joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493541
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x4aa018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
mov ecx, esp
mov dword [ebp - 0xa4], esp
push 0x4a5810
mov word [ebp - 0x55], 0x2e45
mov dword [ebp - 0x5a], 0x4f4c5058
mov dword [ebp - 0x5e], 0x45495c73
mov word [ebp - 0x6c], 0x7372
mov dword [ebp - 0x72], 0x746e6572
mov dword [ebp - 0x84], 0x6f736f72
mov dword [ebp - 0x63], 0x74615020
mov dword [ebp - 0x89], 0x694d5c45
mov word [ebp - 0x69], 0x6e6f
mov word [ebp - 0x7a], 0x6f64
mov word [ebp - 0x66], 0x7041
mov dword [ebp - 0x7f], 0x69575c74
mov byte [ebp - 0x85], 0x63
mov word [ebp - 0x8b], 0x5241
mov byte [ebp - 0x80], 0x66
mov dword [ebp - 0x78], 0x435c7377
mov word [ebp - 0x6e], 0x6556
mov word [ebp - 0x74], 0x7275
mov byte [ebp - 0x64], 0x70
mov byte [ebp - 0x56], 0x52
mov dword [ebp - 0x90], 0x54464f53
mov dword [ebp - 0x53], 0x455845
mov byte [ebp - 0x6a], 0x69
mov byte [ebp - 0x5f], 0x68
mov byte [ebp - 0x7b], 0x6e
mov byte [ebp - 0x8c], 0x57
mov byte [ebp - 0x67], 0x5c
call fcn.00411d40
push ecx
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
mov ecx, esp
push eax
call fcn.00411d40
mov edx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004050d0
add esp, 8
test al, al
jne 0x405e7b
push ecx
lea ecx, [ebp - 0x94]
mov word [ebp - 0x15], 0x45
mov dword [ebp - 0x1a], 0x452e4552
mov word [ebp - 0x1f], 0x5845
mov byte [ebp - 0x16], 0x58
mov word [ebp - 0x1c], 0x4f4c
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1d], 0x50
mov word [ebp - 0x2e], 0x6235
mov dword [ebp - 0x35], 0x3932622d
mov word [ebp - 0x2b], 0x3233
mov dword [ebp - 0x47], 0x65353039
mov dword [ebp - 0x28], 0x31326433
mov word [ebp - 0x37], 0x6534
mov word [ebp - 0x23], 0x7d
mov word [ebp - 0x43], 0x3336
mov word [ebp - 0x3a], 0x342d
mov word [ebp - 0x31], 0x2d63
mov byte [ebp - 0x48], 0x7b
mov word [ebp - 0x3d], 0x6231
mov byte [ebp - 0x3b], 0x66
mov word [ebp - 0x40], 0x2d36
mov byte [ebp - 0x41], 0x62
mov byte [ebp - 0x2c], 0x37
mov byte [ebp - 0x2f], 0x36
mov byte [ebp - 0x3e], 0x63
mov byte [ebp - 0x24], 0x61
mov byte [ebp - 0x38], 0x39
mov byte [ebp - 0x29], 0x64
call fcn.004045d0
push ecx
lea eax, [ebp - 0x48]
mov ecx, esp
push eax
call fcn.00411d40
lea ecx, [ebp - 0x94]
call fcn.00405180
add esp, 4
push 0x4a5850
lea edx, [ebp - 0x94]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x9c]
call fcn.00410190
add esp, 4
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x98]
call fcn.00410190
add esp, 4
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.004107c0
lea ecx, [ebp - 0x98]
call fcn.00412190
lea ecx, [ebp - 0x9c]
call fcn.00412190
lea ecx, [ebp - 0x94]
call fcn.00412190
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c13e
mov esp, ebp
pop ebp
ret
Function at 0x405ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49357d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4aa018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004045d0
call fcn.00412700
mov dword [ebp - 4], 0
call fcn.00404f90
push ecx
push esi
test eax, eax
mov dword [ebp - 0x26], 0x656c676f
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1e], 0x656d6f
mov ecx, esp
mov dword [ebp - 0x22], 0x72684320
setne bh
mov word [ebp - 0x28], 0x6f47
push eax
mov dword [ebp - 0x18], 0x6f726843
xor bl, bl
mov word [ebp - 0x13], 0x65
mov byte [ebp - 0x14], 0x6d
call fcn.00411d40
mov dl, bl
mov cl, dl
call fcn.004058b0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x40600d
push ecx
push esi
push ecx
mov byte [ebp - 0x2d], al
mov ecx, esp
lea eax, [ebp - 0x28]
mov bl, 1
push eax
call fcn.00411d40
mov cl, byte [ebp - 0x2d]
mov dl, bl
call fcn.004058b0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x40600d
test bh, bh
je 0x405f93
push ecx
push esi
push ecx
lea eax, [ebp - 0x28]
mov byte [ebp - 0x2d], 1
mov ecx, esp
push eax
call fcn.00411d40
mov cl, byte [ebp - 0x2d]
mov dl, bl
call fcn.004058b0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x40600d
push ecx
push esi
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
xor bl, bl
push eax
mov byte [ebp - 0x2d], bl
call fcn.00411d40
mov dl, bl
mov cl, bl
call fcn.004058b0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x40600d
push ecx
push esi
push ecx
mov byte [ebp - 0x2d], al
mov ecx, esp
lea eax, [ebp - 0x18]
mov bl, 1
push eax
call fcn.00411d40
mov cl, byte [ebp - 0x2d]
mov dl, bl
call fcn.004058b0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x40600d
test bh, bh
je 0x406004
push ecx
push esi
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
mov bh, 1
call fcn.00411d40
mov dl, bl
mov cl, bh
call fcn.004058b0
mov bl, al
add esp, 0xc
test bl, bl
jne 0x40600d
mov ecx, esi
call fcn.00405410
mov bl, al
lea ecx, [ebp - 0x2c]
mov byte [edi], 0
call fcn.00412190
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c13e
mov esp, ebp
pop ebp
ret
Function at 0x406570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493665
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4aa018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x15], 0x36363037
mov dword [ebp - 0x1b], 0x2e302e36
mov word [ebp - 0x17], 0x2e35
mov byte [ebp - 0x1c], 0x36
mov byte [ebp - 0x11], 0
call fcn.004045d0
lea eax, [ebp - 0x1c]
push eax
call fcn.00411d40
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00410800
test al, al
jne 0x4066a9
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
call fcn.0040ff10
lea edx, [ebp - 0x30]
mov ecx, eax
call fcn.00417120
mov ebx, eax
test ebx, ebx
je 0x4066a9
push ebx
call fcn.0041c809
add esp, 4
lea ecx, [ebp + 8]
mov edi, eax
push edi
push ebx
call fcn.0040ff10
mov edx, dword [ebp - 0x30]
mov ecx, eax
call fcn.004171f0
add esp, 8
test eax, eax
je 0x4066a0
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004172c0
add esp, 8
test eax, eax
je 0x4066a0
cmp dword [ebp - 0x34], 0
je 0x4066a0
mov ecx, dword [ebp - 0x38]
cmp dword [ecx], 0xfeef04bd
jne 0x4066a0
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x64252e64
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x252e6425
push eax
mov dword [ebp - 0x20], 0x64252e
call fcn.00410d60
add esp, 0x18
push edi
call fcn.0041c3aa
add esp, 4
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00411e60
lea ecx, [ebp - 0x2c]
call fcn.00412190
lea ecx, [ebp + 8]
call fcn.00412190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c13e
mov esp, ebp
pop ebp
ret
Function at 0x407230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
mov eax, ecx
mov byte [esp + 0xb], 0
mov dword [esp + 0xc], eax
push esi
push edi
test eax, eax
je 0x4074d8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14c], 4
mov dword [esp + 0x150], 0
call fcn.00404be0
mov edi, eax
mov dword [esp + 0x20], 0x128
call fcn.00417930
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4074bf
lea edx, [esp + 0x20]
mov ecx, ebx
call fcn.004178b0
cmp eax, 1
jne 0x4074b8
nop dword [eax]
nop word [eax + eax]
lea eax, [esp + 0x44]
mov dword [esp + 0x263], 0x78652e72
push eax
lea eax, [esp + 0x260]
mov dword [esp + 0x260], 0x6c707865
push eax
mov word [esp + 0x269], 0x6572
mov word [esp + 0x26f], 0x65
mov byte [esp + 0x268], 0x6f
call fcn.004248d8
add esp, 8
test eax, eax
jne 0x4073ac
push dword [esp + 0x28]
call fcn.00418670
mov esi, eax
add esp, 4
test esi, esi
je 0x4073ac
lea eax, [esp + 0x18]
mov edx, 8
push eax
mov ecx, esi
call fcn.004189f0
add esp, 4
test eax, eax
je 0x4073a5
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14c]
push eax
push dword [esp + 0x150]
lea eax, [esp + 0x158]
mov edx, 0xc
push eax
call fcn.00416ee0
add esp, 0xc
test eax, eax
je 0x407372
cmp edi, dword [esp + 0x150]
je 0x4073e0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x407387
call fcn.004199f0
mov dword [esp + 0x18], 0
mov ecx, esi
call fcn.004199f0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4073ac
call fcn.004199f0
mov dword [esp + 0x18], 0
jmp 0x4073ac
mov ecx, esi
call fcn.004199f0
lea edx, [esp + 0x20]
mov ecx, ebx
call fcn.00417830
cmp eax, 1
je 0x4072c0
mov ecx, ebx
call fcn.004199f0
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0041c13e
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [esp + 0x15c]
mov dword [esp + 0x158], 0
push 0
push eax
call fcn.0041d790
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x160]
add esp, 0xc
mov edx, 1
push eax
lea eax, [esp + 0x15c]
push 0x100
push eax
call fcn.00416ee0
add esp, 0xc
test eax, eax
je 0x40749c
mov ecx, dword [esp + 0x158]
lea edx, [esp + 0x1c]
call fcn.004196e0
test eax, eax
je 0x40749c
mov edx, dword [esp + 0x1c]
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407450
sub ecx, edi
cmp ecx, 0x104
jae 0x407495
push edx
mov byte [esp + 0x14e], al
lea eax, [esp + 0x14c]
push eax
push 0x104
push dword [esp + 0x20]
mov word [esp + 0x158], 0x7325
call fcn.00411640
mov edx, dword [esp + 0x2c]
add esp, 0x10
mov byte [esp + 0x13], 1
mov ecx, edx
call fcn.004188e0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4074b1
call fcn.004199f0
mov dword [esp + 0x18], 0
mov ecx, esi
call fcn.004199f0
mov ecx, ebx
call fcn.004199f0
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0041c13e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x26c]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c13e
mov esp, ebp
pop ebp
ret
Function at 0x407fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493867
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x4aa018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x12c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x134], esi
push ecx
mov dword [ebp - 0x130], 0
call fcn.004045d0
push 0x4a5810
call fcn.00411d40
push 0x104
lea eax, [ebp - 0x128]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x130], 1
call fcn.0041d790
push 0xffffffffffffffff
push str.1b9f7e73316b45b89b17f3e9f8e0a57d
lea eax, [ebp - 0x128]
mov dword [ebp - 0x20], 0x6b636954
push 0x104
push eax
mov dword [ebp - 0x24], 0x5f4f5353
mov word [ebp - 0x1b], 0x74
mov byte [ebp - 0x1c], 0x65
call fcn.00425722
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x128]
push 0x104
push eax
call fcn.004257fb
lea ecx, [ebp - 0x128]
call fcn.00411620
mov edx, eax
lea ecx, [ebp - 0x128]
call fcn.00407f90
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x17], 0x25783830
push ecx
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0x25
push eax
push esi
mov word [ebp - 0x13], 0x73
mov dword [ebp - 0x12c], 0x74745f
call fcn.00410d60
add esp, 0x3c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c13e
mov esp, ebp
pop ebp
ret
Function at 0x40b0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493f6d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4aa018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 3
mov dword [ebp - 4], 0
xor bl, bl
call fcn.0043f190
call fcn.0043f1b0
push dword [ebp + 8]
mov edi, eax
push 0x2712
push edi
call fcn.00443e70
push 0x40b060
push 0x4e2b
push edi
call fcn.00443e70
push esi
push 0x2711
push edi
call fcn.00443e70
lea eax, [ebp - 0x24]
mov dword [ebp - 0x16], 0x302e31
push eax
push 0x2722
push edi
mov dword [ebp - 0x20], 0x2d6c7275
mov dword [ebp - 0x24], 0x6362696c
mov dword [ebp - 0x1c], 0x6e656761
mov word [ebp - 0x18], 0x2f74
call fcn.00443e70
push edi
call fcn.0043f200
test eax, eax
movzx ebx, bl
mov ecx, 1
push edi
cmove ebx, ecx
call fcn.0043f220
add esp, 0x3c
lea ecx, [ebp + 8]
call fcn.00412190
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c13e
mov esp, ebp
pop ebp
ret
Function at 0x40cc20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49433d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4aa018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
lea ecx, [ebp - 0x48]
call fcn.004045d0
call fcn.00412700
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
push eax
push 0x400
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x4c], 0x400
mov dword [ebp - 0x18], 0x6e65704f
mov byte [ebp - 0x14], 0
call fcn.00410810
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.00419780
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.004107e0
lea ecx, [ebp - 0x48]
call fcn.004103c0
push ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x37], 0x46455249
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x38], 0x46
mov word [ebp - 0x32], 0x58
mov byte [ebp - 0x33], 0x4f
call fcn.004103f0
test eax, eax
js 0x40ccd9
lea ecx, [ebp - 0x48]
call fcn.00412190
mov eax, 2
jmp 0x40cd96
push ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1e], 0x454c474f
push eax
lea ecx, [ebp - 0x48]
mov word [ebp - 0x20], 0x4f47
mov byte [ebp - 0x1a], 0
call fcn.004103f0
test eax, eax
js 0x40cd2c
push ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x26], 0x454d4f52
push eax
lea ecx, [ebp - 0x48]
mov word [ebp - 0x28], 0x4843
mov byte [ebp - 0x22], 0
call fcn.004103f0
test eax, eax
js 0x40cd2c
lea ecx, [ebp - 0x48]
call fcn.00412190
mov eax, 1
jmp 0x40cd96
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x3f], 0x45524f
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x43], 0x4c505845
mov byte [ebp - 0x44], 0x49
call fcn.004103f0
test eax, eax
js 0x40cd5e
lea ecx, [ebp - 0x48]
call fcn.00412190
mov eax, 3
jmp 0x40cd96
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2f], 0x47444553
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x30], 0x4d
mov word [ebp - 0x2b], 0x45
call fcn.004103f0
lea ecx, [ebp - 0x48]
test eax, eax
js 0x40cd8f
call fcn.00412190
mov eax, 4
jmp 0x40cd96
call fcn.00412190
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c13e
mov esp, ebp
pop ebp
ret
Function at 0x40f070
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
mov dword [esp], 0
push eax
call fcn.00418c70
mov edx, 0x20
mov ecx, eax
call fcn.004189f0
add esp, 4
test eax, eax
je 0x40f0f3
lea eax, [esp + 4]
mov edx, str.SeDebugPrivilege
push eax
call fcn.00418a90
add esp, 4
test eax, eax
je 0x40f0eb
mov eax, dword [esp + 4]
sub esp, 0xc
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call fcn.00418b20
add esp, 0x10
mov ecx, dword [esp]
call fcn.004199f0
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041c13e
add esp, 0x24
ret
Function at 0x40fda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x58], eax
lea eax, [esp]
mov word [esp + 0x44], 0x4e20
push eax
lea eax, [esp + 8]
mov dword [esp + 0x4b], 0x75435c5c
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x3f], 0x74666f73
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x4b], 0x776f646e
push eax
lea edx, [esp + 0x38]
mov word [esp + 0x3f], 0x5c45
mov ecx, 0x80000002
mov word [esp + 0x42], 0x694d
mov dword [esp + 0x5f], 0x72655674
mov dword [esp + 0x4b], 0x69575c5c
mov word [esp + 0x3c], 0x4157
mov dword [esp + 0x5b], 0x6e657272
mov dword [esp + 0x63], 0x6e6f6973
mov word [esp + 0x45], 0x6f72
mov word [esp + 0x39], 0x464f
mov byte [esp + 0x56], 0x54
mov byte [esp + 0x41], 0x5c
mov byte [esp + 0x3b], 0x54
mov byte [esp + 0x38], 0x53
mov byte [esp + 0x53], 0x73
mov byte [esp + 0x3e], 0x52
mov byte [esp + 0x67], 0
mov byte [esp + 0x44], 0x63
mov word [esp + 0x26], 0x726f
mov dword [esp + 0x29], 0x69737265
mov word [esp + 0x2e], 0x4e6e
mov word [esp + 0x23], 0x614d
mov word [esp + 0x20], 0x6e65
mov word [esp + 0x31], 0x626d
mov word [esp + 0x1d], 0x7275
mov byte [esp + 0x1c], 0x43
mov byte [esp + 0x25], 0x6a
mov byte [esp + 0x22], 0x74
mov word [esp + 0x34], 0x72
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x28], 0x56
mov byte [esp + 0x30], 0x75
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x2d], 0x6f
mov dword [esp + 0x18], 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 4
call fcn.00417780
mov ecx, dword [esp + 0x68]
add esp, 0x10
test eax, eax
sete al
xor ecx, esp
call fcn.0041c13e
add esp, 0x5c
ret

Function at 0x4119c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x411a16
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x411a16
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x411a06
cmp esi, edx
jae 0x411a16
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4119f4
cmp esi, edx
jae 0x411a16
cmp word [esi], 0
je 0x411a16
pop edi
mov eax, esi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4129b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4949d6
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x10e0
call fcn.0041d170
mov eax, dword [0x4aa018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10d4], edi
push ecx
lea ecx, [ebp - 0xc54]
mov dword [ebp - 0x10d4], edi
call fcn.0040f8a0
push edx
lea ecx, [ebp - 0x10ec]
call fcn.00402d10
lea edx, [ebp - 0x10ec]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xc54]
call fcn.00412750
lea ecx, [ebp - 0x10ec]
call fcn.00403720
push 0x400
lea eax, [ebp - 0x848]
push 0
push eax
call fcn.0041d790
add esp, 0xc
lea ecx, [ebp - 0xc54]
call fcn.00412bd0
mov esi, eax
xor edx, edx
test esi, esi
je 0x412a8a
nop word [eax + eax]
push edx
lea ecx, [ebp - 0xc54]
call fcn.00412bc0
mov al, byte [eax]
mov byte [ebp + edx - 0x848], al
inc edx
cmp edx, esi
jb 0x412a70
push 0x400
lea eax, [ebp - 0xc48]
push 0
push eax
call fcn.0041d790
add esp, 0xc
lea eax, [ebp - 0x448]
xorps xmm0, xmm0
movups xmmword [ebp - 0x48], xmm0
push 0x400
push 0
push eax
call fcn.0041d790
add esp, 0xc
mov dword [ebp - 0x31], 0x41324443
lea eax, [ebp - 0x38]
mov word [ebp - 0x2d], 0x4537
mov dword [ebp - 0x21], 0x46434243
mov dword [ebp - 0x38], 0x37383843
push eax
lea eax, [ebp - 0x448]
mov word [ebp - 0x2a], 0x3646
push 0x400
push eax
mov word [ebp - 0x19], 0x39
mov word [ebp - 0x34], 0x3444
mov dword [ebp - 0x25], 0x42413436
mov word [ebp - 0x1c], 0x4638
mov word [ebp - 0x27], 0x4232
mov byte [ebp - 0x1a], 0x39
mov byte [ebp - 0x32], 0x32
mov byte [ebp - 0x1d], 0x36
mov byte [ebp - 0x2b], 0x39
mov byte [ebp - 0x28], 0x44
call fcn.00424845
add esp, 0xc
lea ecx, [ebp - 0x10d0]
call fcn.004143c0
push 0x10
push 0x20
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x448]
push eax
call fcn.00414410
push ecx
lea ecx, [ebp - 0xc54]
call fcn.00412bd0
push eax
lea eax, [ebp - 0xc48]
push eax
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x10d0]
call fcn.00414fd0
lea eax, [ebp - 0xc38]
mov ecx, edi
push eax
call fcn.00402d10
lea ecx, [ebp - 0x10d0]
call fcn.00414400
lea ecx, [ebp - 0xc54]
call fcn.00412c50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041c13e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x413040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x4aa018]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, ecx
mov dword [esp + 0x19], 0x29616c
lea eax, [esp + 8]
mov dword [esp + 4], esi
push eax
mov dword [esp + 8], esi
mov dword [esp + 0x18], 0x697a6f4d
mov word [esp + 0xf], 0x5f53
mov dword [esp + 0x13], 0x20637465
mov word [esp + 0xc], 0x534e
mov word [esp + 0x11], 0x6e49
mov byte [esp + 0x17], 0x28
mov byte [esp + 0xe], 0x49
mov byte [esp + 0x1c], 0x6c
call fcn.00402d10
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0041c13e
add esp, 0x20
ret
Function at 0x4140a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494a9e
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4aa018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x40], ebx
push eax
mov dword [ebp - 0x3c], 0
call fcn.00414180
mov ecx, ebx
call fcn.00402d40
push ecx
mov dword [ebp - 4], 0
mov ecx, ebx
mov dword [ebp - 0x3c], 1
call fcn.00414230
xor edi, edi
movzx esi, byte [ebp + edi - 0x24]
mov ecx, ebx
mov eax, esi
mov dword [ebp - 0x2d], 0x65646362
shr eax, 4
mov dword [ebp - 0x38], 0x33323130
mov word [ebp - 0x29], 0x66
mov word [ebp - 0x30], 0x3938
mov word [ebp - 0x33], 0x3635
mov byte [ebp - 0x31], 0x37
mov byte [ebp - 0x2e], 0x61
mov byte [ebp - 0x34], 0x34
movzx eax, byte [ebp + eax - 0x38]
push eax
call fcn.00403e00
and esi, 0xf
movzx ecx, byte [ebp + esi - 0x38]
push ecx
mov ecx, ebx
call fcn.00403e00
inc edi
cmp edi, 0x10
jl 0x414100
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041c13e
mov esp, ebp
pop ebp
ret 4

Function at 0x414360
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x41439b
xor edx, edx
cmp dword [esi + 0x3cc], edx
jle 0x414394
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, dword [esi + 0x3cc]
jl 0x414381
pop edi
pop esi
add esp, 0xc
ret 8
push str.Object_not_Initialized
lea ecx, [esp + 8]
call fcn.00403650
push 0x4a88ec
lea eax, [esp + 8]
push eax
call fcn.0041f31d
int3
Function at 0x4150c0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
ret