joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a60d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [edi]
mov cx, word [eax + 0x14]
lea esi, [ecx + eax + 0x18]
mov ecx, dword [edi + 0x3c]
push ecx
mov eax, dword [esi + 8]
push eax
mov dword [esp + 0x1c], eax
call fcn.004a6220
push esi
push edi
mov dword [esp + 0x28], eax
call fcn.004a6230
mov ecx, dword [edi]
mov dword [esp + 0x2c], eax
mov edx, dword [esi + 0x24]
mov eax, 1
add esp, 0x10
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0
add esi, 0x28
cmp word [ecx + 6], ax
mov dword [esp + 0x10], eax
jbe 0x4a61eb
mov ecx, dword [edi + 0x3c]
mov eax, dword [esi + 8]
push ecx
push eax
mov dword [esp + 0x34], eax
call fcn.004a6220
push esi
push edi
mov ebx, eax
call fcn.004a6230
mov edx, dword [esp + 0x24]
mov ebp, eax
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebx
je 0x4a6195
mov eax, dword [esp + 0x1c]
add eax, edx
cmp eax, ebx
ja 0x4a6195
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.004a6260
add esp, 8
test eax, eax
je 0x4a620b
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebp
mov eax, dword [esi + 0x24]
mov dword [esp + 0x20], eax
jmp 0x4a61ca
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x20]
test eax, 0x2000000
je 0x4a61b3
test ecx, 0x2000000
je 0x4a61b3
or ecx, eax
mov dword [esp + 0x20], ecx
jmp 0x4a61be
or eax, ecx
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
sub ebp, edx
add ebp, eax
mov dword [esp + 0x1c], ebp
mov ecx, dword [edi]
mov eax, dword [esp + 0x10]
xor edx, edx
inc eax
mov dx, word [ecx + 6]
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x4a6131
mov eax, 1
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
push edi
call fcn.004a6260
add esp, 8
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x4b3e10
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4b3e59
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4b42d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50cc90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004b3e80
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004b3f00
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004b3f00
lea ecx, [esi + 0xc]
call fcn.004fe5ce
lea ecx, [esi + 0x10]
call fcn.004fe5ce
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004b5490
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004b5490
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004b5490
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004fe643
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004fe643
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4b5680
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4b56e6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4b56e6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4b56c7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4ba500
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x1661250]
xor edx, edx
cmp eax, edx
jne 0x4ba526
xor eax, eax
mov byte [eax + 0x1661150], al
inc eax
cmp eax, 0x100
jl 0x4ba50e
mov dword [0x1661250], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x1661150
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4ba5b7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4ba58a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4ba558
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4ba5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4ba613
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4ba5fa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c0fd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50d08e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004c18f0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x151f3cc
call fcn.004fe384
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4c1063
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004fe384
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4c105c
push 0
mov ecx, eax
call fcn.004b8140
mov dword [esi + 0xc], eax
jmp 0x4c1065
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4c1065
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4d2016
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x4d2137
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x4d211b
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x4d206d
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x4d204b
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x4d2b7f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x1522a44
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4d2bd6
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4d2bd6
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x4d2bd6
xor eax, eax
inc eax
jmp 0x4d2bd8
xor eax, eax
leave
ret 0x10

Function at 0x4d2c01
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push 0x1522a44
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4d2c6f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x152326c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4d2c66
cmp dword [ebp - 0xc], 4
jne 0x4d2c66
cmp dword [ebp - 0x10], edi
je 0x4d2c66
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1622310], edi
xor eax, eax
jmp 0x4d2cae
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1622310], edi
jge 0x4d2ca9
lea eax, [ebp - 0x34]
push eax
mov dword [0x1622310], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x4d2ca9
cmp word [ebp - 0x14], 5
jb 0x4d2ca9
call fcn.004d2bdc
test eax, eax
je 0x4d2ca9
emms
mov dword [0x1622310], 1
mov eax, dword [0x1622310]
pop edi
leave
ret

Function at 0x5009ea
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x500a22
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004fea9e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004fea76
jmp 0x500a2e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5020d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x50211a
call fcn.00507c51
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x50211a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x502111
xor eax, eax
jmp 0x502122
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00502128
pop edi
pop esi
pop ebx
ret 4
Function at 0x508181
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5081af
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5081cd
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005080e7
jmp 0x5081cd
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5081cd
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005080e7
test edi, edi
mov eax, edi
jne 0x5081b7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40be10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov edx, str._gbK_
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.0040ad60
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], ebx
je 0x40bece
xor esi, esi
push edi
lea esp, [esp]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 8]
push edx
push 0
xor ecx, ecx
push 2
test esi, esi
push 0
setne cl
push 0
push 0
push eax
mov dword [ebp - 8], 0
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40bec0
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test edx, edx
jne 0x40be81
lea eax, [edx + 0xd]
jmp 0x40beae
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40be86
sub eax, ebx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push 0x4410a0
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test edi, edi
je 0x40bec0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
inc esi
cmp esi, 2
jl 0x40be40
pop edi
lea esi, [eax - 0x10]
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bee8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + reloc.mscms.dll_GetStandardColorSpaceProfileA]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f21dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x68], esi
pushal
mov word [esp], dx
pushal
pushal
lea esp, [esp + 0x60]
jmp 0x4f2200
mov byte [esp + 0xc], bh
lea esp, [esp + 2]
jmp 0x4f21c5

Function at 0x4f21f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esi, 0xb2aeb2db
jmp 0x4f2375
push word [esp + 1]
push esp
call fcn.004f21dc
pushal
push word [esp + 0x1b]
pop dword [esp + 0xa]
pop word [esp + 0xd]
pop dword [esp + 6]
jmp 0x4f2264
mov esi, dword [esp + 0x28]
inc eax
jmp 0x4f228d
not bh
mov di, word [esp]
rdtsc
lea ebp, [esp]
xchg ch, dl
cpuid
rdtsc
jmp 0x4f22c4
mov bp, dx
mov cl, byte [esp]
jmp 0x4f2223
mov dword [esp + 0x7c], edi
lea esp, [esp + 0x7c]
pushfd
mov cl, 0xda
mov si, word [esp]
jmp 0x4f224c
rdtsc
jmp 0x4f2236
jno 0x4f222e
not bh
mov di, word [esp]
jmp 0x4f2275
neg cx
jnp 0x4f2300
jp 0x4f2300
lea ecx, [ecx + 0xd3]
push esp
push word [esp + 1]
mov eax, dword [esp + 1]
lea esp, [esp + 2]
mov edx, esi
jmp 0x4f2344
sub esp, 0xc0
mov edi, esp
jmp 0x4f22cb
rcr bx, cl
mov bl, bh
jmp 0x4f232d
pushal
jmp 0x4f21e6
shr cx, cl
jo 0x4f2322
rcr bx, cl
mov bl, bh
pushal
jmp 0x4f21e6
lea ecx, [esp + ebp]
mov eax, esi
xchg ah, bl
xchg ecx, eax
call fcn.004f239b
out 0x87, eax
or al, 0x24
lea ebx, [eax + edx]
bswap ebx
rcl bx, cl
neg bx
shr ebx, 0xd
jmp 0x4f24fb
lea esp, [esp + 2]
push dword [esp + 0x1c]
ret 0x20
xchg dword [esp], ecx
pushal
neg bl
pop cx
xchg word [esp + 5], cx
mov bl, byte [esp + 9]
jmp 0x4f23eb
lea ecx, [ecx - 0x2f]
bsr bx, bp
mov bx, word [esp]
shl bl, 5
inc ebx
mov ebx, 0x41f0265a
jmp 0x4f242f

Function at 0x4f80a9
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4f6b71
pop ecx
sub ecx, 0x1001277e
mov dword [ecx + reloc.WINMM.dll_waveOutClose], eax
jmp 0x4f6bf9
movzx ebx, byte [eax]
add ebx, 0xb9fc8678
cmp ebx, 0xb9fc8744
jmp 0x4f6cfa
call 0x4f6c66
jmp 0x4f806a
je 0x4f6c66
jne 0x4f64b6
popfd
ret
pop eax
sub eax, 0x4bcea33b
jmp 0x4f8097
inc dword [esp + 8]
jmp 0x4f93f3
call 0x4f80a9
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
dec ecx
dec esp
fbld tbyte [esi]
push ecx
jne 0x4f8081
pushal
jmp 0x4f6c61
popfd
ret

Function at 0x5122aa
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutClose]
cmc
pushal
jmp 0x512276
mov bh, byte [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 4], edx
stc
call fcn.005121ba
lea esp, [esp + 0x14]
and edi, 0xff000000
xor ecx, edi
jmp 0x51228b
mov word [esp + 0xc], bx
lea esp, [esp + 2]
jmp 0x512237
lea esp, [esp + 0x54]
and ecx, 0xff0000
sub esp, 0x12
mov word [esp + 0xa], dx
push esp
jmp 0x51225b
pushal
lea esi, [edx*4]
mov ebp, ecx
ror esi, 7
lea ebx, [esp + ebx]
mov dword [esp], edx
call fcn.00512245
xlatb
dec edx
fdivr dword [edi + 0x216bfa4a]
idiv ecx
jmp 0x51220e
mov word [esp], bx
jmp 0x51233f
lea esp, [esp + 0xc]
movzx edi, byte [edi*4 + 0x4ef3a8]
cmc
call fcn.005123ce
or esp, dword [edx + reloc.WINMM.dll_waveOutClose]
mov edi, dword [esp]
pushal
lea ecx, [edi*4]
push esp
push word [esp + 1]
jmp 0x512225
Function at 0x5122d9
Capabilities:
Encrypt data using aes

Disassembly:
pop dword [esp + 2]
lea esp, [esp + 8]
popal
call fcn.005122b2
add esp, 3
jmp 0x5122e2
lea esp, [esp + 1]
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
call fcn.00512302
outsd dx, dword [esi]
in al, dx
bound eax, qword [0xf97b30f4]
imul ecx, dword [eax], reloc.WINMM.dll_waveOutClose
jmp 0x5122cb

Function at 0x51231e
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutClose]
cmc
pushal
jmp 0x512276
mov bh, byte [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 4], edx
stc
call fcn.005121ba
lea esp, [esp + 0x14]
and edi, 0xff000000
xor ecx, edi
jmp 0x51228b
mov word [esp + 0xc], bx
lea esp, [esp + 2]
jmp 0x512237
lea esp, [esp + 0x54]
and ecx, 0xff0000
sub esp, 0x12
mov word [esp + 0xa], dx
push esp
jmp 0x51225b
pushal
lea esi, [edx*4]
mov ebp, ecx
ror esi, 7
lea ebx, [esp + ebx]
mov dword [esp], edx
call fcn.00512245
xlatb
dec edx
fdivr dword [edi + 0x216bfa4a]
idiv ecx
jmp 0x51220e
mov word [esp], bx
jmp 0x51233f
lea esp, [esp + 0xc]
movzx edi, byte [edi*4 + 0x4ef3a8]
cmc
call fcn.005123ce
or esp, dword [edx + reloc.WINMM.dll_waveOutClose]
mov edi, dword [esp]
pushal
lea ecx, [edi*4]
push esp
push word [esp + 1]
jmp 0x512225

Function at 0x512a77
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x512ab1

Function at 0x512caf
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
sub esp, 0x1e
jmp 0x512c9d
push edx
lea esp, [esp + 2]
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
call 0x512caf
mov word [esp], ax
jmp 0x512d16
mov edx, dword [esi + 4]
cmc
mov dword [esi], edi
jmp 0x512d25
lea esp, [esp + 1]
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
mov edx, dword [esp]
jmp 0x512cdb
and edx, ecx
push edx
pop word [esp]
add esp, 1
lea esp, [esp]
jmp 0x512cf9
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
btc edi, edi
lea edi, reloc.WINMM.dll_waveOutClose
call fcn.00512ce3
imul esi, esp, 0x6a
or eax, 0xe17f48fc
jno 0x512d54
jecxz 0x512d69
mov al, byte [0x21751ae3]
retf
and ah, byte [ecx]
iretd
Function at 0x512d71
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutClose]
jmp 0x512ddc
lea ebx, [ebx*4]
lea ebx, reloc.WINMM.dll_waveOutClose
mov edi, dword [ebx]
pop ebx
jmp 0x512dbb
mov bl, 0x32
bsf bx, ax
bsf bx, ax
lea esp, [esp + 0x18]
movzx ebx, byte [esi + 6]
jmp 0x512de3
and ebx, ecx
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
sub esp, 0x18
jmp 0x512d99
and edi, ecx
push ebx
mov ebx, edi
jmp 0x512d7b
sub esp, 0xe
mov word [esp + 8], di
add esp, 0xd
push esp
lea esp, [esp + 1]
jmp 0x512e1d
and ebx, ecx
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
mov bl, bh
jmp 0x512efe
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
jmp 0x512df5
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
and edx, ecx
sub esp, 0x12
lea esp, [esp + 2]
jmp 0x512eb5
sub esp, 0
stc
and edx, ecx
stc
jmp 0x512e4b
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
mov edi, edx
stc
pushal
jmp 0x512edc
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
lea edi, [edi*4]
lea edi, [ebx + edi]
mov edi, dword [esp]
jmp 0x512e74
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + reloc.WINMM.dll_waveOutClose]
clc
or edx, ebp
jmp 0x512e99
push dword [esp + 6]
shr edi, 0x18
sub esp, 0
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutClose]
call fcn.00512e81
jmp 0x6fee245c
lea ebx, [ebp + 0x67]
stc
mov bx, 0x2b51
movzx ebx, byte [esi + 9]
clc
jmp 0x512e6b

Function at 0x512e81
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x512ec5
and edi, ecx
jmp 0x512f10
pushal
push word [esp + 0x17]
push edx
lea esp, [esp + 2]
jmp 0x512e83
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutClose]
and ebx, ecx
lea esp, [esp + 0x4c]
jmp 0x513f6f
push esp
jmp 0x513580
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutClose]
mov bx, 0x6561
mov bl, byte [esp]
not ebx
movzx ebx, byte [esi + 0xa]
jmp 0x512f22

Function at 0x6252b6
Capabilities:
Parse pe header

Disassembly:
push dword [esp]
lea esp, [esp + 0x1d]
pop word [esp]
push edx
push dword [esp + 4]
jmp 0x6252d2
pushal
pushal
lea esp, [esp + 0x48]
pushal
jmp 0x6252a0
lea esp, [esp + 8]
lea esp, [esp]
pop word [esp]
lea esp, [esp + 3]
jmp 0x6252f7

Function at 0x62530d
Capabilities:
Parse pe header

Disassembly:
call int.00624174
lea esp, [esp + 3]
mov dword [esp + 0x70], esi
call fcn.006252cd
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
jmp 0x625313
lea esp, [esp + 4]
jmp 0x6252ea
mov eax, dword fs:[0x30]
jmp 0x625823
mov eax, dword [eax + 8]
push eax
jmp 0x62416f
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x625400