joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dc20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x5180a0]
mov dword [ebp - 0x1c], 0x8242f7e4
mov dword [ebp - 0x18], 0x83f8efb8
mov dword [ebp - 0x14], 0xdf8429e9
mov dword [ebp - 0x10], 0x58e4ca2
mov dword [ebp - 0xc], 0xd3a34003
mov dword [ebp - 8], 0x23b341e4
push edi
test esi, esi
jne 0x41ddd3
mov esi, dword [0x517eb4]
test esi, esi
jne 0x41dc82
call fcn.00414210
mov esi, eax
mov dword [0x517eb4], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x41dd41
cmp byte [ebp - 0x1c], 0x30
je 0x41dd41
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41dd37
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41dd37
add eax, 0x18
je 0x41dd37
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x41dd37
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x41dd37
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x41dd37
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x41dd37
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41dd37
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x41dd37
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41dd26
test dl, dl
je 0x41dd22
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41dd26
add ecx, 2
add eax, 2
test dl, dl
jne 0x41dd06
xor eax, eax
jmp 0x41dd2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x41dd54
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x41dcfe
mov dword [0x5180a0], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41ddc3
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41ddc3
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41ddb5
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41ddc5
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41ddc5
add esi, ecx
mov dword [0x5180a0], esi
test esi, esi
je 0x41dd41
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41de50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x51804c]
mov dword [ebp - 0x18], 0xe458e3e3
mov dword [ebp - 0x14], 0x64beef6d
mov dword [ebp - 0x10], 0xdff890cf
mov dword [ebp - 0xc], 0x645f4c45
mov word [ebp - 8], 0x3d01
push edi
test esi, esi
jne 0x41dffd
mov esi, dword [0x517ea8]
test esi, esi
jne 0x41deaa
call fcn.0041ddf0
mov esi, eax
mov dword [0x517ea8], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41df6b
cmp byte [ebp - 0x18], 0x30
je 0x41df6b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41df61
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41df61
add eax, 0x18
je 0x41df61
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x41df61
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x41df61
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x41df61
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x41df61
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41df61
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x41df61
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41df50
test dl, dl
je 0x41df4c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41df50
add ecx, 2
add eax, 2
test dl, dl
jne 0x41df30
xor eax, eax
jmp 0x41df55
sbb eax, eax
or eax, 1
test eax, eax
je 0x41df7e
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41df26
mov dword [0x51804c], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41dfed
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41dfed
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41dfdf
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41dfef
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41dfef
add esi, ecx
mov dword [0x51804c], esi
test esi, esi
je 0x41df6b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41e010
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518048]
mov dword [ebp - 0x14], 0x8a5ac9e4
mov dword [ebp - 0x10], 0x6446546d
mov dword [ebp - 0xc], 0xdfbe35cf
mov dword [ebp - 8], 0x64f89a45
push edi
test esi, esi
jne 0x41e1b5
mov esi, dword [0x517ea8]
test esi, esi
jne 0x41e064
call fcn.0041ddf0
mov esi, eax
mov dword [0x517ea8], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x41e123
cmp byte [ebp - 0x14], 0x30
je 0x41e123
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41e119
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41e119
add eax, 0x18
je 0x41e119
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x41e119
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x41e119
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x41e119
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x41e119
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41e119
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x41e119
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41e108
test dl, dl
je 0x41e104
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41e108
add ecx, 2
add eax, 2
test dl, dl
jne 0x41e0e8
xor eax, eax
jmp 0x41e10d
sbb eax, eax
or eax, 1
test eax, eax
je 0x41e136
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x41e0e0
mov dword [0x518048], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41e1a5
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41e1a5
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41e197
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41e1a7
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41e1a7
add esi, ecx
mov dword [0x518048], esi
test esi, esi
je 0x41e123
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41e1d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518050]
mov dword [ebp - 0x14], 0xe45ce3f7
mov dword [ebp - 0x10], 0x64808e34
mov dword [ebp - 0xc], 0x2d464dca
mov word [ebp - 8], 0x6ac3
push edi
test esi, esi
jne 0x41e374
mov esi, dword [0x517ea8]
test esi, esi
jne 0x41e223
call fcn.0041ddf0
mov esi, eax
mov dword [0x517ea8], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x41e2e2
cmp byte [ebp - 0x14], 0x30
je 0x41e2e2
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41e2d8
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41e2d8
add eax, 0x18
je 0x41e2d8
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x41e2d8
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x41e2d8
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x41e2d8
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x41e2d8
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41e2d8
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x41e2d8
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41e2c7
test dl, dl
je 0x41e2c3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41e2c7
add ecx, 2
add eax, 2
test dl, dl
jne 0x41e2a7
xor eax, eax
jmp 0x41e2cc
sbb eax, eax
or eax, 1
test eax, eax
je 0x41e2f5
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x41e29f
mov dword [0x518050], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41e364
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41e364
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41e356
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41e366
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41e366
add esi, ecx
mov dword [0x518050], esi
test esi, esi
je 0x41e2e2
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x4201b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041fcd0

Function at 0x420390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax]
lea edi, [eax + 4]
mov dword [ebp - 4], ecx
test edi, edi
je 0x4203e7
mov bl, byte [ebp - 1]
lea eax, [edi + 2]
mov bh, byte [ebp - 2]
mov edx, 0x40
xor byte [eax - 2], cl
lea eax, [eax + 4]
xor byte [eax - 5], ch
xor byte [eax - 4], bh
xor byte [eax - 3], bl
sub edx, 1
jne 0x4203b6
lea edx, [ebp - 4]
mov esi, 2
lea ecx, [edi + 0x100]
mov al, byte [edx]
lea edx, [edx + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub esi, 1
jne 0x4203d8
push 0x102
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x420406
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x102
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push edi
call fcn.0041ef70
add eax, eax
mov dword [ebp - 8], eax
cdq
sub eax, edx
xor edx, edx
mov ebx, eax
sar ebx, 1
test ebx, ebx
jle 0x42044c
mov ecx, esi
movzx eax, byte [edi + edx*2]
lea ecx, [ecx + 2]
mov byte [ecx - 2], al
mov eax, edx
and eax, 3
inc edx
movzx eax, byte [ebp + eax - 4]
mov byte [ecx - 1], al
cmp edx, ebx
jl 0x420430
push dword [ebp - 8]
push esi
call fcn.0042fb90
mov eax, dword [ebp + 8]
push 0xa91e
add eax, 0x106
push eax
call fcn.0042f9f0
push 0x6188
push dword [ebp + 0xc]
call fcn.0042f9f0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x420490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 0x14]
je 0x420519
cmp eax, 1
jb 0x420519
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x420519
cmp edi, 1
jb 0x420519
xor edx, edx
div edi
push esi
mov esi, eax
mov dword [ebp - 4], edx
mov dword [ebp + 0x10], esi
test esi, esi
je 0x4204f0
mov dword [ebp + 0x14], esi
mov esi, dword [ebp + 8]
nop word [eax + eax]
xor edx, edx
mov eax, esi
mov cl, byte [edx + ebx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, edi
jb 0x4204d4
add esi, edi
sub dword [ebp + 0x14], 1
jne 0x4204d0
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x42050e
imul esi, edi
add esi, dword [ebp + 8]
nop dword [eax]
mov al, byte [ecx + ebx]
lea esi, [esi + 1]
xor byte [esi - 1], al
inc ecx
cmp ecx, edx
jb 0x420500
pop esi
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x420fb0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0x808], edi
mov dword [esi], edi
test ebx, ebx
je 0x4210e8
push 0x800
lea eax, [ebp - 0x804]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push edi
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 0x808]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4210e8
mov eax, 0x5a4d
cmp word [ebp - 0x804], ax
je 0x421049
pop edi
mov dword [esi], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x7c8]
cmp dword [ebp + eax - 0x804], 0x4550
je 0x421077
pop edi
mov dword [esi], 2
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x10b
cmp word [ebp + eax - 0x7ec], cx
jne 0x4210aa
cmp dword [ebp + eax - 0x768], edi
jne 0x4210b3
mov eax, edi
mov dword [esi], 3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + eax - 0x758], edi
je 0x4210cd
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret 8
mov eax, edi
mov dword [esi], 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret 8
Function at 0x4241f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], 0xe41ce400
mov dword [ebp - 0x7c], 0xdf46efee
mov dword [ebp - 0x78], 0xdf462974
mov dword [ebp - 0x74], 0x3b464c78
mov dword [ebp - 0x70], 0x3d46396c
mov dword [ebp - 0x6c], 0xdb463961
mov dword [ebp - 0x68], 0xd641fb52
mov dword [ebp - 0x64], 0xfa416646
mov dword [ebp - 0x60], 0xf241d13b
mov dword [ebp - 0x5c], 0x741602f
mov dword [ebp - 0x58], 0x7841a833
mov dword [ebp - 0x54], 0x76412a27
mov dword [ebp - 0x50], 0x5415718
mov dword [ebp - 0x4c], 0x7e41d90c
mov dword [ebp - 0x48], 0xdf414c01
mov dword [ebp - 0x44], 0xf2419ef5
mov dword [ebp - 0x40], 0x7841e9ee
mov dword [ebp - 0x3c], 0x644142e2
mov dword [ebp - 0x38], 0x9a4133d7
mov word [ebp - 0x34], 0x8c87
mov dword [ebp - 0x30], 0x8273b61b
mov dword [ebp - 0x2c], 0x5fd1732
mov dword [ebp - 0x28], 0x23f84d1b
mov dword [ebp - 0x24], 0x21d964c3
mov dword [ebp - 0x20], 0x21cd27ac
mov dword [ebp - 0x1c], 0x3d9a44a1
mov dword [ebp - 0x18], 0x7889c1e9
mov dword [ebp - 0x14], 0xd120c1cd
mov dword [ebp - 0x10], 0x838796e1
mov dword [ebp - 0xc], 0xdfd20fed
mov byte [ebp - 8], 0x96
call fcn.0041aa60
test eax, eax
je 0x424358
push 0
push 0x1c
lea ecx, [ebp - 0x288]
push ecx
push 0
call eax
test eax, eax
je 0x424358
push esi
push 0
push 0
push 0
lea eax, [ebp - 0x80]
push eax
call fcn.004201b0
mov esi, eax
lea eax, [ebp - 0x288]
push esi
push 0x104
push eax
call fcn.0041eb80
push esi
test eax, eax
jne 0x424331
call fcn.0041fc30
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
call fcn.0041fc30
push 0
push 0
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.0041fef0
push 7
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00423ad0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x427800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x20], 0xbd4ee3e4
push eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x1c], 0xdf46efee
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0xdf46f874
push eax
push 0x400
push 0x522c28
mov dword [ebp - 0x14], 0xa3469278
mov dword [ebp - 0x10], 0xcc46b76c
mov dword [ebp - 0xc], 0x97462561
mov dword [ebp - 8], 0xd1414f52
mov dword [ebp - 0x78], 0xe464e44b
mov dword [ebp - 0x74], 0x7d46efee
mov dword [ebp - 0x70], 0xd6464e74
mov dword [ebp - 0x6c], 0x2d464e78
mov dword [ebp - 0x68], 0x3f464b6c
mov dword [ebp - 0x64], 0x7464161
mov dword [ebp - 0x60], 0x7412a52
mov dword [ebp - 0x5c], 0x2341ba46
mov dword [ebp - 0x58], 0x4b41af3b
mov dword [ebp - 0x54], 0xee41042f
mov dword [ebp - 0x50], 0xa341df33
mov dword [ebp - 0x4c], 0x30417227
mov dword [ebp - 0x48], 0x7d411b18
mov word [ebp - 0x44], 0x9a89
mov dword [ebp - 0x40], 0xe44ce496
mov dword [ebp - 0x3c], 0x2346efee
mov dword [ebp - 0x38], 0xd1464874
mov dword [ebp - 0x34], 0x35461d78
mov dword [ebp - 0x30], 0xa746396c
mov dword [ebp - 0x2c], 0x46463961
mov dword [ebp - 0x28], 0x5410352
mov word [ebp - 0x24], 0x68c3
call fcn.00435200
cmp eax, 1
jne 0x427905
inc word [0x523430]
mov dword [0x523434], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret

Function at 0x428220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 0x54], 0xe41ce400
mov dword [ebp - 0x50], 0x2046efee
mov dword [ebp - 0x4c], 0x20466d74
mov dword [ebp - 0x48], 0x20466978
mov dword [ebp - 0x44], 0x2046656c
mov dword [ebp - 0x40], 0xe9466161
mov dword [ebp - 0x3c], 0x20419d52
mov dword [ebp - 0x38], 0x20419946
mov dword [ebp - 0x34], 0x2041953b
mov dword [ebp - 0x30], 0x2041582f
mov dword [ebp - 0x2c], 0x20418d33
mov dword [ebp - 0x28], 0x20418927
mov dword [ebp - 0x24], 0xe9418518
mov dword [ebp - 0x20], 0x2041480c
mov dword [ebp - 0x1c], 0x2041bd01
mov dword [ebp - 0x18], 0x2041b9f5
mov dword [ebp - 0x14], 0x2041b5ee
mov dword [ebp - 0x10], 0x2041b1e2
mov dword [ebp - 0xc], 0x204133d7
mov word [ebp - 8], 0xa955
call fcn.0041ef70
test eax, eax
je 0x428327
push esi
call fcn.0041e620
cmp eax, 1
je 0x428327
push edi
push 0
push 0
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.004201b0
mov edi, eax
push edi
push esi
call fcn.0041e3f0
push edi
test eax, eax
je 0x42830e
call fcn.0041fc30
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret 4
call fcn.0041fc30
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00441849
mov esp, ebp
pop ebp
ret 4
Function at 0x42c710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x20], 0xbd4ee3e4
push eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x1c], 0xdf46efee
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0xdf46f874
push eax
push 0x50
push 0x525f18
mov dword [ebp - 0x14], 0xa3469278
mov dword [ebp - 0x10], 0xcc46b76c
mov dword [ebp - 0xc], 0x97462561
mov dword [ebp - 8], 0xd1414f52
mov dword [ebp - 0x8c], 0xe410e415
mov dword [ebp - 0x88], 0x7d46efee
mov dword [ebp - 0x84], 0xd646f374
mov dword [ebp - 0x80], 0xbe464ea2
mov dword [ebp - 0x7c], 0x3fc34b6c
mov dword [ebp - 0x78], 0x746ff61
mov dword [ebp - 0x74], 0xbe412a88
mov dword [ebp - 0x70], 0x23b9ba46
mov dword [ebp - 0x6c], 0x4b410b3b
mov dword [ebp - 0x68], 0xbe4104bc
mov dword [ebp - 0x64], 0xdfffdf33
mov dword [ebp - 0x60], 0xdb411727
mov dword [ebp - 0x5c], 0xbe4190a1
mov dword [ebp - 0x58], 0xd1e5ba0c
mov dword [ebp - 0x54], 0x5412301
mov dword [ebp - 0x50], 0xbe411aa5
mov dword [ebp - 0x4c], 0x462448ee
mov dword [ebp - 0x48], 0x5412fe2
mov word [ebp - 0x44], 0xb614
mov dword [ebp - 0x40], 0xe44ce496
mov dword [ebp - 0x3c], 0x3546efee
mov dword [ebp - 0x38], 0x464874
mov dword [ebp - 0x34], 0x64463778
mov dword [ebp - 0x30], 0xd1463d6c
mov dword [ebp - 0x2c], 0x35462361
mov dword [ebp - 0x28], 0x78410352
mov word [ebp - 0x24], 0x686f
call fcn.00435200
cmp eax, 1
jne 0x42c857
push 0x525f18
call fcn.0041ef70
test eax, eax
je 0x42c857
inc word [0x525fc0]
mov dword [0x525fc4], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x42cf40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x20], 0xbd4ee3e4
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x1c], 0xdf46efee
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0xdf46f874
push eax
push 0x50
push 0x526158
mov dword [ebp - 0x14], 0xa3469278
mov dword [ebp - 0x10], 0xcc46b76c
mov dword [ebp - 0xc], 0x97462561
mov dword [ebp - 8], 0xd1414f52
mov dword [ebp - 0x80], 0x156a4be4
mov dword [ebp - 0x7c], 0x7d46efee
mov dword [ebp - 0x78], 0xd6469c74
mov dword [ebp - 0x74], 0x83464e78
mov dword [ebp - 0x70], 0x3f464b6c
mov dword [ebp - 0x6c], 0x7469e61
mov dword [ebp - 0x68], 0x2d412a52
mov dword [ebp - 0x64], 0xa341ba46
mov dword [ebp - 0x60], 0x4b41e13b
mov dword [ebp - 0x5c], 0x741042f
mov dword [ebp - 0x58], 0xd141df33
mov dword [ebp - 0x54], 0xe541b327
mov dword [ebp - 0x50], 0xee41a018
mov dword [ebp - 0x4c], 0xdf41df0c
mov dword [ebp - 0x48], 0x83414601
mov dword [ebp - 0x44], 0x7d41a2f5
mov dword [ebp - 0x40], 0xe44ce496
mov dword [ebp - 0x3c], 0x3546efee
mov dword [ebp - 0x38], 0x464874
mov dword [ebp - 0x34], 0x64463778
mov dword [ebp - 0x30], 0xd1463d6c
mov dword [ebp - 0x2c], 0x35462361
mov dword [ebp - 0x28], 0x78410352
mov word [ebp - 0x24], 0x686f
call fcn.00435200
cmp eax, 1
jne 0x42d067
push 0x526158
call fcn.0041ef70
test eax, eax
je 0x42d067
inc word [0x526200]
mov dword [0x526204], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret