joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4700e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c858
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x565240]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x90], 1
mov dword [ebp - 0x24], eax
jl 0x470336
mov edx, dword [eax + 0x20]
lea ecx, [ebp - 0x20]
xor ebx, ebx
push ecx
push edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [0x51f850]
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push 0xffffff
mov ecx, esi
call edx
mov dword [ebp - 0x58], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ebx
mov ecx, esi
call edx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x54], eax
call fcn.004796fe
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.004796fe
mov byte [ebp - 4], 1
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call edi
push eax
lea ecx, [ebp - 0x38]
call fcn.00479d55
mov eax, dword [esi + 4]
push eax
call edi
push eax
lea ecx, [ebp - 0x50]
call fcn.00479d55
mov eax, dword [ebp + 0xc]
cmp eax, 4
ja 0x47031b
jmp dword [eax*4 + 0x407d24]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call int.00479dd6
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call int.00479dd6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call 0x562ac6
mov esp, ebp
pop ebp
ret 8
Function at 0x47389d
Capabilities:
Encode data using xor

Disassembly:
aad 0x23
out 0x51, eax
pop es
inc esi
and al, 0xb3
adc byte [di - 0x328f], 0x26
xchg esi, eax
invalid
aam 0x43
daa
cmp byte [ebx - 0x1b09380e], al
xlatb
jl 0x473875
or dword [ebx + 0x34], edx
push edi
mov esp, 0xb08be477
cmc
je 0x473930
lds eax, [edi + 0x75f39945]
loop 0x473905
arpl word [ebp - 3], ax
in al, 0xf0
or eax, 0x76120852
mov esi, dword [ebx - 0x3b]
int1
lodsb al, byte [esi]
fild word [edi + 0x7ad79782]
inc esi
stosd dword es:[edi], eax
invalid
pop ecx
or ebx, dword [0xbd155cc6]
imul dword [ebx + edi + 0x4c]
mov ah, 0x74
xchg ebp, eax
imul esi, esp, 0xad4caf12
int3
mov ebx, 0x50fc874d
mov al, byte [esp + ebx*8]
add al, 0xdc
ror dword [edx + 0x47], cl
inc dword [edi - 0x68]
or dword [eax + 0x1a7f5ac2], 0x23
adc edx, edi
cld
jl 0x473936
xor ebx, ebp
push 0xffffffffffffffbc
push ds
loop 0x4739ba
int3
salc
xchg ebp, eax
or al, 0x35
sub dl, byte [ebx]
cwde
out 0x28, eax
mov al, 0x18
out 0x8c, eax
xchg edi, eax
or ch, dh
sbb dword [esi], 0x481c7c4
test esi, edi
mov ah, 0x21
push esi
xor eax, 0xf81eff7a
mov dword [ecx - 0x4b017afc], 0x7a355621
call [esi]
clc
jmp 0x5b3246e1
cld
cmp al, 0x5c
dec esp
jmp 0x11a985dd
bound edx, qword [ecx]
sub dh, byte [ecx - 0x29fa087a]
in al, dx
sbb ch, 0xd1
ja 0x47397c
cld
cli
jge 0x473969
xor eax, 0xb7f862f1
pop ebp
or ah, bl
mov dl, 0xb2
in eax, dx
push esp
inc ecx
lcall 0xf6ba, 0x17c7aaf4
adc esp, dword [0xc7eb7fc2]
pop ebx
loope 0x4739b3
popal
popfd
cmc
stosb byte es:[edi], al
xchg esi, eax
mov ah, byte [edi - 0x8bbea93]
mov word [esp + edx], ss
call 0x6bf470b6
das
sbb bl, byte [edi]
inc ebx
cmp byte [ecx - 0x1178d890], ah
inc edi
invalid

Function at 0x479d55
Capabilities:
Encode data using xor

Disassembly:
inc ebx
int1
mov al, 8
nop
sub edx, dword [esi]
sbb eax, 0x79a0dcb
and byte [edi], dh
push cs
retf
xor al, 0xe0
dec eax
pop ebp
imul eax, edx, 0x937e4af6
jle 0x479cd6
dec edx
jle 0x479cd6
cmp eax, 0x8edc07fb
cmc
mov esi, edi
mov byte [0x547e3a82], al
jbe 0x479d8f
movsb byte es:[edi], byte [esi]
jle 0x479db9
invalid
leave
mov esp, dword [ebx + 0x27]
and ch, cl
jecxz 0x479d40
sbb al, 0x24
jae 0x479d39
salc
and eax, 0x4a44c4a5
dec edi
adc dword [ecx - 0x1f8f6135], ebp
pop ss
push eax
mov dword [ecx + 0x17], ecx
mov byte [0xb41f3903], al
push esi
sbb eax, dword [ebx]
add al, byte [edi]
or dh, cl
mov byte [0x6ca222d4], al
xor edx, eax
mov byte [0x17395a4a], al
add dword [edi - 0x632c483d], eax
xchg ebx, eax
mov bh, 0xd3
pushfd
mov bh, 0xd3
pushfd
xchg ecx, eax
sub dword [edx], esi
sub byte [edi + ebx*4], cl
push edi
cwde
or al, 0x5d
test eax, 0xb293b4c3
lodsb al, byte [esi]
jnp 0x479d6f
fdiv st(1)
mov ah, 0x42
dec ebx
movsb byte es:[edi], byte [esi]
invalid
cmp dword [ebp + 0x42088418], ebx
ret
Function at 0x48f560
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x56cdb8
mov dword [0x56cd24], 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x48f577
push esi
push edi
mov ecx, 6
mov esi, 0x546f1c
mov edi, 0x56cebc
rep movsd dword es:[edi], dword [esi]
push 0x56cd18
movsb byte es:[edi], byte [esi]
push 1
mov dword [0x56ceb8], 0x7d0
mov dword [0x56cefc], 1
call dword [sym.imp.WINMM.dll_waveInOpen]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop esi
test edx, edx
jg 0x48f5d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop ebp
ret

Function at 0x492d40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c858
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x565240]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x90], 1
mov dword [ebp - 0x24], eax
jl 0x492f96
mov edx, dword [eax + 0x20]
lea ecx, [ebp - 0x20]
xor ebx, ebx
push ecx
push edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [0x51f850]
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push 0xffffff
mov ecx, esi
call edx
mov dword [ebp - 0x58], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ebx
mov ecx, esi
call edx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x54], eax
call fcn.0049c35e
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0049c35e
mov byte [ebp - 4], 1
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call edi
push eax
lea ecx, [ebp - 0x38]
call fcn.0049c9b5
mov eax, dword [esi + 4]
push eax
call edi
push eax
lea ecx, [ebp - 0x50]
call fcn.0049c9b5
mov eax, dword [ebp + 0xc]
cmp eax, 4
ja 0x492f7b
jmp dword [eax*4 + 0x407d24]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.0049ca36
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0049ca36
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call 0x585726
mov esp, ebp
pop ebp
ret 8
Function at 0x4a1509
Capabilities:
Encode data using xor

Disassembly:
bound eax, qword [esi + 0x5ed5784a]
adc dh, cl
lea esi, [ebx + edi - 0x6d1fcc1a]
jmp 0x7d164216
fldcw word [edx]
aam 0xd0
mul byte [ebp - 0x39]
xchg esp, eax
in eax, dx
sub dword [ebp - 0x2f], 0xffffffe7
in eax, dx
add byte [esi - 0x4b], bh
arpl si, dx
push 0xffffffffffffffb4
shr dword [esp + ecx*4 + 0x3d], 1
and eax, dword [eax - 0x2e]
push edi
mov ecx, 0xefdc9cc4
invalid
lea esp, [eax]
mov dl, 0x8f
stosb byte es:[edi], al
neg edi
xlatb
hlt
rep stosd dword es:[edi], eax
jo 0x4a1488
pop ds
xchg esp, eax
mov al, 0xdc
xchg byte [ecx - 0x2a6161ce], ah
loop 0x4a1506
sahf
sahf
aad 0xe2
adc eax, 0x48b4e099
cdq
loopne 0x4a14a8
dec eax
ret
movsd dword es:[edi], dword [esi]
sub eax, 0x97784695
inc esi
js 0x4a14a3
inc esi
js 0x4a14a3
dec eax
push ebp
mov ch, 0x25
or esi, dword [edi + 9]
xor esp, dword [esi]
xlatb
jle 0x4a14ec
lodsb al, byte [esi]
push es
les eax, ss:[ecx]
in al, 0xef
clc
outsd dx, dword [esi]
xor eax, 0x43a6721c
sti
jg 0x4a14e1
nop
jae 0x4a1540
fnstsw word [edi - 0x7f9f1df7]
lodsb al, byte [esi]
rcl dword [esi + esi*2], 3
jle 0x4a15a3
invalid
ljmp 0x9dd7:0x2d07a871
call 0xe2d1c8b6
pop edx
mov bl, 0x87
loop 0x4a15f6
int3
jb 0x4a1598
dec eax
sbb dword [edi + ebp*2], 0xffffffdb
enter 0x2225, 0x2b
invalid
cli
and ecx, dword [0x478dd2a6]
mov bl, 0x67
cmp al, 0x94
shl dword [ebp - 0x7e28d140], 0xa5
dec ebx
je 0x4a1595
xlatb
and dword [ebp - 0x65758bb5], 0xc1cf8fbb
cdq
xor edi, dword [eax - 0x78eea6dc]
lcall 0x3399, 0xc1cf8fbb
mov eax, 0x87115924
sbb dword [eax - 0x1cbc1d88], edi
mov byte [ebx + ebp + 0x3ff62d6f], al
sub dl, al
movsb byte es:[edi], byte [esi]
jae 0x4a1604
ret

Function at 0x4b2560
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x56cdb8
mov dword [0x56cd24], 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4b2577
push esi
push edi
mov ecx, 6
mov esi, 0x546f1c
mov edi, 0x56cebc
rep movsd dword es:[edi], dword [esi]
push 0x56cd18
movsb byte es:[edi], byte [esi]
push 1
mov dword [0x56ceb8], 0x7d0
mov dword [0x56cefc], 1
call dword [sym.imp.WINMM.dll_waveInOpen]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop esi
test edx, edx
jg 0x4b25d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop ebp
ret
Function at 0x4b5d40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c858
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x565240]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x90], 1
mov dword [ebp - 0x24], eax
jl 0x4b5f96
mov edx, dword [eax + 0x20]
lea ecx, [ebp - 0x20]
xor ebx, ebx
push ecx
push edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [0x51f850]
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push 0xffffff
mov ecx, esi
call edx
mov dword [ebp - 0x58], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ebx
mov ecx, esi
call edx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x54], eax
call fcn.004bf35e
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.004bf35e
mov byte [ebp - 4], 1
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call edi
push eax
lea ecx, [ebp - 0x38]
call fcn.004bf9b5
mov eax, dword [esi + 4]
push eax
call edi
push eax
lea ecx, [ebp - 0x50]
call fcn.004bf9b5
mov eax, dword [ebp + 0xc]
cmp eax, 4
ja 0x4b5f7b
jmp dword [eax*4 + 0x407d24]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.004bfa36
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.004bfa36
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call 0x5a8726
mov esp, ebp
pop ebp
ret 8

Function at 0x4bf35e
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x49
arpl word [0x3d8fc489], si
inc esi
sub dword [edx*4 - 0x49c4f160], esp
inc edx
les ecx, [edi + 0x2429463d]
xchg ebp, eax
mov al, byte [0x42b63b0e]
mov esi, 0x61ce2677
jge 0x4bf3b2
scasb al, byte es:[edi]
jae 0x4bf379
adc al, ah
insd dword es:[edi], dx
pushfd
mov word [esi - 0x63302d70], es
cmp eax, 0xa7747e80
loop 0x4bf363
add eax, 0xa27c391e
lodsd eax, dword [esi]
ljmp 0xbca9
xor al, 0x1d
test byte [eax], dh
push eax
push edx
out dx, al
in al, dx
pop ds
movsd dword es:[edi], dword [esi]
aaa
xor al, 0x44
lahf
xlatb
add edx, edi
dec ecx
xchg ebp, eax
xor al, 8
fcom st(6)
fsub dword [ecx - 0x6a64e6f2]
xchg ebp, eax
push 0xffffffffffffffb2
mov esi, 0x62bc437f
cmp al, 0x5e
mov edi, 0x58cb2e07
scasd eax, dword es:[edi]
inc esi
mov ebp, 0xa46f6918
not word [edi - 0x67]
sahf
inc ebp
dec eax
lea sp, [esi]
adc eax, 0xe6e44b47
stosd dword es:[edi], eax
inc edi
add byte [ecx - 0x2ccc29dd], dh
xor eax, 0x477d2cc2
test eax, 0x65fc37f2
invalid

Function at 0x4bfe9e
Capabilities:
Encode data using xor

Disassembly:
push 0x47b16623
push eax
pop es
ljmp 0xe618
xlatb
inc esi
loopne 0x4bfecb
push esp
push ds
pop ss
mov al, 0xe4
ja 0x4bfeb0
xor edi, esp
dec esi
and al, 0x2c
std
fidiv word [ebp - 0x666101c9]
retf
mov ch, 0x37
invalid
xchg ecx, eax
out dx, eax
lodsd eax, dword [esi]
out dx, al
scasd eax, dword es:[edi]
jbe 0x4bfe69
in al, 0xe5
mul byte [ecx + ecx*8 + 0x67]
or cl, byte [edi - 0x5e]
invalid
Function at 0x4c3b78
Capabilities:
Encode data using xor

Disassembly:
pop eax
jg 0x4c3bf2
or dword [eax + 0x9d53c], esi
push ebx
jge 0x4c3b4f
loopne 0x4c3bd4
fsubr qword [esi]
xchg esp, eax
add bl, byte [ecx]
cmp byte [0x93a59a68], dh
movsb byte es:[edi], byte [esi]
pop ss
scasb al, byte es:[edi]
call 0x2361a413
scasb al, byte es:[edi]
sub byte [0x73295212], bh
xor eax, 0x24e66677
sub byte [edi - 0x49cd9ec8], 0x35
or byte [eax - 0xc], ch
add byte [esi], cl
sbb byte [eax - 0x314bb7b0], bh
xlatb
sub al, ah
sbb dl, byte [esi - 0x5c]
xor dword [eax], esp
movsb byte es:[edi], byte [esi]
inc edi
loop 0x4c3b9a
jbe 0x4c3bfc
and eax, 0x947e23a0
xor dword [edx + 0x22], esp
push esi
fbstp tbyte [0x1727173f]
pop ss
dec esi
sbb al, 0x9a
pop ss
jl 0x4c3c1a
sbb esp, dword [esi + 0x79]
push es
ljmp 0xab91
sbb byte [ebp + 0x20], dl
push edi
push ebp
pop edi
jmp 0xddc5d205
sbb dl, cl
push ss
stosb byte es:[edi], al
mov bh, dh
sub dword [edx - 0x1a235be4], ebp
dec eax
sar dword [esi + edx*2], 0x38
xchg cl, ch
sbb al, 0xaa
cld
loope 0x4c3beb
ret
mov ah, 0xdd
invalid

Function at 0x4d5c70
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x56cdb8
mov dword [0x56cd24], 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4d5c87
push esi
push edi
mov ecx, 6
mov esi, 0x546f1c
mov edi, 0x56cebc
rep movsd dword es:[edi], dword [esi]
push 0x56cd18
movsb byte es:[edi], byte [esi]
push 1
mov dword [0x56ceb8], 0x7d0
mov dword [0x56cefc], 1
call dword [sym.imp.WINMM.dll_waveInOpen]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop esi
test edx, edx
jg 0x4d5ce7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop ebp
ret
Function at 0x4d9450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c858
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x565240]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x90], 1
mov dword [ebp - 0x24], eax
jl 0x4d96a6
mov edx, dword [eax + 0x20]
lea ecx, [ebp - 0x20]
xor ebx, ebx
push ecx
push edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [0x51f850]
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push 0xffffff
mov ecx, esi
call edx
mov dword [ebp - 0x58], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ebx
mov ecx, esi
call edx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x54], eax
call fcn.004e2a6e
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.004e2a6e
mov byte [ebp - 4], 1
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call edi
push eax
lea ecx, [ebp - 0x38]
call fcn.004e30c5
mov eax, dword [esi + 4]
push eax
call edi
push eax
lea ecx, [ebp - 0x50]
call fcn.004e30c5
mov eax, dword [ebp + 0xc]
cmp eax, 4
ja 0x4d968b
jmp dword [eax*4 + 0x407d24]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.004e3146
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.004e3146
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call 0x5cbe36
mov esp, ebp
pop ebp
ret 8

Function at 0x4f8d30
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, 0x56cdb8
mov dword [0x56cd24], 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4f8d47
push esi
push edi
mov ecx, 6
mov esi, 0x546f1c
mov edi, 0x56cebc
rep movsd dword es:[edi], dword [esi]
push 0x56cd18
movsb byte es:[edi], byte [esi]
push 1
mov dword [0x56ceb8], 0x7d0
mov dword [0x56cefc], 1
call dword [sym.imp.WINMM.dll_waveInOpen]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop esi
test edx, edx
jg 0x4f8da7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop ebp
ret
Function at 0x4fc510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c858
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x565240]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x90], 1
mov dword [ebp - 0x24], eax
jl 0x4fc766
mov edx, dword [eax + 0x20]
lea ecx, [ebp - 0x20]
xor ebx, ebx
push ecx
push edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [0x51f850]
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push 0xffffff
mov ecx, esi
call edx
mov dword [ebp - 0x58], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ebx
mov ecx, esi
call edx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x54], eax
call fcn.00505b2e
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.00505b2e
mov byte [ebp - 4], 1
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call edi
push eax
lea ecx, [ebp - 0x38]
call fcn.00506185
mov eax, dword [esi + 4]
push eax
call edi
push eax
lea ecx, [ebp - 0x50]
call fcn.00506185
mov eax, dword [ebp + 0xc]
cmp eax, 4
ja 0x4fc74b
jmp dword [eax*4 + 0x407d24]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.00506206
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.00506206
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call 0x5eeef6
mov esp, ebp
pop ebp
ret 8
Function at 0x505b2e
Capabilities:
Encode data using xor

Disassembly:
jl 0x505b48
invalid
or eax, 0x43b845ff
invalid
salc
xchg edx, eax
in al, dx
nop
stc
jns 0x505b01
cmp edx, ecx
movsb byte es:[edi], byte [esi]
and eax, 0xfe91feac
fsubr dword [edx - 0x93d56fe]
jbe 0x505bc0
loopne 0x505af8
cmp dword [esi + 0x67], esi
nop
mov dh, 0x1c
out dx, eax
jae 0x505b54
inc ebx
sbb byte [ecx], dl
nop
cli
sub dword [ecx + eax], 0x2f36845f
out 0xd6, eax
sub al, 0x71
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
add cl, byte [edx + ebx*2 - 0x2a]
push es
cmp ah, dl
inc ecx
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
xor al, 0xe3
xor al, 0x27
jg 0x505be4
salc
xlatb
cwde
aad 0x59
int 0xb1
add dword [esi], 0x3960330d
inc ecx
add byte [ecx - 0x304b4b], ch
jb 0x505baa
ret
push ecx
sbb dword [ecx - 0x19], esp
mov ecx, 0xf4a8a674
xor esp, esp
and al, 0x7d
fisub word [edx - 0x7d69cb2c]
add bl, cl
add eax, 0x5a149d93
xchg ebx, eax
popfd
adc al, 0x5a
jno 0x505b87
push ecx
inc edi
aaa
dec esi
push 0x70
popal
sar byte [edx - 0x30], 0x17
out 0xf3, eax
cld
in al, 0xf4
sbb eax, dword [0x67c87a2c]
cmp eax, 0xc9316570
and ah, al
cmc
scasb al, byte es:[edi]
mov dword [0x63589b66], eax
rcr dword [ecx - 0x5af5be94], 0x81
out 0x3d, eax
nop
sahf
and byte [esp + esi + 0x23c1fa51], 0x22
jbe 0x505c68
mov ch, 0x6f
cmp dl, byte [edi - 0x7c]
dec ebx
test ah, dl
popfd
xchg esp, eax
lds edi, [edx + ebx*4 + 0x274750e2]
iretd
jl 0x505c07
push ecx
mov esp, 0xf540a1b3
stosb byte es:[edi], al
xor eax, 0x5a40b747
hlt
invalid
cmc
enter 0xffffffffffffb79d, 0xffffffffffffffb2
dec eax
push esi
push cs
cmpsd dword [esi], dword es:[edi]
in eax, dx
add eax, dword [ebp - 0x6ea97f53]
jne 0x505c14
je 0x505cb2
sbb dword [edx + 0x4c263bbe], ebp
xlatb
test esp, ebx
mov ebx, 0x98edfb8
or al, 0x7d
push ecx
jl 0x505c2b
xchg esi, eax
popfd
cmp eax, 0xd990c3a8
enter 0xffffffffffff9b50, 0x7c
sub byte [edx + 0x687a9b80], bl
daa
mov gs, word [edx - 0xfc0b4d9]
fdivrp st(3)
int3
or eax, 0xc359d6db
mov dword [0x429da475], eax
dec esi
cmp bh, byte [esi - 0x1c]
sahf
invalid
Function at 0x51a44d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x522398
cmp edx, dword [eax]
je 0x51a46f
add eax, 8
inc ecx
cmp eax, 0x522428
jl 0x51a460
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x522398]
jne 0x51a59d
mov eax, dword [0x526d5c]
cmp eax, 1
je 0x51a577
test eax, eax
jne 0x51a4a0
cmp dword [0x5222c0], 1
je 0x51a577
cmp edx, 0xfc
je 0x51a59d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x51a4d7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0051ae30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0051b2c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x51a51a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0051b2c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x51f89c
push edi
call fcn.0051d190
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0051ae30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0051ae40
lea eax, [ebp - 0xa0]
push 0x51f87c
push eax
call fcn.0051ae40
push dword [esi + 0x52239c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0051ae40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0051d104
add esp, 0x2c
pop edi
jmp 0x51a59d
lea eax, [ebp + 8]
lea esi, [esi + 0x52239c]
push 0
push eax
push dword [esi]
call fcn.0051b2c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x466f60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5a000]
push edi
jmp 0x466f7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x466f81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x466f70
mov eax, 1
add ebx, ebx
jne 0x466f93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x466fa4
jne 0x466fc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x466fc3
dec eax
add ebx, ebx
jne 0x466fb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x466f88
add ebx, ebx
jne 0x466fbf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x467015
xor ecx, ecx
sub eax, 3
jb 0x466fdb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46704a
sar eax, 1
mov ebp, eax
jmp 0x466fe6
add ebx, ebx
jne 0x466fe6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x466fb4
inc ecx
add ebx, ebx
jne 0x466ff4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x466fb4
add ebx, ebx
jne 0x467001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x466ff6
jne 0x467012
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x466ff6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x467034
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x467026
jmp 0x466f76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x467034
add edi, ecx
jmp 0x466f76
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x467052
cmp byte [edi], 9
jne 0x467052
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x467057
lea edi, [esi + 0x64000]
mov eax, dword [edi]
or eax, eax
je 0x4670cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xaf2e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xaf3c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x467084
mov ecx, edi
jns 0x4670b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xaf3cc]
or eax, eax
je 0x4670c9
mov dword [ebx], eax
add ebx, 4
jmp 0x4670a1
call dword [esi + 0xaf3c8]
mov ebp, dword [esi + 0xaf3d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x467103
sub esp, 0xffffff80
jmp 0x41382f