joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4185b3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x10], 1
call fcn.0041874f
xor ebx, ebx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x418667
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x418659
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push str.ProxyEnable
mov dword [ebp - 8], 4
push dword [ebp - 4]
call esi
test eax, eax
je 0x41861d
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x824
push eax
lea eax, [ebp - 0x838]
push eax
push ebx
push ebx
push str.AutoConfigURL
push dword [ebp - 4]
call esi
test eax, eax
pop esi
je 0x418646
mov byte [ebp - 0x838], bl
cmp dword [ebp - 0xc], ebx
jne 0x418653
cmp byte [ebp - 0x838], bl
je 0x418659
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], ebx
je 0x418667
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.00418227
add esp, 0x14
cmp dword [ebp + 0xc], ebx
mov dword [edi + 4], eax
je 0x41868c
cmp dword [ebp + 0xc], 4
jne 0x4186b8
cmp dword [ebp - 0x14], ebx
jne 0x4186b8
mov ax, word [edi + 0x14]
cmp ax, 3
jne 0x4186a4
mov ecx, edi
call fcn.00418c6a
jmp 0x4186b8
cmp ax, 4
mov ecx, edi
jne 0x4186b3
call fcn.00418e4b
jmp 0x4186b8
call fcn.0041921f
xor eax, eax
cmp dword [edi + 4], ebx
pop edi
pop ebx
setne al
leave
ret 0x14
Function at 0x418c6a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1190
call fcn.0041d070
and byte [ebp - 0x96c], 0
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov edx, 0x208
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x96b]
and byte [ebp - 0x1190], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x118f]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push str.SOFTWARENetscapeNetscape_NavigatorProxy_Information
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x418e38
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push str.Proxy_Type
push dword [ebp - 4]
mov dword [ebp - 0x48], str.http
mov dword [ebp - 0x44], str.HTTP_Proxy
mov dword [ebp - 0x40], str.HTTP_ProxyPort
mov dword [ebp - 0x3c], str.https
mov dword [ebp - 0x38], str.HTTPS_Proxy
mov dword [ebp - 0x34], str.HTTPS_ProxyPort
mov dword [ebp - 0x30], str.ftp
mov dword [ebp - 0x2c], str.FTP_Proxy
mov dword [ebp - 0x28], str.FTP_ProxyPort
mov dword [ebp - 8], 4
call ebx
test eax, eax
jne 0x418e38
cmp dword [ebp - 0x14], 1
jne 0x418e38
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edi, [ebp - 0x48]
mov dword [ebp - 0xc], 3
lea eax, [ebp - 8]
mov dword [ebp - 8], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x148]
push eax
push 0
push 0
push dword [edi + 4]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x418dfb
cmp byte [ebp - 0x148], al
je 0x418dfb
push dword [edi]
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x96c]
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push dword [edi + 8]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x418ded
lea eax, [ebp - 0x96c]
push 0x42f984
push eax
call esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x96c]
push 0x42eb30
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x96c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x96c]
push 0x42e7d8
push eax
call esi
add edi, 0xc
dec dword [ebp - 0xc]
jne 0x418d51
lea eax, [ebp - 0x96c]
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1190]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push 0x26
mov dword [ebp - 0x24], 3
push dword [eax + 4]
call fcn.00418438
add esp, 0x10
xor esi, esi
cmp dword [ebp - 4], esi
je 0x418e46
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419dbf
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0xf4]
cmp eax, 0x7530
jbe 0x419e22
mov ecx, dword [esi + 0xe8]
lea eax, [esi + 0xe8]
mov edx, dword [esi + 0xf0]
mov dword [esi + 0xdc], ecx
xor ecx, ecx
mov dword [esi + 0xe4], edx
mov dword [eax], ecx
lea eax, [esi + 0xf0]
mov edx, dword [esi + 0xec]
mov dword [esi + 0xec], ecx
mov dword [eax], ecx
lea eax, [esi + 0xec]
mov dword [esi + 0xe0], edx
call edi
mov dword [esi + 0xf4], eax
mov edi, dword [esi + 0xe4]
test edi, edi
jne 0x419e34
mov eax, dword [esi + 0xdc]
jmp 0x419e8c
push ebx
push ebp
push 0xa
xor eax, eax
pop ecx
xor ebp, ebp
test eax, eax
jne 0x419e8a
or eax, 0xffffffff
xor edx, edx
div ecx
mov ebx, dword [esi + 0xdc]
cmp ebx, eax
jbe 0x419e62
shr ebx, 1
shr edi, 1
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe4], edi
mov eax, dword [esi + 0xdc]
mov edi, dword [esi + 0xe4]
imul eax, ecx
xor edx, edx
div edi
xor edx, edx
imul eax, eax, 0x3e8
div ecx
lea ecx, [ecx + ecx*4]
inc ebp
shl ecx, 1
cmp ebp, 3
jb 0x419e3d
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x41a6d9
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x41a72b
push eax
call fcn.0041c6a8
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41a72b
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x42ec24
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x41a72f
xor al, al
jmp 0x41a790
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x41a78e
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.0041c6a8
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x41a78e
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x41a77c
mov al, 1
pop ebx
leave
ret 4
Function at 0x424e76
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x432800
cmp edx, dword [eax]
je 0x424e98
add eax, 8
inc ecx
cmp eax, 0x432890
jl 0x424e89
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x432800]
jne 0x424fc6
mov eax, dword [0x435e40]
cmp eax, 1
je 0x424fa0
test eax, eax
jne 0x424ec9
cmp dword [0x42fdf4], 1
je 0x424fa0
cmp edx, 0xfc
je 0x424fc6
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x424f00
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041ca60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041c9e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x424f43
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041c9e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42a4b8
push edi
call fcn.0041c8e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041ca60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041ca70
lea eax, [ebp - 0xa0]
push 0x42a498
push eax
call fcn.0041ca70
push dword [esi + 0x432804]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041ca70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00426c18
add esp, 0x2c
pop edi
jmp 0x424fc6
lea eax, [ebp + 8]
lea esi, [esi + 0x432804]
push 0
push eax
push dword [esi]
call fcn.0041c9e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x490470
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x5c6b7
mov dword [ebp - 4], 0xf8c9
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4904e8
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x41
jl 0x4904c1
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5a
jg 0x4904c1
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
lea eax, [eax + edx + 0x20]
mov dword [ebp - 0xc], eax
jmp 0x4904d3
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x49048b
mov eax, dword [ebp - 0xc]
and eax, 0x7fffffff
mov esp, ebp
pop ebp
ret

Function at 0x490500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 1
jmp 0x490536
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x490594
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
call fcn.00490470
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0x490592
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov eax, dword [ebp - 0x10]
mov cx, word [edx + eax*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
movzx ecx, word [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
mov eax, edx
jmp 0x490596
jmp 0x49052d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4905a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call dword [fcn.00409004]
mov esp, ebp
pop ebp
ret
Function at 0x4906e0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, 1
test eax, eax
je 0x490858
mov dword [ebp - 0x18], 0
call dword [0x40900c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x490727
mov ecx, dword [ebp - 0x14]
and ecx, 1
je 0x49071d
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
shr eax, 1
mov dword [ebp - 0x14], eax
jmp 0x490706
push 0
push 0
call dword [0x409018]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call dword [0x409010]
push eax
call dword [0x409008]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [0x409018]
push 0x4e1e0843
call fcn.004905f0
add esp, 4
mov dword [ebp - 0x10], eax
push 0x70ebfb28
call fcn.004905f0
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0
jmp 0x49078a
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0xc]
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp dword [ebp - 0x1c], eax
jge 0x490853
mov byte [ebp - 0x34], 0
xor edx, edx
mov word [ebp - 0x33], dx
mov byte [ebp - 0x31], dl
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*4]
push edx
lea eax, [ebp - 0x34]
push eax
call dword [fcn.00409028]
movsx ecx, byte [ebp - 0x34]
push ecx
push 0x40a29c
lea edx, [ebp - 0x78]
push edx
call dword [0x409108]
add esp, 0xc
push 0
push 0x40
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x78]
push eax
call dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x4907f8
jmp 0x490781
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xa0], 0x28
push 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0xa0]
push edx
lea eax, [ebp - 0xa4]
push eax
push 0xc
lea ecx, [ebp - 0x30]
push ecx
push 0x2d1400
mov edx, dword [ebp - 0x20]
push edx
call dword [0x409020]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [ebp - 8]
push 0x1f4
call dword [0x409014]
jmp 0x490781
jmp 0x4906e9
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x490b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
push 0x214c6981
call fcn.004905f0
add esp, 4
mov dword [ebp - 0x20], eax
push 0x104
lea eax, [ebp - 0x2c0]
push eax
call dword [ebp - 0x20]
push 0x1c368da0
call fcn.004905f0
add esp, 4
mov dword [ebp - 0x14], eax
call dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x15c]
push ecx
call fcn.00490400
add esp, 0xc
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x144], 0x2e
mov byte [ebp - 0x143], 0x64
mov byte [ebp - 0x142], 0x6c
mov byte [ebp - 0x141], 0x6c
mov byte [ebp - 0x140], 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.00490670
add esp, 8
lea ecx, [ebp - 0x15c]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call fcn.00490670
add esp, 8
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.00490670
add esp, 8
mov dword [ebp - 0x2c4], 0
jmp 0x490c62
mov edx, dword [ebp - 0x2c4]
add edx, 1
mov dword [ebp - 0x2c4], edx
cmp dword [ebp - 0x2c4], 1
jge 0x490c6d
jmp 0x490c53
mov dword [ebp - 0x2c8], 0
jmp 0x490c88
mov eax, dword [ebp - 0x2c8]
add eax, 1
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x490c93
jmp 0x490c79
push 0x4e1e0843
call fcn.004905f0
add esp, 4
mov dword [ebp - 0x1ac], eax
push 0x7463a627
call fcn.004905f0
add esp, 4
mov dword [ebp - 0x148], eax
push 0x70ebfb28
call fcn.004905f0
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x289fbd13
call fcn.004905f0
add esp, 4
mov dword [ebp - 0x10], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea ecx, [ebp - 0x2c0]
push ecx
call dword [ebp - 0x1ac]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
je 0x490d3b
mov dword [ebp - 0x2cc], 0
push 0
lea edx, [ebp - 0x2cc]
push edx
push 0x6000
push 0x41f250
mov eax, dword [ebp - 0x13c]
push eax
call dword [ebp - 0x148]
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [ebp - 0x1c]
mov byte [ebp - 0x1b8], 0x52
mov byte [ebp - 0x1b7], 0x75
mov byte [ebp - 0x1b6], 0x6e
mov byte [ebp - 0x1b5], 0x64
mov byte [ebp - 0x1b4], 0x6c
mov byte [ebp - 0x1b3], 0x6c
mov byte [ebp - 0x1b2], 0x33
mov byte [ebp - 0x1b1], 0x32
mov byte [ebp - 0x1b0], 0x20
mov byte [ebp - 0x1af], 0
mov byte [ebp - 0xc], 0x20
mov byte [ebp - 0xb], 0x45
mov byte [ebp - 0xa], 0x78
mov byte [ebp - 9], 0x62
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0
push 0x44
push 0
lea edx, [ebp - 0x1a8]
push edx
call fcn.00490650
add esp, 0xc
mov dword [ebp - 0x1a8], 0x44
push 0x10
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00490650
add esp, 0xc
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call fcn.00490670
add esp, 8
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x128]
push ecx
call dword [fcn.00409028]
lea edx, [ebp - 0x2c0]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.00490670
add esp, 8
push 0
lea ecx, [ebp - 0x128]
push ecx
call dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x491180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push 0x4ee61051
call fcn.004905f0
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
call dword [fcn.00409004]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x4911ee
lea ecx, [ebp - 0xc]
push ecx
call dword [fcn.0040901c]
mov dword [ebp - 0x23c], eax
push 0x384977d3
mov edx, dword [ebp - 0x23c]
push edx
call fcn.00490500
add esp, 8
mov dword [ebp - 0x238], eax
push 0x7f8a
push 0x7f00
push 0
call dword [fcn.0040910c]
push eax
call dword [fcn.00409104]
push eax
call dword [ebp - 0x238]
call fcn.00490e30
call fcn.00490860
call fcn.00490b90
push 0x660c1c02
call fcn.004905f0
add esp, 4
mov dword [ebp - 0x240], eax
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [ebp - 0x240]
push 0x214c6981
call fcn.004905f0
add esp, 4
mov dword [ebp - 0x224], eax
push 0x104
lea ecx, [ebp - 0x118]
push ecx
call dword [ebp - 0x224]
mov byte [ebp - 0x234], 0x5c
mov byte [ebp - 0x233], 0x5c
mov byte [ebp - 0x232], 0x73
mov byte [ebp - 0x231], 0x79
mov byte [ebp - 0x230], 0x73
mov byte [ebp - 0x22f], 0x74
mov byte [ebp - 0x22e], 0x65
mov byte [ebp - 0x22d], 0x6d
mov byte [ebp - 0x22c], 0x2e
mov byte [ebp - 0x22b], 0x65
mov byte [ebp - 0x22a], 0x78
mov byte [ebp - 0x229], 0x65
mov byte [ebp - 0x228], 0
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.00490670
add esp, 8
push 1
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49b020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [ebp + 8]
push eax
call fcn.0049a450
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x49b0f2
push 0
push 0x14
lea edx, [ebp - 0x84]
push edx
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x1000b170]
push 0
push 0
push 0
lea edx, [ebp - 0x50]
push edx
call dword [0x1000b184]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x49b079
xor al, al
jmp 0x49b214
mov dword [ebp - 0x70], 0x1c
lea eax, [ebp - 0x70]
push eax
push 1
push 0
push 0
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x84]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [0x1000b180]
test eax, eax
jne 0x49b0aa
xor al, al
jmp 0x49b214
mov ecx, dword [ebp + 8]
push ecx
call dword [0x1000b090]
add eax, 2
push eax
mov edx, dword [ebp + 8]
push edx
push 1
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x1000b18c]
test eax, eax
jne 0x49b0d7
xor al, al
jmp 0x49b214
lea edx, [ebp - 0x70]
push edx
mov eax, dword [ebp - 8]
push eax
push 0x19
call dword [0x1000b188]
test eax, eax
jne 0x49b0f2
xor al, al
jmp 0x49b214
mov dword [ebp - 4], 0
mov byte [ebp - 0x40], 0x6e
mov byte [ebp - 0x3f], 0x65
mov byte [ebp - 0x3e], 0x77
mov byte [ebp - 0x3d], 0x64
mov byte [ebp - 0x3c], 0x65
mov byte [ebp - 0x3b], 0x76
mov byte [ebp - 0x3a], 0x2e
mov byte [ebp - 0x39], 0x64
mov byte [ebp - 0x38], 0x6c
mov byte [ebp - 0x37], 0x6c
mov byte [ebp - 0x36], 0
lea ecx, [ebp - 0x40]
push ecx
call dword [0x1000b040]
mov dword [ebp - 0x34], eax
push 0x94c4c32
call fcn.0049ca00
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x34], 0
jne 0x49b152
lea edx, [ebp - 0x40]
push edx
call dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x2c], 0x55
mov byte [ebp - 0x2b], 0x70
mov byte [ebp - 0x2a], 0x64
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x74
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x44
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x69
mov byte [ebp - 0x23], 0x76
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x46
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x50
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0x67
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x50
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x41
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call dword [0x1000b02c]
mov dword [ebp - 0x54], eax
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [ebp - 0x54]
test eax, eax
jne 0x49b20a
xor al, al
jmp 0x49b214
mov edx, dword [ebp - 8]
push edx
call dword [0x1000b17c]
mov esp, ebp
pop ebp
ret
Function at 0x49b220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov byte [ebp - 0x1c], 0x41
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x32
mov byte [ebp - 0x14], 0x2e
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], 0
push 0x3777cccb
call fcn.0049ca00
add esp, 4
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1c]
push eax
call dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x49b294
push 0x94c4c32
call fcn.0049ca00
add esp, 4
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
push 0x4927ac50
mov edx, dword [ebp - 0x24]
push edx
call fcn.0049c910
add esp, 8
mov dword [ebp - 0x20], eax
push 0x4842adf4
mov eax, dword [ebp - 0x24]
push eax
call fcn.0049c910
add esp, 8
mov dword [ebp - 0x30], eax
push 0x42f77b2b
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0049c910
add esp, 8
mov dword [ebp - 0x28], eax
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x61
mov byte [ebp - 6], 0x76
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0
call dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 1
push 3
push 1
push 0xf01ff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x1000b018]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49b329
cmp dword [ebp - 4], 0xffffffff
jne 0x49b391
push 0xf01ff
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [ebp - 0x30]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49b363
lea edx, [ebp - 0x50]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [0x1000b010]
mov ecx, dword [ebp - 4]
push ecx
call dword [0x1000b01c]
mov edx, dword [ebp - 4]
push edx
call dword [ebp - 0x28]
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 1
push 3
push 1
push 0xf01ff
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [0x1000b018]
mov dword [ebp - 4], eax
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [0x1000b014]
mov edx, dword [ebp - 4]
push edx
call dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
push eax
call dword [ebp - 0x28]
mov al, 1
mov esp, ebp
pop ebp
ret