joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push esi
mov ebx, ebx
mov eax, eax
mov ebx, ebx
push 0x40
push 0x3000
push 3
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40104e
push 0x4013a0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Memory_allocation_failed.
call fcn.00401180
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 3
mov word [esi], 0xd801
push 2
mov byte [esi + 2], 0xc3
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 8
mov edx, str.Result:
push 0x4013a0
push eax
call fcn.00401180
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x28
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ebx, ebx
mov eax, eax
mov ebx, ebx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401c00
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401c3f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401c3f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401c3f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401c3f
cmp dword [ecx + 0x74], 0xe
jbe 0x401c3f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401130
Capabilities:
Generate random numbers via winapi
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9cc
call fcn.0041a470
mov eax, dword [0x424040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x3a9a4], 0
push eax
push eax
push eax
mov word [ebp - 0x3a990], ax
lea eax, [ebp - 0x3a9a0]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a4]
mov dword [ebp - 0x3a9a0], 0x10001
push eax
mov dword [ebp - 0x3a99c], 0x1f40
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
add esp, 0xc
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
xor ebx, ebx
mov dword [ebp - 0x3a9c8], ebx
nop dword [eax + eax]
mov eax, dword [0x42471c]
test eax, eax
jne 0x4011f6
push 0xf0000040
push 1
push eax
push eax
push 0x42471c
call esi
test eax, eax
je 0x401309
mov eax, dword [0x42471c]
lea ecx, [ebp - 0x3a98c]
push ecx
push 4
push eax
call edi
mov edx, dword [ebp - 0x3a9c8]
mov eax, edx
shr ebx, 6
mov ch, bl
shr eax, 4
and ch, dl
add ch, dl
shr edx, 8
and ch, al
mov al, byte [ebp - 0x3a9c8]
mov cl, al
add al, al
add cl, al
add cl, cl
and dl, cl
mov cl, byte [ebp - 0x3a98c]
and dl, bl
mov ebx, dword [ebp - 0x3a9c8]
mov eax, ebx
xor ch, dl
shr eax, cl
or ch, al
mov byte [ebp + ebx - 0x3a988], ch
inc ebx
mov dword [ebp - 0x3a9c8], ebx
cmp ebx, 0x3a980
jb 0x4011d0
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9c0], 0x3a980
mov dword [ebp - 0x3a9c4], eax
lea eax, [ebp - 0x3a9c4]
push 0x20
push eax
push dword [ebp - 0x3a9a4]
mov dword [ebp - 0x3a9bc], 0
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c4]
push eax
push dword [ebp - 0x3a9a4]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c4]
push eax
push dword [ebp - 0x3a9a4]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a4]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004194ef
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4014a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.0041a470
mov eax, dword [0x424040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ebx, ebx
lea esi, [ebx + 4]
nop dword [eax + eax]
mov eax, 0xa0a0a0a1
mov ecx, 0x13
mul ebx
shr edx, 5
imul eax, edx, 0x33
cmp ebx, eax
mov eax, ebx
cmovne ecx, esi
shr eax, 4
and cl, al
mov eax, ebx
shr eax, 1
and cl, al
movsx eax, bl
inc cl
movsx ecx, cl
imul ecx, eax
mov eax, ebx
shr eax, 0xb
xor al, bl
add cl, al
mov byte [ebp + ebx - 0x3a988], cl
inc ebx
cmp ebx, 0x3a980
jb 0x401530
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004194ef
mov esp, ebp
pop ebp
ret
Function at 0x401630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xea644
call fcn.0041a470
mov eax, dword [0x424040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xea620], 0
push eax
push eax
push eax
mov word [ebp - 0xea60c], ax
mov ebx, 1
lea eax, [ebp - 0xea61c]
mov dword [ebp - 0xea61c], 0x10001
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xea620]
mov dword [ebp - 0xea618], 0x7d00
push eax
mov dword [ebp - 0xea614], 0x7d00
mov dword [ebp - 0xea610], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xea600
lea eax, [ebp - 0xea608]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
add esp, 0xc
mov dword [ebp - 0xea644], edx
xor edi, edi
mov ecx, edx
mov eax, edx
shr eax, 0xc
mov esi, ebx
shr ecx, 0x15
and ecx, eax
mov bl, byte [ebp - 0xea644]
mov eax, edx
and ecx, 1
shr eax, 0xb
xor edx, edx
shl esi, cl
div esi
mov ecx, edx
mov edx, dword [ebp - 0xea644]
shl bl, cl
mov eax, edx
mov ecx, edi
add edi, 7
shr eax, cl
shr eax, 7
xor bl, al
mov byte [ebp + edx - 0xea608], bl
inc edx
mov dword [ebp - 0xea644], edx
mov ebx, 1
cmp edi, 0x668a00
jb 0x4016c3
lea eax, [ebp - 0xea608]
mov dword [ebp - 0xea63c], 0xea600
mov dword [ebp - 0xea640], eax
lea eax, [ebp - 0xea640]
push 0x20
push eax
push dword [ebp - 0xea620]
mov dword [ebp - 0xea638], 0
mov dword [ebp - 0xea634], 0
mov dword [ebp - 0xea630], 0
mov dword [ebp - 0xea62c], 0
mov dword [ebp - 0xea628], 0
mov dword [ebp - 0xea624], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004194ef
mov esp, ebp
pop ebp
ret
Function at 0x401b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x3a9c4
call fcn.0041a470
mov eax, dword [0x424040]
xor eax, esp
mov dword [esp + 0x3a9c0], eax
push esi
xor eax, eax
mov dword [esp + 8], 0
push eax
push eax
push eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x38]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1c]
mov dword [esp + 0x40], 0x10001
push eax
mov dword [esp + 0x48], 0x1f40
mov dword [esp + 0x4c], 0x1f40
mov dword [esp + 0x50], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [esp + 0x44]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movsd xmm0, qword [0x41ff38]
add esp, 0xc
xor esi, esi
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_cos_precise
movsd xmm2, qword [0x41ff20]
movaps xmm1, xmm0
mov ecx, esi
lea eax, [esi + esi*4]
shr ecx, 7
add eax, eax
xor ecx, eax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x420370]
mulsd xmm0, xmm1
mulsd xmm0, xmm2
cvttsd2si eax, xmm0
mov byte [esp + esi + 0x40], al
inc esi
cmp esi, 0x3a980
jb 0x401be1
lea eax, [esp + 0x40]
mov dword [esp + 0x10], 0x3a980
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 0x20
push eax
push dword [esp + 0x10]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [esp + 8]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [esp + 0x3a9c4]
pop esi
xor ecx, esp
call fcn.004194ef
mov esp, ebp
pop ebp
ret
Function at 0x401cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c8
call fcn.0041a470
mov eax, dword [0x424040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x3a9c4], edx
lea esi, [edx + 7]
nop
mov eax, edx
mov ecx, edx
shr eax, 0x10
mov bl, 1
shr ecx, 8
add eax, ecx
mov ecx, edx
shr ecx, 0xb
xor edx, edx
xor eax, ecx
inc eax
div esi
mov ecx, edx
mov edx, dword [ebp - 0x3a9c4]
shl bl, cl
movsx eax, dl
movsx ecx, bl
imul ecx, eax
movsx eax, dl
imul eax, eax, 0xb
add al, 0x2d
xor cl, al
mov byte [ebp + edx - 0x3a988], cl
inc edx
mov dword [ebp - 0x3a9c4], edx
cmp edx, 0x3a980
jb 0x401d40
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004194ef
mov esp, ebp
pop ebp
ret
Function at 0x4020f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c4
call fcn.0041a470
mov eax, dword [0x424040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov eax, ecx
lea esi, [ecx - 0x58b]
or eax, 0x16800
xor esi, ecx
shr eax, 0xb
xor edx, edx
div esi
movsx edx, cl
add eax, ecx
shr eax, 0xc
and al, cl
movsx eax, al
imul eax, edx
mov byte [ebp + ecx - 0x3a988], al
inc ecx
cmp ecx, 0x3a980
jb 0x402180
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004194ef
mov esp, ebp
pop ebp
ret
Function at 0x402450
Capabilities:
Generate random numbers via winapi
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9cc
call fcn.0041a470
mov eax, dword [0x424040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x3a9a4], 0
push eax
push eax
push eax
mov word [ebp - 0x3a990], ax
lea eax, [ebp - 0x3a9a0]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a4]
mov dword [ebp - 0x3a9a0], 0x10001
push eax
mov dword [ebp - 0x3a99c], 0x1f40
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
add esp, 0xc
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov dword [ebp - 0x3a9c8], 0
nop word [eax + eax]
mov eax, dword [0x42471c]
test eax, eax
jne 0x402516
push 0xf0000040
push 1
push eax
push eax
push 0x42471c
call esi
test eax, eax
je 0x40262a
mov eax, dword [0x42471c]
lea ecx, [ebp - 0x3a98c]
push ecx
push 4
push eax
call edi
mov eax, dword [ebp - 0x3a9c8]
mov ecx, eax
mov ebx, dword [ebp - 0x3a98c]
shr ecx, 0xd
and ebx, 0x7fffffff
and cl, 0x37
movsx eax, al
movsx ecx, cl
imul ecx, eax
mov eax, 0x4ec4ec4f
mul ebx
and cl, 0x63
shr edx, 2
movsx eax, dl
mov edx, dword [ebp - 0x3a9c8]
imul eax, eax, 0xd
sub cl, al
add cl, bl
mov byte [ebp + edx - 0x3a988], cl
inc edx
mov dword [ebp - 0x3a9c8], edx
cmp edx, 0x3a980
jb 0x4024f0
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9c0], 0x3a980
mov dword [ebp - 0x3a9c4], eax
lea eax, [ebp - 0x3a9c4]
push 0x20
push eax
push dword [ebp - 0x3a9a4]
mov dword [ebp - 0x3a9bc], 0
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c4]
push eax
push dword [ebp - 0x3a9a4]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c4]
push eax
push dword [ebp - 0x3a9a4]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a4]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004194ef
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.0041a470
mov eax, dword [0x424040]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
cmp dword [0x4246dc], 6
jl 0x402e70
movaps xmm5, xmmword [0x4201c0]
xor ecx, ecx
movaps xmm6, xmmword [0x420250]
movaps xmm7, xmmword [0x420210]
movups xmm4, xmmword [0x420190]
lea eax, [ecx + 4]
movd xmm0, ecx
add ecx, 8
pshufd xmm2, xmm0, 0
movaps xmm0, xmm6
paddd xmm2, xmm5
andps xmm0, xmm2
movaps xmm3, xmm2
xorps xmm0, xmm7
vpsrlvd xmm0, xmm2, xmm0
pshufb xmm0, xmm4
psrld xmm2, 1
andnps xmm0, xmmword [0x4203b0]
pshufb xmm3, xmm4
pshufb xmm2, xmm4
andps xmm0, xmm3
vpmovzxbw ymm1, xmm0
vpmovzxbw ymm0, xmm2
vpmullw ymm0, ymm1, ymm0
vpmovzxwd zmm0, ymm0
vpmovdb xmm0, zmm0
orps xmm0, xmm3
movd dword [ebp + eax - 0x3a98c], xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm0, xmm2
movaps xmm3, xmm2
andps xmm0, xmm6
xorps xmm0, xmm7
vpsrlvd xmm0, xmm2, xmm0
pshufb xmm0, xmm4
pshufb xmm3, xmm4
andnps xmm0, xmmword [0x4203b0]
andps xmm0, xmm3
psrld xmm2, 1
vpmovzxbw ymm1, xmm0
pshufb xmm2, xmm4
vpmovzxbw ymm0, xmm2
vpmullw ymm0, ymm1, ymm0
vpmovzxwd zmm0, ymm0
vpmovdb xmm0, zmm0
orps xmm0, xmm3
movd dword [ebp + eax - 0x3a988], xmm0
add eax, 8
cmp eax, 0x3a984
jb 0x402d91
jmp 0x402ea1
mov ecx, eax
mov edx, eax
and ecx, 0xa7
xor ecx, 0xc
shr edx, cl
mov ecx, eax
not dl
shr ecx, 1
and dl, al
movsx ecx, cl
movsx edx, dl
imul edx, ecx
or dl, al
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x402e70
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004194ef
mov esp, ebp
pop ebp
ret
Function at 0x403d30
Capabilities:
Generate random numbers via winapi
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c4
call fcn.0041a470
mov eax, dword [0x424040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x3a9a4], 0
push eax
push eax
push eax
mov word [ebp - 0x3a990], ax
lea eax, [ebp - 0x3a9a0]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a4]
mov dword [ebp - 0x3a9a0], 0x10001
push eax
mov dword [ebp - 0x3a99c], 0x1f40
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
add esp, 0xc
xor esi, esi
nop dword [eax]
mov eax, dword [0x42471c]
test eax, eax
jne 0x403de6
push 0xf0000040
push 1
push eax
push eax
push 0x42471c
call edi
test eax, eax
je 0x403ee6
mov eax, dword [0x42471c]
lea ecx, [ebp - 0x3a98c]
push ecx
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ecx, esi
shr ecx, 1
and ecx, 1
lea eax, [ecx + 1]
lea eax, [eax + eax*2]
add eax, eax
lea ebx, [ecx + 1]
lea ebx, [ebx + ebx*4]
test esi, 0x4000
cmovne ebx, eax
mov eax, esi
imul ebx, esi
shr ebx, cl
mov ecx, dword [ebp - 0x3a98c]
and ecx, 0xf
shr eax, cl
or bl, al
mov byte [ebp + esi - 0x3a988], bl
inc esi
cmp esi, 0x3a980
jb 0x403dc0
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9c0], 0x3a980
mov dword [ebp - 0x3a9c4], eax
lea eax, [ebp - 0x3a9c4]
push 0x20
push eax
push dword [ebp - 0x3a9a4]
mov dword [ebp - 0x3a9bc], 0
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c4]
push eax
push dword [ebp - 0x3a9a4]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c4]
push eax
push dword [ebp - 0x3a9a4]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a4]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004194ef
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403ef0
Capabilities:
Generate random numbers via winapi
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9cc
call fcn.0041a470
mov eax, dword [0x424040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x3a9a8], 0
push eax
push eax
push eax
mov word [ebp - 0x3a994], ax
lea eax, [ebp - 0x3a9a4]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a8]
mov dword [ebp - 0x3a9a4], 0x10001
push eax
mov dword [ebp - 0x3a9a0], 0x1f40
mov dword [ebp - 0x3a99c], 0x1f40
mov dword [ebp - 0x3a998], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
add esp, 0xc
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov dword [ebp - 0x3a9cc], 0
nop word [eax + eax]
mov eax, dword [0x42471c]
test eax, eax
jne 0x403fb6
push 0xf0000040
push 1
push eax
push eax
push 0x42471c
call esi
test eax, eax
je 0x4040e4
mov eax, dword [0x42471c]
lea ecx, [ebp - 0x3a98c]
push ecx
push 4
push eax
call edi
mov ebx, dword [ebp - 0x3a98c]
mov eax, dword [0x42471c]
and ebx, 0x7fffffff
test eax, eax
jne 0x403ff4
push 0xf0000040
push 1
push eax
push eax
push 0x42471c
call esi
test eax, eax
je 0x4040e4
mov eax, dword [0x42471c]
lea ecx, [ebp - 0x3a990]
push ecx
push 4
push eax
call edi
mov edx, dword [ebp - 0x3a9cc]
movsx eax, bl
movsx ecx, dl
imul ecx, eax
movsx eax, byte [ebp - 0x3a990]
movsx ecx, cl
imul ecx, eax
mov byte [ebp + edx - 0x3a988], cl
inc edx
mov dword [ebp - 0x3a9cc], edx
cmp edx, 0x3a980
jb 0x403f90
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9c4], 0x3a980
mov dword [ebp - 0x3a9c8], eax
lea eax, [ebp - 0x3a9c8]
push 0x20
push eax
push dword [ebp - 0x3a9a8]
mov dword [ebp - 0x3a9c0], 0
mov dword [ebp - 0x3a9bc], 0
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c8]
push eax
push dword [ebp - 0x3a9a8]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c8]
push eax
push dword [ebp - 0x3a9a8]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a8]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004194ef
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]