joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430090
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4377c8
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea eax, [esp + 4]
push ebx
push eax
push 1
push 0
push str.SOFTWAREOZ_Development
mov ebx, ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43018a
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [ebx + 0x22c]
mov dword [esp + 0x18], 0
test eax, eax
jne 0x4300f7
push str.LicenseKey
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_2
jmp 0x43010a
push eax
lea ecx, [esp + 8]
push str.LicenseKey_04X
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
push 0
push 0
push 0
push eax
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x43016d
inc eax
push esi
push eax
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0xc]
push edx
push esi
push 0
push 0
push eax
push ecx
call edi
test eax, eax
jne 0x430163
push esi
lea ecx, [ebx + 0xd0]
call sub.MFC42.DLL_CString::operator_2
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop esi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
mov ecx, dword [esp + 0x10]
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4301a0
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4377f6
push eax
mov dword fs:[0], esp
sub esp, 0xd4
lea eax, [esp + 4]
push esi
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREOZ_Development
mov esi, ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x430294
lea ecx, [esp + 0xc]
call fcn.00402f30
lea ecx, [esp + 4]
mov dword [esp + 0xe0], 0
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [esi + 0x22c]
mov byte [esp + 0xe0], 1
test eax, eax
jne 0x430229
push str.LicenseKey
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_2
jmp 0x43023c
push eax
lea ecx, [esp + 8]
push str.LicenseKey_04X
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00403ad0
mov eax, dword [esi + 0xd0]
mov edx, dword [esp + 4]
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x10]
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 4]
mov byte [esp + 0xe0], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0xe0], 0xffffffff
call fcn.004031b0
mov ecx, dword [esp + 0xd8]
pop esi
mov dword fs:[0], ecx
add esp, 0xe0
ret
Function at 0x4302b0
Capabilities:
Access peb ldr_data
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x437838
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_4
lea eax, [esi + 0xc4]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x34], 0
call fcn.00432ada
push 0x445e70
push 0x442030
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Replace
push 0
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push 0
push 0x4459dc
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [esi + 0x22c]
push 4
test eax, eax
push 8
jne 0x4303d3
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Mid
mov edi, eax
push 4
lea edx, [esp + 0x1c]
push 4
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::Mid
mov ebp, eax
push 4
lea eax, [esp + 0x18]
push 0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 2
call sub.MFC42.DLL_CString::Mid
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
mov edx, ecx
add esi, 0xd4
and edx, 0xffff
mov byte [esp + 0x30], 3
shr ecx, 0x10
push edx
mov edx, dword [ebp]
push ecx
mov ecx, dword [edi]
push ecx
push edx
push eax
push str._s__s__s__04X__04X
push esi
call sub.MFC42.DLL_CString::Format
add esp, 0x1c
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x30], 0
lea ecx, [esp + 0x1c]
jmp 0x43046d
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Mid
mov edi, eax
push 4
lea edx, [esp + 0x1c]
push 4
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 4
call sub.MFC42.DLL_CString::Mid
mov ebp, eax
push 4
lea eax, [esp + 0x20]
push 0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call sub.MFC42.DLL_CString::Mid
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x22c]
mov eax, dword [eax]
and ecx, 0xffff
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [ebp]
push ecx
push edx
push eax
add esi, 0xd4
push str._s__s__s_Z8_02X__04X
push esi
mov byte [esp + 0x4c], 6
call sub.MFC42.DLL_CString::Format
add esp, 0x1c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x30], 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x4304a0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
mov eax, dword [esi + 0x8c]
push ecx
push 0x4304f0
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [esp + 8]
push 0
mov dword [esi + 0x17c], edx
mov eax, dword [0x4469dc]
push 1
push eax
mov ecx, esi
call fcn.00430600
pop esi
add esp, 8
ret
Function at 0x430a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4378df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
xor esi, esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], esi
call sub.MFC42.DLL_CString::CString_4
mov ebp, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], 1
mov edi, ecx
test edi, edi
jle 0x430b19
cmp esi, edi
jge 0x430b19
mov al, byte [esi + ebp]
cmp al, 0xd
je 0x430a5f
cmp al, 0xa
jne 0x430a6a
inc esi
cmp esi, edi
jge 0x430b19
jmp 0x430a54
cmp esi, edi
jge 0x430b19
movsx eax, byte [esi + ebp]
movsx edx, byte [esi + ebp + 1]
mov cl, byte [eax + 0x445a00]
mov al, byte [edx + 0x445a00]
sar al, 4
shl cl, 2
and al, 3
add cl, al
mov byte [esp + 0x30], cl
mov ecx, dword [esp + 0x30]
push ecx
lea ecx, [esp + 0x10]
call fcn.00432d9e
mov al, byte [esi + ebp + 2]
cmp al, 0x3d
je 0x430adb
movsx ecx, byte [esi + ebp + 1]
movsx edx, al
mov al, byte [edx + 0x445a00]
mov dl, byte [ecx + 0x445a00]
sar al, 2
and al, 0xf
lea ecx, [esp + 0xc]
shl dl, 4
add al, dl
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x10]
push eax
call fcn.00432d9e
mov al, byte [esi + ebp + 3]
cmp al, 0x3d
je 0x430b0e
movsx ecx, byte [esi + ebp + 2]
movsx eax, al
mov dl, byte [ecx + 0x445a00]
mov cl, byte [eax + 0x445a00]
shl dl, 6
add dl, cl
mov byte [esp + 0x14], dl
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x10]
call fcn.00432d9e
add esi, 4
cmp esi, edi
jl 0x430a54
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x18], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x4310d0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx + 4]
lea eax, [esp]
push 0
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x431101
push eax
call fcn.00430d40
add esp, 4
mov eax, dword [esp]
pop ecx
ret 8

Function at 0x431110
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx + 4]
lea eax, [esp]
push 0
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x431141
push eax
call fcn.00430d40
add esp, 4
mov eax, dword [esp]
pop ecx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40d420
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40d442
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40d449
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40d438
mov eax, 1
add ebx, ebx
jne 0x40d45b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40d450
jne 0x40d46c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d450
xor ecx, ecx
sub eax, 3
jb 0x40d480
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40d4f2
mov ebp, eax
add ebx, ebx
jne 0x40d48b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40d498
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40d4bc
inc ecx
add ebx, ebx
jne 0x40d4a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40d49d
jne 0x40d4b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d49d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40d4dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40d4cd
jmp 0x40d43e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40d4dc
add edi, ecx
jmp 0x40d43e
pop esi
mov edi, esi
mov ecx, 0x1f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40d4fa
cmp byte [edi], 0
jne 0x40d4fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40d4ff
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40d56e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x119ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11a34]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40d52c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11a3c]
or eax, eax
je 0x40d568
mov dword [ebx], eax
add ebx, 4
jmp 0x40d549
call dword [esi + 0x11a38]
mov ebp, dword [esi + 0x11a40]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40d5a2
sub esp, 0xffffff80
jmp 0x402ffe
Function at 0x5ae4ed
Capabilities:
Encode data using xor

Disassembly:
pushfd
call fcn.005ae451
xor ch, byte [0x42efb73c]
imul ebx, edx, 0xffffffb4
scasb al, byte es:[edi]
out 0xd8, eax
in eax, 0x47
inc dword [eax + 0x67]
mov al, 0x57
adc dl, byte [esi]
mov edi, 0x4b20d740
xchg esp, eax
xor eax, 0x66bdcc9b
stc
lcall 0xf329, 0x826dba0
cmp al, 0x27
invalid
jmp 0x5ae467

Function at 0x5c3952
Capabilities:
Encode data using xor

Disassembly:
call 0x5c312f
jmp 0x5c38e5
inc dword [esp + 8]
popfd
jmp 0x5c39ff
lea esp, [esp + 5]
pushfd
pop word [esp]
mov byte [esp], bl
lea esp, [esp + 3]
jmp 0x5c38fc
lea esp, [esp + 0x1c]
cmp dword [esp + 4], 0
jne 0x5c38a4
jmp 0x5c3924
pop eax
sub eax, 0xbe1677cc
jmp 0x5c3940
push ebx
lodsd eax, dword [esi]
das
mov edi, 0xc2b029da
inc eax
salc
mov cl, 0x40
and bh, byte [ebp + 0x4c]
fild qword [eax]
add byte [eax], al
add byte [eax + 0x24448f66], bl
pop es
push 0
pushfd
pushal
pop word [esp + 7]
lea esp, [esp + 2]
jmp 0x5c38d8
pushal
jmp 0x5c312a
call 0x5c3952
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
mov edx, 0x8aef7fff
jns 0x5c38ec
ror byte [ebp - 0x24], cl
das
ret

Function at 0x74c0c3
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 0x28]
jmp 0x74c11f

Function at 0x74cd47
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [esp + 0x6ab15ff3]
pop ebp
ror bp, 4
pop ax
jmp 0x74ccc1
bt bp, si
mov dx, word [esp + 9]
clc
mov dh, byte [esp + 1]
push bp
lea ebp, [ecx + esi]
jmp 0x74cc6a
dec dh
xchg dh, al
bsf bp, sp
not dh
bt ax, dx
rdtsc
jmp 0x74cc80
pop dword [esp + 4]
mov dl, ah
lea esp, [esp + 3]
lea ebp, [ecx + edx]
jmp 0x74ccdc
push word [esp + 0x10]
lea ebp, [ebp - 0xf8]
mov bp, word [esp + 0x13]
mov byte [esp + 0x10], ch
pushfd
lea esp, [esp + 0xb]
jmp 0x74ccab
bts ax, dx
rdtsc
mov ax, word [esp + 2]
lea esp, [esp + 3]
bts ebp, edx
mov dl, 0x9f
jmp 0x74cd2f
neg dh
shr bp, 6
mov dh, ah
mov word [esp + 8], bx
pushfd
mov eax, dword [esp]
jmp 0x74cc99
lea esp, [esp]
add esp, 2
lea ebp, [esp + edi]
mov byte [esp], bl
adc ebp, ecx
jmp 0x74cd6e
bsr edx, esi
add esp, 0
mov word [esp], sp
mov eax, ebp
xchg byte [esp], dl
lea eax, [esp + ebx]
jmp 0x74cd19
sub esp, 0xd
btc ax, sp
lea ebp, [ebx + edi]
xchg word [esp + 6], dx
jmp 0x74cd06
pop bp
bt dx, di
bt edx, esi
lea esp, [esp]
lea ebp, [ecx + ebx]
jmp 0x74cdb1
bt bp, sp
ror eax, cl
neg edx
lea ebp, [eax + 0x507ee1bb]
push bp
dec dl
jmp 0x74cd58
mov ax, 0x369d
mov ebp, 0x6414cb4
mov dh, dl
lea esp, [esp]
cmc
call fcn.0074cd98
Function at 0x74cd98
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0
mov ebp, eax
add edx, 0x215fddf1
inc ebp
lea esp, [esp]
jmp 0x74cddb
pop word [esp]
jmp 0x74cd82
setp al
clc
lea eax, [edx*4]
bsf eax, esi
jmp 0x74ce06
mov bp, 0x2db9
mov ah, byte [esp + 2]
rdtsc
xchg dl, ah
mov word [esp], dx
mov dl, byte [esp]
jmp 0x74cdc5
bswap eax
mov dh, 0x85
lea ebp, [eax*4]
push word [esp + 2]
jmp 0x74ce4d
mov dl, 0x28
btc ax, bx
bswap ebp
cld
mov dh, 0xd1
and ebp, edi
jmp 0x74cdf0
sub esp, 0x1c
lea esp, [esp + 0x16]
pop ebp
mov edx, dword [esp + 4]
lea esp, [esp + 2]
xchg ebp, eax
jmp 0x74ce2c

Function at 0x74d10d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
rdtsc
mov dh, dl
sub esp, 3
lea ebp, [ecx + edx]
jmp 0x74d11a
push dword [esp + 0x25]
lea ebp, [ebx*4]
jmp 0x74d0f7
pop word [esp + 8]
mov bp, bx
not edx
mov eax, 0x529916fd
jmp 0x74d158
xchg ebp, edx
not ebp
push edx
mov dh, ah
mov ebp, dword [esp + 7]
bswap eax
jmp 0x74d2f5
lea esp, [esp + 0x25]
push word [esp + 0xa]
push dword [esp]
bsr ebp, ebp
mov dx, si
neg ebp
jmp 0x74d142
xchg word [esp], bp
xchg dword [esp], edx
mov bp, word [esp + 3]
neg bp
mov dh, 0xdf
mov ax, bx
jmp 0x74d1df
xchg word [esp + 2], bp
mov byte [esp + 2], bl
mov ebp, dword [esp + 1]
cmc
xchg byte [esp + 2], al
xchg word [esp + 2], bp
jmp 0x74d16e
xchg byte [esp + 8], dl
xchg dword [esp + 0xb], edx
add esp, 0x11
neg ebp
sub esp, 3
stc
jmp 0x74d18a
not edx
bswap eax
lea esp, [esp + 0x12]
mov byte [esp + 1], cl
mov dword [esp], ebx
jmp 0x74d20b
sub esp, 0x14
pop word [esp + 0xb]
bts ebp, esp
mov bp, ax
bsf edx, ebp
not bp
jmp 0x74d1c9
bsr bp, bx
pop word [esp]
lea edx, [edx - 0x60012a53]
jmp 0x74d265
btr bp, bp
lea esp, [esp + 1]
lea ebp, [ebp*4]
mov word [esp + 1], bx
lea esp, [esp]
not bp
jmp 0x74d1f5
mov word [esp + 0xb], si
dec edx
clc
lea edx, [eax + edx]
pop word [esp + 0xa]
lea ebp, [esi*4]
jmp 0x74d1b6
sub esp, 0x17
bswap ebp
mov dh, cl
mov al, byte [esp + 8]
mov bp, ax
jmp 0x74d293
mov dh, 0x11
mov ebp, 0x2835b05c
pushal
xchg dword [esp + 3], edx
push word [esp + 6]
push word [esp + 9]
jmp 0x74d24f
lea eax, [esi + ebp]
mov bp, word [esp]
lea ebp, [eax + ebx]
btr dx, si
cmc
jmp 0x74d2c0
push word [esp + 0x21]
sub esp, 6
lea esp, [esp + 0x45]
rcr bp, cl
bswap ebp
mov bp, 0x2a9d
jmp 0x74d27d
cmp ebp, 0x378ab61b
cmc
btc ebp, edi
cmp ebp, ebx
setle dh
jmp 0x74d2d2
sbb al, dh
xchg dl, dh
mov dl, byte [esp]
bswap eax
mov bp, word [esp]
setl al
jmp 0x74d2aa
mov eax, dword [esp]
mov bp, 0xbd8
mov dl, byte [esp]
mov eax, esp
sub esp, 0xa
neg bp
jmp 0x74d328
mov ebp, dword [esp + 3]
xchg dx, ax
bts ebp, ebx
lea esp, [esp]
pop word [esp + 0xc]
push word [esp + 6]
jmp 0x74d234
push word [esp + 7]
mov al, byte [esp]
pop word [esp]
mov dword [esp + 2], esi
jmp 0x74d33e
pop bp
not ebp
mov dh, bl
xchg word [esp + 3], dx
mov ebp, dword [esp + 4]
mov word [esp + 3], bx
jmp 0x74d310
sub ax, bp
pop word [esp + 3]
xchg ebp, edx
pop ebp
mov ebp, edi
xchg byte [esp], al
jmp 0x74d7ce
mov ebp, 0x2f9808b7
call fcn.0074d3fe
not bp
btc dx, cx
mov eax, 0x8700ed6b
xchg bp, ax
stc
xchg edx, ebp
jmp 0x74d55a
Function at 0x74d39a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 1]
mov bp, di
bt bp, bx
clc
rdtsc
jmp 0x74d3b6
mov eax, ebp
xchg ebp, eax
bsf edx, ebx
mov word [esp], di
mov edx, dword [esp + 6]
mov dx, bp
jmp 0x74d366
push dword [esp + 9]
jmp 0x74d37c
rdtsc
neg ebp
mov ah, byte [esp + 4]
not dh
mov dh, 0xee
setp dh
jmp 0x74d3de
mov edx, dword [esp + 8]
xchg ebp, eax
pop edx
push ax
bswap ebp
push word [esp + 3]
jmp 0x74d3a0
pop word [esp + 6]
mov bp, di
pop bp
mov dh, 0xc1
xchg edx, ebp
jmp 0x74d443
cmc
add esp, 4
sub esp, 0xe
setp dh
lea eax, [ebp + 0xac63]
xchg word [esp + 0xa], bp
jmp 0x74d3c8
bts ebp, ebp
lea ebp, [ecx*4]
bswap ebp
lea ebp, [esp - 0x5f]
mov ebp, dword [esp + 0xe]
jmp 0x74d40d
lea ebp, [eax + 0x60]
mov dh, 0xb0
mov eax, 0x801cbfe6
lea ebp, [esi + edi]
xchg byte [esp + 0xb], dh
ror bp, cl
jmp 0x74d423

Function at 0x74d870
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
mov dx, sp
jmp 0x74d899
neg dx
stc
mov dx, sp
mov dl, 0xa5
mov eax, dword [esp + 1]
xchg dh, dl
jmp 0x74d8e3
setle dl
mov eax, 0xc7f25a6b
push edi
mov byte [esp + 1], al
mov dx, sp
jmp 0x74d8cd
setl dh
adc dh, 0xa6
pop bp
xchg byte [esp], dl
lea edx, [edx*4]
add esp, 3
jmp 0x74d8aa

Function at 0x74dd6f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, word [esp]
inc dh
sub esp, 0x11
mov dl, 0x94
mov edx, dword [esp + 1]
jmp 0x74dcb4
lea edx, [esp + esi]
lea ebp, [ebx + esi]
mov dh, 0xac
btc bp, cx
add esp, 0
push bp
jmp 0x74dc52
bt bp, dx
stc
mov ebp, 0xacecff56
lea ebp, [esi + 0x2111f24a]
xchg byte [esp], dh
lea eax, [edi + 0xf7]
jmp 0x74dc68
rdtsc
mov ah, dh
cld
add esp, 0xe
push word [esp + 2]
rdtsc
jmp 0x74dcc9
mov ax, word [esp + 0xe]
pop ax
mov eax, 0x5b053344
xchg edx, eax
xchg byte [esp + 0xd], al
rcr ah, 1
jmp 0x74dc9e
xchg byte [esp], al
pop dx
mov dx, sp
lea esp, [esp + 1]
mov word [esp], di
mov ebp, esi
jmp 0x74dd1d
mov bp, word [esp + 9]
lea esp, [esp + 9]
dec dh
not bp
add esp, 2
mov edx, dword [esp]
jmp 0x74dc83
stc
mov ax, bx
lea ebp, [edx*4]
or ebp, ecx
jmp 0x74dd46
mov edx, 0x9ac87c62
xchg dh, al
mov word [esp], si
rdtsc
mov dl, 0xf9
mov al, ch
jmp 0x74dd07
push word [esp]
bsf bp, bp
lea esp, [esp + 1]
mov ebp, dword [esp]
mov bp, word [esp]
call fcn.0074dd30
mov al, byte [0x2ed3b426]
test eax, 0xaecb5bd2
pop ebp
fdivr qword [esi]
or dword [eax + 0x6c8762cb], ebp
xchg dword [esp + 1], ebp
xchg dword [esp + 1], ebp
xchg dx, bp
jmp 0x74dcee

Function at 0x74dff3
Capabilities:
Parse pe header

Disassembly:
jmp 0x74dfe6
push ax
mov word [esp + 1], si
call 0x74dff3
mov cl, 0x88
inc esp
and al, 6
mov byte [esp + 5], al
mov word [esp + 4], ax
jmp 0x74e062
pop word [esp + 2]

Function at 0x74e038
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov byte [esp], bl
call fcn.0074e03a
add byte [eax], al
mov byte [ebp - 0x2b], 0xbc
dec edi
outsd dx, dword [esi]
jo 0x74e028
add edi, esi
add edi, esi
jns 0x74e09e
mov gs, ebx
call 0x758a26
call 0x74e0e8
lea esp, [esp + 0xf]
push ax
jmp 0x74e022
in eax, dx
imul edi, ecx, 0xdee6b98
mov bl, byte [eax]
jg 0x74e033
or eax, 0x247c89ab
pop esp
Function at 0x74e04b
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0074d0b4
lea esp, [esp + 0xf]
push ax
call 0x74e04b
sbb dword [ebp - 0x14fcdb9c], ecx
pop edx
jge 0x74e04d
and al, 3
jmp 0x74e0ab
push 0x5b7dfa0f
fisttp word [edi + 0x2a]
fstpnce st(7), st(0)
mov dl, 0xad
mov esp, 0x8f66168f
inc esp
and al, 2
push ecx
mov dword [esp], edi
pop dword [esp + 1]
pop dword [esp]
mov dword [esp + 0x5c], esi
call fcn.0074e038
mov eax, dword [eax + 8]
jmp 0x74e0be
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x74e07b
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x74e091
pushal
pop word [esp + 6]
push dword [esp + 4]
mov dword [esp + 0x1a], esp
lea esp, [esp + 2]
jmp 0x74e10b
mov dword [esp + 0x1c], eax
push ebp
push word [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 0x20]
jmp 0x74d0af
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10007fbe
pop dword [ebp - 0x30]
mov eax, 0x10007fbe
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xbcf280ba
sub dword [ebp - 0x40], 0x6ea03b6f
mov dword [ebp - 0x3c], 0x8ae05d9f
sub dword [ebp - 0x3c], 0x58ad115a
mov dword [ebp - 0x38], 0xd90cfdcb
sub dword [ebp - 0x38], 0x8cc0b99d
mov dword [ebp - 0x34], 0x3a2ae776
add dword [ebp - 0x34], 0xc5d5188a
lea eax, [ebp - 0x40]
push eax
mov eax, 0x46b998f4
sub eax, 0x36b7d874
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x58797690
sub dword [ebp - 0x40], 0xe4070d3a
mov dword [ebp - 0x3c], 0x7e5bc8c
sub dword [ebp - 0x3c], 0xc6795b17
mov dword [ebp - 0x38], 0x5cb2aa1c
sub dword [ebp - 0x38], 0xf9433db0
mov dword [ebp - 0x34], 0xc35981d7
sub dword [ebp - 0x34], 0xc35981d7
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38253
push 0
call eax
mov ecx, 0x4a98
xor esi, esi
add esi, eax
mov edi, 0x8235c977
add edi, 0x8dcc9e89
add edi, dword [ebp - 0x30]
mov edx, 0xcdce334
sub dword [ebp - 0x20], 0xbcf4ed48
mov ebx, dword [edi]
add dword [ebp - 0x10], ecx
xor ebx, edx
add dword [ebp - 0x18], ecx
mov dword [esi], ebx
add dword [ebp - 4], 0xb8d587c5
add esi, 4
add edi, 4
loop 0x100080cc
add eax, 0x5970a398
add eax, 0xa690799b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10036b79
sub ecx, 0x36b79
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_406
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_109
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_109
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret