joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c638
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x562494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x60], esi
mov word [ebp - 0x5c], ax
lea eax, [ebp - 0x44]
push 0x19
push eax
mov dword [ebp - 0x44], 0x65004d
mov dword [ebp - 0x40], 0x730073
mov dword [ebp - 0x3c], 0x670061
mov dword [ebp - 0x38], 0x420065
mov dword [ebp - 0x34], 0x78006f
mov dword [ebp - 0x30], 0x6d005c
mov dword [ebp - 0x2c], 0x730065
mov dword [ebp - 0x28], 0x610073
mov dword [ebp - 0x24], 0x650067
mov dword [ebp - 0x20], 0x6f0062
mov dword [ebp - 0x1c], 0x2e0078
mov dword [ebp - 0x18], 0x6d0078
mov dword [ebp - 0x14], 0x6c
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
call fcn.00408c10
mov dword [ebp - 4], 0
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
mov ecx, esi
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x5c]
push eax
call fcn.00439c30
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x411470
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411466
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411490
push edx
push ecx
call fcn.004af923
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret 4
call fcn.004e03e9
int3

Function at 0x4114a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c66c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x562494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x571e38]
cmp eax, dword [ecx + 4]
jg 0x411509
cmp dword [0x571e50], 8
mov eax, 0x571e3c
cmovae eax, dword [0x571e3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret
push 0x571e38
call fcn.004b0c35
add esp, 4
cmp dword [0x571e38], 0xffffffff
jne 0x4114dd
mov dword [ebp - 4], 0
xor eax, eax
mov word [0x571e3c], ax
mov ecx, 0x571e3c
push 0xf
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x65006d
push eax
mov dword [ebp - 0x2c], 0x730073
mov dword [ebp - 0x28], 0x670061
mov dword [ebp - 0x24], 0x5f0065
mov dword [ebp - 0x20], 0x6f0062
mov dword [ebp - 0x1c], 0x5f0078
mov dword [ebp - 0x18], 0x6e0077
mov dword [ebp - 0x14], 0x64
mov dword [0x571e4c], 0
mov dword [0x571e50], 7
call fcn.00408c10
push 0x524900
call fcn.004afbb6
push 0x571e38
call fcn.004b0beb
add esp, 8
jmp 0x4114dd
Function at 0x412440
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x562494]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4124b8
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push 0x54c074
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret

Function at 0x4124d0
Capabilities:
Terminate process

Disassembly:
push edi
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4124e4
pop edi
ret
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
ret
Function at 0x412500
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10d8
call fcn.004b0350
mov eax, dword [0x562494]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push ecx
push 0
push 0x410
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x10d8], edi
test edi, edi
jne 0x412545
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret
push esi
push 0x800
lea eax, [ebp - 0x10d4]
push 0
push eax
call fcn.004dcf80
add esp, 0xc
lea eax, [ebp - 0x10d4]
push 0x400
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
mov esi, eax
test esi, esi
je 0x4125f4
push 0x800
lea eax, [ebp - 0x8d4]
push 0
push eax
call fcn.004dcf80
lea eax, [ebp - 0x10d4]
push 0x7e
push eax
call fcn.004dd15c
add esp, 0x14
test eax, eax
je 0x4125da
push 0x400
lea eax, [ebp - 0x8d4]
push eax
lea eax, [ebp - 0x10d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x4125da
push ecx
lea eax, [ebp - 0x8d4]
mov edx, 0x400
push eax
push ecx
mov ecx, ebx
call fcn.004120f0
jmp 0x4126ae
push ecx
lea eax, [ebp - 0x10d4]
mov edx, 0x400
push eax
push ecx
mov ecx, ebx
call fcn.004120f0
jmp 0x4126ae
push 0x400
lea eax, [ebp - 0x10d4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x4126ae
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4126ac
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x4126ac
xor ecx, ecx
movzx edx, ax
nop dword [eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x412697
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [ebp - 0xd4]
push edi
push eax
lea eax, [ebp - 0x10d4]
push eax
call fcn.004f28cc
add esp, 0xc
test eax, eax
je 0x4126cd
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x412640
xor esi, esi
push dword [ebp - 0x10d8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004affa8
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [ebp - 0xc]
mov esi, 0x400
push eax
push ecx
mov edx, esi
mov ecx, ebx
call fcn.004120f0
mov edx, esi
mov eax, ebx
cmp word [eax], 0
je 0x4126f8
add eax, 2
sub edx, 1
jne 0x4126e5
lea esi, [edx + 1]
jmp 0x4126ae
test edx, edx
je 0x412712
push ecx
lea eax, [ebp - 0x10d4]
sub esi, edx
lea eax, [eax + edi*2]
push eax
push ecx
lea ecx, [ebx + esi*2]
call fcn.004120f0
mov esi, 1
jmp 0x4126ae
Function at 0x412720
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x555a68
push 0x4de9d0
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x562494]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
test esi, esi
je 0x412881
cmp word [esi], 0
je 0x412881
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412780
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x412881
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412881
push 0x800
push 0
lea eax, [ebp - 0x81c]
push eax
call fcn.004dcf80
push esi
push 0x54c098
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
call fcn.00412060
push 0x3c
push 0
lea eax, [ebp - 0x858]
push eax
call fcn.004dcf80
add esp, 0x28
mov dword [ebp - 0x858], 0x3c
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x84c], 0x54c0a4
mov dword [ebp - 0x844], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x854], 0x440
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x412848
cmp dword [ebp + 0x18], 0
je 0x412848
push dword [ebp + 0x20]
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x41285d
test esi, esi
je 0x41286d
push edi
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x41286d
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41288a
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x412af0
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x412b50
push 0
push 0
call fcn.004ebc40
xor ecx, ecx
mov dword [esi + 4], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
pop esi
ret
Function at 0x412eb0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.004b0350
mov eax, dword [0x562494]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x412edf
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret
push 0x2000
xorps xmm0, xmm0
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x2004]
movq qword [ebp - 0x2014], xmm0
push 0
movups xmmword [ebp - 0x2024], xmm0
push eax
mov word [ebp - 0x2008], 0
mov dword [ebp - 0x2020], 3
call fcn.004dcf80
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.004e9ee0
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004affa8
mov esp, ebp
pop ebp
ret
Function at 0x412f90
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x562494]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4131a3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4131a3
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412fc5
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x4131a3
push 0x208
lea eax, [ebp - 0x214]
mov edi, 1
push 0
push eax
call fcn.004dcf80
add esp, 0xc
lea eax, [ebp - 0x41c]
push 0x208
push 0
push eax
call fcn.004dcf80
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x41c]
add esp, 0xc
push esi
push eax
call ebx
push 0x54c0e8
lea eax, [ebp - 0x41c]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413047
test al, 1
je 0x413047
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x670], eax
cmp eax, 0xffffffff
je 0x413189
lea ecx, [ebp - 0x66c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x41317d
test byte [ebp - 0x66c], 0x10
je 0x4130f8
cmp word [ebp - 0x640], 0x2e
jne 0x4130b7
mov ax, word [ebp - 0x63e]
test ax, ax
je 0x413162
cmp ax, 0x2e
jne 0x4130b7
cmp word [ebp - 0x63c], 0
je 0x413162
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.004dcf80
add esp, 0xc
lea eax, [ebp - 0x214]
push esi
push eax
call ebx
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
lea eax, [ebp - 0x214]
push eax
call fcn.00412f90
add esp, 4
jmp 0x413160
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.004dcf80
add esp, 0xc
lea eax, [ebp - 0x214]
push esi
push eax
call ebx
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41314f
test al, 1
je 0x41314f
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x66c]
push eax
push dword [ebp - 0x670]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x413080
push dword [ebp - 0x670]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004affa8
mov esp, ebp
pop ebp
ret
Function at 0x413b20
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
call fcn.00416210
call fcn.00416640
mov ecx, esi
pop esi
jmp fcn.00413b40
Function at 0x4159a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x44], 0x720063
mov dword [ebp - 0x40], 0x610065
mov dword [ebp - 0x3c], 0x650074
mov dword [ebp - 0x38], 0x640020
mov dword [ebp - 0x34], 0x730065
mov dword [ebp - 0x30], 0x74006b
mov dword [ebp - 0x2c], 0x70006f
mov dword [ebp - 0x28], 0x6c0020
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x20006b
mov dword [ebp - 0x1c], str.Hp
mov dword [ebp - 0x18], 0x6c0069
mov dword [ebp - 0x14], 0x20002e
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x6e0072
mov dword [ebp - 8], 0x3a006f
mov dword [ebp - 4], 0x20
call fcn.00409bb0
mov ecx, eax
test ecx, ecx
je 0x415a7e
mov eax, dword [ecx]
push 2
push 0x21
call dword [eax]
test eax, eax
je 0x415a88
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x21
jl 0x415a74
mov dword [eax - 0xc], 0x21
mov edx, 0x42
mov ecx, dword [esi]
xor eax, eax
push 0x42
mov word [ecx + 0x42], ax
lea eax, [ebp - 0x44]
mov ecx, dword [esi]
push eax
call fcn.0040a070
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0040a130
push 0x80004005
call fcn.0040a130
call fcn.00409240
int3

Function at 0x415a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x54], 0x720063
mov dword [ebp - 0x50], 0x610065
mov dword [ebp - 0x4c], 0x650074
mov dword [ebp - 0x48], 0x730020
mov dword [ebp - 0x44], 0x610074
mov dword [ebp - 0x40], 0x740072
mov dword [ebp - 0x3c], 0x6d0020
mov dword [ebp - 0x38], 0x6e0065
mov dword [ebp - 0x34], 0x200075
mov dword [ebp - 0x30], 0x61006d
mov dword [ebp - 0x2c], 0x6e0069
mov dword [ebp - 0x28], 0x6c0020
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x20006b
mov dword [ebp - 0x1c], str.Hp
mov dword [ebp - 0x18], 0x6c0069
mov dword [ebp - 0x14], 0x20002e
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x6e0072
mov dword [ebp - 8], 0x3a006f
mov dword [ebp - 4], 0x20
call fcn.00409bb0
mov ecx, eax
test ecx, ecx
je 0x415b8a
mov eax, dword [ecx]
push 2
push 0x29
call dword [eax]
test eax, eax
je 0x415b94
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x29
jl 0x415b80
mov dword [eax - 0xc], 0x29
mov edx, 0x52
mov ecx, dword [esi]
xor eax, eax
push 0x52
mov word [ecx + 0x52], ax
lea eax, [ebp - 0x54]
mov ecx, dword [esi]
push eax
call fcn.0040a070
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0040a130
push 0x80004005
call fcn.0040a130
call fcn.00409240
int3
Function at 0x415ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x44], 0x720063
push edi
mov dword [ebp - 0x40], 0x610065
mov dword [ebp - 0x3c], 0x650074
mov dword [ebp - 0x38], 0x730020
mov dword [ebp - 0x34], 0x610074
mov dword [ebp - 0x30], 0x740072
mov dword [ebp - 0x2c], 0x6d0020
mov dword [ebp - 0x28], 0x6e0065
mov dword [ebp - 0x24], 0x200075
mov dword [ebp - 0x20], 0x6e0075
mov dword [ebp - 0x1c], 0x6e0069
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov dword [ebp - 0x10], 0x20006c
mov dword [ebp - 0xc], 0x69006c
mov dword [ebp - 8], 0x6b006e
mov word [ebp - 4], ax
call fcn.00409bb0
mov ecx, eax
test ecx, ecx
je 0x415c7d
mov eax, dword [ecx]
push 2
push 0x20
call dword [eax]
test eax, eax
je 0x415c87
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x20
jl 0x415c73
mov dword [eax - 0xc], 0x20
mov edx, 0x40
mov ecx, dword [esi]
xor eax, eax
push 0x40
mov word [ecx + 0x40], ax
lea eax, [ebp - 0x44]
mov ecx, dword [esi]
push eax
call fcn.0040a070
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0040a130
push 0x80004005
call fcn.0040a130
call fcn.00409240
int3

Function at 0x415c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x60], 0x720063
push edi
mov dword [ebp - 0x5c], 0x610065
mov dword [ebp - 0x58], 0x650074
mov dword [ebp - 0x54], 0x730020
mov dword [ebp - 0x50], 0x610074
mov dword [ebp - 0x4c], 0x740072
mov dword [ebp - 0x48], 0x6d0020
mov dword [ebp - 0x44], 0x6e0065
mov dword [ebp - 0x40], 0x200075
mov dword [ebp - 0x3c], 0x6e0075
mov dword [ebp - 0x38], 0x6e0069
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x6c0061
mov dword [ebp - 0x2c], 0x20006c
mov dword [ebp - 0x28], 0x69006c
mov dword [ebp - 0x24], 0x6b006e
mov dword [ebp - 0x20], 0x660020
mov dword [ebp - 0x1c], 0x690061
mov dword [ebp - 0x18], 0x2e006c
mov dword [ebp - 0x14], 0x650020
mov dword [ebp - 0x10], 0x720072
mov dword [ebp - 0xc], 0x6f006e
mov dword [ebp - 8], 0x20003a
mov word [ebp - 4], ax
call fcn.00409bb0
mov ecx, eax
test ecx, ecx
je 0x415d9e
mov eax, dword [ecx]
push 2
push 0x2e
call dword [eax]
test eax, eax
je 0x415da8
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x2e
jl 0x415d94
mov dword [eax - 0xc], 0x2e
mov edx, 0x5c
mov ecx, dword [esi]
xor eax, eax
push 0x5c
mov word [ecx + 0x5c], ax
lea eax, [ebp - 0x60]
mov ecx, dword [esi]
push eax
call fcn.0040a070
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0040a130
push 0x80004005
call fcn.0040a130
call fcn.00409240
int3
Function at 0x415db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x4c], 0x720063
push edi
mov dword [ebp - 0x48], 0x610065
mov dword [ebp - 0x44], 0x650074
mov dword [ebp - 0x40], 0x730020
mov dword [ebp - 0x3c], 0x610074
mov dword [ebp - 0x38], 0x740072
mov dword [ebp - 0x34], 0x6d0020
mov dword [ebp - 0x30], 0x6e0065
mov dword [ebp - 0x2c], 0x200075
mov dword [ebp - 0x28], 0x6e0075
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740073
mov dword [ebp - 0x1c], 0x6c0061
mov dword [ebp - 0x18], 0x20006c
mov dword [ebp - 0x14], 0x69006c
mov dword [ebp - 0x10], 0x6b006e
mov dword [ebp - 0xc], 0x730020
mov dword [ebp - 8], 0x630075
mov word [ebp - 4], ax
call fcn.00409bb0
mov ecx, eax
test ecx, ecx
je 0x415e9b
mov eax, dword [ecx]
push 2
push 0x24
call dword [eax]
test eax, eax
je 0x415ea5
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x24
jl 0x415e91
mov dword [eax - 0xc], 0x24
mov edx, 0x48
mov ecx, dword [esi]
xor eax, eax
push 0x48
mov word [ecx + 0x48], ax
lea eax, [ebp - 0x4c]
mov ecx, dword [esi]
push eax
call fcn.0040a070
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0040a130
push 0x80004005
call fcn.0040a130
call fcn.00409240
int3
Function at 0x417e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x7c], 0x4f0053
push edi
mov dword [ebp - 0x78], 0x540046
mov dword [ebp - 0x74], 0x410057
mov dword [ebp - 0x70], 0x450052
mov dword [ebp - 0x6c], 0x4d005c
mov dword [ebp - 0x68], 0x630069
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x6f0073
mov dword [ebp - 0x5c], 0x740066
mov dword [ebp - 0x58], 0x57005c
mov dword [ebp - 0x54], 0x6e0069
mov dword [ebp - 0x50], 0x6f0064
mov dword [ebp - 0x4c], 0x730077
mov dword [ebp - 0x48], fcn.0043005c
mov dword [ebp - 0x44], 0x720075
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x74006e
mov dword [ebp - 0x38], 0x650056
mov dword [ebp - 0x34], 0x730072
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x6e0055
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740073
mov dword [ebp - 0x1c], 0x6c0061
mov dword [ebp - 0x18], 0x5c006c
mov dword [ebp - 0x14], 0x6e0041
mov dword [ebp - 0x10], 0x740079
mov dword [ebp - 0xc], 0x690068
mov dword [ebp - 8], 0x67006e
mov word [ebp - 4], ax
call fcn.00409bb0
mov ecx, eax
test ecx, ecx
je 0x417f8f
mov eax, dword [ecx]
push 2
push 0x3c
call dword [eax]
test eax, eax
je 0x417f99
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x3c
jl 0x417f85
mov dword [eax - 0xc], 0x3c
mov edx, 0x78
mov ecx, dword [esi]
xor eax, eax
push 0x78
mov word [ecx + 0x78], ax
lea eax, [ebp - 0x7c]
mov ecx, dword [esi]
push eax
call fcn.0040a070
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0040a130
push 0x80004005
call fcn.0040a130
call fcn.00409240
int3