joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c3ec0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x120
mov ecx, dword [esp + 0x128]
push esi
push edi
mov edi, dword [esp + 0x12c]
test ecx, ecx
mov esi, dword [edi]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], esi
jne 0x100c3ef2
push ecx
push ecx
lea eax, [esp + 0x2c]
push ecx
push eax
jmp 0x100c3f46
cmp ecx, 0xffffffff
jne 0x100c3f09
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
jmp 0x100c3f38
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 8], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 0xc], edx
lea eax, [esp + 8]
lea ecx, [esp + 0x24]
push eax
push 0
push 0
push ecx
inc esi
push esi
call sub.WS2_32.dll_select
test eax, eax
jge 0x100c3f5d
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x120
ret
mov eax, dword [edi]
lea edx, [esp + 0x24]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100c3fb2
push 8
mov dword [esp + 0x14], 0x10
call sub.MSVCRT.dll_malloc
mov esi, eax
add esp, 4
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
mov dword [esi + 4], 0
mov eax, dword [edi]
push ecx
push edx
push eax
call sub.WS2_32.dll_accept
push esi
push edi
mov dword [esi], eax
call fcn.100c3c60
add esp, 8
mov eax, esi
pop edi
pop esi
add esp, 0x120
ret
pop edi
xor eax, eax
pop esi
add esp, 0x120
ret

Function at 0x100c3fc0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0xc], 1
test ecx, ecx
mov dword [esp + 0x10], esi
jne 0x100c3ff3
push ecx
push ecx
push ecx
lea eax, [esp + 0x18]
lea ecx, [esi + 1]
push eax
push ecx
jmp 0x100c404b
cmp ecx, 0xffffffff
jne 0x100c400a
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x100c4039
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 0
push 0
lea edx, [esi + 1]
push ecx
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x100c405f
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100c4097
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x120]
push 0
push ecx
push edx
push esi
call sub.WS2_32.dll_recv
test eax, eax
jg 0x100c409c
mov eax, 0xfffffffc
pop esi
add esp, 0x10c
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret
Function at 0x100c40b0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0xc], 1
test ecx, ecx
mov dword [esp + 0x10], esi
jne 0x100c40e3
push ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
lea ecx, [esi + 1]
push ecx
jmp 0x100c413b
cmp ecx, 0xffffffff
jne 0x100c40fa
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x100c4129
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
lea edx, [esi + 1]
push 0
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x100c414f
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100c417e
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x120]
push 0
push ecx
push edx
push esi
call sub.WS2_32.dll_send
pop esi
add esp, 0x10c
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret

Function at 0x100c4270
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
call fcn.100c49b0
push 6
push 1
push 2
mov dword [0x100fe860], eax
call sub.WS2_32.dll_socket
mov ecx, dword [esp + 0x18]
mov esi, eax
xor eax, eax
push ecx
mov dword [esp + 8], eax
mov word [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_inet_addr
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], eax
push edx
call sub.WS2_32.dll_htons
mov word [esp + 6], ax
lea eax, [esp + 4]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
jge 0x100c42df
push esi
call sub.WS2_32.dll_closesocket
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x100c44f0
Capabilities:
Create udp socket

Disassembly:
sub esp, 0x10
push esi
call fcn.100c49b0
push 0
push 2
push 2
mov dword [0x100fe864], eax
call sub.WS2_32.dll_socket
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
mov word [esp + 4], 2
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_htonl
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], eax
push ecx
call sub.WS2_32.dll_htons
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call sub.WS2_32.dll_bind
test eax, eax
jge 0x100c455b
push esi
call sub.WS2_32.dll_closesocket
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x100c45e0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
mov ecx, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x118]
mov dword [esp + 0xc], 0x10
test ecx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 1
jne 0x100c461b
push ecx
push ecx
push ecx
lea eax, [esp + 0x1c]
lea ecx, [esi + 1]
push eax
push ecx
jmp 0x100c4673
cmp ecx, 0xffffffff
jne 0x100c4632
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x100c4661
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0x10]
push eax
push 0
push 0
lea edx, [esi + 1]
push ecx
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x100c4687
or eax, 0xffffffff
pop esi
add esp, 0x110
ret
lea eax, [esp + 0x10]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100c46cc
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x128]
push edx
push 0
push eax
push ecx
push esi
call sub.WS2_32.dll_recvfrom
test eax, eax
jg 0x100c46d1
mov eax, 0xfffffffc
pop esi
add esp, 0x110
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x110
ret

Function at 0x100c47f0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0xc], 1
test ecx, ecx
mov dword [esp + 0x10], esi
jne 0x100c4823
push ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
lea ecx, [esi + 1]
push ecx
jmp 0x100c487b
cmp ecx, 0xffffffff
jne 0x100c483a
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x100c4869
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
lea edx, [esi + 1]
push 0
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x100c488f
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100c48c8
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x120]
push 0x10
push ecx
push 0
push edx
push eax
push esi
call sub.WS2_32.dll_sendto
pop esi
add esp, 0x10c
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret
Function at 0x100c4900
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
lea eax, [esp + 4]
push esi
push 0x100
push eax
call sub.WS2_32.dll_gethostname
test eax, eax
jge 0x100c4924
xor eax, eax
pop esi
add esp, 0x104
ret
lea ecx, [esp + 8]
push ecx
call sub.WS2_32.dll_gethostbyname
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
jne 0x100c4940
pop esi
add esp, 0x104
ret
push ebx
push ebp
mov ebp, dword [esp + 0x114]
push edi
xor ebx, ebx
jmp 0x100c4952
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 0xc]
cmp dword [edx + ebx*4], 0
je 0x100c49a1
push 0x100
call sub.MSVCRT.dll_malloc
mov dword [ebp + ebx*4], eax
mov eax, dword [esi + 0xc]
add esp, 4
mov ecx, dword [eax + ebx*4]
mov edx, dword [ecx]
push edx
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + ebx*4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp ebx, 0xa
rep movsb byte es:[edi], byte [esi]
jl 0x100c494e
pop edi
mov eax, ebx
pop ebp
pop ebx
pop esi
add esp, 0x104
ret

Function at 0x100c4a20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push edx
mov dword [esp + 0xc], 0x10
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x100c4a56
mov eax, dword [esp + 6]
push eax
call sub.WS2_32.dll_ntohs
and eax, 0xffff
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret

Function at 0x100c59d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x100c59dc
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x100c5a6f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x100c5a39
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.100c5a80
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x100c5a0e
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x100c5aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x100c5b9d
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x100c5af2
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x100c5b1e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.100c5a80
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x100c5b5f
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x100c5ae1
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x100c7310
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x100e7464]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x100c7323
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x100c7364
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x100e750c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x100c7396
mov bl, byte [esp + ecx + 0x4c]
jmp 0x100c739a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x100c738b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x100c73b8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x100c73bc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x100c73ad
xor ecx, ecx
mov eax, 0x100e7474
xor ebx, ebx
mov bl, byte [ecx + 0x100e751c]
cmp byte [esp + ebx + 0x14], 0
je 0x100c73e7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x100e7534]
cmp byte [esp + ebx + 0x14], 0
je 0x100c73fe
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x100c73ce
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x100c7357
lea edx, [esp + 0x84]
push edx
call fcn.100c7440
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x100cac00
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x100cac4a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x100cac79
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x100cacbb
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x7f2907
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07e16f0
jmp 0x7f290d
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
jmp 0x7f2923
mov word [esp], bx
jmp 0x7f28f1
clc
jbe 0x7f29ad
mov cx, bp
mov esi, dword [esp]
mov cl, ch
jmp 0x7f2970
pushfd
jmp 0x7f22ba
mov esi, dword [esp]
mov cl, ch
mov ebp, dword [esp + 0x2c]
jmp 0x7f294e
mov cx, bp
jmp 0x7f296b

Function at 0x7f7035
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 4]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
jmp fcn.007f7058
push word [esp + 4]
jp 0x7f701f
jnp 0x7f706e
stc
imul edi, ecx, 0x19ac6b98
mov bl, byte [eax]
jg fcn.007f6fd3
cmp dword [ecx + 0x29dabf2f], edi
int1
ret 0x4c7d
pop word [esp + 4]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp fcn.007f7085

Function at 0x7f7208
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cx, ax
mov ecx, dword [esp]
cmc
bswap eax
mov dl, byte [esp]
jmp 0x7f7213
add esi, 0x2ac6ab71
bsr ax, sp
jle 0x7f71c0
xchg cx, ax
jmp 0x7f71eb
mov ecx, dword [esp]
cmc
bswap eax
jmp 0x7f7229
not ecx
lea edx, [esi + 0xb]
lea esp, [esp + 4]
jmp 0x7f71d6
lea ecx, [esi + 0xf80e]
jmp 0x7f722e
mov dl, byte [esp]
jmp 0x7f7213
ror esi, 0
setle al
lea ecx, [ecx + esi]
lea eax, [esi*4]
mov eax, 0x23d4139b
jmp 0x7f731e
add esi, dword [ebp]
xchg cx, dx
jmp 0x7f727a
rdtsc
lea eax, [eax*4]
sub esi, 0x2564456
mov ch, 0xd0
xchg dh, ch
jmp 0x7f72c7

Function at 0x8092b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pop dword [esi]
jmp 0x7f64cb
mov ecx, 0x5db05a1a
jmp 0x809314
cmp ebp, ebx
jmp 0x8092ef
jmp 0x8092d7
ja 0x7f2399
call 0x8092fb
invalid
lea ebx, [esi + 0x50]
bswap eax
cmp ecx, ebx
ja 0x8092ed
jbe 0x8092ed
mov ecx, 0x8884c7c6
add ecx, ecx
jl 0x80934f
jge 0x80934f
popfd
pop ss
xchg edx, esp
adc dword [edx + ecx - 0x11b82b5b], ebp
mov ebx, esi
jmp 0x80931f
shl ah, cl
jae 0x809356
bswap eax
jmp 0x809358
lea ecx, [esi + 0x40]
bswap eax
jmp 0x809339
bswap eax
sub ecx, ebx
jmp 0x809396
mov eax, esi
bsr ax, bx
jmp 0x8093bc
rol eax, cl
jge 0x809380
mov eax, esi
bsr ax, bx
jmp 0x8093bc
clc
and al, 0xfc
clc
ja 0x80941b
jbe 0x80941b
arpl bp, si
or al, 0xff
inc edx
jae 0x809398
je 0x8093c7
out dx, al
sub al, 0x97
dec cl
push 0x458d228b
adc byte [edi - 0x7d], 0xec
sbb al, 0x72
fisttp qword [edi]
sbb dword [eax + 0x45000000], 0xffffffdd
lea eax, [ebp - 0x80]
push edi
sub esp, 0x1c
jb 0x8093a2
jae 0x809463
cwde
add byte [eax], al
add byte [ebp - 0x23], al
inc ebp
fisttp qword [ebp + 0x14]
out 0x55, eax
dec ebp
adc al, 0xe7
push ebp
mov ch, 0x2e
mov esp, 0xbff236db
xchg byte [ecx - 0x3075fbaa], cl
lea ecx, [edx + esi]
pushfd
jmp 0x808e79
sub eax, ecx
call 0x8093e7
lea esp, [esp + 2]
jmp 0x809433
jmp 0x8093fd
push esi
jmp 0x80943c
mov esp, eax
pushfd
lea esi, [eax + ecx - 0x40]
jmp 0x80941d
push edi
push ecx
mov esi, ebx
jmp 0x809446
mov edi, eax
mov ecx, ecx
cld
jmp 0x8095b1
clc
jmp 0x8093a3
pop esi
popfd
jmp 0x7f09d9
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
jmp 0x80957b
Function at 0x405420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x75344
call fcn.00408d90
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x75320], 0
push eax
push eax
push eax
mov word [ebp - 0x7530c], ax
lea eax, [ebp - 0x7531c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x75320]
mov dword [ebp - 0x7531c], 0x10001
push eax
mov dword [ebp - 0x75318], 0x3e80
mov dword [ebp - 0x75314], 0x3e80
mov dword [ebp - 0x75310], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x75300
lea eax, [ebp - 0x75308]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov cl, al
mov ebx, eax
add cl, cl
shr ebx, 6
lea edx, [ecx + eax]
xor bl, dl
or bl, al
mov byte [ebp + eax - 0x75308], bl
inc eax
cmp eax, 0x75300
jb 0x4054a4
lea eax, [ebp - 0x75308]
mov dword [ebp - 0x7533c], 0x75300
mov dword [ebp - 0x75340], eax
lea eax, [ebp - 0x75340]
push 0x20
push eax
push dword [ebp - 0x75320]
mov dword [ebp - 0x75338], 0
mov dword [ebp - 0x75334], 0
mov dword [ebp - 0x75330], 0
mov dword [ebp - 0x7532c], 0
mov dword [ebp - 0x75328], 0
mov dword [ebp - 0x75324], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x75340]
push eax
push dword [ebp - 0x75320]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x75340]
push eax
push dword [ebp - 0x75320]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x75320]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004080e4
mov esp, ebp
pop ebp
ret
Function at 0x405820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xafcc0
call fcn.00408d90
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xafca0], 0
push eax
push eax
push eax
mov word [ebp - 0xafc8c], ax
lea eax, [ebp - 0xafc9c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xafca0]
mov dword [ebp - 0xafc9c], 0x10001
push eax
mov dword [ebp - 0xafc98], 0x5dc0
mov dword [ebp - 0xafc94], 0x5dc0
mov dword [ebp - 0xafc90], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xafc80
lea eax, [ebp - 0xafc88]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
cmp dword [0x40b3c4], 2
jl 0x4059e0
movaps xmm4, xmmword [0x409b30]
lea eax, [ecx + 4]
movaps xmm3, xmmword [0x409ba0]
movd xmm0, ecx
add ecx, 8
pshufd xmm1, xmm0, 0
paddd xmm1, xmm4
movaps xmm0, xmm1
movaps xmm2, xmm1
psrld xmm0, 5
psrld xmm2, 8
orps xmm0, xmm1
xorps xmm2, xmm1
pmulld xmm2, xmm0
movaps xmm0, xmm1
psrld xmm0, 7
orps xmm0, xmm1
paddd xmm2, xmm0
movaps xmm0, xmm1
pslld xmm0, 4
orps xmm0, xmm1
paddd xmm2, xmm0
movaps xmm0, xmm2
punpckldq xmm0, xmm2
pmuludq xmm0, xmm3
punpckhdq xmm2, xmm2
pmuludq xmm2, xmm3
shufps xmm0, xmm2, 0xdd
psrld xmm0, 6
pshuflw xmm0, xmm0, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
andps xmm0, xmmword [0x409b90]
packuswb xmm0, xmm0
movd dword [ebp + eax - 0xafc8c], xmm0
movd xmm0, eax
pshufd xmm1, xmm0, 0
paddd xmm1, xmm4
movaps xmm0, xmm1
movaps xmm2, xmm1
psrld xmm0, 5
psrld xmm2, 8
orps xmm0, xmm1
xorps xmm2, xmm1
pmulld xmm2, xmm0
movaps xmm0, xmm1
psrld xmm0, 7
orps xmm0, xmm1
paddd xmm2, xmm0
movaps xmm0, xmm1
pslld xmm0, 4
orps xmm0, xmm1
paddd xmm2, xmm0
movaps xmm0, xmm2
punpckldq xmm0, xmm2
pmuludq xmm0, xmm3
punpckhdq xmm2, xmm2
pmuludq xmm2, xmm3
shufps xmm0, xmm2, 0xdd
psrld xmm0, 6
pshuflw xmm0, xmm0, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
andps xmm0, xmmword [0x409b90]
packuswb xmm0, xmm0
movd dword [ebp + eax - 0xafc88], xmm0
add eax, 8
cmp eax, 0xafc84
jb 0x4058c1
jmp 0x405a1d
mov edx, ecx
mov eax, ecx
shr eax, 5
or eax, ecx
shr edx, 8
xor edx, ecx
imul edx, eax
mov eax, ecx
shr eax, 7
or eax, ecx
add edx, eax
mov eax, ecx
shl eax, 4
or eax, ecx
add edx, eax
mov eax, 0x10624dd3
mul edx
shr edx, 6
mov byte [ebp + ecx - 0xafc88], dl
inc ecx
cmp ecx, 0xafc80
jb 0x4059e0
lea eax, [ebp - 0xafc88]
mov dword [ebp - 0xafcbc], 0xafc80
mov dword [ebp - 0xafcc0], eax
lea eax, [ebp - 0xafcc0]
push 0x20
push eax
push dword [ebp - 0xafca0]
mov dword [ebp - 0xafcb8], 0
mov dword [ebp - 0xafcb4], 0
mov dword [ebp - 0xafcb0], 0
mov dword [ebp - 0xafcac], 0
mov dword [ebp - 0xafca8], 0
mov dword [ebp - 0xafca4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xafcc0]
push eax
push dword [ebp - 0xafca0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xafcc0]
push eax
push dword [ebp - 0xafca0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xafca0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004080e4
mov esp, ebp
pop ebp
ret