joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48198a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00476278
xor ebx, ebx
cmp dword [0x4bac44], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x481a60
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x481b40
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x497fd0
push edi
call esi
cmp eax, ebx
je 0x481b40
push eax
call fcn.0047620a
mov dword [esp], 0x497fc0
push edi
mov dword [0x4bac44], eax
call esi
push eax
call fcn.0047620a
mov dword [esp], 0x497fac
push edi
mov dword [0x4bac48], eax
call esi
push eax
call fcn.0047620a
mov dword [0x4bac4c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00472865
test eax, eax
pop ecx
pop ecx
je 0x481a2e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0046eb9d
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x481a60
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0047620a
cmp eax, ebx
pop ecx
mov dword [0x4bac54], eax
je 0x481a60
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047620a
pop ecx
mov dword [0x4bac50], eax
mov eax, dword [0x4bac50]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x481ae5
cmp dword [0x4bac54], ecx
je 0x481ae5
push eax
call fcn.00476281
push dword [0x4bac54]
mov esi, eax
call fcn.00476281
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x481ae5
cmp edi, ebx
je 0x481ae5
call esi
cmp eax, ebx
je 0x481ab2
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x481ab2
test byte [ebp - 0x18], 1
jne 0x481ae5
lea eax, [ebp - 0x10]
push eax
call fcn.0047289c
test eax, eax
pop ecx
je 0x481acd
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0046eb9d
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x481adc
or dword [ebp + 0x10], 0x200000
jmp 0x481b20
or dword [ebp + 0x10], 0x40000
jmp 0x481b20
mov eax, dword [0x4bac48]
cmp eax, dword [ebp - 8]
je 0x481b20
push eax
call fcn.00476281
cmp eax, ebx
pop ecx
je 0x481b20
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x481b20
mov eax, dword [0x4bac4c]
cmp eax, dword [ebp - 8]
je 0x481b20
push eax
call fcn.00476281
cmp eax, ebx
pop ecx
je 0x481b20
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4bac44]
call fcn.00476281
cmp eax, ebx
pop ecx
je 0x481b40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x481b42
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x488d6a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4b5930]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00488cff
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00473530
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x488db9
cmp dword [ebp - 0x1c], 5
jb 0x488dd1
jmp 0x488dcd
cmp dword [ebp - 0x10], 1
jne 0x488dd1
cmp dword [ebp - 0x1c], 4
ja 0x488dcd
jne 0x488dd1
cmp dword [ebp - 0x18], 0
jbe 0x488dd1
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4998ac
call fcn.00488bd3
test eax, eax
jge 0x488df2
mov byte [0x4baf09], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0046da06
add ebp, 0x78
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409e8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x409e9b
pop dword [ebp - 0x50]
mov eax, 0xde9da2e7
sub eax, 0xde5d044c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xa8f59793
add dword [ebp - 0x60], 0xa55cadb8
mov dword [ebp - 0x5c], 0x1406b8cf
sub dword [ebp - 0x5c], 0xe1d36c8a
mov dword [ebp - 0x58], 0x6c59c8a7
add dword [ebp - 0x58], 0xdff27b87
mov dword [ebp - 0x54], 0x52393704
sub dword [ebp - 0x54], 0x52393704
lea eax, [ebp - 0x60]
push eax
mov eax, 0xb0761a2a
sub eax, 0xb03549d6
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x296f8f72
sub dword [ebp - 0x60], 0xb4fd261c
mov dword [ebp - 0x5c], 0xe840d76e
sub dword [ebp - 0x5c], 0xa6d475f9
mov dword [ebp - 0x58], 0x2eb053ed
sub dword [ebp - 0x58], 0xcb40e781
mov dword [ebp - 0x54], 0x3ab0e8ec
add dword [ebp - 0x54], 0xc54f1714
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a052
push 0
call eax
mov ecx, 0x4989
xor ebx, ebx
add ebx, eax
mov esi, 0x7e6432f6
add esi, 0x81dd7d0a
add esi, dword [ebp - 0x50]
mov edi, 0xabf59221
add edi, 0xdf0bd3c2
mov edx, dword [esi]
mov dword [ebp - 0xc], 0x6db96989
add edx, edi
xor dword [ebp - 0x2c], ecx
mov dword [ebx], edx
add ebx, 0xf8a09740
add ebx, 0x75f68c4
add esi, 0x47469106
add esi, 0xb8b96efe
loop 0x409fb4
add eax, 0x649e50d7
add eax, 0x9b62c820
mov ebx, eax
add eax, 5
mov ecx, 0x2ce06e91
sub ecx, 0x2ca06e91
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10001000
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x10003324]
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000103c
mov ecx, esi
shr ecx, 0x10
jne 0x10001034
push esi
lea edx, [esp + 8]
push 0x10003010
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
add esp, 0x10
ret 4

Function at 0x10001050
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x208
cmp eax, 1
jne 0x100010b7
push esi
mov esi, dword [esp + 0x210]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea eax, [esp + 4]
push 0x104
push eax
mov dword [0x100033f0], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 4]
push str.MSGina
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
mov dword [0x10003324], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
add esp, 0x208
ret 0xc
test eax, eax
jne 0x100010cb
mov eax, dword [0x10003324]
test eax, eax
je 0x100010cb
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add esp, 0x208
ret 0xc

Function at 0x100013f0
Capabilities:
Persist via ginadll registry key
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1000143e
push esi
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 4]
shl eax, 1
push eax
push esi
push 1
push 0
push str.GinaDLL
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 4]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x4033e4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403423
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403423
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403423
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403423
cmp dword [ecx + 0x74], 0xe
jbe 0x403423
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x403850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406730
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov ecx, eax
shr ecx, 0xa
shr edx, 0xf
and dl, cl
mov ecx, eax
shr ecx, 0xb
and dl, 0xf
and cl, 0x18
xor dl, cl
mov ecx, eax
shr ecx, 9
and cl, 0xa
or dl, cl
movsx ecx, al
movsx edx, dl
imul edx, ecx
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x4038d3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040598a
mov esp, ebp
pop ebp
ret
Function at 0x403c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406730
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov cl, al
shr edx, 3
and dl, 1
shl cl, 5
neg dl
xor dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x403ca3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040598a
mov esp, ebp
pop ebp
ret
Function at 0x403d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406730
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov cl, al
shr edx, 4
and dl, 1
shl cl, 4
neg dl
xor dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x403df3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040598a
mov esp, ebp
pop ebp
ret
Function at 0x403ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406730
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov cl, al
shr edx, 5
and dl, 1
shl cl, 3
neg dl
xor dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x403f43
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040598a
mov esp, ebp
pop ebp
ret
Function at 0x4042f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406730
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ebx, ebx
lea esi, [ebx + 0xd]
mov ecx, ebx
shr ecx, 9
lea eax, [ecx - 1]
movsx ecx, cl
movsx eax, al
xor eax, ecx
xor eax, 1
cdq
idiv esi
movsx eax, bl
movsx ecx, dl
imul ecx, eax
mov byte [ebp + ebx - 0x3a988], cl
inc ebx
cmp ebx, 0x3a980
jb 0x404378
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040598a
mov esp, ebp
pop ebp
ret
Function at 0x4045c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c8
call fcn.00406730
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov eax, 0xaaaaaaab
mov ebx, ecx
mul ecx
shr ebx, 0xb
shr edx, 4
lea eax, [edx + edx*2]
mov dl, 1
shl eax, 3
cmp ecx, eax
sete al
lea eax, [eax*4 + 2]
and al, bl
xor bl, cl
sub dl, al
movsx eax, cl
movsx edx, dl
imul edx, eax
mov eax, ecx
shr eax, 4
add dl, bl
movzx ebx, al
mov dword [ebp - 0x3a9a4], edx
mov edx, ecx
shr edx, 0xa
test ecx, 0x256
movzx eax, dl
mov edx, ecx
cmove ebx, eax
mov al, cl
add al, al
shr edx, 6
and bl, al
mov al, cl
xor byte [ebp - 0x3a9a4], bl
and al, 0x25
xor dl, al
mov eax, dword [ebp - 0x3a9a4]
or al, dl
mov byte [ebp + ecx - 0x3a988], al
inc ecx
cmp ecx, 0x3a980
jb 0x404645
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9c0], 0x3a980
mov dword [ebp - 0x3a9c4], eax
lea eax, [ebp - 0x3a9c4]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9bc], 0
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c4]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c4]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040598a
mov esp, ebp
pop ebp
ret
Function at 0x406275
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4062b4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4062b4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4062b4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4062b4
cmp dword [ecx + 0x74], 0xe
jbe 0x4062b4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4056b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44802b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x45c2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0042aef8
push 4
mov dword [ebp - 4], 0
call fcn.0042b711
mov edi, eax
add esp, 4
test edi, edi
je 0x405730
call fcn.0042acc8
mov dword [edi], eax
call fcn.0042aa87
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0042a9bc
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405726
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0042a9e4
jmp 0x405732
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408c50
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push str.advapi32.dll
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x408c7b
push str.advapi32.dll
call fcn.00409340
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push edi
call ebx
push str.RegCreateKeyExW
push edi
mov dword [esi + 4], eax
call ebx
push str.RegQueryValueExW
push edi
mov dword [esi + 8], eax
call ebx
push str.RegSetValueExW
push edi
mov dword [esi + 0x10], eax
call ebx
push str.RegEnumKeyExW
push edi
mov dword [esi + 0x14], eax
call ebx
push str.RegEnumValueW
push edi
mov dword [esi + 0x18], eax
call ebx
push str.RegDeleteValueW
push edi
mov dword [esi + 0x1c], eax
call ebx
push str.RegCloseKey
push edi
mov dword [esi + 0x20], eax
call ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00408bd0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x409240
Capabilities:
Get file attributes

Disassembly:
push esi
xor esi, esi
push edi
cmp dword [0x45fa28], esi
jne 0x40927b
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x409271
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x45fa24], eax
mov dword [0x45fa28], 1
mov eax, dword [0x45fa24]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x409294
push ebx
push eax
call edi
mov esi, eax
test esi, esi
jne 0x4092d2
mov eax, dword [0x45fa2c]
test eax, eax
jne 0x4092cb
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x4092b5
mov eax, dword [0x453784]
push eax
call dword [0x453780]
jmp 0x4092c2
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x453778]
test eax, eax
je 0x4092d2
mov dword [0x45fa2c], eax
push ebx
push eax
call edi
pop edi
pop esi
ret
pop edi
mov eax, esi
pop esi
ret
Function at 0x40a930
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44969b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x45c2c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
mov dword [ebp - 0x23c], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x40aa2e
lea edx, [ebp - 0x21c]
push edx
call fcn.00430355
add esp, 4
cmp word [ebp - 0x21c], 0
lea edi, [ebp - 0x21c]
je 0x40aa2e
movzx eax, word [edi]
mov dword [ebp - 0x240], eax
cmp eax, 0x43
jb 0x40aa0b
push eax
lea esi, [ebp - 0x238]
call fcn.0040b040
mov dword [ebp - 4], 0
cmp dword [ebp - 0x228], 0
je 0x40a9ec
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x240]
call fcn.0040b970
push 0xffffffffffffffff
push 0
mov ecx, esi
push ecx
mov ecx, eax
call fcn.00409cc0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], 8
jb 0x40aa0b
mov edx, dword [ebp - 0x238]
push edx
call fcn.0042b39e
add esp, 4
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40aa10
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x40a9a3
mov ecx, dword [ebp - 0x23c]
xor eax, eax
cmp dword [ecx + 8], eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042bd88
mov esp, ebp
pop ebp
ret 4