joyce8/EMBER2024-capa huggingface dataset:
Function at 0x523200
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push ebp
call fcn.00518b30
add esp, 4
test eax, eax
js 0x5233e1
push ebx
push esi
push edi
mov edi, dword [ebp + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x523271
lea esi, [ebp + 8]
lea esi, [esi + edi*4]
lea eax, [ebp + 8]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x523231
mov edi, 1
cmp dword [ebp + 0xf0], edi
jle 0x5233dc
lea esi, [ebp + 2]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x53f4a0]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53eca0]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53f0a0]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53e8a0]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x53f4a0]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53eca0]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53f0a0]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53e8a0]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x53f4a0]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53eca0]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53f0a0]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53e8a0]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x53f4a0]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53eca0]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53f0a0]
movzx eax, dl
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x53e8a0]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebp + 0xf0]
jl 0x523285
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x524b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52885f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
push 3
mov dword [ebp - 4], 0
xor bl, bl
call fcn.0049925d
call fcn.0049926e
push dword [ebp + 8]
mov edi, eax
push 0x2712
push edi
call fcn.0049e4e6
push 0x529720
push 0x4e2b
push edi
call fcn.0049e4e6
push esi
push 0x2711
push edi
call fcn.0049e4e6
lea eax, [ebp - 0x20]
mov dword [ebp - 0x13], 0x302e312f
push eax
push 0x2722
push edi
mov dword [ebp - 0x20], 0x6362696c
mov dword [ebp - 0x1c], 0x2d6c7275
mov dword [ebp - 0x17], 0x746e6567
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0xf], bl
call fcn.0049e4e6
push edi
call fcn.004992b7
test eax, eax
movzx ebx, bl
mov ecx, 1
push edi
cmove ebx, ecx
call fcn.004992c8
mov dword [ebp - 4], 0xffffffff
add esp, 0x3c
mov edx, dword [ebp + 8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x524c4e
mov eax, dword [edx]
push edx
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x524c4a
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, eax
call esi
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x524c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528879
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push esi
mov ebx, ecx
mov esi, edx
push edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
mov edi, dword [ebp + 0x10]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
mov byte [ebx], 0
mov word [ebp - 0x12], 0x6b63
mov word [ebp - 0xf], 0x74
mov word [ebp - 0x14], 0x6954
mov byte [ebp - 0x10], 0x65
call fcn.0041fa80
push ecx
mov ecx, esp
mov byte [ebp - 4], 1
push 0x5675e0
call fcn.0041fa80
mov edx, edi
mov byte [ebp - 4], 0
mov ecx, 0x80000002
call fcn.0051a2b0
mov eax, dword [edi]
add esp, 8
cmp dword [eax - 0xc], 0
setne al
mov byte [esi], al
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x524dfd
push 0x104
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.00443110
add esp, 8
lea edx, [ebp - 0x130]
call fcn.0052c6c0
add esp, 4
lea ecx, [ebp - 0x130]
call fcn.00522d20
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x642e7474
lea ecx, [ebp - 0x130]
mov word [ebp - 0x17], 0x74
mov byte [ebp - 0x18], 0x61
call fcn.0051ac10
sub esp, 8
lea ecx, [ebp - 0x130]
mov edx, 0x80000000
push 3
sub esp, 8
call fcn.00522db0
add esp, 0x14
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
je 0x524dfd
mov ecx, eax
mov dword [ebp - 0x20], 0
call fcn.0051dec0
mov esi, eax
lea ecx, [esi + 1]
push ecx
call fcn.00426d28
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x20]
push 0
push eax
push esi
mov byte [ebx + esi], 0
mov esi, dword [ebp + 0x10]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x524dea
push ebx
lea eax, [ebp + 0x10]
mov word [ebp + 0x11], 0x73
push eax
push edi
mov byte [ebp + 0x10], 0x25
call fcn.00419930
mov eax, dword [edi]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
setne al
mov byte [ecx], al
push ebx
call fcn.004266a3
add esp, 4
mov ecx, esi
call fcn.0052e1f0
mov ebx, dword [ebp - 0x24]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x524e3a
push ecx
mov ecx, dword [ebp + 8]
mov esi, esp
mov dword [ebp + 0xc], esi
lea ecx, [ecx - 0x10]
call fcn.0041fb60
add eax, 0x10
mov dword [esi], eax
mov ecx, dword [edi]
call fcn.0051ce40
add esp, 4
test al, al
je 0x524e36
cmp byte [ebp + 0x14], 0
jne 0x524e36
mov eax, 1
jmp 0x524e38
xor eax, eax
mov byte [ebx], al
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x524e86
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x524e82
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x528070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
call fcn.0052a6b0
mov esi, eax
test esi, esi
je 0x5280be
lea eax, [esp + 8]
mov dword [esp + 8], 0x61546f43
push eax
push esi
mov dword [esp + 0x15], 0x6d654d6b
mov dword [esp + 0x1a], 0x656572
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x19], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5280b7
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x528210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00514af0
mov edi, eax
test edi, edi
je 0x528283
lea eax, [esp + 0x10]
mov dword [esp + 0x1e], 0x42746e65
push eax
push edi
mov word [esp + 0x1d], 0x4565
mov dword [esp + 0x20], 0x6f726976
mov word [esp + 0x24], 0x6d6e
mov dword [esp + 0x2a], 0x6b636f6c
mov dword [esp + 0x19], 0x74616572
mov byte [esp + 0x2e], 0
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x1f], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52827c
push esi
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x528290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00514af0
mov edi, eax
test edi, edi
je 0x528300
lea eax, [esp + 0xc]
mov word [esp + 0x21], 0x6b63
push eax
push edi
mov dword [esp + 0x24], 0x6c42746e
mov dword [esp + 0x16], 0x6f727473
mov word [esp + 0x14], 0x6544
mov byte [esp + 0x2b], 0
mov dword [esp + 0x20], 0x656d6e6f
mov dword [esp + 0x1c], 0x7269766e
mov byte [esp + 0x28], 0x6f
mov word [esp + 0x1a], 0x4579
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5282f9
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x528310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x528384
lea eax, [esp + 0xc]
mov dword [esp + 0x12], 0x76697250
push eax
push edi
mov dword [esp + 0x14], 0x6b6f6f4c
mov word [esp + 0x24], 0x6c61
mov word [esp + 0x27], 0x4165
mov dword [esp + 0x20], 0x56656765
mov word [esp + 0x18], 0x7075
mov byte [esp + 0x29], 0
mov byte [esp + 0x26], 0x75
mov word [esp + 0x1e], 0x6c69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52837d
push dword [esp + 0x28]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x5297e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x258
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov byte [esp + 0x17], 0
test ebp, ebp
je 0x529a14
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 0
call fcn.00401ec0
mov edi, eax
mov dword [esp + 0x40], pe_nt_image_headers32
call fcn.0051dcd0
mov ebx, eax
cmp ebx, 0xffffffff
je 0x529a08
lea edx, [esp + 0x40]
mov ecx, ebx
call fcn.0051abb0
cmp eax, 1
jne 0x529a01
nop word [eax + eax]
lea eax, [esp + 0x64]
mov word [esp + 0x23], 0x6f6c
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x2d], 0x657865
push eax
mov word [esp + 0x28], 0x7865
mov byte [esp + 0x2a], 0x70
mov dword [esp + 0x2d], 0x2e726572
call fcn.0046735d
add esp, 8
test eax, eax
jne 0x52991a
push dword [esp + 0x48]
call fcn.005280d0
mov esi, eax
add esp, 4
test esi, esi
je 0x52991a
lea eax, [esp + 0x18]
mov edx, 8
push eax
mov ecx, esi
call fcn.0052fc70
add esp, 4
test eax, eax
je 0x529913
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x3c]
mov edx, 0xc
push eax
call fcn.005166c0
add esp, 0xc
test eax, eax
je 0x5298e0
cmp edi, dword [esp + 0x34]
je 0x529941
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x5298f5
call fcn.0052e1f0
mov dword [esp + 0x18], 0
mov ecx, esi
call fcn.0052e1f0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x52991a
call fcn.0052e1f0
mov dword [esp + 0x18], 0
jmp 0x52991a
mov ecx, esi
call fcn.0052e1f0
lea edx, [esp + 0x40]
mov ecx, ebx
call fcn.00521750
cmp eax, 1
je 0x529850
mov ecx, ebx
call fcn.0052e1f0
mov al, byte [esp + 0x17]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [esp + 0x16c]
mov dword [esp + 0x40], 0
push 0
push eax
call fcn.00443110
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x48]
add esp, 0xc
mov edx, 1
push eax
lea eax, [esp + 0x16c]
push 0x100
push eax
call fcn.005166c0
add esp, 0xc
test eax, eax
je 0x5299e5
mov ecx, dword [esp + 0x168]
lea edx, [esp + 0x38]
call fcn.0052a830
test eax, eax
je 0x5299e5
mov edx, dword [esp + 0x38]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5299a4
sub ecx, edi
cmp ecx, 0x104
jae 0x5299de
push edx
lea eax, [esp + 0x20]
mov word [esp + 0x21], 0x73
push eax
push 0x104
push ebp
mov byte [esp + 0x2c], 0x25
call fcn.0041f2e0
mov edx, dword [esp + 0x48]
add esp, 0x10
mov byte [esp + 0x17], 1
mov ecx, edx
call fcn.00516760
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x5299fa
call fcn.0052e1f0
mov dword [esp + 0x18], 0
mov ecx, esi
call fcn.0052e1f0
mov ecx, ebx
call fcn.0052e1f0
mov al, byte [esp + 0x17]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x529b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e89f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x14], ecx
call fcn.00420480
mov ecx, eax
test ecx, ecx
jne 0x529b58
push 0x80004005
call fcn.00420020
mov eax, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x529b6a
lock inc dword [ecx + 0x14]
lea esi, [ecx + 8]
jmp 0x529b6f
call dword [eax + 0xc]
mov esi, eax
lea ecx, [esi + 0x10]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
call fcn.0052e050
push ecx
test eax, eax
mov word [ebp - 0x33], 0x6f6f
push edi
push ecx
setne bh
mov word [ebp - 0x2a], 0x6d6f
lea eax, [ebp - 0x34]
mov word [ebp - 0x2d], 0x6843
mov ecx, esp
mov word [ebp - 0x28], 0x65
xor bl, bl
mov word [ebp - 0x30], 0x656c
push eax
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x31], 0x67
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2b], 0x72
mov word [ebp - 0x24], 0x6843
mov dword [ebp - 0x21], 0x656d6f
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0xd], bl
call fcn.0041fa80
mov dl, bl
mov cl, bl
call fcn.00520a50
mov bl, al
add esp, 0xc
test bl, bl
jne 0x529cbb
push ecx
push edi
push ecx
mov byte [ebp - 0xd], al
mov ecx, esp
lea eax, [ebp - 0x34]
mov bl, 1
push eax
call fcn.0041fa80
mov cl, byte [ebp - 0xd]
mov dl, bl
call fcn.00520a50
mov bl, al
add esp, 0xc
test bl, bl
jne 0x529cbb
test bh, bh
je 0x529c41
push ecx
push edi
push ecx
lea eax, [ebp - 0x34]
mov byte [ebp - 0xd], 1
mov ecx, esp
push eax
call fcn.0041fa80
mov cl, byte [ebp - 0xd]
mov dl, bl
call fcn.00520a50
mov bl, al
add esp, 0xc
test bl, bl
jne 0x529cbb
push ecx
push edi
push ecx
lea eax, [ebp - 0x24]
mov ecx, esp
xor bl, bl
push eax
mov byte [ebp - 0xd], bl
call fcn.0041fa80
mov dl, bl
mov cl, bl
call fcn.00520a50
mov bl, al
add esp, 0xc
test bl, bl
jne 0x529cbb
push ecx
push edi
push ecx
mov byte [ebp - 0xd], al
mov ecx, esp
lea eax, [ebp - 0x24]
mov bl, 1
push eax
call fcn.0041fa80
mov cl, byte [ebp - 0xd]
mov dl, bl
call fcn.00520a50
mov bl, al
add esp, 0xc
test bl, bl
jne 0x529cbb
test bh, bh
je 0x529cb2
push ecx
push edi
push ecx
lea eax, [ebp - 0x24]
mov ecx, esp
push eax
mov bh, 1
call fcn.0041fa80
mov dl, bl
mov cl, bh
call fcn.00520a50
mov bl, al
add esp, 0xc
test bl, bl
jne 0x529cbb
mov ecx, edi
call fcn.004026d0
mov bl, al
mov eax, dword [ebp - 0x14]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov byte [eax], 0
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x529d07
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x529d05
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edx
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x529d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
mov word [esp + 0xc], 0x534e
mov dword [esp + 0x1d], 0x29616c
mov dword [esp + 0x18], 0x697a6f4d
mov word [esp + 0xf], 0x5f53
mov dword [esp + 0x13], 0x20637465
mov word [esp + 0x11], 0x6e49
mov byte [esp + 0x17], 0x28
mov byte [esp + 0xe], 0x49
mov byte [esp + 0x1c], 0x6c
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp + 8], 0
jne 0x529d9c
xor ecx, ecx
lea eax, [esp + 0xc]
push ecx
push eax
mov ecx, esi
call fcn.00408e50
mov eax, esi
pop esi
add esp, 0x20
ret
lea ecx, [esp + 0xc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x529da3
sub ecx, edx
lea eax, [esp + 0xc]
push ecx
push eax
mov ecx, esi
call fcn.00408e50
mov eax, esi
pop esi
add esp, 0x20
ret
Function at 0x52a570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
mov esi, 1
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x52a5e4
lea eax, [esp + 0xc]
mov dword [esp + 0xf], 0x6e65704f
push eax
push edi
mov word [esp + 0x1f], 0x5778
mov word [esp + 0x14], 0x6552
mov word [esp + 0x1c], 0x7965
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1b], 0x4b
mov byte [esp + 0x16], 0x67
mov byte [esp + 0x21], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52a5dd
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push ebx
push 0x80000002
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x52a710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00518280
mov edi, eax
test edi, edi
je 0x52a779
lea eax, [esp + 0xc]
mov word [esp + 0x12], 0x656c
push eax
push edi
mov dword [esp + 0x15], 0x46687461
mov word [esp + 0x20], 0x7374
mov word [esp + 0x1d], 0x6978
mov byte [esp + 0x1c], 0x45
mov word [esp + 0x22], 0x41
mov byte [esp + 0x1f], 0x73
mov byte [esp + 0x14], 0x50
mov byte [esp + 0x19], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52a772
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x52aa40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00402ea0
mov edi, eax
test edi, edi
je 0x52aace
lea eax, [esp + 0xc]
mov word [esp + 0x1b], 0x7443
push eax
push edi
mov dword [esp + 0x28], 0x6c646e61
mov dword [esp + 0x1b], 0x72655372
mov dword [esp + 0x16], 0x74736967
mov dword [esp + 0x2e], 0x417845
mov word [esp + 0x20], 0x6369
mov word [esp + 0x14], 0x6552
mov byte [esp + 0x22], 0x65
mov word [esp + 0x26], 0x486c
mov word [esp + 0x2c], 0x7265
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x1a], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52aac7
push esi
push 0x519000
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x52aae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e949
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x26c
push esi
mov esi, ecx
mov dword [ebp - 0x78], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x70], 0
call fcn.00420480
mov ecx, eax
test ecx, ecx
jne 0x52ab27
push 0x80004005
call fcn.00420020
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x52ab3c
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x52ab3e
call edx
push ebx
add eax, 0x10
push edi
mov dword [esi], eax
push 0x200
lea eax, [ebp - 0x278]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x70], 1
call fcn.00443110
xor eax, eax
mov dword [ebp - 0x14], 0x200
mov word [ebp - 0x2e], ax
mov ecx, 0x5c
mov eax, 0x41
mov word [ebp - 0x48], cx
mov word [ebp - 0x62], ax
add esp, 0xc
mov eax, 0x53
mov word [ebp - 0x5c], cx
mov word [ebp - 0x6c], ax
mov edx, 0x63
mov word [ebp - 0x56], dx
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x60], 0x450052
lea ecx, [eax + 0xe]
mov dword [ebp - 0x42], 0x700079
lea eax, [ebp - 0x10]
mov dword [ebp - 0x46], 0x720043
push eax
push 0x20019
push ecx
mov dword [ebp - 0x50], 0x6f0073
mov dword [ebp - 0x66], 0x570054
mov dword [ebp - 0x3e], 0x6f0074
mov dword [ebp - 0x32], 0x790068
mov dword [ebp - 0x54], 0x6f0072
mov dword [ebp - 0x4c], 0x740066
mov dword [ebp - 0x36], 0x700061
mov dword [ebp - 0x6a], 0x46004f
mov dword [ebp - 0x5a], 0x69004d
mov dword [ebp - 0x3a], 0x720067
mov dword [ebp - 0x20], 0x470065
mov dword [ebp - 0x1c], 0x690075
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x28], 0x680063
mov dword [ebp - 0x2c], 0x61004d
mov dword [ebp - 0x18], 0x64
call fcn.0052a570
add esp, 0xc
pop edi
pop ebx
test eax, eax
jne 0x52acd6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x74]
push eax
push ecx
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.00522b00
add esp, 0x10
test eax, eax
je 0x52aca2
lea eax, [ebp - 0x10]
push eax
push 0x20119
push ecx
lea edx, [ebp - 0x6c]
call fcn.0052a570
add esp, 0xc
test eax, eax
jne 0x52acd6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x74]
push eax
push ecx
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.00522b00
add esp, 0x10
test eax, eax
jne 0x52acd6
lea eax, [ebp - 0x278]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x52acb0
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.00421d70
mov ecx, dword [ebp - 0x10]
call fcn.00527fe0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret