joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ab56
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x42fe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call fcn.00405c64
test eax, eax
pop ecx
je 0x41ab8b
push edi
push edi
push edi
push edi
push edi
call fcn.004081be
add esp, 0x14
push 4
pop eax
call fcn.0041e3e0
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41ac99
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jne 0x41ac12
push 0x401b68
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x41ac12
push 0x402de0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x41ac12
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], edi
call eax
cmp eax, 1
jne 0x41ac12
mov eax, dword [ebp - 0x10]
cmp eax, edi
jbe 0x41ac12
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push dword [ebp - 8]
call fcn.00406461
add esp, 0xc
test eax, eax
jl 0x41ac99
not edi
and dword [ebp - 8], edi
je 0x41ac44
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.00406461
add esp, 0xc
test eax, eax
jl 0x41ac99
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x41ac4f
mov dword [ebp - 8], eax
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 0x14]
sub edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x41ac63
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp edi, ebx
jb 0x41ac99
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x41ac99
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x41ac99
xor eax, eax
inc eax
jmp 0x41ac9b
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d37b
leave
ret
Function at 0x41e40b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x42fe74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x430fac]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
xor edi, edi
cmp eax, edi
jne 0x41e45f
push edi
push edi
xor ebx, ebx
inc ebx
push ebx
push edi
call esi
test eax, eax
je 0x41e445
mov dword [0x430fac], ebx
jmp 0x41e464
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x41e45a
push 2
pop eax
mov dword [0x430fac], eax
jmp 0x41e45f
mov eax, dword [0x430fac]
cmp eax, 1
jne 0x41e477
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
jmp 0x41e536
cmp eax, 2
je 0x41e480
cmp eax, edi
jne 0x41e4a9
cmp dword [ebp + 0x1c], edi
mov dword [ebp - 8], edi
jne 0x41e493
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0x1c], eax
push edi
push edi
push dword [ebp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push dword [ebp + 0xc]
call edi
mov ebx, eax
test ebx, ebx
jne 0x41e4b0
xor eax, eax
jmp 0x41e536
jle 0x41e4f6
push 0xffffffffffffffe0
xor edx, edx
pop eax
div ebx
cmp eax, 1
jb 0x41e4f6
lea eax, [ebx + 8]
cmp eax, 0x400
ja 0x41e4de
call fcn.0041acb0
mov esi, esp
test esi, esi
je 0x41e4a9
mov dword [esi], 0xcccc
add esi, 8
jmp 0x41e4f8
push eax
call fcn.0040daf8
test eax, eax
pop ecx
je 0x41e4f2
mov dword [eax], 0xdddd
add eax, 8
mov esi, eax
jmp 0x41e4f8
xor esi, esi
test esi, esi
je 0x41e4a9
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x41e52c
xor eax, eax
cmp dword [ebp + 0x18], eax
jne 0x41e515
push eax
push eax
jmp 0x41e51b
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0xffffffffffffffff
push esi
push 1
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 8], eax
push esi
call fcn.00412610
mov eax, dword [ebp - 8]
pop ecx
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d37b
leave
ret
Function at 0x4231a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0x3034
mov dword [esp + 0x74], 0x40e4
mov esi, dword [esp + 0x78]
mov edi, dword [esp + 0x7c]
mov ebx, esi
or ebx, ebx
mov dword [esp + 0x3c], eax
mov eax, edi
or eax, eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x80], ebx
xor eax, eax
mov ebx, 0x5799
sub ebx, esi
mov esi, eax
sbb esi, edi
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
mov edi, dword [esp + 0x78]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
mov eax, 0x55e7
sub eax, edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x34]
sbb edi, eax
mov eax, dword [esp + 0x30]
sub ebx, eax
setbe al
sub esi, edi
setbe ah
mov byte [esp + 0x2f], ah
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x1b], al
je 0x42325c
mov al, byte [esp + 0x2f]
mov byte [esp + 0x1b], al
mov al, byte [esp + 0x1b]
test al, al
jne 0x423317
jmp 0x42326a
lea eax, [esp + 0x46]
lea ecx, [0x40127e]
mov edx, 0x12
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x5c], esi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x6c], edi
mov ebx, dword [esp + 0x74]
mov esi, 0x40e4
sub esi, ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x58], ebx
mov di, word [esp + 0x8a]
or di, 0x695
mov word [esp + 0x8a], di
mov dword [esp + 0x70], esi
lea esi, [esp + 0x46]
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0x3450
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x12
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
call fcn.00403bc0
mov eax, dword [esp + 0x14]
add eax, 5
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x8c]
sub eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x8c], eax
cmp ecx, edx
jae 0x423371
mov eax, 0xc
mov ecx, dword [esp + 0x70]
mov dl, byte [esp + 0x93]
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x74]
add edi, 0xffffbf1d
mov byte [esp + 0x93], dl
mov ebx, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov eax, ebx
xor edx, edx
mov ebx, dword [esp + 0xc]
div ebx
mov ebx, dword [esp + 0x40]
movzx edx, byte [ebx + edx]
mov ebx, dword [esp + 0x70]
movzx ecx, byte [esi + ecx]
sub ecx, edx
mov edx, dword [esp + 0x58]
mov byte [edx + ebx], cl
add edi, dword [esp + 0x70]
mov dword [esp + 0x70], edi
jmp 0x4232f6
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4255e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [ebp + 8]
mov byte [esp + 0x5b], 0
mov dword [esp + 0x44], 0x6dbc
mov word [esp + 0x42], 0x12d8
mov byte [esp + 0x41], 0xbc
mov byte [esp + 0x2b], 0x17
mov ecx, dword [esp + 0x4c]
imul edx, ecx, 0x2638
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov bl, byte [esp + 0x2b]
mov dword [esp + 0x4c], edx
mov dx, word [esp + 0x48]
mov word [esp + 0x26], dx
or dx, dx
mov bh, byte [esp + 0x41]
xor bh, 0xed
mov word [esp + 0x48], dx
cmp bh, bl
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x1b], bl
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
jbe 0x425736
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0xed7
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
jne 0x4256a4
mov al, byte [esp + 0x1b]
mov byte [esp + 0x4b], al
mov word [esp + 0x2e], 0x3db0
cmp word [esp + 0x2e], 0x1427
jb 0x4257a8
mov dword [esp + 0x34], 0
jmp 0x4257b0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
mov si, word [edx]
mov word [esp + 0x2c], si
mov edx, dword [esp + 0x14]
add edx, 0xffffb662
mov edi, dword [esp + 0x10]
adc edi, 0xffffffff
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], edx
sub eax, 0x3c4a
seta bl
test ecx, ecx
setne bh
mov byte [esp + 0xf], bh
mov dword [esp + 8], eax
mov byte [esp + 7], bl
je 0x4256f4
mov al, byte [esp + 0xf]
mov byte [esp + 7], al
mov al, byte [esp + 7]
test al, al
jne 0x425736
jmp 0x4256fe
movzx eax, word [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
xor ecx, 0x5dd2
mov dword [esp + 0x4c], ecx
cmp eax, 0x5a4d
jne 0x425764
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x3c]
mov cx, word [esp + 0x26]
mov word [esp + 0x48], cx
mov edx, dword [esp + 0x30]
cmp dword [edx + eax], 0x4550
jne 0x425762
mov ax, word [esp + 0x42]
xor ax, 0x2de7
mov word [esp + 0x28], ax
mov ax, word [esp + 0x42]
add ax, 0xf959
cmp ax, word [esp + 0x28]
ja 0x42565c
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], eax
jmp 0x4257b0
jmp 0x425764
mov eax, dword [esp + 0x14]
add eax, 0x35b5
mov ecx, dword [esp + 0x10]
adc ecx, 0
mov edx, dword [esp + 0x30]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
mov eax, dword [esp + 0x44]
add eax, 0xffffa244
sub edx, eax
mov eax, dword [esp + 0x44]
xor eax, 0xffff9dbc
and edx, eax
mov dword [esp + 0x30], edx
mov al, byte [esp + 0x5b]
inc al
test al, 1
jne 0x4256a4
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x34]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41cf70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x41cf7f
pop dword [ebp - 0x34]
mov eax, 0x41cf7f
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3c6a2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x2b53d027
add ecx, 0xd4ac727d
xor esi, esi
add esi, eax
mov edx, 0xe58cf752
sub edx, 0xe549a352
add edx, dword [ebp - 0x34]
mov edi, 0xf85fe324
add edi, 0x63c0d078
add dword [ebp - 4], ebx
mov ebx, dword [edx]
add dword [ebp - 4], eax
xor ebx, edi
mov dword [ebp - 4], 0x1d6cef77
mov dword [esi], ebx
sub dword [ebp - 4], ebx
add esi, 0x24bf4d29
add esi, 0xdb40b2db
add edx, 4
loop 0x41cfd6
add eax, 0xfd63
mov ebx, eax
add eax, 5
mov ecx, 0xa9f146d
sub ecx, 0xa5f146d
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x5ec00a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5ec049
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5ec049
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5ec049
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5ec049
cmp dword [ecx + 0x74], 0xe
jbe 0x5ec049
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x5f3308
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5f33a5
push ebx
push esi
call fcn.005f32d1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005f3265
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5f3352
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5f33a4
push edi
push eax
call fcn.005f1c6b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5f3372
call fcn.005f1cb9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5f33a3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005f3265
add esp, 0x20
test eax, eax
jne 0x5f3391
push edi
call fcn.005f1cb9
jmp 0x5f3399
push ebx
call fcn.005f1cb9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5f45b4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x672640
push 0x672638
push str.FlsAlloc
push 0x1f
call fcn.005f4473
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5f45e8
push dword [ebp + 8]
mov ecx, esi
call dword [0x5fa13c]
call esi
jmp 0x5f45ee
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x5f4632
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x672650
push 0x672648
push str.FlsGetValue
push 0x21
call fcn.005f4473
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5f4669
push dword [ebp + 8]
mov ecx, esi
call dword [0x5fa13c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x5f4671
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x672658
push 0x672650
push str.FlsSetValue
push 0x22
call fcn.005f4473
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5f46ab
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5fa13c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x5f9a70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5f9a9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5f9a9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405b89
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405b89
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x405b7a
cmp esi, edx
jae 0x405b89
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x405b68
cmp esi, edx
jae 0x405b89
cmp word [esi], 0
je 0x405b89
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x406c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50214b
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov dword [edi + 0x31c], ebx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x44], 0x61006d
mov dword [ebp - 0x40], 0x6e0069
mov dword [ebp - 0x3c], 0x70005f
mov dword [ebp - 0x38], 0x670061
mov dword [ebp - 0x34], 0x65
call fcn.00405dc0
push eax
push 9
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404e60
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x28]
call fcn.00407700
add esp, 4
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x2c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406cfe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x50], 0x6e0075
mov dword [ebp - 0x4c], 0x6e0069
mov dword [ebp - 0x48], 0x740073
mov dword [ebp - 0x44], 0x69005f
mov dword [ebp - 0x40], 0x67006e
mov dword [ebp - 0x3c], 0x70005f
mov dword [ebp - 0x38], 0x670061
mov dword [ebp - 0x34], 0x65
call fcn.00405dc0
push eax
push 0xf
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404e60
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x20]
call fcn.00407700
add esp, 4
mov byte [ebp - 4], 5
mov eax, esi
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406d85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x50], 0x6e0075
mov dword [ebp - 0x4c], 0x6e0069
mov dword [ebp - 0x48], 0x740073
mov dword [ebp - 0x44], 0x65005f
mov dword [ebp - 0x40], 0x64006e
mov dword [ebp - 0x3c], 0x70005f
mov dword [ebp - 0x38], 0x670061
mov dword [ebp - 0x34], 0x65
call fcn.00405dc0
push eax
push 0xf
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404e60
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 6
push eax
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.00407700
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x406e0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 7
lea esi, [ebp - 0x28]
push dword [esi + 4]
lea ecx, [edi + 0x30]
call fcn.0041eac0
cmp dword [esi], ebx
sete cl
mov edx, dword [eax]
movzx ecx, cl
push ecx
mov ecx, eax
call dword [edx + 0x114]
add esi, 8
lea eax, [ebp - 0x10]
cmp esi, eax
jne 0x406e14
push 0x406e80
push 3
push 8
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.00499a2f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret 4
Function at 0x4097b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xf0], 0x740068
push edi
mov dword [ebp - 0xec], 0x700074
mov dword [ebp - 0xe8], 0x2f003a
mov dword [ebp - 0xe4], 0x73002f
mov dword [ebp - 0xe0], 0x35002e
mov dword [ebp - 0xdc], 0x740032
mov dword [ebp - 0xd8], 0x6f006f
mov dword [ebp - 0xd4], 0x62006c
mov dword [ebp - 0xd0], 0x78006f
mov dword [ebp - 0xcc], 0x63002e
mov dword [ebp - 0xc8], 0x6d006f
mov dword [ebp - 0xc4], 0x61002f
mov dword [ebp - 0xc0], 0x79006e
mov dword [ebp - 0xbc], 0x650073
mov dword [ebp - 0xb8], 0x720061
mov dword [ebp - 0xb4], 0x680063
mov dword [ebp - 0xb0], 0x70003f
mov dword [ebp - 0xac], 0x640069
mov dword [ebp - 0xa8], 0x7b003d
mov dword [ebp - 0xa4], 0x690070
mov dword [ebp - 0xa0], 0x7d0064
mov dword [ebp - 0x9c], 0x740026
mov dword [ebp - 0x98], 0x700079
mov dword [ebp - 0x94], 0x3d0065
mov dword [ebp - 0x90], 0x74007b
mov dword [ebp - 0x8c], 0x700079
mov dword [ebp - 0x88], 0x7d0065
mov dword [ebp - 0x84], 0x610026
mov dword [ebp - 0x80], 0x740063
mov dword [ebp - 0x7c], 0x6f0069
mov dword [ebp - 0x78], 0x3d006e
mov dword [ebp - 0x74], 0x61007b
mov dword [ebp - 0x70], 0x740063
mov dword [ebp - 0x6c], 0x6f0069
mov dword [ebp - 0x68], 0x7d006e
mov dword [ebp - 0x64], 0x610026
mov dword [ebp - 0x60], 0x700070
mov dword [ebp - 0x5c], 0x7b003d
mov dword [ebp - 0x58], 0x700061
mov dword [ebp - 0x54], 0x7d0070
mov dword [ebp - 0x50], 0x610026
mov dword [ebp - 0x4c], 0x700070
mov dword [ebp - 0x48], 0x650076
mov dword [ebp - 0x44], 0x3d0072
mov dword [ebp - 0x40], 0x61007b
mov dword [ebp - 0x3c], 0x700070
mov dword [ebp - 0x38], 0x650076
mov dword [ebp - 0x34], 0x7d0072
mov dword [ebp - 0x30], 0x6d0026
mov dword [ebp - 0x2c], 0x640069
mov dword [ebp - 0x28], 0x7b003d
mov dword [ebp - 0x24], 0x69006d
mov dword [ebp - 0x20], 0x7d0064
mov dword [ebp - 0x1c], 0x6d0026
mov dword [ebp - 0x18], 0x640069
mov dword [ebp - 0x14], 0x3d0032
mov dword [ebp - 0x10], 0x6d007b
mov dword [ebp - 0xc], 0x640069
mov dword [ebp - 8], 0x7d0032
mov word [ebp - 4], ax
call fcn.00405dc0
mov ecx, dword [ebp + 8]
push eax
push 0x76
lea eax, [ebp - 0xf0]
push eax
call fcn.00404e60
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40df80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502afb
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
push ebx
push esi
push edi
mov eax, dword [0x5473d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0x38]
call fcn.00418e90
mov dword [ebp - 4], 0
mov edi, dword [eax]
mov dword [ebp - 0x2c], 0x6e0075
mov dword [ebp - 0x28], 0x6e0069
mov dword [ebp - 0x24], 0x740073
mov dword [ebp - 0x20], 0x6c0061
mov dword [ebp - 0x1c], 0x20006c
mov dword [ebp - 0x18], 0x650062
mov dword [ebp - 0x14], 0x690067
mov dword [ebp - 0x10], 0x6e
call fcn.00405dc0
push eax
push 0xf
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00404e60
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd0]
call fcn.0040b430
mov byte [ebp - 4], 2
mov eax, 0x531ef4
mov esi, dword [ebp - 0x30]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00409e50
mov eax, dword [edi]
lea ecx, [ebp - 0xd0]
add esp, 8
push ecx
mov ecx, edi
call dword [eax + 0xc]
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xd0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0xd4], eax
lea ecx, [ebp - 0xcc]
call fcn.0040c1d0
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xd0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xd4], eax
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x80], vtable.std::ios_base.0
call fcn.0041c00c
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esp, 4
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40e0d9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 4
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x40e105
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x40e105
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x40e105
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebx + 8]
test eax, eax
je 0x40e11c
push 0
push 0
push 0x429
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret