joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10173143
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x170
push esi
xor esi, esi
push edi
inc ecx
movzx edi, byte [ecx + 1]
xor edx, edx
mov dh, byte [ecx - 1]
mov dl, byte [ecx]
add ecx, 4
shl edx, 8
or edx, edi
movzx edi, byte [ecx - 2]
shl edx, 8
or edx, edi
mov dword [ebp + esi*4 - 0x170], edx
inc esi
cmp esi, 0x10
jb 0x10173153
push 5
pop ecx
mov esi, eax
lea edi, [ebp - 0x30]
push 0x40
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x168]
pop esi
mov ecx, dword [edx + 0x2c]
xor ecx, dword [edx + 0x18]
xor ecx, dword [edx - 8]
xor ecx, dword [edx]
add edx, 4
mov edi, ecx
shr edi, 0x1f
add ecx, ecx
or edi, ecx
dec esi
mov dword [edx + 0x34], edi
jne 0x1017318f
mov ecx, dword [eax]
mov edi, dword [eax + 8]
and dword [ebp - 4], 0
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 4]
and dword [ebp - 8], 0
push ebx
mov ebx, dword [eax + 0x10]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x170]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ebx
mov ebx, ecx
shl ecx, 5
shr ebx, 0x1b
or ebx, ecx
mov ecx, dword [ebp - 8]
cmp ecx, 0x3c
mov dword [ebp - 0x1c], ebx
jge 0x101731fe
cmp ecx, 0x28
jl 0x101731f9
mov ecx, esi
or ecx, edi
and ecx, edx
mov ebx, esi
jmp 0x10173212
cmp ecx, 0x14
jl 0x10173206
mov ecx, edx
xor ecx, esi
xor ecx, edi
jmp 0x1017321a
test ecx, ecx
jl 0x10173218
mov ecx, edx
not ecx
and ecx, esi
mov ebx, edx
and ebx, edi
or ecx, ebx
jmp 0x1017321a
xor ecx, ecx
mov edi, dword [ebp - 0xc]
mov edi, dword [edi]
add edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x1c]
add edi, ecx
mov ecx, dword [ebp - 4]
add ebx, edi
cmp cx, 0x3c
jl 0x10173239
mov ecx, 0xca62c1d6
jmp 0x10173261
cmp cx, 0x28
jl 0x10173246
mov ecx, 0x8f1bbcdc
jmp 0x10173261
cmp cx, 0x14
jl 0x10173253
mov ecx, 0x6ed9eba1
jmp 0x10173261
test cx, cx
jl 0x1017325f
mov ecx, 0x5a827999
jmp 0x10173261
xor ecx, ecx
add dword [ebp - 0xc], 4
mov edi, edx
shr edx, 2
shl edi, 0x1e
or edi, edx
mov edx, dword [ebp - 0x18]
add ecx, ebx
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp word [ebp - 4], 0x50
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ecx
jl 0x101731d5
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], esi
mov dword [eax + 4], edx
lea ecx, [ebp - 0x30]
mov esi, ecx
mov edx, eax
push 5
sub edx, esi
pop esi
mov dword [eax + 8], edi
pop ebx
mov edi, dword [edx + ecx]
add dword [ecx], edi
add ecx, 4
dec esi
jne 0x101732af
push 5
pop ecx
lea esi, [ebp - 0x30]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret

Function at 0x1017365d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
call fcn.101735e6
test eax, eax
je 0x1017369e
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
push 0
push str.Seed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8
Function at 0x101738a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x101739db
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x101739b0
test eax, eax
jne 0x101739b0
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x101738f0
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x101739db
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x101739b0
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x10173e10
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4
Function at 0x10178946
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101ebb68]
jne 0x10178950
repz ret
jmp fcn.10179172

Function at 0x1017a140
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
mov ebp, ecx
je 0x1017a1c0
call fcn.10179a60
push 2
or eax, 0xffffffff
push 0
push ebx
mov dword [ebp + 8], eax
mov dword [ebp + 4], eax
call sub.MSVCR100.dll_fseek
push ebx
call sub.MSVCR100.dll_ftell
push 0
push 0
push ebx
mov edi, eax
call sub.MSVCR100.dll_fseek
add esp, 0x1c
test edi, edi
jg 0x1017a197
push 0
push 0
push 0
push 0xc
mov ecx, ebp
call fcn.1017baa0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
lea eax, [edi + 1]
push eax
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
push ebx
mov esi, eax
push 1
push edi
push esi
mov byte [esi], 0
call sub.MSVCR100.dll_fread
add esp, 0x14
cmp eax, 1
je 0x1017a1d8
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, ebp
call fcn.1017baa0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
mov byte [esi + edi], 0
mov dl, byte [esi]
test dl, dl
mov eax, esi
mov ecx, esi
je 0x1017a205
mov dl, byte [eax]
cmp dl, 0xd
jne 0x1017a1fc
mov byte [ecx], 0xa
mov dl, byte [eax + 1]
inc ecx
inc eax
cmp dl, 0xa
jne 0x1017a200
jmp 0x1017a1ff
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x1017a1e6
mov eax, dword [esp + 0x18]
mov byte [ecx], 0
mov edx, dword [ebp]
push eax
push 0
push esi
mov ecx, ebp
call dword [edx + 8]
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov cl, byte [ebp + 0x2c]
add esp, 4
xor eax, eax
pop edi
pop esi
test cl, cl
pop ebp
pop ebx
sete al
ret 8
Function at 0x41fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e52
and dword [ebp - 0x14], 0
cmp dword [0x46d558], 0
mov dword [ebp - 0x18], eax
jne 0x41fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46d560], eax
call edi
push eax
call esi
mov dword [0x46d568], eax
test eax, eax
je 0x41fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46d564], eax
mov eax, dword [0x46d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41fc78
cmp dword [0x46d568], ecx
je 0x41fc78
push eax
call esi
push dword [0x46d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fc78
test ebx, ebx
je 0x41fc78
call edi
test eax, eax
je 0x41fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fc6f
test byte [ebp - 8], 1
jne 0x41fc78
or dword [ebp + 0x10], 0x200000
jmp 0x41fcab
mov eax, dword [0x46d55c]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fcab
mov eax, dword [0x46d560]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46d558]
call esi
test eax, eax
je 0x41fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113cb
leave
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0xea33b52
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x6f8c0bc6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x601850
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a4000]
push edi
jmp 0x60186a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x601871
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x601860
mov eax, 1
add ebx, ebx
jne 0x601883
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x601894
jne 0x6018b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6018b3
dec eax
add ebx, ebx
jne 0x6018a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x601878
add ebx, ebx
jne 0x6018af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x601905
xor ecx, ecx
sub eax, 3
jb 0x6018cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x60193a
sar eax, 1
mov ebp, eax
jmp 0x6018d6
add ebx, ebx
jne 0x6018d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6018a4
inc ecx
add ebx, ebx
jne 0x6018e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6018a4
add ebx, ebx
jne 0x6018f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6018e6
jne 0x601902
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6018e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x601924
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x601916
jmp 0x601866
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x601924
add edi, ecx
jmp 0x601866
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x601942
cmp byte [edi], 0x11
jne 0x601942
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x601947
lea edi, [esi + 0x1fa000]
mov eax, dword [edi]
or eax, eax
je 0x6019bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x31d1b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x31d334]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x601974
mov ecx, edi
jns 0x6019a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x31d338]
or eax, eax
je 0x6019b9
mov dword [ebx], eax
add ebx, 4
jmp 0x601991
call dword [esi + 0x31d348]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6019f0
cmp al, 0xef
ja 0x6019e3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6019c5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6019d2
mov ebp, dword [esi + 0x31d33c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x601a24
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x6a4e6320
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x5d2f4a7f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401160
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c7c6
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x59df20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.004040c6
push 0
call fcn.00404c20
push 0xc
call fcn.004032ec
add esp, 8
mov dword [ebp - 0xd8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4011e9
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax + 8], 0
call fcn.0040587a
mov esi, eax
jmp 0x4011eb
xor esi, esi
push 0x54f860
mov dword [ebp - 4], 0xffffffff
call fcn.0040d5cc
push 0x57ab08
mov ecx, edi
call fcn.00410b63
push ecx
lea ecx, [ebp - 0xd4]
call fcn.00401350
push 0
push 0x66
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x1c], 0
call fcn.00415c6b
mov dword [ebp - 4], 1
mov dword [ebp - 0xd4], 0x57ade4
call fcn.004163c5
call fcn.004163c5
mov eax, dword [eax + 0xc]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xd4]
mov dword [ebp - 4], 2
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.00411299
test esi, esi
je 0x401289
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 4
call fcn.004141c8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], vtable.CBrush.0
call fcn.004017f0
lea ecx, [ebp - 0xd4]
mov dword [ebp - 4], 0xffffffff
call fcn.00410da5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00525066
mov esp, ebp
pop ebp
ret

Function at 0x4019e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x59df20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
mov ebx, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x14], 0x4e52454b
mov dword [ebp - 0x10], 0x32334c45
mov dword [ebp - 0xc], 0x6c6c642e
mov byte [ebp - 8], 0
mov dword [ebp - 0x24], 0x64616f4c
mov dword [ebp - 0x20], 0x7262694c
mov dword [ebp - 0x1c], 0x41797261
mov byte [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x401a72
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401a72
push ebx
call dword [ebp - 0x28]
test eax, eax
jne 0x401a72
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525066
mov esp, ebp
pop ebp
ret
push edi
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00525066
mov esp, ebp
pop ebp
ret
Function at 0x401a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x59df20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x3c]
push edi
mov esi, edx
mov ebx, ecx
push eax
lea edx, [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x14], 0x4e52454b
mov dword [ebp - 0x10], 0x32334c45
mov dword [ebp - 0xc], 0x6c6c642e
mov byte [ebp - 8], 0
mov dword [ebp - 0x3c], 0x50746547
mov dword [ebp - 0x38], 0x65636f72
mov dword [ebp - 0x34], 0x65487373
mov word [ebp - 0x30], 0x7061
mov byte [ebp - 0x2e], 0
call fcn.004019e0
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x2c], 0x70616548
mov dword [ebp - 0x28], 0x6c416552
mov dword [ebp - 0x24], 0x636f6c
call fcn.004019e0
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x20], 0x70616548
mov dword [ebp - 0x1c], 0x6f6c6c41
mov word [ebp - 0x18], 0x63
call fcn.004019e0
add esp, 0xc
mov dword [ebp - 0x40], eax
push esi
test ebx, ebx
je 0x401b5c
push ebx
push 0
call edi
push eax
call dword [ebp - 0x44]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525066
mov esp, ebp
pop ebp
ret
push 0
call edi
push eax
call dword [ebp - 0x40]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00525066
mov esp, ebp
pop ebp
ret

Function at 0x401b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x59df20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x30]
push edi
mov ebx, ecx
push eax
lea edx, [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x14], 0x4e52454b
mov dword [ebp - 0x10], 0x32334c45
mov dword [ebp - 0xc], 0x6c6c642e
mov byte [ebp - 8], 0
mov dword [ebp - 0x30], 0x50746547
mov dword [ebp - 0x2c], 0x65636f72
mov dword [ebp - 0x28], 0x65487373
mov word [ebp - 0x24], 0x7061
mov byte [ebp - 0x22], 0
call fcn.004019e0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x20], 0x70616548
mov dword [ebp - 0x1c], 0x65657246
mov byte [ebp - 0x18], 0
call fcn.004019e0
add esp, 8
mov esi, eax
push ebx
push 0
call edi
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00525066
mov esp, ebp
pop ebp
ret
Function at 0x401c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x59df20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov dword [ebp - 0x30], edx
push eax
lea edx, [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], 0x4e52454b
mov dword [ebp - 0x20], 0x32334c45
mov dword [ebp - 0x1c], 0x6c6c642e
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x74726956
mov dword [ebp - 0x10], 0x416c6175
mov dword [ebp - 0xc], 0x636f6c6c
mov byte [ebp - 8], 0
call fcn.004019e0
mov edx, dword [ebx]
mov edi, eax
mov eax, dword [ebx + 4]
movzx ecx, word [edx + 0x14]
mov dword [ebp - 0x2c], eax
xor eax, eax
add esp, 4
xor ebx, ebx
mov dword [ebp - 0x28], edi
cmp ax, word [edx + 6]
jae 0x401d10
push esi
lea esi, [edx + 0x28]
add esi, ecx
nop
mov eax, dword [esi]
test eax, eax
jne 0x401cd0
mov eax, dword [ebp - 0x30]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x401cfb
mov eax, dword [esi - 4]
add eax, dword [ebp - 0x2c]
push 4
push 0x1000
push edi
push eax
call dword [ebp - 0x28]
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.00526a50
jmp 0x401cf8
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, dword [ebp - 0x2c]
push eax
call edi
push dword [esi]
mov ecx, dword [esi + 4]
add ecx, 0x59fd30
mov edi, eax
push ecx
push edi
call fcn.00526e10
mov dword [esi - 8], edi
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x28]
mov eax, dword [eax]
inc ebx
movzx eax, word [eax + 6]
add esi, 0x28
cmp ebx, eax
jl 0x401ca0
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00525066
mov esp, ebp
pop ebp
ret
Function at 0x401d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x59df20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
lea eax, [ebp - 0x20]
push edi
push eax
lea edx, [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x14], 0x4e52454b
mov dword [ebp - 0x10], 0x32334c45
mov dword [ebp - 0xc], 0x6c6c642e
mov byte [ebp - 8], 0
mov dword [ebp - 0x20], 0x74726956
mov dword [ebp - 0x1c], 0x466c6175
mov dword [ebp - 0x18], 0x656572
call fcn.004019e0
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x30], 0x74726956
mov dword [ebp - 0x2c], 0x506c6175
mov dword [ebp - 0x28], 0x65746f72
mov word [ebp - 0x24], 0x7463
mov byte [ebp - 0x22], 0
call fcn.004019e0
mov edi, dword [ebx]
mov dword [ebp - 0x40], eax
movzx ecx, word [edi + 0x14]
xor eax, eax
add esp, 8
mov dword [ebp - 0x38], 0
cmp ax, word [edi + 6]
jae 0x401e58
push esi
lea esi, [edi + 0x3c]
add esi, ecx
mov ecx, dword [esi]
mov eax, ecx
mov edx, ecx
shr eax, 0x1d
shr edx, 0x1e
mov ebx, ecx
and eax, 1
and edx, 1
shr ebx, 0x1f
test ecx, 0x2000000
je 0x401df7
push 0x4000
push dword [esi - 0x14]
push dword [esi - 0x1c]
call dword [ebp - 0x44]
jmp 0x401e3c
lea eax, [edx + eax*2]
lea eax, [ebx + eax*2]
mov edx, dword [eax*4 + 0x59fd0c]
test ecx, 0x4000000
je 0x401e12
or edx, 0x200
mov ebx, dword [esi - 0x14]
mov eax, ebx
test eax, eax
jne 0x401e30
test cl, 0x40
je 0x401e25
mov eax, dword [edi + 0x20]
jmp 0x401e2c
test cl, cl
jns 0x401e3c
mov eax, dword [edi + 0x24]
test eax, eax
je 0x401e3c
lea eax, [ebp - 0x34]
push eax
push edx
push ebx
push dword [esi - 0x1c]
call dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov edi, dword [eax]
inc ecx
movzx eax, word [edi + 6]
add esi, 0x28
mov dword [ebp - 0x38], ecx
cmp ecx, eax
jl 0x401dc8
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00525066
mov esp, ebp
pop ebp
ret