joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov esi, dword [eax + eax + 0x5653f8c4]
push edi
mov dword [ebp], ecx
add dword [ebp - 4], edx
mov edi, eax
mov ebp, dword [ecx]
add byte [ebp - 0x1e7bf00a], al
add byte [eax], al
add byte [ecx], al
inc ebp
clc
movzx edx, byte [eax]
inc dword [eax]
stc
cmp edx, 0xf
ja 0x418ab6
movzx edx, byte [edx + 0xc448]
jmp dword [edx*4 + 0x40dd58]
fdiv qword [esp + esi*8 + 0x195fc15b]
pop ebp
outsd dx, dword [esi]
mov ebp, edx
jle 0x418af8
outsb dx, byte [esi]
fst dword [0xe6475b04]
scasd eax, dword es:[edi]
adc bh, 0x54
add dword [ecx + 0x35c5b92f], edi
aam 0x5f
aam 0x21
aad 0x44
movsb byte es:[edi], byte [esi]
sbb al, 0x25
push esi
sbb ch, byte [edi + 0x6d]
xor eax, 0xe438b369
in al, dx
jno 0x418b25
mov al, 0xd4
je 0x418b42
mov dl, 0x9e
mov edx, esi
hlt
xchg ecx, eax
or esi, dword [esi + edi*2]
lcall 0x9736, 0xbad4b40
adc eax, 0x6504a74b
xor al, 0x74
popfd
push 0xffffffffffffffb1
jl 0x418b25
popfd
pop ebx
das
cmp eax, 0x34c89482
out dx, eax
xchg esp, eax
enter 0xffffffffffffef34, 0xffffffffffffffb7
jge 0x418b7e
xor al, 0xef
mov bh, 0x7d
bound esi, qword [ecx + 0x38e7ec95]
mov cl, 0x95
in al, dx
out 0x38, eax
loopne 0x418b17
int1
and byte [ecx + ecx*8 - 0x4fa5db00], dl
add bl, dh
retf
xchg esp, eax
leave
add byte [0x265b05a], ah
fmulp st(3)
push eax
fsin
movsb byte es:[edi], byte [esi]
jno 0x418b93
sub esi, dword [edi + 0x49]
movsb byte es:[edi], byte [esi]
invalid
and al, 0xd9
inc esp
dec eax
insd dword es:[edi], dx
sub dword [ebx + 0x732ef403], 0xffffffc4
test dword [esi + ebp*2], 0x99d4fc76
add al, 0x6e
jbe 0x418b4f
aam 0x99
mov eax, dword [0xdb68c677]
std
cmpsd dword [esi], dword es:[edi]
les esp, [eax + edx*8 + 0x6604da7c]
sbb ch, byte [ebx + 0x51]
aam 0xb4
xchg ebp, eax
add eax, 0xf13d6474
add al, 0xaa
sahf
mov ah, 0xd2
dec edi
add bl, ah
nop
in eax, 0x1b
invalid
daa
sub eax, dword [ebp + 0x5a]
dec byte [eax - 0x7c]
jbe 0x418bf1
movsb byte es:[edi], byte [esi]
mov ah, 0x55
jns 0x418b15
mov ebx, 0x4452bcf9
mov eax, 0xc71faf28
invalid
sub byte [edi - 0x513838e1], ch
int1
dec ecx
sar dword [edi], 1
enter 0x14a3, 0x31
jp 0x418b63
pop ebp
push cs
add eax, 0x887518c4
jae 0x418b51
test byte [esi + esi*4 - 0x31], cl
aam 0x44
push cs
loopne 0x418b8a
jbe 0x418bdc
dec edi
add dl, byte [esp + eax - 1]
wait
inc esi
sub byte [eax + 0x5ba5e422], bh
imul edx, esp, 0xf1d4eec9
into
adc al, 0x81
cmp cl, byte [ebx - 0x5b36db1f]
cmp ecx, dword [esp + edx - 0x4737aabd]
and eax, 0x9a78eed0
scasd eax, dword es:[edi]
jl 0x418bb8
add al, 0x22
aam 0x44
xchg ebp, eax
and byte [ecx], ch
sub dword [edx + 8], edx
add eax, 0x819f99c9
clc
or esp, dword [ecx]
hlt
lahf
cmp eax, 0x40f4210b
pop eax
mov dword [0x5940f5ea], eax
sub cl, bh
hlt
Function at 0x413d7c
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xd5
test byte [ecx + 0x56559d74], ah
aas
popfd
add al, 0xc8
or al, 0x42
jbe 0x413daf
add eax, 0x87003728
in al, 0x43
pop es
call 0x765b24d5
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
or ecx, dword [edx - 0x5b3d318f]
and dword [eax + 0x1c5e2bd1], ebp
cli
in al, 0xe4
scasb al, byte es:[edi]
sub eax, 0x117de342
adc dword [edi], ebp
das
xor al, 0xa5
pop ss
xchg ebp, eax
xchg byte [ebx], ah
movsb byte es:[edi], byte [esi]
shl dword [esp + ebp*4 - 0x4a001911], 0x25
cmp al, 0x30
insb byte es:[edi], dx
mov edx, dword [ebp + 0x2e]
jo 0x413db0
mov ch, 0xf4
or ebx, esi
popfd
and dl, byte [edx]
stosb byte es:[edi], al
add bh, cl
pushfd
push ds
push cs
push 0x40
push ebx
mov ebx, 0x6cce2479
daa
jb 0x413dd3
add dword [eax + ebx*8], edx
fsubr dword [esp - 0x154a89b6]
aaa
xchg ebp, eax
cld
in al, 0x6c
mov edx, 0xa1293142
cwde
xor eax, 0x2da18454
mov ch, 0xf6
mov al, byte [0x93cb9a99]
invalid

Function at 0x44140d
Capabilities:
Encode data using xor

Disassembly:
sub byte [eax + 3], dl
and al, 4
out 0x10, eax
mov eax, dword [0x41e2a397]
push edi
invalid

Function at 0x44b6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov cl, byte [0x65f042]
mov al, byte [0x65f041]
or cl, 0x10
push ebx
shr cl, 3
and ecx, 0xff
mov bl, byte [0x65f04b]
mov dword [esp + 4], ecx
add al, 0x32
fcomp st(3)
inc esp
and al, 4
mov byte [0x65f04b], bl
mov ebx, dword [esp + 0x10]
test ebx, ebx
fdivr qword [0x6629b0]
push esi
fadd qword [0x65f058]
fstp qword [0x662a20]
je 0x44b793
call fcn.0044b610
push 0x65f0ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [0x65f030]
mov ecx, dword [0x65f034]
mov esi, eax
mov dword [esp + 0xc], 0
lea eax, [edx + edx]
or eax, ecx
mov dword [esp + 8], eax
fild qword [esp + 8]
test esi, esi
fadd qword [0x65f058]
fstp qword [0x65f058]
je 0x44b793
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x65f088
push esi
call edi
push 0x65f064
push esi
call edi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x44b793
lea ecx, [esp + 0x14]
inc eax
add ecx, 4
cmp eax, 0x36
jae 0x44b79d
cmp dword [ecx], 0
jne 0x44b785
pop esi
xor al, al
pop ebx
add esp, 8
ret 4
mov dword [ebx], esi
pop esi
mov al, 1
pop ebx
add esp, 8
ret 4
Function at 0x49dab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov esi, dword [eax + eax + 0x5653f8c4]
push edi
mov dword [ebp], ecx
add dword [ebp - 4], edx
mov edi, eax
mov ebp, dword [ecx]
add byte [ebp - 0x1e7bf00a], al
add byte [eax], al
add byte [ecx], al
inc ebp
clc
movzx edx, byte [eax]
inc dword [eax]
stc
cmp edx, 0xf
ja 0x4adba6
movzx edx, byte [edx + 0xc448]
jmp dword [edx*4 + 0x40dd58]
mov esi, 0x80407960
add eax, 0xe84917f
push edx
xchg ebx, eax
retf
push esi
dec edi
sub eax, 0x1e5bfdec
sbb dword [0x122792c1], eax
mov ah, 0x65
pop ds
loopne 0x4adc0c
mov dl, 0x81
mov byte [0x984092f0], al
inc eax
cwde
jecxz 0x4adb7a
iretd
push eax
mov dword [0x6f819052], edx
fsubr dword [ebp + 0x66]
mov ss, ebp
xchg ecx, eax
mov byte [0x779e1565], al
xor dh, ch
adc eax, 0xee30779e
mov dl, byte [edx + 0x65]
stosb byte es:[edi], al
and dword [eax], edi
add al, 0x78
jl 0x4adbfd
fidiv word [ecx - 0x2d]
sar byte [ecx - 0x1e], 0x3d
and ah, 0x17
mov ecx, 0xc8cfa4bc
and byte [esi - 0x3a], bh
dec esi
adc byte [eax], dl
mov dl, 0x71
mov byte [ebx + eax*4], dh
jg 0x4adbbd
leave
movsb byte es:[edi], byte [esi]
les esi, [edx - 0x60]
bound ebp, qword [esi]
push ecx
inc edi
mul byte [edi + 0x4ac20faf]
ror byte gs:[edi + 0x353a05ef], 0x4d
ror byte [edi + 0x353a05ef], 0x4d
loope 0x4adc47
int1
imul edx, dword [ebx + 0x7c], 0xbbb6ac82
cmpsb byte [esi], byte es:[edi]
jo 0x4adbfd
push edi
ret 0x5950

Function at 0x51e234
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x13
in eax, dx
mov ah, 0x3d
xchg edx, eax
mov ebp, 0x935f1f33
sar dword [ecx - 0x14], 0x6f
adc dword [eax - 0x2a], esp
push esi
insd dword es:[edi], dx
mov cl, pe_nt_image_headers32
test al, 0xb2
xchg edi, eax
inc eax
or al, 0x89
cmp al, 0x6f
mov eax, 0xcf9da2f3
lodsb al, byte [esi]
clc
xchg esi, eax
inc ecx
rol byte [esi + 0x58c4effa], 0xad
fsubp st(7)
push ecx
xor dl, dh
rol byte [eax + 0x71], 1
adc ebp, esi
outsd dx, dword [esi]
lodsd eax, dword [esi]
fmulp st(4)
sbb eax, 0xd23beff6
mov al, 0x31
lodsd eax, dword [esi]
outsd dx, dword [esi]
out dx, al
mov eax, 0x9fd8cfdc
invalid

Function at 0x568c44
Capabilities:
Encode data using xor

Disassembly:
pop ds
out dx, eax
mov edx, 0xb3c20e02
mov bh, 0xe
push 0xffffffffffffffa5
wait
test byte [ebx - 0x2a], ah
inc ebx
rol dword [edx], cl
out dx, al
push ebx
test al, 0x13
xchg esi, eax
or esp, esp
insb byte es:[edi], dx
scasb al, byte es:[edi]
add cl, dh
out dx, al
arpl word [0xb1eb8f98], si
test dword ds:[edx], ecx
lodsb al, byte [esi]
ror dword es:[edx + 0x4c], 0xaf
aas
mov edi, 0xad861b11
or ah, byte [ebp + 5]
faddp st(3)
and byte [ebx], al
out 0x92, al
adc al, dl
fst qword [esi]
push ss
imul esi, dword es:[edx + 0x7624462a], 0x34e6e21d
sub byte [ebx], bl
invalid
Function at 0x613660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov esi, dword [eax + eax + 0x5653f8c4]
push edi
mov dword [ebp], ecx
add dword [ebp - 4], edx
mov edi, eax
mov ebp, dword [ecx]
add byte [ebp - 0x1e7bf00a], al
add byte [eax], al
add byte [ecx], al
inc ebp
clc
movzx edx, byte [eax]
inc dword [eax]
stc
cmp edx, 0xf
ja 0x623756
movzx edx, byte [edx + 0xc448]
jmp dword [edx*4 + 0x40dd58]
leave
jo 0x62376a
mov bh, byte [ebx + 0x685c45d9]
sub al, 0x6c
mov edx, edx
push 0xd2896c2c
push esi
pop ss
test eax, 0x5ac7cd5b
fistp word [ecx - 0x67]
lea eax, [esi - 0x13]
popfd
pop esp
and cl, byte [ecx - 0x75]
mov dl, 0x8f
cwde
adc eax, 0x2ecb6886
sahf
adc al, 0x8b
mov edx, 0x42f7dbd7
stc
out dx, eax
xchg esp, eax
rcl byte [edx + 0x270bcbab]
mov ebx, 0x3b068bab
push ss
jns 0x62375e
push esp
imul ebx, eax, 0x36bc8261
and dword [edi], esi
not dword ss:[eax]
cli
aad 0x30
enter 0xffffffffffff9df7, 0xffffffffffffffda
test dword [edi - 0x5d], ebp
cmpsd dword [esi], dword es:[edi]
ficom dword [edi + 0x345e39b5]
inc ebx
jnp 0x6237bf
or dword [eax], esi
salc
xor dh, dl
adc eax, 0xe3cd2b86
cli
in eax, 0x3b
aaa
cmp esi, dword [edi]
ficomp word [eax]
jns 0x6237be
outsb dx, byte [esi]
aam 0x23
mov cl, 0xd9
cmpsb byte [esi], byte es:[edi]
cmp dword [ebx + 0x39], edi
jo 0x6237b5
movsd dword es:[edi], dword [esi]
and eax, 0xa47df9b8
invalid

Function at 0x65797d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f3f8
cmp edx, dword [eax]
je 0x65799f
add eax, 8
inc ecx
cmp eax, 0x65f488
jl 0x657990
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f3f8]
jne 0x657acd
mov eax, dword [0xa5bdd4]
cmp eax, 1
je 0x657aa7
test eax, eax
jne 0x6579d0
cmp dword [0x65f324], 1
je 0x657aa7
cmp edx, 0xfc
je 0x657acd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657a07
lea eax, [ebp - 0x1a4]
push 0x65c9f8
push eax
call fcn.00658360
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006587f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657a4a
lea eax, [ebp - 0x1a4]
push eax
call fcn.006587f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65c9f4
push edi
call fcn.0065a6c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65c9d8
push eax
call fcn.00658360
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658370
lea eax, [ebp - 0xa0]
push 0x65c9d4
push eax
call fcn.00658370
push dword [esi + 0x65f3fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658370
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65c9ac
push eax
call fcn.0065a634
add esp, 0x2c
pop edi
jmp 0x657acd
lea eax, [ebp + 8]
lea esi, [esi + 0x65f3fc]
push 0
push eax
push dword [esi]
call fcn.006587f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10004180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10004355
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10004355
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareAurealA3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100041ca
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str._TAPS
lea eax, [ebp - 0x10c]
push ebx
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 8]
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x10c]
mov dword [ebp - 8], 4
push eax
push ecx
push 0
mov eax, dword [ebp - 4]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10004220
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xc
call fcn.1000a6d0
add esp, 4
mov esi, eax
test esi, esi
je 0x10004342
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov ax, word [ebp - 0xc]
mov word [esi + 8], ax
movsx eax, ax
shl eax, 2
lea ecx, [eax + eax*4]
lea edx, [ecx + ecx*2]
lea eax, [edx + edx*4]
push eax
call fcn.1000a6d0
add esp, 4
mov dword [esi], eax
push 0x12c
call fcn.1000a6d0
add esp, 4
mov dword [esi + 4], eax
cmp dword [esi], 0
je 0x1000431a
test eax, eax
je 0x1000431a
push str._HRTF
lea eax, [ebp - 0x10c]
push ebx
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 8]
mov ecx, dword [esi]
lea edx, [ebp - 0x10c]
push eax
push ecx
push 0
mov eax, dword [ebp - 4]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000431a
push str._ITD
lea eax, [ebp - 0x10c]
push ebx
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 8]
mov ecx, dword [esi + 4]
lea edx, [ebp - 0x10c]
push eax
push ecx
push 0
mov eax, dword [ebp - 4]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000431a
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x1000432a
push eax
call fcn.1000a5f0
add esp, 4
mov eax, dword [esi]
test eax, eax
je 0x10004339
push eax
call fcn.1000a5f0
add esp, 4
push esi
call fcn.1000a5f0
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005374
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x100053af
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10005396
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x100053a7
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x100053b1
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1000538c
xor eax, eax
pop edi
pop esi
ret

Function at 0x10005ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [esi - 0x3a]
test dword [ecx + 0x56fffffc], edi
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10005344
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100052f9
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
add al, 0
add byte [eax], al
Function at 0x100082c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10008462
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea eax, [ebp - 0x10]
nop
push ebx
push esi
push edi
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareAurealA3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008334
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], 4
push ecx
push esi
push esi
push str.ForceDS
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10008326
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10008334
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10008370
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
mov edi, dword [ebp + 0xc]
push edi
mov ebx, dword [ebp + 8]
push ebx
call sub.DSOUND.dll_DirectSoundCreate
test eax, eax
jne 0x1000835d
cmp esi, 1
jle 0x1000835d
mov eax, 1
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x1000837e
mov eax, 0x80070057
jmp 0x1000835d
mov eax, dword [ebp + 0x10]
mov dword [edi], 0
test eax, eax
je 0x10008392
mov eax, 0x80040110
jmp 0x1000835d
push 0x718
call fcn.1000aed0
mov dword [ebp - 0x14], eax
add esp, 4
mov ebx, eax
mov esi, 0
mov dword [ebp - 4], 0
test ebx, ebx
je 0x100083bd
mov ecx, ebx
call fcn.100084e0
mov esi, eax
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x100083cf
mov eax, 0x8007000e
jmp 0x1000835d
push esi
call fcn.10008840
test eax, eax
jge 0x100083fe
test esi, esi
je 0x100083ed
mov ecx, esi
call fcn.10008650
push esi
call fcn.1000abc0
add esp, 4
push 0
mov ebx, dword [ebp + 8]
push edi
push ebx
call sub.DSOUND.dll_DirectSoundCreate
jmp 0x1000835d
push edi
mov eax, dword [esi]
push 0x10018410
push esi
call dword [eax]
mov ebx, eax
test ebx, ebx
jge 0x1000842a
test esi, esi
je 0x10008423
mov ecx, esi
call fcn.10008650
push esi
call fcn.1000abc0
add esp, 4
mov eax, ebx
jmp 0x1000835d
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
push ebx
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
test eax, eax
jge 0x1000845c
test esi, esi
je 0x1000844e
mov ecx, esi
call fcn.10008650
push esi
call fcn.1000abc0
add esp, 4
push 0
push edi
push ebx
call sub.DSOUND.dll_DirectSoundCreate
jmp 0x1000835d
inc eax
jmp 0x1000835d

Function at 0x1000881a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
jmp fcn.10005c00
Function at 0x10009c90
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x100
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push esi
push edi
push eax
push 0x20019
push 0
push str.SoftwareAurealA3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009d30
lea eax, [ebp - 8]
lea ecx, [ebp - 0x110]
push eax
mov edx, dword [ebp - 4]
push ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
push 0
push str.SplashPath
push edx
call ebx
mov edi, eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
push eax
push ecx
push 0
push 0
push str.SplashAudio
push edx
call ebx
lea ecx, [ebp - 8]
lea edx, [ebp - 0xc]
push ecx
mov eax, dword [ebp - 4]
push edx
push 0
push 0
push str.SplashScreen
push eax
call ebx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10009d33
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10009d33
mov edi, dword [ebp - 4]
test edi, edi
jne 0x10009d6d
mov edi, str.A3DSplsh.exe
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [ebp - 0x110]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10009d81
push 0x10023834
lea eax, [ebp - 0x110]
push eax
call fcn.1000b0d0
add esp, 8
push 1
lea eax, [ebp - 0x110]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10009da6
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10009db1
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000f670
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.1000f730
cmp dword [0x10024994], 1
mov esi, dword [esp + 0x10]
jne 0x1000f693
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x10024990], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x1002498c], bl
jne 0x1000f6ed
cmp dword [0x100285ec], 0
je 0x1000f6db
mov edi, dword [0x100285e8]
sub edi, 4
cmp edi, dword [0x100285ec]
jb 0x1000f6db
mov eax, dword [edi]
test eax, eax
je 0x1000f6d0
call eax
sub edi, 4
cmp edi, dword [0x100285ec]
jae 0x1000f6c8
push 0x1001a030
push 0x1001a028
call fcn.1000f750
add esp, 8
push 0x1001a038
push 0x1001a034
call fcn.1000f750
add esp, 8
test ebx, ebx
je 0x1000f70c
call fcn.1000f740
pop edi
pop esi
pop ebx
ret
mov dword [0x10024994], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100103c0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.1000b780
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100249a0], eax
cmp eax, 0xffffffff
jne 0x100103da
xor eax, eax
pop esi
ret
push 0x74
push 1
call fcn.1000a840
add esp, 8
mov esi, eax
test esi, esi
je 0x1001041c
push esi
mov eax, dword [0x100249a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1001041c
push esi
call fcn.10010450
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x10010470
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x100249a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x100104d3
push 0x74
push 1
call fcn.1000a840
add esp, 8
mov edi, eax
test edi, edi
je 0x100104c9
push edi
mov eax, dword [0x100249a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x100104c9
push edi
call fcn.10010450
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi], eax
mov dword [edi + 4], 0xffffffff
jmp 0x100104d3
push 0x10
call fcn.1000b6c0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret
Function at 0x10011420
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x10024f54], ebx
jne 0x1001146f
call esi
cmp eax, ebx
mov edi, eax
je 0x1001144d
mov dword [0x10024f54], 1
jmp 0x1001146f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x10011465
mov dword [0x10024f54], 2
jmp 0x1001146f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x10024f54], 1
jne 0x1001151e
test edi, edi
jne 0x10011492
call esi
mov edi, eax
test edi, edi
jne 0x10011492
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x100114ac
add esi, 2
cmp word [esi], 0
jne 0x1001149a
add esi, 2
cmp word [esi], 0
jne 0x1001149a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x1001150d
push ebp
call fcn.1000a6d0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x1001150d
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x100114fc
push ebx
call fcn.1000a5f0
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x10024f54], 2
jne 0x100115a2
test ebx, ebx
jne 0x10011541
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x10011541
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x10011556
inc ebp
cmp byte [ebp], 0
jne 0x10011548
inc ebp
cmp byte [ebp], 0
jne 0x10011548
sub ebp, ebx
inc ebp
push ebp
call fcn.1000a6d0
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x1001157b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret