joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d100
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00444b00
test al, al
je 0x40d2ee
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043c4d0
test al, al
je 0x40d2e9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0xaed7849b
mov dword [esp + 8], 0x626cce76
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d186
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d300
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d160
mov dword [esp + 4], 0xfe571ddd
mov dword [esp + 8], 0xe8573ad3
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d1d6
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d360
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d1b0
mov dword [esp + 4], 0x313e3f1f
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d226
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d3d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d200
test esi, esi
je 0x40d286
mov dword [esp + 4], 0xcb49e319
mov dword [esp + 8], 0x919ca8ee
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d286
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d430
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d260
mov dword [esp + 4], 0x36353433
mov dword [esp + 8], 0x3a393837
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d2d6
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d4c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d2b0
call fcn.0040e970
test al, al
je 0x40d2e9
call fcn.004123e0
call fcn.004105a0
call fcn.00445850
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, ecx
mov edi, dword [esp + 0x6c]
add edi, dword [ecx + 0x60]
mov word [esp + 4], 0xc5c3
mov byte [esp + 6], 0xce
mov dword [esp + 7], 0
mov byte [esp + 0xb], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 7
ja 0x40d7cb
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x18]
push eax
call fcn.0040e480
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 8
jb 0x40d7a0
mov dword [esp + 0xc], 0xe2e0ec86
mov dword [esp + 0x10], 0xf5e2
mov byte [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 8
ja 0x40d82b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 0xc]
push dword [esp + 0x18]
push eax
call fcn.0040e420
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 9
jb 0x40d800
mov dword [esp + 0x18], 0x7a78b4b5
mov dword [esp + 0x1c], 0x4646a8a4
mov dword [esp + 0x20], 0x43564895
mov dword [esp + 0x24], 0x4e434257
mov dword [esp + 0x28], 0x9e4b5f5e
mov dword [esp + 0x2c], 0x4075a3a1
mov dword [esp + 0x30], 0x45534542
mov dword [esp + 0x34], 0x527e9840
mov dword [esp + 0x38], 0x484d494f
mov dword [esp + 0x3c], 0xb0ab4955
mov dword [esp + 0x40], 0xad667fb2
mov dword [esp + 0x44], 0x66a7b3b7
mov dword [esp + 0x48], 0xaebaa8ac
mov dword [esp + 0x4c], 0xb2a06d73
mov dword [esp + 0x50], 0x716bb4bd
mov byte [esp + 0x54], 0x54
mov dword [esp + 0x55], 0
mov word [esp + 0x59], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x42
ja 0x40d8f6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.0040e3d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x43
jb 0x40d8d0
mov ecx, dword [esp + 0x70]
movzx edx, byte [esp + 0x18]
mov eax, edi
test dl, dl
je 0x40d91b
lea ebx, [esp + 0x19]
mov eax, edi
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d910
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d93b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d930
mov ecx, dword [esp + 0x74]
mov byte [eax], 0
movzx edx, byte [esp + 0xc]
test dl, dl
je 0x40d95b
lea ebx, [esp + 0xd]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d950
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d97b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d970
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x40d99b
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40d990
mov byte [eax], 0
sub eax, edi
add dword [esi + 0x60], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x410ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x240
mov esi, dword [0x4542b8]
mov dword [esp + 0x40], 0x33a53185
mov dword [esp + 0x44], 0x2fb72da6
mov dword [esp + 0x48], 0x2bbe29bc
mov dword [esp + 0x4c], 0x27712585
mov dword [esp + 0x50], 0x2374216d
mov dword [esp + 0x54], 0x1f7e1d4c
mov dword [esp + 0x58], 0x1bb51940
mov dword [esp + 0x5c], 0x1780158d
mov dword [esp + 0x60], 0x1385118c
mov dword [esp + 0x64], 0xf9d0d83
mov dword [esp + 0x68], 0xbbc0968
mov dword [esp + 0x6c], 0x76605a8
mov dword [esp + 0x70], 0x3520151
mov dword [esp + 0x74], 0x7f2e7d2a
mov dword [esp + 0x78], 0x7b1a7933
mov dword [esp + 0x7c], 0x77ef75db
mov dword [esp + 0x80], 0x733c71e6
mov dword [esp + 0x84], 0x6f256d20
mov dword [esp + 0x88], 0x6be26908
mov dword [esp + 0x8c], 0x672a652a
mov dword [esp + 0x90], 0x63026139
mov dword [esp + 0x94], 0x5fce5d1d
mov dword [esp + 0x98], 0x5bce59c8
mov dword [esp + 0x9c], 0x57f955c9
mov dword [esp + 0xa0], 0x53f051cd
mov dword [esp + 0xa4], 0x4fd74df7
mov dword [esp + 0xa8], 0x4b1d49c4
mov dword [esp + 0xac], 0x47154509
mov dword [esp + 0xb0], 0x4314410f
mov dword [esp + 0xb4], 0xbff0bdef
mov dword [esp + 0xb8], 0xbbe2b9d8
mov dword [esp + 0xbc], 0xb70eb50f
mov dword [esp + 0xc0], 0xb307b11c
mov dword [esp + 0xc4], 0xaffaad18
mov dword [esp + 0xc8], 0xab3ea9c8
mov dword [esp + 0xcc], 0xa73da53d
mov dword [esp + 0xd0], 0xa3c2a13d
mov dword [esp + 0xd4], 0x9f039d23
mov dword [esp + 0xd8], 0x9b01993b
mov dword [esp + 0xdc], 0x97cf9503
mov dword [esp + 0xe0], 0x93d191f0
mov dword [esp + 0xe4], 0x8f1c8d14
mov dword [esp + 0xe8], 0x8b1f891f
mov dword [esp + 0xec], 0x87d18519
mov dword [esp + 0xf0], 0x83d381d1
mov dword [esp + 0xf4], 0xffa8fdb5
mov dword [esp + 0xf8], 0xfbacf9a8
mov dword [esp + 0xfc], 0xf7a0f5a4
mov dword [esp + 0x100], 0xf392f1a0
mov dword [esp + 0x104], 0xef4fed5f
mov dword [esp + 0x108], 0xeb4be976
mov dword [esp + 0x10c], 0xe77fe576
mov dword [esp + 0x110], 0xe3afe1b7
mov dword [esp + 0x114], 0xdf91dd8f
mov dword [esp + 0x118], 0xdb89d98e
mov dword [esp + 0x11c], 0xd7d6d59a
mov word [esp + 0x120], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0xe1
ja 0x41115d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
movzx eax, byte [esp + eax + 0x40]
push dword [esp + 0xc]
push eax
call fcn.00412040
add esp, 8
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x40], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0xe2
jb 0x411130
lea ebx, [esp + 0x40]
push 0
push 0
push 0
push 0
push ebx
call esi
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x44f020]
mov ecx, 0xfd70e441
xor ecx, dword [0x44f028]
add eax, ecx
inc eax
jmp eax
or eax, 0x452c98
xor ecx, 0x4955b13b
cmp esi, dword [ecx - 0x37d6b6ab]
cmp esi, dword [ecx - 0x37d6b6ab]
mov cl, 1
mov dword [ebp - 0xf4], ecx
mov esi, 1
mov ebx, dword [ebp - 0x3c]
jmp eax
Function at 0x41d680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa50
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41d6a0
sar esi, 1
lea ecx, [esp + 0x44]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x4555fc]
mov ebx, dword [esp + 0x44]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41d6d4
mov eax, 0xffffffff
jmp 0x41d6d7
lea eax, [ebx + ebx]
push eax
call fcn.0040ca00
add esp, 4
lea ecx, [esp + 0x44]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x4555fc]
mov eax, dword [esp + 0x44]
mov ecx, eax
add ecx, 0xd
js 0x41d70c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040ca00
add esp, 4
mov esi, eax
mov dword [esp + 0x130], 0xf306f114
mov dword [esp + 0x134], 0xef7ded0d
mov dword [esp + 0x138], 0xebcae964
mov dword [esp + 0x13c], 0xe77be50a
mov dword [esp + 0x140], 0xe371e172
mov dword [esp + 0x144], 0x9f099d05
mov dword [esp + 0x148], 0x9b9a990e
mov dword [esp + 0x570], 0
mov eax, dword [esp + 0x570]
cmp eax, 0x1b
ja 0x41d7c0
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x570]
movzx eax, byte [esp + eax + 0x130]
push dword [esp + 0x570]
push eax
call fcn.00422c70
add esp, 8
mov ecx, dword [esp + 0x570]
mov byte [esp + ecx + 0x130], al
inc dword [esp + 0x570]
mov eax, dword [esp + 0x570]
cmp eax, 0x1c
jb 0x41d780
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x41d7f1
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d7e0
mov word [eax], 0
movzx ecx, word [esp + 0x130]
test cx, cx
je 0x41d821
lea edx, [esp + 0x132]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d810
mov word [eax], 0
lea eax, [esp + 0x8f8]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00449330
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x450294]
Function at 0x424bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x424c10
cmp eax, 0xffffffdd
jge 0x424c27
mov eax, 0xffffffff
jmp 0x424c2a
add eax, 0x22
push eax
call fcn.0040ca00
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0xff909e4
mov dword [esp + 0x1c], 0x3f10df8
mov dword [esp + 0x20], 0x7e701f6
mov dword [esp + 0x24], 0x1bff05ff
mov dword [esp + 0x28], 0x1ffa19f4
mov dword [esp + 0x2c], 0x13e81df9
mov dword [esp + 0x30], 0x17e311f1
mov dword [esp + 0x34], 0x2bde15e8
mov dword [esp + 0x38], 0x2928
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x23
ja 0x424cbb
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.004258d0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x24
jb 0x424c90
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x424ce1
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x424cd0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x424d11
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424d00
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x61f767f3
mov dword [esp + 0x1c], 0x5db563ea
mov dword [esp + 0x20], 0x59d65fc3
mov dword [esp + 0x24], 0x55c55bd4
mov dword [esp + 0x28], 0x51db57c2
mov dword [esp + 0x2c], 0x4dc353cb
mov dword [esp + 0x30], 0x499b4fda
mov dword [esp + 0x34], 0x459f4b9d
mov dword [esp + 0x38], 0x41e0479e
mov dword [esp + 0x3c], 0x3dcf43cf
mov dword [esp + 0x40], 0x39ac3fa3
mov dword [esp + 0x44], 0x35ab3b85
mov dword [esp + 0x48], 0x31ba37a2
mov dword [esp + 0x4c], 0x2dba33af
mov dword [esp + 0x50], 0x29952fa0
mov dword [esp + 0x54], 0x25ed2bb4
mov dword [esp + 0x58], 0x212627fe
mov byte [esp + 0x5e], 0
mov word [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x46
ja 0x424e06
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00425920
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x47
jb 0x424de0
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x425110
push ecx
push esi
call fcn.00425c60
add esp, 0x10
jmp dword [0x450664]
Function at 0x4284e0
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
mov esi, dword [0x4555fc]
mov dword [esp + 0x14], 0x77c20965
mov dword [esp + 0x18], 0x73dd75e7
mov dword [esp + 0x1c], 0x7fea71d1
mov dword [esp + 0x20], 0x7bea7d3d
mov dword [esp + 0x24], 0x672a79e8
mov dword [esp + 0x28], 0x63fe65c5
mov dword [esp + 0x2c], 0x6f0361c1
mov word [esp + 0x30], 0x6d6c
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x22
ja 0x42857b
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042ace0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x23
jb 0x428550
lea edi, [esp + 0x64]
lea eax, [esp + 0x14]
push edi
push 0
push 0
push 0xe
push eax
push 0
call esi
mov ebx, dword [esp + 0x64]
test ebx, ebx
jns 0x42859e
mov eax, 0xffffffff
jmp 0x4285a1
lea eax, [ebx + ebx]
push eax
call fcn.0040ca00
add esp, 4
mov esi, eax
mov ebp, dword [0x4555fc]
mov dword [esp + 0x14], 0x3ff239dd
mov dword [esp + 0x18], 0x23853daf
mov dword [esp + 0x1c], 0x278a2181
mov dword [esp + 0x20], 0x2bba25e5
mov dword [esp + 0x24], 0x2fea29b8
mov dword [esp + 0x28], 0x13862d8d
mov dword [esp + 0x2c], 0x17f311b1
mov dword [esp + 0x30], 0x1514
mov byte [esp + 0x34], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x20
ja 0x42863b
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042ad30
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x21
jb 0x428610
push edi
push ebx
push esi
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebp
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
jns 0x42865b
mov eax, 0xffffffff
jmp 0x428662
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040ca00
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0xd786c9ac
mov dword [esp + 0x18], 0xd3bdd5b5
mov dword [esp + 0x1c], 0xdfbfd1a7
mov dword [esp + 0x20], 0xdbb7ddb7
mov dword [esp + 0x24], 0xe7e6d9a7
mov dword [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x17
ja 0x4286db
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042ad80
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x18
jb 0x4286b0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x428701
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4286f0
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x428731
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428720
mov ebx, dword [esp + 0x84]
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.004494d0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x450d2c]
Function at 0x428bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov esi, dword [0x4555fc]
mov dword [esp + 4], 0x3430125
mov dword [esp + 8], 0x7760574
mov dword [esp + 0xc], 0xb6b094c
mov dword [esp + 0x10], 0xf6f0d78
mov dword [esp + 0x14], 0x134e1135
mov dword [esp + 0x18], 0x177e1540
mov dword [esp + 0x1c], 0x1b74196d
mov dword [esp + 0x20], 0x1f7b1d78
mov dword [esp + 0x24], 0x23402152
mov dword [esp + 0x28], 0x2754254d
mov dword [esp + 0x2c], 0x2b76294c
mov dword [esp + 0x30], 0x2f5c2d7c
mov dword [esp + 0x34], 0x3354315f
mov dword [esp + 0x38], 0x375a355d
mov dword [esp + 0x3c], 0x3b49395d
mov dword [esp + 0x40], 0x3d3c
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x3f
ja 0x428c76
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0042af70
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x40
jb 0x428c50
lea ebx, [esp + 0x48]
lea eax, [esp + 4]
push ebx
push 0
push 0
push 0x1e
push eax
push 0
call esi
mov ebp, dword [esp + 0x48]
test ebp, ebp
jns 0x428c99
mov eax, 0xffffffff
jmp 0x428ca0
lea eax, [ebp*2]
push eax
call fcn.0040ca00
add esp, 4
mov esi, eax
mov edi, dword [0x4555fc]
mov dword [esp + 4], 0x23632145
mov dword [esp + 8], 0x27962594
mov dword [esp + 0xc], 0x3b9b397c
mov dword [esp + 0x10], 0x3f9f3d88
mov dword [esp + 0x14], 0x339e3155
mov dword [esp + 0x18], 0x378e3560
mov dword [esp + 0x1c], 0xbb409bd
mov dword [esp + 0x20], 0xfab0da8
mov dword [esp + 0x24], 0x3a001b2
mov dword [esp + 0x28], 0x7b405bd
mov dword [esp + 0x2c], 0x1bb619bc
mov dword [esp + 0x30], 0x1fac1d4c
mov dword [esp + 0x34], 0x13b411af
mov dword [esp + 0x38], 0x17aa15ad
mov dword [esp + 0x3c], 0x6bd969cd
mov word [esp + 0x40], 0x6d6c
mov dword [esp + 0x42], 0
mov byte [esp + 0x46], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x42
ja 0x428d76
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0042afb0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x43
jb 0x428d50
push ebx
push ebp
push esi
push 0x1e
lea ebx, [esp + 0x14]
push ebx
push 0
call edi
mov dword [esp + 4], 0x832a8154
mov dword [esp + 8], 0x87288531
mov dword [esp + 0xc], 0x8b2f892c
mov dword [esp + 0x10], 0x8f2c8d3e
mov dword [esp + 0x14], 0x93209139
mov dword [esp + 0x18], 0x97969530
mov byte [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x18
ja 0x428df6
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0042b000
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x19
jb 0x428dd0
push 0
push 0
push ebx
push esi
push dword [esp + 0x70]
call fcn.00423570
add esp, 0x14
jmp dword [0x450d74]
Function at 0x42b450
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84c
xor esi, esi
xor edi, edi
mov ebx, 0x20219
mov eax, 1
mov dword [esp + 4], 0
jmp dword [eax*4 + 0x451424]
Function at 0x42f390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x80
mov edi, dword [0x4555fc]
mov dword [esp + 0x18], 0xc303c125
mov dword [esp + 0x1c], 0xc756c554
mov dword [esp + 0x20], 0xcb6bc90c
mov dword [esp + 0x24], 0xcf6fcd58
mov dword [esp + 0x28], 0xb30eb155
mov dword [esp + 0x2c], 0xb719b57a
mov dword [esp + 0x30], 0xbb1fb92c
mov dword [esp + 0x34], 0xbf1fbd2c
mov dword [esp + 0x38], 0xa349a104
mov dword [esp + 0x3c], 0xa71aa54f
mov dword [esp + 0x40], 0xab0fa93b
mov dword [esp + 0x44], 0xaf3dad3f
mov dword [esp + 0x48], 0x933d9139
mov dword [esp + 0x4c], 0x9778953a
mov dword [esp + 0x50], 0x9b379900
mov dword [esp + 0x54], 0x9f9e9d30
mov dword [esp + 0x58], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x42f466
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00431770
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x42f440
lea esi, [esp + 0x7c]
lea eax, [esp + 0x18]
push esi
push 0
push 0
push 0x1f
push eax
push 0
call edi
mov edi, dword [esp + 0x7c]
test edi, edi
jns 0x42f489
mov eax, 0xffffffff
jmp 0x42f48c
lea eax, [edi + edi]
push eax
call fcn.0040ca00
add esp, 4
mov ebp, eax
mov ebx, dword [0x4555fc]
mov dword [esp + 0x18], 0x3373316d
mov dword [esp + 0x1c], 0x2fbe2dbc
mov dword [esp + 0x20], 0x2b8b2994
mov dword [esp + 0x24], 0x278725a8
mov dword [esp + 0x28], 0x2386217d
mov dword [esp + 0x2c], 0x1f891daa
mov dword [esp + 0x30], 0x1b871994
mov dword [esp + 0x34], 0x17b71584
mov dword [esp + 0x38], 0x1349118c
mov dword [esp + 0x3c], 0xfaa0d57
mov dword [esp + 0x40], 0xb97099b
mov dword [esp + 0x44], 0x7950597
mov dword [esp + 0x48], 0x3950199
mov dword [esp + 0x4c], 0x7f287dea
mov dword [esp + 0x50], 0x7bef79f0
mov dword [esp + 0x54], 0x777675e0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x3f
ja 0x42f556
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.004317d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x40
jb 0x42f530
push esi
push edi
push ebp
push 0x1f
lea edi, [esp + 0x28]
push edi
push 0
call ebx
lea eax, [esp + 0x64]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00449330
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x45185c]