joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4922d9
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x50
mov eax, dword [0x4a9018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], 0
push ecx
mov dword [ebp - 4], 1
call fcn.004045d0
call fcn.00412590
lea eax, [ebp - 0x20]
mov dword [ebp - 0x58], 1
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
push eax
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x1e], 0x336c6c65
mov dword [ebp - 0x18], 0x6c6c64
mov word [ebp - 0x20], 0x6873
mov word [ebp - 0x1a], 0x2e32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x54], esi
test esi, esi
je 0x405307
push 0x2bf
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
mov dword [0x4afb1c], edx
test edx, edx
je 0x40523c
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebx + 8]
call fcn.0040ff20
push eax
call edx
lea eax, [ebp - 0x38]
mov word [ebp - 0x31], 0x776f
push eax
push esi
mov dword [ebp - 0x2e], 0x646c6f46
mov dword [ebp - 0x36], 0x4b746547
mov word [ebp - 0x2a], 0x7265
mov dword [ebp - 0x27], 0x687461
mov word [ebp - 0x38], 0x4853
mov byte [ebp - 0x32], 0x6e
mov byte [ebp - 0x2f], 0x6e
mov byte [ebp - 0x28], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4afb18], eax
test eax, eax
je 0x405300
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
lea ecx, [ebp - 0x4c]
push ecx
call eax
test eax, eax
jne 0x405300
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x405300
mov ecx, eax
mov word [ebp - 0x3c], 0x7325
mov byte [ebp - 0x3a], 0
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4052b0
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jle 0x4052cc
xor eax, eax
jmp 0x4052ea
lea esi, [ecx + ecx]
mov eax, esi
call fcn.0041ca90
mov ecx, esp
call fcn.00411900
mov edx, dword [ebp - 0x50]
push eax
push esi
call fcn.00411620
mov esi, dword [ebp - 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
push edi
call fcn.00410dc0
mov ecx, dword [ebp - 0x50]
add esp, 0xc
call fcn.004181a0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebx + 8]
call fcn.00412020
mov eax, edi
lea esp, [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041c0d2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x405c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492431
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x4a9018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
mov ecx, esp
mov dword [ebp - 0xa4], esp
push 0x4a51d0
mov word [ebp - 0x55], 0x2e45
mov dword [ebp - 0x5a], 0x4f4c5058
mov dword [ebp - 0x5e], 0x45495c73
mov word [ebp - 0x6c], 0x7372
mov dword [ebp - 0x72], 0x746e6572
mov dword [ebp - 0x84], 0x6f736f72
mov dword [ebp - 0x63], 0x74615020
mov dword [ebp - 0x89], 0x694d5c45
mov word [ebp - 0x69], 0x6e6f
mov word [ebp - 0x7a], 0x6f64
mov word [ebp - 0x66], 0x7041
mov dword [ebp - 0x7f], 0x69575c74
mov byte [ebp - 0x85], 0x63
mov word [ebp - 0x8b], 0x5241
mov byte [ebp - 0x80], 0x66
mov dword [ebp - 0x78], 0x435c7377
mov word [ebp - 0x6e], 0x6556
mov word [ebp - 0x74], 0x7275
mov byte [ebp - 0x64], 0x70
mov byte [ebp - 0x56], 0x52
mov dword [ebp - 0x90], 0x54464f53
mov dword [ebp - 0x53], 0x455845
mov byte [ebp - 0x6a], 0x69
mov byte [ebp - 0x5f], 0x68
mov byte [ebp - 0x7b], 0x6e
mov byte [ebp - 0x8c], 0x57
mov byte [ebp - 0x67], 0x5c
call fcn.00411bd0
push ecx
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
mov ecx, esp
push eax
call fcn.00411bd0
mov edx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004050c0
add esp, 8
test al, al
jne 0x405e6b
push ecx
lea ecx, [ebp - 0x94]
mov word [ebp - 0x15], 0x45
mov dword [ebp - 0x1a], 0x452e4552
mov word [ebp - 0x1f], 0x5845
mov byte [ebp - 0x16], 0x58
mov word [ebp - 0x1c], 0x4f4c
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1d], 0x50
mov word [ebp - 0x2e], 0x6235
mov dword [ebp - 0x35], 0x3932622d
mov word [ebp - 0x2b], 0x3233
mov dword [ebp - 0x47], 0x65353039
mov dword [ebp - 0x28], 0x31326433
mov word [ebp - 0x37], 0x6534
mov word [ebp - 0x23], 0x7d
mov word [ebp - 0x43], 0x3336
mov word [ebp - 0x3a], 0x342d
mov word [ebp - 0x31], 0x2d63
mov byte [ebp - 0x48], 0x7b
mov word [ebp - 0x3d], 0x6231
mov byte [ebp - 0x3b], 0x66
mov word [ebp - 0x40], 0x2d36
mov byte [ebp - 0x41], 0x62
mov byte [ebp - 0x2c], 0x37
mov byte [ebp - 0x2f], 0x36
mov byte [ebp - 0x3e], 0x63
mov byte [ebp - 0x24], 0x61
mov byte [ebp - 0x38], 0x39
mov byte [ebp - 0x29], 0x64
call fcn.004045d0
push ecx
lea eax, [ebp - 0x48]
mov ecx, esp
push eax
call fcn.00411bd0
lea ecx, [ebp - 0x94]
call fcn.00405170
add esp, 4
push 0x4a5210
lea edx, [ebp - 0x94]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x9c]
call fcn.004101b0
add esp, 4
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x98]
call fcn.004101b0
add esp, 4
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.004107e0
lea ecx, [ebp - 0x98]
call fcn.00412020
lea ecx, [ebp - 0x9c]
call fcn.00412020
lea ecx, [ebp - 0x94]
call fcn.00412020
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c0d2
mov esp, ebp
pop ebp
ret
Function at 0x405e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49246d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4a9018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004045d0
call fcn.00412590
mov dword [ebp - 4], 0
call fcn.00404f80
push ecx
push esi
test eax, eax
mov dword [ebp - 0x26], 0x656c676f
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1e], 0x656d6f
mov ecx, esp
mov dword [ebp - 0x22], 0x72684320
setne bh
mov word [ebp - 0x28], 0x6f47
push eax
mov dword [ebp - 0x18], 0x6f726843
xor bl, bl
mov word [ebp - 0x13], 0x65
mov byte [ebp - 0x14], 0x6d
call fcn.00411bd0
mov dl, bl
mov cl, dl
call fcn.004058a0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x405ffd
push ecx
push esi
push ecx
mov byte [ebp - 0x2d], al
mov ecx, esp
lea eax, [ebp - 0x28]
mov bl, 1
push eax
call fcn.00411bd0
mov cl, byte [ebp - 0x2d]
mov dl, bl
call fcn.004058a0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x405ffd
test bh, bh
je 0x405f83
push ecx
push esi
push ecx
lea eax, [ebp - 0x28]
mov byte [ebp - 0x2d], 1
mov ecx, esp
push eax
call fcn.00411bd0
mov cl, byte [ebp - 0x2d]
mov dl, bl
call fcn.004058a0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x405ffd
push ecx
push esi
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
xor bl, bl
push eax
mov byte [ebp - 0x2d], bl
call fcn.00411bd0
mov dl, bl
mov cl, bl
call fcn.004058a0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x405ffd
push ecx
push esi
push ecx
mov byte [ebp - 0x2d], al
mov ecx, esp
lea eax, [ebp - 0x18]
mov bl, 1
push eax
call fcn.00411bd0
mov cl, byte [ebp - 0x2d]
mov dl, bl
call fcn.004058a0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x405ffd
test bh, bh
je 0x405ff4
push ecx
push esi
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
mov bh, 1
call fcn.00411bd0
mov dl, bl
mov cl, bh
call fcn.004058a0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x405ffd
mov ecx, esi
call fcn.00405400
mov bl, al
lea ecx, [ebp - 0x2c]
mov byte [edi], 0
call fcn.00412020
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c0d2
mov esp, ebp
pop ebp
ret
Function at 0x406560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492555
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4a9018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x15], 0x36363037
mov dword [ebp - 0x1b], 0x2e302e36
mov word [ebp - 0x17], 0x2e35
mov byte [ebp - 0x1c], 0x36
mov byte [ebp - 0x11], 0
call fcn.004045d0
lea eax, [ebp - 0x1c]
push eax
call fcn.00411bd0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00410820
test al, al
jne 0x406699
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
call fcn.0040ff20
lea edx, [ebp - 0x30]
mov ecx, eax
call fcn.00416f50
mov ebx, eax
test ebx, ebx
je 0x406699
push ebx
call fcn.0041c79e
add esp, 4
lea ecx, [ebp + 8]
mov edi, eax
push edi
push ebx
call fcn.0040ff20
mov edx, dword [ebp - 0x30]
mov ecx, eax
call fcn.00417020
add esp, 8
test eax, eax
je 0x406690
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004170f0
add esp, 8
test eax, eax
je 0x406690
cmp dword [ebp - 0x34], 0
je 0x406690
mov ecx, dword [ebp - 0x38]
cmp dword [ecx], 0xfeef04bd
jne 0x406690
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x64252e64
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x252e6425
push eax
mov dword [ebp - 0x20], 0x64252e
call fcn.00410dc0
add esp, 0x18
push edi
call fcn.0041c33f
add esp, 4
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00411cf0
lea ecx, [ebp - 0x2c]
call fcn.00412020
lea ecx, [ebp + 8]
call fcn.00412020
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c0d2
mov esp, ebp
pop ebp
ret
Function at 0x407220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
mov eax, ecx
mov byte [esp + 0xb], 0
mov dword [esp + 0xc], eax
push esi
push edi
test eax, eax
je 0x4074c8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14c], 4
mov dword [esp + 0x150], 0
call fcn.00404bd0
mov edi, eax
mov dword [esp + 0x20], 0x128
call fcn.00417760
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4074af
lea edx, [esp + 0x20]
mov ecx, ebx
call fcn.004176e0
cmp eax, 1
jne 0x4074a8
nop dword [eax]
nop word [eax + eax]
lea eax, [esp + 0x44]
mov dword [esp + 0x263], 0x78652e72
push eax
lea eax, [esp + 0x260]
mov dword [esp + 0x260], 0x6c707865
push eax
mov word [esp + 0x269], 0x6572
mov word [esp + 0x26f], 0x65
mov byte [esp + 0x268], 0x6f
call fcn.00424ee2
add esp, 8
test eax, eax
jne 0x40739c
push dword [esp + 0x28]
call fcn.004184a0
mov esi, eax
add esp, 4
test esi, esi
je 0x40739c
lea eax, [esp + 0x18]
mov edx, 8
push eax
mov ecx, esi
call fcn.00418820
add esp, 4
test eax, eax
je 0x407395
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14c]
push eax
push dword [esp + 0x150]
lea eax, [esp + 0x158]
mov edx, 0xc
push eax
call fcn.00416d10
add esp, 0xc
test eax, eax
je 0x407362
cmp edi, dword [esp + 0x150]
je 0x4073d0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x407377
call fcn.00419810
mov dword [esp + 0x18], 0
mov ecx, esi
call fcn.00419810
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40739c
call fcn.00419810
mov dword [esp + 0x18], 0
jmp 0x40739c
mov ecx, esi
call fcn.00419810
lea edx, [esp + 0x20]
mov ecx, ebx
call fcn.00417660
cmp eax, 1
je 0x4072b0
mov ecx, ebx
call fcn.00419810
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0041c0d2
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [esp + 0x15c]
mov dword [esp + 0x158], 0
push 0
push eax
call fcn.0041e190
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x160]
add esp, 0xc
mov edx, 1
push eax
lea eax, [esp + 0x15c]
push 0x100
push eax
call fcn.00416d10
add esp, 0xc
test eax, eax
je 0x40748c
mov ecx, dword [esp + 0x158]
lea edx, [esp + 0x1c]
call fcn.00419500
test eax, eax
je 0x40748c
mov edx, dword [esp + 0x1c]
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407440
sub ecx, edi
cmp ecx, 0x104
jae 0x407485
push edx
mov byte [esp + 0x14e], al
lea eax, [esp + 0x14c]
push eax
push 0x104
push dword [esp + 0x20]
mov word [esp + 0x158], 0x7325
call fcn.00411600
mov edx, dword [esp + 0x2c]
add esp, 0x10
mov byte [esp + 0x13], 1
mov ecx, edx
call fcn.00418710
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4074a1
call fcn.00419810
mov dword [esp + 0x18], 0
mov ecx, esi
call fcn.00419810
mov ecx, ebx
call fcn.00419810
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0041c0d2
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x26c]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c0d2
mov esp, ebp
pop ebp
ret
Function at 0x407fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492757
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x4a9018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x12c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x134], esi
push ecx
mov dword [ebp - 0x130], 0
call fcn.004045d0
push 0x4a51d0
call fcn.00411bd0
push 0x104
lea eax, [ebp - 0x128]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x130], 1
call fcn.0041e190
push 0xffffffffffffffff
push str.a5f4b0c12db345269df4ba4cb036c5e5
lea eax, [ebp - 0x128]
mov dword [ebp - 0x20], 0x6b636954
push 0x104
push eax
mov dword [ebp - 0x24], 0x5f4f5353
mov word [ebp - 0x1b], 0x74
mov byte [ebp - 0x1c], 0x65
call fcn.00425d2c
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x128]
push 0x104
push eax
call fcn.00425e05
lea ecx, [ebp - 0x128]
call fcn.004115e0
mov edx, eax
lea ecx, [ebp - 0x128]
call fcn.00407f80
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x17], 0x25783830
push ecx
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0x25
push eax
push esi
mov word [ebp - 0x13], 0x73
mov dword [ebp - 0x12c], 0x74745f
call fcn.00410dc0
add esp, 0x3c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c0d2
mov esp, ebp
pop ebp
ret
Function at 0x40b0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492e5d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4a9018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 3
mov dword [ebp - 4], 0
xor bl, bl
call fcn.0043eb20
call fcn.0043eb31
push dword [ebp + 8]
mov edi, eax
push 0x2712
push edi
call fcn.00443870
push 0x40b050
push 0x4e2b
push edi
call fcn.00443870
push esi
push 0x2711
push edi
call fcn.00443870
lea eax, [ebp - 0x24]
mov dword [ebp - 0x16], 0x302e31
push eax
push 0x2722
push edi
mov dword [ebp - 0x20], 0x2d6c7275
mov dword [ebp - 0x24], 0x6362696c
mov dword [ebp - 0x1c], 0x6e656761
mov word [ebp - 0x18], 0x2f74
call fcn.00443870
push edi
call fcn.0043eb78
test eax, eax
movzx ebx, bl
mov ecx, 1
push edi
cmove ebx, ecx
call fcn.0043eb89
add esp, 0x3c
lea ecx, [ebp + 8]
call fcn.00412020
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c0d2
mov esp, ebp
pop ebp
ret
Function at 0x40cc00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49322d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4a9018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
lea ecx, [ebp - 0x48]
call fcn.004045d0
call fcn.00412590
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
push eax
push 0x400
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x4c], 0x400
mov dword [ebp - 0x18], 0x6e65704f
mov byte [ebp - 0x14], 0
call fcn.00410830
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.004195a0
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.00410800
lea ecx, [ebp - 0x48]
call fcn.004103e0
push ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x37], 0x46455249
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x38], 0x46
mov word [ebp - 0x32], 0x58
mov byte [ebp - 0x33], 0x4f
call fcn.00410410
test eax, eax
js 0x40ccb9
lea ecx, [ebp - 0x48]
call fcn.00412020
mov eax, 2
jmp 0x40cd76
push ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1e], 0x454c474f
push eax
lea ecx, [ebp - 0x48]
mov word [ebp - 0x20], 0x4f47
mov byte [ebp - 0x1a], 0
call fcn.00410410
test eax, eax
js 0x40cd0c
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x26], 0x454d4f52
push eax
lea ecx, [ebp - 0x48]
mov word [ebp - 0x28], 0x4843
mov byte [ebp - 0x22], 0
call fcn.00410410
test eax, eax
js 0x40cd0c
lea ecx, [ebp - 0x48]
call fcn.00412020
mov eax, 1
jmp 0x40cd76
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x3f], 0x45524f
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x43], 0x4c505845
mov byte [ebp - 0x44], 0x49
call fcn.00410410
test eax, eax
js 0x40cd3e
lea ecx, [ebp - 0x48]
call fcn.00412020
mov eax, 3
jmp 0x40cd76
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2f], 0x47444553
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x30], 0x4d
mov word [ebp - 0x2b], 0x45
call fcn.00410410
lea ecx, [ebp - 0x48]
test eax, eax
js 0x40cd6f
call fcn.00412020
mov eax, 4
jmp 0x40cd76
call fcn.00412020
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c0d2
mov esp, ebp
pop ebp
ret
Function at 0x40f080
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
mov dword [esp], 0
push eax
call fcn.00418aa0
mov edx, 0x20
mov ecx, eax
call fcn.00418820
add esp, 4
test eax, eax
je 0x40f103
lea eax, [esp + 4]
mov edx, str.SeDebugPrivilege
push eax
call fcn.004188c0
add esp, 4
test eax, eax
je 0x40f0fb
mov eax, dword [esp + 4]
sub esp, 0xc
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call fcn.00418950
add esp, 0x10
mov ecx, dword [esp]
call fcn.00419810
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041c0d2
add esp, 0x24
ret
Function at 0x40fdb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x58], eax
lea eax, [esp]
mov word [esp + 0x44], 0x4e20
push eax
lea eax, [esp + 8]
mov dword [esp + 0x4b], 0x75435c5c
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x3f], 0x74666f73
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x4b], 0x776f646e
push eax
lea edx, [esp + 0x38]
mov word [esp + 0x3f], 0x5c45
mov ecx, 0x80000002
mov word [esp + 0x42], 0x694d
mov dword [esp + 0x5f], 0x72655674
mov dword [esp + 0x4b], 0x69575c5c
mov word [esp + 0x3c], 0x4157
mov dword [esp + 0x5b], 0x6e657272
mov dword [esp + 0x63], 0x6e6f6973
mov word [esp + 0x45], 0x6f72
mov word [esp + 0x39], 0x464f
mov byte [esp + 0x56], 0x54
mov byte [esp + 0x41], 0x5c
mov byte [esp + 0x3b], 0x54
mov byte [esp + 0x38], 0x53
mov byte [esp + 0x53], 0x73
mov byte [esp + 0x3e], 0x52
mov byte [esp + 0x67], 0
mov byte [esp + 0x44], 0x63
mov word [esp + 0x26], 0x726f
mov dword [esp + 0x29], 0x69737265
mov word [esp + 0x2e], 0x4e6e
mov word [esp + 0x23], 0x614d
mov word [esp + 0x20], 0x6e65
mov word [esp + 0x31], 0x626d
mov word [esp + 0x1d], 0x7275
mov byte [esp + 0x1c], 0x43
mov byte [esp + 0x25], 0x6a
mov byte [esp + 0x22], 0x74
mov word [esp + 0x34], 0x72
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x28], 0x56
mov byte [esp + 0x30], 0x75
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x2d], 0x6f
mov dword [esp + 0x18], 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 4
call fcn.004175b0
mov ecx, dword [esp + 0x68]
add esp, 0x10
test eax, eax
sete al
xor ecx, esp
call fcn.0041c0d2
add esp, 0x5c
ret

Function at 0x411850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4118a6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4118a6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x411896
cmp esi, edx
jae 0x4118a6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x411884
cmp esi, edx
jae 0x4118a6
cmp word [esi], 0
je 0x4118a6
pop edi
mov eax, esi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x412840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493846
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x10e0
call fcn.0041d120
mov eax, dword [0x4a9018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10d4], edi
push ecx
lea ecx, [ebp - 0xc54]
mov dword [ebp - 0x10d4], edi
call fcn.0040f8b0
push edx
lea ecx, [ebp - 0x10ec]
call fcn.00402d10
lea edx, [ebp - 0x10ec]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xc54]
call fcn.004125e0
lea ecx, [ebp - 0x10ec]
call fcn.00403730
push 0x400
lea eax, [ebp - 0x848]
push 0
push eax
call fcn.0041e190
add esp, 0xc
lea ecx, [ebp - 0xc54]
call fcn.00412a60
mov esi, eax
xor edx, edx
test esi, esi
je 0x41291a
nop word [eax + eax]
push edx
lea ecx, [ebp - 0xc54]
call fcn.00412a50
mov al, byte [eax]
mov byte [ebp + edx - 0x848], al
inc edx
cmp edx, esi
jb 0x412900
push 0x400
lea eax, [ebp - 0xc48]
push 0
push eax
call fcn.0041e190
add esp, 0xc
lea eax, [ebp - 0x448]
xorps xmm0, xmm0
movups xmmword [ebp - 0x48], xmm0
push 0x400
push 0
push eax
call fcn.0041e190
add esp, 0xc
mov dword [ebp - 0x31], 0x41324443
lea eax, [ebp - 0x38]
mov word [ebp - 0x2d], 0x4537
mov dword [ebp - 0x21], 0x46434243
mov dword [ebp - 0x38], 0x37383843
push eax
lea eax, [ebp - 0x448]
mov word [ebp - 0x2a], 0x3646
push 0x400
push eax
mov word [ebp - 0x19], 0x39
mov word [ebp - 0x34], 0x3444
mov dword [ebp - 0x25], 0x42413436
mov word [ebp - 0x1c], 0x4638
mov word [ebp - 0x27], 0x4232
mov byte [ebp - 0x1a], 0x39
mov byte [ebp - 0x32], 0x32
mov byte [ebp - 0x1d], 0x36
mov byte [ebp - 0x2b], 0x39
mov byte [ebp - 0x28], 0x44
call fcn.00424e4f
add esp, 0xc
lea ecx, [ebp - 0x10d0]
call fcn.004141f0
push 0x10
push 0x20
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x448]
push eax
call fcn.00414240
push ecx
lea ecx, [ebp - 0xc54]
call fcn.00412a60
push eax
lea eax, [ebp - 0xc48]
push eax
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x10d0]
call fcn.00414e00
lea eax, [ebp - 0xc38]
mov ecx, edi
push eax
call fcn.00402d10
lea ecx, [ebp - 0x10d0]
call fcn.00414230
lea ecx, [ebp - 0xc54]
call fcn.00412ae0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041c0d2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x412e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4a9018]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, ecx
mov dword [esp + 0x19], 0x29616c
lea eax, [esp + 8]
mov dword [esp + 4], esi
push eax
mov dword [esp + 8], esi
mov dword [esp + 0x18], 0x697a6f4d
mov word [esp + 0xf], 0x5f53
mov dword [esp + 0x13], 0x20637465
mov word [esp + 0xc], 0x534e
mov word [esp + 0x11], 0x6e49
mov byte [esp + 0x17], 0x28
mov byte [esp + 0xe], 0x49
mov byte [esp + 0x1c], 0x6c
call fcn.00402d10
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0041c0d2
add esp, 0x20
ret