joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405369
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
test esi, esi
jg 0x40538b
jl 0x405382
test ebx, ebx
jne 0x40538b
xor eax, eax
xor edx, edx
jmp 0x405453
cmp dword [ecx + 0x38], 0
je 0x4053a1
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x405453
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov edx, dword [eax]
test edx, edx
je 0x4053e5
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x4053e5
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [ebp + 8]
cmovb esi, dword [eax]
push esi
push edx
push edi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
jmp 0x4053eb
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [ecx + 0x4c], 0
je 0x405449
call fcn.00405933
mov edx, dword [ebp + 8]
mov eax, edi
cmp edi, 0xfff
jbe 0x405433
push dword [ecx + 0x4c]
push 0xfff
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, dword [ebp + 8]
mov ecx, 0xfff
add edx, eax
add esp, 0x10
sub edi, eax
mov dword [ebp + 8], edx
cmp eax, ecx
jne 0x405449
cmp edi, ecx
mov ecx, dword [ebp - 4]
ja 0x405403
mov eax, edi
test eax, eax
je 0x405449
push dword [ecx + 0x4c]
push edi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4056c6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x4056e2
xor eax, eax
jmp 0x4057a2
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x405706
mov ecx, dword [esi + 0x30]
mov ecx, dword [ecx]
add ecx, dword [eax]
cmp dword [eax], ecx
jae 0x405706
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x4057a2
cmp dword [esi + 0x4c], 0
je 0x4057a0
mov ecx, esi
call fcn.00405933
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x405734
movsx eax, bl
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
pop ecx
pop ecx
cmove ebx, edi
jmp 0x4056ff
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x40576f
sub eax, 1
je 0x40576f
dec eax
sub eax, 1
jne 0x4057a0
movsx eax, byte [ebp - 1]
jmp 0x405721
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 8], eax
je 0x405793
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 8], eax
jne 0x4057a0
lea eax, [ebp - 1]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0xc], eax
cmovne edi, ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x405956
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x4059a4
cmp byte [esi + 0x3d], bl
je 0x4059a4
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4059d4
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x4059ab
sub eax, 1
je 0x4059ae
dec eax
sub eax, 1
jne 0x4059d4
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4059cc
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4059d4
cmp byte [esi + 0x3d], bl
sete al
jmp 0x4059a6
xor al, al
jmp 0x4059a6
Function at 0x407259
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x38]
test eax, eax
je 0x40726c
call eax
push ebx
xor ebx, ebx
cmp dword [esi + 0x30], ebx
je 0x407285
mov edx, 0xdef80ae7
xor ecx, ecx
call fcn.00404bfc
push dword [esi + 0x30]
call eax
mov edx, 0x27b57b9d
xor ecx, ecx
call fcn.00404bfc
mov edi, eax
mov dword [ebp - 0xd], 0x6f7c706a
mov dl, 0x6a
mov dword [ebp - 9], 0x3d766c6f
mov dword [ebp - 5], 0x76766e38
mov ecx, ebx
mov byte [ebp - 1], bl
movsx eax, dl
and eax, 0x8000000f
jns 0x4072be
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 0xb
jae 0x4072cd
mov dl, byte [ebp - 0xd]
jmp 0x4072af
lea eax, [ebp - 0xc]
mov byte [ebp - 1], bl
push eax
call edi
mov edi, eax
test edi, edi
je 0x4072eb
mov edx, 0xdef80ae7
xor ecx, ecx
call fcn.00404bfc
push edi
call eax
mov edx, 0x27b57b9d
xor ecx, ecx
call fcn.00404bfc
mov edi, eax
mov dword [ebp - 0xd], 0x897e7c1f
mov dl, 0x1f
mov dword [ebp - 9], 0x74847b76
mov dword [ebp - 5], 0x7b7b733d
mov ecx, ebx
mov byte [ebp - 1], bl
movsx eax, dl
and eax, 0x8000000f
jns 0x407324
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 0xb
jae 0x407333
mov dl, byte [ebp - 0xd]
jmp 0x407315
lea eax, [ebp - 0xc]
mov byte [ebp - 1], bl
push eax
call edi
mov edi, eax
test edi, edi
je 0x407351
mov edx, 0xdef80ae7
xor ecx, ecx
call fcn.00404bfc
push edi
call eax
mov edx, 0x27b57b9d
xor ecx, ecx
call fcn.00404bfc
mov edx, eax
mov dword [ebp - 0xe], 0x2a2f315c
mov cl, 0x5c
mov dword [ebp - 0xa], 0x686d2c3f
mov dword [ebp - 6], 0x3038726c
mov eax, ebx
mov word [ebp - 2], 0x30
xor byte [ebp + eax - 0xd], cl
inc eax
cmp eax, 0xc
jae 0x40738d
mov cl, byte [ebp - 0xe]
jmp 0x40737e
lea eax, [ebp - 0xd]
mov byte [ebp - 1], bl
push eax
call edx
mov edi, eax
test edi, edi
je 0x4073ab
mov edx, 0xdef80ae7
xor ecx, ecx
call fcn.00404bfc
push edi
call eax
mov edx, 0x27b57b9d
xor ecx, ecx
call fcn.00404bfc
mov edi, eax
mov dword [ebp - 0xe], 0x6d767a17
mov dl, 0x17
mov dword [ebp - 0xa], 0x7572767b
mov dword [ebp - 6], 0x736b353a
mov ecx, ebx
mov word [ebp - 2], 0x73
movsx eax, dl
and eax, 0x8000000f
jns 0x4073e7
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xd], al
inc ecx
cmp ecx, 0xc
jae 0x4073f6
mov dl, byte [ebp - 0xe]
jmp 0x4073d8
lea eax, [ebp - 0xd]
mov byte [ebp - 1], bl
push eax
call edi
mov edi, eax
test edi, edi
je 0x407414
mov edx, 0xdef80ae7
xor ecx, ecx
call fcn.00404bfc
push edi
call eax
mov edx, 0x27b57b9d
xor ecx, ecx
call fcn.00404bfc
movaps xmm0, xmmword [0x41b4e0]
mov edi, eax
movups xmmword [ebp - 0x12], xmm0
mov word [ebp - 2], 0x7b
mov ecx, ebx
movsx eax, byte [ebp - 0x12]
and eax, 0x8000000f
jns 0x407445
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x11], al
inc ecx
cmp ecx, 0x10
jb 0x407435
lea eax, [ebp - 0x11]
mov byte [ebp - 1], bl
push eax
call edi
mov edi, eax
pop ebx
test edi, edi
je 0x40746e
mov edx, 0xdef80ae7
xor ecx, ecx
call fcn.00404bfc
push edi
call eax
lea ecx, [esi + 0x18]
call fcn.00401a42
mov ecx, esi
call fcn.00401a42
pop edi
pop esi
leave
ret
Function at 0x407e37
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
push edi
mov esi, ecx
mov edx, 0xde5b7090
push 4
pop ecx
call fcn.00404bfc
movaps xmm0, xmmword [str.k8____9.7]
xor ebx, ebx
movups xmmword [ebp - 0x3e], xmm0
mov edx, eax
mov dword [ebp - 0x1e], 0xe19191e
movaps xmm0, xmmword [0x41b070]
mov ecx, ebx
movups xmmword [ebp - 0x2e], xmm0
mov dword [ebp - 0x1a], 0xe3d1f05
mov dword [ebp - 0x16], 0x4021819
mov word [ebp - 0x12], 5
mov al, byte [ebp - 0x3e]
xor byte [ebp + ecx - 0x3d], al
inc ecx
cmp ecx, 0x2c
jb 0x407e89
add esi, 0x18
mov byte [ebp - 0x11], bl
push esi
push 0x20119
push ebx
lea eax, [ebp - 0x3d]
push eax
push 0x80000002
call edx
push 4
mov edx, 0x77739979
mov dword [ebp - 0x10], 0x100
pop ecx
call fcn.00404bfc
mov edi, eax
mov dword [ebp - 0xb], 0x736e4f4a
mov dl, 0x4a
mov dword [ebp - 7], 0x7879737e
mov word [ebp - 3], 0x4e53
mov ecx, ebx
mov byte [ebp - 1], bl
movsx eax, dl
and eax, 0x8000000f
jns 0x407eee
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xa], al
inc ecx
cmp ecx, 9
jae 0x407efd
mov dl, byte [ebp - 0xb]
jmp 0x407edf
lea eax, [ebp - 0x10]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0x140]
push eax
push ebx
push ebx
lea eax, [ebp - 0xa]
push eax
push dword [esi]
call edi
push 4
mov edx, 0x59b26164
pop ecx
call fcn.00404bfc
push dword [esi]
call eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov byte [ebp + eax - 0x140], bl
lea eax, [ebp - 0x140]
push eax
call fcn.00401a09
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x408145
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword fs:[0x30]
mov edx, 0x6d669242
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx + 0xa4]
mov dword [esi], eax
mov eax, dword [ecx + 0xa8]
mov dword [esi + 4], eax
movzx ecx, word [ecx + 0xac]
mov dword [esi + 8], ecx
xor ecx, ecx
call fcn.00404bfc
lea ecx, [esi + 0xc]
push ecx
push 0xffffffffffffffff
call eax
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x40b04c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 6], 0x78893d3f
push edi
mov al, 0x3f
mov word [ebp - 2], 0x7f
mov ecx, ebx
movsx eax, al
and eax, 0x8000000f
jns 0x40b07a
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 5], al
inc ecx
cmp ecx, 4
jae 0x40b089
mov al, byte [ebp - 6]
jmp 0x40b06b
xor eax, eax
mov byte [ebp - 1], bl
xorps xmm0, xmm0
lea edi, [ebp - 0x7c]
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
pop edi
push eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], edi
mov byte [ebp - 0x7c], bl
call fcn.00407f49
mov cl, 0x5b
mov byte [ebp - 9], 0x76
xor cl, 0x76
mov byte [ebp - 7], bl
mov esi, eax
mov byte [ebp - 8], cl
lea eax, [ebp - 8]
mov edx, 0x41e788
push eax
lea ecx, [ebp - 0x54]
call fcn.004026c8
pop ecx
push esi
push eax
push dword [ebp - 0xa]
lea ecx, [ebp - 0x24]
call fcn.00409e67
lea eax, [ebp - 5]
push eax
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x3c]
call fcn.00404203
pop ecx
lea ecx, [ebp - 0x24]
call fcn.00401a42
lea ecx, [ebp - 0x54]
call fcn.00401a42
lea ecx, [ebp - 0x94]
call fcn.00401a42
lea ecx, [ebp - 0x7c]
call fcn.00401a42
cmp dword [ebp - 0x28], edi
lea ecx, [ebp - 0x3c]
cmova ecx, dword [ebp - 0x3c]
push ecx
push ecx
call fcn.00418527
pop ecx
pop ecx
mov edi, eax
mov dword [ebp - 0x1a], 0x7a805a67
mov al, 0x67
mov dword [ebp - 0x16], 0x4a746c7b
mov dword [ebp - 0x12], 0x706d7576
mov ecx, ebx
mov word [ebp - 0xe], 0x6e
movsx eax, al
and eax, 0x8000000f
jns 0x40b160
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0xc
jae 0x40b16f
mov al, byte [ebp - 0x1a]
jmp 0x40b151
lea eax, [ebp - 0x19]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [ebp - 0x54]
call fcn.00401a09
lea eax, [ebp - 0x54]
mov ebx, 0x41e788
push eax
mov edx, ebx
mov ecx, edi
call fcn.0040ae2a
pop ecx
lea ecx, [ebp - 0x54]
call fcn.00401a42
test edi, edi
jne 0x40b1a9
mov dword [0x41e690], 0x10000
jmp 0x40b1eb
cmp dword [edi], 2
je 0x40b1ba
mov dword [0x41e690], 0x80000
jmp 0x40b1eb
mov esi, dword [edi + 4]
mov ecx, esi
call fcn.00417924
mov dword [0x41e690], eax
test esi, esi
je 0x40b1e1
mov ecx, esi
call fcn.0041775e
push 0x4098
push esi
call fcn.004189da
pop ecx
pop ecx
push 8
push edi
call fcn.004189da
pop ecx
pop ecx
mov ecx, ebx
call fcn.00413e7d
lea ecx, [ebp - 0x3c]
call fcn.00401a42
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d99c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
mov edx, 0x87339fd5
lea ecx, [ebp - 0x54]
call fcn.004146c6
cmp dword [ebp - 0x44], 0
je 0x40dab7
movaps xmm0, xmmword [0x41b2e0]
xor ebx, ebx
movups xmmword [ebp - 0x7e], xmm0
mov ecx, ebx
mov dword [ebp - 0x5e], 0x56275621
movaps xmm0, xmmword [0x41b080]
movups xmmword [ebp - 0x6e], xmm0
mov dword [ebp - 0x5a], 0x2a545721
mov word [ebp - 0x56], 0x51
mov al, byte [ebp - 0x7e]
xor byte [ebp + ecx - 0x7d], al
inc ecx
cmp ecx, 0x28
jb 0x40d9eb
lea eax, [ebp - 0x7d]
mov byte [ebp - 0x55], bl
push eax
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x3c]
call fcn.004026c8
pop ecx
mov edx, 0xd66878cf
xor ecx, ecx
call fcn.00404bfc
cmp dword [ebp - 0x28], 0xf
lea ecx, [ebp - 0x3c]
cmova ecx, dword [ebp - 0x3c]
push ecx
call eax
cmp eax, 0xffffffff
je 0x40daaf
test al, 0x10
je 0x40daaf
mov cl, 0x17
mov dword [ebp - 0xb], 0x72434b17
mov dword [ebp - 7], 0x6570727b
mov eax, ebx
mov word [ebp - 3], 0x7a76
mov byte [ebp - 1], bl
xor byte [ebp + eax - 0xa], cl
inc eax
cmp eax, 9
jae 0x40da5c
mov cl, byte [ebp - 0xb]
jmp 0x40da4d
lea eax, [ebp - 0xa]
mov byte [ebp - 1], bl
push eax
mov edx, 0x41e7d0
lea ecx, [ebp - 0x24]
call fcn.004026c8
pop ecx
mov edx, 0x29158ba4
xor ecx, ecx
call fcn.00404bfc
cmp dword [ebp - 0x10], 0xf
lea ecx, [ebp - 0x24]
push ebx
cmova ecx, dword [ebp - 0x24]
push ecx
call eax
cmp dword [ebp - 0x10], 0xf
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x3c]
cmova edx, dword [ebp - 0x24]
cmp dword [ebp - 0x28], 0xf
cmova ecx, dword [ebp - 0x3c]
call fcn.00414265
lea ecx, [ebp - 0x24]
call fcn.00401a42
lea ecx, [ebp - 0x3c]
call fcn.00401a42
lea ecx, [ebp - 0x54]
call fcn.00401a42
pop ebx
leave
ret
Function at 0x40e8ab
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
mov edx, 0x87339fd5
lea ecx, [ebp - 0x84]
call fcn.004146c6
cmp dword [ebp - 0x74], 0
je 0x40ea71
movaps xmm0, xmmword [0x41b370]
xor ebx, ebx
movups xmmword [ebp - 0x22], xmm0
mov dword [ebp - 0x12], 0x3c213a1d
mov ecx, ebx
mov dword [ebp - 0xe], 0x2b292f
mov al, byte [ebp - 0x22]
xor byte [ebp + ecx - 0x21], al
inc ecx
cmp ecx, 0x16
jb 0x40e8ed
lea eax, [ebp - 0x21]
mov byte [ebp - 0xb], bl
push eax
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0x54]
call fcn.004026c8
pop ecx
mov al, 0xc
mov dword [ebp - 0xa], 0x7178680c
mov dword [ebp - 6], 0x70787182
mov ecx, ebx
mov word [ebp - 2], 0x6e
movsx eax, al
and eax, 0x8000000f
jns 0x40e937
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 8
jae 0x40e946
mov al, byte [ebp - 0xa]
jmp 0x40e928
lea eax, [ebp - 9]
mov byte [ebp - 1], bl
push eax
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.004026c8
pop ecx
mov al, 0x42
mov dword [ebp - 0xa], 0x6b465e42
mov dword [ebp - 6], 0x74716575
mov ecx, ebx
mov word [ebp - 2], 0x66
movsx eax, al
and eax, 0x8000000f
jns 0x40e980
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 8
jae 0x40e98f
mov al, byte [ebp - 0xa]
jmp 0x40e971
lea eax, [ebp - 9]
mov byte [ebp - 1], bl
push eax
mov edx, 0x41e7d0
lea ecx, [ebp - 0x3c]
call fcn.004026c8
push 0xf
pop esi
cmp dword [ebp - 0x40], esi
lea eax, [ebp - 0x54]
cmova eax, dword [ebp - 0x54]
sub esp, 0x14
mov ecx, esp
push eax
call fcn.00401a09
call fcn.00414418
add esp, 0x18
test eax, eax
je 0x40ea59
cmp dword [ebp - 0x28], esi
lea eax, [ebp - 0x3c]
cmova eax, dword [ebp - 0x3c]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401a09
call fcn.00414418
add esp, 0x18
test eax, eax
jne 0x40ea06
mov edx, 0x29158ba4
xor ecx, ecx
call fcn.00404bfc
cmp dword [ebp - 0x28], esi
lea ecx, [ebp - 0x3c]
push ebx
cmova ecx, dword [ebp - 0x3c]
push ecx
call eax
cmp dword [ebp - 0x28], esi
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x54]
cmova edx, dword [ebp - 0x3c]
cmp dword [ebp - 0x40], esi
cmova ecx, dword [ebp - 0x54]
call fcn.00414265
cmp dword [ebp - 0x58], esi
lea eax, [ebp - 0x6c]
cmova eax, dword [ebp - 0x6c]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401a09
call fcn.00414418
add esp, 0x18
test eax, eax
je 0x40ea59
cmp dword [ebp - 0x28], esi
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x6c]
cmova edx, dword [ebp - 0x3c]
cmp dword [ebp - 0x58], esi
cmova ecx, dword [ebp - 0x6c]
call fcn.00414265
lea ecx, [ebp - 0x3c]
call fcn.00401a42
lea ecx, [ebp - 0x6c]
call fcn.00401a42
lea ecx, [ebp - 0x54]
call fcn.00401a42
lea ecx, [ebp - 0x84]
call fcn.00401a42
pop esi
pop ebx
leave
ret
Function at 0x40f8ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
mov edx, 0x87339fd5
lea ecx, [ebp - 0x68]
call fcn.004146c6
cmp dword [ebp - 0x58], 0
je 0x40fa60
movaps xmm0, xmmword [0x41b310]
xor ebx, ebx
movups xmmword [ebp - 0x1f], xmm0
mov dword [ebp - 0xf], 0x7c686d6c
mov ecx, ebx
mov word [ebp - 0xb], 0x7b73
mov byte [ebp - 9], bl
movsx eax, byte [ebp - 0x1f]
and eax, 0x8000000f
jns 0x40f937
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x1e], al
inc ecx
cmp ecx, 0x15
jb 0x40f927
lea eax, [ebp - 0x1e]
mov byte [ebp - 9], bl
push eax
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x38]
call fcn.004026c8
pop ecx
mov al, 0x23
mov dword [ebp - 0x17], 0x66645f23
mov dword [ebp - 0x13], 0x71787266
mov ecx, ebx
mov dword [ebp - 0xf], 0x7b317677
mov word [ebp - 0xb], 0x6f70
mov byte [ebp - 9], bl
movsx eax, al
and eax, 0x8000000f
jns 0x40f985
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x16], al
inc ecx
cmp ecx, 0xd
jae 0x40f994
mov al, byte [ebp - 0x17]
jmp 0x40f976
lea eax, [ebp - 0x16]
mov byte [ebp - 9], bl
push eax
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.004026c8
cmp dword [ebp - 0x3c], 0xf
lea eax, [ebp - 0x50]
cmova eax, dword [ebp - 0x50]
sub esp, 0x14
mov ecx, esp
push eax
call fcn.00401a09
call fcn.00414418
add esp, 0x18
test eax, eax
je 0x40fa50
mov cl, 0x1a
mov dword [ebp - 6], 0x694a461a
mov word [ebp - 2], 0x73
mov eax, ebx
xor byte [ebp + eax - 5], cl
inc eax
cmp eax, 4
jae 0x40f9ec
mov cl, byte [ebp - 6]
jmp 0x40f9dd
lea eax, [ebp - 5]
mov byte [ebp - 1], bl
push eax
mov edx, 0x41e7d0
lea ecx, [ebp - 0x20]
call fcn.004026c8
pop ecx
mov edx, 0x29158ba4
xor ecx, ecx
call fcn.00404bfc
cmp dword [ebp - 0xc], 0xf
lea ecx, [ebp - 0x20]
push ebx
cmova ecx, dword [ebp - 0x20]
push ecx
call eax
test eax, eax
jne 0x40fa2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40fa48
cmp dword [ebp - 0xc], 0xf
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
cmova edx, dword [ebp - 0x20]
cmp dword [ebp - 0x24], 0xf
cmova ecx, dword [ebp - 0x38]
call fcn.00414265
lea ecx, [ebp - 0x20]
call fcn.00401a42
lea ecx, [ebp - 0x50]
call fcn.00401a42
lea ecx, [ebp - 0x38]
call fcn.00401a42
lea ecx, [ebp - 0x68]
call fcn.00401a42
pop ebx
leave
ret
Function at 0x40fe29
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xd], 0x77476125
mov edi, ecx
mov dword [ebp - 9], 0x6a787c74
mov al, 0x25
mov word [ebp - 5], 0x77
mov ecx, ebx
movsx eax, al
and eax, 0x8000000f
jns 0x40fe5d
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 8
jae 0x40fe6c
mov al, byte [ebp - 0xd]
jmp 0x40fe4e
lea eax, [ebp - 0xc]
mov byte [ebp - 4], bl
push eax
mov edx, 0x41e7e8
lea ecx, [ebp - 0x28]
lea esi, [edi + 0x90]
call fcn.004026c8
pop ecx
push eax
mov ecx, esi
call fcn.00403e31
lea ecx, [ebp - 0x28]
call fcn.00401a42
sub esp, 0x18
mov ecx, esp
push esi
call fcn.004025ee
call fcn.00414418
add esp, 0x18
test eax, eax
jne 0x40fec8
mov edx, 0x29158ba4
xor ecx, ecx
call fcn.00404bfc
cmp dword [esi + 0x14], 0xf
mov ecx, esi
jbe 0x40fec4
mov ecx, dword [esi]
push ebx
push ecx
call eax
mov cl, 0x22
mov byte [ebp - 1], bl
mov al, 0x7e
mov byte [ebp - 3], cl
xor al, cl
mov edx, esi
mov byte [ebp - 2], al
lea ecx, [ebp - 0x40]
lea eax, [ebp - 2]
push eax
call fcn.004026c8
pop ecx
mov esi, eax
push 0x2e
mov ecx, esi
call fcn.00401a65
push esi
lea ecx, [ebp - 0x28]
call fcn.004019d0
lea eax, [ebp - 0x28]
push eax
lea ecx, [edi + 0xa8]
call fcn.00403e31
lea ecx, [ebp - 0x28]
call fcn.00401a42
lea ecx, [ebp - 0x40]
call fcn.00401a42
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413e7d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 6], 0x3834661a
mov esi, ecx
mov word [ebp - 2], 0x34
push edi
mov al, 0x1a
mov ecx, ebx
movsx eax, al
and eax, 0x8000000f
jns 0x413ead
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 5], al
inc ecx
cmp ecx, 4
jae 0x413ebc
mov al, byte [ebp - 6]
jmp 0x413e9e
lea eax, [ebp - 5]
mov byte [ebp - 1], bl
push eax
mov edx, esi
lea ecx, [ebp - 0x50]
call fcn.004026c8
pop ecx
mov edx, 0x69ebc9fc
xor ecx, ecx
call fcn.00404bfc
cmp dword [ebp - 0x3c], 0xf
lea edx, [ebp - 0x190]
lea ecx, [ebp - 0x50]
cmova ecx, dword [ebp - 0x50]
push edx
push ecx
call eax
mov edi, eax
cmp edi, 0xffffffff
je 0x4140a9
cmp byte [ebp - 0x164], 0x2e
je 0x413faf
mov cl, 0x22
mov byte [ebp - 1], bl
mov al, 0x7e
mov byte [ebp - 3], cl
xor al, cl
mov edx, esi
mov byte [ebp - 2], al
lea ecx, [ebp - 0x20]
lea eax, [ebp - 2]
push eax
call fcn.004026c8
pop ecx
lea ecx, [ebp - 0x164]
mov edx, eax
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413f30
sub ecx, ebx
lea eax, [ebp - 0x164]
push ecx
push eax
mov ecx, edx
call fcn.0040266f
push eax
lea ecx, [ebp - 0x38]
call fcn.004019d0
lea ecx, [ebp - 0x20]
call fcn.00401a42
test byte [ebp - 0x190], 0x10
je 0x413f6c
lea ecx, [ebp - 0x38]
call fcn.00413e7d
jmp 0x413fa5
mov edx, 0x6b50c57a
xor ecx, ecx
call fcn.00404bfc
cmp dword [ebp - 0x24], 0xf
lea ecx, [ebp - 0x38]
push 0x80
cmova ecx, dword [ebp - 0x38]
push ecx
call eax
mov edx, 0xbe4b57d8
xor ecx, ecx
call fcn.00404bfc
cmp dword [ebp - 0x24], 0xf
lea ecx, [ebp - 0x38]
cmova ecx, dword [ebp - 0x38]
push ecx
call eax
lea ecx, [ebp - 0x38]
call fcn.00401a42
xor ebx, ebx
mov edx, 0xa24669f6
xor ecx, ecx
call fcn.00404bfc
lea ecx, [ebp - 0x190]
push ecx
push edi
call eax
test eax, eax
jne 0x413efa
mov edx, 0x25ec0c37
xor ecx, ecx
call fcn.00404bfc
push edi
call eax
mov edx, 0xd3e65c39
xor ecx, ecx
call fcn.00404bfc
mov edi, eax
mov dword [ebp - 0x16], 0x776a7065
mov dl, 0x65
mov dword [ebp - 0x12], 0x38716a73
mov dword [ebp - 0xe], 0x71693337
mov ecx, ebx
mov word [ebp - 0xa], 0x71
movsx eax, dl
and eax, 0x8000000f
jns 0x414018
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x15], al
inc ecx
cmp ecx, 0xc
jae 0x414027
mov dl, byte [ebp - 0x16]
jmp 0x414009
lea eax, [ebp - 0x15]
mov byte [ebp - 9], bl
push eax
call edi
mov edx, 0xdc02ba32
xor ecx, ecx
mov ebx, eax
call fcn.00404bfc
movaps xmm0, xmmword [0x41b0d0]
mov edi, eax
movups xmmword [ebp - 0x32], xmm0
mov word [ebp - 0x22], 0x16
xor ecx, ecx
mov al, byte [ebp - 0x32]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x10
jb 0x414053
lea eax, [ebp - 0x31]
mov byte [ebp - 0x21], 0
push eax
push ebx
call edi
mov edi, eax
test edi, edi
je 0x41409a
mov edx, 0x6b50c57a
xor ecx, ecx
call fcn.00404bfc
cmp dword [esi + 0x14], 0xf
mov ecx, esi
jbe 0x414087
mov ecx, dword [esi]
push 0x80
push ecx
call eax
cmp dword [esi + 0x14], 0xf
jbe 0x414097
mov esi, dword [esi]
push esi
call edi
mov edx, 0xdef80ae7
xor ecx, ecx
call fcn.00404bfc
push ebx
call eax
lea ecx, [ebp - 0x50]
call fcn.00401a42
pop edi
pop esi
pop ebx
leave
ret