joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4269b9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4269f8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4269f8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4269f8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4269f8
cmp dword [ecx + 0x74], 0xe
jbe 0x4269f8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x438da0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438dcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438dcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x74086a5e
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x57c609fa
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x234e04e0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x234e06ad
pushal
mov esi, 0x234d7015
lea edi, [esi - 0x16015]
push edi
or ebp, 0xffffffff
jmp 0x234e050a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x234e0511
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x234e0500
mov eax, 1
add ebx, ebx
jne 0x234e0523
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x234e0518
jne 0x234e0534
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x234e0518
xor ecx, ecx
sub eax, 3
jb 0x234e0548
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x234e05ba
mov ebp, eax
add ebx, ebx
jne 0x234e0553
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x234e0560
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x234e0584
inc ecx
add ebx, ebx
jne 0x234e0570
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x234e0565
jne 0x234e0581
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x234e0565
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x234e05a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x234e0595
jmp 0x234e0506
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x234e05a4
add edi, ecx
jmp 0x234e0506
pop esi
mov edi, esi
mov ecx, 0x2b2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x234e05c2
cmp byte [edi], 5
jne 0x234e05c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x234e05c7
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x234e063f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2540c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x254ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x234e05f4
mov ecx, edi
jns 0x234e0623
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x254b0]
or eax, eax
je 0x234e0639
mov dword [ebx], eax
add ebx, 4
jmp 0x234e0611
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x234e0670
cmp al, 0xef
ja 0x234e0663
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x234e0645
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x234e0652
mov ebp, dword [esi + 0x254b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x234e06a4
sub esp, 0xffffff80
jmp 0x234c964b
Function at 0x404bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0xc], 0
call fcn.00404560
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404d2a
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x24], 0x6d
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x24], 0x45
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x24], 0x69
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x24], 0x6e
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x24], 0x43
mov eax, 1
imul ecx, eax, 0x11
mov byte [ebp + ecx - 0x24], 0x73
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x24], 0x74
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x24], 0x49
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x24], 0x43
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x24], 0x72
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x24], 0x6c
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x24], 0x6f
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x24], 0x6f
mov edx, 1
imul eax, edx, 0x13
mov byte [ebp + eax - 0x24], 0x78
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x24], 0x6d
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x24], 0x6f
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x24], 0x74
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x24], 0x6e
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x24], 0x6f
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x24], 0x6e
mov edx, 1
imul eax, edx, 0x14
mov byte [ebp + eax - 0x24], 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404d20
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x404d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0xc], 0
call fcn.00404660
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404f60
mov eax, 1
imul ecx, eax, 0x15
mov byte [ebp + ecx - 0x30], 0x64
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x30], 0x76
mov ecx, 1
imul edx, ecx, 0x17
mov byte [ebp + edx - 0x30], 0x6c
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x30], 0x67
mov edx, 1
imul eax, edx, 0x1f
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
imul edx, ecx, 0x1d
mov byte [ebp + edx - 0x30], 0x69
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x30], 0x55
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x30], 0x74
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x30], 0x69
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x30], 0x46
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x30], 0x72
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x30], 0x72
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x30], 0x64
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x30], 0x50
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x30], 0x75
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x30], 0x6c
mov ecx, 1
imul edx, ecx, 0x18
mov byte [ebp + edx - 0x30], 0x61
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x30], 0x41
mov edx, 1
imul eax, edx, 0x16
mov byte [ebp + eax - 0x30], 0x50
mov ecx, 1
imul edx, ecx, 0x21
mov byte [ebp + edx - 0x30], 0x57
mov eax, 1
shl eax, 5
mov byte [ebp + eax - 0x30], 0x73
mov ecx, 1
imul edx, ecx, 0x1a
mov byte [ebp + edx - 0x30], 0x44
mov eax, 1
imul ecx, eax, 0x1b
mov byte [ebp + ecx - 0x30], 0x65
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x30], 0x6f
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x30], 0x72
mov eax, 1
imul ecx, eax, 0x14
mov byte [ebp + ecx - 0x30], 0x6e
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
imul edx, ecx, 0x19
mov byte [ebp + edx - 0x30], 0x79
mov eax, 1
imul ecx, eax, 0x1e
mov byte [ebp + ecx - 0x30], 0x63
mov edx, 1
imul eax, edx, 0x22
mov byte [ebp + eax - 0x30], 0
mov ecx, 1
imul edx, ecx, 0x1c
mov byte [ebp + edx - 0x30], 0x76
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x30], 0x61
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x30], 0x65
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x30], 0x70
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x30], 0x44
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404f56
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x404f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call fcn.00404740
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4050bd
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x20], 0x64
mov edx, 1
imul eax, edx, 0x13
mov byte [ebp + eax - 0x20], 0
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x20], 0x6e
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x20], 0x45
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x20], 0x6b
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x20], 0x6b
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x20], 0x48
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x20], 0x57
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x68
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x20], 0x77
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x20], 0x55
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x20], 0x73
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x20], 0x69
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x20], 0x78
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x20], 0x6e
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4050b3
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4050d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
call fcn.00404740
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4051ce
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x1c], 0x73
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x1c], 0x67
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x1c], 0x61
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x1c], 0x73
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x1c], 0x74
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x1c], 0x73
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x1c], 0x57
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x1c], 0x50
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x6f
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x1c], 0x4d
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4051c4
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4051e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x18], 0x43
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x18], 0x47
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x18], 0x74
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x18], 0x6e
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x18], 0x4c
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
imul eax, edx, 0xe
mov byte [ebp + eax - 0x18], 0x57
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x18], 0x6d
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x64
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x18], 0x6e
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x18], 0x61
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x18], 0x6d
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x6f
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0x69
lea ecx, [ebp - 0x18]
push ecx
call fcn.00404820
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4052db
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4052f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.00404920
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4053ee
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x18], 0x43
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x18], 0x69
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x18], 0x7a
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x18], 0x74
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x18], 0x55
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x18], 0x6f
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x18], 0x69
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x18], 0x61
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x18], 0x6e
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], 0x6e
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x18], 0x69
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x69
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x18], 0x6c
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4053e4
call dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esp, ebp
pop ebp
ret

Function at 0x405400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 1
call fcn.00404920
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4054f2
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x1c], 0x69
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x1c], 0
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x1c], 0x61
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x1c], 0x7a
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x1c], 0x74
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x1c], 0x69
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x1c], 0x69
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x1c], 0x49
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x1c], 0x6e
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x1c], 0x6f
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x1c], 0x43
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x1c], 0x6c
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x1c], 0x65
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4054e8
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x405500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 1
call fcn.00404920
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405636
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x20], 0x63
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x20], 0x61
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x20], 0x49
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x20], 0x73
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x20], 0x61
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x43
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x20], 0x6e
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x20], 0x74
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x20], 0x43
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x20], 0x72
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x20], 0x74
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x20], 0
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x20], 0x6e
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40562c
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x405640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
call fcn.00404740
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405729
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x18], 0x69
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x18], 0x46
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x18], 0x57
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], 0x64
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x18], 0x6f
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x18], 0x6e
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x77
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x57
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x18], 0x6e
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x18], 0x64
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x18], 0x69
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40571f
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x405730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call fcn.00404740
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40586f
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x20], 0x45
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x20], 0x57
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x20], 0x69
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x20], 0x6e
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x74
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x20], 0x48
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x20], 0x78
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x20], 0x77
mov eax, 1
imul ecx, eax, 0x11
mov byte [ebp + ecx - 0x20], 0
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x20], 0x53
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x20], 0x6f
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x20], 0x6b
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x20], 0x57
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x20], 0x64
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x20], 0x73
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405865
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x405880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call fcn.004049f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4059c4
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x20], 0x54
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x20], 0x6e
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x20], 0x64
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x6d
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x20], 0x43
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x20], 0x6d
mov edx, 1
imul eax, edx, 0xe
mov byte [ebp + eax - 0x20], 0x72
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x20], 0x6f
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x20], 0x69
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x20], 0x4c
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x20], 0x67
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x20], 0x6e
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x20], 0x76
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x20], 0x41
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x20], 0x61
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x20], 0x57
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 0x12
mov byte [ebp + edx - 0x20], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4059ba
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret