joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452170
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x485d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0047e773
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00451b10
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0047e6a1
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0047af65
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0047af65
push 1
push 0
push 0
mov ecx, esi
call fcn.0047af0d
push 1
push 0
push 1
mov ecx, esi
call fcn.0047af0d
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047e7e5
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4522f0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x485d38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0047e773
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00451b10
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0047e6a1
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x4523b4
cmp dword [esp + 0x40], 1
jne 0x4523b2
cmp ecx, eax
jge 0x4523b4
mov eax, ecx
cmp eax, 0xc8
jge 0x4523c0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00452170
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047e7e5
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x452b30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x485da3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00479382
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0047ea1b
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0047ff37
test eax, eax
je 0x452c4c
mov ecx, dword [esp + 0x3c]
call fcn.0047ea48
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x452c10
push edi
mov ecx, esi
call fcn.0047c0b0
mov ecx, esi
call fcn.00452db0
cmp dword [esp + 0x38], 1
jne 0x452c45
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0047c1eb
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x455660
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x455693
push esi
call fcn.00458760
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45568c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x455719
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x455702
mov eax, dword [esi + 8]
test eax, eax
je 0x4556b7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4556fe
cmp eax, 2
je 0x455702
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4556aa
cmp eax, 3
je 0x4556dd
cmp eax, 1
jne 0x4556aa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4556aa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4556aa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00455740
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x455728
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00455740
add esp, 4
pop esi
ret

Function at 0x462760
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x462803
test eax, eax
jbe 0x462803
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x462803
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4627ae
xor esi, esi
jmp 0x4627b4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4627df
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004172c0
add esi, eax
push esi
mov ebx, esi
call fcn.004172c0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4627c0
pop ebp
test edi, edi
pop edi
jne 0x462803
test ebx, ebx
je 0x462803
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004688c0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x462945
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x462a5d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x462a5d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004797d4
mov esi, eax
test esi, esi
je 0x462a5d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x462a5d
mov ecx, esi
call fcn.004628b0
cmp edi, eax
jge 0x462a5d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4629e3
mov dword [esp + 0x34], 1
jmp 0x462a3e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x462a5d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004610c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x47a178
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47a1b0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00478205
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004781dd
jmp 0x47a1bc
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47b86d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47b8af
call fcn.00481322
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47b8af
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47b8a6
xor eax, eax
jmp 0x47b8b7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047b8bd
pop edi
pop esi
pop ebx
ret 4
Function at 0x481852
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x481880
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48189e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004817b8
jmp 0x48189e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48189e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004817b8
test edi, edi
mov eax, edi
jne 0x481888
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5bbc99
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
cmp eax, 1
pushal
pop dword [esp + 0xa]
jmp 0x5eba85
jmp 0x5ec15f
pop ebx
pushal
mov byte [esp + 4], bh
lea esp, [esp + 0x20]
jmp 0x5ec139
bsr di, bp
mov bx, 0xb639
jmp 0x5eba30
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
lea edi, [esp + ebp]
sete dh
jmp 0x5ebad6
mov ecx, 0xff
jmp 0x5eb77f
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
mov ebx, 0xe7072e2a
jmp 0x5eba4a
lea esp, [esp + 0x1c]
jle 0x5eb5c4
mov cx, word [esp]
lea ecx, [eax + edx]
xchg cx, bx
jmp 0x5eba68
fldpi
int 0x35
test al, 0x3e
pop ecx
test al, 0x17
inc ebp
sub edx, 0x10
call fcn.005eb9f5
mov edi, edx
call 0x5ebac0
aam 0x76
in al, 0x83
jle 0x5ebab0
add ah, dl
jbe 0x5eba98
cmp dword [esi - 7], reloc.WINMM.dll_midiStreamOut
imul edi, ebx, 0xffffff9e
out 0x6b, eax
sti
sahf
insd dword es:[edi], dx
test al, 0xe
cdq
clc
call fcn.005ebadf
ficomp dword [edi - 0x31]
stosb byte es:[edi], al
pop ecx
mov eax, dword [reloc.WINMM.dll_midiStreamOut]
mov al, 0x71
sub eax, 0x1960f3c
add esi, 0x10
inc dx
mov edx, dword [esi]
jmp 0x5ebaaa
leave
call fcn.005ec1af
pop edi
xchg bl, bh
lea ebx, [ebx*4]
pop esi
jmp 0x5eb5c9

Function at 0x5be847
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
push word [esp + 9]
call fcn.00600ce9
xchg esp, eax
sub dword [edx + reloc.WINMM.dll_midiStreamOut], 0x81168ff5
sub al, 0xa7
aaa
push edx
mov eax, dword [reloc.WINMM.dll_midiStreamOut]
add byte [eax + 0x9fa9f0f], al
shr dword [esi], cl
mov al, byte [0x64a05136]
pop ebp
lodsb al, byte [esi]
mov edi, 0x1de83186
add al, 0
call 0x600db5
popal
loop 0x5be80b
pop ss
loop 0x5be7c2
mov eax, dword [reloc.WINMM.dll_midiStreamOut]
out dx, al
fidiv dword [reloc.WINMM.dll_midiStreamOut]
sahf
invalid
push 0xffffffffffffffd5
or esp, dword [edx - reloc.WINMM.dll_midiStreamOut]
lodsd eax, dword [esi]
pop esp
call 0x55d6ab12
lea eax, [edx*4]
bswap edx
jmp 0x5be82b
mov ebx, dword [ebp]
mov edx, 0x6b8a95c4
call 0x5be847
imul eax, dword [edx + reloc.WINMM.dll_midiStreamOut], 0xffffff99
adc esi, dword [edx - 0x45]
call fcn.005be81e
xchg dh, dl
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x601688
pushal
push dword [esp]
add esi, edx
jmp 0x600c91
push word [esp + 1]
jmp 0x600c7b
lea esp, [esp + 0x28]
jbe 0x5be793
ja 0x5be762
stosd dword es:[edi], eax
ret 0x4c7d
stc
cmp eax, esi
push edx
mov dword [esp], esi
pop word [esp]
jmp 0x600c5b
lea esp, [esp + 0x2c]
test ecx, ecx
call fcn.00600cef
mov dl, byte [esi]
test bl, ah
push ds
ficomp dword [eax]
mov ebx, dword [ebx]
jle 0x600c53
xor al, 0x8e
sub al, 0xa2
lds esi, [ebx + esi*4]
mov ecx, 0x8310498b
in al, dx
or al, 0x8f
add al, 0x24
mov ecx, dword [ecx + 0x10]
sub esp, 0xc
pop dword [esp]
jmp 0x600cb0
lea esp, [esp + 2]
jmp 0x600cce
add ebp, 2
bswap eax
mov edx, 0x17177e7e
mov edx, 0x6afa7caa
adc eax, eax
jmp 0x6016bd
jno 0x6016e9
jo 0x6016e9
mov dx, 0x10cf
mov word [ebp], ax
not ebx
bsf dx, si
jl 0x601710
mov dh, byte [esp]
rcl dx, cl
jmp fcn.005ca277
mov al, byte [ebx]
lea edx, [esi + edi]
mov dx, bp
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0x6016c1
mov dh, byte [esp]
rcl dx, cl
jmp fcn.005ca277
jmp 0x6016f9
Function at 0x5ca2c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp + 3]
jmp 0x5ca314
mov bh, byte [esp + 3]
jmp 0x5ca314
xchg ebx, edx
setge dh
jmp 0x5ca2f7
bsr dx, bp
jge 0x5ca297
jl 0x5ca2a1
invalid
xchg ebx, edx
setge dh
jmp 0x5ca2f7
cmp ebp, eax
ja 0x5c8f6e
lea ebx, reloc.WINMM.dll_midiStreamOut
xchg dx, bx
jmp 0x5ca322
lea eax, [edi + 0x50]
setae bh
bsr dx, bp
jae 0x5ca2a7
jb 0x5ca2ec
lea edx, reloc.WINMM.dll_midiStreamOut
mov dh, ch
jmp 0x5ca578
rcl dx, cl
sub esp, 0x18
lea edx, [edi + 0x40]
not ax
call fcn.005ca3f8
mov al, byte [edi + 0x40e82404]
xchg dword [esp], eax
call fcn.005ca475
lea eax, [eax - 0x5b]
sub esp, 0xa
pop dword [esp]
add esp, 1
mov byte [esp + 1], dh
jmp 0x5ca451
and eax, 0x796ec754
mov dh, byte [esp]
jmp 0x5ca41b
mov ebx, edi
dec edx
ja 0x5ca44c
mov dh, byte [esp]
rcl dx, cl
sub esp, 0x18
call fcn.005ca39d
clc
ja 0x5ca5c5
pushal
lea esp, [esp + 0x20]
popal
jmp 0x5ca5ae
popal
pushal
xchg si, cx
mov dword [esp + 0x18], edx
jmp 0x5ca5cc
pushal
lea esp, [esp + 0x20]
jmp 0x5ca5ad
stc
jae 0x5ca5fd
popal
jmp 0x5ca5fe
rep movsb byte es:[edi], byte [esi]
pop ecx
mov edi, 0x6b38f052
jmp 0x5ca601
mov edi, dword [esp]
stc
jmp 0x5ca715
popal
cld
jmp 0x5ca5d2
inc edi
jns 0x5ca5dc
mov edi, dword [esp]
stc
lea esp, [esp + 4]
jmp 0x5ca719
lea esp, [esp + 4]
pop esi
popfd
jmp 0x5c8f6e

Function at 0x5db479
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 4]
push ecx
call fcn.005db4a2
cmpsb byte [esi], byte es:[edi]
das
mov edi, 0xccf629da
inc eax
salc
mov cl, 0x40
invalid

Function at 0x5ebadf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x20]
sub esp, 0x1e
lea esp, [esp + 2]
shr edi, 0x18
sub esp, 0x12
jmp 0x5ebb2a
pop ecx
mov si, word [esp]
bswap esi
not esi
pushal
jmp 0x5eb9d1
and edi, ecx
stc
jmp 0x5ebb8a
push esp
stc
sub esp, 2
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
stc
jmp 0x5ebb12
mov dword [esp], eax
lea esp, [esp + 4]
call fcn.005bd4b0
mov esi, 0xe02300aa
mov di, word [esp]
jmp 0x5ebb03
lea eax, reloc.WINMM.dll_midiStreamOut
mov edi, dword [eax]
pop eax
call 0x5ebb5c
adc ebx, dword [edx + reloc.WINMM.dll_midiStreamOut]
jnp 0x5ebbda
int 0x5c
push eax
mov eax, edi
lea eax, [eax*4]
jmp 0x5ebb72
movsd dword es:[edi], dword [esi]
xor eax, 0x883fcca5
movsb byte es:[edi], byte [esi]
xlatb
notrack jmp 0x5ebb45
jmp 0x5ebb45

Function at 0x5ebd4b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
jmp 0x5ebd89
lea esp, [esp + 1]
jmp 0x5ebf8b
mov dword [eax], edi
pop eax
inc di
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov edi, 0xdd2c24be
jmp 0x5ebe1b
push eax
mov eax, esi
lea eax, [eax + 4]
jmp 0x5ebdd2
mov dx, word [esp]
mov edx, dword [esi + 8]
clc
push esp
mov dword [esp], ecx
jmp 0x5ebdf3
bsr di, cx
sub esp, 0x1c
inc di
pushal
neg ecx
jmp 0x5ebed7
lea esp, [esp + 3]
lea esp, [esp + 0x2c]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
setp dh
mov edx, dword [esp]
jmp 0x5ebe0d
setl ch
mov bp, di
mov dword [esp], edx
sub esp, 2
call fcn.005ebe6e
and edx, ecx
sub esp, 0x14
pop dword [esp + 4]
sub esp, 4
add esp, 5
jmp 0x5ebe3a
Function at 0x5ebeea
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
lea esp, [esp + 1]
and ebx, ecx
jmp 0x5ebf3c
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov bl, bh
jmp 0x5ebf23
lea ebx, [edi*4]
pushal
jmp 0x5ebf64
sub esp, 0x18
pop dword [esp + 0xa]
push word [esp + 5]
pop word [esp + 5]
jmp 0x5ebef5

Function at 0x5ec044
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esi + 8], edi
lea edi, [esp + ecx]
push ebp
jmp 0x5ebff1
pushal
xchg ebp, ecx
mov al, ah
mov dword [esp], edx
popal
jmp 0x5ebfdb
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
neg edx
sub esp, 0xe
lea esp, [esp + 2]
mov edx, dword [esi + 0xc]
jmp 0x5ebf9f
pushal
mov word [esp + 0x1c], sp
jmp 0x5ec024
mov ebp, ebx
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [ebp]
pop ebp
jmp 0x5ebfa8
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_midiStreamOut
mov edi, dword [esi]
pop esi
push edx
jmp 0x5ec02c
shr edi, 0x18
push esi
mov esi, edi
jmp 0x5ec006
mov word [esp], di
pushal
jmp 0x5ec0a1
mov byte [esp], ah
lea esp, [esp + 1]
lea esp, [esp + 3]
lea esp, [esp + 0x1c]
jmp 0x5ebfc6
movzx ebx, byte [esi + 0xe]
push esp
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x5ec082
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
inc bx
sets bl
xchg bl, bh
jmp 0x5ec058
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
call fcn.005ec0ae
sbb dword [ebp + 0x328f7c15], eax
test eax, 0x3ec3a436
sti
mov ecx, 0x2ddebb2b
out dx, eax
into
and edi, ecx
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
and ebx, ecx
jmp 0x5ec06e

Function at 0x5ec22a
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
jmp 0x5ec0b6

Function at 0x6ed79f
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
jmp 0x6ed7a7
pushal
lea edx, reloc.WINMM.dll_midiStreamOut
pop ebx
xchg byte [esp + 1], cl
mov bp, bx
cpuid
jmp 0x6ed7dc
Function at 0x6edaa8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 2], sp
xchg word [esp], dx
and edi, ecx
pop cx
shr bh, 3
neg dx
jmp 0x6eda78
cmc
pop dword [esp]
xchg ah, bl
mov word [esp], di
btc edx, ebx
xchg dword [esp], esi
jmp 0x6eda02
rdtsc
stc
mov ebx, dword [esp + 1]
clc
sub esp, 0xc
pop di
jmp 0x6eda86
mov ecx, 0xc44b434c
lea esp, [esp + 5]
push word [esp + 2]
mov edi, dword [esp + 2]
xchg ecx, eax
jmp 0x6edb15
lea esi, [edi + edi]
push esp
xchg byte [esp + 2], al
xchg bh, cl
pop word [esp]
not cx
jmp 0x6eda31
mov bl, 0xe0
mov byte [esp + 1], ah
clc
bswap edi
cmc
neg ah
jmp 0x6eda59
rdtsc
mov word [esp + 0xc], sp
shr dh, 7
add esp, 7
mov ecx, dword [esp + 5]
mov edx, ecx
jmp 0x6eda40
btr edi, esp
jmp 0x6eda1f
and edi, ecx
call fcn.006edab0
mov esi, 0x5c789050
not si
add al, dh
mov bp, di
bsr ax, bp
mov bl, bh
jmp 0x6edb47
pop edi
mov ch, byte [esp]
add esp, 0
neg bx
stc
btr ebp, esp
jmp 0x6edad8
xchg byte [esp], dl
mov ax, sp
rcl cx, cl
lea edx, [ecx + 0xbb]
mov dh, byte [esp]
sub esp, 0
jmp 0x6edb59
rdtsc
rdtsc
rdtsc
mov ecx, dword [esp]
mov esi, dword [esp]
mov di, 0x5641
jmp 0x6edb25
setp bh
mov bh, byte [esp]
mov ch, byte [esp]
xchg edx, ebx
cld
xchg ch, dl
jmp 0x6edbd8
lea ebx, reloc.WINMM.dll_midiStreamOut
mov ecx, 0xbebde36c
call fcn.006edb7b
cpuid
mov dl, dh
setno ah
inc di
lea eax, [ecx - 0xfb]
mov dl, dh
jmp 0x6edba6

Function at 0x6edab0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp + 4]
cld
xchg di, ax
push edx
push word [esp + 1]
jmp 0x6edafd
mov cx, 0x582d
mov byte [esp], bh
inc bp
mov bp, sp
cpuid
jmp 0x6edadf
add esp, 0xa
cmc
mov dh, byte [esp]
lea ebp, [ecx + 0x33]
mov dl, dh
xchg edi, esi
jmp 0x6edabf

Function at 0x6edb7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [eax - 0x59]
setg dh
xchg dword [esp], ebp
xchg byte [esp], cl
jmp 0x6edb8d
lea ebp, [eax - 0x29]
sub di, 0x710
mov al, ah
inc edx
rdtsc
mov ebp, dword [esp + 2]
jmp 0x6edbb6
stc
pop di
sub esp, 6
setge ah
neg bp
xchg word [esp + 2], cx
jmp 0x6edc0a
xchg word [esp + 4], ax
push dword [esp + 4]
ror bh, 3
mov dl, dh
bswap edi
xchg bh, cl
jmp 0x6edc46
pop bx
and bx, 0xeb3a
xchg byte [esp], cl
xchg dh, al
mov di, 0xd2d3
jmp 0x6edbeb
xchg bp, di
push dword [esp]
sub bl, ah
pop ax
sub esp, 0x16
cmc
jmp 0x6edd19
add esp, 5
mov di, word [esp + 2]
mov bx, di
xchg si, ax
rcr ebp, 3
xchg dh, al
jmp 0x6edc2c
push dword [esp]
xchg ebp, ecx
mov ebp, dword [esp + 0x2f]
mov eax, 0x7b2166de
xchg byte [esp + 0x2e], bl
mov bx, word [esp + 0x1a]
jmp 0x6edcb8
mov byte [esp + 0xf], ah
push edx
neg bh
sub esp, 0xc
mov eax, 0x82f8ae46
not ecx
jmp 0x6edc81
xchg byte [esp + 0xc], al
mov al, 0xee
neg bp
mov byte [esp + 0x12], ah
call fcn.006edd00
mov ah, 0x3f
scasd eax, dword es:[edi]
retf 0xa439
mov cx, 0x5281
mov si, 0xdae9
rdtsc
mov dl, dh
lea ecx, reloc.WINMM.dll_midiStreamOut
mov edx, ebp
jmp 0x6edca5
mov cl, 0x9a
mov ecx, dword [esp + 0xd]
mov ah, byte [esp + 1]
mov ax, di
add ecx, ebp
btc esi, edi
jmp 0x6edcd2