joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420470
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5fc920
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
lea ecx, [esp + 0x1c]
movdqu xmm0, xmmword [esi + 4]
lea eax, [esi + 0x14]
push eax
movdqu xmmword [edi + 4], xmm0
call fcn.00407790
push eax
lea ecx, [edi + 0x14]
mov dword [esp + 0x18], 0
call fcn.00409ad0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00404e10
lea eax, [esi + 0x18]
push eax
lea ecx, [esp + 0x20]
call fcn.00407790
push eax
lea ecx, [edi + 0x18]
mov dword [esp + 0x18], 1
call fcn.00409ad0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00404e10
lea eax, [esi + 0x1c]
push eax
lea ecx, [esp + 0x20]
call fcn.00407790
push eax
lea ecx, [edi + 0x1c]
mov dword [esp + 0x18], 2
call fcn.00409ad0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00404e10
lea eax, [esi + 0x20]
push eax
lea ecx, [esp + 0x20]
call fcn.00407790
push eax
lea ecx, [edi + 0x20]
mov dword [esp + 0x18], 3
call fcn.00409ad0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00404e10
lea eax, [esi + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.00407790
push eax
lea ecx, [edi + 0x24]
mov dword [esp + 0x18], 4
call fcn.00409ad0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00404e10
lea eax, [esi + 0x28]
push eax
lea ecx, [esp + 0x20]
call fcn.00407790
push eax
lea ecx, [edi + 0x28]
mov dword [esp + 0x18], 5
call fcn.00409ad0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00404e10
lea eax, [esi + 0x2c]
push eax
lea ecx, [esp + 0x20]
call fcn.00407790
push eax
lea ecx, [edi + 0x2c]
mov dword [esp + 0x18], 6
call fcn.00409ad0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00404e10
lea eax, [esi + 0x30]
push eax
lea ecx, [esp + 0x20]
call fcn.00407790
push eax
lea ecx, [edi + 0x30]
mov dword [esp + 0x18], 7
call fcn.00409ad0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00404e10
lea eax, [esi + 0x34]
push eax
lea ecx, [esp + 0x20]
call fcn.00407790
push eax
lea ecx, [edi + 0x34]
mov dword [esp + 0x18], 8
call fcn.00409ad0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00404e10
lea eax, [esi + 0x38]
push eax
lea ecx, [esp + 0xc]
call fcn.00407790
push eax
lea ecx, [edi + 0x38]
mov dword [esp + 0x18], 9
call fcn.00409ad0
lea ecx, [esp + 8]
call fcn.00404e10
mov al, byte [esi]
mov ecx, dword [esp + 0xc]
mov byte [edi], al
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x421020
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi]
test ecx, ecx
je 0x42104b
mov edx, 0x3e8
mov byte [esi + 4], 0
call fcn.0048d7c0
test eax, eax
je 0x421045
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi], 0
pop esi
ret
Function at 0x421320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
xor eax, eax
mov dword [esp + 0x46], 0x420074
push edi
mov word [esp + 0x54], ax
mov edi, 0x65
lea eax, [esp + 0x34]
mov dword [esp + 0x50], 0x740061
push eax
mov ebp, 0x72
mov dword [esp + 0x46], 0x650048
push ecx
mov esi, ecx
mov dword [esp + 0x3c], 0x650053
mov dword [esp + 0x46], 0x650063
mov dword [esp + 0x42], 0x690076
mov word [esp + 0x40], bp
mov dword [esp + 0x4e], 0x720061
mov word [esp + 0x56], di
call fcn.00421050
test eax, eax
je 0x42141b
mov eax, 0x77
mov dword [esp + 0x30], 0x62
mov word [esp + 0x1c], ax
lea edx, [esp + 0x14]
mov eax, 0x41
mov dword [esp + 0x14], 0x6f0053
mov ecx, SysReAllocString
mov dword [esp + 0x28], 0x430050
mov dword [esp + 0x1e], 0x720061
mov dword [esp + 0x18], 0x740066
mov dword [esp + 0x2c], 0x610054
mov dword [esp + 0x22], 0x5c0065
mov word [esp + 0x26], ax
call fcn.0048c940
mov ecx, 0x6b4960
mov edi, 0x659110
call fcn.0043e700
test al, al
mov edx, 0x659118
cmovne edx, edi
sub esp, 0xc
mov ecx, esp
push 0
push 0x651e48
push edx
call fcn.00420bf0
mov ecx, esi
call fcn.00420d00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x421c30
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5fcc28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, ecx
lea ecx, [esp + 0xc]
push edi
mov edi, edx
call fcn.00404ef0
mov dword [esp + 0x2c], 0
movzx eax, word [ebx]
test ax, ax
je 0x421ea2
mov ebp, 0x7ff
jmp 0x421c80
cmp ax, 0x24
je 0x421de8
cmp ax, 0x26
je 0x421de8
cmp ax, 0x2b
je 0x421de8
cmp ax, 0x2c
je 0x421de8
cmp ax, 0x2f
je 0x421de8
cmp ax, 0x3a
je 0x421de8
cmp ax, 0x3b
je 0x421de8
cmp ax, 0x3d
je 0x421de8
cmp ax, 0x3f
je 0x421de8
cmp ax, 0x40
je 0x421de8
cmp ax, 0x23
je 0x421de8
cmp ax, 0x20
je 0x421de8
cmp ax, 0x7f
jbe 0x421dda
cmp ax, bp
movzx eax, ax
ja 0x421d39
or eax, 0x3000
shr eax, 6
push eax
push 0x65915c
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push 4
push eax
call fcn.005d7066
add esp, 0x14
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
call fcn.00404df0
jmp 0x421d9b
shr eax, 0xc
or eax, 0xe0
push eax
push 0x65915c
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push 4
push eax
call fcn.005d7066
add esp, 0x14
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
call fcn.00404df0
movzx eax, word [ebx]
and eax, 0xfc0
or eax, 0x2000
shr eax, 6
push eax
push 0x65915c
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push 4
push eax
call fcn.005d7066
add esp, 0x14
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
call fcn.00424110
movzx eax, word [ebx]
and eax, 0x3f
or eax, 0x80
push eax
push 0x65915c
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push 4
push eax
call fcn.005d7066
add esp, 0x14
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
call fcn.00424110
lea ecx, [esp + 0x10]
call fcn.00409800
mov esi, eax
test esi, esi
jne 0x421e57
mov ax, word [ebx]
mov word [edi], ax
add edi, 2
jmp 0x421e92
movzx eax, ax
push eax
push 0x65915c
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push 4
push eax
call fcn.005d7066
lea ecx, [esp + 0x2c]
add esp, 0x14
xor esi, esi
lea edx, [ecx + 2]
jmp 0x421e10
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421e10
sub ecx, edx
sar ecx, 1
je 0x421e53
movzx eax, word [esp + esi*2 + 0x18]
push eax
call fcn.005d71e5
mov word [esp + esi*2 + 0x1c], ax
add esp, 4
lea eax, [esp + 0x18]
inc esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421e40
sub eax, edx
sar eax, 1
cmp esi, eax
jb 0x421e21
lea esi, [esp + 0x18]
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421e60
sub ecx, edx
sar ecx, 1
push esi
lea eax, [ecx + 1]
push eax
push edi
call fcn.005d55ea
add esp, 0xc
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x421e80
sub esi, ecx
sar esi, 1
lea edi, [edi + esi*2]
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x421c80
xor eax, eax
lea ecx, [esp + 0x10]
mov word [edi], ax
call fcn.00404e10
mov ecx, dword [esp + 0x24]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425420
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5fd3a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push dword [esp + 0x18]
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00407630
push dword [esp + 0x1c]
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], 0
call fcn.00407630
push dword [esp + 0x20]
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.00407630
mov ecx, dword [esp + 8]
mov eax, esi
mov dword [esi + 0x48], 0
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x42c220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5fe1a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x651e48
mov dword [esp + 0xa0], esi
call fcn.00407630
lea ecx, [esi + 0x18]
mov dword [esp + 0xa8], 0
call fcn.00408180
mov byte [esp + 0xa8], 1
mov eax, 0x30
mov word [esp + 0x7e], ax
mov edx, 0x20
mov eax, 0x57
mov word [esp + 0x38], dx
mov word [esp + 0x4a], ax
mov edx, 0x6b
mov eax, 0x61
mov dword [esp + 0x68], 0x2e0037
mov word [esp + 0x1c], ax
mov ebp, 0x20
lea eax, [esp + 0x10]
mov dword [esp + 0x22], 0x30002e
push eax
mov ecx, esi
mov dword [esp + 0x58], 0x20003b
mov dword [esp + 0x2c], 0x570028
mov dword [esp + 0x68], 0x2f0074
mov dword [esp + 0x5c], 0x720054
mov dword [esp + 0x7a], 0x31003a
mov dword [esp + 0x8e], 0x200065
mov dword [esp + 0x60], 0x640069
mov dword [esp + 0x3e], 0x54004e
mov dword [esp + 0x4a], 0x20003b
mov dword [esp + 0x46], 0x31002e
mov dword [esp + 0x42], 0x360020
mov dword [esp + 0x70], 0x3b0030
mov dword [esp + 0x88], 0x69006c
mov dword [esp + 0x50], 0x57004f
mov dword [esp + 0x64], 0x6e0065
mov dword [esp + 0x7e], 0x2e0031
mov dword [esp + 0x30], 0x6e0069
mov dword [esp + 0x38], 0x730077
mov dword [esp + 0x92], 0x650047
mov dword [esp + 0x34], 0x6f0064
mov dword [esp + 0x96], 0x6b0063
mov dword [esp + 0x84], 0x200029
mov dword [esp + 0x18], 0x69007a
mov dword [esp + 0x76], 0x760072
mov dword [esp + 0x9a], 0x6f
mov dword [esp + 0x22], 0x35002f
mov dword [esp + 0x14], 0x6f004d
mov word [esp + 0x74], bp
mov dword [esp + 0x54], 0x340036
mov word [esp + 0x8c], dx
mov word [esp + 0x2a], bp
mov dword [esp + 0x1c], 0x6c006c
call fcn.00410a40
mov ecx, dword [esp + 0xa0]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x9c
ret
Function at 0x42c410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fe1c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x450
push ebx
push esi
push edi
sub esp, 0xc
mov eax, ecx
mov dword [ebp - 0x30], eax
xor bl, bl
call fcn.004108f0
xor edx, edx
mov ecx, eax
call fcn.00488e60
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x34], esi
test esi, esi
je 0x42c617
lea ecx, [ebp - 0x10]
call fcn.00404ef0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push dword [ebp + 0xc]
mov edx, 0x2f
mov dword [ebp - 0x28], 0x700074
push dword [ebp + 8]
mov dword [ebp - 0x1e], 0x25002f
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x24], 0x3a0073
push eax
mov dword [ebp - 0x2c], 0x740068
mov dword [ebp - 0x16], 0x73
mov word [ebp - 0x20], dx
mov dword [ebp - 0x1a], 0x250073
call fcn.00404860
lea ecx, [ebp - 0x10]
call fcn.00404880
mov edx, eax
mov ecx, esi
call fcn.00488de0
add esp, 0x10
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x42c608
push 0x651e48
lea ecx, [ebp + 8]
call fcn.00404720
mov byte [ebp - 4], 1
call fcn.004099a0
push 0x400
mov dword [ebp - 0x38], eax
xor edi, edi
call fcn.005d4b4d
push 0x400
mov esi, eax
lea eax, [ebp - 0x458]
push edi
push eax
call fcn.005d9ee0
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp + 0xc]
push eax
push 0x400
lea edx, [ebp - 0x458]
mov ecx, ebx
call fcn.00488d60
add esp, 0x18
test eax, eax
je 0x42c57d
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42c57d
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [esi + edi]
push eax
call fcn.005dc7f0
add edi, dword [ebp + 0xc]
lea eax, [edi + 0x400]
push eax
push esi
call fcn.005d4bdf
mov esi, eax
push 0x400
push 0
lea eax, [esi + edi]
push eax
call fcn.005d9ee0
lea eax, [ebp + 0xc]
mov ecx, ebx
push eax
push 0x400
lea edx, [ebp - 0x458]
call fcn.00488d60
add esp, 0x28
test eax, eax
jne 0x42c526
test esi, esi
je 0x42c59a
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c586
sub ecx, edx
lea edi, [ecx + 1]
cmp edi, 0x3fffffff
jle 0x42c59e
xor eax, eax
jmp 0x42c5b3
lea eax, [edi + edi]
call fcn.005dcf20
mov eax, esp
push dword [ebp - 0x38]
push edi
push esi
push eax
call fcn.004098c0
push eax
lea eax, [ebp + 8]
push 0x657524
push eax
call fcn.00409980
push esi
call fcn.005d4b15
add esp, 0x10
mov ecx, ebx
call fcn.00488f60
lea ecx, [ebp + 8]
call fcn.00404880
push eax
lea ecx, [ebp - 0x54]
call fcn.00407630
mov ecx, dword [ebp - 0x30]
push eax
add ecx, 0x18
call fcn.00410860
lea ecx, [ebp - 0x54]
call fcn.00406f10
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
mov bl, 1
call fcn.00404e10
mov esi, dword [ebp - 0x34]
mov ecx, esi
call fcn.00488f60
lea ecx, [ebp - 0x10]
call fcn.00404e10
mov al, bl
lea esp, [ebp - 0x468]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x434de0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5fea68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x4c]
call fcn.00420a60
push dword [esp + 0x54]
lea ecx, [esp + 0x24]
push dword [esp + 0x54]
call fcn.00434d40
add esp, 0x20
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00434c70
lea ecx, [esp + 8]
call fcn.004093c0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], 0x65a7a0
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret 0xc

Function at 0x436d30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fec26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x10]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 0
call fcn.00437730
mov dword [esp + 0x10], 0
lea ecx, [esi + 0x34]
mov byte [esi + 0x24], 0
push 0x651e48
mov byte [esi + 0x25], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x30], 0
call fcn.00407630
mov ecx, esi
mov byte [esp + 0x10], 1
call fcn.00437160
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x437180
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x34]
mov ecx, ebx
call fcn.00437720
test al, al
je 0x4371bb
mov ecx, esi
call fcn.00437160
xor edi, edi
cmp byte [esi + 0x30], 0
je 0x4371bb
mov ecx, 0xc8
call fcn.0048a950
cmp edi, 0x14
jg 0x4371bb
inc edi
cmp byte [esi + 0x30], 0
jne 0x4371a5
mov eax, 0x53
mov dword [esp + 0x2c], 0x6c
mov word [esp + 0x18], ax
mov edx, 0x6c
mov eax, 0x72
mov dword [esp + 0x1a], 0x610063
mov word [esp + 0x24], ax
mov ecx, 0x6e
mov word [esp + 0x15], ax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x24], 0x65006e
mov dword [esp + 0x2a], 0x64002e
mov word [esp + 0x22], cx
mov word [esp + 0x2e], dx
mov word [esp + 0x16], 0x6e6e
mov dword [esp + 0x10], 0x53746547
mov word [esp + 0x14], 0x6163
mov byte [esp + 0x18], 0x65
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [esp + 0xc]
mov dword [esi + 0x28], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43729d
call eax
mov ecx, eax
mov dword [esi], ecx
test ecx, ecx
je 0x43729d
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov ecx, dword [ecx + 0xc]
mov dword [esi + 8], ecx
test eax, eax
je 0x437297
test ecx, ecx
je 0x437297
push esi
push 0
push 0x437560
mov byte [esi + 0xc], 1
call fcn.005d76d6
add esp, 0xc
push dword [esp + 0x34]
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00406ec0
mov eax, dword [esi]
mov eax, dword [eax + 0x18]
call eax
add esp, 0x1c
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
mov dword [esi], 0
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x24
ret 4
Function at 0x437c40
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], 0x65ac08
push eax
call fcn.005d9ee0
add esp, 0xc
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret

Function at 0x439340
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5fee8a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x24], ebx
lea ecx, [ebx + 0x10]
call fcn.00408180
lea ecx, [ebx + 0x28]
mov dword [esp + 0x238], 0
call fcn.00408180
lea ecx, [ebx + 0x44]
mov byte [esp + 0x238], 1
call fcn.00439e30
mov byte [esp + 0x238], 2
lea ecx, [ebx + 0x10]
push 0x651e48
mov dword [ebx + 0xc], 0
call fcn.0040fc20
push 0x651e48
lea ecx, [ebx + 0x28]
call fcn.0040fc20
xor eax, eax
mov dword [ebx + 0x40], 0xffffffff
push 0x206
push eax
mov word [esp + 0x30], ax
lea eax, [esp + 0x32]
push eax
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.005d9ee0
push 0x104
lea edx, [esp + 0x38]
call fcn.0048a6d0
lea eax, [esp + 0x38]
add esp, 0x10
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x439410
sub eax, edx
lea ecx, [esp + 0x28]
sar eax, 1
dec eax
cmp word [ecx + eax*2], 0x5c
lea ecx, [ecx + eax*2]
je 0x439446
mov edi, edi
xor edx, edx
lea eax, [eax - 1]
mov word [ecx], dx
lea ecx, [esp + 0x28]
cmp word [ecx + eax*2], 0x5c
lea ecx, [ecx + eax*2]
jne 0x439430
mov eax, 0x6e
mov dword [esp + 0xc], 0x61006c
mov ecx, 0x61
mov word [esp + 0x10], ax
mov word [esp + 0x16], cx
lea edx, [esp + 0xc]
mov eax, 0x73
mov dword [esp + 0x18], 0x650067
lea ecx, [esp + 0x28]
mov dword [esp + 0x12], 0x750067
mov dword [esp + 0x1e], 0x5c
mov word [esp + 0x1c], ax
call fcn.0048e440
lea eax, [esp + 0x28]
mov ecx, ebx
push eax
call fcn.00439c80
mov ecx, ebx
call fcn.00439710
push 0
mov ecx, ebx
call fcn.00439cb0
mov ecx, dword [esp + 0x230]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x43c5d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
xor eax, eax
mov dword [esp + 0x24], 0x64002e
push esi
mov word [esp + 0x30], ax
mov esi, edx
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x65004b
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x6c0065
push eax
mov dword [esp + 0x34], 0x6c006c
mov dword [esp + 0x2c], 0x320033
mov dword [esp + 0x24], 0x6e0072
mov word [esp + 0x1a], 0x6d61
mov dword [esp + 0xf], 0x75646f4d
mov word [esp + 0x14], 0x4665
mov word [esp + 0xd], 0x7465
mov word [esp + 0x1d], 0x57
mov word [esp + 0x17], 0x656c
mov byte [esp + 0x19], 0x4e
mov byte [esp + 0xc], 0x47
mov byte [esp + 0x13], 0x6c
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x1c], 0x65
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43c67b
push 0x104
push esi
push 0
call eax
pop esi
add esp, 0x30
ret
xor eax, eax
pop esi
add esp, 0x30
ret

Function at 0x43c690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5ff062
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x25c], 0
push 0x651e48
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], 0
call fcn.00404720
xor eax, eax
mov dword [esp + 0x25c], 0
push 0x206
push eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push eax
mov dword [esp + 0x50], 1
call fcn.005d9ee0
add esp, 8
lea edx, [esp + 0x50]
call fcn.0043c5d0
xor eax, eax
mov dword [esp + 0x3a], 0x690070
mov word [esp + 0x46], ax
add esp, 4
mov eax, 0x61
mov dword [esp + 0x3e], 0x6c006c
mov word [esp + 0x34], ax
lea eax, [esp + 0x2c]
mov dword [esp + 0x3a], 0x64002e
push eax
mov dword [esp + 0x34], 0x77006c
mov dword [esp + 0x30], 0x680053
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x43c7d9
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x68746150
push eax
push edi
mov word [esp + 0x23], 0x5765
mov byte [esp + 0x25], 0
mov dword [esp + 0x18], 0x646e6946
mov dword [esp + 0x1e], 0x614e656c
mov byte [esp + 0x22], 0x6d
mov word [esp + 0x1c], 0x6946
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43c7d2
lea ecx, [esp + 0x4c]
push ecx
call eax
push eax
mov ecx, esi
call fcn.00404df0
mov eax, 0x78
mov dword [esp + 0x20], 0x65002e
mov word [esp + 0x24], ax
mov ecx, esi
push 0x651e48
lea eax, [esp + 0x24]
mov dword [esp + 0x2a], 0x65
push eax
call fcn.004095d0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x254]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x254
ret
Function at 0x43d0f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
xor eax, eax
mov dword [esp + 0x24], 0x64002e
push esi
mov word [esp + 0x30], ax
mov esi, edx
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x65004b
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x6c0065
push eax
mov dword [esp + 0x34], 0x6c006c
mov dword [esp + 0x2c], 0x320033
mov dword [esp + 0x24], 0x6e0072
mov word [esp + 0x1a], 0x6d61
mov dword [esp + 0xf], 0x75646f4d
mov word [esp + 0x14], 0x4665
mov word [esp + 0xd], 0x7465
mov word [esp + 0x1d], 0x57
mov word [esp + 0x17], 0x656c
mov byte [esp + 0x19], 0x4e
mov byte [esp + 0xc], 0x47
mov byte [esp + 0x13], 0x6c
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x1c], 0x65
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43d19b
push 0x104
push esi
push 0
call eax
pop esi
add esp, 0x30
ret
xor eax, eax
pop esi
add esp, 0x30
ret

Function at 0x43d1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5ff2e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x25c], 0
push 0x651e48
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], 0
call fcn.00404720
xor eax, eax
mov dword [esp + 0x25c], 0
push 0x206
push eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push eax
mov dword [esp + 0x50], 1
call fcn.005d9ee0
add esp, 8
lea edx, [esp + 0x50]
call fcn.0043d0f0
xor eax, eax
mov dword [esp + 0x3a], 0x690070
mov word [esp + 0x46], ax
add esp, 4
mov eax, 0x61
mov dword [esp + 0x3e], 0x6c006c
mov word [esp + 0x34], ax
lea eax, [esp + 0x2c]
mov dword [esp + 0x3a], 0x64002e
push eax
mov dword [esp + 0x34], 0x77006c
mov dword [esp + 0x30], 0x680053
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x43d2f9
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x68746150
push eax
push edi
mov word [esp + 0x23], 0x5765
mov byte [esp + 0x25], 0
mov dword [esp + 0x18], 0x646e6946
mov dword [esp + 0x1e], 0x614e656c
mov byte [esp + 0x22], 0x6d
mov word [esp + 0x1c], 0x6946
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43d2f2
lea ecx, [esp + 0x4c]
push ecx
call eax
push eax
mov ecx, esi
call fcn.00404df0
mov eax, 0x78
mov dword [esp + 0x20], 0x65002e
mov word [esp + 0x24], ax
mov ecx, esi
push 0x651e48
lea eax, [esp + 0x24]
mov dword [esp + 0x2a], 0x65
push eax
call fcn.004095d0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x254]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x254
ret