joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410dc3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ae66
and dword [ebp - 0x14], 0
cmp dword [0x4307b0], 0
mov dword [ebp - 0x18], eax
jne 0x410e76
push 0x4038cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410f1e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4038c0
push ebx
call edi
test eax, eax
je 0x410f1e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4038b0
push ebx
mov dword [0x4307b0], eax
call edi
push eax
call esi
push 0x40389c
push ebx
mov dword [0x4307b4], eax
call edi
push eax
call esi
push 0x403880
push ebx
mov dword [0x4307b8], eax
call edi
push eax
call esi
mov dword [0x4307c0], eax
test eax, eax
je 0x410e76
push 0x403868
push ebx
call edi
push eax
call esi
mov dword [0x4307bc], eax
mov eax, dword [0x4307bc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410ecf
cmp dword [0x4307c0], ecx
je 0x410ecf
push eax
call esi
push dword [0x4307c0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410ecf
test ebx, ebx
je 0x410ecf
call edi
test eax, eax
je 0x410ec6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x410ec6
test byte [ebp - 8], 1
jne 0x410ecf
or dword [ebp + 0x10], 0x200000
jmp 0x410f02
mov eax, dword [0x4307b4]
cmp eax, dword [ebp - 0x18]
je 0x410f02
push eax
call esi
test eax, eax
je 0x410f02
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410f02
mov eax, dword [0x4307b8]
cmp eax, dword [ebp - 0x18]
je 0x410f02
push eax
call esi
test eax, eax
je 0x410f02
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4307b0]
call esi
test eax, eax
je 0x410f1e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410f20
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408aa1
leave
ret
Function at 0x413540
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.00411930
cmp dword [0x7b454c], 0x37
jne 0x4135da
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x7b5540]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x43559c]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x413860
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b454c]
sub esp, 0x974
push ebx
push ebp
push esi
mov esi, dword [0x43559c]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x413a5f
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
jmp 0x413896
mov esi, dword [esp + 0x20]
xor edi, edi
cmp dword [0x7b454c], 0x1c
jne 0x4138ad
lea eax, [esp + 0x38]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x42c418]
mov ebx, dword [0x42c420]
mov ebp, dword [0x42c424]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x42c41c]
mov dword [esp + 0x18], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0x20
jmp 0x4138f6
mov eax, dword [esp + 0x18]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x1c], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0x7b44bc], edi
mov eax, dword [esp + 0x1c]
add dword [0x7b44bc], eax
mov eax, dword [0x7b44bc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
cmp dword [0x7b454c], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x41398d
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x7b454c], 0x979
mov dword [0x7b44c0], 0xff6b3619
mov dword [0x7b44c4], 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x4139d7
push 0
lea ecx, [esp + 0x184]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x1c]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
mov eax, dword [0x7b454c]
cmp eax, 0x93
je 0x4139fd
add esi, 0x61c88647
dec dword [esp + 0x28]
jne 0x4138f0
cmp eax, 0x8d4
jne 0x413a14
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0x7b454c], 0x17
jne 0x413a4e
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x40]
push edx
push 0x404070
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x20], esi
jne 0x413890
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x974
ret
Function at 0x405ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov dword [ebp - 0x30], 0x750051
mov dword [ebp - 0x2c], 0x630069
mov dword [ebp - 0x28], 0x53006b
mov dword [ebp - 0x24], 0x650065
mov dword [ebp - 0x20], 0x75005c
mov dword [ebp - 0x1c], 0x650073
mov dword [ebp - 0x18], 0x5f0072
mov dword [ebp - 0x14], 0x730061
mov dword [ebp - 0x10], 0x6f0073
mov dword [ebp - 0xc], 0x2e0063
mov dword [ebp - 8], 0x6e0069
mov dword [ebp - 4], 0x69
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x405f86
mov eax, dword [ecx]
push 2
push 0x17
call dword [eax]
test eax, eax
je 0x405f90
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x17
jl 0x405f7c
mov dword [eax - 0xc], 0x17
xor eax, eax
mov ecx, dword [esi]
push 0x2e
mov word [ecx + 0x2e], ax
lea eax, [ebp - 0x30]
push eax
push 0x2e
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3
Function at 0x407410
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50989b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x553418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x55953c]
mov esi, dword [ebp + 8]
test eax, eax
jne 0x4075cd
push 0x515a24
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x55953c], eax
test eax, eax
jne 0x4075cd
push eax
push 0x104
lea ecx, [ebp - 0x230]
call fcn.00405020
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
push eax
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, eax
test ecx, ecx
jne 0x4074cc
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
call fcn.004055f0
jmp 0x4075b2
mov eax, dword [ebp - 0x220]
cmp ecx, eax
ja 0x4074f8
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov dword [ebp - 0x220], ecx
cmovae eax, dword [ebp - 0x230]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x407508
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x230]
call fcn.00409770
movups xmm0, xmmword [ebp - 0x230]
xor eax, eax
lea ecx, [ebp - 0x230]
mov word [ebp - 0x230], ax
movups xmmword [ebp - 0x248], xmm0
movq xmm0, qword [ebp - 0x220]
movq qword [ebp - 0x238], xmm0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
call fcn.004055f0
cmp dword [ebp - 0x238], 0
jbe 0x4075b2
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d2e90
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x515a24
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x55953c], eax
lea ecx, [ebp - 0x248]
call fcn.004055f0
mov eax, dword [0x55953c]
test eax, eax
jne 0x4075cd
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e3a9
mov esp, ebp
pop ebp
ret
Function at 0x40a550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 0x20], 0x6e0049
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6c0061
mov dword [ebp - 0x14], 0x4c006c
mov dword [ebp - 0x10], 0x63006f
mov dword [ebp - 0xc], 0x740061
mov dword [ebp - 8], 0x6f0069
mov dword [ebp - 4], 0x6e
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x40a5ea
mov eax, dword [ecx]
push 2
push 0xf
call dword [eax]
test eax, eax
je 0x40a5f4
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xf
jl 0x40a5e0
mov dword [eax - 0xc], 0xf
xor eax, eax
mov ecx, dword [esi]
push 0x1e
mov word [ecx + 0x1e], ax
lea eax, [ebp - 0x20]
push eax
push 0x1e
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3

Function at 0x40a680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x34], 0x6f0053
push edi
mov dword [ebp - 0x30], 0x740066
mov dword [ebp - 0x2c], 0x610077
mov dword [ebp - 0x28], 0x650072
mov dword [ebp - 0x24], 0x54005c
mov dword [ebp - 0x20], 0x6e0065
mov dword [ebp - 0x1c], 0x650063
mov dword [ebp - 0x18], 0x74006e
mov dword [ebp - 0x14], 0x51005c
mov dword [ebp - 0x10], 0x500051
mov dword [ebp - 0xc], 0x4d0043
mov dword [ebp - 8], 0x720067
mov word [ebp - 4], ax
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x40a73e
mov eax, dword [ecx]
push 2
push 0x18
call dword [eax]
test eax, eax
je 0x40a748
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x18
jl 0x40a734
mov dword [eax - 0xc], 0x18
xor eax, eax
mov ecx, dword [esi]
push 0x30
mov word [ecx + 0x30], ax
lea eax, [ebp - 0x34]
push eax
push 0x30
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3

Function at 0x40a750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov dword [ebp - 0x20], 0x6e0055
mov dword [ebp - 0x1c], 0x6e0069
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov dword [ebp - 0x10], 0x53006c
mov dword [ebp - 0xc], 0x720074
mov dword [ebp - 8], 0x6e0069
mov dword [ebp - 4], 0x67
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x40a7e8
mov eax, dword [ecx]
push 2
push 0xf
call dword [eax]
test eax, eax
je 0x40a7f2
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xf
jl 0x40a7de
mov dword [eax - 0xc], 0xf
xor eax, eax
mov ecx, dword [esi]
push 0x1e
mov word [ecx + 0x1e], ax
lea eax, [ebp - 0x20]
push eax
push 0x1e
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3
Function at 0x40a800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xa0], 0x6f0053
push edi
mov dword [ebp - 0x9c], 0x740066
mov dword [ebp - 0x98], 0x610077
mov dword [ebp - 0x94], 0x650072
mov dword [ebp - 0x90], 0x4d005c
mov dword [ebp - 0x8c], 0x630069
mov dword [ebp - 0x88], 0x6f0072
mov dword [ebp - 0x84], 0x6f0073
mov dword [ebp - 0x80], 0x740066
mov dword [ebp - 0x7c], 0x57005c
mov dword [ebp - 0x78], 0x6e0069
mov dword [ebp - 0x74], 0x6f0064
mov dword [ebp - 0x70], 0x730077
mov dword [ebp - 0x6c], 0x43005c
mov dword [ebp - 0x68], 0x720075
mov dword [ebp - 0x64], 0x650072
mov dword [ebp - 0x60], 0x74006e
mov dword [ebp - 0x5c], 0x650056
mov dword [ebp - 0x58], 0x730072
mov dword [ebp - 0x54], 0x6f0069
mov dword [ebp - 0x50], 0x5c006e
mov dword [ebp - 0x4c], 0x6e0055
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x740073
mov dword [ebp - 0x40], 0x6c0061
mov dword [ebp - 0x3c], 0x5c006c
mov dword [ebp - 0x38], 0x69004b
mov dword [ebp - 0x34], 0x67006e
mov dword [ebp - 0x30], 0x6f0073
mov dword [ebp - 0x2c], 0x740066
mov dword [ebp - 0x28], 0x490020
mov dword [ebp - 0x24], 0x74006e
mov dword [ebp - 0x20], 0x720065
mov dword [ebp - 0x1c], 0x65006e
mov dword [ebp - 0x18], 0x200074
mov dword [ebp - 0x14], 0x650053
mov dword [ebp - 0x10], 0x750063
mov dword [ebp - 0xc], 0x690072
mov dword [ebp - 8], 0x790074
mov word [ebp - 4], ax
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x40a9a2
mov eax, dword [ecx]
push 2
push 0x4e
call dword [eax]
test eax, eax
je 0x40a9ac
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x4e
jl 0x40a998
mov dword [eax - 0xc], 0x4e
xor eax, eax
mov ecx, dword [esi]
push 0x9c
mov word [ecx + 0x9c], ax
lea eax, [ebp - 0xa0]
push eax
push 0x9c
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3
Function at 0x40aa40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x80], 0x6f0053
push edi
mov dword [ebp - 0x7c], 0x740066
mov dword [ebp - 0x78], 0x610077
mov dword [ebp - 0x74], 0x650072
mov dword [ebp - 0x70], 0x4d005c
mov dword [ebp - 0x6c], 0x630069
mov dword [ebp - 0x68], 0x6f0072
mov dword [ebp - 0x64], 0x6f0073
mov dword [ebp - 0x60], 0x740066
mov dword [ebp - 0x5c], 0x57005c
mov dword [ebp - 0x58], 0x6e0069
mov dword [ebp - 0x54], 0x6f0064
mov dword [ebp - 0x50], 0x730077
mov dword [ebp - 0x4c], 0x43005c
mov dword [ebp - 0x48], 0x720075
mov dword [ebp - 0x44], 0x650072
mov dword [ebp - 0x40], 0x74006e
mov dword [ebp - 0x3c], 0x650056
mov dword [ebp - 0x38], 0x730072
mov dword [ebp - 0x34], 0x6f0069
mov dword [ebp - 0x30], 0x5c006e
mov dword [ebp - 0x2c], 0x6e0055
mov dword [ebp - 0x28], 0x6e0069
mov dword [ebp - 0x24], 0x740073
mov dword [ebp - 0x20], 0x6c0061
mov dword [ebp - 0x1c], 0x5c006c
mov dword [ebp - 0x18], 0x330032
mov dword [ebp - 0x14], 0x350034
mov dword [ebp - 0x10], 0x430050
mov dword [ebp - 0xc], 0x610053
mov dword [ebp - 8], 0x650066
mov word [ebp - 4], ax
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x40ab86
mov eax, dword [ecx]
push 2
push 0x3e
call dword [eax]
test eax, eax
je 0x40ab90
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x3e
jl 0x40ab7c
mov dword [eax - 0xc], 0x3e
xor eax, eax
mov ecx, dword [esi]
push 0x7c
mov word [ecx + 0x7c], ax
lea eax, [ebp - 0x80]
push eax
push 0x7c
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3

Function at 0x40aba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0x360033
mov dword [ebp - 0x14], 0x730030
mov dword [ebp - 0x10], 0x660061
mov dword [ebp - 0xc], 0x2e0065
mov dword [ebp - 8], 0x780065
mov dword [ebp - 4], 0x65
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x40ac2a
mov eax, dword [ecx]
push 2
push 0xb
call dword [eax]
test eax, eax
je 0x40ac34
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xb
jl 0x40ac20
mov dword [eax - 0xc], 0xb
xor eax, eax
mov ecx, dword [esi]
push 0x16
mov word [ecx + 0x16], ax
lea eax, [ebp - 0x18]
push eax
push 0x16
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3
Function at 0x40ad40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x78], 0x4f0053
mov dword [ebp - 0x74], 0x540046
mov dword [ebp - 0x70], 0x410057
mov dword [ebp - 0x6c], 0x450052
mov dword [ebp - 0x68], 0x4d005c
mov dword [ebp - 0x64], 0x630069
mov dword [ebp - 0x60], 0x6f0072
mov dword [ebp - 0x5c], 0x6f0073
mov dword [ebp - 0x58], 0x740066
mov dword [ebp - 0x54], 0x57005c
mov dword [ebp - 0x50], 0x6e0069
mov dword [ebp - 0x4c], 0x6f0064
mov dword [ebp - 0x48], 0x730077
mov dword [ebp - 0x44], 0x43005c
mov dword [ebp - 0x40], 0x720075
mov dword [ebp - 0x3c], 0x650072
mov dword [ebp - 0x38], 0x74006e
mov dword [ebp - 0x34], 0x650056
mov dword [ebp - 0x30], 0x730072
mov dword [ebp - 0x2c], 0x6f0069
mov dword [ebp - 0x28], 0x5c006e
mov dword [ebp - 0x24], 0x6e0055
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6c0061
mov dword [ebp - 0x14], 0x5c006c
mov dword [ebp - 0x10], 0x330032
mov dword [ebp - 0xc], 0x350034
mov dword [ebp - 8], 0x690050
mov dword [ebp - 4], 0x63
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x40ae76
mov eax, dword [ecx]
push 2
push 0x3b
call dword [eax]
test eax, eax
je 0x40ae80
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x3b
jl 0x40ae6c
mov dword [eax - 0xc], 0x3b
xor eax, eax
mov ecx, dword [esi]
push 0x76
mov word [ecx + 0x76], ax
lea eax, [ebp - 0x78]
push eax
push 0x76
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3

Function at 0x40af20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x35343332
mov dword [ebp - 8], 0x61736370
mov word [ebp - 4], 0x6566
mov byte [ebp - 2], 0
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x40af96
mov eax, dword [ecx]
push 1
push 0xa
call dword [eax]
test eax, eax
je 0x40afa0
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x40af8c
mov dword [eax - 0xc], 0xa
lea eax, [ebp - 0xc]
mov ecx, dword [esi]
push 0xa
push eax
push 0xa
mov byte [ecx + 0xa], 0
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3
Function at 0x40afb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
xor eax, eax
mov dword [ebp - 0x2c], 0x6f0072
push esi
mov dword [ebp - 0x28], 0x74006f
mov dword [ebp - 0x24], 0x53005c
mov dword [ebp - 0x20], 0x630065
mov dword [ebp - 0x1c], 0x720075
mov dword [ebp - 0x18], 0x740069
mov dword [ebp - 0x14], 0x430079
mov dword [ebp - 0x10], 0x6e0065
mov dword [ebp - 0xc], 0x650074
mov dword [ebp - 8], 0x320072
mov word [ebp - 4], ax
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x40b05c
mov eax, dword [ecx]
push 2
push 0x14
call dword [eax]
test eax, eax
je 0x40b066
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x14
jl 0x40b052
mov dword [eax - 0xc], 0x14
xor eax, eax
mov ecx, dword [esi]
push 0x28
mov word [ecx + 0x28], ax
lea eax, [ebp - 0x2c]
push eax
push 0x28
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3

Function at 0x40b070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
mov dword [ebp - 0x80], 0x4f0053
mov dword [ebp - 0x7c], 0x540046
mov dword [ebp - 0x78], 0x410057
mov dword [ebp - 0x74], 0x450052
mov dword [ebp - 0x70], 0x4d005c
mov dword [ebp - 0x6c], 0x630069
mov dword [ebp - 0x68], 0x6f0072
mov dword [ebp - 0x64], 0x6f0073
mov dword [ebp - 0x60], 0x740066
mov dword [ebp - 0x5c], 0x57005c
mov dword [ebp - 0x58], 0x6e0069
mov dword [ebp - 0x54], 0x6f0064
mov dword [ebp - 0x50], 0x730077
mov dword [ebp - 0x4c], 0x43005c
mov dword [ebp - 0x48], 0x720075
mov dword [ebp - 0x44], 0x650072
mov dword [ebp - 0x40], 0x74006e
mov dword [ebp - 0x3c], 0x650056
mov dword [ebp - 0x38], 0x730072
mov dword [ebp - 0x34], 0x6f0069
mov dword [ebp - 0x30], 0x5c006e
mov dword [ebp - 0x2c], 0x700041
mov dword [ebp - 0x28], 0x200070
mov dword [ebp - 0x24], 0x610050
mov dword [ebp - 0x20], 0x680074
mov dword [ebp - 0x1c], 0x5c0073
mov dword [ebp - 0x18], 0x360033
mov dword [ebp - 0x14], 0x730030
mov dword [ebp - 0x10], 0x660061
mov dword [ebp - 0xc], 0x2e0065
mov dword [ebp - 8], 0x780065
mov dword [ebp - 4], 0x65
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x40b1b7
mov eax, dword [ecx]
push 2
push 0x3f
call dword [eax]
test eax, eax
je 0x40b1c1
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x3f
jl 0x40b1ad
mov dword [eax - 0xc], 0x3f
xor eax, eax
mov ecx, dword [esi]
push 0x7e
mov word [ecx + 0x7e], ax
lea eax, [ebp - 0x80]
push eax
push 0x7e
push dword [esi]
call fcn.0040a010
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406290
push 0x80004005
call fcn.00406290
call fcn.00409290
int3