joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4037b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.004034f0
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40383b
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x2021f
push 0
push 0
push 0
push str.SOFTWARENVIDIA_CorporationGlobalStereo3DPersistent
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40383b
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 4
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push str.3D_Vision
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403831
cmp dword [ebp - 0x10], 0
jne 0x403831
push str._update
call fcn.00403660
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4041c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x433b34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.00414300
add esp, 0xc
mov byte [ebp - 0x135], 0
mov byte [ebp - 0x135], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x40421e
jmp 0x4042ed
mov dword [ebp - 0x130], 0x128
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4042d1
push str.SDManifoldsComEx.exe
lea eax, [ebp - 0x10c]
push eax
call fcn.00414cc9
add esp, 8
test eax, eax
jne 0x4042b6
mov ecx, dword [ebp - 0x128]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x13c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x13c], 0
je 0x4042b6
push 0
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x135], 1
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404243
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, byte [ebp - 0x135]
test ecx, ecx
jne 0x4041fa
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413572
mov esp, ebp
pop ebp
ret

Function at 0x404300
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x434efc], eax
mov ecx, dword [ebp + 0xc]
mov dword [0x434f00], ecx
mov edx, dword [ebp + 8]
mov dword [0x434f10], edx
mov eax, dword [ebp + 0x10]
mov dword [0x434f14], eax
mov ecx, 0x434f98
call fcn.00405d60
mov ecx, 0x434f98
call fcn.00405d60
push 0x434f18
push 0
push 0x434efc
push 0x404460
push 0
push 0
call fcn.00414e1c
add esp, 0x18
mov dword [0x434f04], eax
push 0x434f0c
push 0
push 0x434f10
push 0x4043b0
push 0
push 0
call fcn.00414e1c
add esp, 0x18
mov dword [0x434f08], eax
cmp dword [0x434f04], 0
je 0x404399
cmp dword [0x434f08], 0
je 0x404399
mov dword [ebp - 4], 1
jmp 0x4043a0
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x404a10
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
xor ecx, ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov dword [ebp - 7], ecx
mov word [ebp - 3], cx
mov byte [ebp - 1], cl
mov dword [ebp - 0x3c], 0
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x3c], 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 1
push 1
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x404b7c
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x3c]
push eax
push 0x4e20
push 0x2000
push 0x2000
push 0xff
push 0
push 0x80000003
push str..pipe_stereosvrpipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x404aff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x44], eax
jmp 0x404b7c
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
mov edx, dword [ebp - 0x48]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x404b24
jmp 0x404b7c
mov ecx, 0x434f98
call fcn.00405d60
lea ecx, [ebp - 0x40]
push ecx
push 0
mov edx, dword [ebp - 0x2c]
push edx
push 0x4049a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x404b5c
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404b70
mov ecx, 0x434f98
call fcn.00405d90
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c], 0
jmp 0x404a9e
cmp dword [ebp - 0x2c], 0
je 0x404b8c
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x404cc0
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
cmp eax, dword [ebp + 0xc]
je 0x404d89
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x18]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3e8
jae 0x404d0e
mov dword [ebp - 8], 0x3e8
jmp 0x404d1e
cmp dword [ebp - 8], 0x2710
jbe 0x404d1e
mov dword [ebp - 8], 0x2710
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x404d41
xor al, al
jmp 0x404d8b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x404d50
mov al, 1
jmp 0x404d8b
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
cmp eax, dword [ebp - 4]
jbe 0x404d6f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 4], edx
jmp 0x404d84
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0x18]
jbe 0x404d84
xor al, al
jmp 0x404d8b
jmp 0x404cdb
mov al, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x404da0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x404dc2
xor eax, eax
jmp 0x404df2
cmp dword [ebp - 0x18], 2
jne 0x404de5
push 4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00404cc0
mov byte [ebp - 0x1d], al
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
jne 0x404de5
xor eax, eax
jmp 0x404df2
xor eax, eax
cmp dword [ebp - 0x18], 4
setne al
lea eax, [eax + eax + 1]
mov esp, ebp
pop ebp
ret
Function at 0x405020
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x433b34]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 5], 0
mov ecx, 0x434f68
call fcn.00405c50
push 0x435fc8
call fcn.00401000
add esp, 4
mov eax, dword [0x435fc8]
sub eax, dword [0x435fc0]
mov ecx, dword [0x435fcc]
sbb ecx, dword [0x435fc4]
push 0
push 0x989680
push ecx
push eax
call fcn.00414fa0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x21
jle 0x405086
mov dword [0x435fb8], 0
mov edx, dword [0x435fb8]
add edx, 1
mov dword [0x435fb8], edx
cmp dword [0x435fb8], 7
jl 0x4050c3
cmp dword [ebp - 4], 0x21
jg 0x4050b9
mov eax, 0x21
sub eax, dword [ebp - 4]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x435fb8], 1
cmp dword [0x434f60], 0
jne 0x4050d1
call fcn.00404fb0
cmp dword [0x434f60], 0
je 0x4050ec
push 0x1388
mov ecx, dword [0x434f60]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x104
lea edx, [ebp - 0x118]
push edx
push str._SystemRoot_System32_taskkill.exe__F__IM_dwm.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x118]
push eax
call fcn.00414a48
add esp, 4
push 0x435fc0
call fcn.00401000
add esp, 4
mov ecx, dword [0x434f60]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, 0x434f68
call fcn.00405c70
mov al, byte [ebp - 5]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00413572
mov esp, ebp
pop ebp
ret
Function at 0x405be0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0x20219
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallNVIDIAStereo
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405c3e
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.InstallLocation
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405c34
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x406000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x433b34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
push 0x105
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40606e
mov ecx, dword [ebp + 8]
push ecx
push 0x42ab40
lea edx, [ebp - 0x110]
push edx
call fcn.00414b30
add esp, 4
lea eax, [ebp + eax - 0x110]
push eax
call fcn.00413a44
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413572
mov esp, ebp
pop ebp
ret
Function at 0x408490
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4084bc
xor al, al
jmp 0x40855e
push 0xf01ff
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x408547
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x40852b
lea edx, [ebp - 0x28]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x2c], 0
je 0x40852b
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40852b
cmp dword [ebp - 0x24], 1
je 0x40852b
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408509
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x40853d
mov byte [ebp - 5], 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0xc]
call eax
mov esp, ebp
pop ebp
ret

Function at 0x408810
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x433b34]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x9c
push 0
lea eax, [ebp - 0xa8]
push eax
call fcn.00414300
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 6
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413572
mov esp, ebp
pop ebp
ret

Function at 0x413572
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433b34]
jne 0x41357c
repz ret
jmp fcn.00419078

Function at 0x41f250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41f281
call fcn.00415e11
mov dword [eax], esi
call fcn.00415dfe
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004152d1
add esp, 0x14
push 0x16
pop eax
jmp 0x41f2d6
test dword [ebp + 0xc], 0xfffffff9
jne 0x41f25d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41f2ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00415e24
pop ecx
call fcn.00415dfe
mov eax, dword [eax]
jmp 0x41f2d6
test al, 0x10
jne 0x41f2d4
test al, 1
je 0x41f2d4
test byte [ebp + 0xc], 2
je 0x41f2d4
call fcn.00415e11
mov dword [eax], 5
call fcn.00415dfe
mov dword [eax], 0xd
jmp 0x41f2a5
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4246aa
Capabilities:
Inspect section memory permissions

Disassembly:
jne 0x4246b5
cmp dword [eax + 0xc], ebx
je 0x424758
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00424110
fisttp dword [esi - 0x68]
mov ch, 0x39
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
add al, 0xeb
rol byte [ebx - 0x74eb43bb], 0xbd
js 0x42474d
invalid
invalid
call fcn.00424110
jae 0x424743
les edi, [0xa0878b]
add byte [eax], al
cmp eax, ebx
je 0x4247c4
add eax, esi
cmp dword [eax], ebx
je 0x4247c4
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x4247bf
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x4247a9
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4247b1
cmp edx, ebx
jne 0x4248ff
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x424780
add eax, dword [eax + 4]
jmp 0x42476d
mov dword [ebp + 0xc], ebx
jmp 0x4247cf
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4247e7
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x424805
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x424863
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x42484a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x424853
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x42485d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x42483f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4247c9
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4248b0
dec eax
je 0x4248a7
sub eax, 3
je 0x42489e
mov dword [ebp - 4], 0x40
jmp 0x4248cd
mov dword [ebp - 4], 4
jmp 0x4248b3
mov dword [ebp - 4], 0x20
jmp 0x4248b3
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4248ff
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x42487f
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00424110
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
Function at 0x425564
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x425566
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x425510
call fcn.00424110
sub ecx, ecx
push edi
xor al, byte [eax - 0x72b5b]
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00424110
nop
cwde
sbb al, 0x8d
test esp, edx
clc
invalid

Function at 0x425c9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x78a5b], al
inc dword [eax]
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00424120
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00424081
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x426088

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x289c468e
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x4b006751
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x450068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x10], eax
mov esi, ebx
push edi
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x402aff
mov esi, dword [ebx]
lea edi, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x402b21
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x402b10
mov esi, dword [ebp - 8]
mov eax, dword [esi + 0x18]
and eax, edx
mov edx, dword [esi + 0xc]
mov esi, dword [esi + 4]
mov dword [ebp - 8], esi
mov ecx, dword [edx + eax*8]
add eax, eax
mov edi, dword [edx + eax*4]
inc eax
mov dword [ebp - 0x14], edi
lea eax, [edx + eax*4]
mov dword [ebp - 0x18], eax
cmp edi, esi
jne 0x402b4c
mov eax, esi
jmp 0x402b50
mov eax, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
je 0x402c16
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x402b62
mov eax, dword [ebx]
mov esi, dword [ecx + 0x1c]
lea edi, [ecx + 8]
mov dword [ebp - 0x1c], esi
cmp esi, 8
mov esi, dword [ebp - 8]
jb 0x402b76
mov edi, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x20], edx
cmp edx, dword [ebp - 0xc]
jne 0x402bee
mov esi, edx
test edx, edx
je 0x402ba1
sub edi, eax
nop dword [eax]
mov dx, word [eax + edi]
cmp dx, word [eax]
jne 0x402beb
add eax, 2
sub esi, 1
jne 0x402b90
cmp dword [ebp - 0x1c], 8
lea edx, [ecx + 8]
jb 0x402bac
mov edx, dword [edx]
cmp dword [ebx + 0x14], 8
jb 0x402bb4
mov ebx, dword [ebx]
mov esi, dword [ebp - 0xc]
cmp esi, dword [ebp - 0x20]
jne 0x402bfb
test esi, esi
je 0x402bfe
sub ebx, edx
mov ax, word [edx + ebx]
cmp ax, word [edx]
jne 0x402bfb
add edx, 2
sub esi, 1
jne 0x402bc2
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aaeb
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 8]
mov ecx, dword [ecx]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x402b44
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aaeb
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.0041aaeb
mov esp, ebp
pop ebp
ret 8
Function at 0x403500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x450068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x40352d
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x403549
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x403538
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x403582
cmp eax, edi
jne 0x40357a
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x40358a
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x40358a
cmp eax, edi
jne 0x40358d
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [ecx], esi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.00403030
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.0041aaeb
mov esp, ebp
pop ebp
ret 8