joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4289b0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3db5
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x60dae4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x19], 0
push 1
push 0
call fcn.0040ed80
add esp, 4
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00430210
add esp, 4
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov dword [ebp - 0x40], eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x64], esp
mov edx, dword [ebp - 0x40]
push edx
call fcn.0042aeb0
mov ecx, dword [ebp - 0x28]
call fcn.0040ec20
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
sub eax, 0x10
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
call fcn.0042cb50
mov ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + 0x18]
test edx, edx
je 0x428b75
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
or eax, 0x4000000
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
or ecx, 0x80000
mov dword [ebp - 0x20], ecx
push 0
lea edx, [ebp - 0x7c]
push edx
call fcn.005a17f0
add esp, 8
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 0x10
jb 0x428ab1
mov dword [ebp - 0x30], 1
jmp 0x428ab8
mov dword [ebp - 0x30], 0
mov cl, byte [ebp - 0x30]
mov byte [ebp - 0x1a], cl
movzx edx, byte [ebp - 0x1a]
test edx, edx
je 0x428ad4
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
push 0
push 0
push str.HTTP_1.0
push 0x5ed3e4
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x20]
push edx
call fcn.00421560
add esp, 0x20
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.0042c1f0
cmp dword [ebp - 0x24], 0
je 0x428b69
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
call fcn.0059bec0
add esp, 0x14
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 4
push 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0x20000013
mov eax, dword [ebp - 0x24]
push eax
call fcn.004216d0
add esp, 0x14
cmp dword [ebp - 0x14], 0xc8
jne 0x428b69
mov byte [ebp - 0x19], 1
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0059c030
add esp, 4
mov ecx, dword [ebp - 0x28]
call fcn.005a1790
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005733f7
mov esp, ebp
pop ebp
ret
Function at 0x42ce80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42cea4
xor eax, eax
jmp 0x42cf24
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42cebb
xor eax, eax
jmp 0x42cf24
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x42cf07
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x42cf07
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x42cede
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x42cf13
xor eax, eax
jmp 0x42cf24
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x42cf21
xor eax, eax
jmp 0x42cf24
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x436ff5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x5a3fcc
call fcn.00573cb4
sub esp, 0x20
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 6
push eax
push 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 1
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x25], 0x54495c65
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov word [ebp - 0x2c], 0x6f53
mov dword [ebp - 0x29], 0x72617774
mov byte [ebp - 0x2a], 0x66
mov word [ebp - 0x21], 0x41
mov dword [ebp - 0x1c], 0x74736e49
mov dword [ebp - 0x14], 0x454964
mov dword [ebp - 0x18], 0x656c6c61
call fcn.004377ba
add esp, 0x18
lea ecx, [ebp + 8]
call fcn.004334c0
lea ecx, [ebp + 0x18]
call fcn.0042c2e0
lea ecx, [ebp + 0x30]
call fcn.0042c2e0
lea ecx, [ebp + 0x48]
call fcn.0042c2e0
lea ecx, [ebp + 0x60]
call fcn.0042c2e0
lea ecx, [ebp + 0x78]
call fcn.0042c2e0
lea ecx, [ebp + 0x90]
call fcn.0042c2e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x4371be
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x6970
push eax
mov dword [ebp - 0x10], 0x61766441
mov word [ebp - 6], 0x6c6c
mov word [ebp - 9], 0x2e32
mov byte [ebp - 7], 0x64
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x4371f5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0xd], 0x336c656e
push eax
mov dword [ebp - 9], 0x6c642e32
mov word [ebp - 5], 0x6c
mov word [ebp - 0xf], 0x7265
mov byte [ebp - 0x10], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
leave
ret

Function at 0x437225
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xb], 0x61776c68
push eax
mov word [ebp - 6], 0x2e69
mov byte [ebp - 0xc], 0x53
mov word [ebp - 3], 0x6c6c
mov byte [ebp - 4], 0x64
mov byte [ebp - 1], 0
mov byte [ebp - 7], 0x70
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x43725a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x73726556
push eax
mov dword [ebp - 6], 0x6c642e6e
mov word [ebp - 2], 0x6c
mov word [ebp - 8], 0x6f69
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x437286
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
call fcn.004371be
mov esi, eax
test esi, esi
je 0x4372f0
lea eax, [ebp - 0x18]
mov dword [ebp - 9], 0x74786574
push eax
push esi
mov dword [ebp - 0x14], 0x71634174
mov dword [ebp - 0x18], 0x70797243
mov dword [ebp - 0xe], 0x6f436572
mov word [ebp - 5], 0x41
mov word [ebp - 0x10], 0x6975
mov byte [ebp - 0xa], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4372e9
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4372f6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
call fcn.004371be
mov esi, eax
test esi, esi
je 0x437350
lea eax, [ebp - 0x10]
mov dword [ebp - 0xd], 0x65447470
push eax
push esi
mov word [ebp - 2], 0x79
mov dword [ebp - 7], 0x4b796f72
mov word [ebp - 0x10], 0x7243
mov word [ebp - 9], 0x7473
mov byte [ebp - 3], 0x65
mov byte [ebp - 0xe], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x437349
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x437356
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
call fcn.004371be
mov esi, eax
test esi, esi
je 0x4373b9
lea eax, [ebp - 0x10]
mov word [ebp - 6], 0x7470
push eax
push esi
mov dword [ebp - 0xb], 0x72636e45
mov byte [ebp - 7], 0x79
mov dword [ebp - 0xf], 0x74707972
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4373b2
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x4373bf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
call fcn.004371be
mov esi, eax
test esi, esi
je 0x437424
lea eax, [ebp - 0x14]
mov dword [ebp - 7], 0x6d6172
push eax
push esi
mov dword [ebp - 0x13], 0x74707972
mov dword [ebp - 0xe], 0x654b7465
mov word [ebp - 0xa], 0x5079
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x47
mov byte [ebp - 8], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43741d
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x43742a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
call fcn.004371be
mov esi, eax
test esi, esi
je 0x437490
lea eax, [ebp - 0x10]
mov dword [ebp - 9], 0x74726f70
push eax
push esi
mov dword [ebp - 0xd], 0x6d497470
mov word [ebp - 0xf], 0x7972
mov word [ebp - 4], 0x7965
mov byte [ebp - 2], bl
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 5], 0x4b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x437489
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x437496
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
call fcn.004371be
mov esi, eax
test esi, esi
je 0x437501
lea eax, [ebp - 0x14]
mov dword [ebp - 0x13], 0x74707972
push eax
push esi
mov word [ebp - 8], 0x6f43
mov word [ebp - 0xe], 0x6c65
mov word [ebp - 0xb], 0x7361
mov dword [ebp - 6], 0x7865746e
mov word [ebp - 2], 0x74
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 9], 0x65
mov byte [ebp - 0xf], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4374fa
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x437507
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
call fcn.004371be
mov esi, eax
test esi, esi
je 0x437561
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x74655374
push eax
push esi
mov dword [ebp - 8], 0x6d617261
mov dword [ebp - 0xc], 0x5079654b
mov dword [ebp - 0x14], 0x70797243
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43755a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x437567
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
call fcn.0043725a
mov esi, eax
test esi, esi
je 0x4375d7
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x6c694674
push eax
push esi
mov word [ebp - 7], 0x496e
mov word [ebp - 0xa], 0x6973
mov word [ebp - 0xd], 0x6556
mov dword [ebp - 5], 0x416f666e
mov byte [ebp - 0xe], 0x65
mov word [ebp - 0x14], 0x6547
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 1], bl
mov byte [ebp - 8], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4375d0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x4375dd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
call fcn.0043725a
mov esi, eax
test esi, esi
je 0x437654
lea eax, [ebp - 0x18]
mov word [ebp - 0x15], 0x6946
push eax
push esi
mov dword [ebp - 0x10], 0x69737265
mov word [ebp - 2], 0x41
mov word [ebp - 0x18], 0x6547
mov dword [ebp - 9], 0x536f666e
mov word [ebp - 5], 0x7a69
mov word [ebp - 0x13], 0x656c
mov word [ebp - 0xc], 0x6e6f
mov byte [ebp - 3], 0x65
mov byte [ebp - 0xa], 0x49
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x11], 0x56
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43764d
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x43765a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0x6c6c416c
xor ebx, ebx
mov word [ebp - 4], 0x636f
push eax
mov dword [ebp - 0xc], 0x61636f4c
mov byte [ebp - 2], bl
call fcn.004371f5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x437698
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x4376fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
inc edi
call fcn.004371be
mov esi, eax
test esi, esi
je 0x437757
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x79654b6e
push eax
push esi
mov dword [ebp - 0xf], 0x704f6765
mov dword [ebp - 6], 0x417845
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0x10], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x437750
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x43781e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
call fcn.0043725a
mov esi, eax
test esi, esi
je 0x43787f
lea eax, [ebp - 0x10]
mov word [ebp - 3], 0x41
push eax
push esi
mov dword [ebp - 8], 0x756c6156
mov word [ebp - 0xf], 0x7265
mov dword [ebp - 0xc], 0x79726575
mov byte [ebp - 4], 0x65
mov byte [ebp - 0x10], 0x56
mov byte [ebp - 0xd], 0x51
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x437878
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x437885
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov cl, byte [edi]
test cl, cl
je 0x437956
mov al, cl
push ebx
cmp al, 0x24
je 0x4378d4
cmp al, 0x26
je 0x4378d4
cmp al, 0x2b
je 0x4378d4
cmp al, 0x2c
je 0x4378d4
cmp al, 0x2f
je 0x4378d4
cmp al, 0x3a
je 0x4378d4
cmp al, 0x3b
je 0x4378d4
cmp al, 0x3d
je 0x4378d4
cmp al, 0x3f
je 0x4378d4
cmp al, 0x40
je 0x4378d4
cmp al, 0x23
je 0x4378d4
cmp al, 0x20
je 0x4378d4
mov byte [esi], cl
inc esi
jmp 0x437948
movsx eax, al
push eax
lea eax, [ebp - 8]
mov dword [ebp - 7], 0x32302525
push eax
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
mov word [ebp - 3], 0x78
push 4
push eax
mov byte [ebp - 8], 0x25
call fcn.0042bec0
lea eax, [ebp + 0xc]
xor ebx, ebx
push eax
call fcn.0057e0e0
add esp, 0x18
test eax, eax
je 0x43792b
movsx eax, byte [ebp + ebx + 0xc]
push eax
call fcn.0057ccbc
mov byte [ebp + ebx + 0xc], al
lea eax, [ebp + 0xc]
push eax
inc ebx
call fcn.0057e0e0
pop ecx
pop ecx
cmp ebx, eax
jb 0x43790c
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push esi
call fcn.0057c6dc
lea eax, [ebp + 0xc]
push eax
call fcn.0057e0e0
add esp, 0x14
add esi, eax
inc edi
mov cl, byte [edi]
mov al, cl
test cl, cl
jne 0x43789f
pop ebx
pop edi
mov byte [esi], 0
pop esi
leave
ret

Function at 0x43795d
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x5a4135
call fcn.00573cb4
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
call fcn.00436d43
lea ecx, [esi + 4]
call fcn.00436d43
lea ecx, [esi + 8]
call fcn.00436d43
lea ecx, [esi + 0xc]
call fcn.00436d43
lea ecx, [esi + 0x10]
call fcn.00436d43
lea ecx, [esi + 0x14]
call fcn.00436d43
lea ecx, [esi + 0x18]
call fcn.00436d43
lea ecx, [esi + 0x1c]
call fcn.00436d43
lea ecx, [esi + 0x20]
call fcn.00436d43
lea ecx, [esi + 0x24]
call fcn.00436d43
lea ecx, [esi + 0x28]
call fcn.00436d43
lea ecx, [esi + 0x2c]
call fcn.00436d43
lea ecx, [esi + 0x30]
call fcn.00436d43
lea ecx, [esi + 0x34]
call fcn.00436d43
lea ecx, [esi + 0x38]
call fcn.00436d43
lea ecx, [esi + 0x3c]
call fcn.00436d43
lea ecx, [esi + 0x40]
call fcn.00436d43
lea ecx, [esi + 0x44]
call fcn.00436d43
lea ecx, [esi + 0x48]
call fcn.00436d43
lea ecx, [esi + 0x4c]
call fcn.00436d43
lea ecx, [esi + 0x50]
call fcn.00436d43
lea ecx, [esi + 0x54]
call fcn.00436d43
lea ecx, [esi + 0x58]
call fcn.00436d43
lea ecx, [esi + 0x5c]
call fcn.00436d43
lea ecx, [esi + 0x60]
call fcn.00436d43
and dword [esi + 0x64], 0
mov byte [ebp - 4], 0x19
push 0x5ecfdc
lea ecx, [esi + 0x68]
call fcn.00436cf8
lea eax, [ebp + 8]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [esi + 0x6c]
call fcn.00436cdf
lea ecx, [ebp + 8]
mov byte [esi + 0x70], 1
call fcn.00436d57
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x438565
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x5a41e8
call fcn.00573cb4
sub esp, 0x460
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x3c]
push edi
call fcn.0042dc00
and dword [ebp - 4], 0
push 0x10
pop edi
mov esi, edi
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push eax
lea ecx, [ebp - 0x3c]
call fcn.00438b1a
sub esi, 1
jne 0x43858b
mov esi, dword [ebp + 8]
jmp 0x4385b5
mov byte [ebp + 0xb], al
lea ecx, [ebp - 0x3c]
lea eax, [ebp + 0xb]
push eax
call fcn.00438b1a
inc esi
mov al, byte [esi]
test al, al
jne 0x4385a5
lea eax, [ebp + 0xb]
mov byte [ebp + 0xb], 0
push eax
lea ecx, [ebp - 0x3c]
call fcn.00438b1a
sub edi, 1
jne 0x4385bb
lea ecx, [ebp - 0x3c]
call fcn.00430a00
cdq
lea ecx, [ebp - 0x3c]
and edx, 0xf
lea edi, [edx + eax]
lea eax, [ebp + 8]
and edi, 0xfffffff0
push eax
call fcn.00438abe
push edi
lea ecx, [ebp - 0x3c]
mov esi, dword [eax]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00438918
mov ecx, eax
call fcn.00438520
push esi
lea ecx, [ebp - 0x3c]
push dword [eax]
lea eax, [ebp - 0x54]
push eax
call fcn.00438adf
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x30], 0x46374633
mov word [ebp - 0x18], 0x4531
mov dword [ebp - 0x1d], 0x46314238
mov dword [ebp - 0x25], 0x33393135
mov dword [ebp - 0x16], 0x444544
mov dword [ebp - 0x2a], 0x36364341
mov dword [ebp - 0x21], 0x32444244
mov word [ebp - 0x2c], 0x4233
mov byte [ebp - 0x19], 0x34
mov byte [ebp - 0x26], 0x37
call fcn.0042dc00
mov byte [ebp - 4], 1
xor esi, esi
mov al, byte [ebp + esi - 0x30]
lea ecx, [ebp - 0x50]
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
call fcn.00438b1a
inc esi
cmp esi, 0x1d
jl 0x438663
lea ecx, [ebp - 0x50]
mov dword [ebp + 8], 0x400
call fcn.00430a00
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], eax
call fcn.00430a00
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x50]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x40]
push eax
push 0
call fcn.004309e0
push eax
lea eax, [ebp - 0x44]
push eax
push 0
lea ecx, [ebp - 0x3c]
call fcn.004309e0
push eax
mov ecx, ebx
call fcn.00438938
push dword [ebp + 8]
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00438717
add esp, 0xc
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.0042ae10
lea ecx, [ebp - 0x6c]
call fcn.0042c2e0
lea ecx, [ebp - 0x50]
call fcn.004309c0
lea ecx, [ebp - 0x3c]
call fcn.004309c0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x438717
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
mov eax, 0x5a4212
call fcn.00573cb4
sub esp, 0x54
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp + 8]
push esi
mov word [ebp - 0x60], 0x4241
mov dword [ebp - 0x56], 0x4e4d4c4b
mov word [ebp - 0x4e], 0x5453
mov dword [ebp - 0x5b], 0x49484746
mov dword [ebp - 0x37], 0x73727170
mov dword [ebp - 0x2f], 0x307a7978
mov word [ebp - 0x25], 0x3837
mov dword [ebp - 0x3b], 0x6f6e6d6c
mov dword [ebp - 0x4a], 0x5a595857
mov word [ebp - 0x2a], 0x3332
mov word [ebp - 0x5d], 0x4544
mov dword [ebp - 0x43], 0x67666564
mov dword [ebp - 0x3f], 0x6b6a6968
mov word [ebp - 0x22], 0x2f2b
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x5e], 0x43
mov dword [ebp - 0x33], 0x77767574
mov word [ebp - 0x51], 0x5150
mov word [ebp - 0x46], 0x6261
mov byte [ebp - 0x57], 0x4a
mov byte [ebp - 0x52], 0x4f
mov byte [ebp - 0x23], 0x39
mov word [ebp - 0x4c], 0x5655
mov word [ebp - 0x27], 0x3635
mov byte [ebp - 0x28], 0x34
mov byte [ebp - 0x44], 0x63
mov byte [ebp - 0x4f], 0x52
mov byte [ebp - 0x2b], 0x31
call fcn.0042afb0
mov eax, dword [ebp + 0x10]
mov esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x438907
push edi
push 3
pop edi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + esi - 0x14], al
inc esi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp esi, edi
jne 0x43886a
mov al, cl
mov esi, ebx
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], ch
movzx eax, byte [ebp + esi - 0x18]
mov ecx, dword [ebp + 8]
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.0042cb30
inc esi
cmp esi, 4
jl 0x438846
mov dl, byte [ebp - 0xd]
mov esi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4387ec
test esi, esi
je 0x438906
cmp esi, edi
jge 0x43889e
mov eax, edi
sub eax, esi
push eax
lea eax, [ebp - 0x14]
add eax, esi
push ebx
push eax
call fcn.00575a80
mov ch, byte [ebp - 0x12]
add esp, 0xc
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [esi + 1]
mov byte [ebp - 0x16], dl
test eax, eax
jle 0x4388f1
lea edi, [esi + 1]
movzx eax, byte [ebp + ebx - 0x18]
mov ecx, dword [ebp + 8]
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.0042cb30
inc ebx
cmp ebx, edi
jl 0x4388d6
push 3
pop edi
cmp esi, edi
jge 0x438906
sub edi, esi
mov ecx, dword [ebp + 8]
push 0x3d
call fcn.0042cb30
sub edi, 1
jne 0x4388f7
pop edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret