joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408331
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x40
mov eax, 0x4dd384
call fcn.004c1130
mov esi, ecx
mov dword [ebp - 0x4c], esi
mov dword [esi], vtable.QSUtil::CSingleton_class_CDownloadAppGlobalCfg_.0
xor ecx, ecx
mov dword [ebp - 4], ecx
push 0xf
mov dword [esi], vtable.CDownloadAppGlobalCfg.0
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
pop edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], ecx
mov byte [esi + 0xc], cl
mov byte [ebp - 4], 1
mov dword [esi + 0x38], edx
mov dword [esi + 0x34], ecx
mov byte [esi + 0x24], cl
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x50], 7
mov dword [esi + 0x4c], ecx
mov word [esi + 0x3c], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x68], edx
mov dword [esi + 0x64], ecx
mov byte [esi + 0x54], cl
mov byte [ebp - 4], 4
mov dword [esi + 0x80], edx
mov dword [esi + 0x7c], ecx
mov byte [esi + 0x6c], cl
mov byte [ebp - 4], 5
mov dword [ebp - 0x30], 0x4242425f
mov dword [ebp - 0x34], 0x425f4214
mov dword [ebp - 0x38], 0x424d425a
mov dword [ebp - 0x3c], 0x42484259
mov dword [ebp - 0x40], 0x42614260
mov dword [ebp - 0x44], 0x42144259
mov dword [ebp - 0x48], 0x42524261
mov al, byte [ebp + ecx - 0x48]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x48], al
inc ecx
cmp ecx, 0x1c
jl 0x4083d8
lea eax, [ebp - 0x48]
push eax
call fcn.00402ce4
pop ecx
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [esi + 0x3c]
call fcn.0040394d
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004c10df
ret
Function at 0x4086f3
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x513720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
mov dword [ebp - 0x230], ecx
xor ebx, ebx
lea eax, [ebp - 0x217]
push esi
push ebx
push eax
mov byte [ebp - 0x218], bl
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x228], ebx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], ebx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test edi, edi
je 0x408867
push edi
call fcn.004bb8a9
mov esi, eax
mov dword [ebp - 0x22c], esi
pop ecx
test esi, esi
je 0x408867
push esi
push edi
push dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x408860
lea eax, [ebp - 0x224]
mov dword [ebp - 0x220], 0x5c
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x4087cf
mov dword [ebp - 0x228], ebx
jmp 0x408860
mov eax, dword [ebp - 0x228]
xor esi, esi
push 0x104
push ebx
add esi, dword [eax + 0xc]
mov edi, dword [eax + 8]
lea eax, [ebp - 0x10f]
adc edi, ebx
mov byte [ebp - 0x110], bl
push eax
mov dword [ebp - 0x234], edi
call fcn.004be330
movzx eax, si
mov ecx, 0xffff
push eax
mov eax, edi
shrd esi, eax, 0x10
shr eax, 0x10
and esi, ecx
push esi
movzx eax, di
push eax
shr edi, 0x10
lea eax, [ebp - 0x110]
and edi, ecx
push edi
push str._d._d._d._d
push 0x104
push eax
call fcn.00405487
lea eax, [ebp - 0x110]
push eax
call fcn.00401241
mov ecx, dword [ebp - 0x230]
add esp, 0x2c
add ecx, 0xc
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00401a20
mov esi, dword [ebp - 0x22c]
xor ebx, ebx
inc ebx
push esi
call fcn.004b9894
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b923d
mov esp, ebp
pop ebp
ret
Function at 0x40887a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x513720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
mov dword [ebp - 0x190], ecx
xor ebx, ebx
lea eax, [ebp - 0x12f]
push esi
push ebx
push eax
mov byte [ebp - 0x130], bl
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x130]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x130], bl
je 0x4089ac
push 0x4fe734
lea eax, [ebp - 0x130]
mov dword [ebp - 0x18c], ebx
push eax
lea eax, [ebp - 0x18c]
push eax
call fcn.004ba471
add esp, 0xc
cmp dword [ebp - 0x18c], ebx
je 0x4089ac
push 2
push ebx
push dword [ebp - 0x18c]
mov esi, ebx
call fcn.004bac15
push dword [ebp - 0x18c]
call fcn.004baab7
push esi
push esi
push dword [ebp - 0x18c]
mov ebx, eax
call fcn.004bac15
add esp, 0x1c
cmp ebx, 0xa00000
jge 0x408954
push ebx
call fcn.004b8adf
push ebx
mov esi, eax
push 0
push esi
call fcn.004be330
push dword [ebp - 0x18c]
push ebx
push 1
push esi
call fcn.004ba67b
add esp, 0x20
push dword [ebp - 0x18c]
call fcn.004bad04
pop ecx
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x28], 0
lea edi, [ebp - 0x27]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
push ebx
push esi
lea ecx, [ebp - 0x188]
call fcn.0041e727
lea eax, [ebp - 0x28]
push eax
call fcn.00401241
pop ecx
mov ecx, dword [ebp - 0x190]
push eax
lea eax, [ebp - 0x28]
add ecx, 0x24
push eax
call fcn.00401a20
test esi, esi
je 0x4089a7
push esi
call fcn.004bb670
pop ecx
xor eax, eax
inc eax
jmp 0x4089ae
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b923d
mov esp, ebp
pop ebp
ret
Function at 0x40b589
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x513720]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 8], 0x424f4f5d
mov dword [ebp - 0xc], 0x5f535072
xor ecx, ecx
mov dword [ebp - 0x10], 0x4e594a7d
mov al, byte [ebp + ecx - 0x10]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 0xc
jl 0x40b5b3
lea eax, [ebp - 0x10]
push eax
push 0x4feb94
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 4], eax
test eax, eax
je 0x40b604
call fcn.004309bb
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, eax
call fcn.00430d8d
sub esp, 0xc
lea ecx, [esi + 4]
call fcn.00433a5c
call fcn.00430ac6
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.004b923d
mov esp, ebp
pop ebp
ret
Function at 0x40b697
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x50
mov eax, 0x4dd85a
call fcn.004c1130
mov esi, ecx
mov dword [ebp - 0x5c], esi
mov dword [esi], vtable.QSUtil::CSingleton_class_CDownloadAppInstallList_.0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CDownloadAppInstallList.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [ebp - 4], 1
xor eax, eax
mov dword [esi + 0x24], 7
mov dword [esi + 0x20], ebx
mov word [esi + 0x10], ax
mov byte [ebp - 4], 2
push 0xf
pop ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x28], bl
mov byte [ebp - 4], 3
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov byte [esi + 0x40], bl
mov byte [ebp - 4], 4
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
mov byte [ebp - 4], 5
mov ecx, ebx
mov dword [ebp - 0x44], 0x42424256
mov dword [ebp - 0x48], 0x4255424a
mov dword [ebp - 0x4c], 0x4214424e
mov dword [ebp - 0x50], 0x425c425d
mov dword [ebp - 0x54], 0x427e424f
mov dword [ebp - 0x58], 0x42544279
mov al, byte [ebp + ecx - 0x58]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x58], al
inc ecx
cmp ecx, 0x18
jl 0x40b730
lea eax, [ebp - 0x58]
push eax
call fcn.00402ce4
pop ecx
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [esi + 0x10]
call fcn.0040394d
mov dword [ebp - 0x1d], 0x425b5376
mov ecx, ebx
mov word [ebp - 0x1f], 0x4f54
mov byte [ebp - 0x20], 0x79
mov al, byte [ebp + ecx - 0x20]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 7
jl 0x40b76c
lea eax, [ebp - 0x20]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x28]
call fcn.00401a20
mov dword [ebp - 0x17], 0x42555d4e
mov ecx, ebx
mov byte [ebp - 0x18], 0x79
mov al, byte [ebp + ecx - 0x18]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 5
jl 0x40b7a2
lea eax, [ebp - 0x18]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0x40]
call fcn.00401a20
mov dword [ebp - 0x24], 0x425e5956
mov dword [ebp - 0x28], 0x5d606156
mov al, byte [ebp + ebx - 0x28]
sub al, 3
xor al, 0x3f
mov byte [ebp + ebx - 0x28], al
inc ebx
cmp ebx, 8
jl 0x40b7d9
lea eax, [ebp - 0x28]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0x58]
call fcn.00401a20
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004c10df
ret
Function at 0x40bb44
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x230
mov eax, 0x4dd96e
call fcn.004c1130
mov edi, ecx
mov esi, dword [ebp + 8]
xor eax, eax
push 0x208
mov word [ebp - 0x224], ax
xor ebx, ebx
lea eax, [ebp - 0x222]
push ebx
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x224]
push ebx
push 0x23
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40bbf6
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40bb96
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jbe 0x40bbf6
lea eax, [ebp - 0x224]
push eax
call fcn.00402ce4
pop ecx
push eax
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.0040394d
lea eax, [edi + 0x10]
push eax
lea ecx, [ebp - 0x23c]
call fcn.0040c54d
pop ecx
mov dword [ebp - 4], ebx
mov ecx, esi
push 0xffffffffffffffff
push ebx
push eax
call fcn.00403ae5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
push ebx
push 1
call fcn.00403864
cmp dword [esi + 0x14], 8
jb 0x40bbfe
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call fcn.004c10df
ret 4
Function at 0x40e2b1
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push 0xc0
mov eax, 0x4ddc36
call fcn.004c119c
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
xor eax, eax
lea edi, [ebp - 0xa4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
lea ecx, [ebp - 0xa4]
call fcn.00426ac0
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x94], al
mov byte [ebp - 4], 2
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xa4]
push eax
mov ecx, ebx
call fcn.0040e726
mov dword [ebp - 0x32], 0x4242424e
mov dword [ebp - 0x36], 0x424f4259
mov dword [ebp - 0x3a], 0x4256424e
mov dword [ebp - 0x3e], 0x425d425b
mov dword [ebp - 0x42], 0x42134259
mov dword [ebp - 0x46], 0x42524261
mov word [ebp - 0x48], 0x4213
xor ecx, ecx
mov dword [ebp - 0xc0], ecx
cmp ecx, 0x1a
jge 0x40e369
movsx eax, byte [ebp + ecx - 0x48]
sub eax, 3
xor eax, 0x3f
mov byte [ebp + ecx - 0x48], al
inc ecx
jmp 0x40e34c
mov dword [ebp - 0x66], 0x42424253
mov dword [ebp - 0x6a], 0x425c4254
mov dword [ebp - 0x6e], 0x4259424e
mov dword [ebp - 0x72], 0x425d425b
mov dword [ebp - 0x76], 0x42134259
mov dword [ebp - 0x7a], 0x42524261
mov word [ebp - 0x7c], 0x4213
xor ecx, ecx
mov dword [ebp - 0xc8], ecx
cmp ecx, 0x1a
jge 0x40e3b8
movsx eax, byte [ebp + ecx - 0x7c]
sub eax, 3
xor eax, 0x3f
mov byte [ebp + ecx - 0x7c], al
inc ecx
jmp 0x40e39b
xor eax, eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
push eax
push eax
lea ecx, [ebp - 0xbc]
call fcn.004019c4
mov byte [ebp - 4], 3
xor esi, esi
mov dword [ebp - 0xc4], esi
cmp esi, 0xa
jge 0x40e46c
call fcn.0040510e
lea edi, [ebx + 0x294]
push edi
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [eax + 0x3c]
call fcn.004035b9
lea edx, [ebp - 0x48]
mov ecx, eax
call fcn.004054e1
pop ecx
pop ecx
cmp eax, 0x708
jle 0x40e45e
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xa4]
push eax
push edi
mov ecx, ebx
call fcn.0040eaec
test eax, eax
je 0x40e45e
call fcn.0040510e
lea ecx, [ebx + 0x2ac]
push ecx
lea ecx, [ebp - 0xbc]
push ecx
lea ecx, [eax + 0x3c]
call fcn.004035b9
lea edx, [ebp - 0x7c]
mov ecx, eax
call fcn.004054e1
pop ecx
pop ecx
cmp eax, 0x708
jg 0x40e486
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
jmp 0x40e3d9
xor eax, eax
jne 0x40e486
push eax
push eax
push 0x4ff6b4
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebx + 0x2ac]
push eax
mov ecx, ebx
call fcn.0040f547
mov esi, eax
mov dword [ebp - 0xcc], esi
mov byte [ebp - 4], 2
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xbc]
call fcn.004019c4
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.004019c4
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xa4]
call fcn.00427060
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004c10ee
ret
Function at 0x40e47e
Capabilities:
Terminate process

Disassembly:
push 0xc0
mov eax, 0x4ddc36
call fcn.004c119c
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
xor eax, eax
lea edi, [ebp - 0xa4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
lea ecx, [ebp - 0xa4]
call fcn.00426ac0
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x94], al
mov byte [ebp - 4], 2
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xa4]
push eax
mov ecx, ebx
call fcn.0040e726
mov dword [ebp - 0x32], 0x4242424e
mov dword [ebp - 0x36], 0x424f4259
mov dword [ebp - 0x3a], 0x4256424e
mov dword [ebp - 0x3e], 0x425d425b
mov dword [ebp - 0x42], 0x42134259
mov dword [ebp - 0x46], 0x42524261
mov word [ebp - 0x48], 0x4213
xor ecx, ecx
mov dword [ebp - 0xc0], ecx
cmp ecx, 0x1a
jge 0x40e369
movsx eax, byte [ebp + ecx - 0x48]
sub eax, 3
xor eax, 0x3f
mov byte [ebp + ecx - 0x48], al
inc ecx
jmp 0x40e34c
mov dword [ebp - 0x66], 0x42424253
mov dword [ebp - 0x6a], 0x425c4254
mov dword [ebp - 0x6e], 0x4259424e
mov dword [ebp - 0x72], 0x425d425b
mov dword [ebp - 0x76], 0x42134259
mov dword [ebp - 0x7a], 0x42524261
mov word [ebp - 0x7c], 0x4213
xor ecx, ecx
mov dword [ebp - 0xc8], ecx
cmp ecx, 0x1a
jge 0x40e3b8
movsx eax, byte [ebp + ecx - 0x7c]
sub eax, 3
xor eax, 0x3f
mov byte [ebp + ecx - 0x7c], al
inc ecx
jmp 0x40e39b
xor eax, eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
push eax
push eax
lea ecx, [ebp - 0xbc]
call fcn.004019c4
mov byte [ebp - 4], 3
xor esi, esi
mov dword [ebp - 0xc4], esi
cmp esi, 0xa
jge 0x40e46c
call fcn.0040510e
lea edi, [ebx + 0x294]
push edi
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [eax + 0x3c]
call fcn.004035b9
lea edx, [ebp - 0x48]
mov ecx, eax
call fcn.004054e1
pop ecx
pop ecx
cmp eax, 0x708
jle 0x40e45e
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xa4]
push eax
push edi
mov ecx, ebx
call fcn.0040eaec
test eax, eax
je 0x40e45e
call fcn.0040510e
lea ecx, [ebx + 0x2ac]
push ecx
lea ecx, [ebp - 0xbc]
push ecx
lea ecx, [eax + 0x3c]
call fcn.004035b9
lea edx, [ebp - 0x7c]
mov ecx, eax
call fcn.004054e1
pop ecx
pop ecx
cmp eax, 0x708
jg 0x40e486
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
jmp 0x40e3d9
xor eax, eax
jne 0x40e486
push eax
push eax
push 0x4ff6b4
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebx + 0x2ac]
push eax
mov ecx, ebx
call fcn.0040f547
mov esi, eax
mov dword [ebp - 0xcc], esi
mov byte [ebp - 4], 2
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xbc]
call fcn.004019c4
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.004019c4
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xa4]
call fcn.00427060
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004c10ee
ret
Function at 0x40e4dc
Capabilities:
Encode data using xor

Disassembly:
push 0x43c
mov eax, 0x4ddc69
call fcn.004c1130
mov ebx, ecx
mov dword [ebp - 0x14], 0x424f1d05
xor ecx, ecx
mov dword [ebp - 0x18], 0x505d4c1c
mov dword [ebp - 0x1c], 0x5e1d055e
mov dword [ebp - 0x20], 0x594f1c5e
mov dword [ebp - 0x24], 0x1d055e59
mov dword [ebp - 0x28], 0x5252611c
mov al, byte [ebp + ecx - 0x28]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, 0x18
jl 0x40e519
push 0x400
lea eax, [ebp - 0x42f]
mov byte [ebp - 0x430], 0
push 0
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x448]
push eax
call fcn.0040510e
mov ecx, eax
call fcn.00404251
mov edi, eax
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x40e569
mov edi, dword [edi]
call fcn.0040510e
mov esi, dword [eax + 8]
call fcn.0040510e
push edi
push esi
push dword [eax + 4]
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x430]
push 0x400
push eax
call fcn.004bb7ea
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x448]
call fcn.004019c4
lea eax, [ebp - 0x430]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebx + 0x27c]
call fcn.00401a20
call fcn.004c10df
ret
Function at 0x40e5ce
Capabilities:
Encode data using xor

Disassembly:
push 0x58
mov eax, 0x4ddcc2
call fcn.004c1130
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ecx + 0x27c]
mov esi, dword [ebp + 8]
mov ecx, esi
push eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], ebx
call fcn.00404fb3
mov dword [ebp - 4], ebx
xor edi, edi
inc edi
mov dword [ebp - 0x2a], 0x42050d5e
mov dword [ebp - 0x30], edi
mov ecx, ebx
mov word [ebp - 0x2c], 0x551c
mov al, byte [ebp + ecx - 0x2c]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 6
jl 0x40e60e
lea eax, [ebp - 0x2c]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.0040531a
lea eax, [ebp - 0x4c]
push eax
call fcn.0040510e
mov ecx, eax
call fcn.0040dda0
mov dword [ebp - 4], edi
mov ecx, esi
push 0xffffffffffffffff
push ebx
push eax
call fcn.00405274
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4c]
push ebx
push edi
call fcn.004019c4
mov dword [ebp - 0x1a], 0x4205545b
mov ecx, ebx
mov word [ebp - 0x1c], 0x501c
mov al, byte [ebp + ecx - 0x1c]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 6
jl 0x40e670
lea eax, [ebp - 0x1c]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.0040531a
mov dword [ebp - 0x22], 0x42055f61
mov ecx, ebx
mov word [ebp - 0x24], 0x551c
mov al, byte [ebp + ecx - 0x24]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 6
jl 0x40e6a7
lea eax, [ebp - 0x24]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.0040531a
lea eax, [ebp - 0x64]
push eax
call fcn.004051b8
mov ecx, eax
call fcn.004042b5
mov dword [ebp - 4], 2
mov edx, eax
push ebx
lea ecx, [ebp - 0x4c]
call fcn.00422540
pop ecx
mov byte [ebp - 4], 3
mov ecx, esi
push 0xffffffffffffffff
push ebx
push eax
call fcn.00405274
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
push ebx
push edi
call fcn.004019c4
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x64]
push ebx
push edi
call fcn.00403864
mov eax, esi
call fcn.004c10df
ret 4
Function at 0x410de1
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x4de131
call fcn.004c1130
mov esi, ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x3c], eax
cmp dword [esi + 0xf88], edx
je 0x410ec2
cmp dword [esi + 0xf8c], edx
jbe 0x410ec2
cmp byte [esi + 0xf90], dl
je 0x410ec2
mov dword [ebp - 0x1a], 0x425b5452
mov ecx, edx
mov dword [ebp - 0x1e], 0x144e5e4c
mov word [ebp - 0x20], 0x615c
mov al, byte [ebp + ecx - 0x20]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xa
jl 0x410e31
mov edi, edx
cmp dword [esi + 0xf84], edx
jle 0x410ec2
lea ebx, [esi + 0x384]
cmp dword [ebx], 0
je 0x410e69
push dword [ebx]
lea eax, [ebp - 0x20]
push eax
call fcn.004bae8d
pop ecx
pop ecx
test eax, eax
je 0x410e77
inc edi
add ebx, 4
cmp edi, dword [esi + 0xf84]
jl 0x410e53
jmp 0x410ec2
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x38]
push dword [esi + edi*4 + 0xb84]
push dword [esi + edi*4 + 0x784]
call fcn.0040531a
push dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call fcn.00410d22
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
push ebx
push 1
call fcn.004019c4
call fcn.004c10df
ret 4

Function at 0x410eca
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x2c
mov eax, 0x4de15e
call fcn.004c1130
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xf88], ebx
je 0x410f55
cmp dword [esi + 0xf8c], ebx
jbe 0x410f55
cmp byte [esi + 0xf90], bl
je 0x410f55
mov dword [ebp - 0x16], 0x425b5452
mov ecx, ebx
mov dword [ebp - 0x1a], 0x144e4f59
mov dword [ebp - 0x1e], 0x565d564e
mov word [ebp - 0x20], 0x594e
mov al, byte [ebp + ecx - 0x20]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xe
jl 0x410f0f
mov edi, ebx
cmp dword [esi + 0xf84], ebx
jle 0x410f55
lea ebx, [esi + 0x384]
cmp dword [ebx], 0
je 0x410f47
push dword [ebx]
lea eax, [ebp - 0x20]
push eax
call fcn.004bae8d
pop ecx
pop ecx
test eax, eax
je 0x410fb2
inc edi
add ebx, 4
cmp edi, dword [esi + 0xf84]
jl 0x410f31
xor ebx, ebx
call fcn.004051b8
cmp dword [eax + 0xc], ebx
jne 0x410fa2
call fcn.004051b8
mov ecx, 0x804
cmp word [eax + 8], cx
jne 0x410fa2
call fcn.004051b8
cmp word [eax + 0xa], 8
jne 0x410fa2
call fcn.004051b8
cmp dword [eax + 0x24], 0xb
jne 0x410f9a
call fcn.004051b8
cmp dword [eax + 0x20], ebx
jne 0x410f9a
call fcn.004051b8
cmp dword [eax + 0x18], ebx
je 0x410fac
cmp dword [esi + 0x25c], ebx
je 0x410fac
mov dword [esi + 0x258], 1
call fcn.004c10df
ret
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x38]
push dword [esi + edi*4 + 0xb84]
push dword [esi + edi*4 + 0x784]
call fcn.0040531a
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call fcn.0041098b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
push ebx
push 1
call fcn.004019c4
jmp 0x410f55
Function at 0x410fff
Capabilities:
Encode data using xor

Disassembly:
push 0xd8
mov eax, 0x4de203
call fcn.004c1130
mov esi, ecx
mov eax, dword [ebp + 8]
lea edi, [esi + 0xf9c]
mov dword [ebp - 0x2c], eax
mov eax, dword [edi]
jmp 0x411051
mov ecx, dword [eax]
test ecx, ecx
je 0x41104e
mov dl, byte [ecx + 0x180c]
test dl, dl
je 0x41104e
cmp dl, 1
jne 0x41103e
cmp byte [ecx + 0x249a], 0
je 0x41104e
push eax
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00412497
mov eax, dword [eax]
jmp 0x411051
add eax, 4
cmp eax, dword [esi + 0xfa0]
jne 0x411020
xor ebx, ebx
lea eax, [esi + 0x2c4]
mov dword [esi + 0x264], ebx
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], ebx
jb 0x411072
mov eax, dword [eax]
mov byte [eax], bl
mov ecx, ebx
mov dword [ebp - 0x15], 0x4211534c
mov word [ebp - 0x17], 0x615c
mov byte [ebp - 0x18], 0x14
mov al, byte [ebp + ecx - 0x18]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 7
jl 0x411087
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
call fcn.004018ec
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xe4]
call fcn.00428390
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa4]
call fcn.00428390
mov ebx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x64]
call fcn.00428390
mov edi, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc4]
call fcn.00428390
mov esi, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x84]
call fcn.00428390
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
push edi
push esi
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00428410
mov byte [ebp - 4], 7
xor esi, esi
xor ebx, ebx
lea ecx, [ebp - 0x84]
push esi
inc ebx
push ebx
call fcn.004019c4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xc4]
push esi
push ebx
call fcn.004019c4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x64]
push esi
push ebx
call fcn.004019c4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa4]
push esi
push ebx
call fcn.004019c4
mov byte [ebp - 4], 0xf
push esi
push ebx
lea ecx, [ebp - 0xe4]
call fcn.004019c4
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x44]
push esi
push ebx
call fcn.004019c4
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
call fcn.00428780
mov ecx, eax
call fcn.00427960
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00412262
call fcn.004c10df
ret 4