joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0x43665e
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x43665e
mov word [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0xbcbdbebf
mov dword [esp + 8], 0
mov ecx, dword [esp + 8]
cmp ecx, 0x19
ja 0x436507
nop
mov ecx, dword [esp + 8]
mov edx, dword [esp + 8]
add cl, 0xe8
xor cl, byte [esp + edx + 0x10]
add cl, 0xa8
mov edx, dword [esp + 8]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 8]
mov ecx, dword [esp + 8]
cmp ecx, 0x1a
jb 0x4364e0
mov ebx, dword [ebp + 0x10]
mov edi, dword [esp + 0x10]
mov edx, dword [0x44a04c]
test edx, edx
je 0x436555
xor ecx, ecx
mov ebx, dword [0x44a050]
cmp dword [ebx + ecx*8], 0xfb49c974
je 0x436533
inc ecx
cmp edx, ecx
jne 0x436520
mov ebx, dword [ebp + 0x10]
jmp 0x436555
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, edi
mov ebx, dword [ebp + 0x10]
je 0x436555
push dword [ebp + 8]
push eax
push 2
push dword [0x44a054]
push ecx
call fcn.00437ca0
add esp, 0x14
mov edi, eax
cmp dword [ebp + 0xc], 1
mov eax, ebx
sbb eax, 0
jl 0x436653
cmp edi, 0xc000010a
jne 0x436653
mov ecx, 0xffffd8f0
mov edi, dword [ebp + 0xc]
mov eax, edi
mul ecx
sub edx, edi
imul ecx, ebx, 0xffffd8f0
add ecx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esi]
mov word [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0xbcbdbebf
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x19
ja 0x436607
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
add cl, 0xe8
xor cl, byte [esp + edx + 0x10]
add cl, 0xa8
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x1a
jb 0x4365e0
mov edi, dword [esp + 0x10]
mov ecx, dword [0x44a04c]
test ecx, ecx
je 0x436653
xor edx, edx
mov ebx, dword [0x44a050]
nop
nop
nop
cmp dword [ebx + edx*8], 0x7a1a689f
je 0x436630
inc edx
cmp ecx, edx
jne 0x436620
jmp 0x436653
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, edi
je 0x436653
lea edx, [esp + 8]
push edx
push 0
push eax
push 3
push dword [0x44a054]
push ecx
call fcn.00437ca0
add esp, 0x18
mov edi, eax
test edi, edi
js 0x43665e
mov ecx, esi
call fcn.00436390
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x436670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x436687
lea edx, [esp + 0x38]
mov ecx, dword [ecx]
mov word [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0xbcbdbebf
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x19
ja 0x436705
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0xc]
add al, 0xe8
xor al, byte [esp + esi + 0x10]
add al, 0xa8
mov esi, dword [esp + 0xc]
mov byte [esp + esi + 0x10], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x1a
jb 0x4366e0
mov eax, dword [esp + 0x10]
mov esi, dword [0x44a04c]
test esi, esi
je 0x436754
xor edi, edi
mov ebx, dword [0x44a050]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb7fd7148
je 0x436730
inc edi
cmp esi, edi
jne 0x436720
jmp 0x436754
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x436754
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44a054]
push esi
call fcn.00437ca0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x437280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov dword [esp + 0x10], 0x4bd045d4
mov dword [esp + 0x14], 0x4fe449ee
mov dword [esp + 0x18], 0x339e4de2
mov dword [esp + 0x1c], 0x379c3196
mov dword [esp + 0x20], 0x3b34359a
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x24
ja 0x43732d
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, eax
and edx, 0xcffc835
xor eax, 0xcffc835
lea edx, [eax + edx*2]
lea eax, [edx + ecx]
and edx, ecx
add edx, edx
sub eax, edx
add al, 0x8d
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x25
jb 0x4372f0
lea esi, [esp + 0x10]
push esi
call fcn.00439940
add esp, 4
mov ecx, eax
mov dword [0x452070], eax
xor eax, eax
test ecx, ecx
sete al
mov eax, dword [eax*4 + 0x446da4]
mov edx, 0x28d08397
xor edx, dword [0x446dac]
add edx, eax
inc edx
xor eax, eax
jmp edx

Function at 0x439940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov byte [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0x33343506
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x18
ja 0x4399c5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
add al, 0x79
xor al, byte [esp + ecx + 0x30]
add al, 0xb1
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x30], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x19
jb 0x4399a0
mov eax, dword [esp + 0x30]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
mov ecx, dword [ecx*4 + 0x44806c]
mov edx, 0x36841ad3
xor edx, dword [0x448074]
add ecx, edx
inc ecx
jmp ecx

Function at 0x439d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov word [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x33343506
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1d
ja 0x439dd0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
add al, 0xf9
xor al, byte [esp + ecx + 0x10]
add al, 0x31
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1e
jb 0x439db0
mov eax, dword [esp + 0x10]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
mov ecx, dword [ecx*4 + 0x4482fc]
mov edx, 0xdee3d491
xor edx, dword [0x448304]
add ecx, edx
inc ecx
jmp ecx
Function at 0x401055
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0xc], 0x6d
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0xc], 0
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0xc], 0x61
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0xc], 0x6e
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0xc], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0xc], 0x64
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0xc], 0x65
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
call sub.libav.dll_Ordinal_44283
pop ecx
pop ecx
cmp dword [eax + 0x18], 0
jne 0x4010de
lea eax, [ebp - 4]
push eax
push str.EXIT__d
push dword [ebp + 0xc]
call fcn.0040effc
add esp, 0xc
cmp eax, 1
jne 0x4010dc
push dword [ebp - 4]
call fcn.0040f419
jmp 0x4010f0
push 0
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 1
call fcn.00422df4
add esp, 0x10
leave
ret
Function at 0x4010f2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0x14], 0
and dword [ebp - 0x18], 0
and dword [ebp - 8], 0
push 0x104
push 0x430360
push 0
call fcn.0040c395
add esp, 0xc
push 0x5c
push 0x430360
call fcn.0040f4f0
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40122e
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov byte [ebp - 1], al
inc dword [ebp - 0xc]
cmp byte [ebp - 1], 0
jne 0x401147
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x34], 0x2e
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x34], 0x78
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x34], 0x55
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x34], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x34], 0
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x34], 0x70
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x34], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x34], 0x65
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x34], 0x64
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x34], 0x61
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x34], 0x72
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x34], 0x74
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov byte [ebp - 2], al
inc dword [ebp - 0x10]
cmp byte [ebp - 2], 0
jne 0x4011f7
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jle 0x40122c
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], 0
jmp 0x401235
mov dword [ebp - 8], 0x430360
mov eax, dword [ebp - 8]
leave
ret
Function at 0x405266
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 6
push dword [ebp + 0xc]
call sub.libav.dll_Ordinal_44340
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x405335
push dword [ebp + 8]
push str._s.cvd
push 0x20
lea eax, [ebp - 0x24]
push eax
call sub.libav.dll_Ordinal_44276
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jae 0x4052a6
cmp dword [ebp - 4], 0xffffffff
jne 0x4052ae
or eax, 0xffffffff
jmp 0x40534a
push 4
lea eax, [ebp - 0x24]
push eax
call sub.libav.dll_Ordinal_44340
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x405301
push dword [ebp + 8]
push str._s.cld
push 0x20
lea eax, [ebp - 0x24]
push eax
call sub.libav.dll_Ordinal_44276
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jae 0x4052e5
cmp dword [ebp - 4], 0xffffffff
jne 0x4052ea
or eax, 0xffffffff
jmp 0x40534a
push 4
lea eax, [ebp - 0x24]
push eax
call sub.libav.dll_Ordinal_44340
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x405301
or eax, 0xffffffff
jmp 0x40534a
push dword [ebp + 0xc]
call fcn.004231a1
pop ecx
cmp eax, 0xffffffff
jne 0x405314
or eax, 0xffffffff
jmp 0x40534a
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
call sub.libav.dll_Ordinal_44213
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x405335
push dword [ebp + 0xc]
call sub.libav.dll_Ordinal_44210
pop ecx
or eax, 0xffffffff
jmp 0x40534a
push dword [ebp + 0xc]
call fcn.00422ede
pop ecx
cmp eax, 0xffffffff
jne 0x405348
or eax, 0xffffffff
jmp 0x40534a
xor eax, eax
leave
ret
Function at 0x40534c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
and dword [ebp - 0x10], 0
push 0x431800
call sub.libav.dll_Ordinal_44272
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x405375
or eax, 0xffffffff
jmp 0x4054d0
push dword [ebp - 8]
call sub.libav.dll_Ordinal_44273
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4054c4
mov eax, dword [ebp - 4]
movzx eax, word [eax]
test eax, eax
je 0x4054bf
push str..cld
mov eax, dword [ebp - 4]
add eax, 3
push eax
call sub.libav.dll_Ordinal_44258
pop ecx
pop ecx
test eax, eax
jne 0x4053cb
push str..cvd
mov eax, dword [ebp - 4]
add eax, 3
push eax
call sub.libav.dll_Ordinal_44258
pop ecx
pop ecx
test eax, eax
je 0x4054bf
mov eax, dword [ebp - 4]
add eax, 3
push eax
push 0x431800
push 0x427750
push 0x200
lea eax, [ebp - 0x210]
push eax
call sub.libav.dll_Ordinal_44276
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call sub.libav.dll_Ordinal_5
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4054bf
or dword [ebp - 0x10], 0xffffffff
push dword [ebp - 0xc]
call sub.libav.dll_Ordinal_27
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
push str._Corrupted_database_file__s:__s_n
call fcn.0040d420
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push str._s.broken
push 0x201
lea eax, [ebp - 0x414]
push eax
call sub.libav.dll_Ordinal_44276
add esp, 0x10
push 4
lea eax, [ebp - 0x414]
push eax
call sub.libav.dll_Ordinal_44340
pop ecx
pop ecx
test eax, eax
jne 0x40546d
lea eax, [ebp - 0x414]
push eax
call fcn.00422e36
pop ecx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00410c1f
pop ecx
pop ecx
test eax, eax
je 0x4054ac
lea eax, [ebp - 0x210]
push eax
call fcn.00422e36
pop ecx
test eax, eax
je 0x4054aa
lea eax, [ebp - 0x210]
push eax
push str._Cant_remove_broken_database_file__s__please_delete_it_manually_and_restart_PCAccelerateProUpdater_n
call fcn.0040d420
pop ecx
pop ecx
jmp 0x4054bf
lea eax, [ebp - 0x414]
push eax
push str.Corrupted_database_file_renamed_to__s_n
call fcn.0040d420
pop ecx
pop ecx
jmp 0x405375
push dword [ebp - 8]
call sub.libav.dll_Ordinal_44274
pop ecx
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x409859
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
and dword [ebp - 4], 0
jmp 0x40986c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 4]
jae 0x409a33
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x23
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x25
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x4d
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x20
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x72
mov eax, dword [ebp - 4]
inc eax
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040fb6c
pop ecx
pop ecx
push 0x426950
call fcn.0040fb6c
pop ecx
mov eax, dword [ebp - 4]
imul eax, eax, 0x34
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x20]
cmp dword [ecx + eax], 0
je 0x40994e
push 0x2e
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x34
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x20]
add ecx, eax
push ecx
push 2
call sub.libav.dll_Ordinal_44335
add esp, 0x10
push eax
push str.IP:__s_n
call fcn.0040fb6c
pop ecx
pop ecx
jmp 0x40997c
push 0x2e
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x34
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x20]
lea eax, [ecx + eax + 0x14]
push eax
push 0x17
call sub.libav.dll_Ordinal_44335
add esp, 0x10
push eax
push str.IP:__s_n
call fcn.0040fb6c
pop ecx
pop ecx
mov eax, dword [ebp - 4]
imul eax, eax, 0x34
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x20]
push dword [ecx + eax + 8]
push str.Successes:__u_n
call fcn.0040fb6c
pop ecx
pop ecx
mov eax, dword [ebp - 4]
imul eax, eax, 0x34
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x20]
push dword [ecx + eax + 0xc]
push str.Failures:__u_n
call fcn.0040fb6c
pop ecx
pop ecx
mov eax, dword [ebp - 4]
imul eax, eax, 0x34
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x20]
mov eax, dword [ecx + eax + 4]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0x10]
push eax
call fcn.00411713
pop ecx
push eax
push str.Last_access:__s
call fcn.0040fb6c
pop ecx
pop ecx
mov eax, dword [ebp - 4]
imul eax, eax, 0x34
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x20]
movzx eax, byte [ecx + eax + 0x10]
test eax, eax
je 0x409a01
mov dword [ebp - 8], 0x427c78
jmp 0x409a08
mov dword [ebp - 8], 0x427c7c
push dword [ebp - 8]
push str.Ignore:__s_n
call fcn.0040fb6c
pop ecx
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
dec eax
cmp dword [ebp - 4], eax
je 0x409a2e
push str.______________________________________n
call fcn.0040fb6c
pop ecx
jmp 0x409865
leave
ret
Function at 0x40c0fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x69
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x70
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x33
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x64
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x32
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x41
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x10], 0
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x61
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x64
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x2e
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x76
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x40c19b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x32
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x2e
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x33
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x4b
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x64
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x10], 0
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x65
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x65
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x72
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
leave
ret
Function at 0x40c23b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0xc], 0x65
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0xc], 0x53
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0xc], 0x33
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0xc], 0x6c
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0xc], 0x6c
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0xc], 0x6c
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0xc], 0x64
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0xc], 0x68
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0xc], 0x32
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0xc], 0x2e
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0xc], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0xc], 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x40c2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 8], 0
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x72
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x43
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x78
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0x57
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x18], 0
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x4d
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x75
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x61
lea eax, [ebp - 0x18]
push eax
call fcn.0040c19b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c390
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret
Function at 0x40c395
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x4e
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x64
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x69
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x4d
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x47
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x46
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x1c], 0x41
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x6c
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x65
lea eax, [ebp - 0x1c]
push eax
call fcn.0040c19b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c497
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret