joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030fec
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [esp + 0x58]
mov ebx, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
mov ecx, dword [0x10055b70]
test ecx, ecx
jne 0x100310c6
mov esi, dword [0x10055b68]
test esi, esi
jne 0x10031034
mov ecx, 0xf8f45725
call fcn.100317ce
mov esi, eax
mov dword [0x10055b68], eax
movaps xmm0, xmmword [0x10042cf0]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x7a
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xf
jne 0x10031043
mov byte [esp + 0x17], 0
mov ecx, dword [0x10055b6c]
test ecx, ecx
jne 0x10031072
mov ecx, 0x53b2070f
call fcn.100317ce
mov ecx, eax
mov dword [0x10055b6c], eax
mov dword [esp + 2], 0x4d4d0f19
mov byte [esp + 6], 0
mov word [esp], 0x875
xor eax, eax
inc eax
mov edx, eax
add dl, 0x7a
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10031088
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055b70], eax
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
push esi
push ebx
push ebp
push edi
push edx
push eax
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x30

Function at 0x100310f0
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x10055b74]
test ecx, ecx
jne 0x100311be
mov esi, dword [0x10055b68]
test esi, esi
jne 0x1003112c
mov ecx, 0xf8f45725
call fcn.100317ce
mov esi, eax
mov dword [0x10055b68], eax
mov dword [esp + 0xa], 0x11172a08
mov dword [esp + 0xe], 0xcff5eee4
mov dword [esp + 0x12], 0xd0e1ebeb
mov byte [esp + 0x16], 0
mov word [esp + 8], 0x1e53
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x7a
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xe
jne 0x10031153
mov byte [esp + 0x16], 0
mov ecx, dword [0x10055b6c]
test ecx, ecx
jne 0x10031182
mov ecx, 0x53b2070f
call fcn.100317ce
mov ecx, eax
mov dword [0x10055b6c], eax
mov dword [esp + 2], 0x4d4d0f19
mov byte [esp + 6], 0
mov word [esp], 0x875
xor eax, eax
inc eax
mov edx, eax
add dl, 0x7a
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10031198
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055b74], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x100312a4
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [0x10055b78]
test ecx, ecx
jne 0x10031371
mov esi, dword [0x10055b68]
test esi, esi
jne 0x100312e4
mov ecx, 0xf8f45725
call fcn.100317ce
mov esi, eax
mov dword [0x10055b68], eax
mov dword [esp + 2], 0x12172908
mov word [esp + 6], 0xf3e5
mov byte [esp + 8], 0
mov word [esp], 0x1e53
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x7a
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x10031301
mov byte [esp + 8], 0
mov ecx, dword [0x10055b6c]
test ecx, ecx
jne 0x1003132f
mov ecx, 0x53b2070f
call fcn.100317ce
mov ecx, eax
mov dword [0x10055b6c], eax
mov dword [esp + 0xe], 0x4d4d0f19
mov byte [esp + 0x12], 0
mov word [esp + 0xc], 0x875
xor eax, eax
inc eax
mov edx, eax
add dl, 0x7a
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 6
jne 0x10031346
lea eax, [esp + 0xc]
mov byte [eax + 6], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055b78], eax
mov eax, dword [esp + 0x28]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x100313b2
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [0x10055b7c]
test ecx, ecx
jne 0x10031482
mov esi, dword [0x10055b68]
test esi, esi
jne 0x100313f2
mov ecx, 0xf8f45725
call fcn.100317ce
mov esi, eax
mov dword [0x10055b68], eax
mov dword [esp + 0xa], 0xc1b3008
mov dword [esp + 0xe], 0xe6e5e0f3
mov word [esp + 0x12], 0xd3
mov word [esp + 8], 0x1e47
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x7a
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xb
jne 0x10031413
mov byte [esp + 0x13], 0
mov ecx, dword [0x10055b6c]
test ecx, ecx
jne 0x10031442
mov ecx, 0x53b2070f
call fcn.100317ce
mov ecx, eax
mov dword [0x10055b6c], eax
mov dword [esp + 2], 0x4d4d0f19
mov byte [esp + 6], 0
mov word [esp], 0x875
xor eax, eax
inc eax
mov edx, eax
add dl, 0x7a
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10031458
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055b7c], eax
mov eax, dword [esp + 0x28]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x10031492
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x28]
mov ecx, dword [0x10055b80]
test ecx, ecx
jne 0x10031543
mov esi, dword [0x10055b68]
test esi, esi
jne 0x100314c4
mov ecx, 0xf8f45725
call fcn.100317ce
mov esi, eax
mov dword [0x10055b68], eax
mov byte [esp + 0x18], 0
movaps xmm0, xmmword [0x10042d00]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x7a
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0x10
jne 0x100314d8
mov byte [esp + 0x18], 0
mov ecx, dword [0x10055b6c]
test ecx, ecx
jne 0x10031507
mov ecx, 0x53b2070f
call fcn.100317ce
mov ecx, eax
mov dword [0x10055b6c], eax
mov dword [esp + 2], 0x4d4d0f19
mov byte [esp + 6], 0
mov word [esp], 0x875
xor eax, eax
inc eax
mov edx, eax
add dl, 0x7a
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x1003151d
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055b80], eax
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
ret 4

Function at 0x1003154e
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x28]
mov ecx, dword [0x10055b84]
test ecx, ecx
jne 0x100315ff
mov esi, dword [0x10055b68]
test esi, esi
jne 0x10031580
mov ecx, 0xf8f45725
call fcn.100317ce
mov esi, eax
mov dword [0x10055b68], eax
mov byte [esp + 0x18], 0
movaps xmm0, xmmword [0x10042d10]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x7a
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0x10
jne 0x10031594
mov byte [esp + 0x18], 0
mov ecx, dword [0x10055b6c]
test ecx, ecx
jne 0x100315c3
mov ecx, 0x53b2070f
call fcn.100317ce
mov ecx, eax
mov dword [0x10055b6c], eax
mov dword [esp + 2], 0x4d4d0f19
mov byte [esp + 6], 0
mov word [esp], 0x875
xor eax, eax
inc eax
mov edx, eax
add dl, 0x7a
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x100315d9
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055b84], eax
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
ret 4
Function at 0x1003161e
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x10055b88]
test ecx, ecx
jne 0x100316dd
mov esi, dword [0x10055b68]
test esi, esi
jne 0x10031650
mov ecx, 0xf8f45725
call fcn.100317ce
mov esi, eax
mov dword [0x10055b68], eax
mov dword [esp + 0xa], 0x100c090f
mov dword [esp + 0xe], 0xedebd6f9
mov dword [esp + 0x12], 0xf1eae0
mov word [esp + 8], 0x1e44
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x7a
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xd
jne 0x10031672
mov byte [esp + 0x15], 0
mov ecx, dword [0x10055b6c]
test ecx, ecx
jne 0x100316a1
mov ecx, 0x53b2070f
call fcn.100317ce
mov ecx, eax
mov dword [0x10055b6c], eax
mov dword [esp + 2], 0x4d4d0f19
mov byte [esp + 6], 0
mov word [esp], 0x875
xor eax, eax
inc eax
mov edx, eax
add dl, 0x7a
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x100316b7
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055b88], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4

Function at 0x100316e8
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x10055b8c]
test ecx, ecx
jne 0x100317be
mov esi, dword [0x10055b68]
test esi, esi
jne 0x10031728
mov ecx, 0xf8f45725
call fcn.100317ce
mov esi, eax
mov dword [0x10055b68], eax
mov dword [esp + 0xa], 0x11172a1a
mov dword [esp + 0xe], 0xd3f5eee4
mov dword [esp + 0x12], 0xd0e5eaf6
mov byte [esp + 0x16], 0
mov word [esp + 8], 0x1e44
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x7a
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xe
jne 0x1003174f
mov byte [esp + 0x16], 0
mov ecx, dword [0x10055b6c]
test ecx, ecx
jne 0x1003177e
mov ecx, 0x53b2070f
call fcn.100317ce
mov ecx, eax
mov dword [0x10055b6c], eax
mov dword [esp + 2], 0x4d4d0f19
mov byte [esp + 6], 0
mov word [esp], 0x875
xor eax, eax
inc eax
mov edx, eax
add dl, 0x7a
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10031794
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10055b8c], eax
mov eax, dword [esp + 0x2c]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x100317ce
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x10055b60]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x10031890
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10031890
cmp word [eax + ecx + 0x14], 0x60
jb 0x10031890
cmp dword [eax + ecx + 0x74], 0
je 0x10031890
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x10031890
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x10031890
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x10031878
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10031864
jmp 0x1003187d
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x1003188c
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x1003184d
jmp 0x10031890
test eax, eax
jne 0x100318a4
mov esi, dword [esi]
cmp esi, edi
jne 0x100317ea
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x1003189c
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x432006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [0x403024], eax
mov edx, str._r_nWAV_PLAYER_v1.0_for_Windows
call fcn.004013dc
call fcn.00401473
jb 0x401148
call fcn.0040177f
jb 0x401148
call fcn.00401150
call fcn.004011b9
jb 0x401143
call fcn.004012da
call fcn.00401303
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
neg eax
mov dword [0x403058], eax
cmp byte [section..data], 0
jne 0x401082
cmp dword [0x402084], 0
je 0x40107d
cmp byte [0x4025d5], 0
jne 0x401076
call fcn.00401980
jmp 0x401082
call fcn.004018f5
jmp 0x401082
call fcn.00401c48
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
add dword [0x403058], eax
mov edx, str.audio_duration
call fcn.004013dc
mov eax, dword [0x403004]
mov edx, 0x3e8
mul edx
div dword [0x403034]
xor edx, edx
div dword [0x403038]
xor edx, edx
div dword [0x40303c]
mov dword [0x403054], eax
call fcn.00401412
mov edx, str._milliseconds__performed_in
call fcn.004013dc
mov eax, dword [0x403058]
call fcn.00401412
mov edx, str._milliseconds_r_n
call fcn.004013dc
mov edx, str._clock_cycles_:_r_n
call fcn.004013dc
mov esi, 0x40200c
call fcn.004013fe
lea edx, [esi + 8]
call fcn.004013dc
call fcn.004013fe
mov eax, dword [esi]
mov ebx, dword [esi + 4]
add dword [0x402062], eax
adc dword [0x402066], ebx
mov edx, 0x3e8
imul ebx, edx
mul edx
add edx, ebx
cmp edx, dword [0x403054]
jae 0x401133
div dword [0x403054]
call fcn.00401412
call fcn.004013ed
add esi, 0x1d
cmp esi, 0x40207f
jb 0x4010f1
call fcn.00401842
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x401473
Capabilities:
Accept command line arguments

Disassembly:
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov esi, eax
mov edi, 0x403070
mov ecx, 0x400
lodsb al, byte [esi]
cmp al, 0
stosb byte es:[edi], al
loopne 0x401485
mov byte [edi - 1], 0
mov esi, 0x403070
mov edi, 0x403070
call fcn.00401754
call fcn.00401754
mov al, byte [ebx]
cmp al, 0
je 0x40165c
cmp al, 0x2f
je 0x40153f
cmp al, 0x2d
je 0x40153f
mov eax, dword [edi - 5]
or eax, 0x20202000
cmp eax, 0x7661772e
jne 0x401500
cmp dword [0x402080], 0
ja 0x4014e4
mov dword [0x402080], ebx
mov byte [0x4025d4], 1
jmp 0x40149e
cmp dword [0x402084], 0
ja 0x40168b
mov dword [0x402084], ebx
mov byte [0x4025d5], 1
jmp 0x40149e
mov eax, dword [edi - 5]
or eax, 0x20202000
cmp eax, 0x6d63702e
jne 0x40168b
cmp dword [0x402080], 0
ja 0x401527
mov dword [0x402080], ebx
jmp 0x40149e
cmp dword [0x402084], 0
ja 0x40168b
mov dword [0x402084], ebx
jmp 0x40149e
cmp dword [ebx + 1], 0x6f6e6f6d
jne 0x401554
mov byte [0x402001], 1
jmp 0x40149e
cmp dword [ebx + 1], 0x72657473
jne 0x40156a
cmp word [ebx + 5], 0x6f65
jne 0x40156a
jmp 0x40149e
cmp dword [ebx + 1], 0x74736166
jne 0x40157f
mov byte [0x402004], 1
jmp 0x40149e
cmp dword [ebx + 1], 0x74696238
jne 0x401594
mov byte [0x402002], 1
jmp 0x40149e
cmp dword [ebx + 1], 0x69623631
jne 0x4015a8
cmp byte [ebx + 5], 0x74
jne 0x4015a8
jmp 0x40149e
cmp dword [ebx + 1], 0x666c6168
jne 0x4015bd
mov byte [0x402003], 1
jmp 0x40149e
cmp dword [ebx + 1], 0x72617571
jne 0x4015e0
cmp word [ebx + 5], 0x6574
jne 0x4015e0
cmp byte [ebx + 7], 0x72
jne 0x4015e0
mov byte [0x402003], 2
jmp 0x40149e
cmp dword [ebx + 1], 0x74736574
jne 0x4015f5
mov byte [section..data], 1
jmp 0x40149e
cmp word [ebx + 1], 0x3a46
jne 0x401619
mov eax, dword [ebx + 3]
mov edx, dword [ebx + 7]
call fcn.004016a1
call fcn.004016f9
jb 0x40168b
mov dword [0x40305c], eax
jmp 0x40149e
cmp word [ebx + 1], 0x3a42
jne 0x40163c
mov eax, dword [ebx + 3]
xor edx, edx
call fcn.004016a1
call fcn.0040173c
jb 0x40168b
mov dword [0x403060], eax
jmp 0x40149e
cmp word [ebx + 1], 0x3a43
jne 0x40165a
mov eax, dword [ebx + 3]
xor edx, edx
call fcn.004016a1
call fcn.00401748
jb 0x40168b
mov dword [0x403064], eax
jmp 0x40168b
cmp dword [0x402080], 0
je 0x40168b
mov edx, str._press_CTRLC_to_quit__r_n
call fcn.004013dc
mov edx, str.file:
call fcn.004013dc
mov edx, dword [0x402080]
call fcn.004013dc
call fcn.004013ed
clc
ret
mov edx, str._r_n____________________________r_nby_Erdogan_Tan___23_10_2024_r_n_r_n
call fcn.004013dc
mov edx, str.usage:_wavplay_input.wav__output.wav___output.pcm____test__r_n___________________________mono_stereo____8bit16bit____fast____half_quarter__r_n_t_t_example:_wavplay_input.wav__mono__8bit__half__r_n_t_t_t__________default_options:_same_with_input_file_r_n_r_n____or_wavplay_input.pcm__output.wav____test__r_n___________________________F:Hertz____B:8B:16____C:2C:1__r_n_t_t_example:_wavplay_input.pcm__F:22050__B:16__C:2__r_n_t_t___________________default:__F:44100__B:16__C:2_r_n_r_n
call fcn.004013dc
stc
ret
Function at 0x40177f
Capabilities:
Execute anti-debugging instructions
Get file size
Read file via mapping

Disassembly:
test byte [0x402005], 0x10
je 0x401796
rdtsc
sub dword [0x402029], eax
sbb dword [0x40202d], edx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [0x402080]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x40300c], eax
cmp eax, 0xffffffff
je 0x40181e
push 0
push dword [0x40300c]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [section..bss], eax
mov dword [0x40301c], eax
push 0
push 0
push 0
push 2
push 0
push dword [0x40300c]
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov dword [0x403010], eax
push 0
push 0
push 0
push 4
push dword [0x403010]
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov dword [0x403014], eax
mov dword [0x403018], eax
mov esi, dword [0x403014]
mov ecx, dword [0x40301c]
lodsb al, byte [esi]
loop 0x401818
clc
jmp 0x401828
mov edx, str.cannot_open_source_file_r_n
call fcn.004013dc
pushfd
test byte [0x402005], 0x10
je 0x401840
rdtsc
add dword [0x402029], eax
adc dword [0x40202d], edx
popfd
ret

Function at 0x401842
Capabilities:
Execute anti-debugging instructions

Disassembly:
test byte [0x402005], 0x10
je 0x401859
rdtsc
sub dword [0x402029], eax
sbb dword [0x40202d], edx
push dword [0x403014]
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [0x403010]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [0x40300c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [0x402005], 0x10
je 0x401894
rdtsc
add dword [0x402029], eax
adc dword [0x40202d], edx
ret

Function at 0x401895
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cmp dword [0x40301c], eax
jle 0x4018f4
test byte [0x402005], 0x10
je 0x4018b6
rdtsc
sub dword [0x402029], eax
sbb dword [0x40202d], edx
mov esi, dword [0x403018]
mov ecx, dword [0x40301c]
mov eax, dword [0x403068]
cmp ecx, eax
jbe 0x4018cd
mov ecx, eax
push ecx
add dword [0x403018], ecx
sub dword [0x40301c], ecx
rep movsb byte es:[edi], byte [esi]
test byte [0x402005], 0x10
je 0x4018f3
rdtsc
add dword [0x402029], eax
adc dword [0x40202d], edx
pop eax
ret

Function at 0x4018f5
Capabilities:
Execute anti-debugging instructions
Write file on windows

Disassembly:
test byte [0x402005], 0x10
je 0x40190c
rdtsc
sub dword [0x402045], eax
sbb dword [0x402049], edx
call fcn.004019a1

Function at 0x401980
Capabilities:
Execute anti-debugging instructions
Write file on windows

Disassembly:
mov edi, 0x403470
call fcn.00401895
cmp byte [0x4025d6], 0
jbe 0x401929
call fcn.00401e12
or eax, eax
je 0x401963
mov dword [0x403008], eax
push 0
push 0x403020
push dword [0x40306c]
push 0x403470
push dword [0x40302c]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [0x403008]
add dword [0x40208c], eax
add dword [0x4020b0], eax
jmp 0x401911
call fcn.00401a1e
test byte [0x402005], 0x10
je 0x40197f
rdtsc
add dword [0x402045], eax
adc dword [0x402049], edx
ret
test byte [0x402005], 0x10
je 0x401997
rdtsc
sub dword [0x402045], eax
sbb dword [0x402049], edx
call fcn.004019fa
jmp 0x401911
Function at 0x401be1
Capabilities:
Execute anti-debugging instructions

Disassembly:
test byte [0x402005], 0x10
je 0x401bf8
rdtsc
sub dword [0x402045], eax
sbb dword [0x402049], edx
mov ebx, 0x4020d0
call fcn.00401b1c
add ebx, 0x20
cmp ebx, 0x4021d0
jb 0x401bfd
test byte [0x402005], 0x10
je 0x401c24
rdtsc
add dword [0x402045], eax
adc dword [0x402049], edx
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401ccb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push str.nbtscan_1.0.35___2008_04_08___http:__www.unixwiz.net_tools_
push 0x406698
call fcn.00401def
add esp, 8
mov eax, dword [ebp + 8]
push eax
push str.usage:__s__options__target__targets..._
call fcn.00401def
add esp, 8
push 0x40666c
call fcn.00401def
add esp, 4
push str.___Targets_are_lists_of_IP_addresses__DNS_names__or_address
call fcn.00401def
add esp, 4
push str.___ranges._Ranges_can_be_in__nbits_notation___192.168.12.0_24__
call fcn.00401def
add esp, 4
push str.___or_with_a_range_in_the_last_octet___192.168.12.64_97__
call fcn.00401def
add esp, 4
push 0x40666c
call fcn.00401def
add esp, 4
push str.____V________show_Version_information
call fcn.00401def
add esp, 4
push str.____f________show_Full_NBT_resource_record_responses__recommended_
call fcn.00401def
add esp, 4
push str.____H________generate_HTTP_headers
call fcn.00401def
add esp, 4
push str.____v________turn_on_more_Verbose_debugging
call fcn.00401def
add esp, 4
push str.____n________No_looking_up_inverse_names_of_IP_addresses_responding
call fcn.00401def
add esp, 4
xor ecx, ecx
mov cx, word [0x408042]
push ecx
push str.____p__n_____bind_to_UDP_Port__n___default_d_
call fcn.00401def
add esp, 8
push str.____m________include_MAC_address_in_response__implied_by__f_
call fcn.00401def
add esp, 4
mov edx, dword [0x408018]
push edx
push str.____T__n_____Timeout_the_no_responses_in__n__seconds__default_d_secs_
call fcn.00401def
add esp, 8
mov eax, dword [0x40801c]
push eax
push str.____w__n_____Wait__n__msecs_after_each_write__default_d_ms_
call fcn.00401def
add esp, 8
push str.____t__n_____Try_each_address__n__tries__default1_
call fcn.00401def
add esp, 4
push str.____1________Use_Winsock_1_only
call fcn.00401def
add esp, 4
push str.____P________generate_results_in_perl_hashref_format
call fcn.00401def
add esp, 4
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop ebp
ret

Function at 0x403600
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x40361e
push 0x15
push str.packetio.c
push str.pak___0
call dword [sym.imp.MSVCRT.dll__assert]
add esp, 0xc
cmp dword [ebp + 0x14], 0
jne 0x403639
push 0x16
push str.packetio.c
push str.dst___0
call dword [sym.imp.MSVCRT.dll__assert]
add esp, 0xc
push 0x10
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WSOCK32.dll_sendto]
pop ebp
ret