joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408300
Capabilities:
Encode data using xor

Disassembly:
test esi, esi
jne 0x408307
xor eax, eax
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add eax, 0x71ac741f
xor eax, 0xac184502
add eax, 0x435ceea9
xor eax, 0x3719ae3b
sub eax, 0x71ac741f
xor ebx, ebx
lea esp, [esp]
mov edx, eax
mov cl, bl
add cl, 2
movzx ecx, cl
rol edx, cl
inc ebx
add edx, 0x71ac741f
mov eax, edx
mov ecx, edx
shl ecx, 0x10
and eax, 0xff00
add eax, ecx
mov ecx, edx
shr ecx, 8
shl eax, 8
and ecx, 0xff00
add eax, ecx
shr edx, 0x18
add eax, edx
xor eax, 0x7ac9127b
add eax, 0x71ac741f
rol eax, 1
mov edx, eax
and edx, 0xff00
mov ecx, eax
shl ecx, 0x10
add edx, ecx
mov ecx, eax
shl edx, 8
shr ecx, 8
and ecx, 0xff00
add edx, ecx
shr eax, 0x18
add edx, eax
xor edx, 0x26ce8100
cmp ebx, 0x18
mov eax, edx
jle 0x408330
lea edx, [eax - 0x53e7bafe]
xor ebx, ebx
jmp 0x4083b0
mov al, bl
add al, 2
movzx ecx, al
rol edx, cl
inc ebx
sub edx, 0x53e7bafe
mov eax, edx
mov ecx, edx
shl ecx, 0x10
and eax, 0xff00
add eax, ecx
mov ecx, edx
shr ecx, 8
and ecx, 0xff00
shr edx, 0x18
shl eax, 8
add eax, ecx
add eax, edx
xor eax, 0x7ac9127b
sub eax, 0x53e7bafe
ror eax, 2
mov edx, eax
and edx, 0xff00
mov ecx, eax
shl ecx, 0x10
add edx, ecx
mov ecx, eax
shl edx, 8
shr ecx, 8
and ecx, 0xff00
add edx, ecx
shr eax, 0x18
add edx, eax
xor edx, 0x3bff35dd
cmp ebx, 0x18
jle 0x4083b0
mov dword [esi], 0x2143446
mov eax, 1
pop ebx
ret

Function at 0x408430
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
push edi
xor edi, edi
lea esi, [esp + 0xc]
mov dword [esp + 0xc], edi
call fcn.00408300
mov ebx, dword [esp + 0xc]
test bl, 1
jne 0x408451
lea edx, [ebx + 2]
jmp 0x408458
mov edx, 2
sub edx, ebx
mov eax, ebx
and eax, 0xff00
mov ecx, ebx
shl ecx, 0x10
add eax, ecx
mov ecx, ebx
shr ecx, 8
and ecx, 0xff00
shl eax, 8
add eax, ecx
mov ecx, ebx
shr ecx, 0x18
mov dword [esp + 0xc], edi
movzx esi, bl
lea edi, [eax + ecx]
mov al, byte [esp + 0xc]
add al, 2
movzx ecx, al
rol edx, cl
add edx, ebx
mov eax, edx
mov ecx, edx
shl ecx, 0x10
and eax, 0xff00
add eax, ecx
mov ecx, edx
shr ecx, 8
shl eax, 8
and ecx, 0xff00
add eax, ecx
shr edx, 0x18
add eax, edx
xor eax, 0x7ac9127b
add eax, ebx
mov ecx, esi
ror eax, cl
mov edx, eax
and edx, 0xff00
mov ecx, eax
shl ecx, 0x10
add edx, ecx
mov ecx, eax
shl edx, 8
shr ecx, 8
and ecx, 0xff00
add edx, ecx
shr eax, 0x18
add edx, eax
mov eax, dword [esp + 0xc]
xor edx, edi
inc eax
xor edx, 0x39ba2d71
cmp eax, 0x18
mov dword [esp + 0xc], eax
jle 0x408485
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov dword [eax], edx
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x408510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x10], eax
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
mov byte [esp + 4], 0x57
mov byte [esp + 5], 0xb4
mov byte [esp + 6], 0x28
mov byte [esp + 7], 0xd5
mov byte [esp + 8], 0x44
mov byte [esp + 9], 0x87
mov byte [esp + 0xa], 0xd1
mov byte [esp + 0xb], 0x24
mov byte [esp + 0xc], 0x98
mov byte [esp + 0xd], 0xf1
mov byte [esp + 0xe], 0x42
mov byte [esp + 0xf], 0x3d
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0xa
mov byte [esp + 0x12], 0x25
mov byte [esp + 0x13], 0xde
cmp ecx, 0x10
jb 0x408586
push 0xffffffffffffffff
push 0x10
mov ecx, edi
call fcn.00401d40
jmp 0x408594
mov eax, 0x10
push 0
sub eax, ecx
call fcn.00406a00
cmp dword [edi + 0x18], 0x10
jb 0x40859f
mov edi, dword [edi + 4]
jmp 0x4085a2
add edi, 4
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
pop edi
xor ecx, esp
mov eax, 1
call fcn.00415dd3
add esp, 0x14
ret
Function at 0x408900
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
sub esp, 0x148
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
push ebp
mov ebp, dword [esp + 0x154]
push esi
push edi
test ebp, ebp
jne 0x40892a
xor eax, eax
jmp 0x408adb
push 0x124
xor edi, edi
lea eax, [esp + 0x20]
push edi
push eax
call fcn.00417ce0
mov al, 0x65
add esp, 0xc
mov byte [esp + 0x144], al
mov byte [esp + 0x146], al
xor eax, eax
push eax
push 2
mov byte [esp + 0x148], 0x44
mov byte [esp + 0x149], 0x4e
mov byte [esp + 0x14a], 0x46
mov byte [esp + 0x14b], 0x2e
mov byte [esp + 0x14d], 0x78
mov byte [esp + 0x14f], 0
mov byte [esp + 0x150], 0
mov dword [esp + 0x151], eax
mov dword [esp + 0x155], eax
mov word [esp + 0x159], ax
mov byte [esp + 0x15b], al
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x18]
mov esi, eax
push ecx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4089f9
jmp 0x4089d0
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.004163bc
add esp, 8
test eax, eax
jne 0x4089ea
inc edi
lea ecx, [esp + 0x18]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4089d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x408923
lea esi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.00408300
mov ebx, dword [esp + 0x14]
test bl, 1
jne 0x408a27
lea edx, [ebx + edi]
jmp 0x408a2b
sub edi, ebx
mov edx, edi
mov eax, ebx
shl eax, 0x10
mov ecx, ebx
and ecx, 0xff00
add eax, ecx
mov ecx, ebx
shr ecx, 8
and ecx, 0xff00
shl eax, 8
add eax, ecx
mov ecx, ebx
shr ecx, 0x18
mov dword [esp + 0x14], 0
movzx esi, bl
lea edi, [eax + ecx]
mov al, byte [esp + 0x14]
add al, 2
movzx ecx, al
rol edx, cl
add edx, ebx
mov eax, edx
mov ecx, edx
and ecx, 0xff00
shl eax, 0x10
add eax, ecx
mov ecx, edx
shr ecx, 8
shl eax, 8
and ecx, 0xff00
add eax, ecx
shr edx, 0x18
add eax, edx
xor eax, 0x7ac9127b
add eax, ebx
mov ecx, esi
ror eax, cl
mov edx, eax
shl edx, 0x10
mov ecx, eax
and ecx, 0xff00
add edx, ecx
mov ecx, eax
shl edx, 8
shr ecx, 8
and ecx, 0xff00
add edx, ecx
shr eax, 0x18
add edx, eax
mov eax, dword [esp + 0x14]
xor edx, edi
inc eax
xor edx, 0x39ba2d71
cmp eax, 0x18
mov dword [esp + 0x14], eax
jle 0x408a5d
mov dword [ebp], edx
mov eax, 1
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415dd3
add esp, 0x148
ret
Function at 0x408b00
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x10c
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x19]
push ebx
push eax
mov esi, ecx
mov edi, edx
mov byte [esp + 0x20], bl
call fcn.00417ce0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0x14]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408b50
sub eax, edx
mov ebp, eax
cmp ebp, ebx
jg 0x408b63
xor eax, eax
jmp 0x408bcc
lea esi, [esp + 0x10]
mov dword [esp + 0x10], ebx
call fcn.00408300
mov ecx, dword [edi + 0x14]
cmp ebp, ecx
ja 0x408b83
push 0xffffffffffffffff
push ebp
mov ecx, edi
call fcn.00401d40
jmp 0x408b8d
mov eax, ebp
push ebx
sub eax, ecx
call fcn.00406a00
xor esi, esi
cmp ebp, ebx
jle 0x408bc7
mov eax, dword [esp + 0x10]
mov bl, byte [esp + esi + 0x14]
add bl, al
xor bl, byte [esp + 0x12]
sub bl, ah
xor bl, byte [esp + 0x13]
cmp esi, dword [edi + 0x14]
jbe 0x408bb1
call fcn.004160be
cmp dword [edi + 0x18], 0x10
jb 0x408bbc
mov eax, dword [edi + 4]
jmp 0x408bbf
lea eax, [edi + 4]
mov byte [eax + esi], bl
inc esi
cmp esi, ebp
jl 0x408b93
mov eax, 1
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415dd3
add esp, 0x10c
ret
Function at 0x40a2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
xor edi, edi
cmp ebp, edi
jne 0x40a2f1
pop edi
xor eax, eax
pop ebp
ret
push ebx
push esi
lea esi, [esp + 0x14]
mov dword [esp + 0x14], edi
call fcn.00408300
mov ebx, dword [esp + 0x14]
test bl, 1
jne 0x40a30e
lea edx, [ebx + ebx]
jmp 0x40a310
xor edx, edx
mov eax, ebx
and eax, 0xff00
mov ecx, ebx
shl ecx, 0x10
add eax, ecx
mov ecx, ebx
shr ecx, 8
and ecx, 0xff00
shl eax, 8
add eax, ecx
mov ecx, ebx
shr ecx, 0x18
mov dword [esp + 0x14], edi
movzx esi, bl
lea edi, [eax + ecx]
lea ecx, [ecx]
mov al, byte [esp + 0x14]
add al, 2
movzx ecx, al
rol edx, cl
add edx, ebx
mov eax, edx
mov ecx, edx
shl ecx, 0x10
and eax, 0xff00
add eax, ecx
mov ecx, edx
shr ecx, 8
shl eax, 8
and ecx, 0xff00
add eax, ecx
shr edx, 0x18
add eax, edx
xor eax, 0x7ac9127b
add eax, ebx
mov ecx, esi
ror eax, cl
mov edx, eax
and edx, 0xff00
mov ecx, eax
shl ecx, 0x10
add edx, ecx
mov ecx, eax
shl edx, 8
shr ecx, 8
and ecx, 0xff00
add edx, ecx
shr eax, 0x18
add edx, eax
mov eax, dword [esp + 0x14]
xor edx, edi
inc eax
xor edx, 0x39ba2d71
cmp eax, 0x18
mov dword [esp + 0x14], eax
jle 0x40a340
pop esi
pop ebx
pop edi
mov dword [ebp], edx
mov eax, 1
pop ebp
ret

Function at 0x40a3d0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
mov esi, ecx
test esi, esi
je 0x40a463
test ebx, ebx
jle 0x40a463
xor eax, eax
push 0x48
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
call fcn.00417ce0
push esi
mov eax, ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0040a4a0
add esp, 0x10
lea esi, [esp + 8]
mov ecx, edi
call fcn.0040a550
mov eax, 1
pop esi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00415dd3
add esp, 0x68
ret
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00415dd3
add esp, 0x68
ret
Function at 0x40af20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
push 0x81
lea eax, [esp + 0xc]
push eax
mov esi, ecx
call fcn.00401ac0
mov cl, 0x2e
mov al, 0x55
mov byte [esp + 0x2f], cl
mov byte [esp + 0x3d], cl
push 0x104
lea ecx, [esp + 0xc]
mov dl, 0x37
push 0x23
mov byte [esp + 0x32], al
mov byte [esp + 0x3d], al
mov byte [esp + 0x40], al
push ecx
mov ecx, esi
lea eax, [esp + 0x2c]
mov byte [esp + 0x2c], 0xa4
mov byte [esp + 0x2d], 0xf2
mov byte [esp + 0x2e], 0x22
mov byte [esp + 0x2f], 0x2d
mov byte [esp + 0x30], 0x52
mov byte [esp + 0x31], 0x4f
mov byte [esp + 0x32], 0x4e
mov byte [esp + 0x33], 0x36
mov byte [esp + 0x34], 0x54
mov byte [esp + 0x35], 0x7c
mov byte [esp + 0x37], 0x5b
mov byte [esp + 0x38], 0x47
mov byte [esp + 0x39], 0x75
mov byte [esp + 0x3a], dl
mov byte [esp + 0x3c], 0x22
mov byte [esp + 0x3d], 0x2d
mov byte [esp + 0x3e], 0x46
mov byte [esp + 0x3f], 0x6a
mov byte [esp + 0x40], 0x48
mov byte [esp + 0x42], 0x3b
mov byte [esp + 0x43], 0x72
mov byte [esp + 0x45], 0x58
mov byte [esp + 0x46], 0x47
mov byte [esp + 0x47], 0x75
mov byte [esp + 0x48], dl
mov byte [esp + 0x4a], 0x39
mov byte [esp + 0x4b], 0x29
mov byte [esp + 0x4c], 0x57
mov byte [esp + 0x4d], 0x7b
mov byte [esp + 0x4e], 0xaf
call fcn.00401b80
mov esi, eax
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x40b01b
push eax
call fcn.004160ce
add esp, 4
mov edx, dword [esp + 8]
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004160ce
mov ecx, dword [esp + 0x48]
add esp, 4
mov eax, esi
pop esi
xor ecx, esp
call fcn.00415dd3
add esp, 0x48
ret

Function at 0x40b140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push 0xea
lea eax, [esp + 8]
push eax
mov esi, ecx
call fcn.00401ac0
mov al, 0x20
push 0x104
lea ecx, [esp + 8]
push 0x15
mov byte [esp + 0x2a], al
mov byte [esp + 0x2d], al
mov byte [esp + 0x30], al
push ecx
mov ecx, esi
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0xcf
mov byte [esp + 0x29], 0x99
mov byte [esp + 0x2a], 0x49
mov byte [esp + 0x2b], 0x46
mov byte [esp + 0x2c], 0x3e
mov byte [esp + 0x2d], 0x47
mov byte [esp + 0x2f], 0x56
mov byte [esp + 0x30], 0x3f
mov byte [esp + 0x32], 0x50
mov byte [esp + 0x33], 0x2f
mov byte [esp + 0x35], 0xe
mov byte [esp + 0x36], 0x22
mov byte [esp + 0x37], 1
mov byte [esp + 0x38], 0x5e
mov byte [esp + 0x39], 7
mov byte [esp + 0x3a], 0x24
mov byte [esp + 0x3b], 0x19
mov byte [esp + 0x3c], 0xc4
call fcn.00401b80
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x40b1f5
push eax
call fcn.004160ce
add esp, 4
mov edx, dword [esp + 4]
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.004160ce
mov ecx, dword [esp + 0x38]
add esp, 4
mov eax, esi
pop esi
xor ecx, esp
call fcn.00415dd3
add esp, 0x38
ret
Function at 0x40b230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push 0xad
lea eax, [esp + 0xc]
push eax
mov esi, ecx
call fcn.00401ac0
push 0x104
mov al, 0x67
lea ecx, [esp + 0xc]
push 0x13
mov byte [esp + 0x2f], al
mov byte [esp + 0x32], al
push ecx
mov ecx, esi
lea eax, [esp + 0x2c]
mov byte [esp + 0x2c], 0x88
mov byte [esp + 0x2d], 0xde
mov byte [esp + 0x2e], 0xe
mov byte [esp + 0x2f], 1
mov byte [esp + 0x30], 0x7d
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x78
mov byte [esp + 0x34], 0x17
mov byte [esp + 0x35], 0x68
mov byte [esp + 0x37], 0x49
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], 0x46
mov byte [esp + 0x3a], 0x19
mov byte [esp + 0x3b], 0x40
mov byte [esp + 0x3c], 0x63
mov byte [esp + 0x3d], 0x5e
mov byte [esp + 0x3e], 0x83
call fcn.00401b80
mov esi, eax
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x40b2dc
push eax
call fcn.004160ce
add esp, 4
mov edx, dword [esp + 8]
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004160ce
mov ecx, dword [esp + 0x38]
add esp, 4
mov eax, esi
pop esi
xor ecx, esp
call fcn.00415dd3
add esp, 0x38
ret

Function at 0x40b320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x50
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push 0xbd
lea eax, [esp + 0xc]
push eax
mov esi, ecx
call fcn.00401ac0
mov al, 0x56
mov cl, 0x98
mov dl, 0x75
mov byte [esp + 0x20], cl
mov byte [esp + 0x29], al
mov byte [esp + 0x2d], al
mov byte [esp + 0x3b], al
mov byte [esp + 0x3e], cl
mov byte [esp + 0x41], cl
push 0x104
mov al, 0xd9
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], dl
mov byte [esp + 0x3b], dl
mov dl, 0x67
push 0x2a
mov byte [esp + 0x47], al
mov byte [esp + 0x4a], al
push ecx
mov ecx, esi
lea eax, [esp + 0x2c]
mov byte [esp + 0x2d], 0xce
mov byte [esp + 0x2e], 0x1e
mov byte [esp + 0x2f], 0x11
mov byte [esp + 0x30], 0xf
mov byte [esp + 0x31], 0x54
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x12
mov byte [esp + 0x34], 0x7f
mov byte [esp + 0x36], 0x77
mov byte [esp + 0x37], 0x59
mov byte [esp + 0x3a], 9
mov byte [esp + 0x3b], 0x50
mov byte [esp + 0x3c], 0x73
mov byte [esp + 0x3d], 0x4e
mov byte [esp + 0x3e], 0x1e
mov byte [esp + 0x3f], 0x11
mov byte [esp + 0x40], 0xe
mov byte [esp + 0x41], 0x19
mov byte [esp + 0x42], 0xb
mov byte [esp + 0x44], 0xc
mov byte [esp + 0x45], 0x65
mov byte [esp + 0x46], 0x6d
mov byte [esp + 0x48], 0x69
mov byte [esp + 0x49], dl
mov byte [esp + 0x4c], 0x90
mov byte [esp + 0x4f], 0xa
mov byte [esp + 0x50], 0xb
mov byte [esp + 0x51], 0x73
mov byte [esp + 0x52], 0x1a
mov byte [esp + 0x53], 0x79
mov byte [esp + 0x54], dl
mov byte [esp + 0x55], 0x93
call fcn.00401b80
mov esi, eax
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x40b43d
push eax
call fcn.004160ce
add esp, 4
mov edx, dword [esp + 8]
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004160ce
mov ecx, dword [esp + 0x50]
add esp, 4
mov eax, esi
pop esi
xor ecx, esp
call fcn.00415dd3
add esp, 0x50
ret
Function at 0x40b550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x50
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push 0xcf
lea eax, [esp + 0xc]
push eax
mov esi, ecx
call fcn.00401ac0
mov dl, 0x22
mov cl, 1
mov al, 0x74
mov byte [esp + 0x29], dl
mov byte [esp + 0x2f], dl
mov byte [esp + 0x39], dl
mov dl, 0x70
mov byte [esp + 0x30], cl
mov byte [esp + 0x3e], cl
mov byte [esp + 0x48], cl
push 0x104
lea ecx, [esp + 0xc]
mov byte [esp + 0x3e], dl
mov byte [esp + 0x44], dl
mov dl, 0x1a
push 0x2c
mov byte [esp + 0x2e], al
mov byte [esp + 0x3e], al
mov byte [esp + 0x4a], al
mov byte [esp + 0x51], al
push ecx
mov ecx, esi
lea eax, [esp + 0x2c]
mov byte [esp + 0x2c], 0xea
mov byte [esp + 0x2d], 0xbc
mov byte [esp + 0x2e], 0x6c
mov byte [esp + 0x2f], 0x63
mov byte [esp + 0x30], 0x1c
mov byte [esp + 0x31], 0xa
mov byte [esp + 0x33], 0x12
mov byte [esp + 0x34], 0x71
mov byte [esp + 0x36], 5
mov byte [esp + 0x37], 0x2b
mov byte [esp + 0x38], 7
mov byte [esp + 0x39], 0x24
mov byte [esp + 0x3a], 0x7b
mov byte [esp + 0x3d], 0x3c
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x63
mov byte [esp + 0x40], 0x1c
mov byte [esp + 0x41], 0xa
mov byte [esp + 0x43], 0x12
mov byte [esp + 0x44], 0x71
mov byte [esp + 0x47], 6
mov byte [esp + 0x48], 0x1d
mov byte [esp + 0x49], 0x1b
mov byte [esp + 0x4b], 0x65
mov byte [esp + 0x4d], dl
mov byte [esp + 0x4f], 0x3d
mov byte [esp + 0x50], dl
mov byte [esp + 0x51], 0x10
mov byte [esp + 0x52], 0xfc
mov byte [esp + 0x53], 0xfd
mov byte [esp + 0x56], 0x6e
mov byte [esp + 0x57], 0x6c
call fcn.00401b80
mov esi, eax
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x40b675
push eax
call fcn.004160ce
add esp, 4
mov edx, dword [esp + 8]
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004160ce
mov ecx, dword [esp + 0x50]
add esp, 4
mov eax, esi
pop esi
xor ecx, esp
call fcn.00415dd3
add esp, 0x50
ret
Function at 0x40b7c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
push 0xe9
lea eax, [esp + 8]
push eax
mov esi, ecx
call fcn.00401ac0
mov cl, 0x39
mov byte [esp + 0x20], cl
mov al, 0x53
mov byte [esp + 0x38], cl
mov byte [esp + 0x3c], cl
push 0x104
mov dl, 0x45
lea ecx, [esp + 8]
push 0x25
mov byte [esp + 0x2c], al
mov byte [esp + 0x2e], al
mov byte [esp + 0x36], al
push ecx
mov ecx, esi
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0xcc
mov byte [esp + 0x29], 0x9a
mov byte [esp + 0x2a], 0x4a
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2d], 0x2b
mov byte [esp + 0x2e], 0x3c
mov byte [esp + 0x2f], 0x22
mov byte [esp + 0x31], 0x2c
mov byte [esp + 0x33], 0x24
mov byte [esp + 0x34], 0x3d
mov byte [esp + 0x35], 0x44
mov byte [esp + 0x36], 0x23
mov byte [esp + 0x37], 0x55
mov byte [esp + 0x38], 0x3c
mov byte [esp + 0x39], 0x23
mov byte [esp + 0x3b], 0x2c
mov byte [esp + 0x3c], 0x26
mov byte [esp + 0x3d], 9
mov byte [esp + 0x3e], 0x24
mov byte [esp + 0x3f], dl
mov byte [esp + 0x40], 0x4a
mov byte [esp + 0x41], dl
mov byte [esp + 0x42], 0x5b
mov byte [esp + 0x43], 0x52
mov byte [esp + 0x45], 1
mov byte [esp + 0x46], 0x3b
mov byte [esp + 0x47], 0x43
mov byte [esp + 0x49], 0x37
mov byte [esp + 0x4a], 0x51
mov byte [esp + 0x4b], 0x2d
mov byte [esp + 0x4c], 0xc7
call fcn.00401b80
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x40b8c3
push eax
call fcn.004160ce
add esp, 4
mov edx, dword [esp + 4]
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.004160ce
mov ecx, dword [esp + 0x48]
add esp, 4
mov eax, esi
pop esi
xor ecx, esp
call fcn.00415dd3
add esp, 0x48
ret
Function at 0x40bdb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
push 0xd4
lea eax, [esp + 0xc]
push eax
mov esi, ecx
call fcn.00401ac0
mov cl, 3
mov dl, 0x35
mov byte [esp + 0x2a], cl
mov al, 0x66
mov byte [esp + 0x34], cl
mov byte [esp + 0x40], cl
push 0x104
lea ecx, [esp + 0xc]
mov byte [esp + 0x31], dl
mov byte [esp + 0x3b], dl
mov dl, 0xd
push 0x23
mov byte [esp + 0x34], al
mov byte [esp + 0x3e], al
mov byte [esp + 0x46], al
push ecx
mov ecx, esi
lea eax, [esp + 0x2c]
mov byte [esp + 0x2c], 0xf1
mov byte [esp + 0x2d], 0xa7
mov byte [esp + 0x2e], 0x77
mov byte [esp + 0x2f], 0x78
mov byte [esp + 0x30], 7
mov byte [esp + 0x31], 0x17
mov byte [esp + 0x32], 0x6f
mov byte [esp + 0x33], 0x73
mov byte [esp + 0x34], 0x1a
mov byte [esp + 0x35], 0x60
mov byte [esp + 0x37], 0x76
mov byte [esp + 0x3a], 0x77
mov byte [esp + 0x3b], 0x78
mov byte [esp + 0x3c], 0x13
mov byte [esp + 0x3d], 0x3f
mov byte [esp + 0x3e], 0x1b
mov byte [esp + 0x3f], 0x1c
mov byte [esp + 0x41], 0x76
mov byte [esp + 0x44], 0xd4
mov byte [esp + 0x45], dl
mov byte [esp + 0x46], 0x68
mov byte [esp + 0x47], 0x18
mov byte [esp + 0x48], 4
mov byte [esp + 0x49], 0x2c
mov byte [esp + 0x4b], dl
mov byte [esp + 0x4d], 0x23
mov byte [esp + 0x4e], 0xfa
call fcn.00401b80
mov esi, eax
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x40beaa
push eax
call fcn.004160ce
add esp, 4
mov edx, dword [esp + 8]
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004160ce
mov ecx, dword [esp + 0x48]
add esp, 4
mov eax, esi
pop esi
xor ecx, esp
call fcn.00415dd3
add esp, 0x48
ret
Function at 0x40bfc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
push 0xca
lea eax, [esp + 8]
push eax
mov esi, ecx
call fcn.00401ac0
mov cl, 0x1c
mov byte [esp + 0x26], cl
mov al, 0x7f
mov byte [esp + 0x38], cl
mov byte [esp + 0x3e], cl
push 0x104
mov dl, 0x2e
lea ecx, [esp + 8]
push 0x25
mov byte [esp + 0x2f], al
mov byte [esp + 0x38], al
mov byte [esp + 0x47], al
push ecx
mov ecx, esi
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0xef
mov byte [esp + 0x29], 0xb9
mov byte [esp + 0x2a], 0x69
mov byte [esp + 0x2b], 0x66
mov byte [esp + 0x2c], 0x19
mov byte [esp + 0x2d], 9
mov byte [esp + 0x2e], 0x71
mov byte [esp + 0x2f], 0x6d
mov byte [esp + 0x30], 0x79
mov byte [esp + 0x31], dl
mov byte [esp + 0x34], 0x75
mov byte [esp + 0x35], 0x62
mov byte [esp + 0x36], 0xca
mov byte [esp + 0x37], 0x7b
mov byte [esp + 0x38], 0x76
mov byte [esp + 0x39], dl
mov byte [esp + 0x3a], 0x18
mov byte [esp + 0x3b], 0x1b
mov byte [esp + 0x3d], 0x77
mov byte [esp + 0x3e], 0xc
mov byte [esp + 0x3f], 0x10
mov byte [esp + 0x40], 0x69
mov byte [esp + 0x41], 0x66
mov byte [esp + 0x42], 0xd
mov byte [esp + 0x43], 0x21
mov byte [esp + 0x45], 0x12
mov byte [esp + 0x46], 0x1a
mov byte [esp + 0x47], 8
mov byte [esp + 0x48], 0x79
mov byte [esp + 0x49], dl
mov byte [esp + 0x4c], 0xe4
call fcn.00401b80
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x40c0c3
push eax
call fcn.004160ce
add esp, 4
mov edx, dword [esp + 4]
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.004160ce
mov ecx, dword [esp + 0x48]
add esp, 4
mov eax, esi
pop esi
xor ecx, esp
call fcn.00415dd3
add esp, 0x48
ret