joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418848
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00405ebc
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00408244
mov edi, eax
cmp edi, 0x104
jbe 0x4187ef
mov eax, edi
add eax, eax
call fcn.00403bec
mov esi, eax
jmp 0x4187f1
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00408244
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41882c
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x418816
mov eax, esp
cmp esi, eax
je 0x418839
mov eax, esi
call fcn.00403c08
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x418874
cmp bl, 0
je 0x418870
cmp bl, 0x41
jl 0x41886b
cmp bl, 0x5a
jg 0x41886b
or bl, 0x20
xor al, bl
inc esi
jmp 0x41884f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4187b0

Function at 0x418a94
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00406128
add esp, 0x800
pop ebx
ret

Function at 0x41bfa4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x42821c
test edx, edx
jne 0x41bfc3
xor eax, eax
jmp 0x41c0e1
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x41bfe0
push esi
push edx
push eax
call fcn.0041c0e8
add esp, 0xc
jmp 0x41c0e1
push esi
push edx
push eax
call fcn.0041c3a8
add esp, 0xc
jmp 0x41c0e1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41c9ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov edi, eax
xor eax, eax
push ebp
push 0x41ca32
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov ebx, eax
mov eax, edi
call fcn.00405b08
mov esi, ebx
dec esi
test esi, esi
jl 0x41ca19
inc esi
lea ebx, [ebp - 0x208]
lea eax, [ebp - 0x20c]
movzx edx, word [ebx]
call fcn.004060ac
mov edx, dword [ebp - 0x20c]
mov eax, edi
call fcn.00406200
add ebx, 2
dec esi
jne 0x41c9f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ca39
lea eax, [ebp - 0x20c]
call fcn.00405b08
ret

Function at 0x41cc1c
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcb8
xor eax, eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41ce03
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x338]
call fcn.0041c9ac
mov edx, dword [ebp - 0x338]
lea eax, [ebp - 4]
mov ecx, 0x41ce1c
call fcn.00406258
xor ecx, ecx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2e0]
call fcn.00404424
call fcn.00403d40
lea eax, [ebp - 0x2e0]
call fcn.004040e4
call fcn.00403d40
mov edx, 0x41ce44
lea eax, [ebp - 0x2e0]
call fcn.00404ad8
call fcn.00404bd8
call fcn.00403d40
push 0x41ce5c
lea edx, [ebp - 0x340]
xor eax, eax
call fcn.00403fac
push dword [ebp - 0x340]
push 0x41ce74
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.004062e0
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2e0]
call fcn.00404ad8
call fcn.00404bd8
call fcn.00403d40
push 0x41ce84
lea edx, [ebp - 0x348]
xor eax, eax
call fcn.00403fac
push dword [ebp - 0x348]
push 0x41ce74
push 0x41cea8
lea eax, [ebp - 0x344]
mov edx, 4
call fcn.004062e0
mov edx, dword [ebp - 0x344]
lea eax, [ebp - 0x2e0]
call fcn.00404ad8
call fcn.00404bd8
call fcn.00403d40
mov edx, 0x41cec8
lea eax, [ebp - 0x2e0]
call fcn.00404ad8
call fcn.00404bd8
call fcn.00403d40
lea eax, [ebp - 0x2e0]
call fcn.00404524
call fcn.00403d40
lea eax, [ebp - 0x334]
xor ecx, ecx
mov edx, 0x44
call fcn.0040457c
mov dword [ebp - 0x308], 1
mov word [ebp - 0x304], 0
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x334]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406094
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x41cddd
mov eax, dword [ebp - 0x2ec]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x2f0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ce0a
lea eax, [ebp - 0x348]
mov edx, 5
call fcn.00405b68
lea eax, [ebp - 4]
call fcn.00405b08
ret
Function at 0x41ced8
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push 0x41cf04
mov eax, esi
call fcn.00406094
push eax
mov eax, ebx
call fcn.00406094
push eax
push 0x41cf08
push 0
call sub.shell32.dll_ShellExecuteW
pop esi
pop ebx
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x772c1d48
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x3c45158a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1af2058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1af21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1af207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1af206a
add dl, dl
jne 0x1af2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1af20dc
xor eax, eax
add dl, dl
jne 0x1af2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1af217d
add dl, dl
jne 0x1af20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1af20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1af20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1af20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1af20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1af2075
mov eax, 1
add dl, dl
jne 0x1af20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1af20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1af20e1
sub eax, ebx
mov ebx, 1
jne 0x1af2128
mov ecx, 1
add dl, dl
jne 0x1af210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1af2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1af2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1af2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1af213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1af214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1af2136
cmp eax, 0x7d00
jae 0x1af216d
cmp eax, 0x500
jb 0x1af2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1af2075
cmp eax, 0x7f
ja 0x1af2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1af2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1af219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1af2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x12722b59
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x55b95dcd
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x102733d4
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0xc]
popal
jmp 0x10273451
mov edi, eax
add edi, 8
movzx edx, byte [edi]
pop edi
jmp 0x10273419
lea edi, [ecx + edx]
jmp 0x1027342a
movzx esi, byte [eax + 9]
mov edi, dword [esp]
mov edi, 0x7ce1a03b
shl edx, 8
jmp 0x10273403
xor edx, esi
sub esp, 0x12
add esp, 0xd
lea esp, [esp + 1]
jmp 0x10273476
shl edx, 8
xor edx, esi
jmp 0x10273460
add esi, 4
mov dword [esi], edx
pop esi
mov bp, si
push edi
jmp 0x102733db
movzx esi, byte [eax + 0xb]
xchg bh, bl
bswap edi
jmp 0x102734a2
movzx esi, byte [eax + 0xa]
mov edi, 0x131f6b81
sub esp, 0xf
pop word [esp]
lea esp, [esp + 1]
jmp 0x10273438
lea ebp, [ebx + ebp]
jmp 0x102734c2
shl edx, 8
not bh
xor edx, esi
clc
jmp 0x1027348c
movzx edx, byte [eax + 0xc]
jmp 0x1027350c
mov dword [ecx + 8], edx
dec di
jmp 0x102734ac
shl edx, 8
jmp 0x1027357b
movzx esi, byte [eax + 0xd]
sub esp, 0x12
sub esp, 2
clc
jmp 0x102734f6
shl edx, 8
mov bp, 0x1028
setg bl
jmp 0x102735a0
lea ebx, [edi*4]
mov edi, 0x4b0adf8b
dec bh
movzx eax, byte [eax + 0xf]
jmp 0x10273541
xor edx, esi
mov di, word [esp]
movzx esi, byte [eax + 0xe]
mov bl, byte [esp]
jmp 0x10273557
neg bp
xchg bp, si
neg esi
jmp 0x102735d5
xor edx, esi
rcl si, cl
bsf si, di
shl edx, 8
jmp 0x1027358a
mov dword [ecx + 0xc], edx
mov si, 0x9ff2
lea ebx, [eax*4]
mov eax, edx
jmp 0x102735f6
xor edx, eax
cmp bh, 0x9a
bswap ebx
bswap esi
jmp 0x102735ae
mov esi, 0xff
jmp 0x1027362c
shr eax, 0x10
mov bx, di
sub esp, 1
mov di, 0x16ea
lea esp, [esp + 1]
jmp 0x102735e0
and eax, esi
setnp bl
mov eax, dword [eax*4 + reloc.WINMM.dll_midiStreamProperty]
mov bx, 0xfa51
jmp 0x1027375c
mov bh, byte [esp]
jmp 0x1027369e
mov word [esp + 3], bx
and edi, esi
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamProperty]
ror ebx, 3
jmp 0x1027365f
mov ebx, dword [ecx + 4]
mov bp, word [esp]
jmp 0x1027372c
lea esp, [esp + 8]
and edi, 0xff0000
jmp 0x10273688
setb bl
mov edi, edx
shr edi, 8
sub esp, 8
jmp 0x10273675
neg ebp
bts bp, dx
mov bp, 0x97e3
jmp 0x10273705
xor eax, edi
mov ebp, dword [esp]
lea edi, [ebp*4]
bsr ebp, ecx
mov edi, edx
jmp 0x102736c4
xor eax, edi
sbb di, 0xff36
jmp 0x10273740
shr edi, 0x18
sbb bp, 0x185e
movzx edi, byte [edi*4 + 0x1024a458]
lea ebp, [edx + ebx]
jmp 0x102736ef
and eax, 0xff000000
lea ebp, [ebp*4]
not bp
xor bp, bp
jmp 0x102736dc
pushal
mov dword [esp], edx
popal
and edi, esi
jmp 0x1027378a
cmp bh, ah
bswap ebx
lea ebx, reloc.WINMM.dll_midiStreamProperty
lea esp, [esp + 0x30]
xor eax, 0x1000000
jmp 0x102736b7
not ebp
lea ebp, [ebp*4]
jmp 0x102737bc
sub esp, 0x13
sub esp, 9
mov bp, 0x44c4
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamProperty]
mov bp, 0x243b
jmp 0x10273774
add ebp, 0x9c4a8d22
stc
jmp 0x102737cc
mov ebp, 0x63b671de
push cx
add esp, 1
lea esp, [esp + 1]
jmp 0x102737a1
and edi, ebp
call 0x102737d4
std
push word [esp + 3]
push dword [esp + 4]
lea esp, [esp + 2]
jmp 0x102739cf
xor eax, edi
call fcn.10273867
Function at 0x10273867
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x10273836
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
push di
add esp, 0
push ebp
jmp 0x102737f8
mov dword [edi], eax
not ax
mov eax, dword [ecx + 8]
stc
jmp 0x10273844
xor ebx, eax
pushfd
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x1027381b
xor eax, ebx
mov dword [ecx + 0x14], ebx
neg ebx
mov bx, word [esp]
jmp 0x102738c7
push dx
lea esp, [esp + 2]
lea esp, [esp + 0x28]
jmp 0x1027380e
mov dword [ecx + 0x18], eax
xor edx, eax
lea ebx, [edx*4]
add byte [ebp + 0x8d1c], cl
add byte [eax], al

Function at 0x10273956
Capabilities:
Encrypt data using aes

Disassembly:
xor ecx, edi
jmp 0x1027395f
sub esp, 0x15
lea esp, [esp + 1]
jmp 0x10273940
mov edi, edx
sub esp, 0x1e
lea esp, [esp + 2]
and edx, esi
jmp 0x10273970
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamProperty]
sub esp, 0x1b
pop word [esp + 0x13]
jmp 0x102739a9
lea esp, [esp + 1]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x1024a458]
jmp 0x10273993

Function at 0x10273e79
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
add esi, 0x10
mov dl, 0x29
mov edx, dword [esi]
jmp 0x10273d91
movzx ebx, byte [esi + 0x11]
mov di, 0x9e38
bsf edi, edi
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamProperty]
jmp 0x10273da7
xchg word [esp + 1], di
xchg byte [esp], bh
jmp 0x10273dc7

Function at 0x10274144
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamProperty]
call fcn.102740c5
invalid
mov edx, dword [eax]
pop eax
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamProperty]
jmp 0x102740b3
push eax
mov eax, esi
add eax, 8
jmp 0x102740de
mov dx, word [esp + 1]
btc edx, ebp
mov dl, 0x8a
jmp 0x1027410e

Function at 0x10274150
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
jmp 0x102741e8
lea esp, [esp + 3]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamProperty]
and ebx, ecx
sub esp, 0x15
call fcn.10274193
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamProperty]
mov edx, ebx
cmc
jmp 0x10274295
add edi, 0xc
mov edx, dword [edi]
pop edi
push ecx
call fcn.10274229
mov edi, edx
jmp 0x1027426e
shr edi, 0x18
pushal
push edx
jmp 0x102742b7
sub esp, 0x11
sub esp, 0x1f
and edi, ecx
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamProperty]
jmp 0x102742a1
mov dx, 0x794a
neg dx
push edi
mov edi, esi
jmp 0x1027423f
and ebx, ecx
jmp 0x102742f6
mov edx, edi
lea edx, [edx*4]
lea edx, reloc.WINMM.dll_midiStreamProperty
mov edi, dword [edx]
pop edx
jmp 0x10274275
lea esp, [esp + 0x5c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamProperty]
neg bl
stc
jmp 0x102742e0

Function at 0x10274193
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamProperty]
jmp 0x102741ab
jmp 0x10274177
movzx ebx, byte [edx]
pop edx
sub esp, 7
mov dword [esp], edi
lea esp, [esp + 3]
jmp 0x102741c9
push edx
mov edx, esi
add edx, 0xd
jmp 0x10274195
and edx, ecx
jmp 0x102741fd
and edx, ecx
push edx
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamProperty]
jmp 0x102741b3
Function at 0x10274229
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov word [esp + 3], sp
jmp 0x10274261
pushfd
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamProperty]
jmp 0x1027424b

Function at 0x10274346
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
jmp 0x102743d5
push dword [esp + 3]
mov byte [esp + 5], al
jmp 0x10274330
and edx, ecx
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamProperty]
pushfd
jmp 0x10274372
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamProperty]
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x10274392
Function at 0x10369d12
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.10351e73
add esp, 2
cmc
mov byte [esp], cl
sub esp, 0x19
cmc
push dword [esp + 1]
jmp 0x10369d5f
std
jmp 0x10369acb
mov eax, dword [eax + 0xc]
jmp 0x10369d3a
mov dword [esp + 0x54], edi
lea esp, [esp + 0x54]
mov eax, dword fs:[0x30]
jmp 0x10369cd9
mov dword [reloc.WINMM.dll_midiStreamProperty], eax
cmp byte [esi + 0x56], ah
pushal
pop word [esp + 0x17]
mov dword [esp + 0xc], ebp
jmp 0x10369cef
push eax
jmp 0x10351e6e
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x10369d24
pop dword [esp + 1]
std
call fcn.10369b24
push es
xchg byte [ebx + esi*2], dl
mov gs, word [edi - 0x4c]
cmp ebp, dword [ebx - reloc.WINMM.dll_midiStreamProperty]
sbb al, 0xb2
aad 0x24
int 0xec
imul edi, ecx, 0xe896b98
mov bl, byte [eax]
jg 0x10369d10
lodsb al, byte fs:[esi]
das
mov edi, 0xcade29da
inc eax
salc
mov cl, 0x40
mov byte [0xf46dfd74], al
pop es
mov byte [0x3b5cce46], al
salc
add dl, ah
arpl bx, si
xchg esi, eax
mov word gs:[edx], gs
movsb byte es:[edi], byte [esi]
cmp bl, byte [ebp - 0x54]
inc edx
pop esp
rol dword [ecx + 0x20], 1
sal dword [ebx], cl
ficom word [edx - 0x40]
cmpsd dword [esi], dword es:[edi]
push edx
mov ecx, 0x2247d75c
sar dword [edx + ebx*8], 1
dec eax
fidivr word [ecx - 0x6b9a55b8]
pop es
scasb al, byte es:[edi]
mov ecx, 0x80cb840f
invalid
Function at 0x41e070
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x417015
lea edi, [esi - 0x16015]
push edi
or ebp, 0xffffffff
jmp 0x41e092
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41e099
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41e088
mov eax, 1
add ebx, ebx
jne 0x41e0ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41e0a0
jne 0x41e0bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e0a0
xor ecx, ecx
sub eax, 3
jb 0x41e0d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41e142
mov ebp, eax
add ebx, ebx
jne 0x41e0db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41e0e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41e10c
inc ecx
add ebx, ebx
jne 0x41e0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41e0ed
jne 0x41e109
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e0ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41e12c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41e11d
jmp 0x41e08e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41e12c
add edi, ecx
jmp 0x41e08e
pop esi
mov edi, esi
mov ecx, 0x50
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41e14a
cmp byte [edi], 2
jne 0x41e14a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41e14f
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41e1be
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e000]
add ebx, esi
push eax
add edi, 8
or bh, bh
xchg esi, eax
push eax
loopne 0x41e198
invalid
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41e17c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e058]
or eax, eax
je 0x41e1b8
mov dword [ebx], eax
add ebx, 4
jmp 0x41e199
call dword [esi + 0x1e054]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x41e1ef
cmp al, 0xef
ja 0x41e1e2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x41e1c4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x41e1d1
mov ebp, dword [esi + 0x1e05c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x1e24a]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41e23b
sub esp, 0xffffff80
jmp 0x4013f0
Function at 0x430520
Capabilities:
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov edx, dword [eax]
mov ecx, dword [ecx]
cmp edx, ecx
jle 0x430553
mov eax, dword [esp + 8]
mov esi, dword [eax]
mov eax, edx
sub ecx, esi
jo 0x430579
add ecx, 1
jo 0x430579
sub eax, esi
jo 0x430579
cdq
idiv ecx
mov eax, edx
add eax, esi
pop esi
jo 0x430579
ret 0xc
mov eax, dword [esp + 8]
push edi
mov esi, ecx
mov edi, dword [eax]
mov eax, ecx
sub esi, edi
pop edi
jo 0x430579
add esi, 1
jo 0x430579
sub eax, edx
jo 0x430579
cdq
idiv esi
pop esi
sub ecx, edx
jo 0x430579
mov eax, ecx
ret 0xc
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop