joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474b10
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4ad6dc
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4cd4a4]
xor eax, esp
mov dword [esp + 0x130], eax
push esi
push edi
mov eax, dword [0x4cd4a4]
xor eax, esp
push eax
lea eax, [esp + 0x140]
mov dword fs:[0], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftOffice10.0WordInstallRoot
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
call esi
test eax, eax
je 0x474bb0
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftOffice11.0WordInstallRoot
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x474bb0
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftOffice12.0WordInstallRoot
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x474bb0
push 0
push 0x14
mov ecx, edi
call fcn.004742e0
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x3c]
push ecx
push 0
push 0
push str.Path
push edx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.WinWord.exe
lea ecx, [esp + 0x20]
call sub.jfutility.dll_public:_void___thiscall_jfString::constructor_char_const__
mov esi, eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14c], 0
call sub.jfutility.dll_public:_void___thiscall_jfString::constructor_wchar_t_const__
push esi
push eax
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x154], 1
call sub.jfutility.dll_class_jfString___cdecl_operator_class_jfString_const___class_jfString_const__
add esp, 0xc
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x14c], 2
call sub.jfutility.dll_public:_void___thiscall_jfFileId::constructor_class_jfString_const__
cmp dword [esp + 0x28], 0
mov byte [esp + 0x148], 4
je 0x474c4b
lea ecx, [esp + 0x24]
call sub.jfutility.dll_private:_void___thiscall_jfString::ReleaseData_void_
cmp dword [esp + 0x18], 0
mov byte [esp + 0x148], 5
je 0x474c63
lea ecx, [esp + 0x14]
call sub.jfutility.dll_private:_void___thiscall_jfString::ReleaseData_void_
cmp dword [esp + 0x20], 0
mov byte [esp + 0x148], 6
je 0x474c7b
lea ecx, [esp + 0x1c]
call sub.jfutility.dll_private:_void___thiscall_jfString::ReleaseData_void_
lea ecx, [esp + 0x2c]
call sub.jfutility.dll_public:_void___thiscall_jfFileId::AbsoluteName_void_
lea ecx, [esp + 0x2c]
call sub.jfutility.dll_public:_int___thiscall_jfFileId::Exists_void_const
test eax, eax
jne 0x474c9b
push eax
push 0x14
mov ecx, edi
call fcn.004742e0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x148], 0xffffffff
call sub.jfutility.dll_public:_void___thiscall_jfFileId::destructor_void_
mov ecx, dword [esp + 0x140]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.0049ec62
add esp, 0x140
ret
Function at 0x47e650
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4aeba3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4cd4a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi], 3
fldz
fst qword [esi + 0x18]
push 0x4b3e2b
lea ecx, [esi + 0x28]
fstp qword [esi + 0x20]
mov dword [esp + 0x1c], ebx
mov byte [esi + 9], 1
mov byte [esi + 0xa], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call sub.jfutility.dll_public:_void___thiscall_jfString::constructor_char_const__
fldz
lea ecx, [esi + 0x38]
fstp qword [esi + 0x30]
mov byte [esp + 0x18], 1
call fcn.0047e520
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xcc], 3
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x496830
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b1ddb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4cd4a4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x28]
mov dword [esi], vtable.shape_info.0
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], 3
fldz
fst dword [esi + 8]
mov dword [esp + 0x14], eax
fst dword [esi + 4]
mov byte [esi + 0xc], al
fst dword [esi + 0x20]
mov dword [esi + 0x38], eax
fst dword [esi + 0x1c]
mov byte [esi + 0x10], al
fst dword [esi + 0x18]
mov dword [esi + 0x34], eax
fst dword [esi + 0x14]
mov dword [esi + 0x30], eax
fstp dword [esi + 0x24]
call sub.jfutility.dll_public:_void___thiscall_jfString::Empty_void_
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x5c9d5b12
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4cc462e5
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x43b652
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
pop edx
add ecx, 1
inc edi
add edi, 0xbd7d3b7c
call fcn.0043b6a0
sub ecx, edi
mov edi, 0x68adfb16
sub ecx, 0x7ea1d033
xor dword [esi], edx
or edi, edi
add edi, 0x9b1935e8
inc esi
and ecx, ecx
mov edi, edi
cmp esi, eax
jne fcn.0043b652
or ecx, ecx
or ecx, ecx
ret
Function at 0x42210b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42214a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42214a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42214a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42214a
cmp dword [ecx + 0x74], 0xe
jbe 0x42214a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x40344b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x409310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004023a4
and dword [ebp - 0x14], 0
cmp dword [0x40a41c], 0
mov dword [ebp - 0x18], eax
jne 0x4034fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4035a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4035a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40a41c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40a420], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40a424], eax
call edi
push eax
call esi
mov dword [0x40a42c], eax
test eax, eax
je 0x4034fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40a428], eax
mov eax, dword [0x40a428]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403557
cmp dword [0x40a42c], ecx
je 0x403557
push eax
call esi
push dword [0x40a42c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403557
test ebx, ebx
je 0x403557
call edi
test eax, eax
je 0x40354e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40354e
test byte [ebp - 8], 1
jne 0x403557
or dword [ebp + 0x10], 0x200000
jmp 0x40358a
mov eax, dword [0x40a420]
cmp eax, dword [ebp - 0x18]
je 0x40358a
push eax
call esi
test eax, eax
je 0x40358a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40358a
mov eax, dword [0x40a424]
cmp eax, dword [ebp - 0x18]
je 0x40358a
push eax
call esi
test eax, eax
je 0x40358a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40a41c]
call esi
test eax, eax
je 0x4035a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4035a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004037b6
leave
ret

Function at 0x4037b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409310]
jne 0x4037c0
repz ret
jmp fcn.00404a26

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5b9730
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], 0x610075
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], str.hJP
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x405d0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x405d0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x405cf0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5b9730
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460f8d
mov esp, ebp
pop ebp
ret
Function at 0x41b3d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5b99b4
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], 0x610075
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], str.hJP
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x41b46e
movzx ecx, word [esi + eax]
test cx, cx
je 0x41b46e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41b450
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5b99b4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460f8d
mov esp, ebp
pop ebp
ret

Function at 0x41b4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x4b0048
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5b98c4
mov dword [ebp - 0x34], 0x590045
mov dword [ebp - 0x30], 0x50005f
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x520045
sub esi, eax
mov dword [ebp - 0x28], 0x4f0046
mov dword [ebp - 0x24], 0x4d0052
mov dword [ebp - 0x20], 0x4e0041
mov dword [ebp - 0x1c], 0x450043
mov dword [ebp - 0x18], 0x4e005f
mov dword [ebp - 0x14], 0x53004c
mov dword [ebp - 0x10], 0x450054
mov dword [ebp - 0xc], 0x540058
nop word [eax + eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x41b53e
movzx ecx, word [esi + eax]
test cx, cx
je 0x41b53e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41b520
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5b98c4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460f8d
mov esp, ebp
pop ebp
ret

Function at 0x41b560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5b986c
mov dword [ebp - 0x28], 0x4b0048
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x590045
mov dword [ebp - 0x20], 0x43005f
mov edx, 0x13
mov dword [ebp - 0x1c], 0x41004c
sub esi, eax
mov dword [ebp - 0x18], 0x530053
mov dword [ebp - 0x14], 0x530045
mov dword [ebp - 0x10], 0x52005f
mov dword [ebp - 0xc], 0x4f004f
mov dword [ebp - 8], 0x54
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x41b5de
movzx ecx, word [esi + eax]
test cx, cx
je 0x41b5de
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41b5c0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5b986c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460f8d
mov esp, ebp
pop ebp
ret
Function at 0x428bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5b99fc
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], 0x610075
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], str.hJP
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x428c8e
movzx ecx, word [esi + eax]
test cx, cx
je 0x428c8e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x428c70
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5b99fc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460f8d
mov esp, ebp
pop ebp
ret
Function at 0x42c800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5b9a8c
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], 0x610075
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], str.hJP
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x42c89e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42c89e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x42c880
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5b9a8c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460f8d
mov esp, ebp
pop ebp
ret
Function at 0x432380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5b9ac8
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], 0x610075
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], str.hJP
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x43241e
movzx ecx, word [esi + eax]
test cx, cx
je 0x43241e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x432400
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5b9ac8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460f8d
mov esp, ebp
pop ebp
ret

Function at 0x4338e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
push 0x569de8
lea ecx, [esi + 0x30]
call fcn.0047fdc0
test eax, eax
je 0x433911
mov edx, dword [eax]
mov ecx, eax
push 0
call dword [edx + 0x10c]
push str.restore
lea ecx, [esi + 0x30]
call fcn.0047fdc0
test eax, eax
je 0x43392e
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x10c]
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x28
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x433957
movups xmm0, xmmword [ebp - 0x18]
movups xmmword [ebp - 0x3c], xmm0
push 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x3c]
sub eax, edx
push 0
push eax
mov eax, dword [ebp - 0x34]
sub eax, ecx
push eax
push edx
push ecx
push 0xfffffffffffffffe
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00460f8d
mov esp, ebp
pop ebp
ret
Function at 0x43b430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5b9b10
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], 0x610075
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], str.hJP
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x43b4ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x43b4ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x43b4b0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5b9b10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460f8d
mov esp, ebp
pop ebp
ret

Function at 0x43beb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5b228c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5b9b4c
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], 0x610075
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], str.hJP
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x43bf4e
movzx ecx, word [esi + eax]
test cx, cx
je 0x43bf4e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x43bf30
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5b9b4c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460f8d
mov esp, ebp
pop ebp
ret