joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ea60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x43ea79
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x43ea8e
cmp eax, 2
je 0x43eb00
jmp 0x43eb31
push 0xbbf966b4
push dword [0x4504cc]
call fcn.004433b0
add esp, 8
test eax, eax
je 0x43eacb
mov ecx, dword [esi]
test ecx, ecx
je 0x43eaf8
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43ead4
cmp dword [esp], 0
je 0x43ead4
mov dword [esi + 4], 3
jmp 0x43eaf8
mov dword [esi + 4], 1
jmp 0x43eb31
lea eax, [esp + 0xc]
push eax
call fcn.00443bb0
add esp, 4
test al, al
je 0x43eaf8
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43eaf5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43eb31
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
push 0x732f71fd
push dword [0x4584f4]
call fcn.004433b0
add esp, 8
push dword [esp + 4]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43ec0a
mov eax, dword [esi]
mov dword [esp + 8], eax
mov dword [esp], 0x34353a3b
mov eax, 0x9a22fb6
mov edi, 0x65dd049
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x9a22fb6]
mov edx, edi
and edx, 0x608904b
mov esi, eax
and esi, 0x8000084
or esi, edx
xor esi, ecx
xor esi, 0x28554084
mov ebx, 0xbfd51170
sub ebx, esi
mov ecx, ebx
add esi, 0x402aee8f
mov edx, esi
and esi, 0x1e
and ebx, 0xe1
or ebx, esi
not edx
xor ebx, 0x1f
and edx, 1
or edx, ebx
and ecx, 1
add edx, ecx
mov byte [esp + eax - 0x9a22fb6], dl
inc eax
dec edi
cmp eax, 0x9a22fba
jne 0x43eb50
mov eax, dword [esp]
mov ecx, dword [0x4504d8]
test ecx, ecx
je 0x43ec0a
xor edx, edx
mov esi, dword [0x4504dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xfd743ac4
je 0x43ebe0
inc edx
cmp ecx, edx
jne 0x43ebd0
jmp 0x43ec0a
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43ec0a
push dword [esp + 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [esp + 0x18]
push 5
push dword [0x4504e0]
push ecx
call fcn.00440d90
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43fad0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov dword [esp + 0x30], 0x89068b3e
mov dword [esp + 0x34], 0x85328734
mov dword [esp + 0x38], 0x81708330
mov dword [esp + 0x3c], 0x9d2a9f3c
mov dword [esp + 0x40], 0x999a9b28
mov dword [esp + 0x44], 0
mov eax, 0xd44ed963
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x2bb126cd]
xor ecx, eax
mov edx, ecx
and edx, 0x5c
xor edx, 0x2081225c
and ecx, 0xc40000a3
sub ecx, edx
add ecx, 0xda75c110
mov edx, ecx
and edx, 0x5c
xor ecx, 0x5c
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0x2bb126cd], cl
inc eax
cmp eax, 0xd44ed97b
jne 0x43fb10
lea eax, [esp + 0x30]
push eax
call fcn.00442eb0
add esp, 4
mov dword [0x4584f4], eax
mov dword [esp + 0x2c], 0xfc343f07
test eax, eax
je 0x43fb75
mov dword [esp + 0x2c], 0x1047607f
mov ebp, 0x2796fac8
xor eax, eax
cmp ebp, 0xe47629dd
setl al
mov eax, dword [eax*4 + 0x44e43c]
mov ecx, 0xcf3ed168
xor ecx, dword [0x44e444]
add eax, ecx
inc eax
mov dword [esp + 0x28], ecx
jmp eax

Function at 0x440cc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44e858]
Function at 0x441d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x441dd2
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, edx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x441f6e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x441f6e
mov dword [esp], 0x909f9e9d
mov eax, 0xc4e76de5
nop
nop
movzx edx, byte [esp + eax + 0x3b18921b]
mov ecx, eax
and ecx, edx
mov edi, ecx
and edi, 2
mov ebp, ecx
or ecx, 2
imul ecx, edi
xor edi, 2
and ebp, 0xffffffed
imul ebp, edi
add ecx, ebp
add edx, eax
mov edi, ecx
xor edi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, edi
mov edx, 1
sub edx, ecx
or edx, 0xfe
or ecx, 1
sub ecx, edx
add cl, 0x85
mov byte [esp + eax + 0x3b18921b], cl
inc eax
cmp eax, 0xc4e76de9
jne 0x441de0
mov eax, dword [esp]
mov ecx, dword [0x4504d8]
test ecx, ecx
je 0x441e60
xor edx, edx
mov edi, dword [0x4504dc]
mov ebp, dword [esp + 0x20]
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x441e66
inc edx
cmp ecx, edx
jne 0x441e50
jmp 0x441e90
mov ebp, dword [esp + 0x20]
jmp 0x441e90
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x441e90
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x4504e0]
push ecx
call fcn.00440d90
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x441f6e
push 0x732f71fd
push dword [0x4584f4]
call fcn.004433b0
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp + 4], 0x909f9e9d
mov edx, 0xc4e76de5
nop
nop
movzx esi, byte [esp + edx + 0x3b18921f]
mov ebx, edx
and ebx, esi
mov edi, ebx
and edi, 2
mov ebp, ebx
or ebx, 2
imul ebx, edi
xor edi, 2
and ebp, 0xffffffed
imul ebp, edi
add ebx, ebp
add esi, edx
mov edi, ebx
xor edi, esi
not ebx
and ebx, esi
add ebx, ebx
sub ebx, edi
mov esi, 1
sub esi, ebx
or esi, 0xfe
or ebx, 1
sub ebx, esi
add bl, 0x85
mov byte [esp + edx + 0x3b18921f], bl
inc edx
cmp edx, 0xc4e76de9
jne 0x441ed0
mov edx, dword [0x4504d8]
test edx, edx
je 0x441f6e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4504dc]
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x441f50
inc edi
cmp edx, edi
jne 0x441f40
jmp 0x441f6e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x441f6e
push ecx
push 1
push dword [0x4504e0]
push edx
mov esi, eax
call fcn.00440d90
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4432c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov dword [esp], 0x3020130
mov eax, 0xab516b80
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x54ae9480]
xor edx, eax
mov esi, edx
xor esi, 0x7f
lea edx, [esi + edx*2]
inc dl
mov byte [esp + eax + 0x54ae9480], dl
inc eax
cmp eax, 0xab516b84
jne 0x4432e0
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44efd8]

Function at 0x4433b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
push eax
mov edi, esp
movzx eax, word [eax]
mov dword [ebp - 0x20], 0x7f7e0735
mov dword [ebp - 0x1c], 0
mov ecx, 0x2a
mov esi, 0x15
nop
nop
nop
nop
nop
nop
mov edx, esi
and edx, 0x14
mov ebx, ecx
and ebx, 0x2b
or ebx, edx
xor bl, byte [ebp + ecx - 0x4a]
xor bl, 0xd4
add bl, 0x6e
mov byte [ebp + ecx - 0x4a], bl
inc ecx
dec esi
cmp ecx, 0x32
jne case.default.0x44340b
xor ecx, ecx
cmp dword [ebp - 0x20], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44f028]

Function at 0x443522
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp ecx, dword [ebp - 0x48]
setb al
mov esi, 2
jmp dword [eax*4 + 0x44f060]

Function at 0x443992
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
jmp dword [ecx*4 + 0x44f0e8]
Function at 0x43115c
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x431197
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x43117e
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x43118f
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x431199
inc edi
add eax, 0x28
cmp edi, esi
jb 0x431174
xor eax, eax
pop edi
pop esi
ret
Function at 0x401220
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 8]
push 0x404028
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40125f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x401275
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
jne 0x40129e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push 0
push eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push ebx
push esi
call edi
push 0
push 0
push 0
push esi
mov byte [ebp - 4], 0x4d
mov byte [ebp - 3], 0x5a
mov byte [ebp - 2], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 8]
push 0
push ecx
lea edx, [ebp - 4]
push 2
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451760
Capabilities:
Delete service

Disassembly:
push esi
push edi
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x451792
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.OpenSCManager_Failed__08x_n
call fcn.0045fe03
add esp, 8
mov eax, esi
pop edi
pop esi
ret
push ebx
push 0xf01ff
push str.ss_conn_service
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x4517cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.OpenService_Failed__08x_n
call fcn.0045fe03
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
push edi
call ebx
pop ebx
pop edi
mov eax, esi
pop esi
ret
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x451802
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.DeleteService_Failed__08x_n
call fcn.0045fe03
add esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push edi
call ebx
pop ebx
pop edi
mov eax, esi
pop esi
ret
push str.DeleteService_Succeed_n
call fcn.0045fe03
add esp, 4
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push edi
call ebx
pop ebx
pop edi
mov eax, esi
pop esi
ret

Function at 0x453a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004535df
push eax
push esi
push dword [ebp + 8]
call fcn.00453594
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004535cf
out dx, al
or bh, byte [eax + 0x48]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004535cf
mov byte [0x8d75989f], al
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x453ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004535df
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00453594
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.004535df
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00453594
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004535cf
push cs
xchg esi, eax
invalid
Function at 0x423da0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x423dc2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x423dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x423db8
mov eax, 1
add ebx, ebx
jne 0x423ddb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x423dd0
jne 0x423dec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423dd0
xor ecx, ecx
sub eax, 3
jb 0x423e00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x423e72
mov ebp, eax
add ebx, ebx
jne 0x423e0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423e18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423e3c
inc ecx
add ebx, ebx
jne 0x423e28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423e1d
jne 0x423e39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423e1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x423e5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x423e4d
jmp 0x423dbe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x423e5c
add edi, ecx
jmp 0x423dbe
pop esi
mov edi, esi
mov ecx, 6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x423e7a
cmp byte [edi], 2
jne 0x423e7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x423e7f
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x423ef7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x238e0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2391c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423eac
mov ecx, edi
jns 0x423edb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23920]
or eax, eax
je 0x423ef1
mov dword [ebx], eax
add ebx, 4
jmp 0x423ec9
call dword [esi + 0x23930]
mov ebp, dword [esi + 0x23924]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x423f2b
sub esp, 0xffffff80
jmp 0x401274
Function at 0x9bfc05
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9bfc2c
call fcn.00962138
mov dword [eax], esi
call fcn.00962125
push 0x16
pop esi
mov dword [eax], esi
call fcn.00962d7a
mov eax, esi
jmp 0x9bfc81
test dword [ebp + 0xc], 0xfffffff9
jne 0x9bfc12
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9bfc59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0096214b
pop ecx
call fcn.00962125
mov eax, dword [eax]
jmp 0x9bfc81
test al, 0x10
jne 0x9bfc7f
test al, 1
je 0x9bfc7f
test byte [ebp + 0xc], 2
je 0x9bfc7f
call fcn.00962138
mov dword [eax], 5
call fcn.00962125
mov dword [eax], 0xd
jmp 0x9bfc50
xor eax, eax
pop esi
pop ebp
ret

Function at 0x80039fd
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043a0], 0x30
mov dword [0x80043a8], 0x80032e8
mov dword [0x80043a4], 2
mov dword [0x80043ac], 0
mov dword [0x80043b0], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003a40
mov dword [0x80043b4], eax
mov dword [0x80043c8], 0x80041d4
mov dword [0x80043c0], 0xf
mov dword [0x80040f6], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043b8], eax
mov dword [0x80043cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040fe], ebp
mov dword [0x80043bc], eax
push 0x80043a0
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004420], eax
push 0
push dword [0x80040f6]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004418], eax
push 1
push dword [0x8004418]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004418]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003afe
xor edi, edi
lea ebx, [0x80043d0]
jmp 0x8003b16
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003b08
jmp 0x8003b2a
mov eax, dword [0x80043d8]
call 0x80029cd
ret
Function at 0x4016a0
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x5c5b14]
xor eax, esp
mov dword [esp + 0x38], eax
xor ecx, ecx
mov eax, 0xac44
mov edx, 2
mul edx
seto cl
push ebx
push esi
push edi
neg ecx
or ecx, eax
push ecx
call fcn.00443a41
add esp, 4
push 8
xor esi, esi
push esi
push esi
lea edx, [esp + 0x3c]
push edx
mov ebx, eax
push 0xffffffffffffffff
lea eax, [esp + 0x20]
xor ecx, ecx
mov edi, 0x15888
push eax
mov dword [esp + 0x48], 0x10001
mov dword [esp + 0x4c], 0xac44
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], 0x100002
mov word [esp + 0x58], cx
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x4017d0
mov dword [esp + 0x14], edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
lea ecx, [ecx]
mov edx, dword [esp + 0xc]
push 0x20
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov ecx, dword [esp + 0xc]
push 0x20
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.WINMM.dll_waveInStart]
test eax, eax
jne 0x4017d0
test byte [esp + 0x20], 1
jne 0x40178b
lea ebx, [ebx]
push 0x64
call edi
test byte [esp + 0x20], 1
je 0x401780
mov ecx, dword [esp + 0xc]
push 0x20
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
mov eax, ebx
call fcn.004015b0
call fcn.0055f350
fmul qword [0x5a44e8]
call fcn.005473c0
cmp eax, dword [0x5cd8c4]
je 0x4017c1
cmp esi, 2
jg 0x4017e4
inc esi
mov dword [0x5cd8c4], eax
cmp esi, 0xc
jle 0x401740
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.005434c7
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.005434c7
mov esp, ebp
pop ebp
ret

Function at 0x401a60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
push esi
push edi
push 0x5a1fec
push str.C:UsersPublicMusicen.dat
call fcn.00544184
push 2
mov esi, eax
push 0
push esi
call fcn.00544225
push esi
call fcn.00544435
push 0
push 0
push esi
mov ebx, eax
call fcn.00544225
push ebx
call fcn.00443a41
push esi
push ebx
mov edi, eax
push 1
push edi
call fcn.005446e4
push esi
mov ebx, eax
call fcn.0054476e
mov eax, ebx
mov edx, edi
call fcn.00401800
push 0x5a1ff0
push str.C:UsersPublicMusicde.dat
call fcn.00544184
add esp, 0x44
mov esi, eax
push esi
push ebx
push 1
push edi
call fcn.00544939
push esi
call fcn.0054476e
push edi
call fcn.00443a36
add esp, 0x18
pop edi
pop esi
pop ebx
ret