joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53b494
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x556c00]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x556c00]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x556c00]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x556c00]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x556784]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x53b4cf
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x53b5b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x556c00]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x556c00]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x556c00]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x556c00]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x556784]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x556c00]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x556c00]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x556c00]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x556c00]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x53b5fb
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x54a908
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
test dl, dl
je 0x54a920
add esp, 0xfffffff0
call fcn.00403988
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp - 0x109]
push eax
push 0x105
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
jne 0x54a940
call fcn.0040e348
lea eax, [ebp - 0x20e]
push eax
push 0
push 0
lea eax, [ebp - 0x109]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
jne 0x54a960
call fcn.0040e348
mov dword [edi + 0x1c], 0xffffffff
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
xor eax, eax
mov dword [edi + 0x24], eax
lea eax, [edi + 0x14]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.004047a8
push 0xffff
mov ecx, dword [edi + 0x14]
mov dl, 1
mov eax, dword [0x41b900]
call fcn.00420cb4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x54a9c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, edi
call fcn.0054a2c0
mov edx, esi
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54a9e0
mov eax, edi
test bl, bl
je 0x54a9f5
call fcn.004039e0
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40ea10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call sub.MFC42.DLL_CWnd::CWnd
xor edi, edi
mov dword [esi + 0x98], 0x410c68
mov dword [esp + 0x14], edi
mov dword [esi + 0x9c], edi
lea ecx, [esi + 0xc0]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0xd4]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0xd8]
mov byte [esp + 0x14], 3
call fcn.00408d2e
mov edx, dword [esp + 0x28]
mov dword [esi + 0xa4], edi
mov ecx, 9
xor eax, eax
lea edi, [esi + 0x50]
mov dword [esi], 0x410ba8
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x2c], 4
call fcn.00403430
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x404db0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40ebf2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_CDialogBar::CDialogBar
lea ebp, [esi + 0x144]
xor edi, edi
mov ecx, ebp
mov dword [esp + 0x30], edi
lea ebx, [esi + 0x104]
call sub.MFC42.DLL_CString::CString_2
mov dword [esi + 0x150], 0x410e98
mov dword [esi + 0x154], edi
lea ecx, [esi + 0x160]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0xf4]
xor eax, eax
mov dword [esi], 0x410da8
mov dword [esi + 0x8c], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x148], edi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x15c], edi
mov dword [esi + 0x158], edi
mov dword [ecx], eax
xor edx, edx
push 0x2713
mov dword [ecx + 4], eax
mov byte [esp + 0x34], 3
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi + 0xa4]
mov dword [esi + 0xa4], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
call fcn.0040a5d0
add esp, 4
mov ecx, ebp
push eax
call sub.MFC42.DLL_CString::operator
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [eax + 0xc]
mov ebp, dword [0x4179b8]
mov dword [esp + 0x10], ecx
call sub.MFC42.DLL_AfxGetModuleState
lea edx, [esp + 0x18]
push str.IDB_CAPTIONBAR_SYS_CLOSEBT_N
push edx
mov ecx, 0x417bf8
mov dword [eax + 0xc], ebp
call fcn.00406c00
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebp, dword [sym.imp.USER32.dll_SetRect]
push eax
push ecx
push edi
push edi
push ebx
call ebp
lea edx, [esp + 0x20]
push str.IDB_CAPTIONBAR_SYS_STOREBT_N
push edx
mov ecx, 0x417bf8
call fcn.00406c00
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebx]
mov dword [esp + 0x1c], edx
lea ebx, [esi + 0x114]
push edx
lea edx, [eax - 2]
sub eax, ecx
push edx
sub eax, 2
push edi
push eax
push ebx
call ebp
lea eax, [esp + 0x20]
push str.IDB_CAPTIONBAR_SYS_MINBT_N
push eax
mov ecx, 0x417bf8
call fcn.00406c00
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebx]
mov dword [esp + 0x1c], edx
push edx
lea edx, [eax - 2]
sub eax, ecx
push edx
sub eax, 2
push edi
push eax
lea eax, [esi + 0x124]
push eax
call ebp
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [esp + 0x10]
pop edi
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x407750
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40ee26
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x110
push esi
mov esi, dword [esp + 0x124]
push edi
push 0x17
push eax
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40788c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [esp + 0x14]
call fcn.00408bea
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x134]
mov byte [esp + 0x120], 1
test eax, eax
jl 0x4077e9
mov ecx, dword [esp + 0x130]
push eax
push ecx
lea edx, [esp + 0x10]
push str._s__d
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
jmp 0x4077fa
mov eax, dword [esp + 0x130]
lea ecx, [esp + 8]
push eax
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0xc]
call fcn.004078b0
push eax
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, edi
call fcn.00407650
mov al, byte [esp + 0x18]
mov dword [esp + 0xc], 0
cmp al, 0x30
jne 0x407849
cmp byte [esp + 0x19], 0x78
jne 0x407849
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push 0x4165ac
push ecx
jmp 0x407858
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
push edx
push 0x4160c8
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
mov esi, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 8]
mov byte [esp + 0x120], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
mov ecx, dword [esp + 0x118]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x11c
ret 0x10
Function at 0x40a240
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
push ebp
push esi
mov esi, dword [ebx + 0x10]
push edi
mov edi, dword [esp + 0x24]
mov ebp, dword [esi]
test ebp, ebp
je 0x40a27b
mov cl, byte [esi + 8]
mov eax, edi
and eax, 0xffff
xor edx, edx
shr eax, cl
div dword [esi + 4]
mov edx, dword [ebp + edx*4]
test edx, edx
je 0x40a27b
cmp word [edx + 4], di
je 0x40a2ec
mov edx, dword [edx]
test edx, edx
jne 0x40a26f
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
sub ecx, eax
cmp ecx, 1
jle 0x40a3b8
mov edx, dword [ebx + 0x14]
push ecx
add eax, edx
and edi, 0xffff
mov dword [esp + 0x20], eax
push eax
mov eax, dword [ebx + 8]
push edi
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
mov ebp, dword [ebx + 0x14]
mov cl, byte [esi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x1c]
add eax, ebp
mov ebp, dword [esi + 4]
mov dword [esp + 0x14], eax
mov eax, edi
shr eax, cl
xor edx, edx
mov ecx, dword [esi]
div ebp
test ecx, ecx
mov edi, edx
mov dword [esp + 0x10], edi
je 0x40a304
mov eax, dword [ecx + edi*4]
test eax, eax
je 0x40a300
mov dx, word [eax + 4]
cmp dx, word [esp + 0x24]
je 0x40a2f8
mov eax, dword [eax]
test eax, eax
jne 0x40a2d9
jmp 0x40a300
test edx, edx
je 0x40a27b
mov edx, dword [edx + 6]
jmp 0x40a3b4
test eax, eax
jne 0x40a39c
test ecx, ecx
jne 0x40a333
lea edi, [ebp*4]
push edi
call sub.MFC42.DLL_operatornew
mov edx, eax
mov ecx, edi
mov dword [esi], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x10]
mov dword [esi + 4], ebp
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x40a36d
mov eax, dword [esi + 0x18]
push 0xa
lea ecx, [esi + 0x14]
push eax
push ecx
call fcn.0040d110
mov ecx, dword [esi + 0x18]
add eax, 4
lea edx, [ecx + ecx*4]
dec ecx
test ecx, ecx
lea eax, [eax + edx*2 - 0xa]
jl 0x40a36d
mov edx, dword [esi + 0x10]
mov dword [eax], edx
mov dword [esi + 0x10], eax
test ecx, ecx
jle 0x40a36a
sub eax, 0xa
dec ecx
jns 0x40a35b
mov eax, dword [esi + 0x10]
mov dx, word [esp + 0x24]
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov ecx, dword [esi + 0xc]
inc ecx
mov dword [esi + 0xc], ecx
xor ecx, ecx
mov word [eax + 4], cx
mov dword [eax + 6], ecx
mov dword [eax], ecx
mov word [eax + 4], dx
mov ecx, dword [esi]
mov edx, dword [ecx + edi*4]
mov dword [eax], edx
mov ecx, dword [esi]
mov dword [ecx + edi*4], eax
mov edx, dword [esp + 0x14]
mov dword [eax + 6], edx
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx + 0x1c]
mov edx, dword [esp + 0x1c]
inc eax
add ecx, eax
mov dword [ebx + 0x1c], ecx
test edx, edx
jne 0x40a3c7
pop edi
pop esi
pop ebp
mov eax, 0x417920
pop ebx
add esp, 0x10
ret 4
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0x10
ret 4
Function at 0x40b830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40effb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x417720
mov dword [ebp - 0x14], ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
mov dword [ebp - 0x10], edi
je 0x40b9d3
push edi
call dword [sym.imp.MSVCRT.dll__fileno]
push eax
call dword [sym.imp.MSVCRT.dll__filelength]
mov ebx, eax
add esp, 8
test ebx, ebx
jge 0x40b89b
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
jmp 0x40b9d3
cmp ebx, 0x400
mov dword [ebp + 8], ebx
jl 0x40b8b4
push ebx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov esi, eax
jmp 0x40b8c2
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00409120
mov esi, esp
test esi, esi
jne 0x40b8d7
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
jmp 0x40b9d3
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [ebp - 0x10]
mov edi, eax
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [ebp + 0xc]
add esp, 0x14
test eax, eax
je 0x40b9ad
mov ebx, dword [ebp + 8]
cmp ebx, 4
jl 0x40b950
mov eax, ebx
mov ecx, 0x18
cdq
idiv ecx
cmp edx, 4
jne 0x40b950
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea ecx, [eax + 0x17]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edi, [edx + edx*2]
shl edi, 3
lea ecx, [edi + 4]
cmp ecx, ebx
je 0x40b966
cmp ebx, 0x400
jl 0x40b962
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
jmp 0x40b9d3
mov edx, dword [ebp + 0xc]
push 3
push edx
lea ecx, [ebp - 0x1b4]
call fcn.0040d570
lea ebx, [esi + 4]
push edi
push ebx
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 4], 0
call fcn.0040d6d0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
mov ecx, dword [ebp - 0x14]
push ebx
call fcn.0040baa0
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, 0x400
jl 0x40b9d1
jmp 0x40b9c7
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
push edx
push edi
push esi
call fcn.0040baa0
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, 0x400
jl 0x40b9d1
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x1c0]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40dd20
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
push edi
mov dword [esp + 0x14], ecx
xor edx, edx
xor eax, eax
mov al, byte [edx + str.80_]
mov ecx, eax
and eax, 7
sar ecx, 3
mov bl, byte [eax*2 + 0x412e84]
mov cl, byte [ecx + esi]
test bl, cl
setne al
mov byte [esp + edx + 0x50], al
inc edx
cmp edx, 0x38
jl 0x40dd37
mov eax, 0x1e
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp word [esp + 0x110], 1
je 0x40dd79
lea eax, [ebx + ebx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [ebx + 0x412f2c]
mov dword [edi], 0
mov esi, ecx
mov dword [ebp], 0
mov edx, esi
cmp edx, 0x1c
jge 0x40ddad
mov cl, byte [esp + edx + 0x50]
jmp 0x40ddb1
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x1c
jl 0x40dda2
mov eax, 0x1c
lea edx, [esi + 0x1c]
cmp edx, 0x38
jge 0x40ddcf
mov cl, byte [esp + edx + 0x50]
jmp 0x40ddd3
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x38
jl 0x40ddc4
xor edx, edx
mov eax, 0x412e94
xor ecx, ecx
mov cl, byte [edx + 0x412f3c]
cmp byte [esp + ecx + 0x18], 0
je 0x40ddfe
mov ecx, dword [eax]
mov esi, dword [ebp]
or esi, ecx
mov dword [ebp], esi
xor ecx, ecx
mov cl, byte [edx + 0x412f54]
cmp byte [esp + ecx + 0x18], 0
je 0x40de15
mov ecx, dword [eax]
mov esi, dword [edi]
or esi, ecx
mov dword [edi], esi
add eax, 4
inc edx
cmp eax, str.80_
jl 0x40dde5
mov eax, dword [esp + 0x10]
inc ebx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x40dd6b
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x88]
push edx
call fcn.0040e040
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 8
Function at 0xbb26f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov word [esp + 0x17], ax
lea esp, [esp + 2]
push word [esp + 0x11]
jmp 0xbb27ae
mov dword [esp + 0x1c], eax
pushfd
push si
push word [esp + 2]
mov dword [esp + 0x20], ecx
jmp 0xbb27b7
push si
push word [esp + 2]
mov dword [esp + 0x20], ecx
jmp 0xbb27b7
jp 0xbb2779
mov dword [esp + 0x1c], eax
pushfd
jmp 0xbb2798
mov dword [esp + 0x1c], edx
push si
mov byte [esp], al
push word [esp]
jb 0xbb28c1
jae 0xbb27f9
outsb dx, byte [esi]
std
insd dword es:[edi], dx
hlt
mov dword [esp + 0x18], ebx
jmp 0xbb28d0
lea esp, [esp]
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0xbb27e3
lea esp, [esp]
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x18], ebx
call fcn.00bb282a
jmp 0xbb299b
xchg dl, dh
jmp 0xbb2966
mov ebp, dword [esp + 0x44]
neg ch
jp 0xbb2917
xchg dl, dh
lea ecx, [edi*4]
jmp 0xbb2950
sub esp, 0x14
mov dx, word [esp + 0x11]
jmp 0xbb292d
mov eax, 0xd9ad8afa
jmp 0xbb2972
lea ecx, [edi*4]
mov eax, 0xd9ad8afa
lea esi, [esp + 0x18]
mov dx, 0xc071
mov eax, ebp
lea ebx, [ecx + edx]
jmp 0xbb2985
xchg edi, eax
jmp 0xbb2a67
inc ax
jl 0xbb2946
sub esp, 0x14
mov dx, word [esp + 0x11]
jmp 0xbb292d
mov ax, 0x6b8d
shl dh, 2
jmp 0xbb29bf
sub esp, 0xa8
mov edi, esp
bsr eax, edi
jae 0xbb29fd
mov ax, 0x6b8d
shl dh, 2
jmp 0xbb29c6

Function at 0xbb29a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
jmp 0xbb29e3
not cx
setge dl
sub esp, 0x13
jp 0xbb29cd
push word [esp + 0x11]
ror cx, cl
jmp 0xbb29ff
push word [esp + 1]
lea esp, [esp + 3]
jmp 0xbb2a24

Function at 0xbc041f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call 0xbd4def
call 0x757f6f55
xor al, byte [ebp - 0x76134626]
jmp 0xba2c3e
push bx
lea esp, [esp + 2]
push ebp
bt ax, bp
jmp 0xba2c0a
mov ebp, esp
movzx eax, word [ebp + 8]
mov cx, word [esp]
mov dx, 0xb1af
not ch
jmp 0xba2c5e
dec dh
jmp 0xba2c82
sub esp, 8
lea esp, [esp + 8]
push esi
mov dh, byte [esp]
sub esp, 8
jmp 0xba2c28
movzx ecx, word [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0xc]
jmp 0xba2c3e
mov dx, word [esp]
sub esp, 0x12
lea esp, [esp + 2]
jmp 0xba2ca9
mov esi, dword [ebp + 8]
mov edx, edi
mov dx, cx
shr esi, 0x10
jmp 0xba2c68
lea esp, [esp + 0x18]
movzx esi, si
sete dh
mov dx, word [esp]
pushal
jmp 0xbd4cee
shr ebx, 0x10
jmp 0xba2c8f
lea esp, [esp + 4]
jmp 0xba2bcf
mov edx, eax
lea esp, [esp + 0x20]
movzx ebx, bx
stc
jmp 0xbd4d18
imul edx, ecx
sub esp, 0x19
lea esp, [esp + 1]
jmp 0xbd4d52
mov dword [ebp + 0xc], esi
bswap esi
jmp 0xbd4da6
lea esp, [esp + 0x18]
imul ecx, esi
sub esp, 0x14
lea esp, [esp + 9]
sub esp, 0xd
jmp 0xbd4d3c
mov esi, ebx
call 0xbd4d82
xor al, 0xf5
lea esp, [esp + 4]
imul esi, dword [ebp + 0xc]
jmp 0xbd4e4d
mov dword [ecx], edx
pop ecx
pushfd
jmp 0xbd4dce
lea esp, [esp + 0x18]
imul eax, ebx
mov si, dx
lea esi, [edx + edi]
rol si, cl
jmp 0xbd4d7a
jae 0xba2bb9
call fcn.00bd4e0e
in ax, dx
jge 0xbd4dcb
test dword [ecx + 0x7c], reloc.WINMM.dll_midiStreamOut
salc
inc ecx
ret
mov dword [edi + 4], esi
cmp eax, ecx
lea esp, [esp + 4]
jmp 0xbd4db8
add eax, ecx
push ecx
mov ecx, edi
jmp 0xbd4d90
Function at 0xc8a762
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 5]
rdtsc
rdtsc
stc
xchg ecx, edi
lea ecx, [ebx + ebx]
jmp 0xc8a78e
bswap edi
jmp 0xc8a74c
rdtsc
stc
lea eax, [esi - 3]
lea ebx, reloc.WINMM.dll_midiStreamOut
mov ch, al
mov dl, bl
jmp 0xc8a7bc
add esp, 0xb
mov si, 0xeeb3
xchg byte [esp], dh
bswap ebx
mov byte [esp], ah
jmp 0xc8a7a6
xchg si, ax
rdtsc
add esp, 2
lea esi, [esi - 0xb2]
mov edx, 0x9df0422f
xchg bp, bx
jmp 0xc8a766
mov cx, 0xb848
mov esi, eax
mov dl, 0x66
cpuid
mov ch, 0xa9
jmp 0xc8a7d7
mov esi, 0xdde01826
lea ebp, [ebx*4]
bswap eax
setle dh
sub esp, 0xb
push word [esp + 5]
jmp 0xc8a778
lea ecx, [ebp*4]
bts ebp, esi
sub esp, 0x14
pop bp
bswap eax
mov ah, 0xcd
jmp 0xc8ab2c
neg bx
xchg dword [esp + 3], ebx
inc dl
cpuid
pop di
call fcn.00c8a870

Function at 0xc8ab91
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xf], ecx
xchg byte [esp + 0x12], dh
xchg ch, dh
mov ch, 0xfd
neg bh
jmp 0xc8abad