joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4662e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4663e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x466404
call fcn.00406f68
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
sete bl
test bl, bl
je 0x46634e
push 0xa
lea eax, [ebp - 0xe]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
je 0x466352
xor eax, eax
jmp 0x466354
mov al, 1
mov ebx, eax
test bl, bl
je 0x46636f
lea eax, [ebp - 4]
lea edx, [ebp - 0x18]
call fcn.004079dc
mov eax, esi
lea edx, [ebp - 0xe]
call fcn.004079dc
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0041b668
mov eax, dword [ebp - 0x1c]
mov edx, 0x466418
call fcn.00407d18
jne 0x4663b6
lea edx, [ebp - 0x20]
mov eax, dword [esi]
call fcn.0041b668
mov eax, dword [ebp - 0x20]
mov edx, 0x46642c
call fcn.00407d18
jne 0x4663b6
mov eax, edi
mov edx, dword [0x4b9b64]
mov ecx, 0
call fcn.0040763c
jmp 0x4663c5
mov eax, edi
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040763c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4663ef
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp - 4]
call fcn.00406b40
ret
Function at 0x46f3ec
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x46f5cc
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
jne 0x46f449
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_BeginPaint
mov ebx, eax
jmp 0x46f45c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WindowFromDC
test eax, eax
jne 0x46f45c
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46f4ac
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf5], 0
jne 0x46f4ac
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
jmp 0x46f4bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf5]
test eax, eax
je 0x46f4bc
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x46f5bb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xf5], edx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call fcn.00472000
cmp dword [0x4c023c], 0
je 0x46f4fe
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call dword [0x4c023c]
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call fcn.00472000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x45b]
test eax, eax
je 0x46f523
xor edx, edx
call fcn.0046b2e0
push 0
push ebx
call sub.gdi32.dll_SelectClipRgn
cmp ebx, dword [ebp - 0xc]
je 0x46f54f
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
cmp dword [ebp - 8], 0
jne 0x46f568
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f5c2
cmp dword [ebp - 0x10], 0
je 0x46f5a7
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
jmp 0x46f5ba
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x46f5ba
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
ret
Function at 0x47b394
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x47b479
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b64
xor eax, eax
push ebp
push 0x47b459
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebx + 4]
mov ecx, 0
call fcn.0040763c
lea eax, [ebp - 0x809]
xor ecx, ecx
mov edx, 0x801
call fcn.00404a64
mov eax, dword [ebp - 4]
call fcn.00407540
push eax
push 0x800
lea eax, [ebp - 0x809]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00407540
push eax
mov eax, dword [ebp - 8]
call fcn.00407540
push eax
mov eax, edi
call fcn.00407540
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ebx, eax
test ebx, ebx
jbe 0x47b44f
mov eax, esi
xor ecx, ecx
mov edx, ebx
call fcn.004075c4
mov eax, esi
call fcn.004070fc
mov edx, eax
lea eax, [ebp - 0x809]
mov ecx, ebx
call fcn.00404694
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b463
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b480
lea eax, [ebp - 4]
call fcn.00406b64
ret

Function at 0x47b824
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00406c24
xor eax, eax
push ebp
push 0x47b888
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.00407984
push eax
mov eax, esi
call fcn.00407984
push eax
mov eax, ebx
call fcn.00407984
push eax
push 0x47b898
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b88f
lea eax, [ebp + 8]
call fcn.00406b40
ret

Function at 0x47ba54
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c24
xor eax, eax
push ebp
push 0x47baee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a64
lea eax, [ebp - 0x44]
call fcn.0047c954
xor eax, eax
push ebp
push 0x47bad1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x44], 0x3c
lea eax, [ebp - 0x44]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
call sub.wininet.dll_InternetCrackUrlW
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bad8
lea eax, [ebp - 0x44]
call fcn.0047ca64
ret

Function at 0x47ddb4
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00404a64
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x48c220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48c418
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48c3e8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.0047e7a4
call fcn.0047f8e0
call fcn.004a8fc8
xor ecx, ecx
mov dl, 1
mov eax, dword [0x487714]
call fcn.0048b3bc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48c3d7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004723b4
mov edi, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], edi
cmp edi, 0x20
setne al
push eax
mov edx, dword [0x4ba5e0]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.0048b6dc
mov edx, dword [0x4ba818]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0048b5f4
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00407a6c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0048b504
mov ebx, eax
test ebx, ebx
je 0x48c3c1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x30]
mov cl, 7
call fcn.004723f4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x48c3ba
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00472e78
call fcn.0046b5a0
mov ecx, eax
mov edx, dword [ebx + 0x58]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.00476438
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebx + 0x74]
mov eax, dword [ebx + 0x70]
call fcn.0043beec
lea eax, [ebp - 0x1c]
push eax
push esi
push 0
push 0
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0048aa78
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00407a80
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp + 8]
mov dl, 1
mov eax, dword [0x48c158]
call fcn.0048c530
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48c39d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c3a4
mov eax, dword [ebp - 0xc]
call fcn.00404ed4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c3de
mov eax, dword [ebp - 8]
call fcn.00404ed4
ret
Function at 0x498f0c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x620]
call fcn.00408afc
test eax, eax
jl 0x498fc7
cmp word [esi], 0xd
jne 0x498fae
mov edi, dword [ebx + 0x18]
cmp byte [edi + 0x4a7], 0
je 0x498f96
mov eax, edi
call fcn.00471e3c
push eax
mov eax, dword [ebx + 0x18]
call fcn.00471b80
dec eax
pop edx
cmp edx, eax
jne 0x498f67
mov eax, ebx
call fcn.004a0a30
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.00472064
jmp 0x498fd7
mov eax, dword [ebx + 0x18]
call fcn.00471e3c
mov edi, eax
mov eax, dword [ebx + 0x18]
call fcn.00471b80
sub eax, 2
cmp edi, eax
jne 0x498f8c
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.00472064
jmp 0x498fd7
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.00472064
push 0
push 0xd
push 0x464
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_SendMessageW
cmp word [esi], 0x1b
jne 0x498fc7
mov eax, dword [ebx + 0x18]
cmp byte [eax + 0x4a7], 0
je 0x498fc7
xor edx, edx
call fcn.00472064
cmp word [esi], 0x21
jae 0x498fd7
mov eax, dword [ebx + 0x18]
mov dword [eax + 0x2e], 3
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x49d930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49da3a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49da1a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.0047e7a4
call fcn.0047f8e0
call fcn.0047e6c0
mov dword [ebx + 0x10], eax
call fcn.004a8fc8
lea eax, [ebp - 0x10]
mov edx, 1
mov cl, 1
call fcn.0042d900
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x49da4c
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x88]
push 0x49da5c
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4c02bc], eax
push 0x49da80
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4c02c0], eax
push 0x49daa4
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4c02c4], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 8]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x10]
cmp dword [ebx + 0x18], 0
jne 0x49da09
cmp dword [0x4ba2e4], 0xffffffff
je 0x49da09
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49da24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49da41
lea eax, [ebp - 0x10]
call fcn.00428254
ret

Function at 0x49f1bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x49f24b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x24], 0
je 0x49f235
cmp dword [ebx + 0x18], 0
je 0x49f235
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x18]
call fcn.00470208
cmp dword [ebp - 4], 0
jne 0x49f224
mov eax, dword [ebx + 0x18]
call fcn.00470638
test al, al
je 0x49f224
mov edx, dword [ebx + 0xf8]
mov eax, dword [ebx + 0x24]
call fcn.00470278
push 4
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x24]
call fcn.004756c8
jmp 0x49f235
push 0
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f252
lea eax, [ebp - 4]
call fcn.00406b40
ret
Function at 0x4aaae0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call fcn.00406c24
xor eax, eax
push ebp
push 0x4aaba0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a64
push ebp
call fcn.004aaa18
pop ecx
xor eax, eax
push ebp
push 0x4aab83
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
mov eax, dword [ebp - 0x40]
call fcn.00407984
push eax
call sub.wininet.dll_InternetCrackUrlW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x41], al
mov eax, ebx
mov edx, dword [ebp - 0x2c]
call fcn.004079dc
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.004079dc
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.004079dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aab8a
push ebp
call fcn.004aaaa0
pop ecx
ret
Function at 0x4039c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c4
call fcn.00406930
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
lea eax, [ebp - 0x3a988]
mov edi, 0x346
mov dword [ebp - 0x3a9a4], ecx
add esp, 0xc
sub edi, eax
nop dword [eax]
mov al, cl
lea esi, [ebp - 0x3a988]
mov ebx, ecx
and al, 0x4e
add esi, ecx
shr ebx, 9
or bl, al
mov edx, ecx
mov al, byte [ebp - 0x3a9a4]
shr ecx, 5
and al, 0x40
or cl, al
shr edx, 8
mov eax, dword [ebp - 0x3a9a4]
xor bl, cl
lea ecx, [edi + esi]
movsx eax, al
shr ecx, 0xd
and cl, dl
movsx ecx, cl
imul ecx, eax
and cl, 0x84
xor bl, cl
mov ecx, dword [ebp - 0x3a9a4]
mov al, cl
and al, 0x21
or al, dl
xor bl, al
mov al, cl
or al, 0xbb
inc ecx
xor bl, al
mov dword [ebp - 0x3a9a4], ecx
mov byte [esi], bl
cmp ecx, 0x3a980
jb 0x403a60
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9c0], 0x3a980
mov dword [ebp - 0x3a9c4], eax
lea eax, [ebp - 0x3a9c4]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9bc], 0
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c4]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c4]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405b07
mov esp, ebp
pop ebp
ret
Function at 0x403cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xea644
call fcn.00406930
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xea620], 0
push eax
push eax
push eax
mov word [ebp - 0xea60c], ax
lea eax, [ebp - 0xea61c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xea620]
mov dword [ebp - 0xea61c], 0x10001
push eax
mov dword [ebp - 0xea618], 0x7d00
mov dword [ebp - 0xea614], 0x7d00
mov dword [ebp - 0xea610], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xea600
lea eax, [ebp - 0xea608]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ebx, ebx
mov edx, ebx
mov eax, ebx
shr eax, 4
mov ecx, ebx
shr edx, 9
or dl, al
shr ecx, 0xb
mov eax, ebx
shr eax, 3
or dl, al
mov al, bl
shl al, 2
and cl, al
shl dl, 6
add dl, cl
mov eax, ebx
mov ecx, ebx
shr eax, 7
shr ecx, 0x10
or cl, al
or cl, bl
add cl, cl
xor dl, cl
mov byte [ebp + ebx - 0xea608], dl
inc ebx
cmp ebx, 0xea600
jb 0x403d74
lea eax, [ebp - 0xea608]
mov dword [ebp - 0xea63c], 0xea600
mov dword [ebp - 0xea640], eax
lea eax, [ebp - 0xea640]
push 0x20
push eax
push dword [ebp - 0xea620]
mov dword [ebp - 0xea638], 0
mov dword [ebp - 0xea634], 0
mov dword [ebp - 0xea630], 0
mov dword [ebp - 0xea62c], 0
mov dword [ebp - 0xea628], 0
mov dword [ebp - 0xea624], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405b07
mov esp, ebp
pop ebp
ret
Function at 0x403e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406930
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ebx, ebx
mov ecx, ebx
mov eax, ebx
shr eax, 0xb
mov esi, ebx
shr ecx, 0xd
not esi
and cl, al
mov eax, esi
shr eax, 9
and al, 3
movsx ecx, cl
movsx eax, al
imul ecx, eax
movsx eax, bl
shr esi, 0xb
and esi, 1
movsx edx, cl
mov ecx, esi
imul edx, eax
mov eax, ebx
and eax, 0x6000
or eax, 0x8000
shr eax, 0xd
imul eax, ebx
shr eax, cl
xor al, dl
and al, 0x80
xor al, dl
mov byte [ebp + ebx - 0x3a988], al
inc ebx
cmp ebx, 0x3a980
jb 0x403ef5
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00405b07
mov esp, ebp
pop ebp
ret
Function at 0x4043b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406930
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
lea edx, [eax - 0x43]
mov ecx, eax
shr ecx, 5
shr edx, 4
or dl, cl
mov cl, al
xor cl, 0xbd
or dl, cl
mov cl, al
shl cl, 4
or dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x404433
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405b07
mov esp, ebp
pop ebp
ret
Function at 0x404950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406930
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
lea ecx, [eax - 0x500]
shr edx, 0xf
or dl, 1
shr ecx, 0xa
add dl, al
xor dl, cl
mov ecx, eax
shr ecx, 0xa
xor dl, cl
movsx ecx, al
xor dl, al
movsx edx, dl
imul edx, ecx
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x4049d3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405b07
mov esp, ebp
pop ebp
ret