joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4207f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x420812
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x420819
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x420808
mov eax, 1
add ebx, ebx
jne 0x42082b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42083c
jne 0x42084c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42084c
dec eax
add ebx, ebx
jne 0x420848
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x420820
xor ecx, ecx
sub eax, 3
jb 0x420864
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4208d6
sar eax, 1
mov ebp, eax
jmp 0x42086f
add ebx, ebx
jne 0x42086f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42087c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4208a0
inc ecx
add ebx, ebx
jne 0x42088c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x420881
jne 0x42089d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x420881
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4208c0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4208b1
jmp 0x42080e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4208c0
add edi, ecx
jmp 0x42080e
pop esi
mov edi, esi
mov ecx, 0x810
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4208de
cmp byte [edi], 0xd
jne 0x4208de
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4208e3
lea edi, [esi + 0x1e000]
mov eax, dword [edi]
or eax, eax
je 0x42095b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x218e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2199c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x420910
mov ecx, edi
jns 0x42093f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x219a0]
or eax, eax
je 0x420955
mov dword [ebx], eax
add ebx, 4
jmp 0x42092d
call dword [esi + 0x219a4]
popal
jmp section.UPX0
Function at 0x41cbd3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041420e
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x41cc0b
xor eax, eax
jmp 0x41cc37
cmp esi, dword [ebp - 4]
je 0x41cc34
cmp dword [ebp + 0xc], 0
je 0x41cc34
push dword [edi + 0x9c]
call fcn.0041c7e1
push dword [edi + 0x9c]
mov esi, eax
call fcn.0040f117
pop ecx
pop ecx
cmp esi, eax
je 0x41cc07
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3a945b14
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x247a4656
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x45663b
Capabilities:
Encode data using xor

Disassembly:
and al, 0xfd
push edx
invalid
mov esp, 0x9d7c86bc
push ds
or bl, byte [ebp - 0x74]
inc eax
jl 0x456683
pushfd
outsb dx, byte [esi]
xor dword [esi - 0x3d], esp
inc ebx
sti
push ecx
pop ecx
xor ah, cl
loope 0x456650
jae 0x456614
or al, 0x61
invalid
mov cl, 0x33
dec ebp
mov esp, 0xff15bd58
sbb cl, byte [ecx + 0x5c]
push esi
call [edi + 0x6fdc6be1]
wait
or al, 0x9f
in al, dx
inc ebx
in al, 0xa0
fisttp dword [edi - 0x32]
shl dword [eax + 0x3ded2be2], 0xbb
push ebx
cld
cmp ebx, dword [edi + eax*2 + 0x3a]
outsb dx, byte [esi]
sbb al, 0x54
call 0xda52634b
imul edx, dword [ecx - 0x1d], 0x8c6de83c
pushfd
les ecx, [esi + 0xaccb4c3]
push es
xor dword [eax + edx*4 - 0x89fedf2], edi
sar bh, cl
or al, 0xb9
push esi
or ch, byte [eax + 0x532a9dec]
push edi
popal
ret 0xaf67

Function at 0x5bffb3
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor eax, 0x50ae97b4
mov bl, 0xd2
jne 0x5bff59
retf 0x4ec

Function at 0x60aa43
Capabilities:
Encode data using xor

Disassembly:
xor byte cs:[edi - 0x48f1f72], 0x28
mov esi, 0x45cce179
invalid

Function at 0x65793d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f398
cmp edx, dword [eax]
je 0x65795f
add eax, 8
inc ecx
cmp eax, 0x65f428
jl 0x657950
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f398]
jne 0x657a8d
mov eax, dword [0xa5bcf4]
cmp eax, 1
je 0x657a67
test eax, eax
jne 0x657990
cmp dword [0x65f2c4], 1
je 0x657a67
cmp edx, 0xfc
je 0x657a8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6579c7
lea eax, [ebp - 0x1a4]
push 0x65c9e0
push eax
call fcn.00658320
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006587b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657a0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.006587b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65c9dc
push edi
call fcn.0065a680
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65c9c0
push eax
call fcn.00658320
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658330
lea eax, [ebp - 0xa0]
push 0x65c9bc
push eax
call fcn.00658330
push dword [esi + 0x65f39c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658330
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65c994
push eax
call fcn.0065a5f4
add esp, 0x2c
pop edi
jmp 0x657a8d
lea eax, [ebp + 8]
lea esi, [esi + 0x65f39c]
push 0
push eax
push dword [esi]
call fcn.006587b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x417d5f
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xb287559b], al
and al, 0x7d
sbb esi, dword [ebp + 0x5a]
jne 0x417da3
arpl word [ecx], bp
mov byte [0x75d6f62b], al
jne 0x417d11
push ss
fimul word [ecx + 0x5d67f94b]
pop ebp
inc eax
cmpsb byte [esi], byte es:[edi]
inc edx
call 0x5835aae9
push edi
mov al, 0x8d
adc byte [eax + ebx + 0x4c], dh
and dword [ebp + 0x24e2660a], esp
adc al, 0x48

Function at 0x4bbef5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33a8
cmp edx, dword [eax]
je 0x4bbf17
add eax, 8
inc ecx
cmp eax, 0x4c3438
jl 0x4bbf08
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33a8]
jne 0x4bc045
mov eax, dword [0x4c8dd0]
cmp eax, 1
je 0x4bc01f
test eax, eax
jne 0x4bbf48
cmp dword [0x4c32d4], 1
je 0x4bc01f
cmp edx, 0xfc
je 0x4bc045
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bbf7f
lea eax, [ebp - 0x1a4]
push 0x4c16c8
push eax
call fcn.004bc8e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bcd70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bbfc2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bcd70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c16c4
push edi
call fcn.004bec40
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c16a8
push eax
call fcn.004bc8e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc8f0
lea eax, [ebp - 0xa0]
push 0x4c16a4
push eax
call fcn.004bc8f0
push dword [esi + 0x4c33ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc8f0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c167c
push eax
call fcn.004bebb4
add esp, 0x2c
pop edi
jmp 0x4bc045
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33ac]
push 0
push eax
push dword [esi]
call fcn.004bcd70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4019f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019ff
push esp
mov dword [ebp - 0x24], 0x40171b
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a9e
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a7f
pop ebp
ret 0x10
Function at 0x1e7a4c0e
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi

Function at 0x1e7a4eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
div ecx
test edx, edx
je 0x1e7a4ebc
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1e7a4bce
mov eax, dword [0x8de7abb1]
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x1e7a4fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub dh, al
inc ebp
lcall 0xc635, 0x9b45c633
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a4bde
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a4b93
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a4bde
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a4b93
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a4bce
sbb byte [edx - 0x627706e1], cl
jl 0x1e7a5053
invalid
invalid
Function at 0x1e7a52c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a52a5
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a52c3
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a5321
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a5308
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a5311
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a531b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a52fd
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a5287
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
add al, 7
sub eax, ecx
je 0x1e7a536e
dec eax
je 0x1e7a5365
sub eax, 3
je 0x1e7a535c
mov dword [ebp - 4], 0x40
jmp 0x1e7a538b
mov dword [ebp - 4], 4
jmp 0x1e7a5371
mov dword [ebp - 4], 0x20
jmp 0x1e7a5371
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1e7a53bd
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1e7a533d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1e7a4bce
jno 0x1e7a5345
sub ecx, ebp
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x1e7a53c9
push 0x8000
push ebx
push esi
call dword [ebp - 8]

Function at 0x1e7a5aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1e7a4bac
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
invalid
movsd dword es:[edi], dword [esi]
Function at 0x403a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406a80
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov ecx, edx
movsx eax, dl
shr ecx, 6
movsx ecx, cl
imul ecx, eax
mov eax, edx
shr eax, 8
and cl, al
mov al, dl
add al, al
xor cl, al
mov eax, edx
shr eax, 3
or cl, al
mov byte [ebp + edx - 0x3a988], cl
inc edx
cmp edx, 0x3a980
jb 0x403ad3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405e70
mov esp, ebp
pop ebp
ret
Function at 0x403fe0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa1844
call fcn.00406a80
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xa1820], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1820]
mov dword [ebp - 0xa181c], 0x10001
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ebx, ebx
mov ecx, ebx
mov al, bl
shr ecx, 9
mov edx, ebx
and al, cl
shr edx, 7
or dl, cl
and al, 0x10
movsx eax, al
movsx ecx, dl
mov dl, 1
imul ecx, eax
movsx eax, bl
sub dl, cl
movsx ecx, dl
imul ecx, eax
mov eax, ebx
shr eax, 6
xor al, bl
add cl, al
mov byte [ebp + ebx - 0xa1808], cl
inc ebx
cmp ebx, 0xa17fc
jb 0x404064
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa183c], 0xa17fc
mov dword [ebp - 0xa1840], eax
lea eax, [ebp - 0xa1840]
push 0x20
push eax
push dword [ebp - 0xa1820]
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
mov dword [ebp - 0xa1828], 0
mov dword [ebp - 0xa1824], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405e70
mov esp, ebp
pop ebp
ret
Function at 0x404470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14303c
call fcn.00406a80
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x143018], 0
push eax
push eax
push eax
mov word [ebp - 0x143004], ax
lea eax, [ebp - 0x143014]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x143018]
mov dword [ebp - 0x143014], 0x10001
push eax
mov dword [ebp - 0x143010], 0xac44
mov dword [ebp - 0x14300c], 0xac44
mov dword [ebp - 0x143008], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x142ff8
lea eax, [ebp - 0x143000]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x14301c], ecx
nop word [eax + eax]
mov ebx, ecx
mov edx, 0x234568a0
shr ecx, 8
and ecx, 0x1c
shr ebx, 1
sar edx, cl
mov ecx, dword [ebp - 0x14301c]
and dl, 0xf
shr ecx, 0xb
movsx eax, bl
movsx edx, dl
imul edx, eax
shr ebx, cl
mov ecx, dword [ebp - 0x14301c]
mov eax, ecx
shr eax, 0xc
xor bl, al
mov eax, ecx
shr eax, 4
or dl, bl
and al, cl
and al, 0x18
add dl, al
mov byte [ebp + ecx - 0x143000], dl
inc ecx
mov dword [ebp - 0x14301c], ecx
cmp ecx, 0x142ff8
jb 0x404500
lea eax, [ebp - 0x143000]
mov dword [ebp - 0x143038], 0x142ff8
mov dword [ebp - 0x14303c], eax
lea eax, [ebp - 0x14303c]
push 0x20
push eax
push dword [ebp - 0x143018]
mov dword [ebp - 0x143034], 0
mov dword [ebp - 0x143030], 0
mov dword [ebp - 0x14302c], 0
mov dword [ebp - 0x143028], 0
mov dword [ebp - 0x143024], 0
mov dword [ebp - 0x143020], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x14303c]
push eax
push dword [ebp - 0x143018]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x14303c]
push eax
push dword [ebp - 0x143018]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x143018]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405e70
mov esp, ebp
pop ebp
ret
Function at 0x404ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c44
call fcn.00406a80
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ebx, ebx
mov eax, ebx
lea ecx, [ebx - 0xa]
or eax, 0xc8000
xor ecx, ebx
shr eax, 0xc
xor edx, edx
div ecx
mov ecx, ebx
add eax, ebx
shr ecx, 9
shr eax, 0xa
and al, cl
movsx ecx, bl
xor al, bl
inc al
movsx eax, al
imul eax, ecx
mov byte [ebp + ebx - 0x50c08], al
inc ebx
cmp ebx, 0x50bfe
jb 0x404b64
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405e70
mov esp, ebp
pop ebp
ret