joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x405062
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405062
cmp dword [esp + 0x2c], 0
je 0x405062
push esi
call fcn.0040cba0
add esp, 4
test eax, eax
je 0x404fba
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404fc1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404fa0
jmp 0x404fc3
mov ebx, 0x1505
jmp 0x404fc3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x40506a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405027
call fcn.00405d00
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x405062
push ecx
call fcn.0040cba0
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x4050dd
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405088
inc edi
dec esi
je 0x404fdc
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404fe1
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405080
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cba0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405080
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040cbc0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405080
mov eax, 0xffffffff
jmp 0x405062
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4050f8
inc edi
dec esi
je 0x405022
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405027
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4050f0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040cba0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4050f0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040cbc0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4050f0
jmp 0x405027
Function at 0x405a50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405c3a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405c3a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405c3a
cmp dword [ecx], 0
jne 0x405c3a
push esi
call fcn.0040cba0
add esp, 4
test eax, eax
je 0x405aba
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405ac1
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405aa0
jmp 0x405ac3
mov edi, 0x1505
jmp 0x405ac3
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405b94
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405b21
call fcn.00405d00
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405c3a
push esi
call fcn.0040cba0
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405c50
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cba0
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44e008]
add esp, 4
test eax, eax
je 0x405c35
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040cac0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405c3a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405bb8
inc ebx
dec edx
je 0x405adc
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405ae1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405bb0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cba0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405bb0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cbc0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405bb0
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404b00
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405b89
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406cd0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406e86
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406e7f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406d65
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406e7f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406de5
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov esi, edi
and esi, eax
xor edi, eax
lea eax, [edi + esi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406d80
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406d2d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406e30
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406e10
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406d20
jmp 0x406e3f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406d20
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406e50
jmp 0x406d20
shl ecx, 0x10
or ecx, edi
jmp 0x406e8b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406f01
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406f03
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44bc50]
mov ebp, ebx
not ebp
mov eax, ebx
shr eax, 4
shr edi, 4
or ebp, edi
not edi
or edi, ebx
or ebp, 0x3ffffff0
and ebp, edi
not ebp
xor eax, dword [ebp*4 + 0x44bc50]
inc esi
cmp edx, esi
jne 0x406ec0
not eax
jmp 0x406f03
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d110
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00444cc0
test al, al
je 0x40d2ee
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043c8d0
test al, al
je 0x40d2e9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0xfe05c8c5
mov dword [esp + 8], 0xaaa01ea2
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d196
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d300
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d170
mov dword [esp + 4], 0xea518737
mov dword [esp + 8], 0xfc49aed1
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d1f6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d370
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d1d0
mov dword [esp], 0x77767999
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x40d239
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax]
push dword [esp + 4]
push eax
call fcn.0040d3e0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x40d210
test esi, esi
je 0x40d286
mov dword [esp + 4], 0x11abcd57
mov dword [esp + 8], 0xefe0fc36
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d286
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d440
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d260
mov dword [esp + 4], 0x2050407
mov dword [esp + 8], 0xe010003
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40d2d6
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d490
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40d2b0
call fcn.0040e8f0
test al, al
je 0x40d2e9
call fcn.00412f10
call fcn.00410b40
call fcn.004456e0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov edi, dword [esp + 0x64]
add edi, dword [ecx + 0x60]
mov dword [esp + 4], 0x766f6d
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 3
ja 0x40d73b
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x14]
push eax
call fcn.0040e460
add esp, 8
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 4
jb 0x40d710
mov dword [esp + 8], 0xa0408e2
mov word [esp + 0xc], 0xff06
mov dword [esp + 0xe], 0
mov byte [esp + 0x12], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 0xa
ja 0x40d79b
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [esp + eax + 8]
push dword [esp + 0x14]
push eax
call fcn.0040e3e0
add esp, 8
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 8], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 0xb
jb 0x40d770
mov dword [esp + 0x14], 0x766c2023
mov dword [esp + 0x18], 0x72762428
mov dword [esp + 0x1c], 0x7d667c23
mov dword [esp + 0x20], 0x7a717e69
mov dword [esp + 0x24], 0x52796d6e
mov dword [esp + 0x28], 0x1467a9af
mov dword [esp + 0x2c], 0x701130a
mov dword [esp + 0x30], 0x66e441c
mov dword [esp + 0x34], 0x41f1f19
mov dword [esp + 0x38], 0x419071b
mov dword [esp + 0x3c], 0x1f564d1a
mov dword [esp + 0x40], 0x52150909
mov dword [esp + 0x44], 0x220a1c18
mov dword [esp + 0x48], 0x262c637d
mov dword [esp + 0x4c], 0x6b79202b
mov byte [esp + 0x50], 0x88
mov word [esp + 0x51], 0
mov byte [esp + 0x53], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x3f
ja 0x40d866
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x14]
push dword [esp]
push eax
call fcn.0040e390
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x40
jb 0x40d840
mov ecx, dword [esp + 0x68]
movzx edx, byte [esp + 0x14]
mov eax, edi
test dl, dl
je 0x40d88b
lea ebx, [esp + 0x15]
mov eax, edi
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d880
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d8ab
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d8a0
mov ecx, dword [esp + 0x6c]
mov byte [eax], 0
movzx edx, byte [esp + 8]
test dl, dl
je 0x40d8cb
lea ebx, [esp + 9]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d8c0
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d8eb
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d8e0
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x40d90b
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40d900
mov byte [eax], 0
sub eax, edi
add dword [esi + 0x60], eax
add esp, 0x54
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x411780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x240
mov esi, dword [0x4543d4]
mov dword [esp + 0x40], 0x1785196d
mov dword [esp + 0x44], 0x138b1592
mov dword [esp + 0x48], 0xf9a1184
mov dword [esp + 0x4c], 0xb590d6d
mov dword [esp + 0x50], 0x7540945
mov dword [esp + 0x54], 0x3220554
mov dword [esp + 0x58], 0x3f550158
mov dword [esp + 0x5c], 0x3ba83da5
mov dword [esp + 0x60], 0x37a539a4
mov dword [esp + 0x64], 0x33bd35bf
mov dword [esp + 0x68], 0x2f5c3110
mov dword [esp + 0x6c], 0x2b0a2d40
mov dword [esp + 0x70], 0x27762979
mov dword [esp + 0x74], 0x23722576
mov dword [esp + 0x78], 0x5f7e2167
mov dword [esp + 0x7c], 0x5bc35d37
mov dword [esp + 0x80], 0x571c59ca
mov dword [esp + 0x84], 0x53155518
mov dword [esp + 0x88], 0x4fc65170
mov dword [esp + 0x8c], 0x4b064d06
mov dword [esp + 0x90], 0x47664911
mov dword [esp + 0x94], 0x43d24505
mov dword [esp + 0x98], 0x7fea41d0
mov dword [esp + 0x9c], 0x7b117de1
mov dword [esp + 0xa0], 0x77e879e5
mov dword [esp + 0xa4], 0x73eb7503
mov dword [esp + 0xa8], 0x6f3d71fc
mov dword [esp + 0xac], 0x6b256d21
mov dword [esp + 0xb0], 0x67346923
mov dword [esp + 0xb4], 0x6328652b
mov dword [esp + 0xb8], 0x9fc66140
mov dword [esp + 0xbc], 0x9be29deb
mov dword [esp + 0xc0], 0x97e399f4
mov dword [esp + 0xc4], 0x93c695e0
mov dword [esp + 0xc8], 0x8f1a91b0
mov dword [esp + 0xcc], 0x8b1d8d15
mov dword [esp + 0xd0], 0x87a68915
mov dword [esp + 0xd4], 0x831f85ff
mov dword [esp + 0xd8], 0xbf29811f
mov dword [esp + 0xdc], 0xbbe3bd2f
mov dword [esp + 0xe0], 0xb7c9b998
mov dword [esp + 0xe4], 0xb33cb52c
mov dword [esp + 0xe8], 0xaf3bb123
mov dword [esp + 0xec], 0xabf9ad31
mov dword [esp + 0xf0], 0xa7f7a9f9
mov dword [esp + 0xf4], 0xa3f0a5ed
mov dword [esp + 0xf8], 0xdf8ca1f0
mov dword [esp + 0xfc], 0xdb88dd8c
mov dword [esp + 0x100], 0xd7f6d988
mov dword [esp + 0x104], 0xd3b3d5bb
mov dword [esp + 0x108], 0xcfafd14a
mov dword [esp + 0x10c], 0xcb53cd42
mov dword [esp + 0x110], 0xc78bc99b
mov dword [esp + 0x114], 0xc389c58b
mov dword [esp + 0x118], 0xffb1c192
mov dword [esp + 0x11c], 0xfbfafdb6
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0xdf
ja 0x411a0d
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
movzx eax, byte [esp + eax + 0x40]
push dword [esp + 0xc]
push eax
call fcn.00412b90
add esp, 8
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x40], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0xe0
jb 0x4119e0
lea ebp, [esp + 0x40]
push 0
push 0
push 0
push 0
push ebp
call esi
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x44f338]
mov ecx, 0x139e3b73
xor ecx, dword [0x44f340]
add eax, ecx
inc eax
jmp eax
Function at 0x412f10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x5b8
mov esi, esp
push eax
sub esp, 8
mov ecx, esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x20], eax
mov esp, eax
mov dword [esi + 0x24], ecx
push eax
sub esp, 0xc
mov dword [esi + 0x34], esp
sub esp, 0x800
mov ebx, esp
sub esp, 0x80
mov dword [esi + 0x1c], esp
sub esp, 0x44
mov dword [esi + 0xac], esp
sub esp, 0x10
mov edi, esp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44fae4]

Function at 0x41d760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1ad0
call fcn.0040c9f0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41d780
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x455718]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41d7b4
mov eax, 0xffffffff
jmp 0x41d7b7
lea eax, [ebx + ebx]
push eax
call fcn.0040ca90
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x455718]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x41d7ec
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040ca90
add esp, 4
mov edi, eax
mov dword [esp + 0xacc], 0xb7c289ec
mov dword [esp + 0xad0], 0xb32db5d5
mov dword [esp + 0xad4], 0xbf9eb12c
mov dword [esp + 0xad8], 0xbbd7bdc6
mov dword [esp + 0xadc], 0xa739b926
mov dword [esp + 0xae0], 0xa331a5cd
mov dword [esp + 0xae4], 0xafaea132
mov dword [esp + 0xae8], 0
mov dword [esp + 0x210], 0
mov eax, dword [esp + 0x210]
cmp eax, 0x1f
ja 0x41d8b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x210]
movzx eax, byte [esp + eax + 0xacc]
push dword [esp + 0x210]
push eax
call fcn.00423980
add esp, 8
mov ecx, dword [esp + 0x210]
mov byte [esp + ecx + 0xacc], al
inc dword [esp + 0x210]
mov eax, dword [esp + 0x210]
cmp eax, 0x20
jb 0x41d870
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41d8e1
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d8d0
mov word [eax], 0
movzx ecx, word [esp + 0xacc]
test cx, cx
je 0x41d911
lea edx, [esp + 0xace]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d900
mov word [eax], 0
lea eax, [esp + 0x6b8]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.004495b0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x450484]
Function at 0x425b10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x425b30
cmp eax, 0xffffffdd
jge 0x425b47
mov eax, 0xffffffff
jmp 0x425b4a
add eax, 0x22
push eax
call fcn.0040ca90
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x43d141bc
mov dword [esp + 0x1c], 0x47a945d0
mov dword [esp + 0x20], 0x4bab49da
mov dword [esp + 0x24], 0x4fab4dab
mov dword [esp + 0x28], 0x7396718c
mov dword [esp + 0x2c], 0x77907591
mov dword [esp + 0x30], 0x7bef7999
mov dword [esp + 0x34], 0x7fea7d90
mov dword [esp + 0x38], 0x6160
mov byte [esp + 0x3c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x24
ja 0x425beb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.00426850
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x25
jb 0x425bc0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x425c11
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x425c00
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x425c41
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425c30
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x93e591e5
mov dword [esp + 0x1c], 0xaf9bad26
mov dword [esp + 0x20], 0xab22a9d5
mov dword [esp + 0x24], 0xa7dba528
mov dword [esp + 0x28], 0xa3d1a1d6
mov dword [esp + 0x2c], 0xbfc9bdc5
mov dword [esp + 0x30], 0xbb81b9ce
mov dword [esp + 0x34], 0xb78db58f
mov dword [esp + 0x38], 0xb3d4b18a
mov dword [esp + 0x3c], 0xcfbdcd41
mov dword [esp + 0x40], 0xcbb8c9b5
mov dword [esp + 0x44], 0xc7b1c587
mov dword [esp + 0x48], 0xc34ec1b6
mov dword [esp + 0x4c], 0xdf56dda1
mov dword [esp + 0x50], 0xdb83d954
mov dword [esp + 0x54], 0xd793d5a8
mov dword [esp + 0x58], 0xd3d2d1ea
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x425d26
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.004268c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x425d00
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x426000
push ecx
push esi
call fcn.00426cc0
add esp, 0x10
jmp dword [0x450910]