joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
lea esi, [edx + 4]
mov eax, esi
push edi
mov edi, ecx
lea ecx, [ebp + 8]
cmp eax, edx
je 0x40f06b
lea ebx, [ebx]
mov bl, byte [eax - 1]
dec eax
mov byte [ecx], bl
inc ecx
cmp eax, edx
jne 0x40f060
mov edx, dword [ebp + 8]
lea eax, [esi + 4]
lea ecx, [ebp + 8]
cmp eax, esi
je 0x40f083
mov bl, byte [eax - 1]
dec eax
mov byte [ecx], bl
inc ecx
cmp eax, esi
jne 0x40f078
mov ecx, dword [edi + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, dword [edi + 0x10]
mov dword [ebp + 8], ecx
mov ecx, dword [edi + 4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + 8]
mov esi, 0xc6ef3720
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 8
lea ebx, [ebx]
mov ecx, edx
shr ecx, 5
add ecx, dword [ebp + 8]
mov edi, edx
shl edi, 4
add edi, dword [ebp - 4]
xor ecx, edi
lea edi, [esi + edx]
xor ecx, edi
sub eax, ecx
mov ecx, eax
shr ecx, 5
add ecx, dword [ebp - 8]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0xc]
xor ecx, edi
lea edi, [esi + eax]
xor ecx, edi
sub edx, ecx
mov ecx, edx
shr ecx, 5
add ecx, dword [ebp + 8]
mov edi, edx
shl edi, 4
add edi, dword [ebp - 4]
xor ecx, edi
lea edi, [esi + edx + 0x61c88647]
xor ecx, edi
sub eax, ecx
mov ecx, eax
shr ecx, 5
add ecx, dword [ebp - 8]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0xc]
xor ecx, edi
lea edi, [esi + eax + 0x61c88647]
xor ecx, edi
sub edx, ecx
mov edi, edx
shr edi, 5
add edi, dword [ebp + 8]
lea ecx, [esi + edx - 0x3c6ef372]
xor ecx, edi
mov edi, edx
shl edi, 4
add edi, dword [ebp - 4]
xor ecx, edi
sub eax, ecx
mov edi, eax
shr edi, 5
add edi, dword [ebp - 8]
lea ecx, [esi + eax - 0x3c6ef372]
xor ecx, edi
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0xc]
xor ecx, edi
sub edx, ecx
mov ecx, edx
shr ecx, 5
add ecx, dword [ebp + 8]
mov edi, edx
shl edi, 4
add edi, dword [ebp - 4]
xor ecx, edi
lea edi, [esi + edx + 0x255992d5]
xor ecx, edi
sub eax, ecx
mov ecx, eax
shr ecx, 5
add ecx, dword [ebp - 8]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0xc]
xor ecx, edi
lea edi, [esi + eax + 0x255992d5]
xor ecx, edi
sub edx, ecx
sub esi, 0x78dde6e4
dec dword [ebp - 0x10]
jne 0x40f0b0
mov dword [ebp + 8], edx
lea ecx, [ebp + 0xc]
lea esi, [ebp - 0x10]
mov dl, byte [ecx - 1]
dec ecx
mov byte [esi], dl
lea edx, [ebp + 8]
inc esi
cmp ecx, edx
jne 0x40f1a8
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esi], ecx
mov dword [ebp + 8], eax
lea eax, [ebp + 0xc]
lea ecx, [ebp + 0xc]
mov dl, byte [eax - 1]
dec eax
mov byte [ecx], dl
lea edx, [ebp + 8]
inc ecx
cmp eax, edx
jne 0x40f1c7
mov eax, dword [ebp + 0xc]
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40f2e0
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
push 0x40
lea esi, [ecx + 0x5c]
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.0040f2c0
mov byte [esi], 0x80
pop esi
ret
Function at 0x411070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x46fb40]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0x4713dc]
push edi
push 0xf0
push eax
mov edi, 1
push esi
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x411238
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x411238
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x411238
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x4110e6
mov edi, dword [ebp - 0x10c]
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x411223
mov edx, dword [esi + 4]
mov edi, eax
movzx eax, word [esi + 2]
mov ecx, 0x403
add esi, 8
mov dword [ebp - 0x114], edx
cmp cx, ax
jne 0x411176
push 3
lea edx, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], edx
call fcn.00410310
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 0x110]
push eax
mov eax, dword [edx + 4]
push 0
push 0x143
push edi
push eax
call ebx
cmp eax, 0xffffffff
jne 0x411154
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
cmp eax, ecx
je 0x4111f7
push eax
call fcn.004382b0
add esp, 4
jmp 0x4111f7
mov edx, 0x1234
cmp dx, ax
jne 0x4111f7
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x108], eax
call fcn.00410310
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x130], eax
cmp eax, ecx
je 0x4111cd
push eax
call fcn.004382b0
add esp, 4
mov ecx, dword [ebp - 0x110]
lea edx, [ebp - 0x138]
push edx
mov edx, dword [ecx + 4]
push 0
push 0x40b
push edi
push edx
call ebx
cmp eax, 0xffffffff
jne 0x4111f7
mov dword [ebp - 0x10c], 0
add esi, dword [ebp - 0x114]
cmp dword [ebp - 0x10c], 0
jne 0x4110e0
mov eax, dword [ebp - 0x10c]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438fdb
mov esp, ebp
pop ebp
ret 4
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438fdb
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00438fdb
mov esp, ebp
pop ebp
ret 4
Function at 0x416bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454668
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x46fb40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, edx
mov esi, ecx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416be4
sub eax, edi
sar eax, 1
je 0x416ca0
push edx
lea ecx, [ebp - 0x6c]
call fcn.00405720
lea ecx, [ebp - 0x38]
xor eax, eax
push ecx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], 0x630041
mov dword [ebp - 0x34], 0x650063
mov dword [ebp - 0x30], 0x740070
mov dword [ebp - 0x2c], 0x74003a
mov dword [ebp - 0x28], 0x780065
mov dword [ebp - 0x24], 0x2f0074
mov dword [ebp - 0x20], 0x740068
mov dword [ebp - 0x1c], 0x6c006d
mov dword [ebp - 0x18], 0xa000d
mov word [ebp - 0x14], ax
call fcn.00405720
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esi + 0x30]
mov byte [ebp - 4], 2
test eax, eax
je 0x416c88
mov ecx, dword [eax]
lea edx, [ebp - 0x5c]
push edx
lea edx, [ebp - 0x48]
push edx
push edx
push edx
lea edx, [ebp - 0x6c]
push edx
push eax
mov eax, dword [ecx + 0xd0]
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x48]
push ecx
call esi
lea edx, [ebp - 0x5c]
push edx
call esi
lea eax, [ebp - 0x6c]
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438fdb
mov esp, ebp
pop ebp
ret 4
Function at 0x417dd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jne 0x417de5
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push esi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0xd
push 1
push edx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.dbghelp.dll_ImageDirectoryEntryToDataEx]
mov esi, eax
cmp esi, edi
jne 0x417e10
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
push ebx
cmp eax, edi
je 0x417e3c
mov ebx, dword [ebp + 0xc]
jmp 0x417e20
cmp dword [esi], edi
jne 0x417e3c
push ebx
push eax
call fcn.004427e7
add esp, 8
test eax, eax
je 0x417e3c
mov eax, dword [esi + 0x24]
add esi, 0x20
cmp eax, edi
jne 0x417e20
cmp dword [esi + 4], edi
je 0x417e94
test byte [esi], 1
je 0x417e94
mov esi, dword [esi + 0xc]
add esi, dword [ebp + 8]
mov eax, dword [esi]
cmp eax, edi
je 0x417e94
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, edi
cmp eax, dword [ebp + 0x10]
jne 0x417e8a
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x417e8a
push 0
push 4
lea ecx, [ebp + 0x14]
push ecx
push esi
call ebx
push eax
call edi
test eax, eax
jne 0x417e9d
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x417e60
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x418140
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
jne 0x418155
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 1
push 1
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.dbghelp.dll_ImageDirectoryEntryToDataEx]
mov esi, eax
cmp esi, ebx
je 0x41820c
mov eax, dword [esi + 0xc]
cmp eax, ebx
mov ebx, dword [ebp + 0xc]
je 0x4181a1
add eax, edi
push ebx
push eax
call fcn.004427e7
add esp, 8
test eax, eax
je 0x4181a1
mov eax, dword [esi + 0x20]
add esi, 0x14
test eax, eax
jne 0x418187
cmp dword [esi + 0xc], 0
jne 0x4181c0
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push edx
push eax
push ebx
push edi
call fcn.00417dd0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 0x10]
mov eax, dword [esi + edi]
add esi, edi
test eax, eax
je 0x41820c
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, dword [ebp + 0x10]
jne 0x418202
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x418202
push 0
push 4
lea edx, [ebp + 0x14]
push edx
push esi
call ebx
push eax
call edi
test eax, eax
jne 0x418215
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x4181d8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4182a0
Capabilities:
Allocate or change rwx memory
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00439260
push ebx
xor ebx, ebx
push 0xffc
lea eax, [ebp - 0x1014]
push ebx
push eax
mov dword [ebp - 0x1018], ebx
call fcn.00438810
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0xc]
push ecx
push 0x1000
lea edx, [ebp - 0x1018]
push edx
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4183da
xor eax, eax
test dword [ebp - 0xc], 0xfffffffc
mov dword [ebp - 4], eax
jbe 0x4183da
push esi
push edi
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + eax*4 - 0x1018]
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], ebx
je 0x4183c3
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
push 1
push 1
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.dbghelp.dll_ImageDirectoryEntryToDataEx]
mov esi, eax
cmp esi, ebx
je 0x4183c3
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x418360
mov ecx, dword [ebp + 8]
push ecx
add eax, edi
push eax
call fcn.004427e7
add esp, 8
test eax, eax
je 0x418360
mov eax, dword [esi + 0x20]
add esi, 0x14
cmp eax, ebx
jne 0x418343
cmp dword [esi + 0xc], ebx
jne 0x41837c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
push edi
call fcn.00417dd0
add esp, 0x10
jmp 0x4183c3
mov esi, dword [esi + 0x10]
mov eax, dword [esi + edi]
add esi, edi
cmp eax, ebx
je 0x4183c3
cmp eax, dword [ebp + 0xc]
jne 0x4183b9
lea edx, [ebp - 0x18]
push edx
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4183b9
push ebx
push 4
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4183c3
mov eax, dword [esi + 4]
add esi, 4
cmp eax, ebx
jne 0x418388
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc eax
shr ecx, 2
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x418303
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4185b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4549a1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x46fb40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [0x46fa80]
mov edx, dword [eax + 0xc]
mov ecx, 0x46fa80
mov dword [ebp - 4], ebx
call edx
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.00426d10
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
push ecx
push edx
push 0x45aed0
push esi
mov dword [ebp - 4], 1
call fcn.004089fc
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418647
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c200
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [eax + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 0xc], ecx
push edx
mov ecx, edi
call fcn.00417450
test eax, eax
jne 0x41c23c
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp dword [0x4712e8], 0
jne 0x41c268
mov eax, dword [edi + 0x2c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x2c]
push 0
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
mov ecx, edi
call fcn.00416290
jmp 0x41c274
mov edx, dword [edi + 0x2c]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x45a83a
lea ecx, [edi + 0x54]
call fcn.00412000
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x60]
cmp ecx, eax
je 0x41c2ac
mov edx, dword [ebp + 8]
push edx
push ecx
push eax
push eax
call fcn.0040a440
mov ebx, eax
mov eax, dword [edi + 0x64]
add esp, 0x10
push eax
push ebx
lea ecx, [edi + 0x60]
call fcn.0040aaf0
mov dword [edi + 0x64], ebx
cmp dword [ebp + 0x10], 0
je 0x41c2be
push str.about:blank_first
mov ecx, edi
call fcn.00416bb0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc
Function at 0x41ea40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x455130
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x46fb40]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
push 0x17
push ebx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
mov dword [ebp - 0x24], 0x6d78734d
mov dword [ebp - 0x20], 0x582e326c
mov dword [ebp - 0x1c], 0x54484c4d
mov word [ebp - 0x18], 0x5054
mov byte [ebp - 0x16], bl
call fcn.0041e750
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x41eae3
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x41eac3
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00438fdb
mov esp, ebp
pop ebp
ret 4
push eax
lea ecx, [ebp - 0x34]
call fcn.0041e2e0
push 0x470958
push 0x470958
mov ecx, 0x45
push 0x470958
push ecx
mov ecx, dword [ebp - 0x34]
mov eax, esp
mov dword [ebp - 0x2c], 0x450047
mov dword [ebp - 0x28], 0x54
mov dword [eax], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], esp
cmp eax, ebx
je 0x41eb2a
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ecx
lea edx, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x3c], esp
push edx
mov byte [ebp - 4], 3
call fcn.0041e2e0
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], 4
cmp ecx, ebx
jne 0x41eb52
push 0x80004003
call fcn.004481d0
mov byte [ebp - 4], 2
call fcn.0041e8b0
mov ecx, dword [ebp - 0x30]
cmp ecx, ebx
jne 0x41eb6c
push 0x80004003
call fcn.004481d0
mov edi, dword [0x470958]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], edi
mov edi, dword [0x47095c]
mov dword [eax + 4], edi
mov edi, dword [0x470960]
mov dword [eax + 8], edi
mov edi, dword [0x470964]
mov dword [eax + 0xc], edi
mov eax, dword [edx + 0x2c]
push ecx
mov esi, ecx
call eax
cmp eax, ebx
jge 0x41ebae
push 0x45b858
push esi
push eax
call fcn.004481f0
mov esi, dword [ebp - 0x34]
cmp esi, ebx
je 0x41ebf0
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x41ebed
cmp esi, ebx
je 0x41ebed
mov eax, dword [esi]
cmp eax, ebx
je 0x41ebd4
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x41ebe4
push eax
call fcn.004381e4
add esp, 4
push esi
call fcn.00438188
add esp, 4
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x41ec02
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, 1
jmp 0x41eac5
Function at 0x41f0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4551f0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x46fb40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ecx, ecx
mov word [ebp - 0x20], cx
mov word [ebp - 0x38], cx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], 0x61002e
mov dword [ebp - 0x30], 0x65006c
mov dword [ebp - 0x2c], 0x610078
mov dword [ebp - 0x28], 0x63002e
mov dword [ebp - 0x24], 0x6d006f
mov dword [ebp - 0x54], 0x61002e
mov dword [ebp - 0x50], 0x61006d
mov dword [ebp - 0x4c], 0x6f007a
mov dword [ebp - 0x48], 0x61006e
mov dword [ebp - 0x44], 0x730077
mov dword [ebp - 0x40], 0x63002e
mov dword [ebp - 0x3c], 0x6d006f
mov eax, dword [ecx - 0xc]
or esi, 0xffffffff
mov dword [ebp - 4], 1
test eax, eax
js 0x41f17b
lea edx, [ebp - 0x34]
push edx
push ecx
call fcn.004388a5
mov ecx, dword [ebp + 0xc]
add esp, 8
test eax, eax
je 0x41f17b
sub eax, ecx
sar eax, 1
cmp eax, esi
jne 0x41f22f
cmp dword [ecx - 0xc], 0
jl 0x41f19f
lea eax, [ebp - 0x54]
push eax
push ecx
call fcn.004388a5
add esp, 8
test eax, eax
je 0x41f19f
sub eax, dword [ebp + 0xc]
sar eax, 1
cmp eax, esi
jne 0x41f22f
lea ecx, [ebp + 8]
call fcn.0041dc80
push eax
lea ecx, [ebp + 8]
call fcn.00408960
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x1c], 0x650074
mov dword [ebp - 0x18], 0x740078
mov word [ebp - 0x14], dx
cmp dword [ecx - 0xc], edx
jl 0x41f1ed
lea eax, [ebp - 0x1c]
push eax
push ecx
call fcn.004388a5
mov ecx, dword [ebp + 8]
add esp, 8
test eax, eax
je 0x41f1ed
sub eax, ecx
sar eax, 1
cmp eax, esi
je 0x41f1ed
lea eax, [ecx - 0x10]
jmp 0x41f235
lea eax, [ecx - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f20c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [ebp - 4], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x41f22b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x41f275
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov edx, esi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f251
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov dword [ebp - 4], esi
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x41f270
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438fdb
mov esp, ebp
pop ebp
ret 8
Function at 0x41fcf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x46fb40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x30], 0x740068
mov dword [ebp - 0x2c], 0x700074
mov dword [ebp - 0x28], 0x2f003a
mov dword [ebp - 0x24], 0x77002f
mov dword [ebp - 0x20], 0x770077
mov dword [ebp - 0x1c], 0x62002e
mov dword [ebp - 0x18], 0x690061
mov dword [ebp - 0x14], 0x750064
mov dword [ebp - 0x10], 0x63002e
mov dword [ebp - 0xc], 0x6d006f
mov dword [ebp - 8], 0x2f
mov dword [ebp - 0x64], 0x740068
mov dword [ebp - 0x60], 0x700074
mov dword [ebp - 0x5c], 0x2f003a
mov dword [ebp - 0x58], 0x77002f
mov dword [ebp - 0x54], 0x770077
mov dword [ebp - 0x50], 0x67002e
mov dword [ebp - 0x4c], 0x6f006f
mov dword [ebp - 0x48], 0x6c0067
mov dword [ebp - 0x44], 0x2e0065
mov dword [ebp - 0x40], 0x6f0063
mov dword [ebp - 0x3c], 0x2e006d
mov dword [ebp - 0x38], 0x6b0068
mov dword [ebp - 0x34], 0x2f
call fcn.0043bd2a
cdq
mov ecx, 0x64
idiv ecx
cmp edx, 0x3c
jae 0x41fdcb
lea edx, [ebp - 0x30]
push edx
jmp 0x41fde7
cmp edx, 0x55
jae 0x41fdd6
lea eax, [ebp - 0x64]
push eax
jmp 0x41fde7
cmp edx, 0x5a
jae 0x41fde2
push str.about:blank
jmp 0x41fde7
push 0x4599e8
mov ecx, esi
call fcn.00408e6f
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00438fdb
mov esp, ebp
pop ebp
ret 4
Function at 0x424410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x46fb40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebx + 0x124]
call fcn.004488b0
mov ecx, edi
mov esi, eax
call fcn.004488b0
cmp eax, esi
jne 0x424569
mov ecx, edi
call fcn.00448e90
mov esi, dword [ebx - 0x20]
xor eax, eax
lea ecx, [ebp - 0x38]
push eax
mov edx, ecx
push edx
push eax
push esi
mov dword [ebp - 0x38], 0x6e0049
mov dword [ebp - 0x34], 0x650074
mov dword [ebp - 0x30], 0x6e0072
mov dword [ebp - 0x2c], 0x740065
mov dword [ebp - 0x28], 0x450020
mov dword [ebp - 0x24], 0x700078
mov dword [ebp - 0x20], 0x6f006c
mov dword [ebp - 0x1c], 0x650072
mov dword [ebp - 0x18], 0x5f0072
mov dword [ebp - 0x14], 0x650053
mov dword [ebp - 0x10], 0x760072
mov dword [ebp - 0xc], 0x720065
mov word [ebp - 8], ax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], eax
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x4244c6
mov dword [ebp - 0x4c], eax
jmp 0x4244d9
lea eax, [ebp - 0x50]
push eax
push 0x419e00
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
push ecx
push eax
mov dword [ebp - 0x54], eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x48]
cmp edx, 0xa
jle 0x424538
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x44]
cmp eax, 0xa
jle 0x424538
call fcn.0043bd2a
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x48]
cdq
idiv ecx
mov esi, edx
call fcn.0043bd2a
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x44]
cdq
idiv ecx
mov ecx, dword [ebp - 0x54]
movzx eax, si
movzx edx, dx
shl edx, 0x10
or edx, eax
push edx
push 0
push 0x200
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0043bd2a
mov esi, eax
and esi, reloc.DSOUND.dll_DirectSoundCreate
jns 0x42454c
dec esi
or esi, 0xfffffffe
inc esi
imul esi, esi, 0x3e8
call fcn.0043bd2a
cdq
mov ecx, 0x3e8
idiv ecx
mov ecx, edi
add edx, esi
push edx
call fcn.00448f50
push edi
mov ecx, ebx
call fcn.0041d740
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438fdb
mov esp, ebp
pop ebp
ret 4