joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004b98
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1008464]
and dword [ebp - 0x214], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x2001f
push 0
push 0x1001a7c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004c72
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov esi, 0x1001a68
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004c65
push 0x1001a4c
push 0x1001a30
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.01004655
xor edi, edi
inc edi
test eax, eax
je 0x1004c5f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push 0
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1004c65
mov dword [ebp - 0x214], edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
call fcn.0100637b
leave
ret 4
Function at 0x1004c8a
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1008464]
and dword [ebp - 0x210], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
mov dword [ebp - 0x218], eax
je 0x1004e3f
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x214]
push eax
mov ebx, 0xf003f
push ebx
push 0
push 0x10014d0
mov edi, 0x80000001
push edi
call esi
test eax, eax
jne 0x1004e3c
and word [ebp - 0x20c], ax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0x10014c0
push dword [ebp - 0x214]
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1004d28
and word [ebp - 0x20c], 0
lea eax, [ebp - 0x21c]
push eax
push ebx
push 0
push 0x1001ad0
push edi
call esi
test eax, eax
jne 0x1004e30
mov edi, 0x1001aa8
push edi
push dword [ebp - 0x218]
call dword [sym.imp.SETUPAPI.dll_SetupGetLineCountW]
test eax, eax
mov dword [ebp - 0x224], eax
jle 0x1004e24
and dword [ebp - 0x210], 0
test eax, eax
jle 0x1004e1a
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x210]
push edi
push dword [ebp - 0x218]
call dword [sym.imp.SETUPAPI.dll_SetupGetLineByIndexW]
test eax, eax
je 0x1004e02
push 1
lea eax, [ebp - 0x238]
push eax
call sub.SETUPAPI.dll_pSetupGetField
mov ebx, eax
test ebx, ebx
je 0x1004e02
cmp word [ebp - 0x20c], 0
je 0x1004df5
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1004df5
push 2
lea eax, [ebp - 0x238]
push eax
call sub.SETUPAPI.dll_pSetupGetField
mov esi, eax
test esi, esi
je 0x1004df5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push 0x10014c0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
inc dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x224]
jl 0x1004d71
mov dword [ebp - 0x210], 1
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
call fcn.0100637b
leave
ret 4
Function at 0x1004f9b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1008464]
and dword [ebp - 0x418], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.01003073
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.01003073
mov esi, 0x104
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01002a62
push esi
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.01002a62
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
je 0x1005036
test al, 0x10
jne 0x1005036
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0100373a
test eax, eax
je 0x1005036
mov dword [ebp - 0x418], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
call fcn.0100637b
leave
ret 0xc

Function at 0x1005246
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1008464]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, 0xffffffff
mov dword [ebp - 0x424], eax
jne 0x1005271
xor eax, eax
jmp 0x1005355
push ebx
mov ebx, 0x1001bb0
push ebx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupGetLineCountW]
cmp eax, esi
mov dword [ebp - 0x420], eax
jle 0x1005352
mov dword [ebp - 0x418], esi
jbe 0x100534f
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov edi, 0x104
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x424]
call dword [sym.imp.SETUPAPI.dll_SetupGetLineByIndexW]
test eax, eax
je 0x1005336
push 1
lea eax, [ebp - 0x438]
push eax
call sub.SETUPAPI.dll_pSetupGetField
test eax, eax
mov dword [ebp - 0x428], eax
je 0x1005336
push 2
lea eax, [ebp - 0x438]
push eax
call sub.SETUPAPI.dll_pSetupGetField
test eax, eax
mov dword [ebp - 0x41c], eax
je 0x1005336
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x428]
call esi
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x41c]
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100369e
test eax, eax
je 0x1005336
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.010036ec
inc dword [ebp - 0x418]
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0x420]
jb 0x10052a5
pop edi
xor esi, esi
inc esi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0100637b
leave
ret 4
Function at 0x1005367
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8a0
mov eax, dword [0x1008464]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, 0xffffffff
mov dword [ebp - 0x884], eax
jne 0x1005392
xor eax, eax
jmp 0x100559d
push 0x1001bd8
push eax
call dword [sym.imp.SETUPAPI.dll_SetupGetLineCountW]
cmp eax, esi
mov dword [ebp - 0x88c], eax
jle 0x100559b
mov dword [ebp - 0x878], esi
jbe 0x1005598
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, 0x104
lea eax, [ebp - 0x8a0]
push eax
push dword [ebp - 0x878]
push 0x1001bd8
push dword [ebp - 0x884]
call dword [sym.imp.SETUPAPI.dll_SetupGetLineByIndexW]
test eax, eax
je 0x100557e
push 1
lea eax, [ebp - 0x8a0]
push eax
call sub.SETUPAPI.dll_pSetupGetField
test eax, eax
mov dword [ebp - 0x870], eax
je 0x100557e
push 2
lea eax, [ebp - 0x8a0]
push eax
call sub.SETUPAPI.dll_pSetupGetField
test eax, eax
mov dword [ebp - 0x87c], eax
je 0x100557e
push 3
lea eax, [ebp - 0x8a0]
push eax
call sub.SETUPAPI.dll_pSetupGetField
test eax, eax
mov dword [ebp - 0x888], eax
je 0x100557e
push 4
lea eax, [ebp - 0x8a0]
push eax
call sub.SETUPAPI.dll_pSetupGetField
mov dword [ebp - 0x874], eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x870]
call edi
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x870]
call edi
push ebx
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x870]
call edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01002ae0
lea eax, [ebp - 0x61c]
push eax
call fcn.01002ae0
mov dword [ebp - 0x870], eax
lea eax, [ebp - 0x414]
push eax
call fcn.01002ae0
push dword [ebp - 0x87c]
mov dword [ebp - 0x890], eax
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x1001bd4
lea eax, [ebp - 0x20c]
push eax
call esi
push dword [ebp - 0x874]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x874], eax
je 0x100557e
push dword [ebp - 0x87c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp - 0x888]
lea eax, [ebp + eax*2 - 0x840]
push dword [ebp - 0x870]
mov dword [ebp - 0x880], eax
call esi
push dword [ebp - 0x880]
push dword [ebp - 0x870]
call esi
lea eax, [ebp - 0x840]
push eax
push dword [ebp - 0x890]
call esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0100373a
lea eax, [ebp - 0x86c]
push eax
push dword [ebp - 0x874]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1005504
push dword [ebp - 0x874]
call dword [sym.imp.KERNEL32.dll_FindClose]
inc dword [ebp - 0x878]
mov eax, dword [ebp - 0x878]
cmp eax, dword [ebp - 0x88c]
jb 0x10053cb
pop edi
pop ebx
xor esi, esi
inc esi
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
call fcn.0100637b
leave
ret 4
Function at 0x1005a86
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
mov ebx, 0xcb22
push ebx
push 0x40
call esi
push 0x19642
push 0x40
mov dword [ebp - 4], eax
call esi
test eax, eax
mov dword [ebp - 0xc], eax
je 0x1005b65
cmp dword [ebp - 4], 0
je 0x1005b65
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
call edi
push dword [ebp - 0xc]
mov esi, eax
call edi
push 0
mov edi, eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005b95
mov bx, word [esi]
mov word [edi], bx
movzx eax, word [esi]
imul eax, eax, 0x34
inc eax
inc eax
cmp dword [ebp - 8], eax
je 0x1005b1e
push dword [ebp - 8]
call fcn.01005a59
test eax, eax
je 0x1005b65
mov eax, dword [ebp - 8]
push 0x34
add eax, 0xfffffffe
xor edx, edx
pop ecx
div ecx
mov word [esi], ax
movzx eax, bx
test eax, eax
jle 0x1005b4c
add esi, 2
lea ebx, [edi + 2]
mov dword [ebp + 8], eax
push 0x68
push ebx
push 0x34
push esi
push 1
push 0x3a8
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add ebx, 0x68
add esi, 0x34
dec dword [ebp + 8]
jne 0x1005b2e
push 0
lea eax, [ebp - 8]
push eax
push 0x19642
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
jmp 0x1005b67
xor ebx, ebx
cmp dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x1005b83
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
cmp dword [ebp - 0xc], 0
je 0x1005b93
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1005ba1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1008464]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01002a62
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1001810
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1001df8
lea eax, [ebp - 0x414]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
push edi
push edi
push 3
push edi
push edi
push 0x80000000
lea eax, [ebp - 0x20c]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1005c56
push edi
push edi
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x414]
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x1005c5a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1005c79
push edi
push ebx
call fcn.01005a86
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov dword [ebp - 0x418], eax
call esi
push edi
call esi
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100637b
leave
ret 4
Function at 0x10061b9
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x1008464]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x670], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x668]
push eax
push 0x1001eb4
push 1
push 0
push 0x1001ec4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x10062ec
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax]
lea edx, [ebp - 0x66c]
push edx
push 0x1001ed4
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x10062e0
mov eax, dword [ebp - 0x66c]
mov ecx, dword [eax]
push 2
push edi
push eax
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jl 0x10062d4
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax]
push 5
push 0
push eax
call dword [ecx + 0x4c]
mov esi, eax
test esi, esi
jl 0x10062d4
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x664]
push edx
push 0x104
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x670]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01002d89
test eax, eax
je 0x10062d4
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax]
lea edx, [ebp - 0x414]
push edx
push eax
call dword [ecx + 0x50]
mov esi, eax
test esi, esi
jl 0x10062d4
mov eax, dword [ebp - 0x66c]
mov ecx, dword [eax]
push 1
push edi
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x66c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0100637b
leave
ret 0xc
Function at 0x1006493
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x1001ea8
call fcn.010066d8
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10064d0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10064d0
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10064e8
cmp eax, 0x20b
je 0x10064d5
mov dword [ebp - 0x1c], ebx
jmp 0x10064fc
cmp dword [ecx + 0x84], 0xe
jbe 0x10064d0
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x10064f6
cmp dword [ecx + 0x74], 0xe
jbe 0x10064d0
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100848c], 0xffffffff
or dword [0x1008490], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1008484]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1008480]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1008494], eax
call fcn.010066d0
cmp dword [0x1008470], ebx
jne 0x1006557
push fcn.010066d0
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010066b9
push 0x1008010
push 0x100800c
call sub.msvcrt.dll__initterm
mov eax, dword [0x100847c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1008478]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1008008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x10065ed
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x10065c1
cmp al, 0x22
jne 0x10065b3
cmp byte [esi], 0x22
jne 0x10065ca
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x10065d4
cmp al, 0x20
jbe 0x10065c6
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call fcn.01007172
add esi, esi
inc ebp
lodsb al, byte [esi]
add dword [ecx + edx + 0xf], esi
mov bh, 0x45
mov al, 0xeb
push cs
cmp byte [esi], 0x20
jbe 0x10065ca
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10065ed
Function at 0x401662
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x8000
call dword [sym.imp.MSVCR110.dll___iob_func]
push eax
call dword [sym.imp.MSVCR110.dll__fileno]
pop ecx
push eax
call dword [sym.imp.MSVCR110.dll__setmode]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.libav.dll_Ordinal_44286]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
add esp, 0x10
pop ebp
jmp fcn.0040169e

Function at 0x4022b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0xc]
mov dword [ebp - 8], 0x65764573
mov dword [ebp - 0xc], 0x75726956
mov word [ebp - 3], 0x74
mov byte [ebp - 4], 0x6e
call fcn.004071e5
leave
ret
Function at 0x40353a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
and dword [ebx], esi
push edi
mov dword [ebp - 8], edx
mov edi, ecx
cmp dword [ebp + 0xc], esi
je 0x40357f
cmp dword [0x40e708], esi
je 0x403705
push 0x40e6fc
call dword [sym.imp.libav.dll_Ordinal_24]
pop ecx
xor ecx, ecx
cmp eax, 1
cmove ecx, edi
mov eax, ecx
jmp 0x403707
test edi, edi
je 0x40359c
push edi
call dword [sym.imp.libav.dll_Ordinal_15]
xor ecx, ecx
mov esi, eax
call fcn.00406468
push edi
call dword [sym.imp.libav.dll_Ordinal_9]
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1c]
mov word [ebp - 0xc], 0x79
mov word [ebp - 0x17], 0x7361
mov dword [ebp - 0x1c], 0x61746144
mov word [ebp - 0x11], 0x6365
mov word [ebp - 0x14], 0x6944
mov word [ebp - 0xf], 0x6f74
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x18], 0x62
call fcn.004071e5
cmp dword [0x40e708], 0
mov eax, dword [eax + 8]
mov dword [ebp + 0x10], eax
mov ecx, 0x40e6fc
je 0x4035fd
push ecx
call dword [sym.imp.libav.dll_Ordinal_25]
pop ecx
mov ecx, 0x40e6fc
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
push dword [ebp + 0x10]
stosd dword es:[edi], eax
call dword [sym.imp.libav.dll_Ordinal_26]
pop ecx
pop ecx
test eax, eax
je 0x40362e
mov dword [ebx], 1
test esi, esi
je 0x403627
push esi
call dword [sym.imp.libav.dll_Ordinal_16]
pop ecx
xor eax, eax
jmp 0x403707
call dword [sym.imp.libav.dll_Ordinal_11]
mov edi, eax
test edi, edi
je 0x403615
test esi, esi
je 0x403650
push esi
push edi
call dword [sym.imp.libav.dll_Ordinal_14]
push esi
call dword [sym.imp.libav.dll_Ordinal_16]
add esp, 0xc
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.libav.dll_Ordinal_18]
add esp, 0x10
push edi
test eax, eax
je 0x403677
call dword [sym.imp.libav.dll_Ordinal_9]
mov dword [ebx], 1
jmp 0x403626
call dword [sym.imp.libav.dll_Ordinal_8]
pop ecx
test eax, eax
je 0x403685
push edi
jmp 0x403669
push dword [ebp - 4]
lea eax, [ebp - 0x48]
push eax
mov word [ebp - 0x23], 0x7574
mov dword [ebp - 0x3d], 0x63657272
mov word [ebp - 0x45], 0x6261
mov dword [ebp - 0x41], 0x6f632065
mov dword [ebp - 0x2c], 0x20752528
mov dword [ebp - 0x28], 0x6e676973
mov dword [ebp - 0x20], 0x297365
mov dword [ebp - 0x34], 0x616f6c65
mov dword [ebp - 0x30], 0x20646564
mov word [ebp - 0x48], 0x6144
mov word [ebp - 0x43], 0x7361
mov dword [ebp - 0x39], 0x20796c74
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x24], 0x61
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x46], 0x74
call fcn.00407aa5
push 0x40c358
call fcn.00407aa5
add esp, 0xc
mov ecx, edi
call fcn.00406468
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404d2a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ecx + 0x28]
sub esp, 0x1c
cmp dword [ecx + 0x30], 0
push eax
push dword [ebp + 8]
je 0x404d9b
test edx, edx
je 0x404d75
push edx
push dword [ecx + 0x30]
lea eax, [ebp - 0x1c]
push eax
push dword [ecx + 0xc]
mov dword [ebp - 0x14], 0x63257325
mov dword [ebp - 0x1a], 0x7325203a
mov byte [ebp - 0x10], 0
mov word [ebp - 0x1c], 0x7525
mov word [ebp - 0x16], 0x203a
call fcn.0040784e
add esp, 0x18
leave
ret
push dword [ecx + 0x30]
lea eax, [ebp - 0xc]
mov dword [ebp - 7], 0x632573
mov dword [ebp - 0xc], 0x203a7525
mov byte [ebp - 8], 0x25
push eax
push dword [ecx + 0xc]
call fcn.0040784e
add esp, 0x14
leave
ret
test edx, edx
je 0x404da7
push edx
push str._s:__s_c
jmp 0x404d8e
push str._s_c
push dword [ecx + 0xc]
call fcn.0040784e
add esp, 0x10
leave
ret
Function at 0x405c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov eax, edx
push esi
mov esi, dword [eax]
xor edx, edx
and dword [ebp - 4], edx
push edi
mov dword [ebp - 0x14], ecx
mov ecx, Ordinal_2
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], ecx
test esi, esi
je 0x405dfb
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [esi + 8]
imul eax, eax, 0xf4240
sub eax, dword [esi + 0xc]
add eax, dword [ebp - 0x10]
jns 0x405ca4
inc edi
jmp 0x405cb2
cmp eax, edx
cmovg edx, eax
cmp eax, ecx
cmovl ecx, eax
add dword [ebp - 4], eax
inc ebx
mov esi, dword [esi]
test esi, esi
jne 0x405c8d
movd xmm2, dword [ebp - 4]
movsd xmm1, qword [0x40cd18]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mov eax, ebx
shr eax, 0x1f
cvtdq2pd xmm2, xmm2
addsd xmm0, qword [eax*8 + 0x40cd20]
sub esp, 0x18
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x3d], 0x2e25203a
mulsd xmm0, xmm1
mov dword [ebp - 0x44], 0x775f6776
mov dword [ebp - 0x49], 0x2066362e
mov dword [ebp - 0x5c], 0x25203a74
divsd xmm2, xmm0
movd xmm0, edx
cvtdq2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm2
divsd xmm0, xmm1
mov word [ebp - 0x4b], 0x2520
movsd qword [esp + 8], xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mov dword [ebp - 0x63], 0x5f6e696d
divsd xmm0, xmm1
mov dword [ebp - 0x50], 0x74696177
movsd qword [esp], xmm0
push eax
push esi
mov dword [ebp - 0x56], 0x616d2066
mov word [ebp - 0x5f], 0x6177
mov word [ebp - 0x38], 0x66
mov byte [ebp - 0x45], 0x61
mov word [ebp - 0x40], 0x6961
mov byte [ebp - 0x64], 0x20
mov word [ebp - 0x58], 0x362e
mov byte [ebp - 0x3e], 0x74
mov byte [ebp - 0x39], 0x36
mov byte [ebp - 0x4c], 0x3a
mov word [ebp - 0x52], 0x5f78
mov byte [ebp - 0x5d], 0x69
call fcn.0040784e
add esp, 0x20
mov dword [ebp - 0x32], 0x41564e49
mov dword [ebp - 0x2a], 0x656d6974
mov word [ebp - 0x23], 0x706d
mov word [ebp - 0x26], 0x7473
mov dword [ebp - 0x1f], 0x29752520
mov word [ebp - 0x21], 0x3a73
mov word [ebp - 0x34], 0x2820
mov dword [ebp - 0x2e], 0x2044494c
mov byte [ebp - 0x24], 0x61
mov byte [ebp - 0x1b], 0
test edi, edi
je 0x405dde
push edi
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.0040784e
add esp, 0xc
mov ecx, dword [ebp - 0x18]
lea eax, [ebx + edi]
cmp eax, dword [ecx + 8]
je 0x405dfb
push dword [ecx + 8]
push eax
push str.__ERROR:__u____u_
push esi
call fcn.0040784e
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret