joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72f6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x72f7f4
push esi
cmp edi, 8
jb 0x72f7b7
lea eax, [edi - 1]
lea eax, [ebx + eax*4]
lea esi, [edi - 1]
lea esi, [edx + esi*4]
cmp edx, eax
ja 0x72f6eb
cmp esi, ebx
jae 0x72f7b7
mov eax, edi
and eax, 0x80000007
jns 0x72f6f9
dec eax
or eax, 0xfffffff8
inc eax
movaps xmm4, xmmword [0x8aa2b0]
mov esi, edi
movaps xmm6, xmmword [0x8aa900]
sub esi, eax
movaps xmm7, xmmword [0x8aa400]
mov eax, 8
mov edi, ebx
sub edi, edx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
movd xmm3, eax
mov eax, 0x10
movd xmm5, eax
lea eax, [edx + 0x10]
mov edx, dword [ebp - 4]
movups xmm2, xmmword [ebx + ecx*4]
add ecx, 8
lea eax, [eax + 0x20]
movaps xmm0, xmm2
psrld xmm0, xmm3
pand xmm0, xmm4
movaps xmm1, xmm0
pslld xmm1, xmm5
por xmm1, xmm0
movaps xmm0, xmm6
pand xmm0, xmm2
paddd xmm1, xmm0
movaps xmm0, xmmword [0x8aa890]
pand xmm0, xmm2
pand xmm1, xmm7
por xmm1, xmm0
movups xmm2, xmmword [edx + eax - 0x20]
movups xmmword [eax - 0x30], xmm1
movaps xmm0, xmm2
psrld xmm0, xmm3
pand xmm0, xmm4
movaps xmm1, xmm0
pslld xmm1, xmm5
por xmm1, xmm0
movaps xmm0, xmm2
pand xmm2, xmmword [0x8aa890]
pand xmm0, xmm6
paddd xmm1, xmm0
pand xmm1, xmm7
por xmm1, xmm2
movups xmmword [eax - 0x20], xmm1
cmp ecx, esi
jl 0x72f734
mov edx, dword [ebp + 0x10]
cmp ecx, edi
jge 0x72f7f3
sub ebx, edx
lea eax, [edx + ecx*4]
sub edi, ecx
mov esi, dword [eax + ebx]
lea eax, [eax + 4]
mov ecx, esi
shr ecx, 8
movzx ecx, cl
mov edx, ecx
shl edx, 0x10
or edx, ecx
mov ecx, esi
and ecx, 0xffff00ff
add edx, ecx
xor edx, esi
and edx, 0xff00ff
xor edx, esi
mov dword [eax - 4], edx
sub edi, 1
jne 0x72f7c2
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x72fdd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + eax*4]
cmp esi, edi
jae 0x72fe19
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [esi]
lea eax, [eax + 2]
mov edx, ebx
mov ecx, ebx
shr ecx, 0xc
add esi, 4
shr edx, 0x10
xor dl, cl
mov ecx, ebx
shr ecx, 0x10
and dl, 0xf
xor dl, cl
mov ecx, ebx
shr ecx, 0x1c
and bl, 0xf0
or cl, bl
mov byte [eax - 2], dl
mov byte [eax - 1], cl
cmp esi, edi
jb 0x72fde6
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x72fe20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + eax*4]
cmp esi, edi
jae 0x72fe73
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [esi]
lea eax, [eax + 2]
mov edx, ebx
mov ecx, ebx
shr edx, 0x10
add esi, 4
shr ecx, 0xd
xor dl, cl
mov ecx, ebx
and dl, 7
shr ecx, 0x10
xor dl, cl
mov ecx, ebx
mov byte [eax - 2], dl
mov edx, ebx
shr edx, 5
shr ecx, 3
xor dl, cl
shr ebx, 5
and dl, 0x1f
xor dl, bl
mov byte [eax - 1], dl
cmp esi, edi
jb 0x72fe36
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x73e970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
mov ecx, esi
mov edx, dword [esi + 4]
add edx, 7
sar edx, 3
call fcn.007523b0
mov ecx, dword [esi + 4]
test eax, eax
je 0x73e9bb
test ecx, ecx
jle 0x73e9b2
mov edx, dword [esi + 0xc]
nop dword [eax + eax]
mov al, byte [esi]
sub ecx, 8
shr dword [esi], 8
mov byte [edx], al
inc edx
test ecx, ecx
jg 0x73e9a0
mov dword [esi + 0xc], edx
mov dword [esi + 4], 0
xor ecx, ecx
mov eax, dword [esi + 8]
lea ebx, [ecx + 7]
sar ebx, 3
add ebx, dword [esi + 0xc]
sub ebx, eax
mov dword [ebp - 8], eax
push edi
push 0x15
mov dword [ebp - 0x24], 0x46464952
lea ecx, [ebx + 1]
mov dword [ebp - 0x1c], 0x50424557
mov esi, ecx
mov dword [ebp - 0x18], 0x4c385056
lea edx, [ecx + 0xc]
mov byte [ebp - 0x10], 0x2f
and esi, 1
add edx, esi
movzx eax, dx
mov byte [ebp - 0x20], al
shr eax, 8
mov byte [ebp - 0x1f], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x1e], al
sar eax, 8
mov byte [ebp - 0x1d], al
movzx eax, cx
mov byte [ebp - 0x14], al
shr eax, 8
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x24]
shr ecx, 0x10
mov byte [ebp - 0x12], cl
sar ecx, 8
push eax
mov eax, dword [edi + 0x48]
mov dword [ebp - 0xc], edx
mov byte [ebp - 0x11], cl
call eax
add esp, 0xc
test eax, eax
je 0x73ea7a
mov eax, dword [edi + 0x48]
push edi
push ebx
push dword [ebp - 8]
call eax
add esp, 0xc
test eax, eax
je 0x73ea7a
test esi, esi
je 0x73ea66
push edi
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push 1
push eax
mov eax, dword [edi + 0x48]
call eax
add esp, 0xc
test eax, eax
je 0x73ea7a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
add ecx, 8
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x755910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
mov dword [ebp - 0xc], ebx
mov esi, dword [ebx]
lea eax, [ecx + esi*2]
add eax, esi
imul ecx, eax, 0x2c
mov eax, dword [ebx + 4]
add ecx, dword [ebx + 0x14]
test eax, eax
jns 0x755951
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x755942
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, eax
jg 0x755ab4
push edi
mov edi, 2
nop
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x755971
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx], eax
mov eax, dword [ebx + 8]
movsx edx, word [eax + esi*2]
test edx, edx
jne 0x7559b9
mov eax, dword [ecx + 4]
inc esi
cmp eax, 0xfffe0000
jb 0x755996
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx + 4], eax
movzx eax, byte [esi + 0x86c484]
imul ecx, eax, 0x84
mov eax, dword [ebx + 8]
movsx edx, word [eax + esi*2]
add ecx, dword [ebx + 0x14]
test edx, edx
je 0x755983
mov eax, dword [ecx + 4]
inc esi
mov dword [ebp - 8], esi
cmp eax, 0xfffe0000
jb 0x7559cf
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx + 4], eax
lea eax, [edx + 1]
cmp edi, eax
mov eax, dword [ecx + 8]
sbb edi, edi
neg edi
cmp eax, 0xfffe0000
jb 0x7559f2
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
add eax, edi
mov dword [ecx + 8], eax
lea eax, [edx + 1]
cmp eax, 2
ja 0x755a1c
movzx eax, byte [esi + 0x86c484]
imul ecx, eax, 0x84
add ecx, 0x2c
add ecx, dword [ebx + 0x14]
jmp 0x755aa5
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, 0x43
cmp eax, 0x43
cmovg eax, edx
xor edi, edi
movzx ebx, word [eax*4 + 0x86fd14]
shr ebx, 1
movzx edx, word [eax*4 + 0x86fd16]
mov dword [ebp - 4], edx
je 0x755a8d
mov esi, dword [ebp - 4]
lea edx, [ecx + 0xc]
nop dword [eax]
test bl, 1
je 0x755a82
mov ecx, edi
mov eax, 2
shl eax, cl
mov ecx, dword [edx]
and eax, esi
neg eax
sbb eax, eax
neg eax
cmp ecx, 0xfffe0000
jb 0x755a79
inc ecx
shr ecx, 1
and ecx, 0x7fff7fff
add eax, 0x10000
add eax, ecx
mov dword [edx], eax
inc edi
add edx, 4
sar ebx, 1
jne 0x755a50
mov esi, dword [ebp - 8]
movzx eax, byte [esi + 0x86c484]
mov ebx, dword [ebp - 0xc]
imul ecx, eax, 0x84
mov eax, dword [ebx + 0x14]
add eax, 0x58
add ecx, eax
mov edi, 2
cmp esi, dword [ebx + 4]
jle 0x755960
pop edi
cmp esi, 0x10
jge 0x755ad1
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x755aca
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx], eax
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x76760f
Capabilities:
Create directory

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov edx, dword [esi + 0xf4]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x767629
sub ecx, edi
sar ecx, 1
cmp ecx, 6
jb 0x76779e
add edx, 0xfffffff4
push 6
push str.XXXXXX
lea ebx, [edx + ecx*2]
push ebx
call fcn.0079b153
add esp, 0xc
test eax, eax
jne 0x76779e
push 0xf0000000
push 1
push eax
push eax
lea eax, [esp + 0x20]
push eax
call dword [0x826004]
test eax, eax
jne 0x767692
call dword [0x826194]
mov dword [esi + 0xf0], eax
mov ecx, eax
call fcn.00768da4
mov dword [esi + 0x48], eax
jmp 0x7677af
mov edi, 0x7fffffff
lea eax, [esp + 0x1c]
push eax
push 8
push dword [esp + 0x18]
call dword [0x826008]
test eax, eax
je 0x767762
mov edx, dword [esp + 0x20]
mov ebp, ebx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 6
mov esi, dword [esp + 0x14]
push 0
push 0x3e
push edx
push eax
call fcn.007e4250
push 0
push 0x3e
mov ax, word [eax*2 + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov word [ebp], ax
lea ebp, [ebp + 2]
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.00796610
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
sub esi, 1
jne 0x7676c6
mov esi, dword [esp + 0x18]
push dword [esi + 0xf4]
call fcn.007e9d3d
pop ecx
test eax, eax
je 0x76773a
call fcn.007a0305
cmp dword [eax], 0x11
jne 0x767727
sub edi, 1
jne 0x767697
jmp 0x767778
or dword [esi + 0x48], 0xffffffff
call fcn.007a02f2
mov ecx, dword [eax]
mov dword [esi + 0xf0], ecx
jmp 0x767770
mov edx, dword [esi + 0x50]
mov ecx, edx
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x767742
sub ecx, ebp
lea eax, [edx - 6]
push 6
add eax, ecx
push ebx
push eax
call fcn.007b100a
add esp, 0xc
and dword [esi + 0x48], 0
jmp 0x767778
call dword [0x826194]
mov dword [esi + 0xf0], eax
mov ecx, eax
call fcn.00768da4
mov dword [esi + 0x48], eax
push 0
push dword [esp + 0x14]
call dword [section..rdata]
test edi, edi
jne 0x7677af
or dword [esi + 0x48], 0xffffffff
call fcn.007a02f2
mov ecx, dword [eax]
mov dword [esi + 0xf0], ecx
jmp 0x767685
mov dword [esi + 0x48], 0xfffff019
mov dword [esi + 0xf0], 0x57
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x76873c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, dword [ebp + 8]
add esi, 0xffffff28
mov eax, dword [esi + 0x3c]
dec eax
cmp eax, 0x1c
ja case.default.0x768756
jmp dword [eax*4 + 0x768990]
mov ecx, esi
call fcn.00766fe6
jmp case.default.0x768756
mov eax, dword [esi + 0xf4]
cmp eax, 0xffffffff
jne 0x768784
mov dword [esi + 0x48], 0xfffff00d
mov dword [esi + 0xf0], 6
jmp case.default.0x768756
cmp eax, 2
jle 0x768792
push eax
call fcn.007ac781
pop ecx
jmp 0x768794
xor eax, eax
cmp eax, 0xffffffff
je 0x768771
and dword [esi + 0x48], 0
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00767214
jmp case.default.0x768756
mov ecx, esi
call fcn.00767378
jmp case.default.0x768756
mov eax, dword [esi + 0x100]
and eax, 1
push eax
push dword [esi + 0xfc]
push dword [esi + 0xf4]
call dword [0x82640c]
test eax, eax
jne case.0x768756.26
jmp 0x76887b
mov ecx, esi
call fcn.00767f80
jmp case.default.0x768756
mov ecx, dword [esi + 0xf4]
call fcn.00767d45
xor edx, edx
mov ecx, esi
call fcn.00767d7f
jmp case.default.0x768756
mov ecx, dword [esi + 0xf4]
call fcn.00767d45
xor edx, edx
inc edx
jmp 0x7687ef
mov ecx, esi
call fcn.00767e2f
jmp case.default.0x768756
mov ecx, esi
call fcn.00767f09
jmp case.default.0x768756
mov ecx, esi
call fcn.0076818e
jmp case.default.0x768756
mov eax, dword [esi + 0xf4]
cmp eax, 0xffffffff
je 0x768771
push eax
call fcn.007b518c
pop ecx
cmp eax, 0xffffffff
jne 0x768849
push 6
pop ecx
jmp 0x7688cf
movsd xmm2, qword [esi + 0x100]
mov ecx, eax
movsd xmm1, qword [esi + 0xf8]
call fcn.00768121
test eax, eax
je case.0x768756.26
jmp 0x76887b
push dword [esi + 0xf4]
call dword [0x82610c]
cmp eax, 0xffffffff
jne 0x76888b
call dword [0x826194]
mov dword [esi + 0xf0], eax
mov ecx, eax
jmp 0x7688d5
test byte [esi + 0xf8], 2
je case.0x768756.26
and al, 0x11
cmp al, 1
jne case.0x768756.26
mov ecx, 0xfffff030
jmp 0x7688cf
push dword [esi + 0xf8]
push dword [esi + 0xf4]
call fcn.007e9dd2
pop ecx
mov dword [esi + 0x48], eax
pop ecx
cmp eax, 0xffffffff
jne case.default.0x768756
call fcn.007a02f2
mov ecx, dword [eax]
mov dword [esi + 0xf0], ecx
call fcn.00768da4
mov dword [esi + 0x48], eax
jmp case.default.0x768756
mov ecx, esi
call fcn.0076807a
jmp case.default.0x768756
mov ecx, esi
call fcn.00767e9f
jmp case.default.0x768756
mov ecx, esi
call fcn.007674d7
jmp case.default.0x768756
push dword [esi + 0xf4]
call fcn.007e9d67
jmp 0x7688bb
push dword [esi + 0xf4]
call fcn.007e9d3d
jmp 0x7688bb
mov ecx, esi
call fcn.0076760f
jmp case.default.0x768756
push 1
push dword [esi + 0xfc]
push dword [esi + 0xf4]
call dword [0x826408]
jmp 0x7687d0
mov ecx, esi
call fcn.007677b7
jmp case.default.0x768756
push 0
push dword [esi + 0xf4]
push dword [esi + 0xfc]
call dword [0x826400]
jmp 0x7687d0
mov ecx, esi
call fcn.007684e7
jmp case.default.0x768756
mov ecx, esi
call fcn.00768589
jmp case.default.0x768756
mov ecx, esi
call fcn.007686b9
jmp case.default.0x768756
Function at 0x776375
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
lea edx, [ebp - 1]
mov esi, ebx
test edx, edx
js 0x77639f
movzx eax, byte [esi]
shl edi, 2
xor edi, eax
inc esi
sub edx, 1
jns 0x776391
push 0x14
call fcn.00795dab
mov esi, eax
xor edx, edx
pop ecx
mov ecx, dword [esp + 0x20]
mov eax, edi
and dword [esi], 0
mov dword [esi + 4], ecx
mov ecx, 0x3f5
div ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x10], edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebp
mov eax, dword [ecx]
pop edi
mov eax, dword [eax + edx*4]
mov dword [esi], eax
mov eax, dword [ecx]
mov dword [eax + edx*4], esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x7763df
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
lea edx, [ebx - 1]
xor edi, edi
test edx, edx
js 0x776401
movzx eax, byte [esi]
shl edi, 2
xor edi, eax
inc esi
sub edx, 1
jns 0x7763f3
mov esi, 0x3f5
mov eax, edi
xor edx, edx
div esi
mov eax, dword [ecx]
mov esi, dword [eax + edx*4]
jmp 0x776433
cmp dword [esi + 0x10], edi
jne 0x776431
cmp dword [esi + 0xc], ebx
jne 0x776431
push ebx
push dword [esp + 0x14]
push dword [esi + 8]
call fcn.00798331
add esp, 0xc
test eax, eax
je 0x77643f
mov esi, dword [esi]
test esi, esi
jne 0x776413
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [esi + 4]
jmp 0x776439
Function at 0x7dd8f0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebx]
mov eax, ecx
xor eax, dword [ebp + 0x10]
mov edx, dword [ebx + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [esi + eax*4]
xor eax, ecx
mov dword [ebx], eax
movzx eax, al
add eax, dword [ebx + 4]
imul ecx, eax, 0x8088405
mov eax, dword [ebp + 0x10]
inc ecx
mov dword [ebx + 4], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [esi + ecx*4]
pop esi
mov dword [ebx + 8], edx
pop ebx
pop ebp
ret

Function at 0x7df550
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.007df560

Function at 0x7df7e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.007dfa90
Function at 0x403f80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c4
call fcn.00405ca0
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
test al, 0xf
mov ecx, eax
mov dl, 1
sete bl
shr ecx, 9
lea ebx, [ebx*4 + 2]
and bl, cl
movsx ecx, al
sub dl, bl
movsx edx, dl
imul edx, ecx
mov ecx, eax
shr ecx, 6
xor cl, al
add dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x404004
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404fb2
mov esp, ebp
pop ebp
ret
Function at 0x4040f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00405ca0
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
lea ecx, [eax - 0x500]
shr edx, 0xf
or dl, 1
shr ecx, 0xa
add dl, al
xor dl, cl
mov ecx, eax
shr ecx, 0xa
xor dl, cl
movsx ecx, al
xor dl, al
movsx edx, dl
imul edx, ecx
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x404173
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404fb2
mov esp, ebp
pop ebp
ret
Function at 0x4057e8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405827
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405827
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405827
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405827
cmp dword [ecx + 0x74], 0xe
jbe 0x405827
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x406291
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4261d0]
jne 0x40629b
repz ret
jmp fcn.0040871c

Function at 0x40adfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4261d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004074b2
and dword [ebp - 0x14], 0
cmp dword [0x427a30], 0
mov dword [ebp - 0x18], eax
jne 0x40aeaf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40af57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40af57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x427a30], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x427a34], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x427a38], eax
call edi
push eax
call esi
mov dword [0x427a40], eax
test eax, eax
je 0x40aeaf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x427a3c], eax
mov eax, dword [0x427a3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40af08
cmp dword [0x427a40], ecx
je 0x40af08
push eax
call esi
push dword [0x427a40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40af08
test ebx, ebx
je 0x40af08
call edi
test eax, eax
je 0x40aeff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40aeff
test byte [ebp - 8], 1
jne 0x40af08
or dword [ebp + 0x10], 0x200000
jmp 0x40af3b
mov eax, dword [0x427a34]
cmp eax, dword [ebp - 0x18]
je 0x40af3b
push eax
call esi
test eax, eax
je 0x40af3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40af3b
mov eax, dword [0x427a38]
cmp eax, dword [ebp - 0x18]
je 0x40af3b
push eax
call esi
test eax, eax
je 0x40af3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x427a30]
call esi
test eax, eax
je 0x40af57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40af59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406291
leave
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x55cc27e6
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x39797dae
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219