joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c350
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x880
mov eax, dword [0x4663d8]
xor eax, esp
mov dword [esp + 0x87c], eax
mov eax, dword [esp + 0x888]
push ebx
mov ebx, dword [esp + 0x8a0]
push ebp
mov ebp, dword [esp + 0x8a0]
push esi
mov esi, dword [esp + 0x890]
push edi
push esi
mov edi, ecx
lea ecx, [esp + 0x684]
push 0x104
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], eax
call fcn.0043a1a2
add esp, 0xc
push 0x456b24
lea edx, [esp + 0x684]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x684]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x41c400
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.__Error_0x_X_retrieving_folder_contents
push 0x4676b8
xor eax, eax
call fcn.0042dae0
add esp, 0xc
jmp 0x41c577
mov ecx, 0x456b30
lea eax, [esp + 0x4c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c436
test dx, dx
je 0x41c432
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c436
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c410
xor eax, eax
jmp 0x41c43b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41c545
mov ecx, 0x456b34
lea eax, [esp + 0x4c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c476
test dx, dx
je 0x41c472
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c476
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c450
xor eax, eax
jmp 0x41c47b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41c545
push esi
lea edx, [esp + 0x47c]
push 0x104
push edx
call fcn.0043a1a2
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0xc
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x47c]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x274]
push 0x104
push eax
call fcn.0043a1a2
add esp, 0xc
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x274]
push edx
call esi
test byte [esp + 0x20], 0x10
je 0x41c511
mov eax, dword [esp + 0x8a4]
mov ecx, dword [esp + 0x8a0]
mov edx, dword [esp + 0x89c]
push ebx
push ebp
push eax
push ecx
push edx
lea eax, [esp + 0x284]
push eax
lea ecx, [esp + 0x490]
push ecx
mov ecx, edi
call fcn.0041c350
jmp 0x41c53b
mov edx, dword [esp + 0x8a4]
mov eax, dword [esp + 0x89c]
push ebp
push edx
push eax
lea ecx, [esp + 0x27c]
push ecx
lea edx, [esp + 0x488]
push edx
mov edx, ebx
mov ecx, edi
call fcn.0041c700
mov esi, eax
test esi, esi
jne 0x41c56c
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41c400
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x12
jne 0x41c56c
xor esi, esi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x88c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437ffa
add esp, 0x880
ret 0x1c
Function at 0x41c5a0
Capabilities:
Copy file
Get common file path
Move file

Disassembly:
sub esp, 0x41c
mov eax, dword [0x4663d8]
xor eax, esp
mov dword [esp + 0x418], eax
push ebp
mov ebp, dword [esp + 0x424]
push edi
lea eax, [esp + 0x218]
push eax
push 0x104
mov edi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x459ef8
lea edx, [esp + 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0
push 3
push 0
push 1
push 0x20000
lea ecx, [esp + 0x28]
push ecx
mov dword [esi], 0
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41c64b
push esi
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 8]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 4
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x41c6a8
push str.____Transfering_source_file_security
push 0x4676b8
call fcn.0042dae0
mov ecx, dword [esp + 0x14]
add esp, 8
push 0
push ecx
push 0
push 0
push 0x80000004
push 1
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov eax, dword [esp + 8]
test eax, eax
je 0x41c6a8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 5
push ebp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x10]
push ecx
push str.____Source:__s
push 0x4676b8
xor eax, eax
call fcn.0042dae0
push ebp
push str.____Destination:__s
push 0x4676b8
xor eax, eax
call fcn.0042dae0
mov ecx, dword [esp + 0x438]
add esp, 0x18
pop edi
pop ebp
xor ecx, esp
call fcn.00437ffa
add esp, 0x41c
ret 4
Function at 0x41cdb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x451bd6
mov eax, dword fs:[0]
push eax
sub esp, 0xa54
mov eax, dword [0x4663d8]
xor eax, esp
mov dword [esp + 0xa50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4663d8]
xor eax, esp
push eax
lea eax, [esp + 0xa68]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa78]
mov ebp, dword [esp + 0xa7c]
mov dword [esp + 0x20], ecx
xor ecx, ecx
or edi, 0xffffffff
mov dword [esp + 0x1c], 0x400
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ecx
mov word [esp + 0x44], cx
mov dword [esp + 0xa70], ecx
cmp byte [eax + 0x3e], cl
je 0x41cf55
add eax, 0x18
push eax
mov ebx, str.Uninstall
lea esi, [esp + 0x28]
call fcn.00410820
add esp, 4
push edi
push 0
lea ecx, [esp + 0x48]
mov byte [esp + 0xa78], 1
call fcn.00404010
mov esi, 8
mov byte [esp + 0xa70], 0
cmp dword [esp + 0x3c], esi
jb 0x41ce74
mov edx, dword [esp + 0x28]
push edx
call fcn.00439935
add esp, 4
cmp dword [esp + 0x58], esi
mov eax, dword [esp + 0x44]
jae 0x41ce82
lea eax, [esp + 0x44]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, edi
add edi, 1
push edi
push ebp
lea edx, [esp + 0x64]
push str._s_d
push edx
call esi
mov ecx, dword [esp + 0x28]
add esp, 0x10
push 0
push 0
push 0
push 0
lea eax, [esp + 0x6c]
push eax
push ecx
call ebx
cmp eax, 2
jne 0x41ceb0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x268]
push eax
mov eax, dword [esp + 0x28]
call fcn.004368e0
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [ecx + ecx]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x268]
push eax
push 7
push 0
lea ecx, [esp + 0x6c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x41cf36
push eax
push str.Error_creating_uninstall_key_0x_X
push 0x4676b8
mov eax, 2
call fcn.0042dae0
add esp, 0xc
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x58], 8
jb 0x41cf55
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00439935
add esp, 4
mov ecx, dword [esp + 0xa68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa50]
xor ecx, esp
call fcn.00437ffa
add esp, 0xa60
ret 8
Function at 0x4242b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x220
mov eax, dword [0x4663d8]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x228]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
mov ebx, edx
lea edx, [esp + 0x20]
push 0x104
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
call fcn.0043a1a2
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x424463
test al, 0x10
jne 0x424463
push edi
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
invalid
invalid
inc eax
inc ebx
inc ebp

Function at 0x4243f2
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x42442d
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x424414
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x424425
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x42442f
inc edi
add eax, 0x28
cmp edi, esi
jb 0x42440a
xor eax, eax
pop edi
pop esi
ret
Function at 0x4246b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004243b2
pushal
xor bh, byte [esi + 0x64]
lea eax, [ebp - 0x40]
push eax
call fcn.004243c2
push eax
push esi
push dword [ebp + 8]
call fcn.00424377
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.004243b2
push edi
cmp byte [edx + ecx*2 - 0x7717ba73], dh
pop ebp
call 0xe99fcf73
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004243c2
push eax
push esi
push dword [ebp + 8]
call fcn.00424377
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004243c2
push eax
push esi
push dword [ebp + 8]
call fcn.00424377
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004243c2
push eax
push esi
push dword [ebp + 8]
call fcn.00424377
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004243b2
in al, dx
adc dword [edi], edx
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
invalid
inc ebp
invalid
Function at 0x424920
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00424323
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x4248ef
call fcn.004243b2
mov esi, 0x8be5d565
jle 0x42496a
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x424ba1
add eax, esi
mov dword [ebp - 0x44], eax
jmp [ecx]

Function at 0x424a80
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x424a89
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x424aa7
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x424b05
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x424aec
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x424af5
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x424aff
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x424ae1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x424a6b
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x425060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb byte [esi + 0x1046808], 0
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x42507b
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x4250a6
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je fcn.00425270
cmp dword [ebp + 0xc], 1
je fcn.00425270
cmp dword [ebp + 0xc], 8
jne 0x425238
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.004243c2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00424377
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.004243b2
xchg ebx, eax
pop ds
jle 0x425263
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042458e
add esp, 0x14
call fcn.004243b2
popfd
cmc
into
jg 0x42520f
push dword [ebp - 0x698]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
mov eax, dword [ebp - 0x33c]
mov esp, dword [ebp + 0x1c]
mov dword [esp - 4], eax
popal
add esp, 0x14
jmp dword [esp - 0x38]
mov ch, 0x68
stc
invalid
call fcn.004243b2
retf
enter 0xfffffffffffffffa, 0xffffffffffffffff
call fcn.004243b2
fmul qword [ebx]
xchg dword [eax + eax*4 - 0x5b], edi
invalid
movsd dword es:[edi], dword [esi]
sar ch, 1
invalid
Function at 0x425270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb byte [esi + 0x1046808], 0
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x42507b
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x4250a6
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je fcn.00425270
cmp dword [ebp + 0xc], 1
je fcn.00425270
cmp dword [ebp + 0xc], 8
jne 0x425238
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.004243c2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00424377
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.004243b2
xchg ebx, eax
pop ds
jle 0x425263
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042458e
add esp, 0x14
call fcn.004243b2
popfd
cmc
into
jg 0x42520f
push dword [ebp - 0x698]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
mov eax, dword [ebp - 0x33c]
mov esp, dword [ebp + 0x1c]
mov dword [esp - 4], eax
popal
add esp, 0x14
jmp dword [esp - 0x38]
mov ch, 0x68
stc
invalid
call fcn.004243b2
retf
enter 0xfffffffffffffffa, 0xffffffffffffffff
call fcn.004243b2
fmul qword [ebx]
xchg dword [eax + eax*4 - 0x5b], edi
invalid
movsd dword es:[edi], dword [esi]
sar ch, 1
invalid
Function at 0x425880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec edi
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
pop eax
pop eax
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.004243b2
lahf
jecxz 0x425841
xchg esi, eax
lea eax, [ebp - 0x72c]
push eax
call fcn.004243c2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00424377
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.004243b2
pop ss
cmpsd dword [esi], dword es:[edi]
lea eax, [ebp - 0x718]
push eax
push 0x40
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
push 5
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0x3a8]
call fcn.00424323
add esp, 0xc
lea eax, [ebp - 0x718]
push eax
push dword [ebp - 0x718]
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
call fcn.004243b2
and byte [eax], cl
sub cl, byte [eax - 0x6ff5a7d]
invalid
Function at 0x426dd0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
sub esp, 0x410
mov eax, dword [0x4663d8]
xor eax, esp
mov dword [esp + 0x408], eax
cmp dword [edi + 0xaec], 8
push ebx
push ebp
push esi
lea ebp, [edi + 0xa88]
jb 0x426dfe
mov eax, dword [edi + 0xad8]
jmp 0x426e04
lea eax, [edi + 0xad8]
push eax
lea eax, [esp + 0x14]
push 0x104
push eax
call fcn.0043a1a2
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0xc
push str.MediaSDK
lea ecx, [esp + 0x14]
push ecx
call esi
cmp byte [edi + 0xb14], 0
mov eax, 0x45b630
jne 0x426e3c
mov eax, 0x45b638
push eax
lea edx, [esp + 0x14]
push edx
call esi
push str.config.ini
lea eax, [esp + 0x14]
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
push str.Looking_for_MediaSDK_configuration__s
push 0x4676b8
xor eax, eax
call fcn.0042dae0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x426f97
push str.Reading_config.ini
push 0x4676b8
xor eax, eax
call fcn.0042dae0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0xfa
lea ecx, [esp + 0x220]
push ecx
push 0x456938
push str.version
push str.Setup
call esi
lea edx, [esp + 0x218]
push edx
push str.__SDK_version___s
push 0x4676b8
xor eax, eax
call fcn.0042dae0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0xfa
lea ecx, [esp + 0x220]
push ecx
push 0x456938
push str.merit
push str.Setup
call esi
push ebp
lea ebx, [esp + 0x21c]
mov edx, str.MSDK_MERIT
call fcn.00425880
mov edx, ebx
push edx
push str.__Merit___s
push 0x4676b8
xor eax, eax
call fcn.0042dae0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0xfa
mov ecx, ebx
push ecx
push 0x456938
push str.apiversion
push str.Setup
call esi
push ebp
mov edx, str.MSDK_APIVERSION
call fcn.00425880
mov edx, ebx
push edx
push str.__APIVersion___s
push 0x4676b8
xor eax, eax
call fcn.0042dae0
add esp, 0xc
cmp byte [edi + 0xb14], 0
mov ebx, 0x45b630
jne 0x426f74
mov ebx, 0x45b638
push ebp
mov edx, str.MSDK_SRC
call fcn.00425880
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00437ffa
add esp, 0x410
ret
push str.config.ini_not_found
push 0x4676b8
mov eax, 1
call fcn.0042dae0
mov ecx, dword [esp + 0x41c]
add esp, 8
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437ffa
add esp, 0x410
ret