joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x100], eax
xor eax, eax
nop
mov byte [eax + esi], al
inc eax
cmp eax, 0x80
jl 0x429b00
push ebx
push edi
push dword [esi + 0x100]
call fcn.0060ced9
mov edi, 1
add esp, 4
lea ebx, [edi + 0x7e]
call fcn.0060ceb8
cdq
idiv ebx
mov cl, byte [edi + esi]
mov al, byte [edx + esi + 1]
mov byte [edi + esi], al
inc edi
mov byte [edx + esi + 1], cl
cmp edi, 0x80
jl 0x429b23
call fcn.00409870
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x54746547
push ecx
push eax
mov dword [ebp - 0x10], 0x436b6369
mov dword [ebp - 0xc], 0x746e756f
mov byte [ebp - 8], 0
call fcn.0048a530
add esp, 8
pop edi
pop ebx
test eax, eax
je 0x429b75
call eax
push eax
call fcn.0060ced9
add esp, 4
xor ecx, ecx
movzx edx, byte [ecx + esi]
mov byte [edx + esi + 0x80], cl
inc ecx
cmp ecx, 0x80
jl 0x429b80
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 4

Function at 0x429bb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64ae19
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x68025c
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov dword [edi], 0x68028c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov byte [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [ebp - 4], 3
push 1
call fcn.005e9c63
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
mov ecx, esi
mov dword [esi], eax
call fcn.0042ffe0
mov byte [ebp - 4], 5
lea ecx, [edi + 0x30]
push dword [ebp + 8]
call fcn.004068e0
mov byte [ebp - 4], 6
lea ecx, [edi + 0x48]
push dword [ebp + 0xc]
call fcn.004068e0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42a370
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64b109
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00406970
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00406970
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00406970
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00406970
mov byte [ebp - 4], 3
lea eax, [esi + 0x60]
push eax
lea ecx, [edi + 0x60]
call fcn.00406970
mov byte [ebp - 4], 4
lea eax, [esi + 0x78]
push eax
lea ecx, [edi + 0x78]
call fcn.004068e0
mov dword [ebp - 4], 6
lea eax, [esi + 0x90]
push eax
lea ecx, [edi + 0x90]
call fcn.00406970
mov byte [ebp - 4], 7
lea eax, [esi + 0xa8]
push eax
lea ecx, [edi + 0xa8]
call fcn.00406970
mov byte [ebp - 4], 8
lea eax, [esi + 0xc0]
push eax
lea ecx, [edi + 0xc0]
call fcn.00406970
mov byte [ebp - 4], 9
lea eax, [esi + 0xd8]
push eax
lea ecx, [edi + 0xd8]
call fcn.00406970
mov byte [ebp - 4], 0xa
lea eax, [esi + 0xf0]
push eax
lea ecx, [edi + 0xf0]
call fcn.00406970
mov byte [ebp - 4], 0xb
lea eax, [esi + 0x108]
push eax
lea ecx, [edi + 0x108]
call fcn.004068e0
mov byte [ebp - 4], 0xc
lea eax, [esi + 0x120]
push eax
lea ecx, [edi + 0x120]
call fcn.004068e0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42ca80
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64be0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xc
lea ecx, [esi + 0x12c]
call fcn.00407b80
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x114]
call fcn.00407b80
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0xfc]
call fcn.00407b80
mov byte [ebp - 4], 9
lea ecx, [esi + 0xe4]
call fcn.00407b80
mov byte [ebp - 4], 8
lea ecx, [esi + 0xd8]
call fcn.00464610
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc0]
call fcn.00407b80
mov byte [ebp - 4], 6
lea ecx, [esi + 0xa8]
call fcn.00407b80
mov byte [ebp - 4], 5
lea ecx, [esi + 0x90]
call fcn.00407b80
mov byte [ebp - 4], 4
lea ecx, [esi + 0x78]
call fcn.00407b80
mov byte [ebp - 4], 3
lea ecx, [esi + 0x60]
call fcn.00407b80
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00407b80
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00407b80
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00407b80
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00407b80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42d090
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64c1f9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 6
lea ecx, [esi + 0x120]
call fcn.00407b00
mov byte [ebp - 4], 5
lea ecx, [esi + 0x108]
call fcn.00407b00
mov byte [ebp - 4], 4
lea ecx, [esi + 0xf0]
call fcn.00407b80
mov byte [ebp - 4], 3
lea ecx, [esi + 0xd8]
call fcn.00407b80
mov byte [ebp - 4], 2
lea ecx, [esi + 0xc0]
call fcn.00407b80
mov byte [ebp - 4], 1
lea ecx, [esi + 0xa8]
call fcn.00407b80
mov byte [ebp - 4], 0
lea ecx, [esi + 0x90]
call fcn.00407b80
mov dword [ebp - 4], 0xc
lea ecx, [esi + 0x78]
call fcn.00407b00
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x60]
call fcn.00407b80
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x48]
call fcn.00407b80
mov byte [ebp - 4], 9
lea ecx, [esi + 0x30]
call fcn.00407b80
mov byte [ebp - 4], 8
lea ecx, [esi + 0x18]
call fcn.00407b80
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00407b80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x460900
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x460b15
push ebx
push edi
cmp eax, 0x7c
je 0x460b13
cmp eax, 0x29
jne 0x460941
cmp dword [esi + 0x10], 0
jne 0x460b13
cmp eax, eax
jne 0x460941
test dword [esi + 0x50], 0x10000000
je 0x460b22
jmp 0x460acc
cmp eax, 0x2e
jne 0x46099b
push 5
lea ecx, [esi + 0x24]
call fcn.00463d50
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x46098f
cmp byte [eax], 0x5c
jne 0x46098c
lea ecx, [eax + 1]
cmp ecx, edx
je 0x46098c
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x460979
mov bl, byte [ecx]
cmp bl, 0x28
je 0x46098a
cmp bl, 0x29
je 0x46098a
test dl, 0x10
jne 0x46098c
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x46098a
cmp dl, 0x7d
jne 0x46098c
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.00464690
jmp 0x460afe
cmp eax, 0x5c
jne 0x4609f7
mov ecx, esi
call fcn.00463e00
test byte [esi + 0x50], 0x80
je 0x4609eb
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x4609ca
push 4
lea ecx, [esi + 0x24]
call fcn.00463d50
mov ecx, esi
call fcn.00463e00
jmp 0x460b05
cmp al, 0x42
jne 0x4609eb
push 4
lea ecx, [esi + 0x24]
call fcn.00463d50
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00463e00
jmp 0x460b05
mov ecx, esi
call fcn.00460b40
jmp 0x460afe
cmp eax, 0x5b
jne 0x460a58
mov ecx, esi
call fcn.00463e00
lea ecx, [esi + 0x24]
call fcn.0045fda0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x460a24
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00463e00
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x460a42
cmp eax, 0x5d
jne 0x460a42
push eax
lea ecx, [esi + 0x24]
call fcn.0045fcf0
mov ecx, esi
call fcn.00463e00
mov ecx, esi
call fcn.004619b0
cmp dword [esi + 0x4c], 0x5d
jne 0x460b2b
jmp 0x460af7
cmp eax, 0x28
jne 0x460a88
mov ecx, esi
call fcn.00463e00
mov ecx, esi
call fcn.00464950
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x460b22
mov ecx, esi
call fcn.00463e00
test bl, bl
je 0x460b05
jmp 0x460afe
cmp eax, 0x5e
jne 0x460aa0
push 2
lea ecx, [esi + 0x24]
call fcn.00463d50
mov ecx, esi
call fcn.00463e00
jmp 0x460b05
cmp eax, 0x24
jne 0x460ab8
push 3
lea ecx, [esi + 0x24]
call fcn.00463d50
mov ecx, esi
call fcn.00463e00
jmp 0x460b05
cmp eax, 0x2a
je 0x460b19
cmp eax, 0x2b
je 0x460b19
cmp eax, 0x3f
je 0x460b19
cmp eax, 0x7b
je 0x460b19
cmp eax, 0x7d
jne 0x460adc
test dword [esi + 0x50], 0x10000000
je 0x460b34
jmp 0x460aea
cmp eax, 0x5d
jne 0x460aea
test dword [esi + 0x50], 0x10000000
je 0x460b2b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0045fba0
mov ecx, esi
call fcn.00463e00
mov ecx, esi
call fcn.00463e60
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x460913
pop edi
pop ebx
mov al, cl
pop esi
ret
push 0xa
mov ecx, esi
call fcn.004635c0
push 5
mov ecx, esi
call fcn.004635c0
push 4
mov ecx, esi
call fcn.004635c0
push 6
mov ecx, esi
call fcn.004635c0
int3
Function at 0x465350
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x465381
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x465370
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x46b580
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x653fa8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ecx + 0x108]
mov dword [ebp - 0x10], 0
mov edi, dword [ebp + 8]
mov ecx, edi
push esi
call fcn.00406970
mov dword [ebp - 4], 1
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00406970
mov byte [ebp - 4], 2
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00406970
mov byte [ebp - 4], 3
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00406970
mov byte [ebp - 4], 4
lea eax, [esi + 0x60]
push eax
lea ecx, [edi + 0x60]
call fcn.00406970
mov byte [ebp - 4], 5
lea eax, [esi + 0x78]
push eax
lea ecx, [edi + 0x78]
call fcn.00406970
mov byte [ebp - 4], 6
lea eax, [esi + 0x90]
push eax
lea ecx, [edi + 0x90]
call fcn.00406970
mov byte [ebp - 4], 7
lea eax, [esi + 0xa8]
push eax
lea ecx, [edi + 0xa8]
call fcn.00406970
mov byte [ebp - 4], 8
lea eax, [esi + 0xc0]
push eax
lea ecx, [edi + 0xc0]
call fcn.00406970
mov byte [ebp - 4], 9
lea eax, [esi + 0xd8]
push eax
lea ecx, [edi + 0xd8]
call fcn.00467390
mov byte [ebp - 4], 0xa
lea eax, [esi + 0xe4]
push eax
lea ecx, [edi + 0xe4]
call fcn.00406970
mov byte [ebp - 4], 0xb
lea eax, [esi + 0xfc]
push eax
lea ecx, [edi + 0xfc]
call fcn.00406970
mov byte [ebp - 4], 0xc
lea eax, [esi + 0x114]
push eax
lea ecx, [edi + 0x114]
call fcn.00406970
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x12c]
push ecx
lea ecx, [edi + 0x12c]
call fcn.00406970
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46e6d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x654326
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push esi
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x46e77c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x46e77c
call fcn.00469e00
mov esi, eax
jmp 0x46e86f
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x46e79f
call fcn.00469e00
jmp 0x46e862
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x46e7bd
call fcn.00469e00
jmp 0x46e862
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x46e7de
mov esi, 0x8007000e
jmp 0x46e864
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x418]
call fcn.00469640
mov dword [ebp - 4], 1
jmp 0x46e816
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x46e827
mov esi, 0x8007000e
jmp 0x46e864
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x46e842
call fcn.00469e00
jmp 0x46e862
xor edx, edx
mov eax, dword [ebp - 0x418]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.0046e530
mov esi, eax
test edi, edi
je 0x46e86f
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x46e88c
lea ecx, [ebp - 0x418]
call fcn.0046b570
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 0x10
Function at 0x471980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.00471a70
mov esi, dword [ebp + 0xc]
or edi, 0xffffffff
mov ebx, dword [ebp + 8]
push 5
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov dword [ebp - 4], eax
test eax, eax
je 0x471a56
push 0xf0
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ecx, eax
mov dword [ebp + 0xc], 0
mov eax, dword [sym.imp.KERNEL32.DLL_LoadResource]
test ecx, ecx
je 0x4719dc
push ecx
push ebx
call eax
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp + 0xc], eax
mov eax, dword [sym.imp.KERNEL32.DLL_LoadResource]
push dword [ebp - 4]
xor esi, esi
push ebx
call eax
test eax, eax
je 0x471a43
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x471a43
push dword [ebp + 0xc]
push eax
call fcn.0046ff10
add esp, 8
mov ebx, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov edi, eax
test edi, edi
je 0x471a22
cmp edi, 0xffffffff
jne 0x471a2a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
cmp ebx, dword [ebp - 4]
je 0x471a4b
test ebx, ebx
je 0x471a4b
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
jmp 0x471a4b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test esi, esi
je 0x471a56
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4722a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x654a2d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6ece84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 3
mov byte [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [ebp - 4], 4
lea ecx, [esi + 0x30]
call fcn.00471fb0
mov byte [ebp - 4], 5
mov dword [esi + 0x28], 0x681260
mov dword [esi + 0x2c], 0x681260
mov dword [esi], 0x6812b0
mov dword [esi + 0x28], 0x6812c4
mov dword [esi + 0x2c], 0x6812c8
mov dword [esi + 0x48], 0
mov byte [ebp - 4], 6
lea ecx, [esi + 0x58]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
call fcn.00472080
mov byte [ebp - 4], 7
lea ecx, [esi + 0x108]
mov dword [esi + 0x104], 0
call fcn.00429880
mov byte [ebp - 4], 8
mov dword [esi + 0x24c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x477590
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x460], 0
mov ecx, dword [esi + 0x1a8]
setne al
mov byte [esi + 0x1ac], al
xor eax, eax
mov dword [ebp - 4], eax
test ecx, ecx
je 0x4775df
cmp ecx, 1
jne 0x4775d1
mov dword [ebp - 4], 0xa
jmp 0x4775df
cmp ecx, 2
mov edx, 0x14
cmove eax, edx
mov dword [ebp - 4], eax
lea ecx, [esi + 0x21c]
call fcn.0045aef0
mov ecx, dword [esi + 0x48]
call fcn.0042ebb0
mov ecx, dword [esi + 0x48]
call fcn.0045f0d0
mov al, byte [esi + 0x1ac]
mov byte [ebp - 8], al
lea eax, [ebp - 4]
push dword [ebp - 8]
push 0
push eax
push dword [esi + 0x1a8]
call fcn.004659a0
mov ecx, eax
call fcn.0045d910
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostQuitMessage]
push dword [esi + 0x1a8]
mov ecx, esi
call fcn.00480390
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47d6e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x656499
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x60], esi
lea edi, [esi + 4]
mov dword [ebp - 0x5c], 0
push 0
mov ecx, edi
mov dword [ebp - 0x64], edi
call fcn.00473010
add esi, 0x7c
cmp dword [esi + 0x14], 8
jb 0x47d731
mov esi, dword [esi]
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xc
call ebx
push 0xb
mov esi, eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_LoadImageW]
push 0
push esi
push eax
push 1
push 0x80
push dword [0x6f38d0]
call ebx
push eax
push 1
push 0x80
push dword [edi]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
call edi
push 0x32
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
mov esi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push esi
push eax
push 1
push 0x80
push dword [0x6f38d0]
call ebx
push eax
mov eax, dword [ebp - 0x64]
push 0
push 0x80
push dword [eax]
call edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.0047b6c0
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00485c00
add esp, 0xc
mov dword [ebp - 0x5c], 1
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00407b00
mov ebx, dword [ebp - 0x60]
lea ecx, [ebx + 0x4c]
cmp ecx, esi
je 0x47d7fc
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x47d7f3
mov eax, dword [esi]
push dword [esi + 0x10]
push eax
call fcn.0040cbc0
mov eax, 1
mov dword [ebp - 0x5c], eax
and eax, 0xfffffffe
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00407b80
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
mov ecx, dword [ebx + 0x48]
push eax
call fcn.00433c20
lea ecx, [ebx + 0x1c0]
lea eax, [ebp - 0x28]
push eax
lea eax, [ecx + 0x18]
push eax
push ecx
lea eax, [ecx + 0xc]
mov ecx, dword [ecx + 0x34]
push eax
push 4
call fcn.00433c50
mov ecx, ebx
call fcn.0047cca0
mov ecx, ebx
call fcn.0047d430
push 1
mov ecx, ebx
call fcn.0047fe90
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 0x4c0]
call esi
push 0
push dword [ebx + 0x4bc]
call esi
push 0
push dword [ebx + 0x4c4]
call esi
push 0
push dword [ebx + 0x4d8]
call esi
push 0
push dword [ebx + 0x4d0]
call esi
push 0
push dword [ebx + 0x4cc]
call esi
push 0
push dword [ebx + 0x580]
call esi
push 0
push 2
mov ecx, ebx
call fcn.0047fe10
push 1
push 1
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 2
push eax
push 0
call fcn.004659a0
mov ecx, eax
call fcn.0045d910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00407b00
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret 0x10
Function at 0x486290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x657759
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebp + 8]
mov ecx, esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0
push ebx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
push 0x67ed6c
mov dword [ebp - 0x28], ebx
mov word [esi], ax
call fcn.0040cbc0
mov dword [ebp - 4], 0
cmp byte [0x6eb291], 0
mov dword [ebp - 0x24], 1
je 0x48634d
call fcn.00409870
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x54746547
push ecx
push eax
mov dword [ebp - 0x1c], 0x436b6369
mov dword [ebp - 0x18], 0x746e756f
mov byte [ebp - 0x14], 0
call fcn.0048a530
add esp, 8
test eax, eax
je 0x48633d
call eax
push eax
call fcn.0060ced9
add esp, 4
mov byte [0x6eb291], 0
xor edi, edi
test ebx, ebx
jle 0x48637c
cmp dword [esi + 0x10], edi
jbe 0x48639a
cmp dword [esi + 0x14], 8
mov ebx, esi
jb 0x486362
mov ebx, dword [esi]
call fcn.0060ceb8
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
mov word [ebx + edi*2], dx
inc edi
cmp edi, dword [ebp - 0x28]
jl 0x486353
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
call fcn.0040c890
int3

Function at 0x4863a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x657759
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6ece84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebp + 8]
mov ecx, esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0
push ebx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
push 0x67ed6c
mov dword [ebp - 0x28], ebx
mov word [esi], ax
call fcn.0040cbc0
mov dword [ebp - 4], 0
cmp byte [0x6eb292], 0
mov dword [ebp - 0x24], 1
je 0x48645d
call fcn.00409870
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x54746547
push ecx
push eax
mov dword [ebp - 0x1c], 0x436b6369
mov dword [ebp - 0x18], 0x746e756f
mov byte [ebp - 0x14], 0
call fcn.0048a530
add esp, 8
test eax, eax
je 0x48644d
call eax
push eax
call fcn.0060ced9
add esp, 4
mov byte [0x6eb292], 0
xor edi, edi
test ebx, ebx
jle 0x486491
cmp dword [esi + 0x10], edi
jbe 0x4864af
cmp dword [esi + 0x14], 8
mov ebx, esi
jb 0x486472
mov ebx, dword [esi]
call fcn.0060ceb8
cdq
mov ecx, 0x24
idiv ecx
mov ax, word [edx*2 + str.0123456789abcdefghijklmnopqrstuvwxyz]
mov word [ebx + edi*2], ax
inc edi
cmp edi, dword [ebp - 0x28]
jl 0x486463
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9f40
mov esp, ebp
pop ebp
ret
call fcn.0040c890
int3