], ax
push 0x4b
pop eax
mov word [ebp - 0x34], ax
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
mov word [ebp - 0x32], dx
push eax
mov word [ebp - 0x2c], dx
mov word [ebp - 0x22], cx
mov word [ebp - 0x12], 0x6c75
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xc], dl
mov word [ebp - 0x15], 0x6f4d
mov word [ebp - 0xe], 0x6c69
mov byte [ebp - 8], dl
mov word [ebp - 7], 0x57
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xf], 0x46
mov word [ebp - 0xa], 0x6d61
mov byte [ebp - 0xb], 0x4e
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x16], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43299b
push 0x104
push esi
push ebx
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00430234
leave
ret
Function at 0x432c46
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x250
mov eax, 0x462639
call fcn.00430a5a
mov esi, ecx
mov dword [ebp - 0x258], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x25c], esi
push 0x4ad448
mov dword [ebp - 0x254], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
push 0x208
lea eax, [ebp - 0x250]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x254], 1
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea edx, [ebp - 0x250]
call fcn.00432d95
pop ecx
push 0x53
pop eax
push 0x69
mov word [ebp - 0x48], ax
pop eax
push 0x61
mov word [ebp - 0x3c], ax
pop eax
push 0x68
mov word [ebp - 0x40], ax
pop eax
push 0x6c
pop ecx
push 0x2e
mov word [ebp - 0x46], ax
pop eax
push 0x70
mov word [ebp - 0x3a], ax
pop eax
push 0x64
mov word [ebp - 0x3e], ax
pop eax
mov word [ebp - 0x38], ax
push 0x77
pop eax
mov word [ebp - 0x42], ax
xor eax, eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 0x44], cx
mov word [ebp - 0x36], cx
mov word [ebp - 0x34], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x432d8d
push 0x65
pop ebx
lea eax, [ebp - 0x24]
mov byte [ebp - 0x19], bl
push eax
push edi
mov word [ebp - 0x18], 0x614e
mov dword [ebp - 0x24], 0x68746150
mov word [ebp - 0x1b], 0x6c69
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x14], 0x57
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x1c], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432d86
lea ecx, [ebp - 0x250]
push ecx
call eax
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x78
pop eax
push 0x2e
mov word [ebp - 0x2c], ax
mov ecx, esi
pop eax
mov word [ebp - 0x30], ax
xor eax, eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x30]
push 0x4ad448
push eax
mov word [ebp - 0x2a], bx
mov word [ebp - 0x2e], bx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
call fcn.00430a04
ret
Function at 0x432d95
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4e4014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x2e
pop eax
push 0x6e
mov word [ebp - 0x24], ax
mov esi, edx
pop eax
push 0x65
pop edx
push 0x32
mov word [ebp - 0x2e], ax
xor ebx, ebx
pop eax
push 0x6c
mov word [ebp - 0x26], ax
pop eax
push 0x64
pop ecx
push 0x72
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x2a], ax
pop eax
push 0x33
mov word [ebp - 0x30], ax
pop eax
mov word [ebp - 0x28], ax
push 0x4b
pop eax
mov word [ebp - 0x34], ax
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
mov word [ebp - 0x32], dx
push eax
mov word [ebp - 0x2c], dx
mov word [ebp - 0x22], cx
mov word [ebp - 0x12], 0x6c75
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xc], dl
mov word [ebp - 0x15], 0x6f4d
mov word [ebp - 0xe], 0x6c69
mov byte [ebp - 8], dl
mov word [ebp - 7], 0x57
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xf], 0x46
mov word [ebp - 0xa], 0x6d61
mov byte [ebp - 0xb], 0x4e
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x16], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432e5d
push 0x104
push esi
push ebx
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00430234
leave
ret
Function at 0x432e6d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x250
mov eax, 0x46503b
call fcn.00430a5a
mov esi, ecx
mov dword [ebp - 0x258], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x25c], esi
push 0x4ad448
mov dword [ebp - 0x254], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
push 0x208
lea eax, [ebp - 0x250]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x254], 1
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea edx, [ebp - 0x250]
call fcn.00432fbc
pop ecx
push 0x53
pop eax
push 0x69
mov word [ebp - 0x48], ax
pop eax
push 0x61
mov word [ebp - 0x3c], ax
pop eax
push 0x68
mov word [ebp - 0x40], ax
pop eax
push 0x6c
pop ecx
push 0x2e
mov word [ebp - 0x46], ax
pop eax
push 0x70
mov word [ebp - 0x3a], ax
pop eax
push 0x64
mov word [ebp - 0x3e], ax
pop eax
mov word [ebp - 0x38], ax
push 0x77
pop eax
mov word [ebp - 0x42], ax
xor eax, eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 0x44], cx
mov word [ebp - 0x36], cx
mov word [ebp - 0x34], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x432fb4
push 0x65
pop ebx
lea eax, [ebp - 0x24]
mov byte [ebp - 0x19], bl
push eax
push edi
mov word [ebp - 0x18], 0x614e
mov dword [ebp - 0x24], 0x68746150
mov word [ebp - 0x1b], 0x6c69
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x14], 0x57
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x1c], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x432fad
lea ecx, [ebp - 0x250]
push ecx
call eax
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x78
pop eax
push 0x2e
mov word [ebp - 0x2c], ax
mov ecx, esi
pop eax
mov word [ebp - 0x30], ax
xor eax, eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x30]
push 0x4ad448
push eax
mov word [ebp - 0x2a], bx
mov word [ebp - 0x2e], bx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
call fcn.00430a04
ret