joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408770
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x40eac0]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push edi
test eax, eax
jne 0x4087b8
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40879c
mov eax, 1
jmp 0x4087b3
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x408898
mov eax, 2
mov dword [0x40eac0], eax
cmp eax, 2
jne 0x4087d8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 1
jne 0x4088aa
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4087f3
mov ecx, dword [0x40e7f8]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
jne 0x408812
pop edi
pop esi
pop ebp
pop ebx
ret
lea edx, [edi + edi]
push edx
call fcn.00402640
mov esi, eax
add esp, 4
test esi, esi
jne 0x408829
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40888f
mov eax, dword [esp + 0x20]
push 0
test eax, eax
push 0
jne 0x408870
mov eax, dword [esp + 0x2c]
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x40888f
push esi
call fcn.00402710
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push 0xffffffffffffffff
push esi
push 0x220
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x40889f
push esi
call fcn.00402710
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.00402710
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x8fc134
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x8fc10c
mov dx, si
lea edx, reloc.WINMM.dll_midiStreamOut
bt edx, ecx
mov dh, 0xfb
jmp 0x8fc168
rcr edx, 3
lea esp, [esp + 2]
dec al
clc
ja 0x8fc0ef
jbe 0x8fc11b
cmp edi, dword [edi + reloc.WINMM.dll_midiStreamOut]
adc cl, byte [ebp - 0x7229749a]
xchg esi, eax
and al, 0xb
invalid
mov dx, si
lea edx, reloc.WINMM.dll_midiStreamOut
bt edx, ecx
jmp 0x8fc1ae
add esp, 2
jno 0x8fc105
rcr edx, 3
jmp 0x8fc0e9
jmp 0x8fc191
mov dl, 0xf8
mov edx, 0x2efb6ac8
rol al, 0
jmp 0x8fc150
sub esp, 2
jns 0x8fc1cc
push edx
mov dl, al
mov dh, cl
mov dx, 0x2c37
xchg byte [esp], dl
jmp 0x8fc1e7
mov edx, dword [esp]
neg al
inc dx
jnp 0x8fc13e
sub esp, 2
pop dx
mov dh, byte [esp]
mov dl, 0xf8
mov edx, 0x2efb6ac8
jmp 0x8fc147
sub esp, 2
pop dx
mov dh, byte [esp]
jmp 0x8fc140
mov dh, 0xfb
mov edx, dword [esp]
jmp 0x8fc16b
mov dh, cl
mov dx, 0x2c37
xchg byte [esp], dl
jmp 0x8fc1e7
push edx
mov dl, al
jmp 0x8fc1b5
sub bl, al
mov eax, esi
lea edx, [esp + ebx]
mov eax, dword [esp]
jmp 0x8fc220
inc edx
lea esp, [esp + 2]
jmp 0x8fc1d1
bsf eax, esp
lea eax, [edx + ebx]
mov ax, word [esp]
cmc
bswap edx
jmp 0x8fc2b3
inc ebp
mov eax, dword [esp]
dec ax
jle 0x8fc20a
jg 0x8fc232
adc eax, 0xa455329c
imul cx, word [eax - 0x723b43f1], 0x1a04
bsf eax, esp
lea eax, [edx + ebx]
mov ax, word [esp]
call fcn.008fc382
daa
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0xffd4202
mov bl, 0xf8
ror cl, 0
push eax
call fcn.008fc2f1
ror dword [esi - 0x24], 0xbb
push esi
nop
push ecx
jecxz 0x8fc2e5
push ss
in eax, 0x20
cmpsb byte [esi], byte es:[edi]
neg eax
bsr dx, dx
jb 0x8fc260
jae 0x8fc260
sub byte [ecx + 0x9bb4829], bh
sbb byte [ebx + 0x52], bh
int 0x5c
scasd eax, dword es:[edi]
btc ax, cx
rdtsc
lea edx, reloc.WINMM.dll_midiStreamOut
push dword [esp]
ret 4
mov cl, 0xd0
and edx, dword [ecx - reloc.WINMM.dll_midiStreamOut]
invalid

Function at 0x8fc2f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebx*4]
stc
mov eax, dword [esp]
xchg dword [esp], ebp
neg eax
call fcn.008fc2db
stc
stc
lea ebp, [ebp + 0xb5]
lea eax, [edx + ebx]
call fcn.008fc34f
mov al, byte [0x3fcca535]
and byte [edi + edx*8 + 0x324648d], 0x9c
xchg al, dh
lea esp, [esp + 1]
jmp 0x8fc365
lea esp, [esp + 4]
xor cl, 0x62
rcl eax, cl
jl 0x8fc394
jge 0x8fc39f
out 0x83, eax
adc esi, dword [esi - 0x7b]
aaa
fild word [edx + ebx*8 - 0x43]
dec esp
invalid
mov ax, 0xd731
jmp 0x8fcbfa
mov ax, 0xd731
mov eax, 0x8c8ff25e
ror ax, cl
mov ax, di
mov al, ah
jmp 0x8fc7a5
jno 0x8fc3f7
jo 0x8fc3f7
call fcn.008fc3c5
lea edx, [edi*4]
jmp 0x8fc50b
mov dl, byte [esp]
lea edx, [edi*4]
add cl, 0xaf
setnp al
mov al, byte [esp]
bsf edx, esi
jmp 0x8fc3db
mov dx, 0x1af1
inc dh
jnp 0x8fc501
mov dl, byte [esp]
jmp 0x8fc4af
mov al, ah
mov dx, 0xa8d
neg cl
rdtsc
jmp 0x8fc762
mov eax, 0x8c8ff25e
ror ax, cl
mov ax, di
jmp 0x8fc7a3
Function at 0x922f9d
Capabilities:
Encrypt data using aes

Disassembly:
add edx, 6
movzx esi, byte [edx]
pop edx
mov di, word [esp]
mov bh, dh
jmp 0x922fe3
lea esp, [esp + 0x14]
popal
jmp 0x922f87
push edx
jmp 0x923062
shl edx, 8
xor edx, esi
xchg bl, bh
jmp 0x922fcd
neg bp
jmp 0x923024
shl edx, 8
clc
xor edx, esi
mov bx, 0xc662
jmp 0x922fec
mov di, word [esp]
jmp 0x923047
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
mov bh, ch
bswap ebx
jmp 0x92300e
shl edx, 8
jmp 0x9230f5
movzx esi, byte [eax + 9]
lea ebp, [esp + edx]
jmp 0x923031
mov edx, eax
add edx, 7
movzx esi, byte [edx]
pop edx
jmp 0x923002
mov ecx, eax
jmp 0x92308e
mov bp, si
neg bp
xor edx, esi
push ecx
jmp 0x92306d
add ecx, 0xb
movzx esi, byte [ecx]
pop ecx
bswap ebp
jmp 0x9230db
lea edi, reloc.WINMM.dll_midiStreamOut
jmp 0x9230c5
movzx esi, byte [eax + 0xa]
bsr ebx, ebp
shl edx, 8
sbb bx, bp
bsf bx, dx
jmp 0x923083
mov dword [ecx + 8], edx
jmp 0x923117
shl edx, 8
xor edx, esi
xchg esi, ebx
neg bh
mov bx, 0x54e2
jmp 0x923099
xor edx, esi
lea ebx, [edx + esi]
not ebx
sbb bl, 0xd6
jmp 0x9230b2
push edi
jmp 0x923121
movzx edx, byte [eax + 0xc]
dec ebp
mov bh, ah
push esp
jmp 0x923101
mov edi, eax
add edi, 0xd
movzx esi, byte [edi]
pop edi
jmp 0x92316b
xor edx, esi
xchg bl, bh
mov edi, 0xcbc60f1e
xchg di, bx
jmp 0x923155
movzx esi, byte [eax + 0xe]
bsf bx, dx
bts bp, si
jmp 0x923179
mov ebx, dword [esp]
shl edx, 8
xchg bp, di
lea ebp, [edx + ebp]
jmp 0x92312c
movzx eax, byte [eax + 0xf]
jmp 0x9233bb
not ah
rcl si, cl
jmp 0x9231dc
mov ebx, 0x72a59605
xor edx, eax
mov dword [ecx + 0xc], edx
inc eax
jmp 0x9231a3
shr eax, 0x10
lea ebx, reloc.WINMM.dll_midiStreamOut
rcr bl, 3
jmp 0x9231fe
mov eax, edx
lea esi, [eax + ecx]
mov ebp, dword [esp]
not bh
jmp 0x9231c6
mov eax, dword [eax*4 + reloc.WINMM.dll_midiStreamOut]
mov edi, 0x51e73de9
cmc
jmp 0x923321
mov esi, 0xff
mov ebp, 0x1ad72239
and eax, esi
jmp 0x9231e8
xor edx, esi
not di
shl edx, 8
bswap ebx
jmp 0x9231b9
lea esp, [esp + 0xc]
xor eax, 0x1000000
dec bp
call fcn.009232cf
and edi, ebp
call fcn.00923385
fist dword [esi - 0x3c]
mov dword [reloc.WINMM.dll_midiStreamOut], eax
pop ebx
int 0xe
out dx, al
stc
fcomp dword [esi + 0x60]
mov dword [esp + 9], ebp
mov ebp, 0xff00
cmc
jmp 0x923331
shl edx, 8
push esi
mov bh, ah
mov edi, 0x961a7ecf
bts ebp, edx
jmp 0x923221

Function at 0x9232cf
Capabilities:
Encrypt data using aes

Disassembly:
popal
sbb bl, 0x98
bswap ebp
shr edi, 8
shl ebp, 0x16
jmp 0x92327d
bswap ebp
bsf ebp, ebp
add bp, 0x8b34
mov dword [esp], edx
pushfd
lea esp, [esp + 4]
jmp 0x92322d
mov bp, 0xebb1
lea esp, [esp + 4]
and edi, 0xff0000
mov bl, byte [esp]
mov bx, si
jmp 0x9232a2
clc
and edi, esi
not bx
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x923261
xor eax, edi
call fcn.009232af
idiv dword [esi - 0x14]
mov eax, dword [esi - reloc.WINMM.dll_midiStreamOut]
cmpsb byte [esi], byte es:[edi]
push ebp
out 0x56, al
rol dword [eax - reloc.WINMM.dll_midiStreamOut], 0x59
add al, 0x25
add byte [eax], al
add bh, bh
mov bx, ax
mov ebx, dword [ecx + 4]
and eax, 0xff000000
jmp 0x92328c
pushal
jmp 0x92324d
Function at 0x923431
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, edi
jmp 0x923485
mov dword [ecx + 0x18], eax
jmp 0x92344c
setb bl
jmp 0x92341b
mov dx, word [esp]
jmp 0x923477
xor edx, eax
mov ah, 0xa4
mov dword [ecx + 0x1c], edx
mov edx, eax
jmp 0x923436
mov ebx, 0x8fadf8
lea esp, [esp + 0x14]
jmp 0x8ee3c7
push ebx
mov ebx, eax
add ebx, 0xc
jmp 0x923657
shr edi, 0x10
sub esp, 0x18
sub esp, 0x1c
jmp 0x9234ed
mov ecx, dword [ecx*4 + reloc.WINMM.dll_midiStreamOut]
clc
sub esp, 0xe
add esp, 0
lea esp, [esp + 2]
jmp 0x9234ab
and ecx, 0xff0000
call fcn.0092351a
rcl byte [edi - 0x39]
mov byte [0xe54ae151], al
adc al, 0x87
and edi, esi
and edi, esi
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
lea esp, [esp + 0x40]
jmp 0x9234d7
mov dword [esp], edx
popal
and ecx, esi
stc
jmp 0x9234c3
shr ecx, 8
mov edi, esi
mov di, word [esp]
btr edi, edi
pushal
jmp 0x923511
mov edx, dword [ebx]
pop ebx
sbb ch, 0xbc
mov ecx, edx
jmp 0x92353d

Function at 0x92351a
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 0
lea esp, [esp + 4]
and edi, 0xff000000
sub esp, 0x13
jmp 0x9235b0
push word [esp]
jmp 0x923583
lea edi, [esp + edx]
mov edi, edx
and edx, esi
push sp
jmp 0x92354c
pushfd
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x923591
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushfd
stc
shr edi, 0x18
jmp 0x92356d
push ebp
mov ebp, edi
lea ebp, [ebp*4]
jmp 0x9235e5
push word [esp + 6]
lea esp, [esp + 1]
xor ecx, edi
inc edi
mov di, 0xc338
jmp 0x923562
and edx, ebp
xor ecx, edx
call 0x9235cc
jae 0x923633
neg edx
jmp 0x923622
lea ebp, reloc.WINMM.dll_midiStreamOut
movzx edi, byte [ebp]
pop ebp
xor ecx, edi
lea edi, [edx + 0x87]
jmp 0x9235c2
lea esp, [esp + 0x20]
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
neg edx
call fcn.009235fa
add ebx, 4
mov dh, dl
mov dh, dl
lea edx, [edx + 0x26]
jmp 0x92367c
ret
mov ebx, eax
add ebx, 4
mov edx, dword [ebx]
pop ebx
jmp 0x923664
xor edx, ecx
mov dword [eax + 0x14], edx
mov cx, di
jmp 0x92384b
mov dword [edi], ecx
ror dx, cl
setle dl
mov dx, word [esp]
push ebx
jmp 0x92363e
push ebp
jmp 0x9237e0
mov dh, 0xc6
bswap edx
mov dword [eax + 0x18], ecx
mov dh, bl
setne dh
jmp 0x92368b
xchg bx, bp
jmp 0x92370a
push 0xa
pop eax
pop edi
lea esi, reloc.WINMM.dll_midiStreamOut
jmp 0x9236af
lea esp, [esp + 0xc]
cmp ebx, 0x8fae1c
jne 0x8ee3c7
jmp 0x9236c5
lea esp, [esp + 2]
jmp 0x923775
pop esi
mov ebx, ecx
setp bh
push cx
lea ebx, reloc.WINMM.dll_midiStreamOut
jmp 0x9236f4
xor edx, ecx
sub esp, 0xe
lea esp, [esp + 2]
mov dword [eax + 0x1c], edx
jmp 0x9236e2
mov ebp, dword [esp]
lea esp, [esp + 4]
pop ebx
ret
mov ebp, eax
add ebp, 0xc
mov edx, dword [ebp]
pop ebp
jmp 0x92372f
mov ecx, dword [eax + 8]
clc
stc
xor ecx, edx
jmp 0x9236a1
Function at 0x9235cc
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 0
lea esp, [esp + 4]
and edi, 0xff000000
sub esp, 0x13
jmp 0x9235b0
push word [esp]
jmp 0x923583
lea edi, [esp + edx]
mov edi, edx
and edx, esi
push sp
jmp 0x92354c
pushfd
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x923591
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushfd
stc
shr edi, 0x18
jmp 0x92356d
push ebp
mov ebp, edi
lea ebp, [ebp*4]
jmp 0x9235e5
push word [esp + 6]
lea esp, [esp + 1]
xor ecx, edi
inc edi
mov di, 0xc338
jmp 0x923562
and edx, ebp
xor ecx, edx
call 0x9235cc
jae 0x923633
neg edx
jmp 0x923622
lea ebp, reloc.WINMM.dll_midiStreamOut
movzx edi, byte [ebp]
pop ebp
xor ecx, edi
lea edi, [edx + 0x87]
jmp 0x9235c2
lea esp, [esp + 0x20]
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
neg edx
call fcn.009235fa
add ebx, 4
mov dh, dl
mov dh, dl
lea edx, [edx + 0x26]
jmp 0x92367c
ret
mov ebx, eax
add ebx, 4
mov edx, dword [ebx]
pop ebx
jmp 0x923664
xor edx, ecx
mov dword [eax + 0x14], edx
mov cx, di
jmp 0x92384b
mov dword [edi], ecx
ror dx, cl
setle dl
mov dx, word [esp]
push ebx
jmp 0x92363e
push ebp
jmp 0x9237e0
mov dh, 0xc6
bswap edx
mov dword [eax + 0x18], ecx
mov dh, bl
setne dh
jmp 0x92368b
xchg bx, bp
jmp 0x92370a
push 0xa
pop eax
pop edi
lea esi, reloc.WINMM.dll_midiStreamOut
jmp 0x9236af
lea esp, [esp + 0xc]
cmp ebx, 0x8fae1c
jne 0x8ee3c7
jmp 0x9236c5
lea esp, [esp + 2]
jmp 0x923775
pop esi
mov ebx, ecx
setp bh
push cx
lea ebx, reloc.WINMM.dll_midiStreamOut
jmp 0x9236f4
xor edx, ecx
sub esp, 0xe
lea esp, [esp + 2]
mov dword [eax + 0x1c], edx
jmp 0x9236e2
mov ebp, dword [esp]
lea esp, [esp + 4]
pop ebx
ret
mov ebp, eax
add ebp, 0xc
mov edx, dword [ebp]
pop ebp
jmp 0x92372f
mov ecx, dword [eax + 8]
clc
stc
xor ecx, edx
jmp 0x9236a1

Function at 0x9235fa
Capabilities:
Encrypt data using aes

Disassembly:
mov dh, dl
jmp 0x923602
lea esp, [esp + 4]
xor ecx, dword [eax]
shr dx, cl
neg edx
btc dx, bx
jmp 0x923632
Function at 0x9239dc
Capabilities:
Encrypt data using aes

Disassembly:
stc
neg bx
jmp 0x9239e5
mov dword [ebp - 4], ecx
clc
mov ecx, 0xff
jmp 0x8eeb49
lea esp, [esp + 4]
lea ecx, [eax - 1]
jmp 0x9239bf
movzx ebx, byte [esi + 0x11]
rol dx, 0xb
pushal
push eax
jmp 0x9239f5
mov eax, ebx
lea eax, [eax*4]
lea eax, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [eax]
jmp 0x923afe
sub esp, 0xd
lea esp, [esp + 1]
jmp 0x923a61
mov edx, dword [esi]
mov edi, esi
xor edi, edx
lea edi, [ecx*4]
mov edi, edx
jmp 0x923a20
shr edi, 0x18
sub esp, 6
sub esp, 0x17
call fcn.00923a4b
lea esp, [esp + 0x2c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
shr ebx, 4
clc
jmp 0x923aa8
movzx ebx, byte [esi + 2]
call fcn.00923a92
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
cmc
jmp 0x923ad6
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
jmp 0x923b3b
and edx, ecx
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
stc
jmp 0x923b0f
pop eax
mov dx, 0x68b9
lea esp, [esp + 0x20]
add esi, 0x10
jmp 0x923a3a
and edx, ecx
cmc
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x923b23
bsf dx, ax
call fcn.00923b71
xchg esp, eax
sbb dword [ecx - 0x920e418], ecx
jp 0x923b1d
invalid
pop bx
btr bx, bp
lea esp, [esp + 2]
movzx ebx, byte [esi + 5]
stc
jmp 0x923ae6

Function at 0x923b71
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, esi
add eax, 4
mov edx, dword [eax]
pop eax
jmp 0x923b91
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
pushal
jmp 0x923b7b
add esp, 1
lea esp, [esp + 3]
push eax
jmp 0x923b4c
stc
jmp 0x923bb5
mov dword [esi], edi
mov edi, ecx
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
pushfd
jmp 0x923b56
and edi, ecx
call fcn.00923b9f
Function at 0x923bbc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x923be9
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
lea ebx, [eax + eax]
jmp 0x923f97
add edi, 8
mov edx, dword [edi]
pop edi
jmp 0x923c7f
mov dl, cl
shl dx, cl
push edi
mov edi, esi
jmp 0x923c20
sub esp, 0x14
lea esp, [esp + 2]
jmp 0x923d41
lea edi, [edx*4]
mov edi, 0x52578575
neg edi
mov edi, edx
push dx
jmp 0x923c40
mov dword [esi + 4], edi
bsr di, ax
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
lea edi, [edi*4]
jmp 0x923c56
bswap ebx
bt ebx, ecx
mov bx, word [esp]
jmp 0x923cd5
and ebx, ecx
clc
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
bsf ebx, ebp
jmp 0x923c96
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x923d12
movzx ebx, byte [esi + 0xa]
jmp 0x923cbf
sub esp, 5
and edi, ecx
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x923cac
mov bx, word [esp + 1]
jmp 0x923d21
and ebx, ecx
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov ebx, dword [esp]
pushfd
jmp 0x923cfc
push edx
mov edx, esi
add edx, 0xd
jmp 0x923d68
shr edi, 0x18
cmc
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 0x17
jmp 0x923cee
movzx ebx, byte [edx]
pop edx
and edx, ecx
call fcn.00923d29
push ebp
jmp 0x923db4
mov ebp, esi
add ebp, 0xc
mov edx, dword [ebp]
pop ebp
call 0x923dc3
jmp 0x923e2f
bsr edi, esi
jmp 0x923e07
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
and edx, ecx
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
clc
jmp 0x923c36
mov dword [esp + 0x10], edx
clc
lea esp, [esp + 0x10]
popal
push eax
jmp 0x923ec6
pushal
lea ecx, reloc.WINMM.dll_midiStreamOut
bswap ebp
sub esp, 0x12
pop word [esp + 7]
jmp 0x923df1
mov dword [esi + 8], edi
bswap edi
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
clc
jmp 0x923dc5
and edi, ecx
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
call fcn.00923e3e
movzx ebx, byte [esi + 0xe]
sub esp, 0x1c
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x923ea4
and ebx, ecx
call fcn.00923f38
call 0x5b7a57fd
xchg ebp, eax
add eax, 0xc80ffc95
and eax, 0xbe4324b6
push cs
daa
dec esi
sub esp, 0x12
lea esp, [esp + 2]
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
not bx
jmp 0x923e62
and edx, ecx
cmc
sub esp, 0x19
lea esp, [esp + 1]
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x923e72
shr edi, 0x18
sub esp, 9
lea esp, [esp + 1]
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x923e54
movzx ebx, byte [esi + 9]
and edx, ecx
stc
jmp 0x923ddb

Function at 0x923ee3
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp], cl
lea esp, [esp + 4]
dec dword [ebp - 4]
call fcn.00923f5b

Function at 0x923f5b
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esi + 0xc], edi
jmp 0x923f45
lea esp, [esp + 4]
jne 0x8eeb49
je 0x8eea79
cmp byte [0x11e69f0c], 0xeb
xchg ebp, eax
jmp 0x923ef2

Function at 0x9a153e
Capabilities:
Check for peb beingdebugged flag
Encode data using xor
Parse pe header

Disassembly:
mov word [esp + 1], di
push dword [esp + 3]
mov dword [esp + 0x24], ebp
jmp 0x9a1528
Function at 0x10059ff
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001b80
call fcn.01005d48
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1005a3a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1005a3a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1005a52
cmp eax, 0x20b
je 0x1005a3f
mov dword [ebp - 0x1c], edi
jmp 0x1005a66
cmp dword [ecx + 0x84], 0xe
jbe 0x1005a3a
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1005a60
cmp dword [ecx + 0x74], 0xe
jbe 0x1005a3a
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1007230], 0xffffffff
or dword [0x1007234], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1007224]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1007220]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100722c], eax
call fcn.01005d40
cmp dword [0x1007110], edi
jne 0x1005ac3
push fcn.01005d40
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01005d29
push 0x1007018
push 0x1007014
call sub.msvcrt.dll__initterm
mov eax, dword [0x100721c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1007218]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x1007010
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x1005b29
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x1005be3
mov dword [ebp - 0x20], esi
cmp word [esi], 0x22
jne 0x1005b77
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1005b45
cmp ax, 0x22
jne 0x1005b32
cmp word [esi], 0x22
jne 0x1005b50
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1005b5e
cmp ax, 0x20
jbe 0x1005b4b
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x54], 1
je 0x1005b84
movzx eax, word [ebp - 0x50]
jmp 0x1005b87
cmp word [esi], 0x20
jbe 0x1005b50
add esi, ebx
mov dword [ebp - 0x20], esi
jmp 0x1005b77
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.01005ec1
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], edi
jne 0x1005ba8
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1005bdd
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01005d83
ret
Function at 0x666aa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x165000]
push edi
jmp 0x666aba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x666ac1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x666ab0
mov eax, 1
add ebx, ebx
jne 0x666ad3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x666ae4
jne 0x666b03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x666b03
dec eax
add ebx, ebx
jne 0x666af0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x666ac8
add ebx, ebx
jne 0x666aff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x666b55
xor ecx, ecx
sub eax, 3
jb 0x666b1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x666b8a
sar eax, 1
mov ebp, eax
jmp 0x666b26
add ebx, ebx
jne 0x666b26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x666af4
inc ecx
add ebx, ebx
jne 0x666b34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x666af4
add ebx, ebx
jne 0x666b41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x666b36
jne 0x666b52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x666b36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x666b74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x666b66
jmp 0x666ab6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x666b74
add edi, ecx
jmp 0x666ab6
pop esi
mov edi, esi
mov ecx, 0x69b9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x666b92
cmp byte [edi], 0x22
jne 0x666b92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x666b97
lea edi, [esi + 0x263000]
mov eax, dword [edi]
or eax, eax
je 0x666c0f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x268258]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x26837c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x666bc4
mov ecx, edi
jns 0x666bf3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x268384]
or eax, eax
je 0x666c09
mov dword [ebx], eax
add ebx, 4
jmp 0x666be1
call dword [esi + 0x268380]
mov ebp, dword [esi + 0x268388]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x257]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x666c43
sub esp, 0xffffff80
jmp 0x4fb91d

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx