joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4064b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xc4
test edx, edx
push ebx
mov dword [esp + 4], ecx
push esi
push edi
push ebp
jne 0x4064cd
xor eax, eax
jmp 0x4066cc
lea edi, [esp + 0x4c]
xor eax, eax
mov ecx, 0x12
rep stosd dword es:[edi], eax
mov dword [esp + 0x54], eax
push 2
mov eax, dword [esp + 0xe0]
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], edx
push ecx
mov dword [esp + 0x68], eax
push 0
mov dword [esp + 0x5c], 0x204d454d
mov dword [esp + 0x88], 0
call dword [sym.imp.WINMM.dll_mmioOpenA]
mov esi, eax
lea eax, [esp + 0x38]
push 0x20
push 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
lea eax, [esp + 0x40]
mov edi, dword [sym.imp.WINMM.dll_mmioDescend]
mov dword [esp + 0x48], 0x5344494d
push eax
push esi
call edi
lea eax, [esp + 0x24]
push 0x10
lea ecx, [esp + 0x3c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
lea eax, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x61746164
push eax
push esi
call edi
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0040a190
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
add esp, 4
add ecx, 0x10
mov edi, dword [sym.imp.WINMM.dll_mmioRead]
push 4
mov dword [esp + 0x1c], ecx
push ecx
push esi
call edi
mov eax, dword [esp + 0x28]
sub eax, 4
push eax
mov ecx, dword [esp + 0x20]
push ecx
push esi
call edi
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov ecx, dword [esp + 0x18]
add eax, 0x40
imul eax, dword [ecx]
push eax
call fcn.0040a190
mov ecx, dword [esp + 0x14]
add esp, 4
mov ebx, eax
mov dword [ecx], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov edx, dword [ecx]
mov dword [esp + 0x20], edx
test edx, edx
jle 0x4066ba
lea eax, [ebx + 0x40]
mov ecx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov dword [ebx], eax
add dword [esp + 0x14], 8
mov edx, dword [ecx + 8]
mov dword [ebx + 4], edx
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x14], 0
test byte [ecx + 0xc], 1
je 0x40667b
mov eax, dword [esp + 0x14]
mov dword [esp + 0x94], eax
lea eax, [esp + 0x94]
mov ecx, dword [ebp + 4]
push eax
mov dword [esp + 0x9c], ecx
push ebx
mov ecx, dword [ebp + 4]
mov dword [esp + 0xa4], ecx
mov ecx, dword [esp + 0x18]
call fcn.004066e0
test eax, eax
jne 0x406698
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040a090
add esp, 4
xor eax, eax
jmp 0x4066cc
mov ecx, dword [ebp + 4]
mov esi, dword [esp + 0x14]
mov dword [ebx + 8], ecx
mov eax, dword [ebp + 4]
mov edi, dword [ebx]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x10]
add dword [esp + 0x14], eax
dec dword [esp + 0x20]
mov eax, dword [ecx + 8]
add eax, 0x40
add ebx, eax
cmp dword [esp + 0x20], 0
jg 0x406602
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040a090
add esp, 4
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc4
ret 8
Function at 0x407960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
xor eax, eax
push esi
push edi
mov esi, ecx
lea edi, [esp + 8]
mov ecx, 8
rep stosd dword es:[edi], eax
mov byte [esp + 8], 0x26
mov byte [esp + 9], 0x28
mov byte [esp + 0xa], 0x25
mov byte [esp + 0xb], 0x27
mov byte [esp + 0xc], 0x20
lea eax, [esp + 8]
mov ecx, dword [esi + 4]
mov byte [esp + 0xd], 0xd
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x1b
push eax
push 0
call fcn.00409d20
mov byte [esp + 8], 0x68
mov byte [esp + 9], 0x62
mov byte [esp + 0xa], 0x64
mov byte [esp + 0xb], 0x66
mov byte [esp + 0xc], 0x5a
lea eax, [esp + 8]
mov ecx, dword [esi + 4]
mov byte [esp + 0xd], 0x58
mov byte [esp + 0xe], 0x43
mov byte [esp + 0xf], 0x56
push eax
push 1
call fcn.00409d20
lea edi, [esp + 8]
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
mov edi, 2
lea eax, [esp + 8]
mov ecx, dword [esi + 4]
push eax
push edi
inc edi
call fcn.00409d20
cmp edi, 8
jl 0x4079f4
pop edi
pop esi
add esp, 0x20
ret
Function at 0x4092b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
push ebx
push esi
mov ebx, ecx
push edi
push ebp
push 2
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call ebp
test eax, eax
jne 0x4092da
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ebp, eax
lea edi, [esp + 0x10]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
cmp word [esp + 0x1e], 8
je 0x40931b
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
mov eax, dword [esp + 0x14]
cdq
xor eax, edx
mov ecx, 1
sub eax, edx
and eax, 3
xor eax, edx
sub eax, edx
test eax, eax
jg 0x409336
xor ecx, ecx
mov eax, dword [esp + 0x14]
cdq
and edx, 3
add eax, edx
sar eax, 2
add ecx, eax
shl ecx, 2
cmp dword [esp + 0x24], 0
mov dword [esp + 0x14], ecx
jne 0x40935e
mov eax, ecx
imul eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, 0x10a
rep stosd dword es:[edi], eax
lea esi, [esp + 0x10]
mov edi, dword [ebx + 8]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x30]
lea esi, [ebp + 0x28]
shl ecx, 2
mov edi, dword [ebx + 8]
shr ecx, 2
add edi, 0x28
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40939d
push eax
call fcn.0040a830
add esp, 4
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x14]
lea esi, [ebp + 0x428]
push ecx
call fcn.0040a7b0
add esp, 4
mov ecx, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 0x14]
mov edi, dword [ebx + 0xc]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], ecx
mov ecx, ebx
mov dword [eax + 0x20], 0x100
mov eax, dword [ebx]
call dword [eax + 0x20]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4

Function at 0x40a280
Capabilities:
Terminate process

Disassembly:
mov dword [0x411110], 1
cmp dword [esp + 8], 0
push ebx
push esi
mov ebx, dword [esp + 0x14]
mov byte [0x41110c], bl
jne 0x40a2dc
cmp dword [0x41348c], 0
je 0x40a2ca
mov esi, dword [0x413484]
sub esi, 4
cmp esi, dword [0x41348c]
jb 0x40a2ca
mov eax, dword [esi]
test eax, eax
je 0x40a2bf
call eax
sub esi, 4
cmp esi, dword [0x41348c]
jae 0x40a2b7
push 0x411024
push 0x41101c
call fcn.0040a300
add esp, 8
push 0x41102c
push 0x411028
call fcn.0040a300
add esp, 8
test ebx, ebx
jne 0x40a2fd
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
ret
Function at 0x40a350
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410370
push 0x40cc00
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x4110d8], eax
xor eax, eax
mov al, byte [0x4110d9]
mov dword [0x4110e4], eax
mov eax, dword [0x4110d8]
shr dword [0x4110d8], 0x10
and eax, 0xff
mov dword [0x4110e0], eax
shl eax, 8
add eax, dword [0x4110e4]
mov dword [0x4110dc], eax
call fcn.0040cbe0
mov dword [ebp - 4], 0
call fcn.0040ca00
call fcn.0040c9f0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x413480], eax
call fcn.0040c590
mov dword [0x411118], eax
test eax, eax
je 0x40a3e9
cmp dword [0x413480], 0
jne 0x40a3f3
push 0xffffffffffffffff
call fcn.0040a240
add esp, 4
call fcn.0040c310
call fcn.0040c230
call fcn.0040a210
mov esi, dword [0x413480]
mov al, byte [esi]
cmp al, 0x22
je 0x40a41a
cmp al, 0x20
jbe 0x40a447
inc esi
cmp byte [esi], 0x20
ja 0x40a412
jmp 0x40a447
inc esi
cmp byte [esi], 0x22
je 0x40a446
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x40a441
xor eax, eax
mov al, bl
push eax
call fcn.0040c1d0
add esp, 4
test eax, eax
je 0x40a43b
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x40a423
cmp byte [esi], 0x22
jne 0x40a447
inc esi
cmp byte [esi], 0
je 0x40a457
cmp byte [esi], 0x20
ja 0x40a457
inc esi
cmp byte [esi], 0
jne 0x40a44c
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x40a47b
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0040a240
jmp 0x40a4bc
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c590
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
cmp dword [0x4111f8], 0
push ebx
push esi
push edi
push ebp
jne 0x40c5e0
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call esi
mov edi, eax
test edi, edi
je 0x40c5be
mov dword [0x4111f8], 1
mov ebx, dword [esp + 0x10]
jmp 0x40c5ee
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x40c5d6
mov dword [0x4111f8], 2
jmp 0x40c5ee
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x4111f8], 1
jne 0x40c69d
test edi, edi
jne 0x40c611
call esi
mov edi, eax
test edi, edi
jne 0x40c611
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x40c62b
add esi, 2
cmp word [esi], 0
jne 0x40c619
add esi, 2
cmp word [esi], 0
jne 0x40c619
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x40c68c
push ebp
call fcn.0040a7b0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x40c68c
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x40c67b
push ebx
call fcn.0040a830
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4111f8], 2
jne 0x40c721
test ebx, ebx
jne 0x40c6c0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x40c6c0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x40c6d5
inc ebp
cmp byte [ebp], 0
jne 0x40c6c7
inc ebp
cmp byte [ebp], 0
jne 0x40c6c7
sub ebp, ebx
inc ebp
push ebp
call fcn.0040a7b0
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x40c6fa
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x40cd20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor eax, eax
mov ecx, 0x411688
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [ecx], edx
je 0x40cd48
add ecx, 8
inc eax
cmp ecx, 0x411710
jb 0x40cd38
cmp dword [eax*8 + 0x411688], edx
lea ebx, [eax*8]
jne 0x40cf03
cmp dword [0x411124], 1
je 0x40cec8
cmp dword [0x411124], 0
jne 0x40cd7f
cmp dword [0x411128], 1
je 0x40cec8
cmp edx, 0xfc
je 0x40cf03
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x40cdbc
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x40ce00
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x41175c
push ebp
call fcn.0040e080
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41173c
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x41168c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.0040dfe0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x413380]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x40cedf
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x41168c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x40dab0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x413374], edx
push ebx
push esi
push edi
push ebp
jbe 0x40dcb7
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x413380
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x40dcb7
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x40db19
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x40db2a
push 2
push 0
push edx
call fcn.0040d4c0
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x40dbc6
mov dword [esp + 0x10], 0
mov edi, dword [esp + 0x430]
mov eax, edi
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x40dbff
lea ebx, [esp + 0x24]
mov eax, edi
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x40db8d
mov al, byte [edi]
inc edi
cmp al, 0xa
jne 0x40db7b
mov byte [ebx], 0xd
inc esi
inc ebx
mov byte [ebx], al
inc ebx
mov eax, ebx
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x40db62
lea eax, [esp + 0x24]
push 0
sub ebx, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push ebx
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40dbf5
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, ebx
jge 0x40db4d
jmp 0x40dbff
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40dbf5
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x40dbff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x40dca6
cmp dword [esp + 0x10], 0
je 0x40dc58
cmp dword [esp + 0x10], 5
jne 0x40dc3b
mov dword [0x4110cc], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x4110d0], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.0040e0b0
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x40dc82
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x40dc82
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4110cc], 0x1c
mov dword [0x4110d0], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4110cc], 9
mov dword [0x4110d0], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x40eba0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.0040ee60
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1014]
push ebp
cmp dword [0x413374], esi
jbe 0x40eced
mov eax, esi
mov ecx, esi
and eax, 0xffffffe7
and ecx, 0x1f
sar eax, 3
mov edx, dword [eax + 0x413380]
test byte [edx + ecx*8 + 4], 1
je 0x40eced
push 1
push ebx
push esi
call fcn.0040d4c0
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x40ecdd
push 2
push ebx
push esi
call fcn.0040d4c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x40ecdd
mov ecx, dword [esp + 0x101c]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x40ec83
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.0040ede0
add esp, 8
mov edi, eax
mov eax, 0x1000
cmp ebp, eax
jge 0x40ec46
mov eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0040dab0
add esp, 0xc
cmp eax, 0xffffffff
je 0x40ec62
sub ebp, eax
test ebp, ebp
jg 0x40ec3b
jmp 0x40ec77
cmp dword [0x4110d0], 5
jne 0x40ec75
mov dword [0x4110cc], 0xd
mov ebx, eax
push edi
push esi
call fcn.0040ede0
add esp, 8
jmp 0x40ecc0
jge 0x40ecc0
push 0
push ecx
push esi
call fcn.0040d4c0
add esp, 0xc
push esi
call fcn.0040e320
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x40ecc0
mov dword [0x4110cc], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4110d0], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.0040d4c0
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4110cc], 9
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
Function at 0x10001000
Capabilities:
Encode data using xor
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push esi
mov esi, dword [sym.imp.msvcrt.dll_rand]
push edi
call esi
movzx eax, al
push eax
call esi
movzx eax, al
push eax
call esi
movzx eax, al
push eax
call esi
movzx eax, al
push eax
call esi
movzx eax, al
push eax
call esi
movzx eax, al
push eax
call esi
movzx eax, al
push eax
call esi
mov edi, dword [sym.imp.msvcrt.dll_sprintf]
movzx eax, al
push eax
lea eax, [ebp - 0x28]
push str._02X_02X__02X_02X__02X_02X__02X_02X
push eax
call edi
push 0
call dword [sym.imp.msvcrt.dll__time64]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], edx
call dword [sym.imp.msvcrt.dll__localtime64]
push dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
inc ecx
push ecx
add eax, 0x76c
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xa8]
push str.productKey_s_nemail_s_nverifiedAt_04d__02d__02d_n
push eax
call edi
lea esi, [ebp - 0xa8]
add esp, 0x4c
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000109c
sub esi, ecx
xor ecx, ecx
test esi, esi
je 0x100010cf
push ebx
xor edx, edx
mov eax, ecx
push 0x1f
pop ebx
div ebx
mov al, byte [edx + str.o3982hueiwe3uhuHHJGy2b2jqiIU]
xor al, byte [ebp + ecx - 0xa8]
mov byte [ebp + ecx - 0x22c], al
inc ecx
cmp ecx, esi
jb 0x100010ac
pop ebx
push 0
push 0x1a
lea eax, [ebp - 0x1ac]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x1ac]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100010eb
push dword [ebp + 8]
sub ecx, edx
lea eax, [ebp - 0x1ac]
add eax, ecx
push str.AugustRose_Audio_sAppData.dat
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
test eax, eax
je 0x10001155
lea eax, [ebp - 0x1ac]
push 0x100020b4
push eax
call dword [sym.imp.msvcrt.dll_fopen]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10001155
push edi
push 1
lea ecx, [ebp - 0x22c]
push esi
push ecx
call dword [sym.imp.msvcrt.dll_fwrite]
push edi
call dword [sym.imp.msvcrt.dll_fclose]
xor eax, eax
add esp, 0x14
inc eax
jmp 0x10001157
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x4011d5
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x2ee5d4c]
mov ecx, dword [0x2ee2b44]
sub esp, 0xd4c
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x40127d
mov edi, ecx
mov ebx, eax
cmp dword [0x2ee5d4c], 0xae9
jne 0x401271
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push esi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x548]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push esi
lea eax, [ebp - 0xd48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push str.cehiwah_manamuxezexemuwetesaxuzaduzawor
push str.darujuwihunuyun_zabebedidez_zizofokajitaxipogejipubowexo_gifitutatopumiduc_deguvofagebifut
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x148]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push edi
call fcn.0040102f
add edi, 8
dec ebx
jne 0x4011fd
pop edi
pop esi
pop ebx
leave
ret