joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4086a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x3c
push eax
call fcn.0041fca7
add esp, 4
cmp eax, 0x1000
ja 0x40881c
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x7dc]
test ecx, ecx
je 0x40881b
push ebx
push edi
lea edi, [eax + eax]
lea ebx, [ecx + 0xac14]
mov ecx, dword [ebp + 0xc]
push edi
push ebx
push ecx
call fcn.0041fcc7
add esp, 0xc
test eax, eax
jne 0x408819
mov edx, dword [ebp + 0xc]
push edi
push edx
push ebx
call fcn.0041faa7
add esp, 0xc
xor ecx, ecx
xor eax, eax
push 0x104
mov word [ebp - 4], cx
mov ecx, dword [esi + 0x3fbc]
lea ebx, [esi + 0x3fc8]
push ebx
mov dword [ebp - 0xc], 0xa000d
mov dword [ebp - 8], 0xa000d
mov dword [ebp - 0x3c], 0x6c0043
mov dword [ebp - 0x38], 0x700069
mov dword [ebp - 0x34], 0x6f0062
mov dword [ebp - 0x30], 0x720061
mov dword [ebp - 0x2c], 0x64
mov word [ebp - 0x28], ax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov word [ebp - 0x1e], ax
call ecx
mov edx, dword [esi + 0x1e68]
push eax
call edx
cmp eax, 0x40
jbe 0x408779
xor eax, eax
mov word [esi + 0x4048], ax
jmp 0x4087a8
test eax, eax
jne 0x4087a8
push 0x10
lea eax, [ebp - 0x1c]
push eax
push ebx
mov dword [ebp - 0x1c], 0x6e0055
mov dword [ebp - 0x18], 0x6e006b
mov dword [ebp - 0x14], 0x77006f
mov dword [ebp - 0x10], 0x6e
call fcn.0041faa7
add esp, 0xc
push 0x14
lea ecx, [ebp - 0x3c]
push ecx
lea edi, [esi + 0x4d2c]
push edi
call fcn.0041faa7
push 0
lea edx, [ebp - 0xc]
push edx
push edi
call fcn.0041fe17
push 0
push ebx
push edi
call fcn.0041fe17
push 0
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.0041fe17
mov ecx, dword [ebp + 0xc]
push 0
push ecx
push edi
call fcn.0041fe17
push edi
call fcn.0041fca7
add esp, 0x40
add eax, eax
push edi
mov dword [esi + 0xa0c], eax
call fcn.0041fca7
mov edx, dword [esi + 0xa08]
add eax, eax
push eax
push edi
push edx
call fcn.0041faa7
push 0x13
push esi
call fcn.0040f147
add esp, 0x18
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b357
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor ecx, ecx
mov edi, 0x100
nop
mov eax, ecx
shl eax, 0x18
mov esi, 8
lea ebx, [ebx]
test eax, eax
jns 0x40b384
add eax, eax
xor eax, 0x4c11db7
jmp 0x40b386
add eax, eax
dec esi
jne 0x40b377
mov dword [edx], eax
inc ecx
add edx, 4
dec edi
jne 0x40b367
pop edi
pop esi
pop ebp
ret

Function at 0x40b397
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push 0x3fc
lea eax, [ebp - 0x3fc]
push 0
push eax
mov dword [ebp - 0x400], 0
call fcn.0041fb27
lea ecx, [ebp - 0x400]
push ecx
call fcn.0040b357
mov esi, dword [ebp + 0xc]
add esp, 0x10
or eax, 0xffffffff
test esi, esi
je 0x40b3fa
mov edx, dword [ebp + 8]
push edi
movzx edi, byte [edx]
mov ecx, eax
shr ecx, 0x18
xor ecx, edi
and ecx, 0xff
shl eax, 8
xor eax, dword [ebp + ecx*4 - 0x400]
inc edx
dec esi
jne 0x40b3db
pop edi
not eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b407
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
pop ebp
ret
Function at 0x40c027
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov edx, ecx
sub edx, eax
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x106], cl
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x40c039
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [ebp + eax - 0x208]
movzx edx, byte [ebp + eax - 0x106]
add ecx, esi
lea esi, [ecx + edx]
and esi, 0x800000ff
jns 0x40c09c
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + eax - 0x106]
mov dl, byte [ebp + esi - 0x106]
mov byte [ebp + eax - 0x106], dl
inc eax
mov byte [ebp + esi - 0x106], cl
cmp eax, 0x100
jl 0x40c077
xor eax, eax
xor cl, cl
mov byte [ebp - 0x107], 0
cmp dword [ebp + 0xc], eax
jbe 0x40c148
mov edi, dword [ebp + 8]
push ebx
jmp 0x40c0dd
mov cl, byte [ebp - 0x108]
mov dl, byte [eax + edi]
inc cl
mov byte [ebp - 0x108], cl
movzx esi, cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, byte [ebp - 0x107]
add ecx, ebx
mov byte [ebp - 0x107], cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x106]
mov byte [ebp - 1], bl
movzx ebx, byte [ecx]
mov byte [ebp + esi - 0x106], bl
movzx ebx, byte [ebp - 1]
mov byte [ecx], bl
movzx ebx, byte [ebp + esi - 0x106]
add bl, byte [ecx]
inc eax
movzx ecx, bl
mov cl, byte [ebp + ecx - 0x106]
xor cl, dl
mov byte [eax + edi - 1], cl
cmp eax, dword [ebp + 0xc]
jb 0x40c0d7
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411297
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
xor eax, eax
push ebx
push esi
push 0x5f
push eax
mov dword [ebp - 0x29], eax
mov dword [ebp - 0x25], eax
mov byte [ebp - 0x21], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 8], al
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov byte [ebp - 0x110], al
lea eax, [ebp - 0x10f]
push eax
mov dword [ebp - 0x30], 0x656d616e
mov word [ebp - 0x2c], 0x203a
mov byte [ebp - 0x2a], 0
mov dword [ebp - 0x20], 0x756c6176
mov dword [ebp - 0x1c], 0x203a65
mov dword [ebp - 0x10], 0x65746164
mov dword [ebp - 0xc], 0x656d6974
mov dword [ebp - 0x130], 0x454c4553
mov dword [ebp - 0x12c], 0x6e205443
mov dword [ebp - 0x128], 0x2c656d61
mov dword [ebp - 0x124], 0x6c617620
mov dword [ebp - 0x120], 0x46206575
mov dword [ebp - 0x11c], 0x204d4f52
mov dword [ebp - 0x118], 0x6f747561
mov dword [ebp - 0x114], 0x6c6c6966
call fcn.0041fb27
push 0x27
lea ecx, [ebp - 0x57]
push 0
push ecx
mov dword [ebp - 0xb0], 0x454c4553
mov dword [ebp - 0xac], 0x68205443
mov dword [ebp - 0xa8], 0x5f74736f
mov dword [ebp - 0xa4], 0x2c79656b
mov dword [ebp - 0xa0], 0x74617020
mov dword [ebp - 0x9c], 0x69202c68
mov dword [ebp - 0x98], 0x65735f73
mov dword [ebp - 0x94], 0x65727563
mov dword [ebp - 0x90], 0x7865202c
mov dword [ebp - 0x8c], 0x65726970
mov dword [ebp - 0x88], 0x74755f73
mov dword [ebp - 0x84], 0x6e202c63
mov dword [ebp - 0x80], 0x2c656d61
mov dword [ebp - 0x7c], 0x6c617620
mov dword [ebp - 0x78], 0x202c6575
mov dword [ebp - 0x74], 0x72636e65
mov dword [ebp - 0x70], 0x65747079
mov dword [ebp - 0x6c], 0x61765f64
mov dword [ebp - 0x68], 0x2065756c
mov dword [ebp - 0x64], 0x4d4f5246
mov dword [ebp - 0x60], 0x6f6f6320
mov dword [ebp - 0x5c], 0x7365696b
mov byte [ebp - 0x58], 0
call fcn.0041fb27
lea edx, [ebp - 0x30]
push edx
call fcn.0041fc87
mov esi, dword [ebp + 0xc]
inc eax
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0xac]
push ecx
call fcn.0041faa7
lea edx, [ebp - 0x20]
push edx
call fcn.0041fc87
inc eax
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0xbc]
push ecx
call fcn.0041faa7
lea edx, [ebp - 0x10]
push edx
call fcn.0041fc87
inc eax
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0xcc]
push ecx
call fcn.0041faa7
lea edx, [ebp - 0xb0]
add esp, 0x48
push edx
call fcn.0041fc87
inc eax
push eax
lea eax, [ebp - 0xb0]
push eax
lea ecx, [esi + 0x1dc]
push ecx
call fcn.0041faa7
lea edx, [ebp - 0x130]
push edx
call fcn.0041fc87
inc eax
push eax
lea eax, [ebp - 0x130]
push eax
add esi, 0x25c
push esi
call fcn.0041faa7
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411547
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x400
push esi
call fcn.0041fad7
mov edi, dword [ebp + 0x14]
xor eax, eax
push edi
mov word [ebp - 8], 9
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x10], 0x45555254
mov byte [ebp - 0xc], al
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
mov dword [ebp - 0x18], 0x534c4146
mov dword [ebp - 0x14], 0x45
call fcn.0041fc87
push eax
push edi
push esi
call fcn.0041faa7
push 0
lea ecx, [ebp - 8]
push ecx
push esi
call fcn.0041fdb7
push 0
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0041fdb7
push 0
lea eax, [ebp - 8]
push eax
push esi
call fcn.0041fdb7
mov ecx, dword [ebp + 0x18]
push 0
push ecx
push esi
call fcn.0041fdb7
add esp, 0x48
push 0
lea edx, [ebp - 8]
push edx
push esi
call fcn.0041fdb7
mov eax, dword [ebp + 0x1c]
add esp, 0xc
cmp byte [eax], 0x30
push 0
jne 0x4115ee
lea ecx, [ebp - 0x18]
push ecx
jmp 0x4115f2
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0041fdb7
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push esi
call fcn.0041fdb7
mov ecx, dword [ebp + 0x20]
push 0
push ecx
push esi
call fcn.0041fdb7
push 0
lea edx, [ebp - 8]
push edx
push esi
call fcn.0041fdb7
mov eax, dword [ebp + 0x24]
push 0
push eax
push esi
call fcn.0041fdb7
push 0
lea ecx, [ebp - 8]
push ecx
push esi
call fcn.0041fdb7
mov edi, dword [ebp + 8]
push 0xb
push 0
push 0
push esi
push edi
call fcn.00414c07
mov edx, dword [ebp + 0x30]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x10]
add esp, 0x50
push 0xb
push edx
mov edx, dword [ecx + 0x3c4]
push eax
push edx
push esi
push edi
call fcn.00414d97
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4121d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push esi
push edi
push 0xadedab08
call fcn.0041f2a7
mov edi, dword [ebp + 8]
xor ecx, ecx
push 0x36
push ecx
lea edx, [ebp - 0x4a]
mov esi, eax
push edx
mov dword [edi + 0xa18], esi
mov dword [ebp - 0x54], 0x410050
mov dword [ebp - 0x50], 0x480054
mov word [ebp - 0x4c], cx
call fcn.0041fb27
xor edx, edx
add esp, 0x10
mov dword [ebp - 0x14], 0x690046
mov dword [ebp - 0x10], 0x650072
mov dword [ebp - 0xc], 0x6f0066
mov dword [ebp - 8], 0x5c0078
mov word [ebp - 4], dx
test esi, esi
jne 0x412248
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
xor eax, esi
push 0x1000
push edi
mov dword [edi + 0xa18], eax
call fcn.0041fb67
push 0x7378
push edi
mov dword [edi + 0xa08], eax
call fcn.0041fb67
mov esi, eax
add esp, 0x10
test esi, esi
je 0x412240
cmp dword [edi + 0xa08], 0
je 0x412240
push ebx
push 0x3f
lea ecx, [ebp - 0x93]
push 0
push ecx
mov byte [ebp - 0x94], 0
call fcn.0041fb27
lea edx, [ebp - 0x94]
push 0
push edx
call fcn.00420617
lea ecx, [ebp - 0x94]
lea eax, [edi + 0x20]
push ecx
push eax
lea ebx, [esi + 0xc]
call fcn.0040c307
mov edx, dword [esi]
push edx
push ebx
push edi
mov dword [ebx], eax
call fcn.0041b787
add esp, 0x28
cmp dword [esi + 0x10], 0
je 0x4123f9
cmp dword [esi + 0x14], 0
je 0x4123f9
cmp dword [esi + 0x18], 0
je 0x4123f9
cmp dword [esi + 0x1c], 0
je 0x4123f9
cmp dword [esi + 0x20], 0
je 0x4123f9
cmp dword [esi + 0x24], 0
je 0x4123f9
cmp dword [esi + 0x28], 0
je 0x4123f9
cmp dword [esi + 0x2c], 0
je 0x4123f9
cmp dword [esi + 0x34], 0
je 0x4123f9
cmp dword [esi + 0x38], 0
je 0x4123f9
push 0x3f
lea eax, [ebp - 0xd3]
push 0
push eax
mov byte [ebp - 0xd4], 0
call fcn.0041fb27
lea ecx, [ebp - 0xd4]
push 6
push ecx
call fcn.00420617
lea edx, [ebp - 0xd4]
push edx
lea ebx, [edi + 0x20]
push ebx
call fcn.0040c307
add esp, 0x1c
test eax, eax
je 0x4123f9
push 0x2430512b
push 0
push 0
push eax
push ebx
call fcn.00418a77
add esp, 0x14
mov dword [esi + 0x48], eax
test eax, eax
je 0x4123f9
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x412393
mov dword [esi + 4], eax
jmp 0x41239a
mov dword [esi + 4], 0x20
push 8
lea eax, [ebp - 0x54]
push eax
lea ecx, [esi + 0x4c]
push ecx
mov dword [esi], 0x32
call fcn.0041faa7
lea ebx, [edi + 0x3b10]
push ebx
call fcn.0041fca7
add eax, eax
push eax
lea edx, [edi + 0x8f4]
push ebx
push edx
call fcn.0041faa7
push esi
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.00413367
push esi
push edi
call fcn.0041fa87
mov ecx, dword [edi + 0xa08]
push ecx
push edi
call fcn.0041fa87
add esp, 0x38
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412407
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x2be]
push ecx
mov word [ebp - 0x2c0], ax
call fcn.0041fb27
xor eax, eax
push 0x36
push eax
lea ecx, [ebp - 0xb6]
push ecx
mov dword [ebp - 0xc0], 0x65002e
mov dword [ebp - 0xbc], 0x650078
mov word [ebp - 0xb8], ax
call fcn.0041fb27
xor ecx, ecx
push 0x2e
push ecx
lea edx, [ebp - 0x6e]
push edx
mov dword [ebp - 0x80], 0x460020
mov dword [ebp - 0x7c], 0x720069
mov dword [ebp - 0x78], 0x660065
mov dword [ebp - 0x74], 0x78006f
mov word [ebp - 0x70], cx
call fcn.0041fb27
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push 5
lea edx, [ebp - 0x2c0]
push edx
push esi
mov dword [ebp - 0x40], 0x720050
mov dword [ebp - 0x3c], 0x67006f
mov dword [ebp - 0x38], 0x610072
mov dword [ebp - 0x34], 0x20006d
mov dword [ebp - 0x30], 0x690046
mov dword [ebp - 0x2c], 0x65006c
mov dword [ebp - 0x28], 0x73
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.0040c657
add esp, 0x34
push 1
lea eax, [ebp - 0x2c0]
push 0x13
push eax
call fcn.0041fca7
add esp, 4
lea ecx, [ebp + eax*2 - 0x2c0]
push ecx
push esi
call fcn.0040c657
push 0
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.0041fe17
push 0
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x2c0]
mov ecx, 0x5c
push eax
mov word [ebp - 0x80], cx
call fcn.0041fe17
push 0
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call fcn.0041fe17
push 0
push 0x15
lea eax, [ebp - 0x2c0]
push eax
push esi
call fcn.00418667
add esp, 0x44
test eax, eax
jne 0x412624
lea ecx, [ebp - 0x2ba]
push 0x80
push ecx
call fcn.0041fad7
lea eax, [ebp - 0x40]
mov edx, 0x20
push eax
mov word [ebp - 0x80], dx
call fcn.0041fca7
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x2ba]
push eax
call fcn.0041faa7
add esp, 0x18
push 1
lea ecx, [ebp - 0x2c0]
push 0x13
push ecx
call fcn.0041fca7
add esp, 4
lea edx, [ebp + eax*2 - 0x2c0]
push edx
push esi
call fcn.0040c657
push 0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.0041fe17
push 0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x2c0]
mov edx, 0x5c
push ecx
mov word [ebp - 0x80], dx
call fcn.0041fe17
push 0
lea edx, [ebp - 0xc0]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.0041fe17
push 0
push 0x15
lea ecx, [ebp - 0x2c0]
push ecx
push esi
call fcn.00418667
add esp, 0x44
test eax, eax
jne 0x412624
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41264c
lea edx, [ebp - 0x2c0]
push edx
call fcn.0041fca7
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
push esi
call fcn.0041faa7
add esp, 0x10
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4135e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
push edi
xor ecx, ecx
push 0x36
push ecx
lea edx, [ebp - 0x66]
push edx
mov dword [ebp - 0x70], 0x410050
mov dword [ebp - 0x6c], 0x480054
mov word [ebp - 0x68], cx
call fcn.0041fb27
mov edi, dword [ebp + 8]
xor edx, edx
xor eax, eax
push 0x7378
push edi
mov dword [ebp - 0x14], 0x690046
mov dword [ebp - 0x10], 0x650072
mov dword [ebp - 0xc], 0x6f0066
mov dword [ebp - 8], 0x5c0078
mov word [ebp - 4], dx
mov dword [ebp - 0x30], 0x680054
mov dword [ebp - 0x2c], 0x6e0075
mov dword [ebp - 0x28], 0x650064
mov dword [ebp - 0x24], 0x620072
mov dword [ebp - 0x20], 0x720069
mov dword [ebp - 0x1c], 0x5c0064
mov word [ebp - 0x18], ax
call fcn.0041fb67
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x41367e
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 8
lea ecx, [ebp - 0x70]
push ecx
lea ebx, [esi + 0x4c]
push ebx
mov dword [esi], 0x32
call fcn.0041faa7
push 0
lea edx, [ebp - 0x14]
push edx
push esi
push edi
call fcn.00412a47
add esp, 0x1c
test eax, eax
je 0x4136c4
push esi
push edi
call fcn.00412d57
add esp, 8
test eax, eax
je 0x4136c4
push esi
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.00413367
add esp, 0xc
cmp dword [esi + 0xc], 0
je 0x4136e2
push 0x16
push esi
push edi
call fcn.004152c7
push 0x1024
push esi
push edi
call fcn.004152c7
add esp, 0x18
cmp dword [esi + 8], 0
je 0x4136fc
lea ecx, [esi + 0x286c]
push ecx
lea edx, [ebp - 0x70]
push edx
push edi
call fcn.0040c457
add esp, 0xc
push 0x7378
push esi
call fcn.0041fad7
push 8
lea eax, [ebp - 0x70]
push eax
push ebx
mov dword [esi], 0x64
call fcn.0041faa7
push 0
lea ecx, [ebp - 0x30]
push ecx
push esi
push edi
call fcn.00412a47
add esp, 0x24
pop ebx
test eax, eax
je 0x41374a
push esi
push edi
call fcn.00412d57
add esp, 8
test eax, eax
je 0x41374a
push esi
lea edx, [ebp - 0x30]
push edx
push edi
call fcn.00413367
add esp, 0xc
cmp dword [esi + 0xc], 0
je 0x413768
push 0x16
push esi
push edi
call fcn.004152c7
push 0x1024
push esi
push edi
call fcn.004152c7
add esp, 0x18
cmp dword [esi + 8], 0
je 0x413782
lea eax, [esi + 0x286c]
push eax
lea ecx, [ebp - 0x70]
push ecx
push edi
call fcn.0040c457
add esp, 0xc
push esi
push edi
call fcn.0041fa87
add esp, 8
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414a07
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push esi
push edi
mov eax, 0x4f
mov word [ebp - 0x70], ax
mov eax, 0x70
mov word [ebp - 0x6e], ax
mov eax, 0x65
mov word [ebp - 0x6c], ax
mov eax, 0x72
mov word [ebp - 0x6a], ax
mov eax, 0x61
mov word [ebp - 0x68], ax
xor eax, eax
mov word [ebp - 0x66], ax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov eax, 0x43
mov word [ebp - 0x50], ax
mov eax, 0x68
mov word [ebp - 0x4e], ax
mov eax, 0x72
mov word [ebp - 0x4c], ax
mov eax, 0x6f
mov word [ebp - 0x4a], ax
mov eax, 0x6d
xor ecx, ecx
mov word [ebp - 0x48], ax
push 0x3f
mov eax, 0x65
push ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x46], ax
xor eax, eax
xor edx, edx
lea ecx, [ebp - 0xaf]
push ecx
mov word [ebp - 4], 0xa0d
mov byte [ebp - 2], 0
mov word [ebp - 0x44], ax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov word [ebp - 0x32], ax
mov dword [ebp - 0xc], 0x52550a0d
mov dword [ebp - 8], 0x203a4c
mov dword [ebp - 0x30], 0x2d005c
mov dword [ebp - 0x2c], 0x310030
mov dword [ebp - 0x28], 0x310030
mov dword [ebp - 0x24], 0x2d0032
mov dword [ebp - 0x20], 0x33
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov byte [ebp - 0xb0], al
call fcn.0041fb27
lea edx, [ebp - 0xb0]
push 6
push edx
call fcn.00420617
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xb0]
push eax
lea ecx, [edi + 0x20]
push ecx
call fcn.0040c307
mov esi, dword [ebp + 0xc]
add esp, 0x1c
mov dword [esi + 0x350], eax
test eax, eax
jne 0x414b37
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
call fcn.0041fc87
inc eax
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.0041faa7
lea ecx, [ebp - 0xc]
push ecx
call fcn.0041fc87
inc eax
push eax
lea edx, [ebp - 0xc]
push edx
lea eax, [esi + 0x10]
push eax
call fcn.0041faa7
lea ecx, [ebp - 0x30]
push ecx
call fcn.0041fca7
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0x20]
push ecx
call fcn.0041faa7
mov eax, dword [ebp + 0x10]
add esp, 0x30
cmp eax, 0x16
jne 0x414ba2
lea edx, [ebp - 0x50]
push edx
call fcn.0041fca7
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [esi + 0x40]
push edx
jmp 0x414bbf
cmp eax, 0x1024
jne 0x414bc7
lea eax, [ebp - 0x70]
push eax
call fcn.0041fca7
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x70]
push edx
lea eax, [esi + 0x40]
push eax
call fcn.0041faa7
add esp, 0x10
push 4
push 0x15
lea ecx, [esi + 0x60]
push ecx
push edi
call fcn.0040c5c7
push 4
push 0x14
lea edx, [esi + 0x80]
push edx
push edi
call fcn.0040c5c7
push 4
push 0x24
add esi, 0xd0
push esi
push edi
call fcn.0040c5c7
add esp, 0x30
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414c07
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
xor edx, edx
push 0x3a
push edx
lea eax, [ebp - 0x7a]
push eax
mov edi, 3
mov dword [ebp - 0x80], 0xa000d
mov word [ebp - 0x7c], dx
call fcn.0041fb27
mov eax, dword [ebp + 0x18]
add esp, 0xc
cmp eax, 0x1024
jne 0x414c45
mov edi, 5
jmp 0x414c73
cmp eax, 8
jne 0x414c4f
lea edi, [eax + 1]
jmp 0x414c73
cmp eax, 0x32
jne 0x414c59
lea edi, [eax - 0x2e]
jmp 0x414c73
cmp eax, 0x64
jne 0x414c63
lea edi, [eax - 0x5d]
jmp 0x414c73
cmp eax, 0xb
jne 0x414c6c
mov edi, eax
jmp 0x414c73
cmp eax, 0xa
jne 0x414c73
mov edi, eax
xor eax, eax
mov dword [ebp - 0x40], 0x520020
mov dword [ebp - 0x3c], 0x630065
mov dword [ebp - 0x38], 0x76006f
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0xd0079
mov dword [ebp - 0x2c], 0xa
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], eax
je 0x414d52
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x414d52
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0xa08]
push 6
lea ecx, [ebp - 0x80]
push ecx
push edx
call fcn.0041faa7
mov eax, dword [esi + 0xa08]
push 0
push ebx
push eax
call fcn.0041fe17
lea ecx, [ebp - 0x40]
push ecx
call fcn.0041fca7
mov ecx, dword [esi + 0xa08]
add esp, 0x1c
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x40]
push eax
push ecx
call fcn.0041fca7
mov edx, dword [esi + 0xa08]
lea eax, [edx + eax*2]
add esp, 4
push eax
call fcn.0041faa7
mov ecx, dword [esi + 0xa08]
push ecx
call fcn.0041fca7
add eax, eax
push edi
push esi
mov dword [esi + 0xa0c], eax
call fcn.0040f147
add esp, 0x18
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x414d87
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0xa08]
push eax
push edx
call fcn.004200a7
mov eax, dword [esi + 0xa08]
push eax
call fcn.0041fca7
add eax, eax
push edi
push esi
mov dword [esi + 0xa0c], eax
call fcn.0040f147
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret