joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5eafdb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x5eb020
call fcn.0045645a
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x5eb01d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5eb067
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x5eb043
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x604454]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x5eb064
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x604454]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x6b4000
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0x6b4031
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x6b403a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [0x6b4047]
push 0
push 0
push 0
push edx
push 0
push 0
call eax
popal
jmp fcn.0058b11a

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x404d5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x404d6c
pop dword [ebp - 0x4c]
mov eax, 0x404d6c
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xab8de773
sub dword [ebp - 0x5c], 0x5d3ba228
mov dword [ebp - 0x58], 0x742aa44a
add dword [ebp - 0x58], 0xbe08a7fb
mov dword [ebp - 0x54], 0x3f326236
sub dword [ebp - 0x54], 0xf2e61e08
mov dword [ebp - 0x50], 0x4569b9d2
add dword [ebp - 0x50], 0xba96462e
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x3bb332d
sub eax, 0x37a62e1
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x70d82e30
add dword [ebp - 0x5c], 0x39a3b26
mov dword [ebp - 0x58], 0x251a2e66
add dword [ebp - 0x58], 0x1c52330f
mov dword [ebp - 0x54], 0xc2abbd1
sub dword [ebp - 0x54], 0xa8bb4f65
mov dword [ebp - 0x50], 0x9ae5e718
add dword [ebp - 0x50], 0x651a18e8
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x6579e53f
add eax, 0x9ac6eb09
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e7ff
push 0
call eax
mov ecx, 0xf82ce3ab
sub ecx, 0xf82c8779
mov edi, eax
mov edx, 0xa5b85b5e
sub edx, 0xa576ab5e
add edx, dword [ebp - 0x4c]
mov esi, 0x57c03c57
sub esi, 0x2e762536
mov dword [ebp - 0x48], 0x7f7369c8
mov ebx, dword [edx]
mov dword [ebp - 8], 0xe251e228
add ebx, esi
xor dword [ebp - 0x14], esi
mov dword [edi], ebx
add edi, 0x6f8933d0
sub edi, 0x6f8933cc
add edx, 0x571a8bde
add edx, 0xa8e57426
loop 0x404e89
add eax, 0x3bcca2d1
sub eax, 0x3bcb3f36
xor ebx, ebx
add ebx, eax
add eax, 0xc6bb376
sub eax, 0xc6bb371
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x408948
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
call fcn.0040896a
xor dword [edx], ebx
sub ecx, 0xd0e670f2
add ecx, 1
inc edx
add ecx, esi
sub esi, esi
cmp edx, eax
jne fcn.00408948
ret
Function at 0x2e001992
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2e03da4c]
jne 0x2e00199c
repz ret
jmp fcn.2e027a26

Function at 0x2e010c88
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e028d1f
call fcn.2e001440
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call fcn.2e012f91
test ax, ax
je 0x2e010d3c
lea eax, [ebp - 0x14]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e010d3c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
mov edi, str.progid
push edi
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x2e010d30
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.2e012f91
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call esi
test eax, eax
jne 0x2e010d24
push dword [ebp - 0x10]
call sub.MSVCR100.dll_strlen
pop ecx
mov ecx, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.2e012f91
push dword [ebp - 0x10]
mov byte [ebp - 4], bl
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x1c]
mov eax, esi
call fcn.2e001489
ret

Function at 0x2e010d44
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e028d4a
call fcn.2e0276dc
mov eax, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov byte [ebp - 0x2d], 0
cmp dword [eax + 0x10], edi
jbe 0x2e010e1f
push eax
lea ecx, [ebp - 0x2c]
call fcn.2e012f91
push esi
mov dword [ebp - 4], edi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.2e012f91
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x2e010d90
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x34]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e010e0f
lea eax, [ebp - 0x38]
push eax
push edi
mov esi, 0x2e02b538
push esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e010e06
mov eax, dword [ebp - 0x38]
inc eax
push eax
call fcn.2e012f91
mov edi, eax
pop ecx
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x38]
push eax
push edi
push 0
push 0
push esi
push dword [ebp - 0x34]
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e010dfb
push edi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.2e012f91
mov byte [ebp - 0x2d], 1
push edi
mov byte [ebp - 4], 0
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2e012f91
mov al, byte [ebp - 0x2d]
call fcn.2e02774b
ret 8
Function at 0x2e010e2a
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x2e028d77
call fcn.2e001440
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor ebx, ebx
push 0x80000001
call esi
cmp eax, ebx
je 0x2e010e62
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call esi
cmp eax, ebx
jne 0x2e010ecd
lea eax, [ebp + 8]
push eax
push ebx
mov esi, 0x2e02b538
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e010ec4
mov eax, dword [ebp + 8]
cmp eax, ebx
jl 0x2e010ec4
inc eax
push eax
call fcn.2e012f91
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp + 8]
push eax
push edi
push ebx
push ebx
push esi
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e010eb9
push edi
call sub.MSVCR100.dll_strlen
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push edi
call fcn.2e012f91
mov bl, 1
or dword [ebp - 4], 0xffffffff
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001489
ret 8

Function at 0x2e012f91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x2e012fa0
pop dword [ebp - 0x50]
mov eax, 0x5b5ec2c5
sub eax, 0x2d5d9325
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x3adc3a3b
add dword [ebp - 0x60], 0x13760b10
mov dword [ebp - 0x5c], 0xab3c8aaf
add dword [ebp - 0x5c], 0x86f6c196
mov dword [ebp - 0x58], 0x2c8886f8
add dword [ebp - 0x58], 0x1fc3bd36
mov dword [ebp - 0x54], 0x39aec957
add dword [ebp - 0x54], 0xc65136a9
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xc38d4cc1
sub dword [ebp - 0x60], 0x4f1ae36b
mov dword [ebp - 0x5c], 0x1f5ca9a
sub dword [ebp - 0x5c], 0xc0896925
mov dword [ebp - 0x58], 0xa4befe3a
sub dword [ebp - 0x58], 0x414f91ce
mov dword [ebp - 0x54], 0xf6b9d448
add dword [ebp - 0x54], 0x9462bb8
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x40cad
push 0
call eax
mov ecx, 0x45f449ae
sub ecx, 0x45f3f9a7
mov esi, eax
mov edx, 0xc4066661
sub edx, 0x96017e61
add edx, dword [ebp - 0x50]
mov ebx, 0x2baacf0f
add ebx, 0x825a04fd
mov edi, dword [edx]
xor dword [ebp - 0x30], ecx
sub edi, ebx
sub dword [ebp - 0x44], ebx
mov dword [esi], edi
add dword [ebp - 0x30], 0xb9133fbb
add esi, 4
add edx, 0x51a0d5be
sub edx, 0x51a0d5ba
loop 0x2e0130b8
add eax, 0x132ef
mov ebx, eax
add eax, 5
mov ecx, 0xa82cfa17
add ecx, 0x85d305e9
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x11cf5d4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x11cf5de
pushal
call 0x11cf5e4
pop ebp
sub ebp, 0x10
sub ebp, 0xdcf5d4
jmp 0x11cf5fa
mov eax, 0xdcf5d4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c2
mov edx, 0xa340b04c
xor byte [eax], dl
inc eax
dec ecx
jne 0x11cf611
jmp 0x11cf624
mov dword [ecx + 0x4c70c5c7], 0x8dcd4c4c
mov ah, 0x4c
dec esp
dec esp
dec edi
xor esp, 0x4c4c4c49
mul byte [esp + ecx*2 + 0x4c]
dec esp
mov ebx, 0xc7844fae
int 0x40
dec esp
dec esp
dec esp
dec edi
mov ecx, eax
sub byte [eax - 0x50], ch
lds ecx, [eax + 0x68]
shr dword [eax], 0x68
mov al, 0xc5
dec eax
push 0x51882424
dec esp
and al, 0x20
jge 0x11cf654
dec esp
dec ebp
pushal
push 0x51d27024
pop edx
movsb byte es:[edi], byte [esi]
dec ecx
dec esp
dec esp
dec esp
movsd dword es:[edi], dword [esi]
dec esp
dec esp
dec esp
sbb dword [eax], ebx
adc edi, eax
leave
inc esp
dec esp
dec esp
dec esp
invalid
Function at 0x100028f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10010890
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x1001d0d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x18]
call fcn.1000c140
push 0x50c0c
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
call fcn.1000c260
push eax
lea ecx, [ebp - 0x18]
call fcn.100028e0
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.Qt5WidgetsKso.dll_public:_void___thiscall_kso_qt::QApplication::constructor_int___char____int_]
push 0x38
mov byte [ebp - 4], 1
call fcn.1000f360
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x10002970
push 0
mov ecx, eax
call fcn.10007860
jmp 0x10002972
xor eax, eax
mov ecx, eax
mov byte [ebp - 4], 1
call dword [sym.imp.Qt5WidgetsKso.dll_public:_void___thiscall_kso_qt::QWidget::show_void_]
call dword [sym.imp.Qt5WidgetsKso.dll_public:_static_int___cdecl_kso_qt::QApplication::exec_void_]
lea ecx, [ebp - 0x24]
mov esi, eax
call dword [sym.imp.Qt5WidgetsKso.dll_public_virtual:_void___thiscall_kso_qt::QApplication::destructor_void_]
lea ecx, [ebp - 0x18]
call fcn.1000c210
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100031d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10003229
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10003229
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000321a
cmp esi, edx
jae 0x10003229
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10003208
cmp esi, edx
jae 0x10003229
cmp word [esi], 0
je 0x10003229
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1000c140
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 4], 0
mov dword [edi], 0
test eax, eax
jne 0x1000c161
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push edi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x1000c1fe
mov eax, dword [edi]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
push ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000f39e
mov ecx, dword [edi]
add esp, 4
xor ebx, ebx
mov dword [edi + 4], eax
test ecx, ecx
je 0x1000c1ec
mov edi, edi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esi + ebx*4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
call fcn.1000f39e
mov ecx, dword [edi + 4]
add esp, 4
push 0
push 0
mov dword [ecx + ebx*4], eax
mov eax, dword [edi + 4]
push esi
mov esi, dword [ebp + 8]
push dword [eax + ebx*4]
push 0xffffffffffffffff
push dword [esi + ebx*4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [edi]
inc ebx
cmp ebx, ecx
jne 0x1000c1a0
mov eax, dword [edi + 4]
push esi
mov dword [eax + ecx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x1000c920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1000c539
push eax
push esi
push dword [ebp + 8]
call fcn.1000c4ee
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1000c539
push eax
push esi
push dword [ebp + 8]
call fcn.1000c4ee
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1000c529
hlt
Function at 0x40ca0e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425a8c]
jne 0x40ca18
repz ret
jmp fcn.00410178

Function at 0x410e74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, esi
sub edi, dword [ecx + 0xc]
add esi, 0xfffffffc
shr edi, 0xf
mov ecx, edi
imul ecx, ecx, 0x204
lea ecx, [ecx + eax + 0x144]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi]
dec ecx
mov dword [ebp - 4], ecx
test cl, 1
jne 0x411186
push ebx
lea ebx, [ecx + esi]
mov edx, dword [ebx]
mov dword [ebp - 0xc], edx
mov edx, dword [esi - 4]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0xc]
mov dword [ebp + 0xc], ebx
test dl, 0x55
push ebp
call fcn.00410f59
dec ecx
sbb ah, byte [ebx + 0x478b6630]
push es
cmp ax, bx
jbe 0x4111b3
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x4111ad
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x41119e
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
inc ebp
stosb byte es:[edi], al
pop eax
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00410f59
jle 0x4111ba
dec ecx
dec ebp
lea eax, [ebp - 0x58]
push eax
call fcn.00410f69
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00410f1e
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x411247
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00410f59
stc
dec edx
movsb byte es:[edi], byte [esi]
or dword [ebp - 0x17af3fbb], 0xffffffc5
cld
invalid
Function at 0x411342
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lahf
adc esi, eax
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00410f69
push eax
push esi
push dword [ebp + 8]
call fcn.00410f1e
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00410f69
push eax
push esi
push dword [ebp + 8]
call fcn.00410f1e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00410f59
jl 0x41142c
and byte ss:[eax - 0x8363], cl
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00410f59
xchg esp, eax
xor dword [edi + 0x7c858d69], eax
invalid

Function at 0x412aef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00410f69
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00410eca
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x412ed1
Function at 0x40c040
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520515
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x56a434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c150
mov ebx, eax
lea esi, [edi + 0x28]
cmp esi, ebx
je 0x40c0b6
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x40c08f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004017f0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x40c0a7
mov eax, dword [esi]
jmp 0x40c0a9
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.004034f0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x40c0d2
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.004017f0
push 0x50
call fcn.004dc4cc
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 1
call fcn.0048a500
sub esp, 0x18
mov ecx, 0x40d4c0
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x40c114
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____stdcall___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x40d4c0
mov dword [eax + 0x24], eax
push 0x5551c0
push edi
mov ecx, esi
call fcn.00422e00
mov dword [edi + 0x74], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x40c132
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414dc0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5210b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x56a434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x414e11
mov eax, dword [esi]
jmp 0x414e13
mov eax, esi
mov edx, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x414e34
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414e25
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.004031a0
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], 0
mov word [esi + 0x18], ax
cmp word [edi], ax
jne 0x414e64
xor ecx, ecx
jmp 0x414e7f
mov ecx, edi
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414e70
sub ecx, ebx
sar ecx, 1
push ecx
push edi
lea ecx, [esi + 0x18]
call fcn.004031a0
mov eax, dword [ebp + 0x14]
movsd xmm0, qword [0x5577e8]
mov dword [esi + 0x30], eax
xor eax, eax
mov dword [esi + 0x38], 0x4047b0
movsd qword [esi + 0x40], xmm0
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov byte [esi + 0x58], 0
mov dword [esi + 0x70], 7
mov dword [esi + 0x6c], 0
mov word [esi + 0x5c], ax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], 0xf
mov byte [esi + 0x74], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10