joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404da2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov edx, dword [eax + 0x3c]
add edx, eax
movzx eax, word [edx + 0x14]
add eax, 0x18
add eax, edx
mov dword [ebp - 4], eax
cmp ebx, dword [ebp + 0xc]
jae 0x404dfe
push esi
movzx esi, word [edx + 6]
mov edx, ecx
mov dword [ebp + 8], esi
test esi, esi
je 0x404dfd
lea esi, [eax + 0xc]
mov eax, dword [ebp + 8]
push edi
mov edi, dword [esi]
cmp ebx, edi
jb 0x404dec
mov eax, dword [esi - 4]
add eax, edi
cmp ebx, eax
jb 0x404df6
mov eax, dword [ebp + 8]
inc edx
add esi, 0x28
cmp edx, eax
jb 0x404dda
jmp 0x404dfc
imul ecx, edx, 0x28
add ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x404e08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [edx + 0x3c]
push ebx
push esi
push edi
mov ecx, dword [eax + edx + 0x78]
mov esi, dword [eax + edx + 0x7c]
mov edi, dword [ebp + 0xc]
lea ebx, [esi + ecx]
cmp ecx, edi
jae 0x404f3c
lea eax, [ecx + 0x28]
cmp eax, edi
jae 0x404f3c
cmp esi, edi
jae 0x404f3c
cmp ebx, edi
jae 0x404f3c
mov eax, dword [ecx + edx + 0x14]
mov edi, dword [ecx + edx + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + edx + 0x20]
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], eax
cmp eax, ecx
jb 0x404f3c
shl edi, 2
add eax, edi
cmp eax, ebx
jae 0x404f3c
cmp edi, esi
jae 0x404f3c
mov edi, dword [ecx + edx + 0x24]
cmp edi, ecx
jb 0x404f3c
mov eax, dword [ebp - 8]
lea eax, [edi + eax*2]
cmp eax, ebx
jae 0x404f3c
mov esi, dword [ecx + edx + 0x1c]
cmp esi, ecx
jb 0x404f3c
mov eax, dword [ebp - 0xc]
lea eax, [esi + eax*4]
cmp eax, ebx
jae 0x404f3c
mov eax, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x10], eax
lea eax, [edi + edx]
mov dword [ebp - 0x14], eax
lea eax, [esi + edx]
mov dword [ebp - 0x18], eax
xor eax, eax
mov edi, eax
cmp dword [ebp - 8], eax
jbe 0x404f3e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + edi*4]
cmp eax, ecx
jb 0x404f36
cmp eax, ebx
jae 0x404f36
mov esi, dword [ebp + 0x10]
add eax, edx
mov dl, byte [eax]
cmp dl, byte [esi]
mov byte [ebp - 1], dl
mov edx, dword [ebp + 8]
jne 0x404f0e
cmp byte [ebp - 1], 0
je 0x404f0a
mov dl, byte [eax + 1]
cmp dl, byte [esi + 1]
mov byte [ebp - 1], dl
mov edx, dword [ebp + 8]
jne 0x404f0e
add eax, 2
add esi, 2
cmp byte [ebp - 1], 0
jne 0x404ede
xor eax, eax
jmp 0x404f13
sbb eax, eax
or eax, 1
test eax, eax
jne 0x404f36
mov eax, dword [ebp - 0x14]
movzx esi, word [eax + edi*2]
cmp esi, dword [ebp - 0xc]
jae 0x404f36
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + esi*4]
cmp esi, dword [ebp + 0xc]
jae 0x404f36
cmp esi, ecx
jb 0x404f47
cmp esi, ebx
jae 0x404f47
inc edi
cmp edi, dword [ebp - 8]
jb 0x404ecb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov al, 1
jmp 0x404f3e
Function at 0x404f50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov ecx, dword [eax + 0x3c]
mov esi, ebx
add ecx, eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
movzx ecx, word [ecx + 6]
mov dword [ebp - 4], eax
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x404fa6
push edi
mov edi, eax
push edi
push dword [ebp + 0x10]
call fcn.0047d634
test eax, eax
je 0x404f94
inc esi
add edi, 0x28
cmp esi, dword [ebp + 8]
jb 0x404f7c
jmp 0x404fa5
mov ecx, dword [ebp - 4]
imul eax, esi, 0x28
mov eax, dword [eax + ecx + 0xc]
cmp eax, dword [ebp + 0xc]
jae 0x404fa5
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x404fb0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov ecx, dword [eax + 0x3c]
mov esi, ebx
add ecx, eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
movzx ecx, word [ecx + 6]
mov dword [ebp - 4], eax
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x405016
push edi
mov edi, eax
push edi
push dword [ebp + 0x10]
call fcn.0047d634
test eax, eax
je 0x404ff4
inc esi
add edi, 0x28
cmp esi, dword [ebp + 8]
jb 0x404fdc
jmp 0x405015
mov eax, dword [ebp - 4]
imul edx, esi, 0x28
mov ecx, dword [edx + eax + 8]
cmp ecx, dword [ebp + 0xc]
jae 0x405015
mov eax, dword [edx + eax + 0xc]
cmp eax, dword [ebp + 0xc]
jae 0x405015
add eax, ecx
cmp eax, dword [ebp + 0xc]
jae 0x405015
mov ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405462
Capabilities:
Attach user process memory

Disassembly:
push 0x88
push 0x48b608
call fcn.004011b4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x88], esi
push 0x314
call fcn.004355f2
mov dword [ebp - 0x8c], eax
test eax, eax
je 0x4054ac
lea ecx, [esi + 0x14]
mov edx, dword [ecx]
test edx, edx
je 0x4054a6
cmp edx, dword [ecx + 4]
je 0x4054a6
mov byte [ecx + 8], 1
add ecx, 0x30
dec eax
jne 0x405497
push dword [ebp - 0x80]
call fcn.00479046
mov byte [ebp - 0x75], al
and dword [ebp - 0x7c], 0
push 0xfffffffffffffffe
pop ebx
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x8c]
jae 0x40560c
imul esi, eax, 0x30
add esi, dword [ebp - 0x88]
cmp dword [esi + 0x14], 0
je 0x405604
push 0xc
pop ecx
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
push 0x19
call fcn.00477546
mov byte [ebp - 0x84], al
push 0xe
call fcn.00477546
mov byte [ebp - 0x94], al
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x80]
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x94]
push 0xe
call fcn.0047769a
push dword [ebp - 0x84]
push 0x19
call fcn.0047769a
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x60]
cmp ecx, edx
jae 0x40559f
lea eax, [ecx + 0xf]
cmp eax, edx
jae 0x40559f
and dword [ebp - 4], 0
push 0x10
lea eax, [ebp - 0x56]
push eax
push ecx
call fcn.0047d5d2
test eax, eax
je 0x40559c
mov byte [ebp - 0x57], 1
cmp byte [ebp - 0x58], 0
jne 0x40559c
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [ebp - 0x60]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x60]
push 0x10
lea eax, [ebp - 0x2c]
push eax
call fcn.004066b0
cmp al, 1
jne 0x40559c
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x5c], eax
jmp 0x40559c
mov dword [ebp - 4], ebx
push 0x19
call fcn.00477546
mov byte [ebp - 0x84], al
push 0xf
call fcn.00477546
mov byte [ebp - 0x98], al
lea eax, [ebp - 0x44]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x98]
push 0xf
call fcn.0047769a
push dword [ebp - 0x84]
push 0x19
call fcn.0047769a
mov dword [ebp - 4], 1
imul edi, dword [ebp - 0x7c], 0x30
add edi, dword [ebp - 0x88]
push 0xc
pop ecx
lea esi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
jmp 0x405601
mov dword [ebp - 4], ebx
inc dword [ebp - 0x7c]
jmp 0x4054be
cmp byte [ebp - 0x75], 1
jne 0x40561a
push dword [ebp - 0x80]
call fcn.004790ec
mov al, 1
call fcn.004011fc
ret 8
Function at 0x4057c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00405e1c
cmp al, 1
jne 0x405870
xor eax, eax
mov dword [ebp - 0x1c], 0x72657355
test bl, bl
mov dword [ebp - 0x18], 0x65696c43
mov dword [ebp - 0x14], 0x6c44746e
setne al
mov dword [ebp - 0x10], 0x696e496c
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 0x6c616974
push eax
push dword [ebp - 0x24]
mov dword [ebp - 8], 0x657a69
push dword [ebp - 0x20]
call fcn.0040487c
test eax, eax
je 0x405868
push esi
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call fcn.00406388
mov esi, eax
test esi, esi
je 0x405867
push esi
test bl, bl
jne 0x405850
push 0x312
jmp 0x405855
push 0x313
call fcn.004356b2
push ebx
push esi
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call fcn.00405882
pop esi
push dword [ebp - 0x20]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 4
Function at 0x405e1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x4c], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x44], 0x53005c
mov dword [ebp - 0x40], 0x730079
mov dword [ebp - 0x3c], 0x650074
mov dword [ebp - 0x38], 0x52006d
mov dword [ebp - 0x34], 0x6f006f
mov dword [ebp - 0x30], 0x5c0074
mov dword [ebp - 0x2c], 0x790073
cmp byte [ebp + 0x10], bl
jne 0x405e89
mov dword [ebp - 0x28], 0x740073
mov esi, ebx
mov dword [ebp - 0x24], 0x6d0065
mov dword [ebp - 0x20], 0x320033
jmp 0x405ea1
xor esi, esi
mov dword [ebp - 0x28], 0x570073
mov dword [ebp - 0x24], 0x57004f
inc esi
mov dword [ebp - 0x20], 0x340036
push 1
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], 0x75005c
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x18], 0x650073
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14], 0x330072
push eax
mov dword [ebp - 0x10], 0x2e0032
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
call fcn.00439b16
test eax, eax
jne 0x405f00
push esi
push dword [ebp - 0x4c]
push edi
push dword [ebp - 0x50]
push dword [ebp - 0x48]
call fcn.00405020
cmp al, 1
jne 0x405ef8
mov bl, al
push dword [ebp - 0x48]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 0xc

Function at 0x405f16
Capabilities:
Attach user process memory

Disassembly:
push 0x34
push 0x48b630
call fcn.004011b4
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40], esi
xor ebx, ebx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x406025
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov edx, dword [eax]
cmp ecx, edx
jae 0x406025
lea eax, [ecx + 4]
cmp eax, edx
jae 0x406025
push 0x314
call fcn.004355f2
cmp dword [esi + 0xc], eax
jae 0x406025
push dword [esi]
call fcn.00478e94
mov byte [ebp - 0x37], al
push dword [esi]
call fcn.00479046
mov byte [ebp - 0x36], al
push 0x19
call fcn.00477546
mov byte [ebp - 0x3b], al
push 0xe
call fcn.00477546
mov byte [ebp - 0x44], al
lea eax, [ebp - 0x34]
push eax
push dword [esi]
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x44]
push 0xe
call fcn.0047769a
push dword [ebp - 0x3b]
push 0x19
call fcn.0047769a
mov dword [ebp - 4], ebx
push dword [esi + 0x14]
push dword [esi + 8]
cmp byte [ebp - 0x37], bl
jne 0x405fbe
call fcn.004822a6
jmp 0x405fc3
call fcn.0048247a
mov bl, 1
mov byte [ebp - 0x35], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x405fe7
push 0x19
call fcn.00477546
mov byte [ebp - 0x3b], al
push 0xf
call fcn.00477546
mov byte [ebp - 0x40], al
lea eax, [ebp - 0x34]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x40]
push 0xf
call fcn.0047769a
push dword [ebp - 0x3b]
push 0x19
call fcn.0047769a
cmp byte [ebp - 0x36], 1
jne 0x406025
push dword [esi]
call fcn.004790ec
mov al, bl
call fcn.004011fc
ret 4
Function at 0x406128
Capabilities:
Attach user process memory

Disassembly:
push 0x44
push 0x48b650
call fcn.004011b4
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x54], ebx
and dword [ebp - 0x4c], 0
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x406239
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov edx, dword [eax]
cmp ecx, edx
jae 0x406239
lea eax, [ecx + 0xf]
cmp eax, edx
jae 0x406239
push 0x314
call fcn.004355f2
cmp dword [ebx + 0xc], eax
jae 0x406239
push dword [ebx]
call fcn.00479046
mov byte [ebp - 0x45], al
push 0x19
call fcn.00477546
mov byte [ebp - 0x50], al
push 0xe
call fcn.00477546
mov byte [ebp - 0x4c], al
lea eax, [ebp - 0x44]
push eax
push dword [ebx]
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x4c]
push 0xe
call fcn.0047769a
push dword [ebp - 0x50]
push 0x19
call fcn.0047769a
xor eax, eax
mov dword [ebp - 4], eax
lea esi, [ebx + 0x1e]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push 1
push 0x10
lea eax, [ebp - 0x2c]
push eax
push dword [ebx + 0x14]
call fcn.00482046
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x46], al
mov dword [ebp - 4], 0xfffffffe
jmp 0x4061fb
push 0x19
call fcn.00477546
mov byte [ebp - 0x50], al
push 0xf
call fcn.00477546
mov byte [ebp - 0x54], al
lea eax, [ebp - 0x44]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x54]
push 0xf
call fcn.0047769a
push dword [ebp - 0x50]
push 0x19
call fcn.0047769a
cmp byte [ebp - 0x45], 1
jne 0x406239
push dword [ebx]
call fcn.004790ec
mov al, byte [ebp - 0x4c]
call fcn.004011fc
ret 4
Function at 0x406244
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x44
push 0x48b588
call fcn.004011b4
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x54], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
xor esi, esi
push 0x1000
push 1
call fcn.00478d6e
mov edi, eax
mov dword [ebp - 0x4c], edi
test edi, edi
je 0x40637e
mov dword [ebp - 0x34], 0x730075
mov dword [ebp - 0x30], 0x720065
mov dword [ebp - 0x2c], 0x320033
mov dword [ebp - 0x28], 0x64002e
mov dword [ebp - 0x24], 0x6c006c
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
mov eax, esi
mov dword [ebp - 0x40], eax
mov ecx, dword [ebx]
mov dword [ebp - 0x38], ecx
cmp ecx, ebx
je 0x406349
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x1000
ja 0x406349
mov ebx, ecx
sub ebx, dword [ebp - 0x48]
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov edx, dword [eax]
mov dword [ebp - 0x44], edx
cmp ebx, edx
jae 0x406349
lea eax, [ebx + 0x48]
cmp eax, edx
jae 0x406349
cmp dword [ebx + 0x18], esi
je 0x406355
movzx ecx, word [ebx + 0x24]
mov dword [ebp - 0x3c], ecx
cmp ecx, 0x1fe
jbe 0x4062f7
mov ecx, 0x1fe
mov dword [ebp - 0x3c], ecx
cmp ecx, 2
jbe 0x406352
mov edx, dword [ebx + 0x28]
cmp edx, dword [ebp - 0x44]
jae 0x406352
test edx, edx
je 0x406352
lea eax, [edx + ecx]
cmp eax, dword [ebp - 0x44]
jae 0x406352
push ecx
push edx
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x3c]
shr eax, 1
xor ecx, ecx
mov word [edi + eax*2], cx
push 0x5c
push edi
call fcn.0047d940
test eax, eax
je 0x406352
add eax, 2
lea ecx, [ebp - 0x34]
push ecx
push eax
call fcn.0047d7a2
test eax, eax
jne 0x406352
mov esi, dword [ebx + 0x18]
mov dword [ebp - 0x50], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x406378
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x54]
jmp 0x4062a7
push edi
call fcn.00478d8c
mov eax, esi
call fcn.004011fc
ret 8

Function at 0x407348
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
push 2
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x46005c
push eax
mov dword [ebp - 0x28], 0x6c0069
mov dword [ebp - 0x24], 0x530065
mov dword [ebp - 0x20], 0x730079
mov dword [ebp - 0x1c], 0x650074
mov dword [ebp - 0x18], 0x5c006d
mov dword [ebp - 0x14], 0x410052
mov dword [ebp - 0x10], 0x57
call fcn.004070ba
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x4073b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x4b47
mov dword [ebp - 0x3c], eax
xor esi, esi
call fcn.004355f2
push 0x4b80
mov dword [ebp - 0x40], eax
call fcn.004355f2
push 0x4b4d
mov edi, eax
call fcn.004355f2
mov ebx, eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], ebx
test eax, eax
je 0x4074d3
test edi, edi
je 0x4074d3
test ebx, ebx
je 0x4074d3
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x44005c
push ecx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x2c], 0x760065
push ecx
mov dword [ebp - 0x28], 0x630069
mov dword [ebp - 0x24], 0x5c0065
mov dword [ebp - 0x20], 0x610048
mov dword [ebp - 0x1c], 0x640072
mov dword [ebp - 0x18], 0x690064
mov dword [ebp - 0x14], 0x6b0073
mov dword [ebp - 0x10], 0x5c0030
mov dword [ebp - 0xc], 0x520044
mov dword [ebp - 8], 0x30
call eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x80
lea eax, [ebp - 0x4c]
push eax
call edi
test eax, eax
jne 0x4074d3
push esi
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x38]
call fcn.004384b6
cmp al, 1
jne 0x4074ce
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4074ce
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x3c]
test edi, edi
je 0x4074cb
push 1
push ecx
push eax
push ebx
call fcn.0040844c
mov eax, dword [ebp - 0x34]
add ebx, 0x82c
dec edi
inc esi
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x4074a5
mov ebx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x38]
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x4074e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
push eax
push 0xa
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x44005c
push eax
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x5c0072
mov dword [ebp - 0x18], 0x380069
mov dword [ebp - 0x14], 0x340030
mov dword [ebp - 0x10], 0x700032
mov dword [ebp - 0xc], 0x740072
call fcn.004070ba
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x407556
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
push eax
push 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x44005c
push eax
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x5c0072
mov dword [ebp - 0x18], 0x62004b
mov dword [ebp - 0x14], 0x430064
mov dword [ebp - 0x10], 0x61006c
mov dword [ebp - 0xc], 0x730073
call fcn.004070ba
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x4075c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
push eax
push 9
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x44005c
push eax
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x5c0072
mov dword [ebp - 0x18], 0x6f004d
mov dword [ebp - 0x14], 0x630075
mov dword [ebp - 0x10], 0x61006c
mov dword [ebp - 0xc], 0x730073
call fcn.004070ba
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x407632
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
push eax
push 0xb
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x44005c
push eax
mov dword [ebp - 0x1c], 0x690072
mov dword [ebp - 0x18], 0x650076
mov dword [ebp - 0x14], 0x5c0072
mov dword [ebp - 0x10], 0x44004e
mov dword [ebp - 0xc], 0x530049
call fcn.004070ba
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x407692
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
push 5
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x44005c
push eax
mov dword [ebp - 0x1c], 0x690072
mov dword [ebp - 0x18], 0x650076
mov dword [ebp - 0x14], 0x5c0072
mov dword [ebp - 0x10], 0x630054
mov dword [ebp - 0xc], 0x690070
mov dword [ebp - 8], 0x70
call fcn.004070ba
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x4076f6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
push eax
push 6
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x44005c
push eax
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x5c0072
mov dword [ebp - 0x18], 0x73006e
mov dword [ebp - 0x14], 0x700069
mov dword [ebp - 0x10], 0x6f0072
mov dword [ebp - 0xc], 0x790078
call fcn.004070ba
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x407764
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
push eax
push 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x44005c
push eax
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x5c0072
mov dword [ebp - 0x1c], 0x6e0050
mov dword [ebp - 0x18], 0x4d0070
mov dword [ebp - 0x14], 0x6e0061
mov dword [ebp - 0x10], 0x670061
mov dword [ebp - 0xc], 0x720065
call fcn.004070ba
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x4077da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
push 7
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x44005c
push eax
mov dword [ebp - 0x18], 0x690072
mov dword [ebp - 0x14], 0x650076
mov dword [ebp - 0x10], 0x5c0072
mov dword [ebp - 0xc], 0x640074
mov dword [ebp - 8], 0x78
call fcn.004070ba
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x407836
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x4b47
mov dword [ebp - 0x40], eax
xor esi, esi
call fcn.004355f2
push 0x4b80
mov dword [ebp - 0x44], eax
call fcn.004355f2
push 0x4b4d
mov edi, eax
call fcn.004355f2
mov ebx, eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], ebx
test eax, eax
je 0x40795e
test edi, edi
je 0x40795e
test ebx, ebx
je 0x40795e
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 0x44005c
push ecx
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x30], 0x760065
push ecx
mov dword [ebp - 0x2c], 0x630069
mov dword [ebp - 0x28], 0x5c0065
mov dword [ebp - 0x24], 0x610048
mov dword [ebp - 0x20], 0x640072
mov dword [ebp - 0x1c], 0x690064
mov dword [ebp - 0x18], 0x6b0073
mov dword [ebp - 0x14], 0x6f0056
mov dword [ebp - 0x10], 0x75006c
mov dword [ebp - 0xc], 0x65006d
mov dword [ebp - 8], 0x31
call eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x80
lea eax, [ebp - 0x50]
push eax
call edi
test eax, eax
jne 0x40795e
push esi
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x3c]
call fcn.004384b6
cmp al, 1
jne 0x407959
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x407959
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x40]
test edi, edi
je 0x407956
push 3
push ecx
push eax
push ebx
call fcn.0040844c
mov eax, dword [ebp - 0x38]
add ebx, 0x82c
dec edi
inc esi
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x407930
mov ebx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x3c]
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8