joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb37d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb37d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xb37d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb37d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xb37d94
push eax
push esi
call fcn.00b3a20b
add esp, 8
pop esi
ret 0x10

Function at 0xb37da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb37e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xb37e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xb50320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b39dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xb37dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xb37e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb37ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xb37eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xb50320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b39dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xb37eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xb37e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xb38000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xb38131
push esi
call fcn.00b3b145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00b2a080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xb38131
push 0
push ebp
call fcn.00b2a3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00b2a260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xb3808b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00b2a2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xb38121
push 0xb50918
push edi
call fcn.00b393f0
push eax
push ebx
push esi
call fcn.00b37f60
push 0xb508f8
push edi
call fcn.00b393f0
push eax
push ebx
push esi
call fcn.00b37f60
push 0xb508d8
push edi
call fcn.00b393f0
push eax
push ebx
push esi
call fcn.00b37f60
push 0xb508c0
push edi
call fcn.00b393f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00b37f60
push 0xb508a0
push edi
call fcn.00b393f0
push eax
push ebx
push esi
call fcn.00b37f60
push 0xb50888
push edi
call fcn.00b393f0
push eax
push ebx
push esi
call fcn.00b37f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xb391b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b39140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b39140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b39140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b39140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb39bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb39c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xb4b87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb39c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb39c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401541
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x22c]
push ebx
sub esp, 0x25c
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
and edi, 0x300
mov dword [esp], ebx
mov eax, edi
mov dword [esp + 4], esi
or eax, 9
mov dword [esp + 8], eax
call fcn.004087b6
sub esp, 0x10
test eax, eax
jne 0x4016a1
test byte [ebp + 0x10], 2
je 0x4015d7
xor eax, eax
mov dword [ebp - 0x228], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x228]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x222]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
cmp eax, 0x103
jne 0x401642
mov eax, dword [ebp + 0x10]
and eax, 1
mov dword [ebp - 0x23c], eax
jmp 0x401605
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call fcn.00401541
sub esp, 0xc
test eax, eax
jne 0x401659
lea edx, [ebp - 0x222]
xor eax, eax
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea edx, [ebp - 0x222]
sub esp, 0x10
test eax, eax
jne 0x401659
cmp dword [ebp - 0x23c], 0
je 0x4015e5
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
push ecx
jmp 0x4016a1
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov dword [esp], 3
call fcn.00409005
push edx
test eax, eax
jne 0x40168b
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push ecx
push ecx
jmp 0x4016a1
xor edx, edx
mov dword [esp + 8], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x4081a8
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
xor ecx, ecx
mov ebp, esp
sub esp, 0x48
mov dword [0x487d40], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], edx
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0x20], 0x487d40
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x408214
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x408218
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], edx
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x40848e
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
inc eax
push edx
je 0x4084bc
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x4084c7
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.0040848e
push ecx
cmp eax, 0xffffffff
je 0x40851c
test byte [ebp + 0xc], 1
mov esi, eax
mov dword [esp], ebx
je 0x408514
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x40850d
test byte [ebp + 0xc], 4
jne 0x40851c
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x40851c
mov eax, 1
jmp 0x40851e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4084f1
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8

Function at 0x408527
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x408542
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
xor ecx, ecx
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc
Function at 0x40857b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x64
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], 0x73006e
mov dword [ebp - 0xc], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
div ecx
xor eax, eax
add word [ebp - 0xc], dx
mov dword [esp + 8], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
jne 0x4085da
dec esi
jne 0x40858b
mov word [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x4085e5
Capabilities:
Read file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x408622
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x408629
Capabilities:
Write file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x408666
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x40886a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x14]
sub esp, 0x30
mov dword [ebp - 0x10], 0x4000
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
xor eax, eax
cmp dword [ebp + 0x18], 0
setne al
shl eax, 8
or eax, 0x20019
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004087b6
sub esp, 0x10
test eax, eax
je 0x4088b8
mov word [ebx], 0
jmp 0x40890b
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov word [ebx + 0x3ffe], 0
test esi, esi
jne 0x4088b1
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x4088b1
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14
Function at 0x408ec3
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x47fd40
mov dword [esp + 4], eax
call fcn.004089f5
push ebx
push ebx
mov dword [esp], 0x47fd40
call fcn.00408372
push edx
test eax, eax
jne 0x408ef4
xor eax, eax
jmp 0x408f70
mov dword [esp], eax
mov ebx, eax
call fcn.00408ab1
push ecx
test byte [0x42f14c], 0x80
je 0x408f16
mov ax, word [ebx]
test ax, ax
je 0x408ef0
cmp ax, 0x5c
je 0x408ef0
sub ebx, 0x47fd40
sar ebx, 1
mov dword [esp], 0x47fd40
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov dword [esp], 0x47fd40
cmp ebx, eax
jge 0x408f55
call fcn.00408e8b
push edx
test eax, eax
je 0x408f46
test byte [eax], 0x10
je 0x408ef0
mov dword [esp], 0x47fd40
call fcn.00408300
push eax
jmp 0x408f1e
call fcn.00408a29
push eax
mov dword [esp], 0x47fd40
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
push edx
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x408f77
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408fb5
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408fbc
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40d3a0
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4
Function at 0x4099f8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x487da4], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x409a35
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409a20
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409a12
mov dword [ecx*4 + 0x487da0], eax
inc ecx
cmp ecx, 0x100
jne 0x409a0b
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x409a57
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x487da0]
jmp 0x409a3f
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x409900
Capabilities:
Inspect section memory permissions

Disassembly:
call fcn.0040930a
adc byte [ebp - 0x3b], bh
sbb al, 0x8b
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x409940
Function at 0x417e10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x58
mov eax, dword [0x630038]
mov dword [esp + 4], 0
push esi
lea ecx, [eax + eax]
mov eax, dword [0x63003c]
or ecx, eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x60]
fild qword [esp + 4]
test ecx, ecx
fadd qword [0x630050]
fstp qword [0x630050]
je 0x417e63
mov eax, dword [0x6337e0]
test eax, eax
je 0x417e57
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x58
ret 4
mov dl, byte [0x630042]
mov cl, byte [0x630049]
xor cl, dl
mov edx, dword [0x630030]
mov byte [0x630049], cl
mov ecx, dword [0x630034]
and ecx, 4
and eax, 0xc
add edx, ecx
mov esi, dword [0x630038]
mov dword [0x630030], edx
mov edx, dword [0x630048]
and edx, 0xff
push ebp
imul eax, edx
xor esi, eax
push edi
lea eax, [esp + 0x14]
push 0x50
push eax
mov dword [0x630038], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x15]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x63004e]
mov ecx, ebp
and ecx, 3
lea edx, [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov cl, byte [0x630040]
push edx
and cl, al
mov byte [0x630040], cl
mov cl, byte [0x630047]
or cl, 2
shr cl, 1
and ecx, 0xff
mov dword [esp + 0x6c], ecx
fild dword [esp + 0x6c]
fdivr qword [0x630050]
fadd qword [str._np_rt_]
fstp qword [0x6339b0]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6337e0], eax
test eax, eax
pop ebp
je 0x417f88
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov dword [0x6337dc], eax
mov eax, dword [0x6337e0]
push str.DirectSoundEnumerateA
add byte [eax - 1], dl
salc

Function at 0x437ed6
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xc5
call [eax - 0x6331b5f5]
mov edi, ecx
dec edi
dec edx
push 0x71e3ad4c
iretd
invalid
sub al, 0xcf
test eax, 0xfa7927d1
pop ss
push 0xb302435c
loope 0x437f01
add eax, 0xcbb06b2f
sub ch, byte [ecx + 0x7d]
js 0x437e9c
jp 0x437e7d
enter 0xffffffffffff89bc, 0xfffffffffffffffc
invalid
xchg ebx, eax
cmp byte [0x2f81c0e1], al
enter 0x146a, 0xffffffffffffffc5
or dword [edi], esi
sub dword [edi - 0x4c], esp
mov dword [edi - 0x25], ebp
call 0xb91251aa
sub dh, cl
invalid
Function at 0x45ce8b
Capabilities:
Encode data using xor

Disassembly:
fld xword [ebx + ebx*2]
sub ebp, dword [esp + ebp*8]
mov esp, 0xc2ac3c64
xchg bh, dh
loope 0x45ce96
leave
dec ebp
enter 0x4f5b, 0x2c
adc dword [edi], 0x393131db
rcr ecx, cl
mov word [edi], es
jge 0x45ce90
or ebp, dword [eax]
invalid
les ebp, [edx + 0x50655994]
push eax
pushfd
mov dl, 0x6e
cmp byte [eax - 6], ch
cli
or esi, dword [esi + 0x5aa25747]
cmp dh, ah
pop es
wait
push esp
xchg dword [edi + 0x119aa5ef], edx
xor al, 0xe6
inc ebp
xor al, 0x77
je 0x45cea0
xor dword [bp + di + 0x2c0], eax
jge 0x45ce37
cli
add ecx, dword [eax*8 - 0x77375cf4]
dec ecx
push cs
rcl dword [eax - 0x18], 0x26
enter 0x66c0, 0x41
xchg esp, eax
xchg ebx, eax
cmp dl, byte [ebp - 0x69]
inc ebp
mov dword [0x50d5b190], eax
add byte [esi + 0x156bf50a], al
inc edi
retf

Function at 0x6295e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303b8
cmp edx, dword [eax]
je 0x629607
add eax, 8
inc ecx
cmp eax, 0x630448
jl 0x6295f8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303b8]
jne 0x629735
mov eax, dword [0x636d50]
cmp eax, 1
je 0x62970f
test eax, eax
jne 0x629638
cmp dword [0x6302e0], 1
je 0x62970f
cmp edx, 0xfc
je 0x629735
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62966f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629fd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a460
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6296b2
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a460
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62e63c
push edi
call fcn.0062c330
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629fd0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629fe0
lea eax, [ebp - 0xa0]
push 0x62e61c
push eax
call fcn.00629fe0
push dword [esi + 0x6303bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629fe0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c2a4
add esp, 0x2c
pop edi
jmp 0x629735
lea eax, [ebp + 8]
lea esi, [esi + 0x6303bc]
push 0
push eax
push dword [esi]
call fcn.0062a460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4043c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x4044ac
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4044ac
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x40440a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404411
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4043f0
jmp 0x404413
mov esi, 0x1505
jmp 0x404413
mov esi, ecx
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 0x20]
lea edi, [ecx - 1]
mov dword [esp + 8], ecx
sub ecx, 1
mov dword [esp + 0xc], ecx
jb 0x4044ac
and edi, esi
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
xor ebp, ebp
jmp 0x404447
inc ebp
cmp dword [esp + 8], ebp
je 0x4044aa
mov eax, ebp
xor eax, edi
mov ecx, ebp
and ecx, edi
lea eax, [eax + ecx*2]
and eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0xffffffff
je 0x4044aa
mov eax, dword [edx + 8]
cmp dword [eax + ebx*4], esi
jne 0x404440
mov eax, dword [edx + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [esp], eax
push eax
call fcn.0040c620
mov edx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x404440
push dword [esp + 0x2c]
push dword [esp + 4]
push dword [esp + 0x30]
call fcn.0040c640
mov edx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404440
mov eax, dword [edx + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x4044ac
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret