joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004e650
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x100e14cc]
jns 0x1004e65d
jmp fcn.1004e6d0
mov eax, dword [0x100e14c8]
mov ecx, dword [eax]
add eax, 4
mov dword [0x100e14c8], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x1005ef40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10084018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x3b797c]
mov eax, str.DataLocalEffectTRSData.bmd
call fcn.10001140
test al, al
je 0x1005efb6
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.DataLocalEffectTRSData.bmd
call dword [0x1007b020]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005efb6
push 0
push edi
call dword [0x1007b044]
cmp eax, 0xa2b20
je 0x1005efcc
push edi
call dword [0x1007b0dc]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10078960
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xa2b20
lea esi, [ebx + 0x211bec]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [0x1007b048]
test eax, eax
je 0x1005efaf
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x85
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xfa
mov byte [esi + eax], dl
inc eax
cmp eax, 0xa2b20
jb 0x1005eff4
push edi
call dword [0x1007b0dc]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.10078960
mov esp, ebp
pop ebp
ret

Function at 0x1005f030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10084018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x3b7980]
mov eax, str.DataLocalTooltipTRSData.bmd
call fcn.10001140
test al, al
je 0x1005f0a6
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.DataLocalTooltipTRSData.bmd
call dword [0x1007b020]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005f0a6
push 0
push edi
call dword [0x1007b044]
cmp eax, 0x103140
je 0x1005f0bc
push edi
call dword [0x1007b0dc]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10078960
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x103140
lea esi, [ebx + 0x2b470c]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [0x1007b048]
test eax, eax
je 0x1005f09f
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x85
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xfa
mov byte [esi + eax], dl
inc eax
cmp eax, 0x103140
jb 0x1005f0e4
push edi
call dword [0x1007b0dc]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.10078960
mov esp, ebp
pop ebp
ret
Function at 0x1005f120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10084018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x3b7984]
mov eax, str.DataLocalMakeWorldTRSData.bmd
call fcn.10001140
test al, al
je 0x1005f196
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.DataLocalMakeWorldTRSData.bmd
call dword [0x1007b020]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005f196
push 0
push edi
call dword [0x1007b044]
cmp eax, 0x12c
je 0x1005f1ac
push edi
call dword [0x1007b0dc]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10078960
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x12c
lea esi, [ebx + 0x3b784c]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [0x1007b048]
test eax, eax
je 0x1005f18f
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x85
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xfa
mov byte [esi + eax], dl
inc eax
cmp eax, 0x12c
jb 0x1005f1d4
push edi
call dword [0x1007b0dc]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.10078960
mov esp, ebp
pop ebp
ret

Function at 0x1005f210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10084018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x3b7978]
mov eax, str.DataInterfaceonject0001.ozt
call fcn.10001140
test al, al
je 0x1005f286
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.DataInterfaceonject0001.ozt
call dword [0x1007b020]
mov edi, eax
cmp edi, 0xffffffff
je 0x1005f286
push 0
push edi
call dword [0x1007b044]
cmp eax, 0x211be8
je 0x1005f29c
push edi
call dword [0x1007b0dc]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10078960
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x211be8
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [0x1007b048]
test eax, eax
je 0x1005f27f
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x95
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xda
mov byte [esi + eax], dl
inc eax
cmp eax, 0x211be8
jb 0x1005f2c1
push edi
call dword [0x1007b0dc]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.10078960
mov esp, ebp
pop ebp
ret
Function at 0x10077340
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10077355
xor eax, eax
jmp 0x100773ca
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x10077382
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x100773c5
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x100773c3
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x100773bf
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x100773c3
xor eax, eax
jmp 0x100773ca
jmp 0x10077379
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x255d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0255d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x255d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x255d06a
add dl, dl
jne 0x255d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x255d0dc
xor eax, eax
add dl, dl
jne 0x255d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x255d17d
add dl, dl
jne 0x255d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x255d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x255d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x255d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x255d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x255d075
mov eax, 1
add dl, dl
jne 0x255d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x255d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x255d0e1
sub eax, ebx
mov ebx, 1
jne 0x255d128
mov ecx, 1
add dl, dl
jne 0x255d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x255d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x255d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x255d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x255d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x255d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x255d136
cmp eax, 0x7d00
jae 0x255d16d
cmp eax, 0x500
jb 0x255d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x255d075
cmp eax, 0x7f
ja 0x255d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x255d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x255d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x255d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x408d00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x4b8420], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x4b841c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x4b8420], eax
cmp ecx, 0x26f
jl 0x408d10
mov dword [0x416910], 0x270
ret

Function at 0x408d50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x4b7010]
cmp eax, dword [0x416430]
je 0x408d68
mov dword [0x416910], 0x271
cmp dword [0x416910], 0x270
jl 0x408e87
cmp dword [0x416910], 0x271
jne 0x408d9f
mov eax, dword [0x4b7010]
call fcn.00408d00
mov eax, dword [0x4b7010]
not eax
mov dword [0x4b7010], eax
mov dword [0x416430], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x4b8424]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x4b8420]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x4b8a54]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x416920]
xor edx, eax
mov dword [ebx*4 + 0x4b8420], edx
cmp ebx, 0xe2
jl 0x408da8
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x4b8424]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x4b8420]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x4b8094]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x416920]
xor edx, eax
mov dword [ebx*4 + 0x4b8420], edx
cmp ebx, 0x26e
jl 0x408dfc
mov eax, dword [0x4b8ddc]
and eax, 0x80000000
mov edx, dword [0x4b8420]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x4b8a50]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x416920]
xor eax, edx
mov dword [0x4b8ddc], eax
mov dword [0x416910], 0
mov eax, dword [0x416910]
mov eax, dword [eax*4 + 0x4b8420]
add dword [0x416910], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x40a910
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x416190]
cmp ax, 0xcb
je 0x40aa0c
cmp ax, 0xcc
je 0x40aa0c
mov edx, dword [0x4b9030]
test edx, edx
je 0x40a942
mov eax, dword [0x4b8ed0]
call edx
mov ebx, eax
jmp 0x40a947
mov ebx, 0x4b8ed4
cmp word [0x4b8ec0], 0
jle 0x40a96a
mov eax, 0x4b8ea0
call fcn.0040ab80
mov eax, ebx
call fcn.0040a4f0
mov eax, ebx
call fcn.0040a560
mov edi, dword [ebx]
jmp 0x40a98a
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40a985
mov edx, edi
mov eax, ebx
call fcn.004099c0
jmp 0x40a988
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40a970
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x4b8ec0], 0
jle 0x40aa0c
mov edx, 0x4b8de0
mov eax, ebx
call fcn.00409af0
mov edi, eax
test edi, edi
je 0x40a9df
mov eax, dword [0x4b8e74]
mov dword [edi + 0xc], eax
cmp dword [0x4b8e74], 0
je 0x40a9d4
mov eax, dword [0x4b8e74]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x4b8e74], eax
sub word [0x4b8ec0], 1
cmp word [0x4b8ec0], 0
sete bl
mov eax, 0x4b8ea0
call fcn.0040ab90
test bl, bl
je 0x40aa0c
mov eax, 0x4b8ea0
call fcn.0040ab70
pop edi
pop esi
pop ebx
ret
Function at 0x40df30
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x7c]
push ebx
push esi
push edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], reloc.kernel32.dll_IsDBCSLeadByte
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], reloc.advapi32.dll_CryptGetHashParam
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], eax
mov edx, dword [eax + 0x30]
mov eax, dword [ecx + 0x3c]
lea eax, [edx + eax]
movzx edx, word [eax + 6]
add eax, 0xf8
mov dword [ebp - 0x74], eax
lea eax, [edx - 1]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
jb 0x40e0b5
sub dword [ebp - 0x6c], 1
lea esi, [esi]
add dword [ebp - 0x6c], 1
imul eax, dword [ebp - 0x6c], 0x28
mov edx, dword [ebp - 0x74]
lea esi, [eax + edx]
lea edi, [ebp - 0x4c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x7c]
or edx, eax
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
test dword [ebp - 0x50], 0xffffffff
je 0x40e0a9
mov ebx, dword [ebp - 0x28]
mov eax, ebx
and eax, 0x2000000
je 0x40e00c
push 0x4000
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 8]
jmp 0x40e0a9
mov eax, ebx
and eax, 0x20000000
je 0x40e01e
mov dword [ebp - 0x68], 1
jmp 0x40e025
mov dword [ebp - 0x68], 0
mov eax, ebx
and eax, 0x40000000
je 0x40e037
mov dword [ebp - 0x64], 1
jmp 0x40e03e
mov dword [ebp - 0x64], 0
mov eax, ebx
and eax, 0x80000000
je 0x40e050
mov dword [ebp - 0x60], 1
jmp 0x40e057
mov dword [ebp - 0x60], 0
mov eax, ebx
and eax, 0x4000000
je 0x40e069
mov dword [ebp - 0x5c], 1
jmp 0x40e070
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x68]
shl eax, 4
lea eax, [ebp + eax - 0x24]
mov edx, dword [ebp - 0x64]
lea ecx, [eax + edx*8]
mov eax, dword [ebp - 0x60]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x5c], 1
jne 0x40e096
or dword [ebp - 0x54], 0x200
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + reloc.advapi32.dll_ReportEventW]
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
ja 0x40dfb4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
mov edx, dword [edx + 0x14]
mov eax, dword [eax]
lea eax, [edx + eax]
mov edx, eax
mov edi, ebx
nop
lea eax, [edx + edi]
mov ebx, dword [eax]
mov esi, ecx
xor esi, ebx
mov dword [eax], esi
lea eax, [edi + 4]
mov edi, eax
cmp edi, dword [ebp - 4]
jb 0x414b50
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x10001131
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
push esi
push edi
push 0xa
push 0x66
xor esi, esi
push dword [0x100042c4]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, esi
je 0x1000125a
push edi
push dword [0x100042c4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [ebp - 8], eax
push dword [0x100042c4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x1000125a
cmp dword [ebp - 8], esi
je 0x1000125a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x1000125a
lea eax, [ebp - 0x168]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x168]
push eax
push esi
lea eax, [ebp - 0x168]
push 0x100040d0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push esi
push esi
push 2
push esi
push 1
lea eax, [ebp - 0x168]
pop ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000125a
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x10], esi
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], eax
call edi
cmp dword [ebp - 4], ebx
jne 0x1000125a
push 0x44
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.100025c0
add esp, 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], ebx
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x168]
push esi
push eax
push esi
mov word [ebp - 0x34], si
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x1000125a
push dword [ebp - 0x1c]
call edi
push dword [ebp - 0x20]
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000133f
Capabilities:
Check for time delay via gettickcount
Get disk information

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, 0x1388
push ebp
mov dword [esp + 0x14], eax
push dword [0x100042d0]
call edi
mov ebx, 0x102
cmp eax, ebx
jne 0x100013a7
call esi
cmp eax, dword [esp + 0x10]
jb 0x100013a2
sub eax, dword [esp + 0x10]
cmp eax, 0x6ddd00
ja 0x100013a2
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp eax, dword [esp + 0x14]
jne 0x100013a2
push ebp
push dword [0x100042d0]
call edi
jmp 0x10001374
push 1
pop eax
jmp 0x100013a9
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x40e704
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov esi, 0x12435774
inc ebx
adc bh, byte [edx - 0x5194037e]
pop edx
mov ebx, 0xb3527029
lodsd eax, dword [esi]
std
jnp 0x40e77e
lodsd eax, dword es:[esi]
invalid
out dx, eax
shr byte [ebp - 0xaf29060], 0xd3
das
adc ebp, edx
pop esp
xor al, 0x32
sbb bl, byte [esi]
mov ecx, 0x547d4048
sahf
stc
scasb al, byte es:[edi]
dec edx
neg dword [ebp - 0x68]
pop ebp
cwde
or byte [esi], ch
cmp eax, eax
sbb dl, ch
dec edi
xor edi, esp
mov byte [0x57877301], al
jne 0x40e799
clc
sub eax, 0x11f35fad
jnp 0x40e822
test dword [edx - 0x613752f2], ebp
or dh, dl
into
adc cl, byte [ecx - 0x19]
xor ebx, dword [ebx]
push cs
stosd dword es:[edi], eax
invalid
insb byte es:[edi], dx
xchg esp, eax
pop ebp
aaa
ret 0x11a
xor byte [esi + 0x6d88ba21], 0x24
xchg ebx, eax
sbb dword [esi], edi
outsd dx, dword [esi]
loop 0x40e85a
int 0x26
fisubr word [edi - 0x2e]
imul edx, dword [ebx], 0xffffff9a
dec byte [edi + 0x370a0b81]
inc ebp
out dx, eax
test byte [ebx], ch
mov eax, dword [0xe3c63c90]
inc ebp
test byte [0x92c5685f], dl
sub dword [esp + 5], ecx
adc al, 0xea
xor esi, esi
mov edx, 0x115c2022
movsb byte es:[edi], byte [esi]
adc byte [eax], al
dec edx
xor al, 0x86
fsub dword [esi + 0x642b02cd]
jmp 0x40e808

Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x6347f0]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6347f0], eax
test eax, eax
pop ebx
je 0x417ad1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6347f0]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x6347ec], eax
call esi
mov ecx, dword [0x6347ec]
mov dword [0x6347f4], eax
test ecx, ecx
je 0x417ac7
test eax, eax
je 0x417ac7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6347f0], 0
xor eax, eax
pop esi
add esp, 0x50
ret

Function at 0x43a19a
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
mov esi, 0xe7ac91e
je 0x43a1eb
js 0x43a1f7
invalid
invalid
mov esi, 0x96499407
iretd
add eax, 0xe41aea1a
sbb esp, dword [ecx]
nop
dec esp
pop es
pushal
and al, 0xe1
salc
loope 0x43a1cf
jne 0x43a1da
push ebx
test byte [edx], cl
sti
hlt
Function at 0x46d9e9
Capabilities:
Encode data using xor

Disassembly:
jp 0x46da07
movsd dword es:[edi], dword [esi]
std
call [ecx]
xchg edi, eax
jno 0x46d9ed
rcr dword [eax], cl
int1
jb 0x46da67
wait
cdq
add al, 0x90
jge 0x46da36
mov word ss:[esi], fs
fadd dword [ebx]
test eax, 0x2e14f2d2
leave
add edx, eax
popfd
daa
test eax, 0x34f271f2
mov ebx, 0xf1d7cf70
mov dh, 0x88
arpl word [esi*8 + 0x22bbd46f], ax
push es
mov al, byte [0xe884f5ff]
or eax, 0xc817f811
sal dword [ebx + 0x6c], 1
dec esp
jae 0x46da02
sbb dword [esi], 0xbcdb6164
mov ah, 0x7a
cwde
or dl, byte [esi]
and dword [esi - 0x6b4eef10], esp
pushal
lock xor byte [edx - 0x4b], dh
mov bl, byte [esi + edx - 0x36]
pushfd
sub al, 0xef
xor al, 0x8f
ja 0x46da4f
retf 0xd128
fist dword [edi + ecx*4 - 0x3c]
fidivr word [eax + edi - 0x3cab245d]
xlatb
lodsb al, byte [esi]
mov word [0x90723676], ax
sal dword [eax], 1
or eax, 0x5b71f174
cmpsd dword [esi], dword es:[edi]
popfd
scasd eax, dword es:[edi]
retf 0x7bf6