joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
push 0
lea ebp, [esi + 0x30]
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x403100
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push edi
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 8], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 8]
push eax
push ebx
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
pop edi
jne 0x40313a
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00402f50
test eax, eax
jne 0x403151
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
mov eax, dword [esp + 0x14]
push 0x104
mov edx, eax
mov word [esi + 0xe], ax
mov eax, dword [esp + 0x1c]
shr edx, 0x10
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x20]
mov word [esi + 0xc], dx
shr ecx, 0x10
mov edx, eax
mov word [esi + 0x16], ax
mov eax, dword [esp + 0x24]
mov word [esi + 0x10], cx
mov ecx, eax
mov word [esi + 0x1a], ax
mov eax, dword [esp + 0x2c]
shr ecx, 0x10
shr edx, 0x10
mov word [esi + 0x18], cx
mov ecx, dword [esp + 0x30]
mov word [esi + 0x14], dx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x24], ecx
lea ecx, [esi + 0x134]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x38]
push ecx
push str.CompanyName
mov ecx, esi
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
call fcn.00402ff0
test eax, eax
jne 0x4031db
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea edx, [esi + 0x33c]
push 0x104
push edx
push str.FileDescription
mov ecx, esi
call fcn.00402ff0
test eax, eax
jne 0x4031fe
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea eax, [esi + 0x238]
push 0x104
push eax
push str.ProductName
mov ecx, esi
call fcn.00402ff0
neg eax
sbb eax, eax
pop esi
pop ebp
pop ebx
neg eax
add esp, 0x34
ret
Function at 0x401470
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4014d2
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
sete al
ret 0x10
xor eax, eax
ret 0x10

Function at 0x401e68
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41bfe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
push edi
push 0xffffffffffffffff
lea edi, [esi + 0x10]
push 0
mov ecx, edi
call sub.MFC42.DLL_CStringArray::SetSize
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
add esi, 4
push str..
lea eax, [esp + 0x14]
push esi
push eax
mov dword [esp + 0x44], 0
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 2
call fcn.0041bb80
mov ecx, dword [esp + 0xc]
push 0
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 3
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x401f7c
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
push ebp
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov edx, dword [esp + 0x18]
push 0x10
lea ecx, [esp + 0x1c]
mov ebp, eax
call dword [edx + 0x40]
test eax, eax
je 0x401f73
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
call sub.MFC42.DLL_CFileFind::GetFileName
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 3
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
push 0x422028
push ecx
call esi
add esp, 8
test eax, eax
je 0x401f73
mov edx, dword [esp + 0xc]
push 0x422024
push edx
call esi
add esp, 8
test eax, eax
je 0x401f73
mov eax, dword [edi + 8]
lea ecx, [esp + 0xc]
push ecx
push eax
mov ecx, edi
call sub.MFC42.DLL_CStringArray::SetAtGrow
test ebp, ebp
jne 0x401ef6
pop ebp
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFileFind::Close
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x401fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41c008
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x20]
dec eax
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
jne 0x401ffe
mov dword [esp + 0x20], 0x103
mov edx, dword [esp + 0x18]
push ebx
lea ecx, [esp + 4]
push esi
push ecx
push 0x20019
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4020ce
mov ebx, dword [esp + 0x24]
mov edx, dword [esp + 8]
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push ebx
push ecx
push 0
push str.Path
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0xc], 1
jne 0x4020ce
cmp esi, 0xea
je 0x4020ce
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov cl, byte [ecx + ebx - 1]
cmp cl, 0x5c
je 0x4020a4
cmp cl, 0x2f
je 0x4020a4
mov edi, 0x42258c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc

Function at 0x402100
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x41c028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x14]
lea ecx, [esp]
push eax
push str._sDataTab
push ecx
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0xc]
add esp, 0xc
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
test eax, eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4174c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00417592
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 8], 0x41
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], bl
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6e
mov dword [ebp - 0xa8], 0x94
call fcn.004175c1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0xa8]
push ecx
call eax
test eax, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
jne 0x417552
call fcn.00417592
add esp, 0xc
xor eax, eax
jmp 0x41758f
call fcn.00417592
mov eax, dword [ebp - 0x98]
add esp, 0xc
sub eax, ebx
je 0x41758c
dec eax
je 0x41756c
dec eax
je 0x41757e
jmp 0x41754e
cmp dword [ebp - 0xa0], ebx
jne 0x417578
push 4
jmp 0x41758e
jbe 0x41757e
push 5
jmp 0x41758e
cmp dword [ebp - 0xa4], 5
sbb eax, eax
add eax, 7
jmp 0x41758f
push 3
pop eax
pop ebx
leave
ret

Function at 0x4175c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00417592
mov eax, dword [0x4267e4]
and byte [ebp - 8], 0
add esp, 0xc
cmp eax, 1
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
jne 0x417624
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4267e4], eax
leave
ret
Function at 0x41824f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x14
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00417592
and byte [ebp - 0x17], 0
add esp, 0xc
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x18], 0x65
call fcn.004175c1
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4182b7
lea ecx, [ebp - 0x10]
push ecx
call eax
push esi
push 0x14
movzx esi, word [ebp - 0x10]
movzx eax, word [ebp - 0xe]
imul esi, esi, 0xd
add esi, eax
push 0
movzx eax, word [ebp - 0xa]
imul esi, esi, 0x1e
add esi, eax
movzx eax, word [ebp - 8]
imul esi, esi, 0x1a
imul eax, eax, 0x3d
add esi, eax
movzx eax, word [ebp - 6]
add esi, eax
movzx eax, word [ebp - 4]
imul esi, esi, 0x3c
add esi, eax
movzx eax, word [ebp - 2]
imul esi, esi, 0x4d2
add esi, eax
lea eax, [ebp - 0x24]
push eax
call fcn.00417592
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x41830a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
xor ebx, ebx
push 0x11
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.00417592
add esp, 0xc
mov byte [ebp - 0x20], 0x2a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x1f], 0x89
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x49
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x25
mov byte [ebp - 0x18], 0x80
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], bl
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], bl
mov byte [ebp - 0x15], 0x51
mov byte [ebp - 5], 0x2d
mov byte [ebp - 0x14], 0xaa
mov byte [ebp - 4], bl
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], bl
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], bl
call fcn.004175c1
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x58]
push ecx
call eax
mov ax, word [ebp - 0x58]
xor ecx, ecx
mov cl, ah
mov byte [ebp - 7], al
mov ax, word [ebp - 0x56]
mov byte [ebp - 6], cl
xor ecx, ecx
mov byte [ebp - 4], al
mov cl, ah
lea eax, [ebp - 0xc8]
push eax
mov byte [ebp - 5], 0x2d
mov byte [ebp - 3], cl
call fcn.00418484
lea eax, [ebp - 0x20]
push 0x1e
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.004184ac
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041854a
add esp, 0x18
xor eax, eax
cmp byte [eax + ebp - 0x48], bl
lea ecx, [eax + ebp - 0x48]
jne 0x418446
mov byte [ecx], 1
inc eax
cmp eax, 0x10
jl 0x418439
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00419190
movzx ax, byte [ebp + 8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00418f36
push dword [ebp + 0xc]
call fcn.0041915d
push 0x1e
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.00417592
add esp, 0x20
xor eax, eax
pop ebx
leave
ret

Function at 0x418484
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x418f8f
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
xor ecx, ecx
movzx eax, byte [ecx + str.80_]
mov esi, dword [ebp + 8]
mov edx, eax
sar edx, 3
and eax, 7
mov dl, byte [esi + edx]
test byte [eax*2 + 0x425efc], dl
setne al
mov byte [ecx + ebp - 0x74], al
inc ecx
cmp ecx, 0x38
jl 0x418f9d
and dword [ebp + 8], 0
mov dword [ebp - 4], 0x1e
cmp word [ebp + 0xc], 1
jne 0x418fdd
mov eax, dword [ebp - 4]
jmp 0x418fe2
mov eax, dword [ebp + 8]
add eax, eax
and dword [ebp + eax*4 - 0xf0], 0
and dword [ebp + eax*4 - 0xf4], 0
lea ecx, [ebp + eax*4 - 0xf0]
lea esi, [ebp + eax*4 - 0xf4]
mov eax, dword [ebp + 8]
xor edx, edx
movzx eax, byte [eax + 0x425fa4]
mov edi, eax
cmp edi, 0x1c
jge 0x419019
mov bl, byte [edi + ebp - 0x74]
jmp 0x419020
mov bl, byte [edi + ebp - 0x90]
mov byte [edx + ebp - 0x3c], bl
inc edx
inc edi
cmp edx, 0x1c
jl 0x41900e
push 0x1c
pop edi
add eax, edi
cmp eax, 0x38
jge 0x41903b
mov dl, byte [eax + ebp - 0x74]
jmp 0x419042
mov dl, byte [eax + ebp - 0x90]
mov byte [edi + ebp - 0x3c], dl
inc edi
inc eax
cmp edi, 0x38
jl 0x419030
xor edi, edi
mov edx, 0x425f0c
movzx ebx, byte [edi + 0x425fb4]
lea eax, [edi + 0x425fcc]
cmp byte [ebx + ebp - 0x3c], 0
je 0x41906c
mov ebx, dword [edx]
or dword [esi], ebx
movzx eax, byte [eax]
cmp byte [eax + ebp - 0x3c], 0
je 0x41907a
mov eax, dword [edx]
or dword [ecx], eax
add edx, 4
inc edi
cmp edx, str.80_
jl 0x419054
sub dword [ebp - 4], 2
inc dword [ebp + 8]
cmp dword [ebp - 4], 0xfffffffe
jg 0x418fd1
lea eax, [ebp - 0xf4]
push eax
call fcn.004190a9
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419301
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push 0x11
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00417592
lea eax, [ebp - 0xc8]
mov byte [ebp - 0x20], 0x2a
push eax
mov byte [ebp - 0x10], 0x89
mov byte [ebp - 0x1f], 0x2f
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x22
mov byte [ebp - 0x18], 0x60
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], 0x11
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], 0x2b
mov byte [ebp - 0x15], 0x78
mov byte [ebp - 5], 0x3c
mov byte [ebp - 0x14], 0xee
mov byte [ebp - 4], 0x46
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], 0x5e
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
call fcn.00418484
lea eax, [ebp - 0x20]
push 0x1e
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.004184ac
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041854a
add esp, 0x24
xor ecx, ecx
cmp byte [ecx + ebp - 0x48], 0
lea eax, [ecx + ebp - 0x48]
jne 0x4193d0
mov byte [eax], 1
inc ecx
cmp ecx, 0x10
jl 0x4193c2
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00419190
movzx ax, byte [ebp + 8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00418f36
push dword [ebp + 0xc]
call fcn.0041915d
push 0x1e
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00417592
and byte [ebp - 0x27], 0
add esp, 0x20
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
call fcn.004175c1
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x58]
push ecx
call eax
mov cx, word [ebp - 0x58]
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dl, ch
mov byte [eax], cl
mov cx, word [ebp - 0x56]
mov byte [eax + 1], dl
xor edx, edx
mov byte [eax + 2], cl
mov dl, ch
mov byte [eax + 3], dl
leave
ret
Function at 0x419478
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x4c
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0xb], 0x31
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
call fcn.00419ef2
test eax, eax
je 0x4195ca
mov al, byte [0x426814]
cmp al, 4
jae 0x419595
mov esi, 0x80
push 0x1388
add al, 0x30
push dword [0x426810]
mov byte [ebp - 0xb], al
call fcn.0041985a
pop ecx
cmp eax, ebx
pop ecx
jne 0x4195aa
push ebx
push esi
push 3
push ebx
push 7
lea eax, [ebp - 0x14]
push 0xc0000000
push eax
call fcn.004195d1
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x419569
lea eax, [ebp - 4]
push ebx
push eax
push esi
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 0x9c406418
push edi
call fcn.0041965c
add esp, 0x20
test eax, eax
je 0x4195b7
call fcn.00419773
cmp eax, 0x57
push edi
je 0x4195b8
call fcn.004196fa
push dword [0x426810]
call fcn.004197ed
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.004198e9
add esp, 0x10
cmp eax, ebx
je 0x4195b3
jmp 0x419581
call fcn.00419773
push dword [0x426810]
mov edi, eax
call fcn.004197ed
cmp edi, 2
pop ecx
jne 0x4195a0
mov al, byte [0x426814]
inc al
cmp al, 4
mov byte [0x426814], al
jb 0x4194d9
cmp al, 3
jbe 0x4195a0
mov byte [0x426814], 1
mov eax, 0x4f1a
pop edi
pop esi
pop ebx
leave
ret
cmp eax, esi
mov eax, 0x4f1b
jmp 0x4195a5
xor eax, eax
jmp 0x4195a5
push edi
call fcn.004196fa
push dword [0x426810]
call fcn.004197ed
pop ecx
pop ecx
mov eax, 0x753c
jmp 0x4195a5

Function at 0x4195d1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00417592
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
call fcn.004175c1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x41962d
leave
ret
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00417592
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x41965c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00417592
and byte [ebp - 5], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x49
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 8], 0x72
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 6], 0x6c
call fcn.004175c1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4196c8
leave
ret
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00417592
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x4196fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00417592
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x48
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6c
call fcn.004175c1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x419756
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00417592
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x419773
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00417592
and byte [ebp - 8], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x72
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x45
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x72
call fcn.004175c1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4197d3
leave
ret
push esi
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00417592
add esp, 0xc
mov eax, esi
pop esi
leave
ret