joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408697
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x3c
push eax
call fcn.0041fc47
add esp, 4
cmp eax, 0x1000
ja 0x40880c
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x7dc]
test ecx, ecx
je 0x40880b
push ebx
push edi
lea edi, [eax + eax]
lea ebx, [ecx + 0xac14]
mov ecx, dword [ebp + 0xc]
push edi
push ebx
push ecx
call fcn.0041fc67
add esp, 0xc
test eax, eax
jne 0x408809
mov edx, dword [ebp + 0xc]
push edi
push edx
push ebx
call fcn.0041fa47
add esp, 0xc
xor ecx, ecx
xor eax, eax
push 0x104
mov word [ebp - 4], cx
mov ecx, dword [esi + 0xdd8]
lea ebx, [esi + 0x32aa]
push ebx
mov dword [ebp - 0xc], 0xa000d
mov dword [ebp - 8], 0xa000d
mov dword [ebp - 0x3c], 0x6c0043
mov dword [ebp - 0x38], 0x700069
mov dword [ebp - 0x34], 0x6f0062
mov dword [ebp - 0x30], 0x720061
mov dword [ebp - 0x2c], 0x64
mov word [ebp - 0x28], ax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov word [ebp - 0x1e], ax
call ecx
mov edx, dword [esi + 0xf88]
push eax
call edx
cmp eax, 0x40
jbe 0x408769
xor eax, eax
mov word [esi + 0x332a], ax
jmp 0x408798
test eax, eax
jne 0x408798
push 0x10
lea eax, [ebp - 0x1c]
push eax
push ebx
mov dword [ebp - 0x1c], 0x6e0055
mov dword [ebp - 0x18], 0x6e006b
mov dword [ebp - 0x14], 0x77006f
mov dword [ebp - 0x10], 0x6e
call fcn.0041fa47
add esp, 0xc
push 0x14
lea ecx, [ebp - 0x3c]
push ecx
lea edi, [esi + 0x4d24]
push edi
call fcn.0041fa47
push 0
lea edx, [ebp - 0xc]
push edx
push edi
call fcn.0041fdb7
push 0
push ebx
push edi
call fcn.0041fdb7
push 0
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.0041fdb7
mov ecx, dword [ebp + 0xc]
push 0
push ecx
push edi
call fcn.0041fdb7
push edi
call fcn.0041fc47
add esp, 0x40
add eax, eax
push edi
mov dword [esi + 0xa0c], eax
call fcn.0041fc47
mov edx, dword [esi + 0xa08]
add eax, eax
push eax
push edi
push edx
call fcn.0041fa47
push 0x13
push esi
call fcn.0040f137
add esp, 0x18
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b347
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor ecx, ecx
mov edi, 0x100
nop
mov eax, ecx
shl eax, 0x18
mov esi, 8
lea ebx, [ebx]
test eax, eax
jns 0x40b374
add eax, eax
xor eax, 0x4c11db7
jmp 0x40b376
add eax, eax
dec esi
jne 0x40b367
mov dword [edx], eax
inc ecx
add edx, 4
dec edi
jne 0x40b357
pop edi
pop esi
pop ebp
ret

Function at 0x40b387
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push 0x3fc
lea eax, [ebp - 0x3fc]
push 0
push eax
mov dword [ebp - 0x400], 0
call fcn.0041fac7
lea ecx, [ebp - 0x400]
push ecx
call fcn.0040b347
mov esi, dword [ebp + 0xc]
add esp, 0x10
or eax, 0xffffffff
test esi, esi
je 0x40b3ea
mov edx, dword [ebp + 8]
push edi
movzx edi, byte [edx]
mov ecx, eax
shr ecx, 0x18
xor ecx, edi
and ecx, 0xff
shl eax, 8
xor eax, dword [ebp + ecx*4 - 0x400]
inc edx
dec esi
jne 0x40b3cb
pop edi
not eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b3f7
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
pop ebp
ret
Function at 0x40c017
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov edx, ecx
sub edx, eax
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x106], cl
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x40c029
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [ebp + eax - 0x208]
movzx edx, byte [ebp + eax - 0x106]
add ecx, esi
lea esi, [ecx + edx]
and esi, 0x800000ff
jns 0x40c08c
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + eax - 0x106]
mov dl, byte [ebp + esi - 0x106]
mov byte [ebp + eax - 0x106], dl
inc eax
mov byte [ebp + esi - 0x106], cl
cmp eax, 0x100
jl 0x40c067
xor eax, eax
xor cl, cl
mov byte [ebp - 0x107], 0
cmp dword [ebp + 0xc], eax
jbe 0x40c138
mov edi, dword [ebp + 8]
push ebx
jmp 0x40c0cd
mov cl, byte [ebp - 0x108]
mov dl, byte [eax + edi]
inc cl
mov byte [ebp - 0x108], cl
movzx esi, cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, byte [ebp - 0x107]
add ecx, ebx
mov byte [ebp - 0x107], cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x106]
mov byte [ebp - 1], bl
movzx ebx, byte [ecx]
mov byte [ebp + esi - 0x106], bl
movzx ebx, byte [ebp - 1]
mov byte [ecx], bl
movzx ebx, byte [ebp + esi - 0x106]
add bl, byte [ecx]
inc eax
movzx ecx, bl
mov cl, byte [ebp + ecx - 0x106]
xor cl, dl
mov byte [eax + edi - 1], cl
cmp eax, dword [ebp + 0xc]
jb 0x40c0c7
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411287
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
xor eax, eax
push ebx
push esi
push 0x5f
push eax
mov dword [ebp - 0x29], eax
mov dword [ebp - 0x25], eax
mov byte [ebp - 0x21], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 8], al
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov byte [ebp - 0x110], al
lea eax, [ebp - 0x10f]
push eax
mov dword [ebp - 0x30], 0x656d616e
mov word [ebp - 0x2c], 0x203a
mov byte [ebp - 0x2a], 0
mov dword [ebp - 0x20], 0x756c6176
mov dword [ebp - 0x1c], 0x203a65
mov dword [ebp - 0x10], 0x65746164
mov dword [ebp - 0xc], 0x656d6974
mov dword [ebp - 0x130], 0x454c4553
mov dword [ebp - 0x12c], 0x6e205443
mov dword [ebp - 0x128], 0x2c656d61
mov dword [ebp - 0x124], 0x6c617620
mov dword [ebp - 0x120], 0x46206575
mov dword [ebp - 0x11c], 0x204d4f52
mov dword [ebp - 0x118], 0x6f747561
mov dword [ebp - 0x114], 0x6c6c6966
call fcn.0041fac7
push 0x27
lea ecx, [ebp - 0x57]
push 0
push ecx
mov dword [ebp - 0xb0], 0x454c4553
mov dword [ebp - 0xac], 0x68205443
mov dword [ebp - 0xa8], 0x5f74736f
mov dword [ebp - 0xa4], 0x2c79656b
mov dword [ebp - 0xa0], 0x74617020
mov dword [ebp - 0x9c], 0x69202c68
mov dword [ebp - 0x98], 0x65735f73
mov dword [ebp - 0x94], 0x65727563
mov dword [ebp - 0x90], 0x7865202c
mov dword [ebp - 0x8c], 0x65726970
mov dword [ebp - 0x88], 0x74755f73
mov dword [ebp - 0x84], 0x6e202c63
mov dword [ebp - 0x80], 0x2c656d61
mov dword [ebp - 0x7c], 0x6c617620
mov dword [ebp - 0x78], 0x202c6575
mov dword [ebp - 0x74], 0x72636e65
mov dword [ebp - 0x70], 0x65747079
mov dword [ebp - 0x6c], 0x61765f64
mov dword [ebp - 0x68], 0x2065756c
mov dword [ebp - 0x64], 0x4d4f5246
mov dword [ebp - 0x60], 0x6f6f6320
mov dword [ebp - 0x5c], 0x7365696b
mov byte [ebp - 0x58], 0
call fcn.0041fac7
lea edx, [ebp - 0x30]
push edx
call fcn.0041fc27
mov esi, dword [ebp + 0xc]
inc eax
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0xac]
push ecx
call fcn.0041fa47
lea edx, [ebp - 0x20]
push edx
call fcn.0041fc27
inc eax
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0xbc]
push ecx
call fcn.0041fa47
lea edx, [ebp - 0x10]
push edx
call fcn.0041fc27
inc eax
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0xcc]
push ecx
call fcn.0041fa47
lea edx, [ebp - 0xb0]
add esp, 0x48
push edx
call fcn.0041fc27
inc eax
push eax
lea eax, [ebp - 0xb0]
push eax
lea ecx, [esi + 0x1dc]
push ecx
call fcn.0041fa47
lea edx, [ebp - 0x130]
push edx
call fcn.0041fc27
inc eax
push eax
lea eax, [ebp - 0x130]
push eax
add esi, 0x25c
push esi
call fcn.0041fa47
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411537
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x400
push esi
call fcn.0041fa77
mov edi, dword [ebp + 0x14]
xor eax, eax
push edi
mov word [ebp - 8], 9
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x10], 0x45555254
mov byte [ebp - 0xc], al
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
mov dword [ebp - 0x18], 0x534c4146
mov dword [ebp - 0x14], 0x45
call fcn.0041fc27
push eax
push edi
push esi
call fcn.0041fa47
push 0
lea ecx, [ebp - 8]
push ecx
push esi
call fcn.0041fd57
push 0
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0041fd57
push 0
lea eax, [ebp - 8]
push eax
push esi
call fcn.0041fd57
mov ecx, dword [ebp + 0x18]
push 0
push ecx
push esi
call fcn.0041fd57
add esp, 0x48
push 0
lea edx, [ebp - 8]
push edx
push esi
call fcn.0041fd57
mov eax, dword [ebp + 0x1c]
add esp, 0xc
cmp byte [eax], 0x30
push 0
jne 0x4115de
lea ecx, [ebp - 0x18]
push ecx
jmp 0x4115e2
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0041fd57
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push esi
call fcn.0041fd57
mov ecx, dword [ebp + 0x20]
push 0
push ecx
push esi
call fcn.0041fd57
push 0
lea edx, [ebp - 8]
push edx
push esi
call fcn.0041fd57
mov eax, dword [ebp + 0x24]
push 0
push eax
push esi
call fcn.0041fd57
push 0
lea ecx, [ebp - 8]
push ecx
push esi
call fcn.0041fd57
mov edi, dword [ebp + 8]
push 0xb
push 0
push 0
push esi
push edi
call fcn.00414bf7
mov edx, dword [ebp + 0x30]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x10]
add esp, 0x50
push 0xb
push edx
mov edx, dword [ecx + 0x3c4]
push eax
push edx
push esi
push edi
call fcn.00414d87
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4121c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push esi
push edi
push 0xadedab08
call fcn.0041f257
mov edi, dword [ebp + 8]
xor ecx, ecx
push 0x36
push ecx
lea edx, [ebp - 0x4a]
mov esi, eax
push edx
mov dword [edi + 0xa18], esi
mov dword [ebp - 0x54], 0x410050
mov dword [ebp - 0x50], 0x480054
mov word [ebp - 0x4c], cx
call fcn.0041fac7
xor edx, edx
add esp, 0x10
mov dword [ebp - 0x14], 0x690046
mov dword [ebp - 0x10], 0x650072
mov dword [ebp - 0xc], 0x6f0066
mov dword [ebp - 8], 0x5c0078
mov word [ebp - 4], dx
test esi, esi
jne 0x412238
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
xor eax, esi
push 0x1000
push edi
mov dword [edi + 0xa18], eax
call fcn.0041fb07
push 0x7378
push edi
mov dword [edi + 0xa08], eax
call fcn.0041fb07
mov esi, eax
add esp, 0x10
test esi, esi
je 0x412230
cmp dword [edi + 0xa08], 0
je 0x412230
push ebx
push 0x3f
lea ecx, [ebp - 0x93]
push 0
push ecx
mov byte [ebp - 0x94], 0
call fcn.0041fac7
lea edx, [ebp - 0x94]
push 0
push edx
call fcn.004205b7
lea ecx, [ebp - 0x94]
lea eax, [edi + 0x20]
push ecx
push eax
lea ebx, [esi + 0xc]
call fcn.0040c2f7
mov edx, dword [esi]
push edx
push ebx
push edi
mov dword [ebx], eax
call fcn.0041b747
add esp, 0x28
cmp dword [esi + 0x10], 0
je 0x4123e9
cmp dword [esi + 0x14], 0
je 0x4123e9
cmp dword [esi + 0x18], 0
je 0x4123e9
cmp dword [esi + 0x1c], 0
je 0x4123e9
cmp dword [esi + 0x20], 0
je 0x4123e9
cmp dword [esi + 0x24], 0
je 0x4123e9
cmp dword [esi + 0x28], 0
je 0x4123e9
cmp dword [esi + 0x2c], 0
je 0x4123e9
cmp dword [esi + 0x34], 0
je 0x4123e9
cmp dword [esi + 0x38], 0
je 0x4123e9
push 0x3f
lea eax, [ebp - 0xd3]
push 0
push eax
mov byte [ebp - 0xd4], 0
call fcn.0041fac7
lea ecx, [ebp - 0xd4]
push 6
push ecx
call fcn.004205b7
lea edx, [ebp - 0xd4]
push edx
lea ebx, [edi + 0x20]
push ebx
call fcn.0040c2f7
add esp, 0x1c
test eax, eax
je 0x4123e9
push 0x2430512b
push 0
push 0
push eax
push ebx
call fcn.00418a67
add esp, 0x14
mov dword [esi + 0x48], eax
test eax, eax
je 0x4123e9
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x412383
mov dword [esi + 4], eax
jmp 0x41238a
mov dword [esi + 4], 0x20
push 8
lea eax, [ebp - 0x54]
push eax
lea ecx, [esi + 0x4c]
push ecx
mov dword [esi], 0x32
call fcn.0041fa47
lea ebx, [edi + 0xfc8]
push ebx
call fcn.0041fc47
add eax, eax
push eax
lea edx, [edi + 0x8f4]
push ebx
push edx
call fcn.0041fa47
push esi
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.00413357
push esi
push edi
call fcn.0041fa27
mov ecx, dword [edi + 0xa08]
push ecx
push edi
call fcn.0041fa27
add esp, 0x38
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4123f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x2be]
push ecx
mov word [ebp - 0x2c0], ax
call fcn.0041fac7
xor eax, eax
push 0x36
push eax
lea ecx, [ebp - 0xb6]
push ecx
mov dword [ebp - 0xc0], 0x65002e
mov dword [ebp - 0xbc], 0x650078
mov word [ebp - 0xb8], ax
call fcn.0041fac7
xor ecx, ecx
push 0x2e
push ecx
lea edx, [ebp - 0x6e]
push edx
mov dword [ebp - 0x80], 0x460020
mov dword [ebp - 0x7c], 0x720069
mov dword [ebp - 0x78], 0x660065
mov dword [ebp - 0x74], 0x78006f
mov word [ebp - 0x70], cx
call fcn.0041fac7
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push 5
lea edx, [ebp - 0x2c0]
push edx
push esi
mov dword [ebp - 0x40], 0x720050
mov dword [ebp - 0x3c], 0x67006f
mov dword [ebp - 0x38], 0x610072
mov dword [ebp - 0x34], 0x20006d
mov dword [ebp - 0x30], 0x690046
mov dword [ebp - 0x2c], 0x65006c
mov dword [ebp - 0x28], 0x73
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.0040c647
add esp, 0x34
push 1
lea eax, [ebp - 0x2c0]
push 0x13
push eax
call fcn.0041fc47
add esp, 4
lea ecx, [ebp + eax*2 - 0x2c0]
push ecx
push esi
call fcn.0040c647
push 0
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.0041fdb7
push 0
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x2c0]
mov ecx, 0x5c
push eax
mov word [ebp - 0x80], cx
call fcn.0041fdb7
push 0
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call fcn.0041fdb7
push 0
push 0x15
lea eax, [ebp - 0x2c0]
push eax
push esi
call fcn.00418657
add esp, 0x44
test eax, eax
jne 0x412614
lea ecx, [ebp - 0x2ba]
push 0x80
push ecx
call fcn.0041fa77
lea eax, [ebp - 0x40]
mov edx, 0x20
push eax
mov word [ebp - 0x80], dx
call fcn.0041fc47
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x2ba]
push eax
call fcn.0041fa47
add esp, 0x18
push 1
lea ecx, [ebp - 0x2c0]
push 0x13
push ecx
call fcn.0041fc47
add esp, 4
lea edx, [ebp + eax*2 - 0x2c0]
push edx
push esi
call fcn.0040c647
push 0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.0041fdb7
push 0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x2c0]
mov edx, 0x5c
push ecx
mov word [ebp - 0x80], dx
call fcn.0041fdb7
push 0
lea edx, [ebp - 0xc0]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.0041fdb7
push 0
push 0x15
lea ecx, [ebp - 0x2c0]
push ecx
push esi
call fcn.00418657
add esp, 0x44
test eax, eax
jne 0x412614
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41263c
lea edx, [ebp - 0x2c0]
push edx
call fcn.0041fc47
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
push esi
call fcn.0041fa47
add esp, 0x10
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4135d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
push edi
xor ecx, ecx
push 0x36
push ecx
lea edx, [ebp - 0x66]
push edx
mov dword [ebp - 0x70], 0x410050
mov dword [ebp - 0x6c], 0x480054
mov word [ebp - 0x68], cx
call fcn.0041fac7
mov edi, dword [ebp + 8]
xor edx, edx
xor eax, eax
push 0x7378
push edi
mov dword [ebp - 0x14], 0x690046
mov dword [ebp - 0x10], 0x650072
mov dword [ebp - 0xc], 0x6f0066
mov dword [ebp - 8], 0x5c0078
mov word [ebp - 4], dx
mov dword [ebp - 0x30], 0x680054
mov dword [ebp - 0x2c], 0x6e0075
mov dword [ebp - 0x28], 0x650064
mov dword [ebp - 0x24], 0x620072
mov dword [ebp - 0x20], 0x720069
mov dword [ebp - 0x1c], 0x5c0064
mov word [ebp - 0x18], ax
call fcn.0041fb07
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x41366e
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 8
lea ecx, [ebp - 0x70]
push ecx
lea ebx, [esi + 0x4c]
push ebx
mov dword [esi], 0x32
call fcn.0041fa47
push 0
lea edx, [ebp - 0x14]
push edx
push esi
push edi
call fcn.00412a37
add esp, 0x1c
test eax, eax
je 0x4136b4
push esi
push edi
call fcn.00412d47
add esp, 8
test eax, eax
je 0x4136b4
push esi
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.00413357
add esp, 0xc
cmp dword [esi + 0xc], 0
je 0x4136d2
push 0x16
push esi
push edi
call fcn.004152b7
push 0x1024
push esi
push edi
call fcn.004152b7
add esp, 0x18
cmp dword [esi + 8], 0
je 0x4136ec
lea ecx, [esi + 0x286c]
push ecx
lea edx, [ebp - 0x70]
push edx
push edi
call fcn.0040c447
add esp, 0xc
push 0x7378
push esi
call fcn.0041fa77
push 8
lea eax, [ebp - 0x70]
push eax
push ebx
mov dword [esi], 0x64
call fcn.0041fa47
push 0
lea ecx, [ebp - 0x30]
push ecx
push esi
push edi
call fcn.00412a37
add esp, 0x24
pop ebx
test eax, eax
je 0x41373a
push esi
push edi
call fcn.00412d47
add esp, 8
test eax, eax
je 0x41373a
push esi
lea edx, [ebp - 0x30]
push edx
push edi
call fcn.00413357
add esp, 0xc
cmp dword [esi + 0xc], 0
je 0x413758
push 0x16
push esi
push edi
call fcn.004152b7
push 0x1024
push esi
push edi
call fcn.004152b7
add esp, 0x18
cmp dword [esi + 8], 0
je 0x413772
lea eax, [esi + 0x286c]
push eax
lea ecx, [ebp - 0x70]
push ecx
push edi
call fcn.0040c447
add esp, 0xc
push esi
push edi
call fcn.0041fa27
add esp, 8
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4149f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push esi
push edi
mov eax, 0x4f
mov word [ebp - 0x70], ax
mov eax, 0x70
mov word [ebp - 0x6e], ax
mov eax, 0x65
mov word [ebp - 0x6c], ax
mov eax, 0x72
mov word [ebp - 0x6a], ax
mov eax, 0x61
mov word [ebp - 0x68], ax
xor eax, eax
mov word [ebp - 0x66], ax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov eax, 0x43
mov word [ebp - 0x50], ax
mov eax, 0x68
mov word [ebp - 0x4e], ax
mov eax, 0x72
mov word [ebp - 0x4c], ax
mov eax, 0x6f
mov word [ebp - 0x4a], ax
mov eax, 0x6d
xor ecx, ecx
mov word [ebp - 0x48], ax
push 0x3f
mov eax, 0x65
push ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x46], ax
xor eax, eax
xor edx, edx
lea ecx, [ebp - 0xaf]
push ecx
mov word [ebp - 4], 0xa0d
mov byte [ebp - 2], 0
mov word [ebp - 0x44], ax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov word [ebp - 0x32], ax
mov dword [ebp - 0xc], 0x52550a0d
mov dword [ebp - 8], 0x203a4c
mov dword [ebp - 0x30], 0x2d005c
mov dword [ebp - 0x2c], 0x31002d
mov dword [ebp - 0x28], 0x300033
mov dword [ebp - 0x24], 0x310038
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov byte [ebp - 0xb0], al
call fcn.0041fac7
lea edx, [ebp - 0xb0]
push 6
push edx
call fcn.004205b7
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xb0]
push eax
lea ecx, [edi + 0x20]
push ecx
call fcn.0040c2f7
mov esi, dword [ebp + 0xc]
add esp, 0x1c
mov dword [esi + 0x350], eax
test eax, eax
jne 0x414b23
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
call fcn.0041fc27
inc eax
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.0041fa47
lea ecx, [ebp - 0xc]
push ecx
call fcn.0041fc27
inc eax
push eax
lea edx, [ebp - 0xc]
push edx
lea eax, [esi + 0x10]
push eax
call fcn.0041fa47
lea ecx, [ebp - 0x30]
push ecx
call fcn.0041fc47
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0x20]
push ecx
call fcn.0041fa47
mov eax, dword [ebp + 0x10]
add esp, 0x30
cmp eax, 0x16
jne 0x414b8e
lea edx, [ebp - 0x50]
push edx
call fcn.0041fc47
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [esi + 0x40]
push edx
jmp 0x414bab
cmp eax, 0x1024
jne 0x414bb3
lea eax, [ebp - 0x70]
push eax
call fcn.0041fc47
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x70]
push edx
lea eax, [esi + 0x40]
push eax
call fcn.0041fa47
add esp, 0x10
push 4
push 0x15
lea ecx, [esi + 0x60]
push ecx
push edi
call fcn.0040c5b7
push 4
push 0x14
lea edx, [esi + 0x80]
push edx
push edi
call fcn.0040c5b7
push 4
push 0x24
add esi, 0xd0
push esi
push edi
call fcn.0040c5b7
add esp, 0x30
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414bf7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
xor edx, edx
push 0x3a
push edx
lea eax, [ebp - 0x7a]
push eax
mov edi, 3
mov dword [ebp - 0x80], 0xa000d
mov word [ebp - 0x7c], dx
call fcn.0041fac7
mov eax, dword [ebp + 0x18]
add esp, 0xc
cmp eax, 0x1024
jne 0x414c35
mov edi, 5
jmp 0x414c63
cmp eax, 8
jne 0x414c3f
lea edi, [eax + 1]
jmp 0x414c63
cmp eax, 0x32
jne 0x414c49
lea edi, [eax - 0x2e]
jmp 0x414c63
cmp eax, 0x64
jne 0x414c53
lea edi, [eax - 0x5d]
jmp 0x414c63
cmp eax, 0xb
jne 0x414c5c
mov edi, eax
jmp 0x414c63
cmp eax, 0xa
jne 0x414c63
mov edi, eax
xor eax, eax
mov dword [ebp - 0x40], 0x520020
mov dword [ebp - 0x3c], 0x630065
mov dword [ebp - 0x38], 0x76006f
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0xd0079
mov dword [ebp - 0x2c], 0xa
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], eax
je 0x414d42
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x414d42
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0xa08]
push 6
lea ecx, [ebp - 0x80]
push ecx
push edx
call fcn.0041fa47
mov eax, dword [esi + 0xa08]
push 0
push ebx
push eax
call fcn.0041fdb7
lea ecx, [ebp - 0x40]
push ecx
call fcn.0041fc47
mov ecx, dword [esi + 0xa08]
add esp, 0x1c
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x40]
push eax
push ecx
call fcn.0041fc47
mov edx, dword [esi + 0xa08]
lea eax, [edx + eax*2]
add esp, 4
push eax
call fcn.0041fa47
mov ecx, dword [esi + 0xa08]
push ecx
call fcn.0041fc47
add eax, eax
push edi
push esi
mov dword [esi + 0xa0c], eax
call fcn.0040f137
add esp, 0x18
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x414d77
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0xa08]
push eax
push edx
call fcn.00420047
mov eax, dword [esi + 0xa08]
push eax
call fcn.0041fc47
add eax, eax
push edi
push esi
mov dword [esi + 0xa0c], eax
call fcn.0040f137
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret