joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a8e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45aa0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x64
call fcn.00402730
mov ebx, eax
push ebx
push 0x64
call sub.kernel32.dll_GetTempPathA
mov eax, 0x49ac08
mov edx, ebx
call fcn.00404580
mov eax, ebx
call fcn.00402750
xor eax, eax
push ebp
push 0x45a9c7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
lea edx, [ebp - 8]
mov eax, dword [0x499df0]
mov eax, dword [eax]
call fcn.004599e0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4130c0]
call fcn.00416f80
mov dword [0x49ac00], eax
push 0
push 0x50
mov eax, dword [0x49ac00]
call fcn.00416aec
lea edx, [ebp - 4]
mov ecx, 4
mov eax, dword [0x49ac00]
call fcn.00416cf8
mov eax, dword [ebp - 4]
cdq
push edx
push eax
mov eax, dword [0x49ac00]
call fcn.00416aec
lea edx, [ebp - 4]
mov ecx, 4
mov eax, dword [0x49ac00]
call fcn.00416cf8
cmp dword [ebp - 4], 0x22322
sete byte [0x49ac04]
cmp dword [ebp - 4], 0x111111
jne 0x45a9bb
mov bl, 1
jmp 0x45a9bd
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a9f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45aa11
lea eax, [ebp - 8]
call fcn.00404388
ret

Function at 0x46169c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
cmp byte [0x49ae10], 0
je 0x4616b5
mov eax, 6
jmp 0x461771
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x46176c
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x461721
dec ecx
jne 0x461765
cmp eax, 4
jg 0x4616ef
mov eax, 4
jmp 0x461771
cmp eax, 5
jne 0x4616ff
test edx, edx
jne 0x4616ff
mov eax, 5
jmp 0x461771
cmp eax, 5
jne 0x46170e
dec edx
jne 0x46170e
mov eax, 6
jmp 0x461771
cmp eax, 5
jle 0x46171a
mov eax, 7
jmp 0x461771
mov eax, 0xf423f
jmp 0x461771
cmp eax, 4
jne 0x46172e
test edx, edx
jne 0x46172e
xor eax, eax
jmp 0x461771
cmp eax, 4
jne 0x46174d
cmp edx, 0xa
jne 0x46174d
cmp byte [esp + 0x15], 0x41
jne 0x461746
mov eax, 2
jmp 0x461771
mov eax, 1
jmp 0x461771
cmp eax, 4
jne 0x46175e
cmp edx, 0x5a
jne 0x46175e
mov eax, 3
jmp 0x461771
mov eax, 0xf423f
jmp 0x461771
mov eax, 0xf423f
jmp 0x461771
mov eax, 0xf423f
add esp, 0x94
ret

Function at 0x479f20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
cmp ebx, 0xff
jle 0x479f42
push ebx
call sub.user32.dll_GetAsyncKeyState
movzx eax, ax
shr eax, 0xf
and eax, 1
cmp eax, 1
sete al
pop ebx
ret
cmp byte [ebx + 0x49afa0], 0
jne 0x479f82
push ebx
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
mov edx, eax
and edx, 1
cmp edx, 1
jne 0x479f67
mov byte [ebx + 0x49afa0], 1
jmp 0x479f82
shr eax, 0xf
and eax, 1
cmp eax, 1
jne 0x479f7b
mov byte [ebx + 0x49afa0], 1
jmp 0x479f82
mov byte [ebx + 0x49afa0], 2
cmp byte [ebx + 0x49afa0], 1
sete al
pop ebx
ret
Function at 0x479f90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov eax, 0x49afa0
mov edx, pe_nt_image_headers32
call fcn.004070e0
xor ebx, ebx
push ebx
call sub.user32.dll_GetAsyncKeyState
inc ebx
cmp ebx, 0x100
jne 0x479fa2
pop ebx
ret

Function at 0x47d19c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47d1ca
mov eax, ebx
call fcn.0047dc50
cmp dword [ebx + 0x40], 0
je 0x47d1c3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47d23b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47d22d
cmp dword [ebx + 8], 0
je 0x47d1ec
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47d1fe
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47d22d
cmp dword [ebx + 8], 0
je 0x47d1df
cmp eax, 3
je 0x47d211
dec eax
jne 0x47d1df
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47d1df
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47d1df
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47d259
cmp dword [ebx + 0x14], 0xcc
je 0x47d259
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047d264
pop ebx
ret
Function at 0x403f80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push edi
mov ebx, 0xf003f
push eax
push ebx
push 0
mov edi, SysReAllocStringLen
push str..DefaultControl_PaneldesktopResourceLocale
push edi
mov dword [ebp - 0xc], 0xa
call esi
test eax, eax
jne 0x403fd5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x407430
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404030
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push ebx
push 0
push str..DEFAULTControl_PanelInternational
push edi
call esi
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x40400a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push edi
push str.Locale
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp dword [ebp - 8], edi
je 0x404018
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x404032
cmp dword [ebp - 4], edi
je 0x40402a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, 0x409
jmp 0x40404f
xor edi, edi
lea eax, [ebp - 0x18]
push eax
call fcn.004048c0
cmp dword [ebp - 4], edi
pop ecx
mov esi, eax
je 0x40404c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, si
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401010
Capabilities:
Get common file path

Disassembly:
push edi
sub esp, 0x200
push esp
pop edi
push 0x100
push edi
call sub.KERNEL32.dll_GetSystemDirectoryA
lea edx, [edi + 0x7c]
xor ecx, ecx
push ecx
push ecx
push ecx
push edx
push ecx
push edi
add edi, eax
mov eax, 0x69636d5c
stosd dword es:[edi], eax
mov eax, 0x65766177
stosd dword es:[edi], eax
mov eax, 0x6c6c642e
stosd dword es:[edi], eax
xor eax, eax
stosd dword es:[edi], eax
call sub.KERNEL32.dll_FindFirstFileExA
add esp, 0x200
pop edi
cmp eax, 1
jg 0x401058
int3
pushal
jmp fcn.00401290

Function at 0x4015b0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
lea edx, [ebx - 0x38]
push edx
push ebx
mov ebx, esp
push ebx
push 0x2b
add dword [esp], 0x15
push 0xfffffe7c
add dword [esp], 0xaec
mov ebx, section..data
push ebx
sub ebx, ebx
dec ebx
and ebx, sym.imp.KERNEL32.dll_VirtualProtect
call dword [ebx]
pop edx
pop edx
mov esi, 0x403400
mov dword [edx + 0x7c], esi
lea edi, [esi - 0x98]
lea ebx, [0x4020f9]
xor ecx, ecx
mov eax, dword [ebx]
add ebx, 3
inc ebx
push eax
pop dword [edi + 0x98]
add edi, 4
xor dword [edi + 0x94], 0x4ae37c43
nop
sub dword [edi + 0x94], 0x4eac6723
add ecx, 4
cmp ecx, 0x568
jne 0x4015f6
push edx
lea ebx, [edx - 0x12c]
push 0
push 0
push ebx
call sub.KERNEL32.dll_LoadLibraryExA
test eax, eax
jne 0x401627
pop edx
pop ebp
ret 0x10
Function at 0x43515a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x435168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x43514a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x435145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x435145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5a9628
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], ch
xchg dword [esp + 4], edi
call fcn.005a95f0
xchg dword [esp + 4], edi
call fcn.005a9672
pushfd
push dx
call 0x5a9628
jmp 0xb7f0ab4

Function at 0x5a96fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf059afec
jmp 0x5a96b2
jmp 0x5a96ee
mov edi, dword [esp + 0x2c]
jmp 0x5a96be
mov dh, 0x27
call fcn.005a96fa
mov eax, dword [esp + 0xc]
lea esp, [esp + 1]
call fcn.005a9745
ficomp word [esi - 0x34]
stosd dword es:[edi], eax
mov byte [0x6621362f], al
mov dword [esp + 1], ebx
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
pushfd
jmp 0x5a95d4
xchg si, dx
not ebx
rcl bl, 6
jbe 0x5a96b4
ja 0x5a96b4
sub esp, 0x15
jle 0x5a96c5
mov eax, dword [esp + 0xc]
jmp 0x5a979f
lea esi, [esp + 0x18]
jmp 0x5a9806
lea esp, [esp + 1]
jmp 0x5a9772
mov ebp, esp
sub esp, 2
jge 0x5a982c
lea esp, [esp]
bsf bx, si
pushfd
jmp 0x5a9831
bswap eax
pushfd
mov dword [esp], eax
mov ecx, ebp
sub esp, 0xa4
jmp 0x5a97f0
bsf bx, si
pushfd
lea esp, [esp + 2]
mov ebx, edi
dec ah
jmp 0x5a9878
lea esp, [esp]
jmp 0x5a9816
lea esp, [esp + 2]
jmp 0x5a981f
neg cx
rcl ax, 0xb
sub esp, 4
add esp, 3
pushfd
jg 0x5a9837
neg cx
rcl ax, 0xb
jmp 0x5a9862

Function at 0x5a9e4e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0x2007024e
jmp 0x5aa12c
add eax, 0xb514bb1c
jmp 0x5aa1bb
mov ah, byte [esp + 1]
adc edx, esi
jnp 0x5a9e66
push dx
call fcn.005a9e87
aaa
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
push ds
dec ebx
jmp 0x5a9e38
push dx
sub esp, 0x1b
jmp 0x5aa077
pop dword [esp + 0x12]
lea eax, [edi + 0xe5]
lea esp, [esp + 1]
lea esp, [esp + 0x1c]
sub cl, 0x7a
call fcn.005a9f6a
lea eax, [esp - 0x29]
mov eax, dword [esp]
dec edx
js 0x5aa104
rdtsc
bsf ax, si
jmp 0x5aa0dc
jmp 0x5aa0ed
setb dh
mov ah, 0x98
jmp 0x5aa0bf
mov eax, ecx
mov dx, word [esp]
sub esp, 0x1c
jno 0x5aa11e
jo 0x5aa108
sbb eax, 0x95660393
and dword [esi + reloc.WINMM.dll_midiStreamOut], edx
adc eax, 0xc6bc0f66
bsf ax, si
not cl
neg ax
jge 0x5aa0b1
mov edx, dword [esp]
jmp 0x5aa0b3
mov edx, dword [esp]
setb dh
mov ah, 0x98
jmp 0x5aa0bf
rdtsc
jmp 0x5aa0d8
mov edx, ecx
xchg dword [esp + 6], edx
jmp 0x5aa124
mov edx, ecx
xchg dword [esp + 6], edx
shl eax, 2
setne dh
jmp 0x5aa19b
shr dx, cl
jae 0x5aa16c
jb 0x5aa154
inc edi
rol byte [eax + 0x27], cl
shl byte [ebx + ecx*8 + 0x57], cl
invalid
add edx, 0x90afc8c3
lea edx, [eax + 0xe6]
jmp 0x5aa178
add edx, 0x90afc8c3
lea edx, [eax + 0xe6]
mov eax, dword [eax - reloc.WINMM.dll_midiStreamOut]
mov edx, 0x670a0b7d
jmp 0x5aa1a8
mov dx, 0x50c3
mov dx, 0x8211
jmp 0x5a969a
lea edx, [edx - 7]
not dl
mov edx, dword [esp]
jmp 0x5a962e
rcr dx, 0xb
jae 0x5aa185
mov dx, 0x50c3
mov dx, 0x8211
jmp 0x5a969a
jmp 0x5aa22c
push bp
mov dx, 0xef0e
lea edx, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 2]
call fcn.005aa35d
movsb byte es:[edi], byte [esi]
mov esp, ebp
mov edx, ebp
jmp 0x5aa1e5
mov dh, 0x4e
bsr dx, sp
jns 0x5aa1fb
js 0x5aa1fb
xchg dword [esp + 0x18], esi
mov dh, 0xf8
ror dx, cl
ror dx, cl
push dword [esp + 0x18]
ret 0x1c
Function at 0x5aa052
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ecx*4]
lea esp, [esp + 8]
add cl, 0xc1
jmp 0x5aa1d1
setb dl
rdtsc
jmp 0x5aa14b
xchg dx, ax
setb dl
rdtsc
not cl
mov dh, bh
jmp 0x5aa091
mov dl, ch
btr dx, cx
je 0x5aa143
xchg dx, ax
jmp 0x5aa0a7

Function at 0x5daf61
Capabilities:
Encrypt data using aes

Disassembly:
mov bp, 0x5c71
lea ebp, [ecx*4]
jmp 0x5daf6d
mov si, word [esp + 3]
mov dword [ecx + 4], edx
mov dh, cl
jmp 0x5daf4b
push ebx
mov ebx, eax
jmp 0x5dafa6
movzx esi, byte [eax + 9]
mov edi, ebp
jmp 0x5dafe0
add ebx, 8
movzx edx, byte [ebx]
pop ebx
jmp 0x5daf90
xchg di, si
push esi
xchg di, si
push dword [esp + 1]
jmp 0x5dafed
shl edx, 8
not bl
mov di, word [esp]
xor edx, esi
jmp 0x5dafca
push ecx
mov ecx, eax
add ecx, 0xa
jmp 0x5daff9
movzx esi, byte [ecx]
pop ecx
inc ebx
mov bh, 0xb3
mov bh, 0xb6
dec bl
jmp 0x5db3e3
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
bswap ebp
mov ebp, dword [esp]
jmp 0x5db069
lea esp, [esp + 3]
xor edx, esi
mov bl, dl
inc edi
xchg edi, esi
jmp 0x5db028
shl edx, 8
mov bl, 0xef
jmp 0x5db079
movzx esi, byte [eax + 0xd]
dec bh
mov ebx, dword [esp]
or ebx, ebp
mov ebx, dword [esp]
jmp 0x5db053
xor edx, esi
neg bh
dec bh
movzx esi, byte [eax + 0xe]
jmp 0x5db0c1
shl edx, 8
lea edi, [ecx + ecx]
mov ebx, eax
sub esp, 0x1f
pop dword [esp + 7]
jmp 0x5db046
shl edx, 8
jmp 0x5db0eb
lea edi, reloc.WINMM.dll_midiStreamOut
movzx eax, byte [eax + 0xf]
lea edi, reloc.WINMM.dll_midiStreamOut
rol edi, cl
jmp 0x5db0ab
sub esp, 7
lea esp, [esp + 3]
jmp 0x5db10d
xor edx, esi
mov ebx, esp
shl edx, 8
mov bh, byte [esp]
jmp 0x5db0d5
stc
jmp 0x5db11d
xor edx, eax
bswap ebx
mov dword [ecx + 0xc], edx
lea ebx, [ecx*4]
jmp 0x5db0f7
pushal
sub esp, 1
inc bl
lea esp, [esp + 1]
mov dword [esp + 0x1c], edx
jmp 0x5db25a
xor edx, esi
lea ebp, reloc.WINMM.dll_midiStreamOut
movzx esi, byte [eax + 0xb]
lea edi, [edx + ebx]
jmp 0x5db09a
mov eax, dword [eax*4 + reloc.WINMM.dll_midiStreamOut]
lea esp, [esp + 0x48]
xor eax, 0x1000000
call fcn.005db149
add al, 0x98
push cs
imul ebx, dword [eax + reloc.WINMM.dll_midiStreamOut], 0x6449ff0c
xchg edi, eax
dec cl
push 0xec83f021
adc eax, 0x66393c8d
pop ebp
and eax, esi
sub esp, 0x15
lea edi, [ecx + edi]
pop bp
lea esp, [esp + 3]
jmp 0x5db15f
popal
mov bx, sp
shr eax, 0x10
mov esi, 0xff
jmp 0x5db185
shl edx, 8
sub esp, 1
mov ebp, 0xba593845
mov ebx, dword [esp]
lea esp, [esp + 1]
jmp 0x5db135

Function at 0x5db338
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
popal
jmp 0x5db372
add edi, 0x14
mov dword [edi], ebx
pop edi
mov dword [ecx + 0x18], eax
mov bx, 0x808a
jmp 0x5db35c
Function at 0x5db459
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
jmp 0x5db461
and edx, esi
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 0xf
lea esp, [esp + 3]
jmp 0x5db4a6
lea eax, [eax*4]
lea eax, reloc.WINMM.dll_midiStreamOut
movzx edi, byte [eax]
jmp 0x5db4ae
shr edi, 0x18
push eax
mov eax, edi
jmp 0x5db490
pop eax
xor ecx, edi
and edx, ebp
mov edi, dword [esp]
jmp 0x5db4bc
xor ecx, edx
lea edx, [ecx*4]
lea edi, [edi*4]
jmp 0x5db501
lea edi, [eax + 0x10]
shr dx, cl
xor ecx, dword [eax]
mov dx, 0xe53f
jmp 0x5db526
lea esp, [esp + 0x10]
xor ecx, dword [ebx]
setb dh
not dl
not edx
jmp 0x5db4e0
pushal
jmp 0x5db571
mov edx, edi
mov dh, 0x1d
mov edx, ebx
add ebx, 4
rol dh, cl
jmp 0x5db510
mov dword [edi], ecx
sub esp, 0x14
xchg word [esp + 0xa], dx
mov edx, dword [eax + 4]
jmp 0x5db551

Function at 0x5db7c5
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x5db825
mov bh, 0xda
pop bx
lea esp, [esp + 1]
jmp 0x5db866
lea esp, [esp + 4]
jle 0x59c4b5
lea ecx, [eax - 1]
sub esp, 0x1f
jmp 0x5db809
lea esp, [esp + 0x1c]
jmp 0x59c495
mov dword [ebx], ecx
pop ebx
mov ecx, 0xff
jmp 0x5db837
push ebx
mov ebx, ebp
add ebx, 0xfffffffc
jmp 0x5db84d

Function at 0x5db901
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 3
lea esp, [esp + 1]
jmp 0x5db962
and ebx, ecx
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov bl, al
jmp 0x5db987
add edx, 2
movzx ebx, byte [edx]
pop edx
sub esp, 0xd
pop dword [esp + 4]
jmp 0x5db971
and edi, ecx
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
pushfd
mov dword [esp], edi
jmp 0x5db93a
add esp, 1
mov byte [esp + 4], dl
jmp 0x5db996
bsr bx, dx
sub ebx, 0xe8b40d33
push edx
mov edx, esi
jmp 0x5db94b
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
stc
and ebx, ecx
jmp 0x5db9d1

Function at 0x5dba74
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
push eax
mov word [esp], dx
jmp 0x5dbb6f
pushal
sub esp, 8
mov dword [esp + 0x1c], esi
lea esp, [esp + 8]
popal
jmp 0x5dbade
mov bx, 0x8398
sub esp, 0x18
mov ebx, dword [esp + 0xc]
lea ebx, [ecx + edi]
push edx
jmp 0x5dbaa1
sub esp, 0
pushfd
jmp 0x5dbb12
add edx, 6
movzx ebx, byte [edx]
pop edx
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x5dbac8
add bl, ch
fimul dword [edi]
mov dh, 0x5e
or dword [ecx], esp
retf 0xe89c
movzx ebx, byte [esi + 9]
and edx, ecx
pushfd
call 0x5dbafb
and dword [ebx + reloc.WINMM.dll_midiStreamOut], ecx
pop edx
add bl, ch
popal
loop 0x5dbb77
pop ss
loop 0x5dbb61
mov eax, dword [reloc.WINMM.dll_midiStreamOut]
jmp 0x5dbaeb
and ebx, ecx
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x5dbaee
stosb byte es:[edi], al
push ds
dec ebp
iretd
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x5dbab7
retf
Function at 0x5dbbc7
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x17
mov dword [esp + 0x10], edx
jmp 0x5dbbf2
lea esp, [esp + 3]
and edi, ecx
push edx
jmp 0x5dbc99
and ebx, ecx
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x5dbc58
popal
add eax, 0xa
movzx ebx, byte [eax]
pop eax
call fcn.005dbc28
pop eax
retf 0x3f58
push eax
pushal
mov ah, 0x3e
mov dword [esp + 0x1c], esi
jmp 0x5dbc3e
mov edx, edi
lea edx, [edx*4]
lea edx, reloc.WINMM.dll_midiStreamOut
mov edi, dword [edx]
pop edx
jmp 0x5dbbfe

Function at 0x5dbd31
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 2], bh
clc
pop word [esp]
lea esp, [esp + 2]
jmp 0x5dbd53

Function at 0x5dbddd
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0xc]
jmp 0x5dbe47
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
call fcn.005dbe74
mov eax, dword [edi]
xchg edi, eax
add dword [esi + reloc.WINMM.dll_midiStreamOut], edi
mov eax, 0x5951f7b
insb byte es:[edi], dx
lahf
test byte cs:[edi], dh
push ds
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov bx, word [esp]
movzx ebx, byte [esi + 0xe]
sub esp, 0x14
add esp, 0xe
jmp 0x5dbe22

Function at 0x5dbe74
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
jmp 0x5dbec0
push word [esp + 1]
mov word [esp + 3], dx
lea esp, [esp + 2]
jmp 0x5dbe5e
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 0x19
lea esp, [esp + 1]
and ebx, ecx
call fcn.005dbeaa
inc eax
rol byte [esi + 0x21], 1
shl byte [edx - 0x22], 1
dec ebp
frstor dword [edi + edx*2 + reloc.WINMM.dll_midiStreamOut]
sub esp, esi
push edi
scasd eax, dword es:[edi]
Function at 0x5dbeaa
Capabilities:
Encrypt data using aes

Disassembly:
rol bx, 8
mov edi, dword [esp]
xchg edx, edi
jmp 0x5db896
jmp 0x5dbf3a
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov edi, ebp
xchg edi, edx
sub esp, 0x1f
pop dx
jmp 0x5db8aa
movzx ebx, byte [esi + 0x11]
mov dh, 0x59
push ebx
push word [esp + 1]
mov dh, bh
lea esp, [esp + 2]
jmp 0x5db871
lea esp, [esp + 1]
lea esp, [esp + 0x20]
add esi, 0x10
inc edi
jmp 0x5db8f4
xchg bl, ch
mov dword [esp], edx
popal
sub esp, 0x11
pop word [esp + 2]
jmp 0x5db9bf
mov edx, dword [esi]
stc
pushal
lea ebx, [edi*4]
jmp 0x5db8de
and edx, ecx
call fcn.005dc56d
mov eax, dword [esp]
not bh
sub esp, 0x12
add esp, 6
mov dword [esp + 0xc], edx
call fcn.005dc060
pop ebx
mov dl, 0x8d
and al, 3
lea esp, [esp + 3]
shr edi, 0x18
sub esp, 0
sub esp, 0x11
call fcn.005db933
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov ebx, dword [esp]
mov bl, 0x34
movzx ebx, byte [esi + 5]
jmp 0x5db9a2
jmp 0x5dbf9a
push word [esp + 8]
lea esp, [esp + 2]
jmp 0x5dbf60
lea esp, [esp + 4]
dec dword [ebp - 4]
push esp
push dword [esp + 2]
push dword [esp + 3]
jmp 0x5dbef8
and edx, ecx
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
push ebp
mov word [esp], dx
jmp 0x5dbf0e
mov edi, dword [esp]
pushfd
lea esp, [esp + 8]
pop esi
setne bl
jmp 0x5dbf73
mov dword [esi + 0xc], edi
lea esp, [esp + 0xc]
jne 0x59c495
je 0x59c4b5
mov bh, byte [esp]
mov ebx, 0xfe73c3dd
mov bx, 0x4a66
add esp, 0
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 1
lea esp, [esp + 1]
jmp 0x5dbf2a

Function at 0x5ded2f
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
mov dword [eax + 8], 0x67452301
jmp 0x5dec43

Function at 0x5e5e03
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esi + 0x18], 0
jmp 0x5e5e23
mov word [esp], bp
lea esp, [esp + 4]
jmp 0x5e5ded
jbe 0x5e578a
ja 0x5e586a
mov eax, dword [ebp - 0x10]
pushfd
mov dx, 0x48a0
jmp 0x5e5e6b
mov ecx, dword [ebp - 4]
push ebp
mov ebp, ecx
jmp 0x5e5e55

Function at 0x5e6c4b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
mov byte [esp], bh
pop word [esp]
push word [esp + 1]
jmp 0x5e6cc5

Function at 0x5e6cd1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
dec cl
jmp 0x5e6d3c
inc cl
sub esp, 0xb
cmc
jbe 0x5e6d0d
ja 0x5e6d0d

Function at 0x6ac847
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov di, 0x3160
mov dx, sp
mov dh, bl
mov edx, eax
ror ah, 0
jmp 0x6ac84e
not edx
std
not dh
jmp 0x6ac831
push bp