joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103023e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x103023f9
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], reloc.WINMM.dll_midiStreamOut
mov dword [esp + 0x10], edx
jmp 0x10302420
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x1030243d
jmp 0x10302430
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x1030243d
inc edi
cmp edi, edx
jb 0x10302430
mov eax, edi
sub eax, ecx
cmp edi, edx
mov ecx, eax
jae 0x10302545
sub ecx, dword [esp + 0x1c]
cmp ecx, 3
jbe 0x10302471
xor ebp, ebp
mov cl, byte [edi + 4]
test cl, cl
mov dword [esp + 0x1c], eax
je 0x103024ac
cmp cl, 0xff
je 0x103024ac
and ebp, 3
shl ebp, 1
or ebp, 1
inc eax
jmp 0x10302420
dec ecx
shl ebp, cl
and ebp, 7
je 0x10302456
movzx ecx, byte [ebp + 0x1003b94c]
mov ebx, edi
sub ebx, ecx
mov cl, byte [ebx + 4]
mov bl, byte [ebp + 0x1003b944]
test bl, bl
je 0x1030249a
test cl, cl
je 0x1030249a
cmp cl, 0xff
jne 0x10302456
and ebp, 3
shl ebp, 1
mov dword [esp + 0x1c], eax
or ebp, 1
inc eax
jmp 0x10302420
xor edx, edx
mov dh, cl
movzx ecx, byte [edi + 2]
mov dl, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x103024d4
lea ebx, [edx + eax]
add ebx, esi
jmp 0x103024da
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x10302517
movzx esi, byte [ebp + 0x1003b94c]
shl esi, 3
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x103024fc
cmp dl, 0xff
jne 0x10302513
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x103024c5
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x10302420
mov esi, dword [esp + 0x1c]
pop edi
sub ecx, esi
cmp ecx, 3
pop esi
pop ebx
jbe 0x1030255e
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
dec ecx
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret
Function at 0x10306780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
shr eax, 1
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
shr eax, 1
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x10047eb0], ecx
inc edx
cmp edx, 0x100
jb 0x10306782
cmp edx, 0x800
jae 0x1030685c
push esi
lea ecx, [ecx]
mov eax, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
mov ecx, eax
and ecx, 0xff
mov esi, dword [ecx*4 + reloc.WINMM.dll_midiStreamOut]
shr eax, 8
xor eax, esi
mov dword [edx*4 + 0x10047eb0], eax
inc edx
cmp edx, 0x800
jb 0x10306830
pop esi
mov dword [fcn.10049eb0], 0x100174a0
call fcn.10302690
test eax, eax
jne 0x10306879
mov dword [fcn.10049eb0], 0x10017540
ret
Function at 0x1030989a
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x103099e2
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x103099e2
mov al, byte [esi]
test al, al
je 0x103099da
push ebx
cmp al, 0xa
jne 0x103098c7
inc esi
mov al, byte [esi]
mov cl, byte [esi + 3]
mov byte [ebp - 0xc], al
mov al, byte [esi + 1]
mov byte [ebp - 0xb], al
mov al, byte [esi + 2]
cmp al, 0x3d
mov byte [ebp - 0xa], al
mov byte [ebp - 9], cl
je 0x1030995f
cmp cl, 0x3d
push dword [ebp - 0xc]
je 0x1030998a
call fcn.10309885
push dword [ebp - 0xb]
mov byte [ebp - 0xc], al
call fcn.10309885
push dword [ebp - 0xa]
mov bl, al
call fcn.10309885
push dword [ebp - 9]
mov byte [ebp - 0xa], al
call fcn.10309885
mov byte [ebp - 9], al
mov al, byte [ebp - 0xc]
shl al, 2
mov cl, bl
shr cl, 4
and cl, 3
or cl, al
mov al, byte [ebp - 0xa]
shr al, 2
and al, 0xf
shl bl, 4
or al, bl
mov byte [ebp - 3], al
mov al, byte [ebp - 9]
mov byte [ebp + 0xb], bl
mov bl, byte [ebp - 0xa]
shl bl, 6
and al, 0x3f
mov byte [edx], cl
mov cl, byte [ebp - 3]
or al, bl
add esp, 0x10
mov byte [edx + 1], cl
mov byte [edx + 2], al
add esi, 4
mov byte [ebp + 0xb], bl
add edx, 3
jmp 0x103099cf
cmp cl, 0x3d
jne 0x103099cf
push dword [ebp - 0xc]
call fcn.10309885
push dword [ebp - 0xb]
mov bl, al
call fcn.10309885
shr al, 4
and al, 3
shl bl, 2
or al, bl
pop ecx
mov byte [edx], al
add esi, 4
pop ecx
inc edx
jmp 0x103099cf
call fcn.10309885
push dword [ebp - 0xb]
mov bl, al
call fcn.10309885
push dword [ebp - 0xa]
mov byte [ebp - 0xb], al
call fcn.10309885
mov cl, byte [ebp - 0xb]
shr cl, 4
shl bl, 2
and cl, 3
or cl, bl
mov bl, byte [ebp - 0xb]
shr al, 2
shl bl, 4
and al, 0xf
or al, bl
add esp, 0xc
mov byte [edx], cl
mov byte [edx + 1], al
add esi, 4
inc edx
mov byte [ebp + 0xb], bl
inc edx
mov al, byte [esi]
test al, al
jne 0x103098c2
pop ebx
xor eax, eax
mov byte [edx], 0
inc eax
jmp 0x103099e4
xor eax, eax
pop esi
leave
ret
Function at 0x10341fa2
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003cf70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
lea ecx, [esp]
call fcn.103577e2
mov eax, dword [esp + 0x3c]
push 0
push 0x80000000
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
call fcn.103562d2
test al, al
lea ecx, [esp]
jne 0x10342006
mov dword [esp + 0x28], reloc.WINMM.dll_midiStreamOut
call fcn.10356372
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10
push ebp
call fcn.10356392
mov ebp, eax
test ebp, ebp
jne 0x10342037
lea ecx, [esp + 4]
mov dword [esp + 0x2c], reloc.WINMM.dll_midiStreamOut
call fcn.10356372
xor al, al
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10
push esi
push edi
lea edi, [ebp + 1]
push edi
call fcn.103727ba
mov esi, eax
add esp, 4
test esi, esi
je 0x1034207e
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0
lea eax, [esp + 0x18]
push eax
push ebp
push esi
lea ecx, [esp + 0x1c]
call fcn.10356312
test al, al
jne 0x103420a5
push esi
call fcn.103727b5
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], reloc.WINMM.dll_midiStreamOut
call fcn.10356372
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10
push 4
push 0x10040908
push ebp
push esi
call fcn.10356252
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x30], ecx
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], 0x100408bc
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov byte [esp + 0x1c], 0
call fcn.10355d92
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 1
call fcn.10355da2
push esi
lea ecx, [esp + 0x14]
call fcn.10355db2
push esi
call fcn.103727b5
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 0
call fcn.10340c92
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], reloc.WINMM.dll_midiStreamOut
call fcn.10356372
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x10
Function at 0x10343c82
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1003d1b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x100
mov eax, dword [0x1004d6f8]
push ebx
push esi
push 0xb
mov esi, ecx
xor ebx, ebx
push 0x10040a38
lea ecx, [esp + 0x18]
mov dword [esp + reloc.WINMM.dll_midiStreamOut], eax
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.10343242
mov eax, dword [esi]
push ebx
push 0x1004c1ec
push 0x1004c1a0
push ebx
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov dword [esp + reloc.WINMM.dll_midiStreamOut], ebx
call dword [eax + 0xc]
push eax
call fcn.10365378
mov eax, dword [esp + 0x3c]
add esp, 0x14
cmp eax, 0x10
mov dword [esp + reloc.WINMM.dll_midiStreamOut], reloc.WINMM.dll_midiStreamOut
jb 0x10343d18
mov edx, dword [esp + 0x14]
push edx
call fcn.103727b5
add esp, 4
push 0xb
push 0x10040988
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.10343242
mov eax, dword [esi]
push ebx
push 0x1004c1b8
push 0x1004c1a0
push ebx
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov dword [esp + reloc.WINMM.dll_midiStreamOut], 1
call dword [eax + 0xc]
push eax
call fcn.10365378
mov eax, dword [esp + 0x3c]
or esi, reloc.WINMM.dll_midiStreamOut
add esp, 0x14
cmp eax, 0x10
mov dword [esp + reloc.WINMM.dll_midiStreamOut], esi
jb 0x10343d84
mov edx, dword [esp + 0x14]
push edx
call fcn.103727b5
add esp, 4
lea ecx, [esp + 0xc]
call fcn.10355d92
push 0x20019
push 0x10040a18
push 0x80000002
lea ecx, [esp + 0x18]
mov dword [esp + reloc.WINMM.dll_midiStreamOut], 2
call fcn.10357422
test al, al
je 0x10343df6
lea ecx, [esp + 0xb8]
call fcn.103552f2
lea eax, [esp + 0xb8]
push eax
push 0x10040a0c
lea ecx, [esp + 0x14]
mov byte [esp + 0x118], 3
call fcn.10357442
test al, al
lea ecx, [esp + 0xb8]
jne 0x10343e0d
mov byte [esp + 0x110], 2
call fcn.10354cc2
lea ecx, [esp + 0xc]
mov dword [esp + reloc.WINMM.dll_midiStreamOut], esi
call fcn.103574b2
xor al, al
jmp 0x10343ead
push 0x100409f8
call fcn.10355062
lea ecx, [esp + 0xb8]
call fcn.10354d32
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.103572a2
add esp, 8
mov ecx, eax
mov byte [esp + 0x110], 4
call fcn.10354d32
push eax
call fcn.10356e72
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0xb], al
mov byte [esp + 0x110], 3
call fcn.10355222
cmp byte [esp + 0xb], bl
je 0x10343e85
mov edx, dword [esp + reloc.WINMM.dll_midiStreamOut]
push edx
lea ecx, [esp + 0xbc]
call fcn.10354d32
push eax
call fcn.103570f2
add esp, 8
mov byte [esp + 0xb], al
lea ecx, [esp + 0xb8]
mov byte [esp + 0x110], 2
call fcn.10354cc2
lea ecx, [esp + 0xc]
mov dword [esp + reloc.WINMM.dll_midiStreamOut], esi
call fcn.103574b2
mov al, byte [esp + 0xb]
mov ecx, dword [esp + reloc.WINMM.dll_midiStreamOut]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + reloc.WINMM.dll_midiStreamOut]
pop ebx
call fcn.10364a3c
add esp, 0x10c
ret 4
Function at 0x10344e12
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1003d494
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10344a02
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
mov dword [esi], 0x10040abc
call fcn.103552f2
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 1
call fcn.103559c2
lea ecx, [esi + 0xd4]
mov byte [esp + 0x18], 2
call fcn.103552f2
lea ecx, [esi + 0x120]
mov byte [esp + 0x18], 3
call fcn.103552f2
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x18], 4
call fcn.103552f2
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x18], 5
call fcn.103552f2
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x18], 6
call fcn.103552f2
mov dword [esi + reloc.WINMM.dll_midiStreamOut], ebx
mov dword [esi + reloc.WINMM.dll_midiStreamOut], ebx
mov dword [esi + reloc.WINMM.dll_midiStreamOut], ebx
mov dword [esi + reloc.WINMM.dll_midiStreamOut], ebx
mov dword [esi + reloc.WINMM.dll_midiStreamOut], ebx
mov dword [esi + reloc.WINMM.dll_midiStreamOut], ebx
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x18], 9
call fcn.103552f2
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x18], 0xa
call fcn.103552f2
mov byte [esi + 0x350], bl
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x18], 0xb
mov byte [esi + 0x351], bl
call fcn.10356212
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x18], 0xc
call fcn.10340ca2
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x18], 0xd
call fcn.103552f2
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x18], 0xe
call fcn.103552f2
push 0xb
push 0x10040b20
lea ecx, [esi + 4]
mov byte [esp + 0x20], 0xf
call fcn.10343242
mov ecx, 0xe
xor eax, eax
lea edi, reloc.WINMM.dll_midiStreamOut
mov dword [esi + 0x20], 0x1000001
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
stosb byte es:[edi], al
mov byte [esi + 0x295], bl
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10348f12
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1003d8d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.10344a02
xor ebx, ebx
mov dword [esi], 0x10040f70
mov dword [esp + 0x18], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 1
call fcn.10356212
push 0xc
push 0x10040f8c
lea ecx, [esi + 4]
mov byte [esp + 0x20], 2
call fcn.10343242
push 0x74
mov dword [esi + 0x20], 0x1000001
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
call fcn.1037278a
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov byte [esp + 0x18], 3
je 0x10348f9e
push ebx
mov ecx, eax
call fcn.10346b82
jmp 0x10348fa0
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x60], eax
mov byte [esi + 0x64], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x1034bdb2
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1003dd76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x10041320
lea ecx, reloc.WINMM.dll_midiStreamOut
mov dword [esp + 0x18], 6
call fcn.10357932
lea edi, reloc.WINMM.dll_midiStreamOut
mov ecx, edi
mov byte [esp + 0x18], 5
call fcn.1034bc52
mov eax, dword [edi + 4]
push eax
call fcn.103727b5
xor ebx, ebx
mov dword [edi + 4], ebx
lea edi, [esi + 0xf8]
add esp, 4
mov ecx, edi
mov byte [esp + 0x18], 4
call fcn.1034bc12
mov eax, dword [edi + 4]
push eax
call fcn.103727b5
add esp, 4
lea ecx, [esi + 0xe0]
mov dword [edi + 4], ebx
mov byte [esp + 0x18], 3
call fcn.10356222
lea ecx, [esi + 0xc8]
mov byte [esp + 0x18], 2
call fcn.10356222
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 1
call fcn.10354cc2
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], bl
call fcn.10354cc2
mov dword [esi], 0x10040944
cmp dword [esi + 0x1c], 0x10
jb 0x1034be7f
mov eax, dword [esi + 8]
push eax
call fcn.103727b5
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 0xf
mov byte [esi + 8], bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1034c7d2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003de9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
mov eax, dword [0x1004d6f8]
push ebx
push esi
mov esi, ecx
mov dword [esp + reloc.WINMM.dll_midiStreamOut], eax
push edi
mov dword [esp + 0xc], esi
call fcn.10344a02
lea ebx, [esi + 0x30]
mov byte [esi + 0x2c], 0
mov ecx, ebx
mov dword [esp + reloc.WINMM.dll_midiStreamOut], 0
mov dword [esi], 0x10041320
call fcn.103552f2
lea ecx, [esi + 0x7c]
mov byte [esp + 0x12c], 1
call fcn.103552f2
lea ecx, [esi + 0xc8]
mov byte [esp + 0x12c], 2
call fcn.10356212
lea ecx, [esi + 0xe0]
mov byte [esp + 0x12c], 3
call fcn.10356212
lea edi, [esi + 0xf8]
mov ecx, edi
mov byte [esp + 0x12c], 4
call fcn.1034bab2
mov dword [edi + 4], eax
mov dword [edi + 8], 0
lea edi, reloc.WINMM.dll_midiStreamOut
mov ecx, edi
mov byte [esp + 0x12c], 5
call fcn.1034bad2
mov dword [edi + 4], eax
mov dword [edi + 8], 0
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x12c], 6
call fcn.103577e2
push 0xb
push 0x10040988
lea ecx, [esi + 4]
mov byte [esp + 0x134], 7
mov dword [esi + reloc.WINMM.dll_midiStreamOut], 0
call fcn.10343242
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x14]
adc al, 0x50
Function at 0x10352232
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003e654
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a0
mov eax, dword [0x1004d6f8]
push ebx
push esi
push edi
push 0xb
mov esi, ecx
xor ebx, ebx
mov edi, 0xf
push 0x10040b20
lea ecx, [esp + 0x38]
mov dword [esp + reloc.WINMM.dll_midiStreamOut], eax
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.10343242
mov eax, dword [esi]
push ebx
push 0x1004c224
push 0x1004c1a0
push ebx
lea ecx, [esp + 0x40]
push ecx
mov ecx, esi
mov dword [esp + reloc.WINMM.dll_midiStreamOut], ebx
call dword [eax + 0xc]
push eax
call fcn.10365378
mov esi, eax
mov eax, dword [esp + 0x5c]
add esp, 0x14
cmp eax, 0x10
mov dword [esp + reloc.WINMM.dll_midiStreamOut], reloc.WINMM.dll_midiStreamOut
jb 0x103522d2
mov edx, dword [esp + 0x34]
push edx
call fcn.103727b5
add esp, 4
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
lea ecx, [esp + 0x78]
mov edi, eax
call fcn.103552f2
push 0xffffffffffffffff
push 0x100417bc
lea ecx, [esp + 0xd0]
mov dword [esp + reloc.WINMM.dll_midiStreamOut], 1
call fcn.10355382
push 0xffffffffffffffff
push 0x10041734
lea ecx, [esp + 0x120]
mov byte [esp + 0x2bc], 2
call fcn.10355382
mov edx, dword [esi]
xor eax, eax
mov al, byte [edi + 0x38]
lea ecx, [esp + 0x78]
mov byte [esp + 0x2b4], 3
push eax
push ecx
lea eax, [esp + 0xd0]
push eax
lea ecx, reloc.WINMM.dll_midiStreamOut
push ecx
mov ecx, esi
call dword [edx + 0x14]
lea ecx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x2b4], 2
call fcn.10354cc2
lea ecx, [esp + 0xc8]
mov byte [esp + 0x2b4], 1
call fcn.10354cc2
lea ecx, [esp + 0x78]
call fcn.10354d22
test al, al
jne 0x1035282d
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
push 0x60
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x80]
mov byte [esp + 0x2bc], 4
call fcn.10354d32
push eax
call fcn.103572d2
mov ecx, dword [esp + 0x30]
add esp, 0xc
cmp ecx, ebx
je 0x10352725
mov edx, dword [esp + 0x28]
sub edx, ecx
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jb 0x10352725
call fcn.10354d12
test eax, eax
je 0x103524f2
xor eax, eax
mov ecx, 0x24
lea edi, reloc.WINMM.dll_midiStreamOut
rep stosd dword es:[edi], eax
lea eax, reloc.WINMM.dll_midiStreamOut
push eax
mov dword [esp + reloc.WINMM.dll_midiStreamOut], 0x94
call dword [fcn.100402dc]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
push 0x2c
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x2bc], 5
call fcn.10354d32
push eax
call fcn.103572d2
add esp, 0xc
xor edi, edi
mov dword [esp + 0x14], ebx
nop
Function at 0x10356252
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor ecx, ecx
test edx, edx
jle 0x1035628c
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
lea ebx, [ebx]
xor eax, eax
test edi, edi
jle 0x10356283
mov bl, byte [eax + ebp]
xor byte [ecx + esi], bl
inc eax
cmp eax, edi
jl 0x10356278
inc ecx
cmp ecx, edx
jl 0x10356272
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10356ba2
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x2004
call fcn.10366402
mov eax, dword [esp + reloc.WINMM.dll_midiStreamOut]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [fcn.10040344]
mov esi, eax
cmp esi, reloc.WINMM.dll_midiStreamOut
jne 0x10356bde
xor al, al
pop esi
add esp, 0x2004
ret
push edi
mov edi, dword [fcn.1004034c]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x40
lea edx, [esp + 0x18]
push edx
push esi
call edi
test eax, eax
je 0x10356c93
cmp dword [esp + 8], 0x40
jne 0x10356c93
cmp word [esp + 0xc], 0x5a4d
jne 0x10356c93
mov eax, dword [esp + 0x48]
push 0
push 0
push eax
push esi
call dword [fcn.10040288]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0xf8
lea edx, [esp + 0x18]
push edx
push esi
call edi
test eax, eax
je 0x10356c93
cmp dword [esp + 8], 0xf8
jne 0x10356c93
push esi
call dword [fcn.10040358]
cmp dword [esp + 0xc], 0x4550
jne 0x10356c9a
mov eax, dword [esp + reloc.WINMM.dll_midiStreamOut]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
lea eax, [esp + 0xc]
xor ecx, ecx
mov edx, 0x1f
nop
mov esi, dword [eax + 4]
add esi, dword [eax]
add ecx, esi
add eax, 8
dec edx
jne 0x10356c72
mov edx, dword [esp + reloc.WINMM.dll_midiStreamOut]
pop edi
mov dword [edx], ecx
mov al, 1
pop esi
add esp, 0x2004
ret
push esi
call dword [fcn.10040358]
pop edi
xor al, al
pop esi
add esp, 0x2004
ret
Function at 0x10358ed2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x10358eeb
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], reloc.WINMM.dll_midiStreamOut
mov dword [esp + 0x10], edx
jmp 0x10358f12
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x10358f2f
jmp 0x10358f22
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x10358f2f
inc edi
cmp edi, edx
jb 0x10358f22
mov eax, edi
sub eax, ecx
cmp edi, edx
mov ecx, eax
jae 0x10359037
sub ecx, dword [esp + 0x1c]
cmp ecx, 3
jbe 0x10358f63
xor ebp, ebp
mov cl, byte [edi + 4]
test cl, cl
mov dword [esp + 0x1c], eax
je 0x10358f9e
cmp cl, 0xff
je 0x10358f9e
and ebp, 3
shl ebp, 1
or ebp, 1
inc eax
jmp 0x10358f12
dec ecx
shl ebp, cl
and ebp, 7
je 0x10358f48
movzx ecx, byte [ebp + 0x10041b74]
mov ebx, edi
sub ebx, ecx
mov cl, byte [ebx + 4]
mov bl, byte [ebp + 0x10041b6c]
test bl, bl
je 0x10358f8c
test cl, cl
je 0x10358f8c
cmp cl, 0xff
jne 0x10358f48
and ebp, 3
shl ebp, 1
mov dword [esp + 0x1c], eax
or ebp, 1
inc eax
jmp 0x10358f12
xor edx, edx
mov dh, cl
movzx ecx, byte [edi + 2]
mov dl, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x10358fc6
lea ebx, [edx + eax]
add ebx, esi
jmp 0x10358fcc
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x10359009
movzx esi, byte [ebp + 0x10041b74]
shl esi, 3
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x10358fee
cmp dl, 0xff
jne 0x10359005
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x10358fb7
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x10358f12
mov esi, dword [esp + 0x1c]
pop edi
sub ecx, esi
cmp ecx, 3
pop esi
pop ebx
jbe 0x10359050
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
dec ecx
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret