joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b71b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x557460]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x55d58c]
mov esi, dword [ebp + 8]
test eax, eax
jne 0x4075dd
push 0x517a44
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x55d58c], eax
test eax, eax
jne 0x4075dd
push eax
push 0x104
lea ecx, [ebp - 0x230]
call fcn.00405030
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
push eax
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, eax
test ecx, ecx
jne 0x4074dc
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
call fcn.00405600
jmp 0x4075c2
mov eax, dword [ebp - 0x220]
cmp ecx, eax
ja 0x407508
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov dword [ebp - 0x220], ecx
cmovae eax, dword [ebp - 0x230]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x407518
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x230]
call fcn.00409780
movups xmm0, xmmword [ebp - 0x230]
xor eax, eax
lea ecx, [ebp - 0x230]
mov word [ebp - 0x230], ax
movups xmmword [ebp - 0x248], xmm0
movq xmm0, qword [ebp - 0x220]
movq qword [ebp - 0x238], xmm0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
call fcn.00405600
cmp dword [ebp - 0x238], 0
jbe 0x4075c2
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d49e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x517a44
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x55d58c], eax
lea ecx, [ebp - 0x248]
call fcn.00405600
mov eax, dword [0x55d58c]
test eax, eax
jne 0x4075dd
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044042c
mov esp, ebp
pop ebp
ret
Function at 0x40a560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 0x20], 0x6e0049
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6c0061
mov dword [ebp - 0x14], 0x4c006c
mov dword [ebp - 0x10], 0x63006f
mov dword [ebp - 0xc], 0x740061
mov dword [ebp - 8], 0x6f0069
mov dword [ebp - 4], 0x6e
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40a5fa
mov eax, dword [ecx]
push 2
push 0xf
call dword [eax]
test eax, eax
je 0x40a604
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xf
jl 0x40a5f0
mov dword [eax - 0xc], 0xf
xor eax, eax
mov ecx, dword [esi]
push 0x1e
mov word [ecx + 0x1e], ax
lea eax, [ebp - 0x20]
push eax
push 0x1e
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3

Function at 0x40a690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x34], 0x6f0053
push edi
mov dword [ebp - 0x30], 0x740066
mov dword [ebp - 0x2c], 0x610077
mov dword [ebp - 0x28], 0x650072
mov dword [ebp - 0x24], 0x54005c
mov dword [ebp - 0x20], 0x6e0065
mov dword [ebp - 0x1c], 0x650063
mov dword [ebp - 0x18], 0x74006e
mov dword [ebp - 0x14], 0x51005c
mov dword [ebp - 0x10], 0x500051
mov dword [ebp - 0xc], 0x4d0043
mov dword [ebp - 8], 0x720067
mov word [ebp - 4], ax
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40a74e
mov eax, dword [ecx]
push 2
push 0x18
call dword [eax]
test eax, eax
je 0x40a758
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x18
jl 0x40a744
mov dword [eax - 0xc], 0x18
xor eax, eax
mov ecx, dword [esi]
push 0x30
mov word [ecx + 0x30], ax
lea eax, [ebp - 0x34]
push eax
push 0x30
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3

Function at 0x40a760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov dword [ebp - 0x20], 0x6e0055
mov dword [ebp - 0x1c], 0x6e0069
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov dword [ebp - 0x10], 0x53006c
mov dword [ebp - 0xc], 0x720074
mov dword [ebp - 8], 0x6e0069
mov dword [ebp - 4], 0x67
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40a7f8
mov eax, dword [ecx]
push 2
push 0xf
call dword [eax]
test eax, eax
je 0x40a802
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xf
jl 0x40a7ee
mov dword [eax - 0xc], 0xf
xor eax, eax
mov ecx, dword [esi]
push 0x1e
mov word [ecx + 0x1e], ax
lea eax, [ebp - 0x20]
push eax
push 0x1e
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3
Function at 0x40a810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xa0], 0x6f0053
push edi
mov dword [ebp - 0x9c], 0x740066
mov dword [ebp - 0x98], 0x610077
mov dword [ebp - 0x94], 0x650072
mov dword [ebp - 0x90], 0x4d005c
mov dword [ebp - 0x8c], 0x630069
mov dword [ebp - 0x88], 0x6f0072
mov dword [ebp - 0x84], 0x6f0073
mov dword [ebp - 0x80], 0x740066
mov dword [ebp - 0x7c], 0x57005c
mov dword [ebp - 0x78], 0x6e0069
mov dword [ebp - 0x74], 0x6f0064
mov dword [ebp - 0x70], 0x730077
mov dword [ebp - 0x6c], 0x43005c
mov dword [ebp - 0x68], 0x720075
mov dword [ebp - 0x64], 0x650072
mov dword [ebp - 0x60], 0x74006e
mov dword [ebp - 0x5c], 0x650056
mov dword [ebp - 0x58], 0x730072
mov dword [ebp - 0x54], 0x6f0069
mov dword [ebp - 0x50], 0x5c006e
mov dword [ebp - 0x4c], 0x6e0055
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x740073
mov dword [ebp - 0x40], 0x6c0061
mov dword [ebp - 0x3c], 0x5c006c
mov dword [ebp - 0x38], 0x69004b
mov dword [ebp - 0x34], 0x67006e
mov dword [ebp - 0x30], 0x6f0073
mov dword [ebp - 0x2c], 0x740066
mov dword [ebp - 0x28], 0x490020
mov dword [ebp - 0x24], 0x74006e
mov dword [ebp - 0x20], 0x720065
mov dword [ebp - 0x1c], 0x65006e
mov dword [ebp - 0x18], 0x200074
mov dword [ebp - 0x14], 0x650053
mov dword [ebp - 0x10], 0x750063
mov dword [ebp - 0xc], 0x690072
mov dword [ebp - 8], 0x790074
mov word [ebp - 4], ax
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40a9b2
mov eax, dword [ecx]
push 2
push 0x4e
call dword [eax]
test eax, eax
je 0x40a9bc
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x4e
jl 0x40a9a8
mov dword [eax - 0xc], 0x4e
xor eax, eax
mov ecx, dword [esi]
push 0x9c
mov word [ecx + 0x9c], ax
lea eax, [ebp - 0xa0]
push eax
push 0x9c
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3
Function at 0x40aa50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x80], 0x6f0053
push edi
mov dword [ebp - 0x7c], 0x740066
mov dword [ebp - 0x78], 0x610077
mov dword [ebp - 0x74], 0x650072
mov dword [ebp - 0x70], 0x4d005c
mov dword [ebp - 0x6c], 0x630069
mov dword [ebp - 0x68], 0x6f0072
mov dword [ebp - 0x64], 0x6f0073
mov dword [ebp - 0x60], 0x740066
mov dword [ebp - 0x5c], 0x57005c
mov dword [ebp - 0x58], 0x6e0069
mov dword [ebp - 0x54], 0x6f0064
mov dword [ebp - 0x50], 0x730077
mov dword [ebp - 0x4c], 0x43005c
mov dword [ebp - 0x48], 0x720075
mov dword [ebp - 0x44], 0x650072
mov dword [ebp - 0x40], 0x74006e
mov dword [ebp - 0x3c], 0x650056
mov dword [ebp - 0x38], 0x730072
mov dword [ebp - 0x34], 0x6f0069
mov dword [ebp - 0x30], 0x5c006e
mov dword [ebp - 0x2c], 0x6e0055
mov dword [ebp - 0x28], 0x6e0069
mov dword [ebp - 0x24], 0x740073
mov dword [ebp - 0x20], 0x6c0061
mov dword [ebp - 0x1c], 0x5c006c
mov dword [ebp - 0x18], 0x330032
mov dword [ebp - 0x14], 0x350034
mov dword [ebp - 0x10], 0x430050
mov dword [ebp - 0xc], 0x610053
mov dword [ebp - 8], 0x650066
mov word [ebp - 4], ax
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40ab96
mov eax, dword [ecx]
push 2
push 0x3e
call dword [eax]
test eax, eax
je 0x40aba0
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x3e
jl 0x40ab8c
mov dword [eax - 0xc], 0x3e
xor eax, eax
mov ecx, dword [esi]
push 0x7c
mov word [ecx + 0x7c], ax
lea eax, [ebp - 0x80]
push eax
push 0x7c
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3

Function at 0x40abb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0x360033
mov dword [ebp - 0x14], 0x730030
mov dword [ebp - 0x10], 0x660061
mov dword [ebp - 0xc], 0x2e0065
mov dword [ebp - 8], 0x780065
mov dword [ebp - 4], 0x65
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40ac3a
mov eax, dword [ecx]
push 2
push 0xb
call dword [eax]
test eax, eax
je 0x40ac44
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xb
jl 0x40ac30
mov dword [eax - 0xc], 0xb
xor eax, eax
mov ecx, dword [esi]
push 0x16
mov word [ecx + 0x16], ax
lea eax, [ebp - 0x18]
push eax
push 0x16
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3
Function at 0x40ad50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x78], 0x4f0053
mov dword [ebp - 0x74], 0x540046
mov dword [ebp - 0x70], 0x410057
mov dword [ebp - 0x6c], 0x450052
mov dword [ebp - 0x68], 0x4d005c
mov dword [ebp - 0x64], 0x630069
mov dword [ebp - 0x60], 0x6f0072
mov dword [ebp - 0x5c], 0x6f0073
mov dword [ebp - 0x58], 0x740066
mov dword [ebp - 0x54], 0x57005c
mov dword [ebp - 0x50], 0x6e0069
mov dword [ebp - 0x4c], 0x6f0064
mov dword [ebp - 0x48], 0x730077
mov dword [ebp - 0x44], 0x43005c
mov dword [ebp - 0x40], 0x720075
mov dword [ebp - 0x3c], 0x650072
mov dword [ebp - 0x38], 0x74006e
mov dword [ebp - 0x34], 0x650056
mov dword [ebp - 0x30], 0x730072
mov dword [ebp - 0x2c], 0x6f0069
mov dword [ebp - 0x28], 0x5c006e
mov dword [ebp - 0x24], 0x6e0055
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6c0061
mov dword [ebp - 0x14], 0x5c006c
mov dword [ebp - 0x10], 0x330032
mov dword [ebp - 0xc], 0x350034
mov dword [ebp - 8], 0x690050
mov dword [ebp - 4], 0x63
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40ae86
mov eax, dword [ecx]
push 2
push 0x3b
call dword [eax]
test eax, eax
je 0x40ae90
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x3b
jl 0x40ae7c
mov dword [eax - 0xc], 0x3b
xor eax, eax
mov ecx, dword [esi]
push 0x76
mov word [ecx + 0x76], ax
lea eax, [ebp - 0x78]
push eax
push 0x76
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3

Function at 0x40af30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x35343332
mov dword [ebp - 8], 0x61736370
mov word [ebp - 4], 0x6566
mov byte [ebp - 2], 0
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40afa6
mov eax, dword [ecx]
push 1
push 0xa
call dword [eax]
test eax, eax
je 0x40afb0
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x40af9c
mov dword [eax - 0xc], 0xa
lea eax, [ebp - 0xc]
mov ecx, dword [esi]
push 0xa
push eax
push 0xa
mov byte [ecx + 0xa], 0
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3
Function at 0x40afc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
xor eax, eax
mov dword [ebp - 0x2c], 0x6f0072
push esi
mov dword [ebp - 0x28], 0x74006f
mov dword [ebp - 0x24], 0x53005c
mov dword [ebp - 0x20], 0x630065
mov dword [ebp - 0x1c], 0x720075
mov dword [ebp - 0x18], 0x740069
mov dword [ebp - 0x14], 0x430079
mov dword [ebp - 0x10], 0x6e0065
mov dword [ebp - 0xc], 0x650074
mov dword [ebp - 8], 0x320072
mov word [ebp - 4], ax
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40b06c
mov eax, dword [ecx]
push 2
push 0x14
call dword [eax]
test eax, eax
je 0x40b076
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x14
jl 0x40b062
mov dword [eax - 0xc], 0x14
xor eax, eax
mov ecx, dword [esi]
push 0x28
mov word [ecx + 0x28], ax
lea eax, [ebp - 0x2c]
push eax
push 0x28
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3

Function at 0x40b080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
mov dword [ebp - 0x80], 0x4f0053
mov dword [ebp - 0x7c], 0x540046
mov dword [ebp - 0x78], 0x410057
mov dword [ebp - 0x74], 0x450052
mov dword [ebp - 0x70], 0x4d005c
mov dword [ebp - 0x6c], 0x630069
mov dword [ebp - 0x68], 0x6f0072
mov dword [ebp - 0x64], 0x6f0073
mov dword [ebp - 0x60], 0x740066
mov dword [ebp - 0x5c], 0x57005c
mov dword [ebp - 0x58], 0x6e0069
mov dword [ebp - 0x54], 0x6f0064
mov dword [ebp - 0x50], 0x730077
mov dword [ebp - 0x4c], 0x43005c
mov dword [ebp - 0x48], 0x720075
mov dword [ebp - 0x44], 0x650072
mov dword [ebp - 0x40], 0x74006e
mov dword [ebp - 0x3c], 0x650056
mov dword [ebp - 0x38], 0x730072
mov dword [ebp - 0x34], 0x6f0069
mov dword [ebp - 0x30], 0x5c006e
mov dword [ebp - 0x2c], 0x700041
mov dword [ebp - 0x28], 0x200070
mov dword [ebp - 0x24], 0x610050
mov dword [ebp - 0x20], 0x680074
mov dword [ebp - 0x1c], 0x5c0073
mov dword [ebp - 0x18], 0x360033
mov dword [ebp - 0x14], 0x730030
mov dword [ebp - 0x10], 0x660061
mov dword [ebp - 0xc], 0x2e0065
mov dword [ebp - 8], 0x780065
mov dword [ebp - 4], 0x65
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40b1c7
mov eax, dword [ecx]
push 2
push 0x3f
call dword [eax]
test eax, eax
je 0x40b1d1
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x3f
jl 0x40b1bd
mov dword [eax - 0xc], 0x3f
xor eax, eax
mov ecx, dword [esi]
push 0x7e
mov word [ecx + 0x7e], ax
lea eax, [ebp - 0x80]
push eax
push 0x7e
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3
Function at 0x40b1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x78], 0x6f0053
push edi
mov dword [ebp - 0x74], 0x740066
mov dword [ebp - 0x70], 0x610077
mov dword [ebp - 0x6c], 0x650072
mov dword [ebp - 0x68], 0x4d005c
mov dword [ebp - 0x64], 0x630069
mov dword [ebp - 0x60], 0x6f0072
mov dword [ebp - 0x5c], 0x6f0073
mov dword [ebp - 0x58], 0x740066
mov dword [ebp - 0x54], 0x57005c
mov dword [ebp - 0x50], 0x6e0069
mov dword [ebp - 0x4c], 0x6f0064
mov dword [ebp - 0x48], 0x730077
mov dword [ebp - 0x44], 0x43005c
mov dword [ebp - 0x40], 0x720075
mov dword [ebp - 0x3c], 0x650072
mov dword [ebp - 0x38], 0x74006e
mov dword [ebp - 0x34], 0x650056
mov dword [ebp - 0x30], 0x730072
mov dword [ebp - 0x2c], 0x6f0069
mov dword [ebp - 0x28], 0x5c006e
mov dword [ebp - 0x24], 0x6e0055
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6c0061
mov dword [ebp - 0x14], 0x5c006c
mov dword [ebp - 0x10], 0x430041
mov dword [ebp - 0xc], 0x530044
mov dword [ebp - 8], 0x650065
mov word [ebp - 4], ax
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40b315
mov eax, dword [ecx]
push 2
push 0x3a
call dword [eax]
test eax, eax
je 0x40b31f
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x3a
jl 0x40b30b
mov dword [eax - 0xc], 0x3a
xor eax, eax
mov ecx, dword [esi]
push 0x74
mov word [ecx + 0x74], ax
lea eax, [ebp - 0x78]
push eax
push 0x74
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3

Function at 0x40b330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x40], 0x650053
push edi
mov dword [ebp - 0x3c], 0x65006c
mov dword [ebp - 0x38], 0x740063
mov dword [ebp - 0x34], 0x2a0020
mov dword [ebp - 0x30], 0x460020
mov dword [ebp - 0x2c], 0x6f0072
mov dword [ebp - 0x28], 0x20006d
mov dword [ebp - 0x24], 0x6e0041
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x690056
mov dword [ebp - 0x18], 0x750072
mov dword [ebp - 0x14], 0x500073
mov dword [ebp - 0x10], 0x6f0072
mov dword [ebp - 0xc], 0x750064
mov dword [ebp - 8], 0x740063
mov word [ebp - 4], ax
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40b403
mov eax, dword [ecx]
push 2
push 0x1e
call dword [eax]
test eax, eax
je 0x40b40d
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x1e
jl 0x40b3f9
mov dword [eax - 0xc], 0x1e
xor eax, eax
mov ecx, dword [esi]
push 0x3c
mov word [ecx + 0x3c], ax
lea eax, [ebp - 0x40]
push eax
push 0x3c
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3
Function at 0x40b420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x34], 0x6f0053
mov dword [ebp - 0x30], 0x740066
mov dword [ebp - 0x2c], 0x610077
mov dword [ebp - 0x28], 0x650072
mov dword [ebp - 0x24], 0x4c005c
mov dword [ebp - 0x20], 0x6e0065
mov dword [ebp - 0x1c], 0x76006f
mov dword [ebp - 0x18], 0x5c006f
mov dword [ebp - 0x14], 0x630050
mov dword [ebp - 0x10], 0x61004d
mov dword [ebp - 0xc], 0x61006e
mov dword [ebp - 8], 0x650067
mov dword [ebp - 4], 0x72
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40b4df
mov eax, dword [ecx]
push 2
push 0x19
call dword [eax]
test eax, eax
je 0x40b4e9
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x19
jl 0x40b4d5
mov dword [eax - 0xc], 0x19
xor eax, eax
mov ecx, dword [esi]
push 0x32
mov word [ecx + 0x32], ax
lea eax, [ebp - 0x34]
push eax
push 0x32
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3

Function at 0x40b4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x7c], 0x4f0053
mov dword [ebp - 0x78], 0x540046
mov dword [ebp - 0x74], 0x410057
mov dword [ebp - 0x70], 0x450052
mov dword [ebp - 0x6c], 0x4d005c
mov dword [ebp - 0x68], 0x630069
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x6f0073
mov dword [ebp - 0x5c], 0x740066
mov dword [ebp - 0x58], 0x57005c
mov dword [ebp - 0x54], 0x6e0069
mov dword [ebp - 0x50], 0x6f0064
mov dword [ebp - 0x4c], 0x730077
mov dword [ebp - 0x48], 0x43005c
mov dword [ebp - 0x44], 0x720075
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x74006e
mov dword [ebp - 0x38], 0x650056
mov dword [ebp - 0x34], 0x730072
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x700041
mov dword [ebp - 0x24], 0x200070
mov dword [ebp - 0x20], 0x610050
mov dword [ebp - 0x1c], 0x680074
mov dword [ebp - 0x18], 0x5c0073
mov dword [ebp - 0x14], 0x360033
mov dword [ebp - 0x10], 0x730030
mov dword [ebp - 0xc], 0x2e0064
mov dword [ebp - 8], 0x780065
mov dword [ebp - 4], 0x65
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40b62d
mov eax, dword [ecx]
push 2
push 0x3d
call dword [eax]
test eax, eax
je 0x40b637
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x3d
jl 0x40b623
mov dword [eax - 0xc], 0x3d
xor eax, eax
mov ecx, dword [esi]
push 0x7a
mov word [ecx + 0x7a], ax
lea eax, [ebp - 0x7c]
push eax
push 0x7a
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3
Function at 0x40b640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0x510051
mov dword [ebp - 0x14], 0x430050
mov dword [ebp - 0x10], 0x67004d
mov dword [ebp - 0xc], 0x2e0072
mov dword [ebp - 8], 0x780065
mov dword [ebp - 4], 0x65
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40b6ca
mov eax, dword [ecx]
push 2
push 0xb
call dword [eax]
test eax, eax
je 0x40b6d4
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xb
jl 0x40b6c0
mov dword [eax - 0xc], 0xb
xor eax, eax
mov ecx, dword [esi]
push 0x16
mov word [ecx + 0x16], ax
lea eax, [ebp - 0x18]
push eax
push 0x16
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3

Function at 0x40b6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], 0x65004c
mov dword [ebp - 0x20], 0x6f006e
mov dword [ebp - 0x1c], 0x6f0076
mov dword [ebp - 0x18], 0x6e0049
mov dword [ebp - 0x14], 0x740073
mov dword [ebp - 0x10], 0x6c0061
mov dword [ebp - 0xc], 0x50006c
mov dword [ebp - 8], 0x740061
mov dword [ebp - 4], 0x68
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40b77f
mov eax, dword [ecx]
push 2
push 0x11
call dword [eax]
test eax, eax
je 0x40b789
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x11
jl 0x40b775
mov dword [eax - 0xc], 0x11
xor eax, eax
mov ecx, dword [esi]
push 0x22
mov word [ecx + 0x22], ax
lea eax, [ebp - 0x24]
push eax
push 0x22
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3

Function at 0x40b810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov dword [ebp - 0x28], 0x65004c
mov dword [ebp - 0x24], 0x6f006e
mov dword [ebp - 0x20], 0x6f0076
mov dword [ebp - 0x1c], 0x630050
mov dword [ebp - 0x18], 0x61004d
mov dword [ebp - 0x14], 0x61006e
mov dword [ebp - 0x10], 0x650067
mov dword [ebp - 0xc], 0x2e0072
mov dword [ebp - 8], 0x780065
mov dword [ebp - 4], 0x65
call fcn.00407790
mov ecx, eax
test ecx, ecx
je 0x40b8b6
mov eax, dword [ecx]
push 2
push 0x13
call dword [eax]
test eax, eax
je 0x40b8c0
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x13
jl 0x40b8ac
mov dword [eax - 0xc], 0x13
xor eax, eax
mov ecx, dword [esi]
push 0x26
mov word [ecx + 0x26], ax
lea eax, [ebp - 0x28]
push eax
push 0x26
push dword [esi]
call fcn.0040a020
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004062a0
push 0x80004005
call fcn.004062a0
call fcn.004092a0
int3