joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f2fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00409604
mov edi, eax
push edi
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x41f366
test ah, 4
je 0x41f35f
test bl, bl
jne 0x41f324
mov al, 1
jmp 0x41f38d
test al, 0x10
je 0x41f32c
xor eax, eax
jmp 0x41f38d
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x41f350
push eax
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x41f38d
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x41f38d
test al, 0x10
sete al
jmp 0x41f38d
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x41f387
cmp ebx, 3
je 0x41f387
cmp ebx, 0x7b
je 0x41f387
mov eax, esi
call fcn.0041f2bc
test al, al
jne 0x41f38b
xor eax, eax
jmp 0x41f38d
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x41f394
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.00409604
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x41f43b
test esi, 0x400
jne 0x41f3d0
test esi, 0x10
setne bl
jmp 0x41f45f
cmp byte [esp], 0
je 0x41f404
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x41f45f
push eax
call sub.KERNEL32.DLL_CloseHandle
test esi, 0x10
setne bl
jmp 0x41f45f
test esi, 0x10
je 0x41f410
mov bl, 1
jmp 0x41f45f
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x41f437
push eax
call sub.KERNEL32.DLL_CloseHandle
xor ebx, ebx
jmp 0x41f45f
mov bl, 1
jmp 0x41f45f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x41f459
cmp eax, 3
je 0x41f459
cmp eax, 0x7b
je 0x41f459
cmp eax, 0x35
je 0x41f459
cmp eax, 0x15
jne 0x41f45d
xor ebx, ebx
jmp 0x41f45f
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4230e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x42311d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00408c6c
jmp 0x423126
mov eax, ebx
mov edx, esi
call fcn.00408ec4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x423130
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x423152
movzx eax, word [esp]
jmp 0x423154
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x423e3c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x423f61
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00423c44
mov esi, eax
mov eax, dword [0x57914c]
cmp byte [eax], 0
je 0x423f09
mov eax, dword [0x578fc8]
call fcn.00406d60
call fcn.004064d8
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x423e0c]
call fcn.0040a988
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x423f7c
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x423f45
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x578f8c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x57cc48]
call fcn.0040ab6c
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423f68
lea eax, [ebp - 4]
mov edx, dword [0x423e0c]
call fcn.0040aaac
ret

Function at 0x425758
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00408fb4
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c45c
mov edi, eax
cmp edi, 0x104
jbe 0x4256ff
mov eax, edi
add eax, eax
call fcn.00406384
mov esi, eax
jmp 0x425701
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c45c
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42573c
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x425726
mov eax, esp
cmp esi, eax
je 0x425749
mov eax, esi
call fcn.004063a0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x425784
cmp bl, 0
je 0x425780
cmp bl, 0x41
jl 0x42577b
cmp bl, 0x5a
jg 0x42577b
or bl, 0x20
xor al, bl
inc esi
jmp 0x42575f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4256c0

Function at 0x425fe0
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.004096a8
add esp, 0x800
pop ebx
ret
Function at 0x4cedbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
xor edx, edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cee5f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.00406dc4
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], 0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.004066e4
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.0041f504
mov eax, dword [ebp - 0x58]
call fcn.00409604
push eax
push 0
push 0x30
push 0
push 0
push 0
mov eax, ebx
lea edx, [ebp - 0x60]
call fcn.004ceb5c
mov eax, dword [ebp - 0x60]
call fcn.00409604
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cee66
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.00408b44
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x403020
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, dword [0x4c6f1c]
mov ecx, dword [0x4c3e28]
sub esp, 0xc2c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403113
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x4c6f1c], 0x959
jne 0x4030f9
push 0
push 0
call esi
push 0
lea eax, [esp + 0x43c]
push eax
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0x402b60
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov eax, dword [esp + 0x14]
push eax
call fcn.00402e60
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403060
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret
Function at 0x405e40
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45a0f8]
jne 0x405e4a
repz ret
jmp fcn.0040a412

Function at 0x40a135
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407ebb
and dword [ebp - 4], 0
cmp dword [0x45c994], 0
mov ebx, eax
jne 0x40a1e6
push 0x401a3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a297
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401a30
push edi
call esi
test eax, eax
je 0x40a297
push eax
call fcn.00407e49
mov dword [esp], 0x401a20
push edi
mov dword [0x45c994], eax
call esi
push eax
call fcn.00407e49
mov dword [esp], 0x401a0c
push edi
mov dword [0x45c998], eax
call esi
push eax
call fcn.00407e49
mov dword [esp], 0x4019f0
push edi
mov dword [0x45c99c], eax
call esi
push eax
call fcn.00407e49
pop ecx
mov dword [0x45c9a4], eax
test eax, eax
je 0x40a1e6
push 0x4019d8
push edi
call esi
push eax
call fcn.00407e49
pop ecx
mov dword [0x45c9a0], eax
mov eax, dword [0x45c9a0]
cmp eax, ebx
je 0x40a23e
cmp dword [0x45c9a4], ebx
je 0x40a23e
push eax
call fcn.00407ec4
push dword [0x45c9a4]
mov esi, eax
call fcn.00407ec4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a23e
test edi, edi
je 0x40a23e
call esi
test eax, eax
je 0x40a235
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a235
test byte [ebp - 0xc], 1
jne 0x40a23e
or dword [ebp + 0x10], 0x200000
jmp 0x40a277
mov eax, dword [0x45c998]
cmp eax, ebx
je 0x40a277
push eax
call fcn.00407ec4
pop ecx
test eax, eax
je 0x40a277
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a277
mov eax, dword [0x45c99c]
cmp eax, ebx
je 0x40a277
push eax
call fcn.00407ec4
pop ecx
test eax, eax
je 0x40a277
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45c994]
call fcn.00407ec4
pop ecx
test eax, eax
je 0x40a297
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a299
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403a7d
Capabilities:
Allocate or change rwx memory
Read .ini file

Disassembly:
mov eax, 0x447dc3
call fcn.00447cd0
sub esp, 0x178
push ebx
push esi
mov eax, 0xb2d3b
add dword [0x487314], eax
xor ebx, ebx
cmp dword [0x487314], 0x20a
jne 0x403b10
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.USER32.dll_ChildWindowFromPoint]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x402c08
push ebx
push 0x402c2c
push 0x402c54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call fcn.00403030
lea eax, [ebp - 0x3c]
call fcn.00403d4d
push ebx
mov dword [ebp - 4], ebx
call fcn.00404be2
push ebx
push ebx
push ebx
call fcn.004051dd
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea edi, [ebp - 0x3c]
call fcn.00403d72
pop edi
xor eax, eax
cmp eax, 0xf027935
jg 0x403b21
inc eax
cmp eax, 0x736251e2
jl 0x403b12
push 0x45ab08
mov byte [0x45ab0d], 0x6c
mov byte [0x45ab0f], 0x32
mov byte [0x45ab10], 0x2e
mov byte [0x45ab0b], 0x6e
mov byte [0x45ab0c], 0x65
mov byte [0x45ab11], 0x64
mov byte [0x45ab0e], 0x33
mov byte [0x45ab12], 0x6c
mov byte [0x45ab13], 0x6c
mov byte [0x45ab14], bl
mov byte [0x45ab08], 0x6b
mov byte [0x45ab09], 0x65
mov byte [0x45ab0a], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x487314]
mov dword [0x487284], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push dword [0x487314]
mov dword [0x487280], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x45503c]
xor esi, esi
mov dword [0x4873ec], eax
cmp dword [0x487314], ebx
jbe 0x403c12
mov eax, dword [0x4873ec]
mov dword [ebp - 0x14], eax
mov eax, 0xb2d3b
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov al, byte [eax + esi]
mov ecx, dword [0x487280]
mov byte [ecx + esi], al
cmp dword [0x487314], 0x44
jne 0x403c09
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalCompact]
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
inc esi
cmp esi, dword [0x487314]
jb 0x403bc4
call fcn.004039c0
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
cmp esi, 0x770e
jne 0x403c36
call fcn.00403a57
inc esi
cmp esi, 0x286c535
jl 0x403c19
push 0x7b
pop esi
cmp dword [0x487314], 0xd
jne 0x403c77
push 0x30
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], ebx
call fcn.00405d80
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
push 0x402c98
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec esi
jne 0x403c42
call fcn.00403a71
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4059bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x454168]
jne 0x4059c5
repz ret
jmp fcn.0040c76c
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43d004]
jne 0x40100a
repz ret
jmp fcn.004018f4

Function at 0x4067a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040261d
and dword [ebp - 4], 0
cmp dword [0x43ecdc], 0
mov ebx, eax
jne 0x406859
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40690a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40690a
push eax
call fcn.004025ab
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43ecdc], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43ece0], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43ece4], eax
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x43ecec], eax
test eax, eax
je 0x406859
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x43ece8], eax
mov eax, dword [0x43ece8]
cmp eax, ebx
je 0x4068b1
cmp dword [0x43ecec], ebx
je 0x4068b1
push eax
call fcn.00402626
push dword [0x43ecec]
mov esi, eax
call fcn.00402626
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4068b1
test edi, edi
je 0x4068b1
call esi
test eax, eax
je 0x4068a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4068a8
test byte [ebp - 0xc], 1
jne 0x4068b1
or dword [ebp + 0x10], 0x200000
jmp 0x4068ea
mov eax, dword [0x43ece0]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4068ea
mov eax, dword [0x43ece4]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ecdc]
call fcn.00402626
pop ecx
test eax, eax
je 0x40690a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40690c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4398e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp edi, 0x19f
jne 0x4398f9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
test edi, edi
jle 0x439941
nop
lea ecx, [esp + 8]
mov dword [esp], 5
mov dword [esp + 8], 0
call fcn.004398d0
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp], eax
sub dword [esp], 0x46
movsx eax, byte [edx + esi]
mov dword [esp + 4], eax
mov eax, dword [esp]
xor dword [esp + 4], eax
mov cl, byte [esp + 4]
mov byte [edx + esi], cl
inc edx
cmp edx, edi
jl 0x439900
cmp edi, 0x2d
jne 0x43995a
mov dword [0x2b3cef8], 0xa62e7790
mov dword [0x2b3cefc], 0xffffffff
add esp, 0xc
ret
Function at 0x402f33
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
pop ebx
jmp 0x402ed5
push edx
push edx
add esp, 4
call 0x402ee9
add byte [ebx], dh
cmp dword [esp + esi + 0x37], ecx
inc esi
dec eax
inc ebx
cmp al, byte [ebx + 0x515a04c4]
push edi
add esp, 4
or ecx, 0x10dd1
and ecx, 0x124dd
pop ecx
push ebx
or ebx, 0x13762
pop ebx
mov dword [ebp - 0xad8], 0
push edx
xor edx, 0xd918
or edx, 0x140f9
jmp 0x402f24
call 0x402f33
add byte [0x3e4d3d3e], dh
dec edx
push eax
inc edi
inc eax
add esp, 4
pop edx
push ecx
push ecx
add esp, 4
xor ecx, 0x12bdf
pop ecx
mov byte [ebp - 0x898], 0x45
mov byte [ebp - 0x897], 0x78
mov byte [ebp - 0x896], 0x69
mov byte [ebp - 0x895], 0x74
mov byte [ebp - 0x894], 0x50
mov byte [ebp - 0x893], 0x72
mov byte [ebp - 0x892], 0x6f
mov byte [ebp - 0x891], 0x63
mov byte [ebp - 0x890], 0x65
mov byte [ebp - 0x88f], 0x73
mov byte [ebp - 0x88e], 0x73
mov byte [ebp - 0x88d], 0
push esi
add esi, 0x12e6d
jmp 0x402fa5
sub esi, 0x11cf3
or esi, 0x7c88
pop esi
push ecx
jmp 0x402fb9
call fcn.00402fc5
add byte [esi + 0x35], al
inc ebx
inc ecx
inc ecx
dec edx
Function at 0x403540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
idiv edi
push dword [edx - 0x3a]
test dword [esi - 9], edx
invalid
Function at 0x403739
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push eax
add esp, 4
xor ebx, 0x12912
and ebx, 0x11bf2
or ebx, 0x2ab2
jmp 0x403664
pop ebx
lea ecx, [ebp - 0x172c]
mov dword [ebp - 0xcdc], ecx
mov edx, dword [ebp - 0x500]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcd8], eax
xor ecx, ecx
mov word [ebp - 0x1c4], cx
xor edx, edx
mov word [ebp - 0x24], dx
push ebx
push edx
add esp, 4
sub ebx, 0xb7af
jmp 0x40369f
call 0x4036ab
add byte [ebp + 0x48], cl
dec ebp
dec edi
dec eax
add esp, 4
call 0x4036bd
add byte [esi + 0x44], al
dec esp
inc edx
dec eax
dec ebx
dec esi
xor eax, 0x5b04c483
mov eax, dword [ebp - 0xcd8]
mov cx, word [eax]
mov word [ebp - 0x109e], cx
mov edx, dword [ebp - 0xcd8]
add edx, 2
mov dword [ebp - 0xcd8], edx
mov ax, word [ebp - 0x109e]
mov word [ebp - 0x1c4], ax
mov ecx, dword [ebp - 0xcdc]
mov dx, word [ecx]
mov word [ebp - 0x10a0], dx
mov eax, dword [ebp - 0xcdc]
add eax, 2
mov dword [ebp - 0xcdc], eax
mov cx, word [ebp - 0x10a0]
mov word [ebp - 0x24], cx
push esi
push ebx
add esp, 4
or esi, 0x13146
or esi, 0x270e
pop esi
push esi
call 0x403739
add byte [ecx], bh
inc esi
aas
inc esp
xor eax, 0x833c3540
les eax, [ebx + ebp*8]
add eax, 0x41453348
cmp eax, dword [ecx + 0xa828e6]
add byte [esi + 0xf], bl
mov bh, 0x55
push ebp
fadd qword [ebp + 0xf1575d2]
mov bh, 0x85
cmp al, 0xfe
invalid

Function at 0x40381a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push edi
push edi
add esp, 4
sub edi, 0x3055
pop edi
push edx
push edi
add esp, 4
and edx, 0x1205e
or edx, 0x9cab
pop edx
invalid
lea eax, [eax]
sti

Function at 0x404098
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc edx
xor esi, dword [ebx]
dec ecx
xor eax, 0x4c4834f
or edx, 0xe7b2
pop edx
mov edx, dword [ebp - 0x2bc]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x33c], eax
push edi
sub edi, 0x136e2
or edi, 0x992
xor edi, 0x7349
pop edi
push eax
push eax
add esp, 4
or eax, 0x15f4f
or eax, 0x5dd5
jmp 0x4040e2
and eax, 0xcf53
pop eax
mov dword [ebp - 0x7a0], 0
mov ecx, dword [ebp - 0x33c]
mov dword [ebp - 0x1624], ecx
cmp dword [ebp - 0x1624], 0
jne 0x404119
mov edx, dword [ebp - 0x7a0]
mov dword [ebp - 0x508], edx
jmp 0x40440a
mov eax, dword [ebp - 0x1624]
mov ecx, dword [ebp - 0x33c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1628], ecx
jne 0x404141
mov edx, dword [ebp - 0x7a0]
mov dword [ebp - 0x508], edx
jmp 0x40440a
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1628]
mov eax, dword [edx + ecx + 0x78]
invalid
Function at 0x40409e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc edx
xor esi, dword [ebx]
dec ecx
xor eax, 0x4c4834f
or edx, 0xe7b2
pop edx
mov edx, dword [ebp - 0x2bc]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x33c], eax
push edi
sub edi, 0x136e2
or edi, 0x992
xor edi, 0x7349
pop edi
push eax
push eax
add esp, 4
or eax, 0x15f4f
or eax, 0x5dd5
jmp 0x4040e2
and eax, 0xcf53
pop eax
mov dword [ebp - 0x7a0], 0
mov ecx, dword [ebp - 0x33c]
mov dword [ebp - 0x1624], ecx
cmp dword [ebp - 0x1624], 0
jne 0x404119
mov edx, dword [ebp - 0x7a0]
mov dword [ebp - 0x508], edx
jmp 0x40440a
mov eax, dword [ebp - 0x1624]
mov ecx, dword [ebp - 0x33c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1628], ecx
jne 0x404141
mov edx, dword [ebp - 0x7a0]
mov dword [ebp - 0x508], edx
jmp 0x40440a
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1628]
mov eax, dword [edx + ecx + 0x78]
invalid

Function at 0x404e55
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x3662ea], al
add byte [edx - 0x7d], bl
mov ebp, 0xffffe9c4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x7a4], 0
jmp 0x404dab
push eax
push eax
add esp, 4
xor eax, 0x516f
pop eax
push ebx
xor ebx, 0x254a
pop ebx
push ebx
jmp 0x404dc7
or ebx, 0x13d2f
call 0x404dd9
add byte [esp + eax*2], bh
dec eax
cmp dh, byte [esi]
push eax
add esp, 4
pop ebx
cmp dword [ebp - 0x7a4], 0
jne 0x404e27
push esi
jmp 0x404df0
call 0x404dff
add byte [edx], dh
dec ebx
inc esi
xor dh, byte [edx]
cmp al, 0x42
inc esi
xor al, byte [ebx + 0x7e804c4]
add byte [eax], al
add byte [eax], al
dec edi
inc edi
inc edi
inc ecx
cmp dword ds:[ebx - 0x97efb3c], eax
sbb bl, byte [ecx]
add byte [esi - 0x39], bl
test dword [esi*8 + 0xffff], ebp
add byte [eax], al
jmp 0x40594e
push ecx
xor ecx, 0xaa92
sub ecx, 0x1774f
pop ecx
push edx
push eax
add esp, 4
or edx, 0x438c
and edx, 0x14f8
call 0x404e55
add byte [edx + esi + 0x33], al
inc esi
cmp byte [ebx + 0x3a], al
inc ebp
inc ecx
add esp, 4
pop edx
mov eax, dword [ebp - 0x7a4]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x37c], ecx
mov dword [ebp - 0x7b4], 0
mov edx, dword [ebp - 0x37c]
mov dword [ebp - 0x1648], edx
cmp dword [ebp - 0x1648], 0
jne 0x404e98
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x3d0], eax
jmp 0x405189
mov ecx, dword [ebp - 0x1648]
mov edx, dword [ebp - 0x37c]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x164c], edx
jne 0x404ec0
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x3d0], eax
jmp 0x405189
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x164c]
mov ecx, dword [eax + edx + 0x78]
invalid
invalid

Function at 0x40527c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jecxz 0x4052d7
jp 0x405280
add byte [ecx + 0xe30ceb], al
add byte [ebx + 0x52], bl
add byte [eax], al