joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x591af8
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x42ca52
movzx ecx, word [esi + eax]
test cx, cx
je 0x42ca52
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x42ca34
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x42f2a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 4
push 0x5426fc
push 0
call fcn.004410b0
cmp eax, 6
jne 0x42f2d5
push 1
push 0
push 0
lea ecx, [ebp - 1]
call fcn.0042c100
push eax
push 0x53ec60
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x4302b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527b96
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x43035c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x43035c
call fcn.0041ca00
mov edi, eax
jmp 0x43047b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x43037f
call fcn.0041ca00
jmp 0x43046e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x43039d
call fcn.0041ca00
jmp 0x43046e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4303be
mov edi, 0x8007000e
jmp 0x430470
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x4304b4
jb 0x4303dc
cmp eax, 0xffffffff
ja 0x4304b4
cmp eax, 0x400
jbe 0x4303f1
push eax
lea ecx, [ebp - 0x418]
call fcn.0042d220
jmp 0x430417
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x430417
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x43042e
mov edi, 0x8007000e
jmp 0x430470
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x43044e
call fcn.0041ca00
jmp 0x43046e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00430110
mov edi, eax
test esi, esi
je 0x43047b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x430494
lea ecx, [ebp - 0x418]
call fcn.0042df60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00408fc0
int3
Function at 0x431f20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004b2720
add esp, 0xc
mov dword [ebp - 0x424], 1
lea ecx, [ebp - 0x415]
mov dword [ebp - 0x420], 0x104
call fcn.0042ba70
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x424]
push ecx
push 0x53ec84
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x432064
lea ecx, [ebp - 0x415]
call fcn.0042bc30
push eax
lea ecx, [ebp - 0x41c]
call fcn.00408540
lea eax, [ebp - 0x41c]
push eax
call fcn.0041dbd0
mov ecx, eax
call fcn.00417730
mov edx, dword [ebp - 0x41c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x431fde
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.bizhi
call fcn.0041dbd0
mov ecx, eax
call fcn.004177f0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004b2720
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x58d56c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041dbd0
mov ecx, eax
call fcn.004176a0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.exist_wp
mov dword [eax + 0x24], 0
call fcn.0041dbd0
mov ecx, eax
call fcn.00417290
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
call fcn.0042e030
mov ecx, eax
call fcn.00423b20
test eax, eax
jne 0x432158
push 1
call fcn.0041efc0
add esp, 4
test eax, eax
jne 0x432158
lea ecx, [ebp - 0x415]
call fcn.0042c840
push eax
lea ecx, [ebp - 0x41c]
call fcn.00408540
lea eax, [ebp - 0x41c]
push eax
call fcn.0041dbd0
mov ecx, eax
call fcn.00417730
mov edx, dword [ebp - 0x41c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4320d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.bizhi
call fcn.0041dbd0
mov ecx, eax
call fcn.004177f0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004b2720
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x58d56c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041dbd0
mov ecx, eax
call fcn.004176a0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.giveup
mov dword [eax + 0x24], 0
call fcn.0041dbd0
mov ecx, eax
call fcn.00417290
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
cmp dword [0x58d628], 0
jne 0x432189
push 0
lea ecx, [ebp - 0x415]
mov dword [0x58d628], 1
call fcn.0042c3a0
push eax
push 0
push dword [0x58d56c]
call fcn.0042f6a0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, dword [0x58827c]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x4321a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push 0x208
push 0
push eax
call fcn.004b2720
add esp, 0xc
mov dword [ebp - 0x420], 1
lea ecx, [ebp - 0x415]
mov dword [ebp - 0x41c], 0x104
call fcn.0042b990
lea ecx, [ebp - 0x41c]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x420]
push ecx
push 0x53ec84
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4322c7
push esi
call fcn.0042e030
mov ecx, eax
call fcn.00422c90
call fcn.0042e030
mov ecx, eax
call fcn.00422550
push eax
call fcn.0041dbd0
mov ecx, eax
call fcn.00417730
push str.bizhi
call fcn.0041dbd0
mov ecx, eax
call fcn.004177f0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004b2720
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x58d56c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041dbd0
mov ecx, eax
call fcn.004176a0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.exist_wp
mov dword [eax + 0x24], 0
call fcn.0041dbd0
mov ecx, eax
call fcn.00417290
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
call fcn.0042e030
mov ecx, eax
call fcn.00423b20
test eax, eax
jne 0x43239a
push 1
call fcn.0041efc0
add esp, 4
test eax, eax
jne 0x43239a
push esi
call fcn.0042e030
mov ecx, eax
call fcn.00422c90
call fcn.0042e030
mov ecx, eax
call fcn.00422550
push eax
call fcn.0041dbd0
mov ecx, eax
call fcn.00417730
push str.bizhi
call fcn.0041dbd0
mov ecx, eax
call fcn.004177f0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004b2720
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x58d56c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041dbd0
mov ecx, eax
call fcn.004176a0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.giveup
mov dword [eax + 0x24], 0
call fcn.0041dbd0
mov ecx, eax
call fcn.00417290
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
cmp dword [0x58d628], 0
jne 0x4323c0
push 0
push esi
push 0
push dword [0x58d56c]
mov dword [0x58d628], 1
call fcn.0042f6a0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, dword [0x58827c]
xor ecx, ebp
pop esi
call fcn.00498678
mov esp, ebp
pop ebp
ret

Function at 0x432480
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.00425af0
test eax, eax
je 0x4324a8
push 0x1000
push 0x58f630
push 0x58d630
call fcn.0042d320
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
call fcn.0042f6a0
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4332c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x591f38
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x4333f2
movzx ecx, word [esi + eax]
test cx, cx
je 0x4333f2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4333d4
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x433410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x592058
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x433542
movzx ecx, word [esi + eax]
test cx, cx
je 0x433542
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x433524
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x433560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x591c60
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x433692
movzx ecx, word [esi + eax]
test cx, cx
je 0x433692
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x433674
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x4336b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x592118
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x4337e2
movzx ecx, word [esi + eax]
test cx, cx
je 0x4337e2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4337c4
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x433800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x591e60
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x433932
movzx ecx, word [esi + eax]
test cx, cx
je 0x433932
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x433914
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x433950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x591d80
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x433a82
movzx ecx, word [esi + eax]
test cx, cx
je 0x433a82
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x433a64
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x433d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x591cf0
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x433e72
movzx ecx, word [esi + eax]
test cx, cx
je 0x433e72
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x433e54
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret

Function at 0x434130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x64], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x64]
mov eax, 0x591bc0
mov dword [ebp - 0x60], 0x700074
push edi
mov dword [ebp - 0x5c], 0x2f003a
mov edx, 0x2f
mov dword [ebp - 0x58], 0x64002f
sub esi, eax
mov dword [ebp - 0x54], 0x2e0064
mov dword [ebp - 0x50], 0x720062
mov dword [ebp - 0x4c], 0x77006f
mov dword [ebp - 0x48], 0x650073
mov dword [ebp - 0x44], 0x2e0072
mov dword [ebp - 0x40], 0x360033
mov dword [ebp - 0x3c], 0x2e0030
mov dword [ebp - 0x38], 0x6e0063
mov dword [ebp - 0x34], 0x73002f
mov dword [ebp - 0x30], 0x610074
mov dword [ebp - 0x2c], 0x690074
mov dword [ebp - 0x28], 0x2f0063
mov dword [ebp - 0x24], 0x2f0061
mov dword [ebp - 0x20], 0x350037
mov dword [ebp - 0x1c], 0x2e0038
mov dword [ebp - 0x18], 0x320032
mov dword [ebp - 0x14], 0x340035
mov dword [ebp - 0x10], 0x67002e
mov dword [ebp - 0xc], 0x660069
nop dword [eax]
lea ecx, [edx + 0x7fffffcf]
test ecx, ecx
je 0x43421e
movzx ecx, word [esi + eax]
test cx, cx
je 0x43421e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x434200
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret