joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cf0
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x660
push esi
mov esi, dword [esp + 0x668]
test esi, esi
jne 0x405d0d
lea eax, [esi + 0x57]
pop esi
add esp, 0x660
ret
push edi
push esi
push 0x46520c
lea eax, [esp + 0x468]
push 0x104
push eax
call fcn.00432fb7
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x464]
xor ecx, ecx
push eax
mov word [esp + 0x66e], cx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x405e6c
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x405d60
mov ecx, 0x465208
lea eax, [esp + 0x38]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405d96
test dx, dx
je 0x405d92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405d96
add eax, 4
add ecx, 4
test dx, dx
jne 0x405d70
xor eax, eax
jmp 0x405d9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405e45
mov ecx, 0x465200
lea eax, [esp + 0x38]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405dd6
test dx, dx
je 0x405dd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405dd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x405db0
xor eax, eax
jmp 0x405ddb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405e45
lea ecx, [esp + 0x38]
push str..tmp
push ecx
call fcn.004331f2
add esp, 8
test eax, eax
jne 0x405e45
lea edx, [esp + 0x38]
push edx
push esi
push 0x4651f4
lea eax, [esp + 0x268]
push 0x104
push eax
call fcn.00432fb7
xor ecx, ecx
add esp, 0x14
test byte [esp + 0xc], 0x10
mov word [esp + 0x462], cx
je 0x405e35
lea edx, [esp + 0x25c]
push edx
call fcn.00405cf0
jmp 0x405e42
lea eax, [esp + 0x25c]
push eax
call fcn.00404ec0
add esp, 4
lea ecx, [esp + 0xc]
push ecx
push edi
call ebp
test eax, eax
jne 0x405d60
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
test eax, eax
je 0x405e6c
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x405e7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 0x660
ret
pop edi
xor eax, eax
pop esi
add esp, 0x660
ret
Function at 0x4061f0
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1008
call fcn.004330b0
push ebx
push ebp
mov ebp, dword [esp + 0x1014]
push 0
push 0x8000
push ebp
call fcn.004353ec
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x406232
push ebp
push str.Unable_to_open_file___S__for_inserting_n
push edi
call fcn.00432c6c
add esp, 0xc
pop ebp
pop ebx
add esp, 0x1008
ret
push esi
push ebx
call fcn.00434bc1
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
jne 0x40625c
push ebp
push str.Unable_to_get_file_length_for_file___S__n
push edi
call fcn.00432c6c
add esp, 0xc
pop esi
pop ebp
pop ebx
add esp, 0x1008
ret
cmp esi, 0x100000
jle 0x40627d
push 0x100000
push esi
push str.File_size_exceeds_max_insert_length__truncating_from__d_to__d_n
push edi
call fcn.00432c6c
add esp, 0x10
mov esi, 0x100000
push esi
push ebp
push str.Inserting_file:_name__S__length_d_n
push edi
call fcn.00432c6c
push 0xfff
lea eax, [esp + 0x29]
push 0
push eax
mov byte [esp + 0x30], 0
call fcn.00433c00
xor eax, eax
add esp, 0x1c
mov dword [esp + 0xc], eax
cmp esi, 0x1000
jl 0x4062f8
mov ebp, 0x1000
push 0x1000
lea ecx, [esp + 0x18]
push ecx
push ebx
call fcn.00434acb
push edi
push 0x1000
lea edx, [esp + 0x28]
push 1
push edx
call fcn.00433f4a
add dword [esp + 0x28], 0x1000
add ebp, 0x1000
add esp, 0x1c
cmp ebp, esi
jle 0x4062b6
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x1018]
cmp eax, esi
jge 0x40631b
sub esi, eax
push esi
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.00434acb
push edi
push esi
lea ecx, [esp + 0x28]
push 1
push ecx
call fcn.00433f4a
add esp, 0x1c
push str.Finished_inserting_file_n
push edi
call fcn.00432c6c
push 4
lea edx, [esp + 0x1c]
push edx
push ebx
call fcn.00434acb
add esp, 0x14
test eax, eax
je 0x406348
push str.ERROR_:_file_continues_beyond_length_n
push edi
call fcn.00432c6c
add esp, 8
push ebx
call fcn.00434450
add esp, 4
cmp dword [esp + 0x101c], 0
je 0x406362
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
pop ebx
add esp, 0x1008
ret
Function at 0x4071b0
Capabilities:
Get common file path

Disassembly:
push esi
push edi
push 0
call fcn.00406fb0
add esp, 4
test eax, eax
je 0x4071e3
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
push edi
push 0x465854
push esi
call fcn.004331a6
add esp, 0xc
xor edx, edx
mov word [esi + edi*2 - 2], dx
pop edi
xor eax, eax
pop esi
ret
push 0
call fcn.00406fb0
mov edi, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x40724e
mov esi, dword [esp + 0xc]
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4072a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40724b
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407220
sub eax, edx
sar eax, 1
mov ecx, edi
sub ecx, eax
push ecx
push str.DRPREI1.DLL
push esi
call fcn.004355b0
xor edx, edx
add esp, 0xc
mov word [esi + edi*2 - 2], dx
xor eax, eax
pop edi
pop esi
ret
cmp word [0x479458], 0
jne 0x40728a
push 0x104
push 0x479458
push str.DYNAMORIO_HOME
push 0
push 0x465064
call fcn.0040a5d0
add esp, 0x14
test eax, eax
jne 0x407283
cmp word [0x479458], ax
jne 0x40728a
mov eax, 0x464770
jmp 0x40728f
mov eax, 0x479458
mov esi, dword [esp + 0xc]
push eax
push str._slib
push edi
push esi
call fcn.00432fb7
add esp, 0x10
push edi
push esi
xor eax, eax
push esi
mov word [esi + edi*2 - 2], ax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp 0x407217

Function at 0x407960
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x2d0
lea eax, [esp]
push eax
mov dword [esp + 4], 0
call fcn.00404fc0
add esp, 4
cmp dword [esp], 0x8c
jb 0x40798c
xor eax, eax
add esp, 0x2d0
ret
cmp dword [0x47987c], 0
jne 0x4079e5
push esi
push 0
push 4
push 0
push 0x407950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4079e4
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0x10007
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4079d6
mov edx, dword [esp + 0xc0]
mov dword [0x47987c], edx
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, dword [0x47987c]
add esp, 0x2d0
ret
Function at 0x40a270
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
mov dword [esp + 0x10], 0
test edi, edi
jne 0x40a294
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], ebx
jmp 0x40a304
push ebp
call fcn.0040a210
add esp, 4
test eax, eax
je 0x40a2dc
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
push edi
push ebp
push ebx
call eax
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40a40b
mov eax, dword [ebp]
test eax, eax
je 0x40a40b
push edi
push eax
push ebx
call fcn.0040a270
mov ebx, dword [esp + 0x1c]
add esp, 0xc
mov esi, eax
jmp 0x40a3ee
mov eax, dword [esp + 0x18]
push 0x2000e
push 0
push edi
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00408210
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x40a40b
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebp + 0xc]
test ebp, ebp
je 0x40a3a7
nop
mov edi, dword [ebp + 8]
mov ecx, str.__DELETE_PARAMETER_KEY
mov eax, edi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40a346
test dx, dx
je 0x40a342
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40a346
add eax, 4
add ecx, 4
test dx, dx
jne 0x40a320
xor eax, eax
jmp 0x40a34b
sbb eax, eax
sbb eax, 0xffffffff
mov edx, dword [ebp + 4]
test eax, eax
jne 0x40a35e
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
jmp 0x40a398
test edi, edi
je 0x40a38a
mov eax, edi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a367
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40a392
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
jne 0x40a407
mov ebp, dword [ebp]
mov ebx, dword [esp + 0x10]
test ebp, ebp
jne 0x40a310
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 4]
test eax, eax
je 0x40a3cb
push ecx
push eax
push ebx
call fcn.0040a270
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40a407
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
test eax, eax
je 0x40a3ea
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ecx
push eax
push edx
call fcn.0040a270
mov ebx, dword [esp + 0x1c]
add esp, 0xc
mov esi, eax
mov ebp, dword [esp + 0x1c]
test ebx, ebx
je 0x40a3ff
cmp dword [ebp + 0x14], 0
je 0x40a3ff
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
jmp 0x40a3ee
Function at 0x40a4d0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20c
test eax, eax
jne 0x40a4ef
push 0x104
push str.SoftwareDynamoRIO
lea eax, [esp + 0xc]
push eax
jmp 0x40a523
cmp dword [esp + 0x214], 0
jne 0x40a518
push eax
push str.SoftwareDynamoRIO
push 0x4651f4
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.00432fb7
add esp, 0x14
jmp 0x40a52b
push 0x104
push eax
lea edx, [esp + 0xc]
push edx
call fcn.004331a6
add esp, 0xc
lea eax, [esp + 4]
push eax
call fcn.004081b0
add esp, 4
push 0
lea ecx, [esp + 4]
push ecx
push 0
call fcn.004053c0
or eax, 0x20006
push eax
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a5c8
mov edx, dword [esp + 0x21c]
push esi
test edx, edx
je 0x40a5a5
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a577
mov ecx, dword [esp + 0x21c]
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
mov edx, dword [esp + 0xc]
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40a5b8
mov eax, dword [esp + 0x21c]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x20c
ret

Function at 0x40a5d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x210
test eax, eax
jne 0x40a5ef
push 0x104
push str.SoftwareDynamoRIO
lea eax, [esp + 0x10]
push eax
jmp 0x40a623
cmp dword [esp + 0x218], 0
jne 0x40a618
push eax
push str.SoftwareDynamoRIO
push 0x4651f4
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.00432fb7
add esp, 0x14
jmp 0x40a62b
push 0x104
push eax
lea edx, [esp + 0x10]
push edx
call fcn.004331a6
add esp, 0xc
lea eax, [esp + 8]
push eax
call fcn.004081b0
add esp, 4
push 0
lea ecx, [esp + 4]
push ecx
push 0
call fcn.004053c0
or eax, 0x20019
push eax
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a6a9
mov eax, dword [esp + 0x224]
push esi
lea ecx, [eax + eax]
mov eax, dword [esp + 0x224]
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
push eax
push 0
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x22c]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x210
ret
Function at 0x430a30
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x254
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
cmp dword [0x4798a8], edi
jne 0x430b47
lea eax, [esp + 0x18]
push eax
push str.SystemCurrentControlSetServicesEventLogDynamoRIO
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, edi
jne 0x430c3c
cmp dword [0x4798a8], 8
jge 0x430b3d
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, 0x104
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x70]
push edx
push edi
push eax
mov dword [esp + 0x30], ebx
call ebp
mov esi, eax
inc edi
cmp esi, 0x103
je 0x430b47
test esi, esi
jne 0x430c1c
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x60]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x430b19
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x60]
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
push str.EventMessageFile
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x430b19
push 2
push eax
lea ecx, [esp + 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, dword [0x4798a8]
mov dword [ecx*4 + 0x479880], eax
inc ecx
mov dword [0x4798a8], ecx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x430b30
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
cmp dword [0x4798a8], 8
jl 0x430a85
mov esi, 0x7a
jmp 0x430c1c
mov edx, dword [esp + 0x268]
movzx eax, word [edx + 0x1a]
cmp eax, 0x10
jbe 0x430b61
mov esi, 0x7a
jmp 0x430c1c
mov ecx, dword [edx + 0x24]
add ecx, edx
mov dword [esp + 0x1c], ecx
cmp eax, 1
jle 0x430ba3
lea ecx, [esp + 0x1c]
lea ebx, [eax - 1]
mov esi, dword [ecx]
mov eax, esi
lea edi, [eax + 2]
lea ecx, [ecx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x430b80
sub eax, edi
sar eax, 1
lea edx, [esi + eax*2 + 2]
mov dword [ecx + 4], edx
add ecx, 4
dec ebx
jne 0x430b76
mov edx, dword [esp + 0x268]
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp dword [0x4798a8], eax
jle 0x430c0c
mov esi, dword [esp + 0x270]
mov edi, dword [esp + 0x26c]
mov ebp, dword [sym.imp.KERNEL32.dll_FormatMessageW]
jmp 0x430bd0
mov ecx, dword [ebx*4 + 0x479880]
test ecx, ecx
je 0x430bff
mov edx, dword [edx + 0x14]
lea eax, [esp + 0x1c]
push eax
push esi
push edi
push 0
push edx
push ecx
push 0x2800
call ebp
mov dword [esp + 0x10], eax
test eax, eax
jne 0x430c13
mov edx, dword [esp + 0x268]
inc ebx
cmp ebx, dword [0x4798a8]
jl 0x430bd0
test eax, eax
jne 0x430c13
mov esi, 0xfffffff7
jmp 0x430c1c
xor eax, eax
mov word [edi + esi*2 - 2], ax
xor esi, esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x430c2b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x430c3a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
Function at 0x4315b0
Capabilities:
Get number of processors

Disassembly:
sub esp, 0x10
push 0xffffffffffffffff
call fcn.004076e0
add esp, 4
test al, al
jne 0x4315c7
xor ecx, ecx
xor eax, eax
jmp 0x4315df
mov eax, dword gs:[0x60]
mov dword [esp], eax
mov eax, dword gs:[0x64]
mov dword [esp + 4], eax
mov eax, dword [esp]
xor ecx, ecx
lea edx, [esp + 8]
push edx
add eax, 0x18
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
push 8
adc ecx, ecx
push ecx
push eax
call fcn.00431540
add esp, 0x10
test al, al
jne 0x431609
xor eax, eax
xor edx, edx
add esp, 0x10
ret
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
add esp, 0x10
ret

Function at 0x4371e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x478414]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00437e79
and dword [ebp - 0x14], 0
cmp dword [0x479918], 0
mov dword [ebp - 0x18], eax
jne 0x437298
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x437340
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x437340
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x479918], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x47991c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x479920], eax
call edi
push eax
call esi
mov dword [0x479928], eax
test eax, eax
je 0x437298
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x479924], eax
mov eax, dword [0x479924]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4372f1
cmp dword [0x479928], ecx
je 0x4372f1
push eax
call esi
push dword [0x479928]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4372f1
test ebx, ebx
je 0x4372f1
call edi
test eax, eax
je 0x4372e8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4372e8
test byte [ebp - 8], 1
jne 0x4372f1
or dword [ebp + 0x10], 0x200000
jmp 0x437324
mov eax, dword [0x47991c]
cmp eax, dword [ebp - 0x18]
je 0x437324
push eax
call esi
test eax, eax
je 0x437324
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x437324
mov eax, dword [0x479920]
cmp eax, dword [ebp - 0x18]
je 0x437324
push eax
call esi
test eax, eax
je 0x437324
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x479918]
call esi
test eax, eax
je 0x437340
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x437342
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004378d2
leave
ret

Function at 0x4378d2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x478414]
jne 0x4378dc
repz ret
jmp fcn.00444645
Function at 0x417e10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417e36
mov eax, dword [0x6377e0]
test eax, eax
je 0x417e2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6377e0], eax
test eax, eax
pop ebx
je 0x417ed1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6377e0]
loopne 0x417f12
arpl word [eax], ax

Function at 0x43c340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop edx
sub dword [eax], esp
in eax, 0x43
push eax
pop esp
imul edx, eax, 0x52fda6ca
push ecx
mov bh, byte [eax]
and al, 0xff
dec eax
shl byte [esi], cl
cmc
mov eax, 0xa0b1f7dc
inc esp
shr dword [esi], 1
jae 0x43c3b4
retf 0xfda6
mov ah, 0x39
push ds
popal
bound ebp, qword [ecx]
jb 0x43c339
mov dl, 0xad
mov fs, word [ecx]
or al, byte [ebp + 0x2b]
dec eax
ljmp 0x5460
std
loope 0x43c342
add byte [eax], dl
inc eax
and esp, dword [edi + eax*4]
arpl word fs:[edx + 0x3250aa42], bp
fisub dword [eax - 0x7e]
popal
in al, dx
aad 0x11
or bl, byte [eax - 0xb]
pushal
jne 0x43c427
mov edx, 0xdda31a28
sbb eax, dword [edx]
out 0xf5, eax
cmp edi, dword [ecx - 0x79dcfb77]
invalid
xor ebx, dword [ebx + 0x45]
dec ebx

Function at 0x4549ef
Capabilities:
Encode data using xor

Disassembly:
or byte [esi], ah
cdq
mov ah, 0x90
dec edi
nop
xor cl, dl
sahf
aas
dec esi
cmp dword [edi + edi*8 - 0xf6245c6], edx
ror byte [esi + 0x557e2acf], 1
insb byte es:[edi], dx
lodsb al, byte [esi]
adc ebx, dword [eax]
inc esi
xchg ebp, eax
push ebp
stosb byte es:[edi], al
dec eax
inc esp
div byte [esi + 0x3d]
pop ebp
adc eax, 0x8be123b0
push edi
xchg ebx, eax
mov ecx, 0x58ea5720
ljmp 0x7c86
cmp edi, esi
invalid
Function at 0x469fe0
Capabilities:
Encode data using xor

Disassembly:
dec ebp
mov ecx, 0x4c784d28
cmp al, 0x1f
xlatb
jle 0x46a05d
sbb byte [ebx + edi*8 - 0x18e7baa2], ah
or ebp, dword [esi + 0x763230cf]
nop
cmp dword [ebx + 0x7e], esp
lds eax, [esi + 0x18]
arpl word [esi - 0xe], di
lds eax, [esi + 0x18]
and al, 0xe0
adc bh, byte [ecx - 0x35b87133]
dec ebp
add byte [eax - 0x53cb1548], al
mov esp, 0xc9bc8e05
stosd dword es:[edi], eax
popal
pushal
out 0xb0, al
pop ss
adc byte [ebx - 0x4a], 0x46
jo 0x46a046
and al, 0x15
pop esp
and byte [edi - 0xd], dl
dec eax
movsd dword es:[edi], dword [esi]
fld xword [ecx - 0x1a26c6c2]
int 0xd3
pop edi
cmp ecx, eax
lahf
popal
add dl, bh
jne 0x46a02a
cmp ecx, ebx
in eax, 0xcd
rcr dword [edi + 0x39], cl
rcr dword [edi + 0x75fa0061], 0xf1
mov ecx, 0x79021b2c
rcr byte [ebx], 0x70
wait
push es
mov ecx, 0x81417c12
insb byte es:[edi], dx
not byte [edx - 0x3de458e5]
inc ecx
sub dword [esi + esi*8 - 0x6e], 0xc21ba71b
sub dh, byte [edi - 0x64]
test byte [ebp - 0xf0ed5f5], dh
into
sub eax, 0xedcd78b0
in eax, dx
outsb dx, byte [esi]
mov eax, dword [0xe9ee98b7]
jno 0x469ffa
cdq
xchg esi, eax
mov eax, 0x6922294b
add eax, 0x349d2d0
invalid

Function at 0x47f243
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x2ab0a65
clc
add al, 9
sub byte [eax + 0x31], 0xd2
rcl dword [ebx - 0x70ce1045], cl
out 0xf9, al
aaa
sahf
or al, 0x99
lea edx, [esi - 0x17]
salc
aas
cmp eax, 0xdcc496d2
adc esp, dword [ecx + esi - 0x26]
pop eax
outsb dx, byte [esi]
cmp bh, ah
push 0x39782458
out 0x10, eax
mov al, 0xda
dec ebx
xor eax, 0xc3981338
pop ebp
leave
push eax
pop ebx
ja 0x47f258
xor byte [edx], cl
rcl byte [eax], 0x2b
or al, al
adc byte [ebx], ch
push ebx
cmp eax, dword [edx + 0x1f]
add eax, 0x585ac46
push 0x95110fbf
or eax, 0x521f3698
add byte [eax + 0x75b314a5], bh
jp 0x47f283
pop es
add byte [eax], ch
pop ds
xor byte [edx], 0x96
push 0x7a
invalid
Function at 0x62a421
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6343b0
cmp edx, dword [eax]
je 0x62a443
add eax, 8
inc ecx
cmp eax, 0x634440
jl 0x62a434
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6343b0]
jne 0x62a571
mov eax, dword [0x638d8c]
cmp eax, 1
je 0x62a54b
test eax, eax
jne 0x62a474
cmp dword [0x6342dc], 1
je 0x62a54b
cmp edx, 0xfc
je 0x62a571
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62a4ab
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062ae00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062b290
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62a4ee
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062b290
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62fd54
push edi
call fcn.0062d160
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062ae00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062ae10
lea eax, [ebp - 0xa0]
push 0x62fd34
push eax
call fcn.0062ae10
push dword [esi + 0x6343b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062ae10
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062d0d4
add esp, 0x2c
pop edi
jmp 0x62a571
lea eax, [ebp + 8]
lea esi, [esi + 0x6343b4]
push 0
push eax
push dword [esi]
call fcn.0062b290
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret