joyce8/EMBER2024-capa huggingface dataset:
Function at 0x501120
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004f4d0e
and dword [ebp - 4], 0
cmp dword [0x545de8], 0
mov ebx, eax
jne 0x5011d1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x501282
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x501282
push eax
call fcn.004f4c9c
mov dword [esp], 0x515590
push edi
mov dword [0x545de8], eax
call esi
push eax
call fcn.004f4c9c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x545dec], eax
call esi
push eax
call fcn.004f4c9c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x545df0], eax
call esi
push eax
call fcn.004f4c9c
pop ecx
mov dword [0x545df8], eax
test eax, eax
je 0x5011d1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004f4c9c
pop ecx
mov dword [0x545df4], eax
mov eax, dword [0x545df4]
cmp eax, ebx
je 0x501229
cmp dword [0x545df8], ebx
je 0x501229
push eax
call fcn.004f4d17
push dword [0x545df8]
mov esi, eax
call fcn.004f4d17
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x501229
test edi, edi
je 0x501229
call esi
test eax, eax
je 0x501220
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x501220
test byte [ebp - 0xc], 1
jne 0x501229
or dword [ebp + 0x10], 0x200000
jmp 0x501262
mov eax, dword [0x545dec]
cmp eax, ebx
je 0x501262
push eax
call fcn.004f4d17
pop ecx
test eax, eax
je 0x501262
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x501262
mov eax, dword [0x545df0]
cmp eax, ebx
je 0x501262
push eax
call fcn.004f4d17
pop ecx
test eax, eax
je 0x501262
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x545de8]
call fcn.004f4d17
pop ecx
test eax, eax
je 0x501282
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x501284
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10123377
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.101233f6
jae 0x10123383
xor ecx, ecx
call fcn.101233f6
jae 0x101233ad
xor eax, eax
call fcn.101233f6
jae 0x101233be
mov al, 0x10
call fcn.101233f6
adc al, al
jae 0x1012339f
jne 0x101233eb
stosb byte es:[edi], al
jmp 0x10123384
call fcn.10123402
dec ecx
loop 0x101233ca
mov eax, ebp
call fcn.10123400
jmp 0x101233ec
lodsb al, byte [esi]
shr eax, 1
je 0x10123412
adc ecx, 2
mov ebp, eax
jmp 0x101233ec
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.10123400
cmp eax, 0x7d00
jae 0x101233ea
cmp eax, 0x500
jae 0x101233eb
cmp eax, 0x7f
ja 0x101233ec
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10123384
pop ebp
ret 8

Function at 0x10136d44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.10136dc3
jae 0x10136d50
xor ecx, ecx
call fcn.10136dc3
jae 0x10136d7a
xor eax, eax
call fcn.10136dc3
jae 0x10136d8b
mov al, 0x10
call fcn.10136dc3
adc al, al
jae 0x10136d6c
jne 0x10136db8
stosb byte es:[edi], al
jmp 0x10136d51
call fcn.10136dcf
dec ecx
loop 0x10136d97
mov eax, ebp
call fcn.10136dcd
jmp 0x10136db9
lodsb al, byte [esi]
shr eax, 1
je 0x10136ddf
adc ecx, 2
mov ebp, eax
jmp 0x10136db9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.10136dcd
cmp eax, 0x7d00
jae 0x10136db7
cmp eax, 0x500
jae 0x10136db8
cmp eax, 0x7f
ja 0x10136db9
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10136d51
pop ebp
ret 8
Function at 0x101def39
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.101df0e9
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x101df037
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x101defda
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x101df01d
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x101deff1
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x101df00c
test al, 0x40
je 0x101df003
mov ecx, dword [edi + 0x20]
jmp 0x101df00a
test al, 0x80
je 0x101df01d
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x101df01d
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x101defa9
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x101e3089
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
push ebp
mov ebp, dword [esp + 8]
je 0x101e31bc
test ebp, ebp
jle 0x101e31bc
push esi
or esi, reloc.WINMM.dll_waveOutGetNumDevs
cmp ebp, 8
jl 0x101e318d
push edi
mov edi, ebp
shr edi, 3
mov eax, edi
neg eax
lea ebp, [ebp + eax*8]
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + reloc.WINMM.dll_waveOutGetNumDevs]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.WINMM.dll_waveOutGetNumDevs]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + reloc.WINMM.dll_waveOutGetNumDevs]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.WINMM.dll_waveOutGetNumDevs]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.WINMM.dll_waveOutGetNumDevs]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.WINMM.dll_waveOutGetNumDevs]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.WINMM.dll_waveOutGetNumDevs]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.WINMM.dll_waveOutGetNumDevs]
add ecx, 1
sub edi, 1
mov esi, eax
jne 0x101e30b9
pop edi
test ebp, ebp
je 0x101e31b5
jmp 0x101e3199
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + reloc.WINMM.dll_waveOutGetNumDevs]
add ecx, 1
sub ebp, 1
jne 0x101e3199
mov eax, esi
pop esi
not eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x101e5229
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x41994f
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esp + 0x14], edi
mov dword [esi], reloc.WINMM.dll_waveOutGetNumDevs
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x34], eax
mov byte [esp + 0x14], 1
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x38], eax
mov byte [esp + 0x14], 2
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x40], eax
mov byte [esp + 0x14], 3
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x44], eax
mov byte [esp + 0x14], 4
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x48], eax
mov byte [esp + 0x14], 5
call fcn.101e5dd9
mov dword [esi + 0x3c], eax
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x101e78f9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x419b0a
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esp + 0x14], edi
mov dword [esi], reloc.WINMM.dll_waveOutGetNumDevs
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov byte [esp + 0x14], 2
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x28], eax
mov byte [esp + 0x14], 3
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x2c], eax
mov byte [esp + 0x14], 4
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x40], eax
mov byte [esp + 0x14], 5
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x44], eax
mov byte [esp + 0x14], 6
call fcn.101e5dd9
push edi
push 0x10
push 0x10
push 1
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
push 0x65
push eax
call dword [0x41a1c4]
mov dword [esi + 0x24], eax
mov ecx, dword [reloc.WINMM.dll_waveOutGetNumDevs]
push 0x65
push ecx
call dword [0x41a1c8]
mov dword [esi + 0x20], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x101e7e69
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4197e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], 0
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
mov ebx, dword [edi + 0x38]
push ecx
call fcn.101e5d39
mov eax, dword [edi + 0x38]
mov edx, dword [eax + 4]
add eax, 4
xor ebx, ebx
push ebx
push edx
call dword [0x41a208]
push 0x30
call fcn.101ec242
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x101e7f44
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi], reloc.WINMM.dll_waveOutGetNumDevs
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x28], eax
mov eax, dword [reloc.WINMM.dll_waveOutGetNumDevs]
mov edx, dword [eax + 0xc]
mov ecx, 0x422b74
call edx
add eax, 0x10
mov dword [esi + 0x2c], eax
jmp 0x101e7f46
xor esi, esi
cmp esi, ebx
mov ebp, dword [esp + 0x18]
mov dword [edi + 0x3c], esi
je 0x101e7fb2
push ecx
lea eax, [ebp - 0x10]
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.101e2ac9
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x30], 2
mov eax, dword [esp + 0x18]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
call fcn.101e2ac9
add eax, 0x10
mov dword [esi], eax
mov eax, dword [edi + 0x3c]
push eax
mov byte [esp + 0x38], 1
call fcn.101e4f19
mov ecx, dword [edi + 4]
push 5
push ecx
call dword [0x41a208]
mov edx, dword [edi + 4]
push edx
call dword [0x41a204]
mov eax, dword [edi + 4]
mov edi, dword [edi + 0x3c]
push eax
call fcn.101e9959
lea eax, [ebp - 0x10]
mov byte [esp + 0x2c], bl
lea ecx, [eax + 0xc]
or edx, reloc.WINMM.dll_waveOutGetNumDevs
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x101e7fd2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2c], reloc.WINMM.dll_waveOutGetNumDevs
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, reloc.WINMM.dll_waveOutGetNumDevs
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x101e7ffa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x1020c256
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.1020c2d5
jae 0x1020c262
xor ecx, ecx
call fcn.1020c2d5
jae 0x1020c28c
xor eax, eax
call fcn.1020c2d5
jae 0x1020c29d
mov al, 0x10
call fcn.1020c2d5
adc al, al
jae 0x1020c27e
jne 0x1020c2ca
stosb byte es:[edi], al
jmp 0x1020c263
call fcn.1020c2e1
dec ecx
loop 0x1020c2a9
mov eax, ebp
call fcn.1020c2df
jmp 0x1020c2cb
lodsb al, byte [esi]
shr eax, 1
je 0x1020c2f1
adc ecx, 2
mov ebp, eax
jmp 0x1020c2cb
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.1020c2df
cmp eax, 0x7d00
jae 0x1020c2c9
cmp eax, 0x500
jae 0x1020c2ca
cmp eax, 0x7f
ja 0x1020c2cb
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1020c263
pop ebp
ret 8
Function at 0x102342b2
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.10234462
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x102343b0
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10234353
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x10234396
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x1023436a
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x10234385
test al, 0x40
je 0x1023437c
mov ecx, dword [edi + 0x20]
jmp 0x10234383
test al, 0x80
je 0x10234396
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x10234396
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x10234322
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x102353f1
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x10235412
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x10235409
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x10235401
mov eax, ebx
leave
ret

Function at 0x10235438
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x10235497
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x102354c4
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x102354b3
xor ecx, eax
xor edx, ebx
dec edi
jne 0x102354a4
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x102354ea
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x1023548b
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x103e999b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], bx
sub esp, 0xa
jno 0x103e99c1
jo 0x103e99c1
xor dword [edx + reloc.WINMM.dll_waveOutGetNumDevs], esp
arpl word [edx - 0x72e81b0b], bx
and al, 4

Function at 0x103e99c6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
xor ebp, 0x497b68c3
call fcn.103e999b
call fcn.103e9a14
jmp 0x103e99ec
lea esp, [esp + 2]
ror ebp, 0
jmp 0x103e99f7
rdtsc
mov ecx, ebp
jmp 0x103e9a2f
jmp 0x103e99b2
shl edx, 0x16
jbe 0x103e99c8
lea esp, [esp + 2]
jmp 0x103e99cc
btc cx, di
jns 0x103e99d1
rdtsc
mov ecx, ebp
mov edx, dword [esp]
dec edx
bts cx, cx
jmp 0x103e9a19
lea eax, reloc.WINMM.dll_waveOutGetNumDevs
xchg dx, ax
jmp 0x103e9a39
mov edx, dword [esp]
dec edx
bts cx, cx
jmp 0x103e9a19
ror ebp, 0
add dl, 0xa0
je 0x103e9a87
lea ecx, [edi*4]
sub esp, 0x15
lea eax, [edx + esi]
jmp 0x103e9aa6
sub esp, 0x15
lea eax, [edx + esi]
mov word [esp + 7], bp
pop dword [esp + 2]
mov dword [esp], ecx
lea esp, [esp + 1]
jmp 0x103e9a90
lea ecx, [edi*4]
jmp 0x103e9a6a
lea esp, [esp + 0x24]
sub ebp, 0x3482f71d
xchg al, ch
sub esp, 0xe
jmp 0x103e9f4f
mov word [esp + 7], bp
pop dword [esp + 2]
jmp 0x103e9a79
sub esp, 0x1d
mov ax, bx
mov dh, 0x99
lea esp, [esp + 3]
lea esp, [esp + 0x28]
sub ebp, 0x30f2592b
jmp 0x103e9ed5
rdtsc
call 0x103e9f1c
xchg edx, ecx
call 0x103e9f04
mov dword [reloc.WINMM.dll_waveOutGetNumDevs], eax
mov cl, byte [edi + 0x1fec8515]
lodsd eax, dword [esi]
add al, 0xb7
sahf
jmp 0x74cc38ad
mov dh, 0x99
lea esp, [esp + 3]
jmp 0x103e9abd
je 0x103e9ab1
sub esp, 0x1d
mov ax, bx
jmp 0x103e9ef3

Function at 0x103ec081
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x3d6778
jmp 0x103ec0f0
push word [esp]
jmp 0x103ec0c2
jnp 0x103ec0d8
lea esp, [esp + 2]
mov dword [esp + 8], edi
jmp 0x103ec0ea
lea esp, [esp + 2]
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x103ec11c
lea esp, [esp + 8]
jmp 0x103ec11c
xchg si, di
bswap edx
lea edi, [ebx*4]
jmp 0x103ec122
pushfd
jmp 0x103eae3a
mov esi, dword [esp + 0x2c]
bts bx, bp
jo 0x103ec17a
mov bh, byte [esp]
jmp 0x103ec154
mov bh, byte [esp]
xchg bp, bx
xchg bl, cl

Function at 0x103ed746
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dl
add esp, 3
jmp 0x103ed780
jle 0x103ed796
lea esp, [esp + 1]
jmp 0x103ed79a
lea esp, [esp + 1]
mov esp, eax
jmp 0x103edf36
clc
jl 0x103edc51
jge 0x103edc51
ror dword [ecx - 0x27], cl
mov eax, 0x8b68f94b
and bl, byte [ebp - 0x54]
mov edi, 0xf58b0ff5
stc
invalid
pop edi
pop esi
popfd
jmp 0x103ecf51
cld
rep movsb byte es:[edi], byte [esi]
pop ecx
jmp 0x103ed7ef
mov esi, ecx
mov edi, eax
mov ecx, edx
jmp 0x103ed812
push edi
push ecx
jmp 0x103ed8c3
pushfd
lea edi, [eax + edx - 0x40]
push esi
jmp 0x103ed7a1
Function at 0x103ee384
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x103ed0db
jmp 0x103ee3e0
call fcn.103ee11e
pushfd
jmp 0x103ee165
jmp 0x103ee265
cmp dword [esp + 4], 0
jne 0x103ee14f
pushal
jmp 0x103ed0d6
inc dword [esp + 8]
popfd
ret
call 0x103ee384
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
dec edi
sar byte [esi - 0x12451635], 1
invalid
pop eax
sub eax, 0xcbc0a846
jmp 0x103ee374

Function at 0x103eecb4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], eax
jmp 0x103eea55
jmp 0x103eeb02
mov dword [esp + 0x28], eax
jmp 0x103eec21
popal
inc dword [esp + 8]
popfd
ret
push edx
jmp 0x103eebfd
pop ecx
sub ecx, 0x10016e89
mov dword [ecx + 0x1001830f], eax
jmp 0x103eea5c
cmp ebx, 0xe6bbdc5
je 0x103eec35
jne 0x103ed572
pop ecx
sub ecx, 0x10016f10
push edi
jmp 0x103eecba
mov edx, eax
movzx ebx, byte [edx]
pop edx
add ebx, 0xe6bbcf9
jmp 0x103eebd1
lea esp, [esp + 4]
ret
popal
push esi
lea esp, [esp + 4]
popfd
jmp 0x103eec0b
je 0x103eeca4
jne 0x103ed64e
and dword [edi + reloc.WINMM.dll_waveOutGetNumDevs], edi
or dword [eax + reloc.WINMM.dll_waveOutGetNumDevs], edx
dec edx
mov ecx, 0x6900977
popal
nop
push ebp
lea ebx, [ecx + eax*4]
sti
retf
cmp ebx, 0xbe3af2cb
jmp 0x103eec2a
call 0x103eecb4
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
cmp dword [edi + edi*4 - reloc.WINMM.dll_waveOutGetNumDevs], ebp
mov edi, ecx
lea edi, reloc.WINMM.dll_waveOutGetNumDevs
mov dword [edi], eax
pop edi
movzx ebx, byte [eax]
add ebx, 0xbe3af1ff
jmp 0x103eec40

Function at 0x1055cf69
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov word [esp], cx
push dword [esp + 3]
mov dword [esp + 0x28], edi
jmp 0x1055cf53
Function at 0x402995
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00402b45
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x402a93
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x402a36
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x402a79
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x402a4d
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x402a68
test al, 0x40
je 0x402a5f
mov ecx, dword [edi + 0x20]
jmp 0x402a66
test al, 0x80
je 0x402a79
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x402a79
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x402a05
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret