joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460c20
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x460cc3
test eax, eax
jbe 0x460cc3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x460cc3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x460c6e
xor esi, esi
jmp 0x460c74
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x460c9f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004169b0
add esi, eax
push esi
mov ebx, esi
call fcn.004169b0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x460c80
pop ebp
test edi, edi
pop edi
jne 0x460cc3
test ebx, ebx
je 0x460cc3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004651a0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x460e05
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x460f1d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x460f1d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004765c3
mov esi, eax
test esi, esi
je 0x460f1d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x460f1d
mov ecx, esi
call fcn.00460d70
cmp edi, eax
jge 0x460f1d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x460ea3
mov dword [esp + 0x34], 1
jmp 0x460efe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x460f1d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00460360
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x476f67
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x476f9f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047501e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00474ff6
jmp 0x476fab
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x478655
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x478697
call fcn.0047e3d2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x478697
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47868e
xor eax, eax
jmp 0x47869f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004786a5
pop edi
pop esi
pop ebx
ret 4

Function at 0x47e902
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47e930
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47e94e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047e868
jmp 0x47e94e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47e94e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047e868
test edi, edi
mov eax, edi
jne 0x47e938
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x200306fd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.200424e9
add esp, 0xc
jnp 0x20030718
jp 0x20030727
pushf
je 0x2003071e
popf
mov ecx, ecx
jmp 0x20030724
jnp 0x20030727
add eax, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
stc
jg 0x2003076f
pushf
lea esi, [esi + 0x6460]
sub esi, 0x6460
popf
Function at 0x20031b8a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.200424e9
add esp, 0xc
test edx, eax
jne 0x20031ba7
js 0x20031bb1
jnp 0x20031bab
js 0x20031bad
jns 0x20031bb1
call 0x848e249
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
nop
or esp, 0
jp 0x20031c04
jl 0x20031bed
xchg ebx, ecx
xchg ebx, ecx
lea esi, [esi + 0xda0]
lea esi, [esi - 0xda0]
jge 0x20031bff
jnp 0x20031c04
mov esi, 0x4d8a952f
call 0xa805058b
dec ebp
call 0xa0f0719b
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
shl edx, 0
jno 0x20031c71
jp 0x20031c8d
pushf
ror edx, 0xa
ror edx, 0x16
or edx, 0
shr esp, 0
popf
lea esp, [esp]
mov edx, edx
jns 0x20031c8a
jnp 0x20031c8d
mov esp, 0xb55ae8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.2003d1ec
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20031ca2
xor eax, eax
jmp 0x20031d4a
lea edi, [edi + 0x6c7a]
lea edi, [edi - 0x6c7a]
jnp 0x20031cb0
jo 0x20031cb2
jge 0x20031cd6
pushf
add eax, 0x54d2
sub eax, 0x54d2
ror ecx, 0xc
rol ecx, 0xc
xor esi, ecx
xor esi, ecx
stc
popf
jb 0x20031ccf
jmp 0x20031cd1
xchg esp, esp
jl 0x20031cd6
or dword [ebp - 0x74ae17b3], 0xe852f855
mov ecx, 0x8900007f
inc ebp
cld
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.20039c9c
mov dword [ebp - 4], eax
and ebx, ebx
jb 0x20031cf7
xchg edi, ebx
xchg edi, ebx
xchg ebx, edx
xchg ebx, edx
ja 0x20031cf4
jae 0x20031cf7
call 0x206d2a65
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.200424e9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x20031d11
xor eax, eax
jmp 0x20031d4a
xchg esp, esp
ja 0x20031d15
mov esi, esi
jne 0x20031d2d
pushf
std
cld
not eax
not eax
sub edi, 0
popf
jg 0x20031d28
jno 0x20031d2a
je 0x20031d2d
xor eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.200474bb
add esp, 4
cmc
add eax, dword [esp]
sub eax, dword [esp]
jp 0x20031d47
xchg edx, edx
jnp 0x20031d47
add eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x20031fa2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x20031fb6
jmp 0x20032143
jp 0x20031fb8
cmp eax, dword [esp]
lea ecx, [ecx + 0x4603]
lea ecx, [ecx - 0x4603]
jge 0x20031fe3
pushf
test dword [esp], ebx
popf
lea esi, [esi + 0x59a3]
lea esi, [esi - 0x59a3]
mov esp, esp
ja 0x20031fe0
jl 0x20031fe3
mov esi, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x200296cc], edx
stc
jle 0x20032008
pushf
xchg edx, eax
xchg edx, eax
test dword [esp + 0x10], ebx
popf
jo 0x20032003
jg 0x20032005
jg 0x20032008
sub eax, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x2002ad58
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x2002ad58], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x2002ad54], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x200298b8], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x200298bc], ecx
mov edi, edi
cld
jne 0x2003203c
mov eax, eax
jb 0x2003204a
je 0x20032042
lea eax, [eax]
jmp 0x20032046
nop
jae 0x2003204a
xor eax, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
xor edx, dword [esp]
xor edx, dword [esp]
jno 0x20032091
xchg esp, esp
js 0x2003208a
xchg edx, edx
mov esp, esp
jo 0x20032091
mov edi, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
ja 0x200320fb
jne 0x20032104
xchg edi, edi
je 0x20032101
je 0x20032104
mov edi, 0xad543d83
add ah, byte [eax]
add byte [esp + edx - 0x73], dh
push ebp
invalid
cmp dword [0x2002ad54], 0
je 0x20032121
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x2002ad54]
push eax
call fcn.20039c9c
mov dword [0x200296c8], eax
and edi, 0xffffffff
nop
cmp edx, dword [esp]
jns 0x20032133
jp 0x2003212c
ja 0x2003212e
js 0x20032130
js 0x20032133
ljmp 0x4d8d:0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.200424e9
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20032282
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.200424e9
add esp, 0xc
ror ecx, 8
ror ecx, 0x18
jbe 0x200322b2
pushf
std
cld
popf
jge 0x200322ab
lea edx, [edx]
mov esi, esi
ja 0x200322b2
call 0x73e3687c
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1e], 0x68
mov byte [ebp - 0x1d], 0x52
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x7a
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x62
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x46
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0
and esi, 0xffffffff
je 0x20032307
mov edi, edi
jle 0x200322ff
jae 0x20032301
js 0x20032303
jne 0x20032307
jmp 0x50ad8a
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x1e]
sub dl, 1
mov byte [ebp - 0x1e], dl
mov al, byte [ebp - 0x19]
sub al, 1
mov byte [ebp - 0x19], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x1d]
sub dl, 1
mov byte [ebp - 0x1d], dl
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x1c]
sub dl, 1
mov byte [ebp - 0x1c], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
ja 0x20032394
jmp 0x20032396
jb 0x20032398
test dword [esp + 4], eax
je 0x200323b2
pushf
xchg ebx, ebx
ja 0x200323a4
sub esi, 0
popf
lea edx, [edx]
jb 0x200323ad
jae 0x200323af
jne 0x200323b2
sub eax, 0x121bb
call 0x20044572
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x200323ca
mov eax, 1
jmp 0x2003267d
call fcn.200323cf
Function at 0x20033a7a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.200424e9
add esp, 0xc
lea ecx, [ecx + 0x227c]
sub ecx, 0x227c
rol ebx, 0x19
ror ebx, 0x19
xchg edi, eax
xchg edi, eax
jne 0x20033ac2
jp 0x20033ab2
lea edi, [edi + 0x228e]
lea edi, [edi - 0x228e]
je 0x20033ac2
mov ebx, 0xe845c666
push ecx
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
clc
xor edx, 0
not ecx
not ecx
jno 0x20033b8c
pushf
test esp, 0x5a99
test esp, 0x31d5
popf
mov esp, esp
jge 0x20033b89
jo 0x20033b8c
xor eax, 0x965be8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.2003d1ec
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20033ba1
xor eax, eax
jmp 0x20033c4b
rol ecx, 2
rol ecx, 0x1e
rol edi, 0
jno 0x20033bbb
pushf
rol esi, 0x11
rol esi, 0xf
popf
jnp 0x20033bb8
jo 0x20033bbb
mov esi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.20039c9c
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.200424e9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x20033be5
xor eax, eax
jmp 0x20033c4b
add ecx, 0x6c00
sub ecx, 0x6c00
jbe 0x20033c08
pushf
shr esp, 0
sub edx, 0
add ebx, 0
jo 0x20033c00
popf
nop
jno 0x20033c05
ja 0x20033c08
or dword [ebx - 0x17ad03ab], 0x138aa
mov edx, dword [ebp - 4]
push edx
call fcn.200474bb
add esp, 4
sub edi, 0
rol edi, 0
xor ebx, 0x1a5c
xor ebx, 0x1a5c
jge 0x20033c28
jns 0x20033c40
pushf
sub esp, 0
xor edx, ecx
xor edx, ecx
and edi, 0xffffffff
sub edx, 0
popf
mov ebx, ebx
js 0x20033c40
mov ebx, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x20033c54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.200424e9
add esp, 0xc
and ebx, ebx
xchg edi, edx
xchg edi, edx
je 0x20033c75
add edi, 0x314a
sub edi, 0x314a
jae 0x20033c96
xchg esp, esp
lea ecx, [ecx + 0x67bf]
lea ecx, [ecx - 0x67bf]
mov esi, esi
jb 0x20033c96
mov ebx, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
ja 0x20033cc8
jle 0x20033cd9
pushf
cmp eax, esi
popf
ja 0x20033cd2
jmp 0x20033cd4
jmp 0x20033cd6
jg 0x20033cd9
mov eax, 0x80f04d8a
jmp 0x1050c4e3
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
and ecx, 0xffffffff
lea esi, [esi]
js 0x20033d40
and ecx, 0xffffffff
jae 0x20033d50
xchg edx, edi
xchg edx, edi
jbe 0x20033d4b
jb 0x20033d50
mov ebx, 0x97e835af
xchg esp, eax
add byte [eax], al
call fcn.2003d1ec
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x20033d62
xor eax, eax
jmp 0x20033d93
cmp ecx, edi
jg 0x20033d66
jge 0x20033d68
jl 0x20033d70
jg 0x20033d6c
nop
jge 0x20033d70
or dword [ebp - 0x74af0fbb], 0xe851fc4d
pop ds
pop edi
add byte [eax], al
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.20039c9c
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.200424e9
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x20034822
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.200424e9
add esp, 0xc
ror edi, 0x1b
ror edi, 5
jge 0x20034853
pushf
xchg ebx, eax
xchg ebx, eax
push esi
pop esi
popf
mov ecx, ecx
js 0x2003484f
nop
jl 0x20034853
mov ebp, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
xor edi, ecx
xor edi, ecx
call 0x2003488c
lea esp, [esp + 4]
jo 0x20034892
je 0x200348a0
pushf
cmc
popf
xchg ebx, esi
xchg ebx, esi
jne 0x200348a0
xor eax, 0x80ec4d8a
jmp 0xc50d0aa
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.2003d1ec
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x20034915
xor eax, eax
jmp 0x2003499b
xor esp, 0
je 0x2003491a
jle 0x20034922
xchg esp, esp
jg 0x20034922
mov esi, 0xec458dde
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.20039c9c
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.200424e9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x2003494c
xor eax, eax
jmp 0x2003499b
jo 0x2003494e
jl 0x20034950
cmp esp, 0x7264
jae 0x20034963
jp 0x2003495a
js 0x2003495c
lea ecx, [ecx]
xchg edx, edx
jb 0x20034963
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.200474bb
add esp, 4
rol ebx, 0x1c
rol ebx, 4
jmp 0x20034977
xchg ecx, edx
xchg ecx, edx
jae 0x2003497d
js 0x20034994
pushf
cmp esi, dword [esp]
call 0x20034989
lea esp, [esp + 4]
popf
lea edx, [edx]
jns 0x20034994
mov ecx, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x20039aea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x200297b0], 1
jne 0x20039c32
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.200424e9
add esp, 0xc
jnp 0x20039b12
xchg esp, esp
jl 0x20039b26
pushf
shl eax, 0
jnp 0x20039b1d
popf
jl 0x20039b21
jno 0x20039b23
jge 0x20039b26
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
ror eax, 0
jo 0x20039b7a
pushf
or esp, 0
je 0x20039b5e
rol esi, 0
test esp, 0x5e91
popf
lea ebx, [ebx]
lea edi, [edi + 0x7915]
lea edi, [edi - 0x7915]
jno 0x20039b7a
mov ebx, 0x80e84d8a
jmp 0x8512384
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.2003d1ec
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x20039be7
mov eax, dword [ebp + 8]
jmp 0x20039c93
rol eax, 0
jl 0x20039bfa
pushf
je 0x20039bf0
popf
lea esp, [esp]
jno 0x20039bf7
jge 0x20039bfa
xor eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.20039c9c
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.200424e9
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x20039c2b
mov edx, dword [ebp - 8]
mov dword [0x200297b0], edx
jmp 0x20039c30
mov eax, dword [ebp + 8]
jmp 0x20039c93
jmp 0x20039c3a
mov eax, dword [0x200297b0]
mov dword [ebp - 8], eax
shl esp, 0
lea eax, [eax]
jle 0x20039c55
jl 0x20039c43
lea edx, [edx + 0x478d]
lea edx, [edx - 0x478d]
je 0x20039c51
jg 0x20039c55
mov edx, 0xf84d8bed
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
sub ecx, 0
nop
jnp 0x20039c6f
pushf
cmp edx, dword [esp]
cmp eax, esi
popf
xchg ecx, eax
xchg ecx, eax
jp 0x20039c6f
or dword [ebx - 0x17ad03ab], 0xd843
mov edx, dword [ebp - 4]
push edx
call fcn.200474bb
add esp, 4
add esp, 0
sub esp, 0
mov edi, edi
js 0x20039c8c
mov ebx, ebx
lea edx, [edx]
jns 0x20039c8c
sub eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4