joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022617
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002ddaf
call fcn.1002b0d2
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002275c
cmp dword [ebp - 0x18], 1
jne 0x1002275c
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f788
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x1002275c
push dword [ebp - 0x14]
push ebx
push esi
call fcn.1001f788
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10022751
cmp dword [ebp - 0x18], 1
jne 0x10022751
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001f788
mov dword [edi], eax
pop ecx
test eax, eax
je 0x10022751
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.1001f788
lea eax, [ebp - 0x20]
push eax
push 0x100333c8
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x10022735
push ebx
call fcn.1001f788
pop ecx
test al, al
je 0x10022735
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x10022751
push dword [edi]
call fcn.1002b601
and dword [edi], 0
pop ecx
jmp 0x10022751
test esi, esi
je 0x1002275c
push esi
call fcn.1002b601
pop ecx
call fcn.1002b030
ret

Function at 0x10022f02
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10033124
xor esi, esi
call fcn.1001f788
pop ecx
test eax, eax
jne 0x10022f23
push 0x1003313c
call fcn.1001f788
pop ecx
test eax, eax
je 0x10022f26
xor esi, esi
inc esi
cmp byte [0x1003cdfb], 0
jne 0x10022f38
cmp byte [0x1003cdfa], 0
je 0x10022f6e
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d640
push edi
call fcn.1001f788
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10022f5d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10022f6d
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x100252bb
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cdfb], 0
jne 0x100252fd
cmp byte [0x1003cdfa], 0
je 0x10025334
movzx eax, bl
mov esi, 0x1003e1a8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.1001f788
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10025324
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10025334
push esi
call fcn.10005eb0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cdfb], 0
jne 0x1002534b
cmp byte [0x1003cdfa], 0
je 0x1002537d
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1a8
push esi
call fcn.1001f788
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x1002536d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1002537d
push esi
call fcn.10005eb0
pop ecx
mov al, 1
pop esi
ret
Function at 0x10028be1
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028bfe
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cdfb], 0
jne 0x10028c14
cmp byte [0x1003cdfa], 0
je 0x10028d53
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5f8
push edi
call fcn.1001f788
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c3a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c53
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c5c
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push 4
push str.sizeof_Uns32____d
push edi
call fcn.1001f788
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c95
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c9e
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.1001f788
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028cd7
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028ce0
cmp byte [0x1003cdfa], 0
je 0x10028d00
push 4
push str.sizeof_Handle32____d
push edi
call fcn.1001f788
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d00
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d19
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028d22
cmp byte [0x1003cdfa], 0
je 0x10028d42
push 4
push str.sizeof_void____d
push edi
call fcn.1001f788
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d42
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d52
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028dec
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e03a
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, 0x1003e5f8
mov edi, dword [ebp + 8]
jne 0x10028e17
mov al, byte [0x1003cdfa]
test al, al
jne 0x10028e17
lea esi, [edi + 4]
jmp 0x10028e2e
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.1001f788
mov al, byte [0x1003cdfa]
add esp, 0xc
test al, al
je 0x10028e39
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028e49
push ebx
call fcn.10005eb0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1001f788
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10028e7c
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100031be
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b045
ret
Function at 0x10028e92
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e067
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x10028ebf
cmp byte [0x1003cdfa], 0
je 0x10028f0e
call fcn.1001f788
test al, al
mov edx, 0x1002fb8c
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5f8
call fcn.1001f788
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028efa
push 0x1003e5f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028f0e
push 0x1003e5f8
call fcn.10005eb0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.1001f788
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100031be
test ebx, ebx
jne 0x10028f8c
cmp byte [0x1003cdfb], bl
jne 0x10028f58
cmp byte [0x1003cdfa], bl
je 0x10029000
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5f8
push ebx
call fcn.1001f788
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x10028f7a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10029000
push ebx
call fcn.10005eb0
pop ecx
jmp 0x10029000
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10028fbb
cmp byte [0x1003cdfb], al
jne 0x10028fb4
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10028f5d
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10028ff0
cmp byte [0x1003cdfb], al
jne 0x10028fe6
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10028f5d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b045
ret
Function at 0x40b230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x494e67
call fcn.0048642c
sub esp, 0x448
and dword [ebp - 0x24], 0
push ebx
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.0040b440
push 1
lea eax, [ebp - 0x18]
pop ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040b4ff
and word [ebp - 0x454], 0
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x452]
rep stosd dword es:[edi], eax
push 0x207
mov byte [ebp - 4], 2
push dword [ebp - 0x18]
stosw word es:[edi], ax
lea eax, [ebp - 0x454]
push eax
call fcn.004870f6
push dword [ebp - 0x20]
lea eax, [ebp - 0x454]
push eax
call fcn.0048709c
add esp, 0x1c
lea eax, [ebp - 0x454]
lea ecx, [ebp - 0x1c]
push eax
call fcn.00401623
push dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
call fcn.0040b5c3
pop ecx
pop ecx
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 4
mov eax, dword [eax - 8]
test eax, eax
jne 0x40b317
mov ecx, dword [ebp + 8]
push 0x4cb3a8
call fcn.00401623
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004015f7
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.004015f7
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.004015f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004015f7
mov eax, dword [ebp + 8]
jmp 0x40b432
push esi
push 0xf
cmp eax, 0x20
mov word [ebp - 0x44], 0x30
mov word [ebp - 0x42], 0x31
mov word [ebp - 0x40], 0x32
mov word [ebp - 0x3e], 0x33
mov word [ebp - 0x3c], 0x34
mov word [ebp - 0x3a], 0x35
mov word [ebp - 0x38], 0x36
mov word [ebp - 0x36], 0x37
mov word [ebp - 0x34], 0x38
mov word [ebp - 0x32], 0x39
mov word [ebp - 0x30], 0x41
mov word [ebp - 0x2e], 0x42
mov word [ebp - 0x2c], 0x43
mov word [ebp - 0x2a], 0x44
mov word [ebp - 0x28], 0x45
mov word [ebp - 0x26], 0x46
pop esi
jge 0x40b3ce
mov eax, dword [0x4bb1a0]
mov di, word [ebp + esi*2 - 0x44]
push ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.0040167c
test eax, eax
je 0x40b3a0
mov eax, dword [ebp - 0x14]
mov word [eax], di
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 5
push dword [eax - 8]
call fcn.00403d53
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004015f7
dec esi
jns 0x40b3c5
push 0xf
pop esi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0x20
jl 0x40b380
lea ecx, [ebp - 0x10]
call fcn.00401908
push dword [ebp - 0x10]
call fcn.00487244
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00401908
push dword [ebp - 0x10]
call dword [0x4a25fc]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0040196a
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 3
call fcn.004015f7
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.004015f7
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.004015f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004015f7
mov eax, dword [ebp + 8]
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40ff87
Capabilities:
Terminate process

Disassembly:
mov eax, 0x495c04
call fcn.0048642c
sub esp, 0x28
push ebx
push esi
lea eax, [ebp - 0xd]
push edi
push eax
lea ecx, [ebp - 0x34]
call fcn.00413d95
lea eax, [ebp - 0x34]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0045beef
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00421ac5
test eax, eax
je 0x40ffd3
lea eax, [ebp - 0x20]
push esi
push eax
push esi
push 0x59
mov dword [ebp - 0x20], esi
call dword [0x4a270c]
cmp eax, esi
jne 0x40ffdc
or dword [ebp - 4], 0xffffffff
jmp 0x410112
mov eax, dword [0x4bb1a0]
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
push 6
lea ecx, [ebp - 0x14]
pop edi
mov byte [ebp - 4], 1
push edi
call fcn.00401877
test eax, eax
je 0x41000b
mov eax, dword [ebp - 0x14]
mov dword [eax - 8], edi
mov eax, dword [ebp - 0x14]
mov word [eax + 0xc], si
mov eax, dword [ebp - 0x14]
push edi
push eax
movzx eax, bx
push 0x59
push eax
call dword [0x4a2338]
or edi, 0xffffffff
lea ecx, [ebp - 0x14]
push edi
call fcn.004018df
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], esi
jne 0x41003e
call fcn.0046d0bd
mov ecx, eax
call fcn.0046d431
jmp 0x410103
lea eax, [ebp - 0x1c]
push eax
call fcn.0045cd4f
push dword [eax]
push dword [ebp - 0x14]
call fcn.00486925
mov ebx, eax
add esp, 0xc
neg ebx
sbb bl, bl
lea ecx, [ebp - 0x1c]
inc bl
call fcn.004015f7
test bl, bl
jne 0x410103
mov esi, dword [ebp - 0x30]
cmp esi, dword [ebp - 0x2c]
je 0x410103
mov ebx, dword [esi]
lea eax, [ebp - 0x24]
push eax
call fcn.00415f4a
pop ecx
push ebx
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
call fcn.00403c8b
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.004015f7
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0045de28
push dword [ebp - 0x14]
mov byte [ebp - 4], 5
push dword [ebp - 0x18]
call fcn.00486925
add esp, 0x10
test eax, eax
je 0x4100dc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.004015f7
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.004015f7
add esi, 4
jmp 0x41006f
call fcn.0046d0bd
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.0046ed5d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.004015f7
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.004015f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004015f7
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x34]
call fcn.00403b24
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x416a25
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x496a90
call fcn.0048642c
sub esp, 0x41c
lea eax, [ebp - 0x10]
push esi
push eax
mov al, byte [ebp + 8]
xor esi, esi
push 1
neg al
sbb eax, eax
push esi
add eax, reloc.OLEAUT32.dll_SysReAllocString
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push eax
mov dword [ebp - 0x10], esi
call dword [0x4a202c]
test eax, eax
jne 0x416aa3
push edi
mov ecx, 0x104
lea edi, [ebp - 0x426]
mov word [ebp - 0x428], si
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x208
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [0x4a2028]
push dword [ebp - 0x10]
mov edi, eax
call dword [0x4a2024]
cmp edi, esi
pop edi
je 0x416aa7
xor al, al
jmp 0x416ada
lea eax, [ebp - 0x428]
push ebx
push eax
lea eax, [ebp + 8]
push eax
call fcn.00416bae
push dword [ebp + 0x10]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.00416ae7
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea ecx, [ebp + 8]
mov bl, al
call fcn.004015f7
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x416b33
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push ebx
push eax
mov al, byte [ebp + 8]
xor ebx, ebx
push 0xf003f
neg al
sbb eax, eax
push ebx
add eax, reloc.OLEAUT32.dll_SysReAllocString
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push eax
mov dword [ebp - 4], ebx
call dword [0x4a202c]
test eax, eax
je 0x416b67
xor al, al
jmp 0x416bab
cmp byte [ebp + 0xc], bl
jne 0x416b7a
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [0x4a2034]
jmp 0x416b98
push dword [ebp + 0x14]
call fcn.00486a45
pop ecx
shl eax, 1
push eax
push dword [ebp + 0x14]
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [0x4a2030]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [0x4a2024]
mov al, bl
pop ebx
leave
ret
Function at 0x434007
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x49a0f8
call fcn.0048642c
sub esp, 0x34
push ebx
push esi
push edi
push 0x421
push dword [ecx + 4]
call dword [0x4a260c]
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call fcn.0046e921
push dword [eax]
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004159a1
add esp, 0xc
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.004015f7
lea eax, [ebp - 0x18]
push eax
call fcn.0046d43c
mov eax, dword [0x4bb1a0]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push 0x43
push eax
mov byte [ebp - 4], 4
call fcn.0045e70e
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.004016bd
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.004015f7
lea eax, [ebp - 0x14]
push eax
call fcn.0046d91c
push dword [ebp - 0x14]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 6
push eax
call fcn.00473d68
mov ebx, eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 7
push eax
call fcn.00473d68
add esp, 0x14
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x38]
push 0x4bb2e0
push eax
call fcn.00403cef
mov esi, 0x4bb434
mov byte [ebp - 4], 9
push esi
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00403c8b
push dword [ebp - 0x24]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00403bde
push esi
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
push eax
call fcn.00403c8b
push ebx
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xc
push eax
call fcn.00403bde
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 0xd
push dword [eax - 8]
call fcn.00403d53
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.004015f7
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
call fcn.004015f7
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.004015f7
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 9
call fcn.004015f7
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 8
call fcn.004015f7
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.004015f7
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 6
call fcn.004015f7
push dword [ebp - 0x10]
push edi
call dword [0x4a272c]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004015f7
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004015f7
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004015f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004015f7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4364d0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x49a498
call fcn.0048642c
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
cmp ebx, dword [esi + 0x30]
je 0x436596
lea eax, [ebp + 8]
xor edi, edi
push eax
push ebx
mov dword [ebp + 8], edi
call dword [0x4a26a8]
cmp dword [ebp + 8], edi
je 0x436596
call dword [0x4a2354]
mov ecx, dword [ebp + 8]
cmp eax, ecx
je 0x436596
cmp ecx, dword [esi + 0x34]
je 0x436596
push ecx
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.004731d8
add esp, 0xc
mov dword [ebp - 4], edi
lea edi, [esi + 0x38]
push eax
mov ecx, edi
call fcn.004016bd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004015f7
mov eax, dword [ebp + 8]
push 0x433
push dword [esi + 4]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], eax
call dword [0x4a260c]
push dword [edi]
push eax
call dword [0x4a272c]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x436571
push eax
call fcn.00473412
pop ecx
push dword [esi + 0x30]
call fcn.0047348d
push dword [edi]
call fcn.004732de
pop ecx
pop ecx
mov ecx, dword [esi + 0xb4]
push eax
call fcn.00473628
push 1
call fcn.00472acd
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x436e35
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, 0x49a620
call fcn.0048642c
push ecx
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
call fcn.00423f64
and dword [ebp - 4], 0
lea ebx, [esi + 0x30]
mov ecx, ebx
call fcn.00406db4
and dword [ebx + 0x20], 0
mov edi, 0x4a2ca4
mov dword [ebx], edi
mov al, byte [ebp + 0x10]
and byte [esi + 0x58], 0
mov byte [esi + 0x59], al
mov eax, dword [ebp + 0xc]
lea ebx, [esi + 0x70]
mov dword [esi + 0x5c], eax
and dword [esi + 0x60], 0
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0042e22c
mov dword [ebx], 0x4a2d40
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 2
call fcn.0044f31a
lea ebx, [esi + 0x14c]
mov byte [ebp - 4], 3
mov ecx, ebx
call fcn.00406db4
and dword [ebx + 0x20], 0
mov dword [ebx], edi
lea ebx, [esi + 0x170]
mov byte [ebp - 4], 4
mov ecx, ebx
call fcn.00406db4
and dword [ebx + 0x20], 0
mov dword [ebx], edi
lea ecx, [esi + 0x194]
mov byte [ebp - 4], 5
call fcn.00438ccd
mov ecx, dword [0x4a26c0]
lea eax, [esi + 0x1b8]
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ebx
mov dword [eax], edi
mov byte [ebp - 4], 7
mov dword [esi], 0x4a2e7c
call fcn.0041289e
mov edi, dword [ebp + 8]
movzx eax, al
mov ecx, edi
mov dword [esi + 0x64], eax
call fcn.0046cfd1
neg al
sbb eax, eax
mov ecx, edi
inc eax
mov dword [esi + 0x54], ebx
mov dword [esi + 0x6c], eax
call fcn.0046e867
mov ecx, edi
mov dword [esi + 0xa4], eax
call fcn.0046e86b
mov ecx, edi
mov dword [esi + 0xa8], eax
call fcn.0046e128
mov dword [esi + 0x68], eax
mov ecx, edi
call fcn.0046eaa4
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xac], eax
mov eax, dword [edi + 0x90]
pop edi
mov dword [esi + 0xb0], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc