joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c49c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x1c], 0x68
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x54
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0x43
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x42
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x4d
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x57
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x79
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x64
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x74
lea eax, [ebp - 0x1c]
push eax
call fcn.0040c19b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c5b2
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret

Function at 0x40c5b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 8], 0
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x4f
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x6e
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x78
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x57
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x74
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x75
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x4d
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x70
lea eax, [ebp - 0x14]
push eax
call fcn.0040c19b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c661
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret
Function at 0x40c666
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 1
call fcn.0040c0fb
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c730
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x67
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x43
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x6c
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x6f
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x4b
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x52
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x79
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x73
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40c727
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40c735
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 1
call fcn.0040c0fb
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c843
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x43
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x78
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x57
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x4b
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x79
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x67
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x45
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x52
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40c83a
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40c848
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 1
call fcn.0040c0fb
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c934
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x67
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x78
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x45
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x4b
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x4f
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x52
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x57
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x6e
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x79
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x70
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40c92b
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40c939
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 1
call fcn.0040c0fb
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ca49
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x79
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x45
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x51
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x52
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x75
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x56
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x67
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x75
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x20], 0x57
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x78
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x65
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40ca40
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40ca4e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 1
call fcn.0040c0fb
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cb48
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x56
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x45
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x78
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x53
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x57
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x67
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x52
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40cb3f
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40cb4d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0xc], 0
call fcn.0040c23b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cc57
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x68
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x46
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x20], 0x41
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x53
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x64
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x50
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x48
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x47
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40cc4e
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40ccc4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 8], 0
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x20], 0x6d
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x73
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x54
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x53
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x54
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x74
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x20], 0x54
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x69
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x79
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0x14
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x46
lea eax, [ebp - 0x20]
push eax
call fcn.0040c19b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cdd9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret
Function at 0x40cdde
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x1c], 0x79
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x64
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x54
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0x42
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x68
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x4d
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x57
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x43
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x6c
lea eax, [ebp - 0x1c]
push eax
call fcn.0040c19b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cefa
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret
Function at 0x41d732
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42fdf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00416680
mov dword [ebp - 0x14], eax
cmp dword [0x43178c], edi
jne 0x41d823
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41d7b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41d903
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41d903
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d903
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x43178c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x431790], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x431794], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43179c], eax
test eax, eax
je 0x41d820
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x431798], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41d848
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41d83b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41d85d
push 4
pop eax
jmp 0x41d905
cmp dword [ebp - 0x14], edi
je 0x41d85d
push dword [0x43178c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41d842
mov eax, dword [0x431798]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x41d8bb
cmp dword [0x43179c], esi
je 0x41d8bb
push eax
call ebx
push dword [0x43179c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41d8bb
test eax, eax
je 0x41d8bb
call ecx
test eax, eax
je 0x41d8b0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41d8b0
test byte [ebp - 8], 1
jne 0x41d8bb
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41d8eb
mov eax, dword [0x431790]
cmp eax, esi
je 0x41d8e8
push eax
call ebx
test eax, eax
je 0x41d8e8
call eax
mov edi, eax
test edi, edi
je 0x41d8e8
mov eax, dword [0x431794]
cmp eax, esi
je 0x41d8e8
push eax
call ebx
test eax, eax
je 0x41d8e8
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x43178c]
call ebx
test eax, eax
je 0x41d903
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41d905
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bb03
leave
ret
Function at 0x348cfeff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x348cff0e
pop dword [ebp - 0x38]
mov eax, 0x348cff0e
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x366e4
push 0
mov eax, 0x9b7c7242
sub eax, 0x66f360ea
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x4708
mov ebx, eax
mov esi, 0xc3131ff9
add esi, 0x717a4007
add esi, dword [ebp - 0x38]
mov edx, 0x53532a74
sub edx, 0xb6a56347
sub dword [ebp - 0x34], ebx
mov edi, dword [esi]
sub dword [ebp - 0x14], eax
sub edi, edx
xor dword [ebp - 0x10], eax
mov dword [ebx], edi
xor dword [ebp - 0x30], esi
add ebx, 0x501ccaa5
sub ebx, 0x501ccaa1
add esi, 0x318bb689
add esi, 0xce74497b
loop 0x348cff62
add eax, 0x7aeacc05
add eax, 0x851642ee
mov ebx, eax
add eax, 0xe09ac5aa
add eax, 0x1f653a5b
mov ecx, 0xf8a745ba
add ecx, 0x3be1ba46
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x100603ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x100603ba
pop dword [ebp - 0x24]
mov eax, 0x3c2f0d9c
sub eax, 0x2c2909e2
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x48889186
sub dword [ebp - 0x34], 0xfa364c3b
mov dword [ebp - 0x30], 0xcca210dc
sub dword [ebp - 0x30], 0x9a6ec497
mov dword [ebp - 0x2c], 0xa3fef7a3
add dword [ebp - 0x2c], 0xa84d4c8b
mov dword [ebp - 0x28], 0x50edeefa
sub dword [ebp - 0x28], 0x50edeefa
lea eax, [ebp - 0x34]
push eax
mov eax, 0x9812a4d4
add eax, 0x77f45c38
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xa8582d4c
add dword [ebp - 0x34], 0xcc1a3c0a
mov dword [ebp - 0x30], 0x4b7f6ee8
add dword [ebp - 0x30], 0xf5ecf28d
mov dword [ebp - 0x2c], 0xa4179501
sub dword [ebp - 0x2c], 0x40a82895
mov dword [ebp - 0x28], 0xa2542d22
add dword [ebp - 0x28], 0x5dabd2de
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x6d78c
push 0
call eax
mov ecx, 0xcc436212
add ecx, 0x33bcfe03
mov esi, eax
mov edi, 0xe508ebdb
add edi, 0x2aff6025
add edi, dword [ebp - 0x24]
mov ebx, 0x76b26c73
sub ebx, 0x976ecc9d
add dword [ebp - 0x14], edx
mov edx, dword [edi]
sub dword [ebp - 8], 0x9689b133
xor edx, ebx
sub dword [ebp - 4], ebx
mov dword [esi], edx
sub dword [ebp - 0x1c], 0x4c77156a
add esi, 0x94be4f59
sub esi, 0x94be4f55
add edi, 0xab32718e
add edi, 0x54cd8e76
loop 0x100604d7
add eax, 0xb200ae81
sub eax, 0xb1ff3b5a
mov ebx, eax
add eax, 0xf3ec5f45
sub eax, 0xf3ec5f40
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x403f10
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret