joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401650
Capabilities:
Hide graphical window

Disassembly:
push 0
push ecx
push 0
push 0
push 0
push SysReAllocString
push 0
push SysReAllocString
push 0xcf0000
push 0x57edd8
push 0x57eea0
push 0
mov dword [0x57edd0], ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x58036c], eax
test eax, eax
jne 0x40168e
xor eax, eax
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x58036c]
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00401960
test eax, eax
jne 0x40168b
push eax
push dword [0x58036c]
call dword [sym.imp.WTSAPI32.dll_WTSRegisterSessionNotification]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x401cd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1068
call fcn.004ff5c0
mov eax, dword [0x57c54c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x580370]
test eax, eax
je 0x401e29
lea ecx, [ebp - 0x808]
push ecx
push 0x15
push eax
call fcn.00407580
add esp, 0xc
test eax, eax
je 0x401d31
push 0
push 0x575144
push str.dfxuiInit.cpp
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1008]
push eax
push 0x16
push dword [0x580370]
call fcn.00407580
add esp, 0xc
test eax, eax
je 0x401d55
push 0
push 0x57514c
jmp 0x401d11
push 0x44
lea eax, [ebp - 0x1068]
push 0
push eax
call fcn.00503c50
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x1068], 0x44
push eax
lea eax, [ebp - 0x808]
mov dword [ebp - 0x103c], 1
push eax
call fcn.00476a90
add esp, 0x14
test eax, eax
je 0x401d9f
push 0
push 0x575154
jmp 0x401d11
cmp dword [ebp - 0x100c], 0
je 0x401dd1
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x1068]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1008]
push eax
call fcn.00476a90
add esp, 8
test eax, eax
je 0x401df7
push 0
push 0x57515c
jmp 0x401d11
cmp dword [ebp - 0x100c], 0
je 0x401e29
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x1068]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
Function at 0x401e40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x868
mov eax, dword [0x57c54c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x580370]
test eax, eax
je 0x401f48
lea ecx, [ebp - 0x809]
push ecx
push eax
call fcn.00402ab0
add esp, 8
test eax, eax
je 0x401e9b
push 0
push 0x575204
push str.dfxuiInit.cpp
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x809], 0
je 0x401f48
lea eax, [ebp - 0x808]
push eax
push 0x17
push dword [0x580370]
call fcn.00407580
add esp, 0xc
test eax, eax
je 0x401ecc
push 0
push 0x57520c
jmp 0x401e7b
push 0x44
lea eax, [ebp - 0x868]
push 0
push eax
call fcn.00503c50
lea eax, [ebp - 0x810]
mov dword [ebp - 0x868], 0x44
push eax
lea eax, [ebp - 0x808]
mov dword [ebp - 0x83c], 1
push eax
call fcn.00476a90
add esp, 0x14
test eax, eax
je 0x401f16
push 0
push 0x575214
jmp 0x401e7b
cmp dword [ebp - 0x810], 0
je 0x401f48
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x868]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret

Function at 0x404270
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.004ff5c0
mov eax, dword [0x57c54c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x404342
cmp dword [eax + 0x1dd24], 0
jne 0x404342
lea ecx, [ebp - 0x804]
push ecx
push 0x14
push eax
call fcn.00407580
add esp, 0xc
test eax, eax
je 0x4042d5
push str.1774
push str.dfxgdfxgInit.cpp
call fcn.0041afb0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push 0x53a71c
push eax
call fcn.00401870
push 0x44
lea eax, [ebp - 0x1058]
push 0
push eax
call fcn.00503c50
add esp, 0x18
mov dword [ebp - 0x1058], 0x44
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x102c], 1
push eax
lea eax, [ebp - 0x1058]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
Function at 0x406dc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x406e41
mov eax, dword [ebp + 0x14]
mov edx, 1
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [eax], 0
push edi
mov edi, 0x811c9dc5
test ebx, ebx
je 0x406e3e
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x406e3e
xor ecx, ecx
test esi, esi
je 0x406e13
mov al, byte [ecx + ebx]
test al, al
mov dword [ebp + 8], 0
movzx eax, al
cmovne edx, dword [ebp + 8]
xor eax, edi
inc ecx
imul edi, eax, 0x1000193
cmp ecx, esi
jb 0x406df3
imul eax, edi, 0x2001
mov ecx, eax
sar ecx, 7
xor ecx, eax
lea eax, [ecx + ecx*8]
mov ecx, eax
sar ecx, 0x11
xor ecx, eax
mov eax, ecx
shl eax, 5
add eax, ecx
xor ecx, ecx
cmp edx, 1
cmove eax, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret
Function at 0x416230
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4162f7
or dword [edi + 0x11250], 0x800
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x960
push ebx
mov dword [edi + 0x173ac], ebx
call esi
push 0x961
push ebx
mov dword [ebp - 0x10], eax
call esi
push 0x962
push ebx
mov dword [ebp + 8], eax
call esi
push 0x963
push ebx
mov dword [ebp - 4], eax
call esi
push 0x964
push ebx
mov dword [ebp - 8], eax
call esi
cmp dword [edi + 0x11280], 0
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0xc], eax
je 0x4162b5
push 0
push dword [ebp + 8]
call esi
push 5
push dword [ebp - 4]
call esi
push 5
jmp 0x4162c5
push 5
push dword [ebp + 8]
call esi
push 0
push dword [ebp - 4]
call esi
push 0
push dword [ebp - 8]
call esi
cmp dword [edi + 0x11284], 0
je 0x4162d7
push 5
jmp 0x4162d9
push 0
push dword [ebp - 0xc]
call esi
lea eax, [edi + 0x1128c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41a670
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41a6b6
cmp dword [esi + 0x1804], 0
je 0x41a6a0
push str.dfxg_CallExecThreadedSendInstallationEmail:_Calling_CreateThread
push esi
call fcn.00401870
mov ecx, dword [esi + 0x1000]
add esp, 8
mov eax, dword [ecx]
push esi
push 1
call dword [eax + 0x14]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x41a800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
pop esi
pop ebp
ret

Function at 0x41d480
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41d4bb
push 0
push dword [esi + 0x4340]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call fcn.0040d500
add esp, 4
test eax, eax
je 0x41d4bb
push 0x53d430
push str.dfxgdfxgWindowMain.cpp
call fcn.0041afb0
add esp, 8
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x41d4c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41d4d3
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x4340]
test eax, eax
je 0x41d4cc
cmp dword [ebp + 0xc], 0
push edi
je 0x41d700
cmp dword [esi + 0x4780], 0
je 0x41d689
cmp dword [esi + 0x1dd38], 0
jne 0x41d529
push 7
push esi
call fcn.00422790
add esp, 8
test eax, eax
je 0x41d6f8
push 0x54243c
push str.dfxgdfxgWindowMain.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.0041d480
add esp, 4
test eax, eax
je 0x41d54e
push 0x53dc5c
push str.dfxgdfxgWindowMain.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push str.displayNotificationWhenMinimzed
push esi
call fcn.0040d0d0
add esp, 0x10
test eax, eax
je 0x41d580
push 0x53c7e0
push str.dfxgdfxgWindowMain.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0
je 0x41d590
cmp dword [ebp - 4], 0
je 0x41d65d
cmp dword [ebp + 0x10], 0
je 0x41d65d
lea edi, [esi + 0x1828]
push edi
push 0x75f7
push esi
call fcn.0041afd0
add esp, 0xc
test eax, eax
je 0x41d5cb
push 0x5424b8
push str.dfxgdfxgWindowMain.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [esi + 0x4aa8]
mov ecx, edi
sub edx, edi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x41d5d5
push edi
push 0x75f8
push esi
call fcn.0041afd0
add esp, 0xc
test eax, eax
je 0x41d610
push 0x53d32c
push str.dfxgdfxgWindowMain.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 0x48a4]
sub ecx, edi
nop dword [eax + eax]
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x41d620
lea eax, [esi + 0x4784]
mov dword [esi + 0x4790], 0x16
push eax
push 1
mov dword [esi + 0x4b28], 0x11
mov dword [esi + 0x4aa4], 0x3e8
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push str.minimized_to_tray
push 1
push esi
call fcn.0040d830
add esp, 0xc
test eax, eax
je 0x41d6de
push 0x53d2d0
push str.dfxgdfxgWindowMain.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 6
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call fcn.0040dbf0
add esp, 8
test eax, eax
je 0x41d6b9
push 0x540178
push str.dfxgdfxgWindowMain.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.0040d500
add esp, 4
test eax, eax
je 0x41d6de
push 0x53d4bc
push str.dfxgdfxgWindowMain.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test dword [esi + 0x11250], 0x100000
je 0x41d6f8
push 0
push dword [esi + 0x173c8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
push esi
call fcn.0041d730
add esp, 8
test eax, eax
je 0x41d6f8
push 0x53cc18
push str.dfxgdfxgWindowMain.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x424a70
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0
push 0x8000
push 0x574250
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
je 0x424a50
push 0x540cd8
push str.dfxgdfxgPathsTopFolders.cpp
call fcn.0041afb0
add esp, 8
pop esi
pop ebp
ret
push dword [ebp + 8]
lea eax, [esi + 0x1acf4]
push 0x53a71c
push eax
call fcn.00401870
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop esi
pop ebp
ret

Function at 0x424a80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x424ab4
push 1
push 0x23
add eax, 0x174f4
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x424ab4
push 0x540c90
push str.dfxgdfxgPathsTopFolders.cpp
call fcn.0041afb0
add esp, 8
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x424b00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x57c54c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x424c0a
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x808]
push eax
push str.useMyDocuments
push esi
call fcn.0040d0d0
add esp, 0x10
test eax, eax
je 0x424b60
push 0x53b568
push str.dfxgdfxgPathsTopFolders.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x808], 0
je 0x424baa
cmp dword [ebp - 0x80c], 0
je 0x424baa
push 1
push 5
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x424be2
push 0x53fadc
push str.dfxgdfxgPathsTopFolders.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
push 1
push 0x1c
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x424be2
push 0x540ca8
push str.dfxgdfxgPathsTopFolders.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
push dword [esi + 0x1dd48]
lea eax, [esi + 0x1bcfc]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [esi + 0x184f4]
push str._s_s_d
push eax
call fcn.00401870
add esp, 0x14
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004ff105
mov esp, ebp
pop ebp
ret
Function at 0x425d80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3458
call fcn.004ff5c0
mov eax, dword [0x57c54c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x425f40
lea eax, [ebp - 0x2404]
push eax
push dword [esi + 0x34544]
call fcn.0045e6c0
add esp, 8
test eax, eax
je 0x425ddd
push 0x57506c
push str.dfxgdfxgRecord.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c04]
push eax
push dword [esi + 0x34544]
call fcn.0045e900
add esp, 8
test eax, eax
je 0x425e17
push 0x53ab7c
push str.dfxgdfxgRecord.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x404]
push eax
push dword [esi + 0x34544]
call fcn.0045e2a0
add esp, 8
test eax, eax
je 0x425e51
push 0x53adb0
push str.dfxgdfxgRecord.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
push str.WavToWma.exe
push str.Apps
add esi, 0x18cf4
lea eax, [ebp - 0xc04]
push esi
push str._s_s_s
push eax
call fcn.00401870
push str.WMEncoder.exe
push str.Apps
push esi
lea eax, [ebp - 0x1404]
push str._s_s_s
push eax
call fcn.00401870
lea eax, [ebp - 0x1404]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x1c04]
push eax
lea eax, [ebp - 0x2404]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x3404]
push str.__s____s____s____s____s_
push eax
call fcn.00401870
add esp, 0x44
lea eax, [ebp - 0x3458]
push 0x44
push 0
push eax
call fcn.00503c50
add esp, 0xc
mov dword [ebp - 0x3458], 0x44
lea eax, [ebp - 0x3414]
mov dword [ebp - 0x342c], 1
push eax
lea eax, [ebp - 0x3458]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x3404]
push eax
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x425f40
push 0x57509c
push str.dfxgdfxgRecord.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004ff105
mov esp, ebp
pop ebp
ret
Function at 0x4269b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x426b64
mov eax, dword [esi + 0x35590]
test eax, eax
je 0x4269e4
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
je 0x426b64
lea eax, [ebp + 8]
mov dword [esi + 0x35598], 0
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 1
push dword [esi + 0x3558c]
call fcn.00487240
add esp, 0x14
test eax, eax
je 0x426a25
push 0x54471c
push str.dfxgdfxgSndServer.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x426b0e
cmp dword [esi + 0x1804], 0
je 0x426a5e
push eax
push str.dfxg_ProcessSndServerTimer__:_sndDevicesReInit_failed__statusFlag___d
push 0x800
push esi
call fcn.00403400
mov ecx, dword [esi + 0x1000]
add esp, 0x10
mov eax, dword [ecx]
push esi
push 1
call dword [eax + 0x14]
mov eax, dword [ebp + 8]
cmp eax, 0xffffffc7
jne 0x426a96
lea eax, [esi + 0x1828]
push eax
push 0x7605
push esi
call fcn.0041afd0
add esp, 0xc
test eax, eax
je 0x426a93
push 0x53a990
push str.dfxgdfxgSndServer.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp eax, 0xffffffc6
jne 0x426acb
lea eax, [esi + 0x1828]
push eax
push 0x75fe
push esi
call fcn.0041afd0
add esp, 0xc
test eax, eax
je 0x426acb
push 0x53a998
push str.dfxgdfxgSndServer.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0x3599c], 0
jne 0x426b15
push 0
push 0
push 0
push 0
lea eax, [esi + 0x1828]
mov byte [esi + 0x3599c], 1
push eax
push esi
call fcn.00416000
add esp, 0x18
test eax, eax
je 0x426b15
push 0x53d4cc
push str.dfxgdfxgSndServer.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3599c], 0
cmp dword [ebp - 8], 0
jle 0x426b40
cmp dword [ebp - 0xc], 1
jne 0x426b40
lea eax, [esi + 0x35594]
push eax
push 0
push esi
push 0x427550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x35590], eax
push esi
call fcn.0042d2d0
add esp, 4
test eax, eax
je 0x426b64
push 0x542edc
push str.dfxgdfxgSndServer.cpp
call fcn.0041afb0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x435be0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x435c74
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x435c0d
pop edi
pop esi
mov dword [ebp + 0xc], 0x53d420
mov dword [ebp + 8], str.dfxgdfxgWindowGeneral.cpp
pop ebp
jmp fcn.0041afb0
cmp dword [esi + 0x1804], 0
je 0x435c33
push edi
push str.dfxg_BringUpWebsite:___s_
push esi
call fcn.00401870
mov ecx, dword [esi + 0x1000]
add esp, 0xc
mov eax, dword [ecx]
push esi
push 1
call dword [eax + 0x14]
push 5
push 0
push 0
push edi
push str.open
push dword [esi + 0x3f38]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x435c73
push edi
call fcn.0048e5b0
add esp, 4
test eax, eax
jns 0x435c73
pop edi
pop esi
mov dword [ebp + 0xc], 0x548738
mov dword [ebp + 8], str.dfxgdfxgWindowGeneral.cpp
pop ebp
jmp fcn.0041afb0
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4424c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.004407d3
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00440734
add esp, 0xc
jmp 0x44273b
Function at 0x4432c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2b14
call fcn.004ff5c0
mov eax, dword [0x57c54c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x44337e
lea eax, [ebp - 0x2b14]
push eax
push 0x7603
push esi
call fcn.0041afd0
add esp, 0xc
test eax, eax
je 0x443322
push 0x54319c
push str.dfxgdfxgDlgAskEmail.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x1c0fc]
push eax
lea eax, [ebp - 0x2b14]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.00401870
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push 0xa8f
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0
push 0xa90
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [esi + 0x11250], 0x2000
push edi
mov dword [esi + 0x17384], edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004ff105
mov esp, ebp
pop ebp
ret

Function at 0x4437f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x443821
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x443810
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x444e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x181c
call fcn.004ff5c0
mov eax, dword [0x57c54c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0x1808], eax
mov eax, dword [ebp + 0x2c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1814], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x181c], ecx
mov ecx, dword [ebp + 0x28]
mov dword [ebp - 0x1810], eax
mov eax, dword [ebp - 0x1808]
mov dword [ebp - 0x1818], ecx
push edi
mov edi, dword [ebp + 0x18]
test esi, esi
je 0x444fea
mov dword [edi], 3
mov dword [ebx], 0
mov dword [eax], 0
lea eax, [ebp - 0x1804]
push eax
push edx
lea eax, [esi + 0x101d0c]
mov dword [ecx], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.004446e0
add esp, 0x18
test eax, eax
je 0x444ebe
push 0x542364
push str.dfxpdfxpInternet.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x804]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x444ef7
push 0x53ae1c
push str.dfxpdfxpInternet.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x804]
push eax
call fcn.00475f50
add esp, 4
test eax, eax
je 0x444f2d
push 0x540180
push str.dfxpdfxpInternet.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push str._sdfxp_cgi_msg.txt
push eax
call fcn.00401870
lea eax, [ebp - 0x180c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1804]
push eax
push esi
call fcn.004447d0
add esp, 0x1c
test eax, eax
je 0x444f8a
push 0x53a970
push str.dfxpdfxpInternet.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x180c], 0
jne 0x444fea
push dword [ebp - 0x1810]
lea eax, [ebp - 0x1004]
push dword [ebp - 0x1814]
push dword [ebp - 0x1818]
push dword [ebp - 0x181c]
push dword [ebp - 0x1808]
push edi
push ebx
push eax
push esi
call fcn.004448a0
add esp, 0x24
test eax, eax
je 0x444fea
push 0x54471c
push str.dfxpdfxpInternet.cpp
call fcn.0041afb0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff105
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff105
mov esp, ebp
pop ebp
ret