joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417113
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor ecx, ecx
mov edi, 0x100
nop
mov eax, ecx
shl eax, 0x18
mov esi, 8
lea ebx, [ebx]
test eax, eax
jns 0x417140
add eax, eax
xor eax, 0x4c11db7
jmp 0x417142
add eax, eax
dec esi
jne 0x417133
mov dword [edx], eax
inc ecx
add edx, 4
dec edi
jne 0x417123
pop edi
pop esi
pop ebp
ret

Function at 0x417153
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push 0x3fc
lea eax, [ebp - 0x3fc]
push 0
push eax
mov dword [ebp - 0x400], 0
call fcn.0042bd03
lea ecx, [ebp - 0x400]
push ecx
call fcn.00417113
mov esi, dword [ebp + 0xc]
add esp, 0x10
or eax, 0xffffffff
test esi, esi
je 0x4171b6
mov edx, dword [ebp + 8]
push edi
movzx edi, byte [edx]
mov ecx, eax
shr ecx, 0x18
xor ecx, edi
and ecx, 0xff
shl eax, 8
xor eax, dword [ebp + ecx*4 - 0x400]
inc edx
dec esi
jne 0x417197
pop edi
not eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4171c3
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
pop ebp
ret
Function at 0x417ed3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov edx, ecx
sub edx, eax
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x106], cl
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x417ee5
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [ebp + eax - 0x208]
movzx edx, byte [ebp + eax - 0x106]
add ecx, esi
lea esi, [ecx + edx]
and esi, 0x800000ff
jns 0x417f48
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + eax - 0x106]
mov dl, byte [ebp + esi - 0x106]
mov byte [ebp + eax - 0x106], dl
inc eax
mov byte [ebp + esi - 0x106], cl
cmp eax, 0x100
jl 0x417f23
xor eax, eax
xor cl, cl
mov byte [ebp - 0x107], 0
cmp dword [ebp + 0xc], eax
jbe 0x417ff4
mov edi, dword [ebp + 8]
push ebx
jmp 0x417f89
mov cl, byte [ebp - 0x108]
mov dl, byte [eax + edi]
inc cl
mov byte [ebp - 0x108], cl
movzx esi, cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, byte [ebp - 0x107]
add ecx, ebx
mov byte [ebp - 0x107], cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x106]
mov byte [ebp - 1], bl
movzx ebx, byte [ecx]
mov byte [ebp + esi - 0x106], bl
movzx ebx, byte [ebp - 1]
mov byte [ecx], bl
movzx ebx, byte [ebp + esi - 0x106]
add bl, byte [ecx]
inc eax
movzx ecx, bl
mov cl, byte [ebp + ecx - 0x106]
xor cl, dl
mov byte [eax + edi - 1], cl
cmp eax, dword [ebp + 0xc]
jb 0x417f83
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418ce3
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
aaa
hlt
cmp dword [ebp - 0x7ff26b7e], 0x46e60001
mov dword [ecx + 0x2ba60efb], esp
cmp eax, 0x27f88eb1
cmp dh, cl
test dword [edx], eax
je 0x418c96
cmpsd dword [esi], dword es:[edi]
xchg esi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x87c
push esi
push cs
cmpsd dword [esi], dword es:[edi]
jge 0x418cbb
dec eax
enter 0xdb, 0x2f
pop edi
insd dword es:[edi], dx
push eax
mov eax, 0x7789fa4b
sal byte [esi*4 + 0x7eff573a], 1
sbb al, 0x6d
insd dword es:[edi], dx
movsb byte es:[edi], byte [esi]
stosw word es:[edi], ax
arpl di, cx
out dx, al
xchg byte [edx - 0x2e], dh
pop ss
inc eax
add byte [eax + 0x11], bl
pop es
loope 0x418d83
cmp eax, 0xd9dc183
sub byte [esi + 0x60], cl
jg 0x418d8f
jae 0x418cdc
stc
adc dword [esp + edi*8], 0xffffffcb
arpl word [ebx - 0x3511f95a], dx
mov word [edi - 0x11a44fdb], ds
inc dword [eax - 0x52]
in eax, dx
sub dl, byte [edx - 0x3e9cbf31]
xor al, 0x90
scasd eax, dword es:[edi]
pushal
add eax, 0xba75963b
invalid
cwde
xor cl, bh
test byte [ebx + 0x4d], al
aas
pop eax
mov al, 0xe6
fnstenv [esi - 0x5c]
movsb byte es:[edi], byte [esi]
stc
imul eax, dword [edx + ecx*4], 0xffffffbf
mov bh, 0xdc
xchg ebp, eax
stosb byte es:[edi], al
sub al, 0x88
les eax, [esi]
je 0x418dbb
sete byte [esi + 0x31b08f0b]
invalid
or eax, 0xdf3e6542
pop esi
enter 0xffffffffffffabdb, 0xffffffffffffff80
mov byte [0x712b03e7], al
into
lea edx, [ebx - 0x5ba4bcbf]
inc edx
cmp ch, byte [edi]
std
mov bh, 0x63
imul ecx, ebx, 0x94190a65
out dx, al
jge 0x418d9a
and dword [ebx - 0x20], esp
cmp al, 0xf0
jae 0x418e16
out dx, eax
dec ebx
rcl dl, 1
and bl, byte [edi - 0x6a7ecf31]
sub al, 0xa5
add byte [ebx], cl
mov al, byte [0xc26f2c72]
add byte [eax - 0x1d765103], al
hlt
out dx, eax
inc edx
push ecx
popal
dec esp
and eax, 0x9acde9d3
sbb al, 0x32
wait
push ss
or bl, al
test bh, dl
jp 0x418e69
or eax, 0xf1aa238f
clc
cdq
mov ebp, 0x66159154
mov al, byte [0x1075de17]
xchg ecx, eax
movsd dword es:[edi], dword [esi]
int 0x56
xor eax, 0x66fc6383
mov esp, 0xecb8067d
and al, 0xed
mov edi, 0x6889063
jne 0x418de3
lahf
enter 0xffffffffffffcaed, 0xffffffffffffffd5
push ds
or ecx, dword [ebx + esi - 0x4fb734d2]
cmp dword [edx + 0x5267d2c8], edi
mov dl, 0x99
add dword [ecx], edi
mov dword [0xded84d0c], eax
sbb ecx, dword [ebp + 0x1849ea09]
fsub dword [esi + ebp*2 + 0x6a]
add esp, esp
nop
mov esi, 0x18c9009b
add dword [eax + 3], esi
in eax, dx
dec esp
sub esp, ebx
lodsb al, byte [esi]
clc
push ecx
sub al, 0xf0
aam 0x48
cmc
fisubr word [edx - 0x70164d01]
push ecx
or al, 0x66
fnstenv [ebx + 0x4f42a788]
ret 0xf462
Function at 0x41aed3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 0x10]
shl ebx, 4
add ebx, dword [ebp + 0xc]
cmp dword [ebx + 4], 0
jne 0x41af56
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, dword [edx + 0x490]
xor ecx, ecx
push 0x2a
push ecx
lea edx, [ebp - 0x2a]
push edx
mov dword [ebp - 0x40], 0x430020
mov dword [ebp - 0x3c], 0x6f006f
mov dword [ebp - 0x38], 0x69006b
mov dword [ebp - 0x34], 0x730065
mov dword [ebp - 0x30], 0xa000d
mov word [ebp - 0x2c], cx
call fcn.0042bd03
lea eax, [ebp - 0x40]
push eax
call fcn.0042bea3
mov esi, eax
mov eax, dword [ebx + 8]
add esi, esi
lea ecx, [esi + 2]
push ecx
lea edx, [ebp - 0x40]
push edx
lea ecx, [eax + edi + 0x14ec14]
push ecx
call fcn.0042bc83
add esp, 0x1c
pop edi
mov dword [ebx + 4], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b7c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push esi
push ss
out 0x86, eax
in al, 0xc5
and al, 0x18
sbb byte [esi - 0x5e], 0x67
sub byte [edx - 0x90caa70], 0x4b
add bh, byte [ebx + 1]
scasd eax, dword es:[edi]
test byte [ebp - 0x2042cdb7], ah
jbe 0x41b85c
pushal
adc al, 0x8f
in eax, 0x58
mov ebp, 0xeebe3810
xchg dword [edx + 0x326245e6], edx
sub edx, dword [esi - 0x37]
sahf
cmp al, 0xe8
mov word [edi + 0x78], fs
sub al, 0xb6
invalid
out dx, eax
inc edx
xchg ebx, eax
or dword [edi - 0x48], ecx
fsubr qword [ebp - 0x29]
arpl word [ebx], bp
enter 0x40bd, 0x57
add eax, dword [ebp + 2]
jge 0x41b8cf
insb byte es:[edi], dx
insb byte es:[edi], dx
mov al, 0xfb
adc eax, 0xe9f7035c
and al, byte [esi - 0x65]
invalid
stosb byte es:[edi], al
xchg ah, bh
mov eax, dword [0xa75aef0b]
daa
in al, dx
mov al, 0x1e
mov eax, 0xe59ac716
retf 0xd1e7
Function at 0x41d073
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
xor eax, eax
push ebx
push esi
push 0x5f
push eax
mov dword [ebp - 0x29], eax
mov dword [ebp - 0x25], eax
mov byte [ebp - 0x21], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 8], al
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov byte [ebp - 0x110], al
lea eax, [ebp - 0x10f]
push eax
mov dword [ebp - 0x30], 0x656d616e
mov word [ebp - 0x2c], 0x203a
mov byte [ebp - 0x2a], 0
mov dword [ebp - 0x20], 0x756c6176
mov dword [ebp - 0x1c], 0x203a65
mov dword [ebp - 0x10], 0x65746164
mov dword [ebp - 0xc], 0x656d6974
mov dword [ebp - 0x130], 0x454c4553
mov dword [ebp - 0x12c], 0x6e205443
mov dword [ebp - 0x128], 0x2c656d61
mov dword [ebp - 0x124], 0x6c617620
mov dword [ebp - 0x120], 0x46206575
mov dword [ebp - 0x11c], 0x204d4f52
mov dword [ebp - 0x118], 0x6f747561
mov dword [ebp - 0x114], 0x6c6c6966
call fcn.0042bd03
push 0x27
lea ecx, [ebp - 0x57]
push 0
push ecx
mov dword [ebp - 0xb0], 0x454c4553
mov dword [ebp - 0xac], 0x68205443
mov dword [ebp - 0xa8], 0x5f74736f
mov dword [ebp - 0xa4], 0x2c79656b
mov dword [ebp - 0xa0], 0x74617020
mov dword [ebp - 0x9c], 0x69202c68
mov dword [ebp - 0x98], 0x65735f73
mov dword [ebp - 0x94], 0x65727563
mov dword [ebp - 0x90], 0x7865202c
mov dword [ebp - 0x8c], 0x65726970
mov dword [ebp - 0x88], 0x74755f73
mov dword [ebp - 0x84], 0x6e202c63
mov dword [ebp - 0x80], 0x2c656d61
mov dword [ebp - 0x7c], 0x6c617620
mov dword [ebp - 0x78], 0x202c6575
mov dword [ebp - 0x74], 0x72636e65
mov dword [ebp - 0x70], 0x65747079
mov dword [ebp - 0x6c], 0x61765f64
mov dword [ebp - 0x68], 0x2065756c
mov dword [ebp - 0x64], 0x4d4f5246
mov dword [ebp - 0x60], 0x6f6f6320
mov dword [ebp - 0x5c], 0x7365696b
mov byte [ebp - 0x58], 0
call fcn.0042bd03
lea edx, [ebp - 0x30]
push edx
call fcn.0042be83
mov esi, dword [ebp + 0xc]
inc eax
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0xac]
push ecx
call fcn.0042bc83
lea edx, [ebp - 0x20]
push edx
call fcn.0042be83
inc eax
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0xbc]
push ecx
call fcn.0042bc83
lea edx, [ebp - 0x10]
push edx
call fcn.0042be83
inc eax
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0xcc]
push ecx
call fcn.0042bc83
lea edx, [ebp - 0xb0]
add esp, 0x48
push edx
call fcn.0042be83
inc eax
push eax
lea eax, [ebp - 0xb0]
push eax
lea ecx, [esi + 0x1dc]
push ecx
call fcn.0042bc83
lea edx, [ebp - 0x130]
push edx
call fcn.0042be83
inc eax
push eax
lea eax, [ebp - 0x130]
push eax
add esi, 0x25c
push esi
call fcn.0042bc83
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d323
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x400
push esi
call fcn.0042bcb3
mov edi, dword [ebp + 0x14]
xor eax, eax
push edi
mov word [ebp - 8], 9
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x10], 0x45555254
mov byte [ebp - 0xc], al
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
mov dword [ebp - 0x18], 0x534c4146
mov dword [ebp - 0x14], 0x45
call fcn.0042be83
push eax
push edi
push esi
call fcn.0042bc83
push 0
lea ecx, [ebp - 8]
push ecx
push esi
call fcn.0042bfb3
push 0
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0042bfb3
push 0
lea eax, [ebp - 8]
push eax
push esi
call fcn.0042bfb3
mov ecx, dword [ebp + 0x18]
push 0
push ecx
push esi
call fcn.0042bfb3
add esp, 0x48
push 0
lea edx, [ebp - 8]
push edx
push esi
call fcn.0042bfb3
mov eax, dword [ebp + 0x1c]
add esp, 0xc
cmp byte [eax], 0x30
push 0
jne 0x41d3ca
lea ecx, [ebp - 0x18]
push ecx
jmp 0x41d3ce
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0042bfb3
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push esi
call fcn.0042bfb3
mov ecx, dword [ebp + 0x20]
push 0
push ecx
push esi
call fcn.0042bfb3
push 0
lea edx, [ebp - 8]
push edx
push esi
call fcn.0042bfb3
mov eax, dword [ebp + 0x24]
push 0
push eax
push esi
call fcn.0042bfb3
push 0
lea ecx, [ebp - 8]
push ecx
push esi
call fcn.0042bfb3
mov edi, dword [ebp + 8]
push 0xb
push 0
push 0
push esi
push edi
call fcn.00420d33
mov edx, dword [ebp + 0x30]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x10]
add esp, 0x50
push 0xb
push edx
mov edx, dword [ecx + 0x3c4]
push eax
push edx
push esi
push edi
call fcn.00420ec3
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x420d33
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
xor edx, edx
push 0x3a
push edx
lea eax, [ebp - 0x7a]
push eax
mov edi, 3
mov dword [ebp - 0x80], 0xa000d
mov word [ebp - 0x7c], dx
call fcn.0042bd03
mov eax, dword [ebp + 0x18]
add esp, 0xc
cmp eax, 0x1024
jne 0x420d71
mov edi, 5
jmp 0x420d9f
cmp eax, 8
jne 0x420d7b
lea edi, [eax + 1]
jmp 0x420d9f
cmp eax, 0x32
jne 0x420d85
lea edi, [eax - 0x2e]
jmp 0x420d9f
cmp eax, 0x64
jne 0x420d8f
lea edi, [eax - 0x5d]
jmp 0x420d9f
cmp eax, 0xb
jne 0x420d98
mov edi, eax
jmp 0x420d9f
cmp eax, 0xa
jne 0x420d9f
mov edi, eax
xor eax, eax
mov dword [ebp - 0x40], 0x520020
mov dword [ebp - 0x3c], 0x630065
mov dword [ebp - 0x38], 0x76006f
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0xd0079
mov dword [ebp - 0x2c], 0xa
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], eax
je 0x420e7e
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x420e7e
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x654]
push 6
lea ecx, [ebp - 0x80]
push ecx
push edx
call fcn.0042bc83
mov eax, dword [esi + 0x654]
push 0
push ebx
push eax
call fcn.0042c013
lea ecx, [ebp - 0x40]
push ecx
call fcn.0042bea3
mov ecx, dword [esi + 0x654]
add esp, 0x1c
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x40]
push eax
push ecx
call fcn.0042bea3
mov edx, dword [esi + 0x654]
lea eax, [edx + eax*2]
add esp, 4
push eax
call fcn.0042bc83
mov ecx, dword [esi + 0x654]
push ecx
call fcn.0042bea3
add eax, eax
push edi
push esi
mov dword [esi + 0x624], eax
call fcn.0041af63
add esp, 0x18
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x420eb3
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x654]
push eax
push edx
call fcn.0042c363
mov eax, dword [esi + 0x654]
push eax
call fcn.0042bea3
add eax, eax
push edi
push esi
mov dword [esi + 0x624], eax
call fcn.0041af63
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421433
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x708
push ebx
push esi
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x706]
push ecx
mov word [ebp - 0x708], ax
call fcn.0042bd03
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x306]
push eax
mov word [ebp - 0x308], dx
call fcn.0042bd03
push 0x7f
lea ecx, [ebp - 0xff]
push 0
push ecx
mov byte [ebp - 0x100], 0
call fcn.0042bd03
lea edx, [ebp - 0x100]
push edx
call fcn.0040c3b3
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x708]
push ecx
push esi
call fcn.00418493
mov ebx, dword [ebp + 0x10]
add esp, 0x38
cmp ebx, 0x16
jne 0x42150e
lea edx, [ebp - 0x100]
push edx
call fcn.0040cdf3
add esp, 4
push 1
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x708]
push ecx
call fcn.0042bea3
add esp, 4
lea edx, [ebp + eax*2 - 0x708]
push edx
push esi
call fcn.00418493
lea eax, [ebp - 0x708]
push eax
call fcn.0042bea3
add esp, 0x14
xor ecx, ecx
mov word [ebp + eax*2 - 0x72c], cx
jmp 0x4215a3
cmp ebx, 0x1024
jne 0x4215a3
xor eax, eax
push 0x46
push eax
lea ecx, [ebp - 0x46]
push ecx
mov dword [ebp - 0x80], 0x4f005c
mov dword [ebp - 0x7c], 0x650070
mov dword [ebp - 0x78], 0x610072
mov dword [ebp - 0x74], 0x530020
mov dword [ebp - 0x70], 0x66006f
mov dword [ebp - 0x6c], 0x770074
mov dword [ebp - 0x68], 0x720061
mov dword [ebp - 0x64], 0x5c0065
mov dword [ebp - 0x60], 0x70004f
mov dword [ebp - 0x5c], 0x720065
mov dword [ebp - 0x58], 0x200061
mov dword [ebp - 0x54], 0x740053
mov dword [ebp - 0x50], 0x620061
mov dword [ebp - 0x4c], 0x65006c
mov word [ebp - 0x48], ax
call fcn.0042bd03
push 0
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x708]
push eax
call fcn.0042c013
add esp, 0x18
lea ecx, [ebp - 0x708]
push ecx
call fcn.0042bea3
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x708]
push eax
lea ecx, [ebp - 0x308]
push ecx
call fcn.0042bc83
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x421673
lea edx, [ebp - 0x308]
push edx
push esi
call fcn.0041b773
add esp, 8
test eax, eax
je 0x421673
push edi
xor edi, edi
lea esp, [esp]
lea eax, [ebp - 0x708]
push eax
call fcn.0042bea3
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x708]
push edx
lea eax, [ebp - 0x308]
push eax
call fcn.0042bc83
push 0
push edi
lea ecx, [ebp - 0x308]
push ecx
push esi
call fcn.00427943
add esp, 0x20
test eax, eax
je 0x421661
cmp ebx, 0x1024
jne 0x421642
mov dword [esi + 0x6ac], 1
jmp 0x42164c
mov dword [esi + 0x670], 1
mov eax, dword [ebp + 0xc]
push ebx
lea edx, [ebp - 0x308]
push edx
push eax
push esi
call fcn.004210b3
add esp, 0x10
inc edi
cmp edi, 8
jb 0x4215f3
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421bd3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x421cb6
cmp byte [edi], 0
je 0x421cb6
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 0x40], 0x23222120
mov dword [ebp - 0x3c], 0x27262524
mov dword [ebp - 0x38], 0x2b2a2928
mov dword [ebp - 0x34], 0x2f2e2d2c
mov dword [ebp - 0x30], 0x3d3c3b3a
mov dword [ebp - 0x2c], 0x5b403f3e
mov dword [ebp - 0x28], 0x5f5e5d5c
mov dword [ebp - 0x24], 0x7d7c7b60
mov dword [ebp - 0x20], 0x90a0d7e
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
call fcn.0042be83
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
call fcn.0042be83
add esp, 8
xor esi, esi
test ebx, ebx
je 0x421ca1
mov dl, byte [esi + edi]
xor ecx, ecx
test eax, eax
je 0x421c7e
mov edi, edi
cmp dl, byte [ebp + ecx - 0x40]
je 0x421c9c
inc ecx
cmp ecx, eax
jb 0x421c73
cmp dl, 0x30
jb 0x421cad
cmp dl, 0x39
jbe 0x421c8d
cmp dl, 0x41
jb 0x421cad
cmp dl, 0x5a
jbe 0x421c97
cmp dl, 0x61
jb 0x421cad
cmp dl, 0x7a
ja 0x421cad
inc esi
cmp esi, ebx
jb 0x421c68
pop esi
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4235c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push esi
push edi
push 0x2c
lea ecx, [ebp - 0x6c]
push 0
push ecx
mov esi, 6
mov dword [ebp - 0x80], 0xa000d
mov dword [ebp - 0x7c], 0x5f005f
mov dword [ebp - 0x78], 0x610056
mov dword [ebp - 0x74], 0x6c0075
mov dword [ebp - 0x70], 0x74
call fcn.0042bd03
push 0x2c
lea eax, [ebp - 0xac]
push 0
push eax
mov dword [ebp - 0xc0], 0xa000d
mov dword [ebp - 0xbc], 0x650049
mov dword [ebp - 0xb8], 0x700078
mov dword [ebp - 0xb4], 0x6f006c
mov dword [ebp - 0xb0], 0x72
call fcn.0042bd03
xor eax, eax
mov word [ebp - 0x18], ax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov eax, dword [ebp + 0x10]
add esp, 0x18
mov dword [ebp - 0x40], 0xa000d
mov dword [ebp - 0x3c], 0x75004f
mov dword [ebp - 0x38], 0x6c0074
mov dword [ebp - 0x34], 0x6f006f
mov dword [ebp - 0x30], 0x20006b
mov dword [ebp - 0x2c], 0x650052
mov dword [ebp - 0x28], 0x6f0063
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x790072
mov dword [ebp - 0x1c], 0xa000d
cmp eax, 0x512
jne 0x4236c4
lea ecx, [ebp - 0x80]
push ecx
mov esi, 1
call fcn.0042bea3
lea edx, [ebp - 0x80]
jmp 0x4236df
cmp eax, 0x128
jne 0x4236ef
lea ecx, [ebp - 0x80]
push ecx
mov esi, 2
call fcn.0042bea3
lea edx, [ebp - 0xc0]
add eax, eax
push eax
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.0042bc83
add esp, 0x10
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x654]
push 0x2a
lea ecx, [ebp - 0x40]
push ecx
push edx
call fcn.0042bc83
push esi
push edi
mov dword [edi + 0x624], 0x28
call fcn.0041af63
add esp, 0x14
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423723
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [esi + 0xc]
xor ecx, ecx
push edi
mov edi, dword [esi + 0x10]
mov dword [ebp - 0x77], eax
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov dword [ebp - 0x6b], eax
mov dword [ebp - 0x67], eax
mov dword [ebp - 0x63], eax
mov dword [ebp - 0x5f], eax
mov word [ebp - 0x5b], ax
mov byte [ebp - 0x59], al
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov dword [ebp - 0x46], eax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov word [ebp - 0x3a], ax
mov eax, dword [esi + 8]
mov word [ebp - 0x1c], cx
mov word [ebp - 0x48], cx
lea ecx, [esi + 0x14]
add eax, esi
push edi
push ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebx + 0x654]
mov dword [ebp - 4], eax
lea eax, [edi + 2]
push ecx
mov byte [ebp - 0x78], 0
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x20], 0xa000d
mov dword [ebp - 0x58], 0x610050
mov dword [ebp - 0x54], 0x730073
mov dword [ebp - 0x50], 0x6f0077
mov dword [ebp - 0x4c], 0x640072
mov dword [ebp + 0xc], edx
mov dword [ebx + 0x624], eax
call fcn.0042bc83
mov eax, dword [ebx + 0x654]
push 4
lea edx, [ebp - 0x38]
shr edi, 1
push edx
lea ecx, [eax + edi*2]
push ecx
call fcn.0042bc83
push 6
push ebx
call fcn.0041af63
add esp, 0x20
cmp dword [esi + 4], 4
jne 0x42383d
mov edi, dword [ebp - 4]
mov eax, dword [edi]
lea edx, [ebp - 0x78]
push edx
push 0x20
push 0
push eax
lea ecx, [ebx + 0x8fc]
push ecx
call fcn.0042bdc3
lea edx, [ebp - 0x78]
push edx
push edi
call fcn.0042c363
push edi
call fcn.0042bea3
mov esi, eax
add esp, 0x20
add esi, esi
jmp 0x4238a4
mov ecx, dword [ebp - 8]
push 0
lea eax, [ebp - 0x58]
push eax
push ecx
call fcn.0042c443
add esp, 0xc
test eax, eax
je 0x42386f
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp - 4]
push edx
push esi
push ebx
call fcn.00423503
push esi
call fcn.0042bea3
add esp, 0x10
add eax, eax
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 0xc]
xor eax, eax
shr esi, 1
je 0x42389e
mov edx, dword [ebp - 4]
movzx ecx, word [edx + eax*2]
test cx, cx
je 0x42388c
test ecx, 0xff00
je 0x423895
mov ecx, 0x20
mov word [edx + eax*2], cx
inc eax
cmp eax, esi
jb 0x423878
mov edi, edx
jmp 0x4238a1
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebx + 0x654]
push esi
push edi
push edx
call fcn.0042bc83
mov edx, dword [ebx + 0x654]
mov eax, esi
shr eax, 1
push 6
lea ecx, [ebp - 0x20]
push ecx
lea eax, [edx + eax*2]
push eax
call fcn.0042bc83
push 6
add esi, 4
push ebx
mov dword [ebx + 0x624], esi
call fcn.0041af63
add esp, 0x20
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret