joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c0b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ac103
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0049cd71
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004a24ea
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004a3a85
test eax, eax
je 0x45c1cc
mov ecx, dword [esp + 0x3c]
call fcn.004a2517
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x45c190
push edi
mov ecx, esi
call fcn.0049facc
mov ecx, esi
call fcn.0045c330
cmp dword [esp + 0x38], 1
jne 0x45c1c5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0049fc36
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x45ec00
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x45ec33
push esi
call fcn.00461d10
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45ec2c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x45ecb9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45eca2
mov eax, dword [esi + 8]
test eax, eax
je 0x45ec57
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45ec9e
cmp eax, 2
je 0x45eca2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45ec4a
cmp eax, 3
je 0x45ec7d
cmp eax, 1
jne 0x45ec4a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45ec4a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45ec4a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0045ece0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45ecc8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0045ece0
add esp, 4
pop esi
ret
Function at 0x471a00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x471a4c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x471a4c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x471a36
push eax
call ebp
test ax, ax
jl 0x471a44
inc esi
add edi, 4
cmp esi, 6
jb 0x471a28
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.00471700
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4759b0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x475a10
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x475a10
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x475a10
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x475a10
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x475a20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x476cd0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x476d73
test eax, eax
jbe 0x476d73
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x476d73
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x476d1e
xor esi, esi
jmp 0x476d24
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x476d4f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00478c20
add esi, eax
push esi
mov ebx, esi
call fcn.00478c20
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x476d30
pop ebp
test edi, edi
pop edi
jne 0x476d73
test ebx, ebx
je 0x476d73
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0048b480
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x476eb5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x476fcd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x476fcd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0049d1c3
mov esi, eax
test esi, esi
je 0x476fcd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x476fcd
mov ecx, esi
call fcn.00476e20
cmp edi, eax
jge 0x476fcd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x476f53
mov dword [esp + 0x34], 1
jmp 0x476fae
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x476fcd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00476420
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x47bda0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x47bdea
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x47be19
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x47be5b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x47f120
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x47f186
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x47f186
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x47f167
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x47f510
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x47f548
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4801e0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x480229
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4806a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ad380
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00480250
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004802d0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004802d0
lea ecx, [esi + 0xc]
call fcn.0049b6d8
lea ecx, [esi + 0x10]
call fcn.0049b6d8
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00481870
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00481870
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00481870
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0049b74d
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0049b74d
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x49db67
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49db9f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049bbf4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049bbcc
jmp 0x49dbab
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49f255
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49f297
call fcn.004a53d2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49f297
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49f28e
xor eax, eax
jmp 0x49f29f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049f2a5
pop edi
pop esi
pop ebx
ret 4
Function at 0x4a0da4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, 0x10b
cmp eax, ecx
ja 0x4a0f72
je case.0x4a0e53.52
cmp eax, 0x3e
ja 0x4a0e62
je 0x4a0e5e
cmp eax, 0x19
ja 0x4a0df6
je case.0x4a0dda.24
cmp eax, 0x18
ja case.0x4a0e53.56
jmp dword [eax*4 + 0x4a0f9a]
xor eax, eax
jmp 0x4a0ea6
push 4
jmp 0x4a0ea5
push 2
jmp 0x4a0ea5
cmp eax, 0x27
ja 0x4a0e47
je 0x4a0ede
cmp eax, 0x20
ja 0x4a0e2b
je 0x4a0e27
sub eax, 0x1a
je case.0x4a0e53.60
dec eax
je case.0x4a0dda.24
dec eax
dec eax
je case.0x4a0e53.54
dec eax
jne case.0x4a0e53.56
push 9
jmp 0x4a0ea5
push 0xb
jmp 0x4a0ea5
sub eax, 0x21
je 0x4a0f3a
dec eax
je case.0x4a0e53.52
dec eax
dec eax
je case.0x4a0dda.4
dec eax
dec eax
jne case.0x4a0e53.56
push 0xe
jmp 0x4a0ea5
add eax, 0xffffffcc
cmp eax, 8
ja case.0x4a0e53.56
jmp dword [eax*4 + 0x4a0ffe]
push 3
jmp 0x4a0ea5
push 8
jmp 0x4a0ea5
cmp eax, 0x6b
ja 0x4a0ead
je case.0x4a0dda.2
cmp eax, 0x47
ja 0x4a0e8a
je case.0x4a0e53.54
sub eax, 0x40
je case.0x4a0e53.54
dec eax
je case.0x4a0e53.54
dec eax
je case.0x4a0e53.60
dec eax
je case.0x4a0e53.52
dec eax
je case.0x4a0dda.4
jmp 0x4a0f69
sub eax, 0x50
je case.0x4a0e53.54
dec eax
dec eax
je case.0x4a0e53.54
sub eax, 3
je case.0x4a0e53.52
dec eax
je case.0x4a0e53.54
dec eax
dec eax
jne case.0x4a0e53.56
push 0xa
pop eax
ret 4
push 5
jmp 0x4a0ea5
mov ecx, 0x90
cmp eax, ecx
ja 0x4a0f07
je case.0x4a0e53.52
cmp eax, 0x75
ja 0x4a0ee2
je case.0x4a0e53.57
sub eax, 0x6c
je 0x4a0f3a
sub eax, 3
je case.0x4a0e53.52
dec eax
je 0x4a0ede
dec eax
je case.0x4a0dda.4
dec eax
jne case.0x4a0e53.56
push 6
jmp 0x4a0ea5
push 0xd
jmp 0x4a0ea5
sub eax, 0x7b
je case.0x4a0e53.52
dec eax
je case.0x4a0e53.52
dec eax
je case.0x4a0e53.52
sub eax, 6
je case.0x4a0dda.24
jmp 0x4a0e1c
mov ecx, 0xb6
cmp eax, ecx
ja 0x4a0f48
je case.0x4a0e53.60
sub eax, 0x91
je case.0x4a0dda.16
sub eax, 9
je case.0x4a0e53.52
sub eax, 7
je case.0x4a0e53.52
sub eax, 6
je 0x4a0f3a
sub eax, 3
jne case.0x4a0e53.56
jmp case.0x4a0e53.54
push 0xc
jmp 0x4a0ea5
push 7
jmp 0x4a0ea5
sub eax, 0xb7
je case.0x4a0e53.54
sub eax, 8
je case.0x4a0e53.60
dec eax
dec eax
je case.0x4a0e53.60
sub eax, 0xd
je case.0x4a0e53.52
dec eax
dec eax
jne case.0x4a0e53.56
jmp case.0x4a0e53.52
sub eax, 0x3e3
je case.0x4a0e53.57
dec eax
je case.0x4a0e53.57
dec eax
je case.0x4a0e53.57
dec eax
dec eax
je case.0x4a0e53.54
push 1
jmp 0x4a0ea5

Function at 0x4a5902
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a5930
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a594e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a5868
jmp 0x4a594e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a594e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a5868
test edi, edi
mov eax, edi
jne 0x4a5938
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0xe7af2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
push ecx
lea esp, [esp + 4]
call fcn.00e7af0e

Function at 0xe7af39
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
push esi
pushal
jmp 0xe7af7a
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0xe7af8b
lea esp, [esp + 0x1c]
jmp 0xe7af8b
lea esp, [esp + 2]
push word [esp + 0x13]
jbe 0xe7af40
mov dword [esp + 0x1c], edi
jmp 0xe7af64
pushfd
jmp 0xe7af1e

Function at 0xe7afb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push bx
lea esp, [esp + 2]
push ecx
call fcn.00e7af2b
pop word [esp]
lea esp, [esp]
lea esp, [esp]
lea esp, [esp + 2]
push eax
jmp 0xe7af58

Function at 0xe817fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, edi
jmp 0xe81806
rcl ax, 3
mov dx, 0xd3a2
jmp 0xe8180e
dec ch
jo 0xe817e0
mov ecx, edi
jmp 0xe817e4
rcl ax, 3
mov dx, 0xd3a2
lea esp, [esp + 4]
sub edi, 0x10e4cfc3
jmp 0xe819aa
xchg al, dh
mov edx, 0xa03f26c5
mov ch, byte [esp]
jmp 0xe818a8
jmp 0xe81834
lea ecx, reloc.WINMM.dll_midiStreamOut
xor edi, 0x4f1f9740
inc ah
jne 0xe8184a
xchg al, dh
mov edx, 0xa03f26c5
mov ch, byte [esp]
mov ax, 0x989
add eax, ebx
jmp 0xe818ae
dec edi
mov dh, bh
mov ah, dl
xchg al, dl
xchg ah, cl
bts edx, edi
jmp 0xe818b3
mov ecx, ebp
mov eax, edi
rdtsc
mov cl, al
jmp 0xe818f3
mov ax, 0x989
add eax, ebx
not dx
jmp 0xe81883
jg 0xe818c9
jle 0xe818c9
aas
mov ebx, 0x7fbd4e2b
pop ss
pushfd
xor dl, byte [ebp - 0x5c]
popal
imul ecx, dword [eax - reloc.WINMM.dll_midiStreamOut], 0x4066dff7
neg edi
inc ax
jae 0xe81891
jb 0xe8191a
mov cl, al
call fcn.00e81944
push ebp
jecxz 0xe8194e
push ss
in eax, 0x5d
lodsd eax, dword [esi]
and al, 0xba
invalid
mov dl, byte [esp]
jmp 0xe81861
sub edi, 0xe7ddc92
bt dx, dx
jmp 0xe8196f
add edi, dword [ebp]
lea ecx, [ebp*4]
mov eax, 0x56c425b2
sub ecx, esi
jmp 0xe819fc
mov ecx, ebp
mov eax, edi
rdtsc
jmp 0xe818d1
mov cx, 0xb50a
mov ch, byte [esp]
lea eax, [eax + 0x1b]
pushal
bswap ecx
lea edx, [ecx + ebp]
jmp 0xe81968
mov ecx, ebp
jmp 0xe81922
neg ch
call fcn.00e81952
jns 0xe81903
js 0xe81903
invalid
jmp 0xe819de
lea edx, reloc.WINMM.dll_midiStreamOut
xchg al, ah
dec cx
je 0xe818eb
mov dl, byte [esp]
lea ecx, reloc.WINMM.dll_midiStreamOut
jmp 0xe81867
jnp 0xe81993
jp 0xe819de
into
pop ecx
leave
test al, 0x5b
in al, dx
and byte [edx + 0x7cba4f28], bh
sbb esi, dword [edx + 0x6d]
jl 0xe81a60
salc
cld
add byte [eax], al
add byte [eax - 0x349f5f5], bh
Function at 0xee9fd7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 2]
call fcn.00e89b09
sub esp, 0xe
add esp, 0xb
jmp 0xee9f99
jmp 0xee9faf
Function at 0x4036c5
Capabilities:
Terminate process

Disassembly:
jmp 0x458cc3
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x458cd4
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405add
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x4037f6
Capabilities:
Query environment variable

Disassembly:
jmp 0x495d1d
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x495d2e
pop esi
ret
push ebx
push edi
push esi
call fcn.00495c04
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004040e3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x495d56
push ebx
push esi
push edi
call fcn.004058b7
add esp, 0xc
push 0
call fcn.00406488
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x405984
Capabilities:
Parse pe header

Disassembly:
jmp 0x41add8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41ae17
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ae17
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ae17
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41ae17
cmp dword [ecx + 0x74], 0xe
jbe 0x41ae17
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x493ef2
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4e44d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x493f3d
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004943b4
test al, al
jne 0x493f37
sub edx, 2
cmp edx, edi
jne 0x493f1d
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x493f5f
lea eax, [edi + 2]
cmp edx, eax
je 0x493f5f
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00493aeb
add esp, 0x10
jmp 0x494059
push esi
lea ecx, [ebp - 0x255]
call fcn.004943b4
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x493fa2
push dword [ebp - 0x25c]
jmp 0x493f4f
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x493fdf
cmp word [ebp - 0x226], 0
je 0x494000
cmp word [ebp - 0x226], ax
jne 0x493fdf
cmp word [ebp - 0x224], 0
je 0x494000
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00493aeb
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x49404c
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x493fb9
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x494034
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x494059
push 0x4934d3
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004056e6
add esp, 0x10
jmp 0x494029
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004030ee
leave
ret
Function at 0x49fb08
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401dcf
mov eax, dword [0x4e44d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00406078
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x49fb4a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x49fca6
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004061d6
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4e8140]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403314
mov ecx, dword [esi*4 + 0x4e8140]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x49fc9f
cmp eax, dword [edi + ecx + 0x24]
jne 0x49fc9f
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49fc9f
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403314
add esp, 0x14
test edx, edx
jl 0x49fc9f
jg 0x49fc15
test eax, eax
jb 0x49fc9f
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x49fc9f
jl 0x49fc2f
cmp dword [ebp - 0x1008], eax
ja 0x49fc9f
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x49fc4d
test ebx, ebx
je 0x49fc86
cmp ecx, edi
jae 0x49fc86
mov al, byte [ecx]
cmp al, 0xd
jne 0x49fc67
lea eax, [edi - 1]
cmp ecx, eax
jae 0x49fc73
cmp byte [ecx + 1], 0xa
jne 0x49fc73
inc ecx
jmp 0x49fc73
movzx eax, al
movsx eax, byte [eax + 0x4e4e10]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x49fc4d
cmp edx, ebx
jne 0x49fc4d
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x49fca4
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004030ee
leave
ret