joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10156337
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 0x34]
mov eax, dword [ecx]
push ebx
mov ebx, dword [eax + 0xb0]
movzx eax, byte [edx + 5]
push ebp
mov ebp, dword [edx + 0x38]
push esi
movzx esi, word [edx + 0xc]
mov dword [esp + 0x1c], esi
movzx esi, word [edx + 0x10]
mov dword [esp + 0x18], esi
mov esi, dword [ecx + 0x24]
xor ecx, ecx
mov ch, byte [eax + ebp + 5]
push edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], 0
mov cl, byte [eax + ebp + 6]
mov edi, ecx
mov ecx, esi
sub ecx, edi
lea esi, [edi + ebp]
add edi, ebx
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
lea edi, [esi + ecx*2]
mov dword [esp + 0x20], edi
jle 0x1015645f
add esi, ebp
mov dword [esp + 0x14], esi
jmp 0x101563c7
mov esi, dword [esp + 0x14]
mov edi, edi
xor eax, eax
mov ah, byte [esi]
mov al, byte [esi + 1]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x28], esi
jl 0x101564e5
mov eax, dword [esp + 0x10]
add eax, 0xfffffffc
cmp esi, eax
jg 0x101564e5
mov ecx, dword [esp + 0x24]
add esi, ecx
push esi
mov eax, edx
call fcn.1013d957
movzx ecx, ax
sub ebx, ecx
add esp, 4
cmp ebx, edi
jl 0x101564bf
mov edx, dword [esp + 0x28]
lea eax, [ecx + edx]
cmp eax, dword [esp + 0x10]
jg 0x101564bf
mov eax, dword [esp + 0x14]
mov edx, ecx
shr ecx, 2
lea edi, [ebx + ebp]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
mov ecx, ebx
sar ecx, 8
mov byte [eax], cl
mov ecx, dword [esp + 0x18]
mov byte [eax + 1], bl
add eax, 2
inc ecx
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
jl 0x101563c1
mov eax, dword [esp + 0x2c]
mov byte [eax + ebp + 6], bl
mov ecx, ebx
sar ecx, 8
mov byte [eax + ebp + 5], cl
sub ebx, edi
mov byte [eax + ebp + 1], 0
mov byte [eax + ebp + 2], 0
mov byte [eax + ebp + 7], 0
mov ecx, ebx
mov esi, ecx
shr ecx, 2
add edi, ebp
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
movzx edx, word [edx + 0xe]
cmp ebx, edx
je 0x1015650b
push 0x1018763c
push 0xc12a
push 0x10188220
push 0xb
call fcn.1014d257
add esp, 0x10
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x20
ret
push 0x1018763c
push 0xc119
push 0x10188220
push 0xb
call fcn.1014d257
add esp, 0x10
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x20
ret
push 0x1018763c
push 0xc10d
push 0x10188220
push 0xb
call fcn.1014d257
add esp, 0x10
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x20
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x1015f6a7
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x44
mov eax, dword [esp + 0x50]
mov eax, dword [eax]
mov cl, byte [eax + 4]
mov edx, dword [eax]
push ebx
mov byte [esp + 0x3f], cl
mov ecx, dword [esp + 0x50]
push ebp
mov dword [esp + 0x20], eax
mov al, byte [ecx]
xor ebx, ebx
cmp al, 0x80
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x2c], edx
jae 0x1015f6e3
movzx eax, al
mov dword [esp + 0x14], eax
mov eax, 1
jmp 0x1015f6ef
lea esi, [esp + 0x14]
call fcn.1013a2d7
movzx eax, al
mov ebp, dword [esp + 0x14]
movzx edi, al
cmp edi, ebp
mov eax, dword [esp + 0x28]
movzx ecx, word [eax + 6]
mov dword [esp + 0x24], ecx
jae 0x1015f7e0
add eax, 0xc
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x60]
movzx eax, word [edx + 4]
cmp ebx, eax
jge 0x1015f7e0
mov ecx, dword [esp + 0x5c]
mov al, byte [ecx + edi]
add ecx, edi
cmp al, 0x80
jae 0x1015f744
movzx eax, al
mov dword [esp + 0x20], eax
mov ecx, 1
jmp 0x1015f754
lea esi, [esp + 0x20]
call fcn.1013a2d7
movzx ecx, al
mov eax, dword [esp + 0x20]
movzx edx, cl
mov ecx, dword [esp + 0x58]
add edi, edx
cmp ebp, ecx
jl 0x1015f778
cmp eax, 0xc
jb 0x1015f76d
lea ecx, [eax - 0xc]
shr ecx, 1
jmp 0x1015f774
movzx ecx, byte [eax + 0x101834a8]
test ecx, ecx
ja 0x1015f7e0
mov ecx, dword [esp + 0x5c]
add ecx, ebp
lea esi, [esp + 0x2c]
call fcn.1013ead7
add ebp, eax
cmp ebx, dword [esp + 0x24]
jge 0x1015f797
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
jmp 0x1015f799
xor eax, eax
mov esi, dword [esp + 0x60]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esi + 0x10]
add eax, edx
lea edx, [esp + 0x30]
call fcn.1015f0e7
mov ecx, eax
add esp, 4
test ecx, ecx
mov dword [esp + 0x10], ecx
jne 0x1015f7ff
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
add edx, 4
add ecx, 0x28
inc ebx
cmp edi, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
jb 0x1015f719
mov eax, dword [esp + 0x60]
mov al, byte [eax + 6]
test al, 1
je 0x1015f845
pop edi
pop esi
mov dword [esp + 8], reloc.WINMM.dll_midiStreamOut
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 0x44
ret
cmp ebx, dword [esp + 0x24]
jge 0x1015f818
mov eax, dword [esp + 0x28]
mov edx, dword [eax + 8]
cmp byte [ebx + edx], 0
je 0x1015f818
neg ecx
mov dword [esp + 0x10], ecx
mov al, byte [esi + 6]
test al, 4
je 0x1015f83b
movzx edx, word [esi + 4]
dec edx
cmp ebx, edx
jne 0x1015f83b
mov edx, dword [esp + 0x40]
and al, 0xfb
mov byte [esi + 6], al
mov eax, dword [esp + 0x3c]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x44
ret
test al, 2
jne 0x1015f857
cmp edi, dword [esp + 0x14]
jae 0x1015f857
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x101697a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [edi + 0x3c]
mov eax, dword [edx]
sub esp, 8
push ebp
xor ebp, ebp
test eax, eax
push esi
mov esi, dword [esp + 0x14]
jne 0x101697dd
mov eax, dword [edi + 0x78]
mov ecx, dword [edi]
or eax, 0x1e
push ebp
and eax, 0x87f7f
push eax
push edx
push ebp
push ecx
call dword [ecx + 0x18]
mov ebp, eax
add esp, 0x14
test ebp, ebp
jne 0x101698da
mov ecx, dword [edi + 0x18]
cmp ecx, dword [edi + 0x24]
jbe 0x10169817
mov eax, dword [edi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.101aa167
mov dword [esp + 0xc], edx
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x3c]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x28]
mov eax, dword [edi + 0x18]
add esp, 0xc
mov dword [edi + 0x24], eax
push ebx
test esi, esi
je 0x101698d1
mov ebx, dword [esi + 0x14]
cmp ebx, dword [edi + 0x18]
ja 0x101698c2
test byte [esi + 0x18], 0x20
jne 0x101698c2
mov eax, dword [edi + 0x80]
cdq
push edx
push eax
lea ecx, [ebx - 1]
push 0
push ecx
call fcn.101aa167
cmp ebx, 1
mov dword [esp + 0xc], eax
mov ebp, edx
jne 0x1016985a
call fcn.1013c957
mov ecx, dword [edi + 0x80]
mov esi, dword [esi + 4]
mov eax, dword [edi + 0x3c]
mov edx, dword [eax]
push ebp
mov ebp, dword [esp + 0x10]
push ebp
push ecx
push esi
push eax
call dword [edx + 0xc]
add esp, 0x14
cmp ebx, 1
mov ebp, eax
jne 0x1016989a
add esi, 0x18
mov ecx, dword [esi]
lea eax, [edi + 0x64]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
cmp ebx, dword [edi + 0x20]
jbe 0x101698a2
mov dword [edi + 0x20], ebx
mov edx, dword [edi + 0xa8]
mov esi, dword [esp + 0x18]
inc edx
mov dword [edi + 0xa8], edx
mov eax, dword [esi + 4]
push eax
mov eax, dword [edi + 0x58]
call fcn.1015f077
add esp, 4
test ebp, ebp
mov esi, dword [esi + 0xc]
mov dword [esp + 0x18], esi
je 0x10169818
pop ebx
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
Function at 0x101d9aa7
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x101d9ac0
mov esi, ebx
mov ebx, eax
jmp 0x101d9ac2
mov esi, eax
mov edi, dword [esp + 0x10]
mov eax, dword [esi + 4]
cmp eax, dword [edi + 8]
jle 0x101d9ad8
push eax
push edi
call fcn.101bfd87
add esp, 8
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x101d9b01
push ebp
jmp 0x101d9ae7
mov ecx, dword [ebx]
mov ebp, dword [ecx + eax*4]
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [edi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x101d9ae7
pop ebp
cmp eax, dword [esi + 4]
jge 0x101d9b19
nop
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [esi + 4]
inc eax
cmp eax, ecx
jl 0x101d9b07
mov esi, dword [esi + 4]
test esi, esi
mov dword [edi + 4], esi
jle 0x101d9b3f
mov eax, dword [edi]
lea eax, [eax + esi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x101d9b3f
mov edx, dword [edi + 4]
dec edx
mov ecx, edx
test ecx, ecx
mov dword [edi + 4], edx
jg 0x101d9b29
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x102ed240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x10037ff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x10046638]
mov dword [esp + 0x10], eax
mov al, 0x65
push 0x1003a8ec
mov byte [esp + 8], 0x72
mov byte [esp + 9], 0x77
mov byte [esp + 0xa], 0x79
mov byte [esp + 0xb], 0x4e
mov byte [esp + 0xc], 0x43
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x63
mov byte [esp + 0xf], 0x2e
mov byte [esp + 0x10], al
mov byte [esp + 0x11], 0x78
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0
call fcn.10300450
add esp, 4
test eax, eax
jne 0x102ed2c3
lea eax, [esp + 4]
push eax
call fcn.10300450
add esp, 4
test eax, eax
je 0x102ed34b
push esi
mov esi, dword [0x1003a31c]
push edi
call esi
lea ecx, [esp + 8]
mov edi, eax
call fcn.10300a20
mov dword [esp + 0x24], 0
call esi
sub eax, edi
cmp eax, 0x124f80
jae 0x102ed338
push ebp
mov ebp, dword [0x1003a320]
push ebx
push 1
push 1
lea ecx, [esp + 0x18]
call fcn.10300170
push 0x7d0
push 0x50
push 0x1003a8dc
lea ecx, [esp + 0x1c]
call fcn.10300040
lea ecx, [esp + 0x10]
mov bl, al
call fcn.102fffb0
test bl, bl
jne 0x102ed336
push 0x1f4
call ebp
call esi
sub eax, edi
cmp eax, 0x124f80
jb 0x102ed2f3
pop ebx
pop ebp
lea ecx, [esp + 8]
mov dword [esp + 0x24], reloc.WINMM.dll_midiStreamOut
call fcn.102fffb0
pop edi
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x10]
call fcn.1030b41a
add esp, 0x20
ret
Function at 0x102ed930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10038070
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
lea ecx, [esp]
call fcn.10300a20
mov eax, dword [esp + 0x3c]
push 0
push 0x80000000
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
call fcn.10300a70
test al, al
lea ecx, [esp]
jne 0x102ed994
mov dword [esp + 0x28], reloc.WINMM.dll_midiStreamOut
call fcn.10300b30
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10
push ebp
call fcn.10300b10
mov ebp, eax
test ebp, ebp
jne 0x102ed9c5
lea ecx, [esp + 4]
mov dword [esp + 0x2c], reloc.WINMM.dll_midiStreamOut
call fcn.10300b30
xor al, al
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10
push esi
push edi
lea edi, [ebp + 1]
push edi
call fcn.10319198
mov esi, eax
add esp, 4
test esi, esi
je 0x102eda0c
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0
lea eax, [esp + 0x18]
push eax
push ebp
push esi
lea ecx, [esp + 0x1c]
call fcn.10300ab0
test al, al
jne 0x102eda33
push esi
call fcn.10319193
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], reloc.WINMM.dll_midiStreamOut
call fcn.10300b30
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10
push 4
push 0x1003a91c
push ebp
push esi
call fcn.103009e0
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x30], ecx
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 0x1003a8a4
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov byte [esp + 0x1c], 0
call fcn.10300520
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 1
call fcn.10300530
push esi
lea ecx, [esp + 0x14]
call fcn.10300540
push esi
call fcn.10319193
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 0
call fcn.102ec2a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], reloc.WINMM.dll_midiStreamOut
call fcn.10300b30
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10
Function at 0x102ef770
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100382c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x100
mov eax, dword [0x10046638]
push ebx
push esi
push 0xb
mov esi, ecx
xor ebx, ebx
push 0x1003aa64
lea ecx, [esp + 0x18]
mov dword [esp + reloc.WINMM.dll_midiStreamOut], eax
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.102eee00
mov eax, dword [esi]
push ebx
push 0x100451ec
push 0x100451a0
push ebx
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov dword [esp + reloc.WINMM.dll_midiStreamOut], ebx
call dword [eax + 0xc]
push eax
call fcn.1030bd56
mov eax, dword [esp + 0x3c]
add esp, 0x14
cmp eax, 0x10
mov dword [esp + reloc.WINMM.dll_midiStreamOut], reloc.WINMM.dll_midiStreamOut
jb 0x102ef806
mov edx, dword [esp + 0x14]
push edx
call fcn.10319193
add esp, 4
push 0xb
push 0x1003a9b4
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.102eee00
mov eax, dword [esi]
push ebx
push 0x100451b8
push 0x100451a0
push ebx
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov dword [esp + reloc.WINMM.dll_midiStreamOut], 1
call dword [eax + 0xc]
push eax
call fcn.1030bd56
mov eax, dword [esp + 0x3c]
or esi, reloc.WINMM.dll_midiStreamOut
add esp, 0x14
cmp eax, 0x10
mov dword [esp + reloc.WINMM.dll_midiStreamOut], esi
jb 0x102ef872
mov edx, dword [esp + 0x14]
push edx
call fcn.10319193
add esp, 4
lea ecx, [esp + 0xc]
call fcn.10300520
push 0x20019
push 0x1003aa44
push 0x80000002
lea ecx, [esp + 0x18]
mov dword [esp + reloc.WINMM.dll_midiStreamOut], 2
call fcn.103013d0
test al, al
je 0x102ef8e4
lea ecx, [esp + 0xb8]
call fcn.102ff350
lea eax, [esp + 0xb8]
push eax
push 0x1003aa38
lea ecx, [esp + 0x14]
mov byte [esp + 0x118], 3
call fcn.103013f0
test al, al
lea ecx, [esp + 0xb8]
jne 0x102ef8fb
mov byte [esp + 0x110], 2
call fcn.102fece0
lea ecx, [esp + 0xc]
mov dword [esp + reloc.WINMM.dll_midiStreamOut], esi
call fcn.10301460
xor al, al
jmp 0x102ef99b
push 0x1003aa24
call fcn.102ff080
lea ecx, [esp + 0xb8]
call fcn.102fed50
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.10301250
add esp, 8
mov ecx, eax
mov byte [esp + 0x110], 4
call fcn.102fed50
push eax
call fcn.10300e20
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0xb], al
mov byte [esp + 0x110], 3
call fcn.102ff280
cmp byte [esp + 0xb], bl
je 0x102ef973
mov edx, dword [esp + reloc.WINMM.dll_midiStreamOut]
push edx
lea ecx, [esp + 0xbc]
call fcn.102fed50
push eax
call fcn.103010a0
add esp, 8
mov byte [esp + 0xb], al
lea ecx, [esp + 0xb8]
mov byte [esp + 0x110], 2
call fcn.102fece0
lea ecx, [esp + 0xc]
mov dword [esp + reloc.WINMM.dll_midiStreamOut], esi
call fcn.10301460
mov al, byte [esp + 0xb]
mov ecx, dword [esp + reloc.WINMM.dll_midiStreamOut]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + reloc.WINMM.dll_midiStreamOut]
pop ebx
call fcn.1030b41a
add esp, 0x10c
ret 4
Function at 0x102f4960
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100389b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.102f1180
xor ebx, ebx
mov dword [esi], 0x1003b000
mov dword [esp + 0x18], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 1
call fcn.103009a0
push 0xc
push 0x1003b01c
lea ecx, [esi + 4]
mov byte [esp + 0x20], 2
call fcn.102eee00
push 0x74
mov dword [esi + 0x20], 0x1000001
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
call fcn.10319168
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov byte [esp + 0x18], 3
je 0x102f49ec
push ebx
mov ecx, eax
call fcn.102f2600
jmp 0x102f49ee
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x60], eax
mov byte [esi + 0x64], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x102f76c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10038e56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x1003b2a8
lea ecx, reloc.WINMM.dll_midiStreamOut
mov dword [esp + 0x18], 6
call fcn.102fffb0
lea edi, reloc.WINMM.dll_midiStreamOut
mov ecx, edi
mov byte [esp + 0x18], 5
call fcn.102f7560
mov eax, dword [edi + 4]
push eax
call fcn.10319193
xor ebx, ebx
mov dword [edi + 4], ebx
lea edi, [esi + 0xf8]
add esp, 4
mov ecx, edi
mov byte [esp + 0x18], 4
call fcn.102f7520
mov eax, dword [edi + 4]
push eax
call fcn.10319193
add esp, 4
lea ecx, [esi + 0xe0]
mov dword [edi + 4], ebx
mov byte [esp + 0x18], 3
call fcn.103009b0
lea ecx, [esi + 0xc8]
mov byte [esp + 0x18], 2
call fcn.103009b0
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 1
call fcn.102fece0
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], bl
call fcn.102fece0
mov dword [esi], 0x1003a964
cmp dword [esi + 0x1c], 0x10
jb 0x102f778d
mov eax, dword [esi + 8]
push eax
call fcn.10319193
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 0xf
mov byte [esi + 8], bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x102f80e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10038f7c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
mov eax, dword [0x10046638]
push ebx
push esi
mov esi, ecx
mov dword [esp + reloc.WINMM.dll_midiStreamOut], eax
push edi
mov dword [esp + 0xc], esi
call fcn.102f1180
lea ebx, [esi + 0x30]
mov byte [esi + 0x2c], 0
mov ecx, ebx
mov dword [esp + reloc.WINMM.dll_midiStreamOut], 0
mov dword [esi], 0x1003b2a8
call fcn.102ff350
lea ecx, [esi + 0x7c]
mov byte [esp + 0x12c], 1
call fcn.102ff350
lea ecx, [esi + 0xc8]
mov byte [esp + 0x12c], 2
call fcn.103009a0
lea ecx, [esi + 0xe0]
mov byte [esp + 0x12c], 3
call fcn.103009a0
lea edi, [esi + 0xf8]
mov ecx, edi
mov byte [esp + 0x12c], 4
call fcn.102f73c0
mov dword [edi + 4], eax
mov dword [edi + 8], 0
lea edi, reloc.WINMM.dll_midiStreamOut
mov ecx, edi
mov byte [esp + 0x12c], 5
call fcn.102f73e0
mov dword [edi + 4], eax
mov dword [edi + 8], 0
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x12c], 6
call fcn.10300a20
push 0xb
push 0x1003a9b4
lea ecx, [esi + 4]
mov byte [esp + 0x134], 7
mov dword [esi + reloc.WINMM.dll_midiStreamOut], 0
call fcn.102eee00
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x14]
push eax
mov dword [esi + 0x20], 0x1000001
call dword [fcn.1003a2fc]
push 0x1003b314
lea ecx, [esp + 0x14]
push ecx
call dword [fcn.1003a300]
lea edx, [esp + 0x10]
push edx
mov ecx, ebx
call fcn.102ff040
mov ecx, dword [esp + reloc.WINMM.dll_midiStreamOut]
mov dword fs:[0], ecx
mov ecx, dword [esp + reloc.WINMM.dll_midiStreamOut]
mov eax, esi
call fcn.1030b41a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102feb90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10039836
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.102f1180
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x1003b7b4
mov dword [esi + 0x2c], ebx
call fcn.102ff350
lea ecx, [esi + 0x7c]
mov byte [esp + 0x14], 1
call fcn.102f4960
lea ecx, [esi + 0xe4]
mov byte [esp + 0x14], 2
call fcn.102f80e0
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x14], 3
call fcn.102f1590
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x14], 4
call fcn.102f9cd0
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x14], 5
call fcn.102fbb00
push 0xb
push 0x1003b7c4
lea ecx, [esi + 4]
mov byte [esp + 0x1c], 6
mov dword [esi + reloc.WINMM.dll_midiStreamOut], ebx
mov byte [esi + 0x84c], bl
mov dword [esi + reloc.WINMM.dll_midiStreamOut], ebx
call fcn.102eee00
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x854], bl
mov dword [esi + 0x20], 0x1000001
mov dword [esi + reloc.WINMM.dll_midiStreamOut], esi
mov dword [esi + reloc.WINMM.dll_midiStreamOut], esi
mov dword [esi + reloc.WINMM.dll_midiStreamOut], esi
mov dword [esi + reloc.WINMM.dll_midiStreamOut], esi
mov dword [esi + 0xa4], esi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x103009e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor ecx, ecx
test edx, edx
jle 0x10300a1a
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
lea ebx, [ebx]
xor eax, eax
test edi, edi
jle 0x10300a11
mov bl, byte [eax + ebp]
xor byte [ecx + esi], bl
inc eax
cmp eax, edi
jl 0x10300a06
inc ecx
cmp ecx, edx
jl 0x10300a00
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10300b50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x2004
call fcn.1030cde0
mov eax, dword [esp + reloc.WINMM.dll_midiStreamOut]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [fcn.1003a32c]
mov esi, eax
cmp esi, reloc.WINMM.dll_midiStreamOut
jne 0x10300b8c
xor al, al
pop esi
add esp, 0x2004
ret
push edi
mov edi, dword [fcn.1003a334]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x40
lea edx, [esp + 0x18]
push edx
push esi
call edi
test eax, eax
je 0x10300c41
cmp dword [esp + 8], 0x40
jne 0x10300c41
cmp word [esp + 0xc], 0x5a4d
jne 0x10300c41
mov eax, dword [esp + 0x48]
push 0
push 0
push eax
push esi
call dword [fcn.1003a260]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0xf8
lea edx, [esp + 0x18]
push edx
push esi
call edi
test eax, eax
je 0x10300c41
cmp dword [esp + 8], 0xf8
jne 0x10300c41
push esi
call dword [fcn.1003a33c]
cmp dword [esp + 0xc], 0x4550
jne 0x10300c48
mov eax, dword [esp + reloc.WINMM.dll_midiStreamOut]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
lea eax, [esp + 0xc]
xor ecx, ecx
mov edx, 0x1f
nop
mov esi, dword [eax + 4]
add esi, dword [eax]
add ecx, esi
add eax, 8
dec edx
jne 0x10300c20
mov edx, dword [esp + reloc.WINMM.dll_midiStreamOut]
pop edi
mov dword [edx], ecx
mov al, 1
pop esi
add esp, 0x2004
ret
push esi
call dword [fcn.1003a33c]
pop edi
xor al, al
pop esi
add esp, 0x2004
ret