joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425fc1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x42600b
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x425fb2
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x425fc1
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x82bc64
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x426012
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.0040ce88
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4260b1
add edi, 4
add eax, 2
dec ecx
jne 0x425ff7
call 0x42605e
loope 0x426054
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4260ae
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4260bf
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x426072
cmp eax, ecx
ja 0x426072
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4260fc
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4260f2
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.0040d367
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0xa8e108
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa8e258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa8e12e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8e11a
add dl, dl
jne 0xa8e139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8e18c
xor eax, eax
add dl, dl
jne 0xa8e146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8e22d
add dl, dl
jne 0xa8e155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa8e160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa8e16b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa8e176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa8e182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa8e125
mov eax, 1
add dl, dl
jne 0xa8e19a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa8e1a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa8e191
sub eax, ebx
mov ebx, 1
jne 0xa8e1d8
mov ecx, 1
add dl, dl
jne 0xa8e1be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa8e1c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa8e1b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa8e125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa8e1ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa8e1fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa8e1e6
cmp eax, 0x7d00
jae 0xa8e21d
cmp eax, 0x500
jb 0xa8e218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa8e125
cmp eax, 0x7f
ja 0xa8e220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa8e125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa8e24e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa8e125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1084d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1084d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1084d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1084d06a
add dl, dl
jne 0x1084d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1084d0dc
xor eax, eax
add dl, dl
jne 0x1084d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1084d17d
add dl, dl
jne 0x1084d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1084d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1084d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1084d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1084d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1084d075
mov eax, 1
add dl, dl
jne 0x1084d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1084d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1084d0e1
sub eax, ebx
mov ebx, 1
jne 0x1084d128
mov ecx, 1
add dl, dl
jne 0x1084d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1084d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1084d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1084d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1084d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1084d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1084d136
cmp eax, 0x7d00
jae 0x1084d16d
cmp eax, 0x500
jb 0x1084d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1084d075
cmp eax, 0x7f
ja 0x1084d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1084d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1084d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1084d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4f2dcf
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
jmp 0x50fb88
xchg edx, ebx
push ebx
jmp 0x4f2e0f
setl bh
push ebp
push esi
mov esi, edi
jmp 0x4f2dec
lea esp, [esp + 4]
push edi
btc ebx, edx
setl dl
stc
jmp 0x4f2e8d
mov ebx, dword [esp]
lea ebx, [eax*4]
sub esp, 0x1b
jmp 0x4f2e6f
mov si, word [esp]
rcl esi, 0xc
movzx esi, byte [eax + 1]
xor edx, esi
jmp 0x4f2e46
lea esp, [esp + 3]
movzx esi, byte [eax + 2]
shl edx, 8
mov di, 0xad15
jmp 0x4f2f00
xor dx, 0x8bda
movzx edx, byte [eax]
shl edx, 8
setle bh
jmp 0x4f2e5c
mov dword [ecx], edx
movzx edx, byte [eax + 4]
movzx esi, byte [eax + 5]
jmp 0x4f2ee8
movzx esi, byte [eax + 3]
bswap ebx
shl edx, 8
xor edx, esi
jmp 0x4f2e9d
shl edx, 8
xchg bp, di
lea ebx, [esi*4]
neg bx
ror bl, 2
jmp 0x530f56
lea ebp, [ebx + ebp]
clc
mov ebp, dword [esp]
jmp 0x4f2ece
xchg bl, bh
xor edx, esi
bsr bp, sp
mov bx, 0xcb
jmp 0x4f2ec1
push ebx
jmp 0x4f2e02
not di
ror bp, 2
clc
jmp 0x530ed6
movzx esi, byte [ebp]
pop ebp
clc
shl edx, 8
bsf edi, ebx
jmp 0x530e25
neg bl
push esi
mov esi, ecx
jmp 0x530e9b
and bh, al
shl edx, 8
xor edx, esi
pushal
jmp 0x530e49
movzx esi, byte [eax + 9]
mov bh, 0xc8
bswap edi
jmp 0x530ebd
cmc
not ebx
xchg si, di
jmp 0x530e6d
add esi, 4
mov dword [esi], edx
pop esi
movzx edx, byte [eax + 8]
jmp 0x530e83
xor edx, esi
shr bx, cl
bsf bp, bp
xor bl, ah
jmp 0x530ee8
shl edx, 8
not bp
xchg bx, di
jmp 0x530ea7
xor edx, esi
movzx esi, byte [eax + 7]
mov edi, edx
mov ebp, 0x25fc20aa
jmp 0x530e63
movzx esi, byte [eax + 0xa]
xchg bl, bh
btr di, ax
mov bx, word [esp]
lea ebp, [eax + edi]
jmp 0x530f23
push ebp
mov ebp, eax
add ebp, 6
jmp 0x530e3b
xor edx, esi
push bp
stc
pop si
jmp 0x530f33
shl edx, 8
mov bx, 0x62c1
push cx
mov byte [esp], dl
pop bp
jmp 0x530f0d
movzx esi, byte [eax + 0xb]
shl edx, 8
inc ebx
mov di, sp
jmp 0x530f92
add esi, 8
mov dword [esi], edx
pop esi
sub esp, 0x17
lea esp, [esp + 3]
jmp 0x530f79
xor edx, esi
clc
bsr bp, dx
mov bh, dl
not ebx
jmp 0x530f02
push edi
jmp 0x530fc6
movzx edx, byte [eax + 0xc]
jmp 0x530f63
xor edx, esi
push esi
mov esi, ecx
jmp 0x530f40
xor edx, esi
jmp 0x530fe7
shl edx, 8
jmp 0x530f99
mov edi, eax
lea edi, [edi + 0xd]
movzx esi, byte [edi]
pop edi
jmp 0x530faf
movzx eax, byte [eax + 0xf]
jmp 0x53106d
movzx esi, byte [eax + 0xe]
jmp 0x530fd1
lea esi, [esi + 0xc]
mov dword [esi], edx
pop esi
pushal
jmp 0x53104a
shr eax, 0x10
jmp 0x531034
xor edx, eax
push esi
mov esi, ecx
jmp 0x53100d
mov esi, 0x6e38813b
pushal
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x5310a0
mov dword [esp + 0x1c], edx
push esp
mov word [esp + 1], sp
lea esp, [esp + 4]
popal
jmp 0x531016
shl edx, 8
xor edx, esi
shl edx, 8
jmp 0x53102d
mov eax, dword [eax*4 + reloc.WINMM.dll_midiStreamOut]
lea esp, [esp + 0x4c]
xor eax, 0x1000000
lea edi, [edi*4]
jmp 0x5310c4
lea esi, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 0x1c]
and eax, esi
jmp 0x531077
shr edi, 8
mov ebx, esi
lea ebp, [eax*4]
sets bh
jmp 0x53122c
mov edi, edx
mov bx, sp
bsf bx, cx
lea ebp, [ecx + edx]
jmp 0x5310ae
and edi, esi
setb bh
call fcn.005311c1
Function at 0x50061e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
mov dword [esp + 0x24], ebx
call fcn.00500608
jmp 0x500693
mov dword [esp + 5], edx
lea esp, [esp + 8]
jmp 0x500666
push dword [esp + 7]
ja 0x50067c
mov dword [esp + 5], edx
lea esp, [esp + 8]
pushal
mov word [esp + 5], sp
mov dword [esp + 0x48], ebp
jmp 0x5006dc

Function at 0x50062a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
mov dword [esp + 0x24], ebx
call fcn.00500608
jmp 0x500693
mov dword [esp + 5], edx
lea esp, [esp + 8]
jmp 0x500666
push dword [esp + 7]
ja 0x50067c
mov dword [esp + 5], edx
lea esp, [esp + 8]
pushal
mov word [esp + 5], sp
mov dword [esp + 0x48], ebp
jmp 0x5006dc
Function at 0x50065a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf04f2028
jmp 0x5006ad
mov dword [esp], ecx
mov dword [esp + 0x28], esp
call fcn.00500640
pushal
mov word [esp + 5], sp
mov dword [esp + 0x48], ebp
jmp 0x5006dc
cpuid
xchg dx, bp
jmp 0x50070e
pushfd
jmp 0x50060d
invalid
mov dword [esp + 0x44], esi
pushfd
push ax
lea esp, [esp + 2]
mov dword [esp + 0x44], edi
lea esp, [esp + 0x44]
jmp 0x5006c3
mov bh, byte [esp + 0x10]
jmp 0x500721
add esp, 0xf
lea esp, [esp + 3]
jmp 0x5007a8
mov esi, dword [esp + 0x2c]
sub esp, 0x1e
je 0x5006f1
mov bh, byte [esp + 0x10]
jmp 0x5006f7
add esp, 0xf
lea esp, [esp + 3]
jmp 0x5007a8
or eax, 0xd317e49d
add byte [esi + 0x67a66b0c], bl
jb 0x50072b
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
jb 0x50072b
arpl word [esi], ax
cmc
dec ebp
jbe 0x5006c7
push esp
and al, 0x24
call fcn.0050061e
clc
mov ecx, esi
stc
jb 0x50075e
jae 0x500789
jg 0x500731
jno 0x500762
jecxz 0x5007b3
mov edi, 0x22d7b022
xchg esi, eax
jecxz 0x500776
jmp 0x500746
sub esp, 0x1a
mov ebx, dword [esp + 0x12]
pop esp
and al, 0x12
mov edx, ecx
lea esp, [esp + 2]
mov bx, word [esp]
mov al, dl
rdtsc
jmp 0x5007d0
xchg edi, eax
dec cl
mov ebp, esp
mov ecx, dword [esp]
xchg ecx, ebx
btc ecx, edx
jle 0x50075c
clc
jmp 0x500747
sub esp, 0x1a
mov ebx, dword [esp + 0x12]
mov edx, ecx
jmp 0x500842
lea edi, [esp + 0xc]
not cx
setle dl
sub esp, 0xb4
in al, dx
mov ah, 0
add byte [eax], al
jmp 0x50077a
lea eax, [edx*4]
jmp 0x500804
xchg dx, ax
sub esp, 0xc
jns 0x5007ba
lea eax, [edx*4]
jmp 0x500804
mov bx, 0xefe1
mov al, ah
jmp 0x500823
inc bh
mov ax, cx
btc eax, edx
mov bl, byte [esp]
jmp 0x50086c
lea esp, [esp + 0xc]
neg esi
mov ah, dl
mov edx, dword [esp]
bt bx, cx
jmp 0x500819
jno 0x5007e0
mov bx, 0xefe1
mov al, ah
jmp 0x5007e6
xor esi, 0xd6b2321
lea edx, reloc.WINMM.dll_midiStreamOut
mov dl, byte [esp]
mov bl, dh
mov dx, si
btc ebx, edx
jmp 0x500a04
lea esp, [esp + 2]
mov bx, word [esp]
jmp 0x50076f
bts edx, esi
jmp 0x500880
sub esi, 0x65d71f22
btc eax, eax
je 0x50084f
bts edx, esi
call fcn.00500995
aaa
mov ebx, 0x46fb09a4
neg ebx
sub esp, 0xc
lea eax, [eax - 0xe7]
rdtsc
jmp 0x500906
btc eax, edx
mov bl, byte [esp]
jmp 0x50086c
xor ebx, 0x3522f0f6
dec ax
btr ax, di
bswap eax
push dword [esp + 0x18]
ret 0x1c
lea ebp, [ebp - 0x2b]
mov ebx, esp
mov dx, word [esp]
rol eax, cl
bswap ebx
xchg dword [esp + 0x18], ebp
jmp 0x5008b8
mov eax, edi
add edx, 0x5cf9583e
xchg ebx, edx
jmp 0x500914
lea esp, [esp + 0xc]
not esi
bsr dx, bp
jno 0x5008f0
jo 0x500952
inc esi
call fcn.0050093c
adc ebx, dword [edx + reloc.WINMM.dll_midiStreamOut]
ja 0x500921
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
mov dh, 0x52
int 0x5c
scasd eax, dword es:[edi]
mov dh, 0x87
sub al, 0x24
xchg edx, ebx
sub esp, 0x16
shl dx, 8
push bp
cmc
jmp 0x5008da
mov eax, edi
add edx, 0x5cf9583e
xchg ebx, edx
jmp 0x500914
jno 0x5007e8
inc bh
mov ax, cx
jmp 0x50089a
Function at 0x500c55
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], edx
pushal
pop dword [esp + 0x1a]
lea esp, [esp + 2]
jmp 0x50073d
jmp 0x500a65
push word [esp + 2]
jg 0x500adc
pushal
pop dword [esp + 0x1a]
lea esp, [esp + 2]
mov dword [esp + 0x24], edx
jmp 0x500741

Function at 0x501a86
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebx, 0x9fb5d74
call fcn.00501b03
sub dword [eax - 1], ecx
je 0x5006ba
pop es
jmp 0x501b63
shl ebx, 2
jg 0x501aa7
lea edx, [ebx*4]
lea esp, [esp + 4]
jmp 0x501aac
jmp 0x501c6c
bswap edx
pushfd
pushal
jmp 0x500686
sub esp, 0x1f
jns 0x501bb2
mov edx, dword [esp + 3]
mov dh, byte [esp + 0xc]
neg edx
jmp 0x501bb8
mov dh, byte [esp + 0xc]
neg edx
lea esp, [esp + 3]
jmp 0x501bf6
mov edx, dword [esp + 3]
jmp 0x501b9c
lea esp, [esp + 3]
jmp 0x501bf6
push ebx
ret
mov esp, ebp
mov edx, 0x72fe7717
mov dx, word [esp]
mov edx, esi
rol dx, 9
jmp 0x501c37
jbe 0x501bbe
ja 0x501bbe
lea edx, [ebx*4]
lea esp, [esp + 4]
bswap edx
pushfd
pushal
jmp 0x500686

Function at 0x50772b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebx
pop word [esp]
mov byte [esp], al
jmp 0x5077c4
lea esp, [esp + 2]
mov dword [esp + 4], esi
call 0x507796
Function at 0x50849b
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ax
jnp 0x5084cb
lea esp, [esp]
dec dx
jmp 0x50856a

Function at 0x508e5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov byte [esp + 4], bh
jmp 0x508eb1
stc
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x508ed8
lea esp, [esp + 8]
stc
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x508ed8
lea esp, [esp + 2]
sub edx, eax
jne 0x508e91
lea esp, [esp + 8]
jmp 0x508e7b
push esi
push edi
cmc
jmp 0x508fa2
mov esp, edx
pushfd
lea edi, [eax + edx - 0x40]
jmp 0x508ebf
push ecx
pushal
mov dword [esp + 4], ebx
sub esp, 0x15
jmp 0x508f55
lea esp, [esp + 1]
lea esp, [esp + 0x14]
popal
jmp 0x508f1d
mov edi, edx
jmp 0x508f36
popal
jmp 0x508f1d
mov ecx, eax
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x508f77
popfd
jmp 0x508f61
jl 0x508ef0
lea esp, [esp + 1]
lea esp, [esp + 0x14]
jmp 0x508f33
movzx ebx, byte [esi]
mov edx, 0xe94bcb2f
bsr ax, dx
jmp 0x50904a
pop ecx
pop edi
pop esi
jmp 0x508f3d
mov al, dl
rcr dh, cl
setae dh
jmp 0x508fd4
setae dh
btc edx, ebx
neg ah
jmp 0x508fd9
jno 0x508ee1
jo 0x508ee1
rcl dx, 0
jns 0x508ff9
js 0x508ff9
adc dx, 0xb415
rdtsc
jmp 0x50901b
btc edx, ebx
neg ah
bsf dx, bx
mov ax, 0x594c
jmp 0x508fae
jle 0x508fb6
adc dx, 0xb415
rdtsc
jmp 0x508fbd
add bl, cl
mov dx, word [esp]
btc dx, ax
jmp 0x508fe3
neg eax
jmp 0x509031
mov dl, bl
mov ax, 0xe3d
mov ax, di
lea eax, reloc.WINMM.dll_midiStreamOut
mov ax, 0xffad
cmc
jmp 0x50906f
rol dl, 0
setnp al
or ax, 0x687c
js 0x509059
jns 0x509269
dec ebp
lds edx, [ebp + 0x3c]
iretd
jns 0x508f7c
mov al, dl
rcr dh, cl
jmp 0x508f89
mov eax, esi
xchg ah, al
mov eax, dword [esp]
pushal
jmp 0x50910c
jo 0x509005
neg eax
jmp 0x509031
stc
bsf ax, bx
neg eax
jmp 0x5090d6
stc
bsf ax, bx
neg eax
mov al, byte [esp]
mov eax, dword [esp]
mov ax, bx
call int.005090f4
mov al, byte [esi]
xchg esp, eax
push cs
mov esi, 0x4e2bbb38
mov ebp, 0x88691e09
sub eax, dword [edx - 0x76]
add al, 0x24
mov al, byte [esp]
mov eax, dword [esp]
jmp 0x5090bd
lea esp, [esp + 0x20]
sub dl, 0x67
inc eax
jl 0x5090b0
jge 0x50909a
pushal
jmp 0x50910c
mov eax, esi
xchg ah, al
mov eax, dword [esp]
jmp 0x509190

Function at 0x5090f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
iretd
and al, 0xeb
ffreep st(0)
retf 0x8b00
ror dl, 0
mov eax, dword [esp]
btc eax, ecx
jl 0x509147
jge 0x50912e
in eax, dx
jge 0x5090db
je 0x509077
inc esi
int3
xchg byte [esp + 2], al
jmp 0x5090de
not ax
sub esp, 0x13
pop ax
jmp fcn.00509118
not ax
sub esp, 0x13
pop ax
lea eax, [ecx*4]
Function at 0x509166
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ecx*4]
lea esp, [esp + 1]
jmp 0x50915a
add al, 0x8d
add byte [eax], al
add byte [eax], al
lea esp, [esp + 1]
lea esp, [esp + 0x14]
not dl
call 0x509166
loopne 0x509150
mov esp, 0xf000000
xchg ecx, eax
ror byte [ebx + 0x1e82404], 0
add byte [eax], al
and eax, dword [ebx + reloc.WINMM.dll_midiStreamOut]
sub esp, 0
lea esp, [esp + 3]
jmp 0x5091f9
mov eax, ebp
lea eax, [eax + ebx]
jmp 0x5091cd
neg ax
jmp 0x5091b1
inc esi
dec dh
jmp 0x50920b
call 0x50924d
mov edx, ebp
rdtsc
lea edx, reloc.WINMM.dll_midiStreamOut
not eax
mov ah, 0x12
jmp 0x509298
add cl, dl
bts dx, si
jns 0x5091c8
neg ax
mov eax, ebp
lea eax, [eax + ebx]
jmp 0x5091cd
jle 0x5091d6
jg 0x5091d6
rdtsc
lea edx, reloc.WINMM.dll_midiStreamOut
not eax
jmp 0x509237
mov ah, 0x12
jmp 0x509298
xor bl, 0x85
mov dx, 0x2675
mov edx, esp
mov al, byte [esp]
jmp 0x5092bd
inc bl
rdtsc
mov ax, word [esp]
mov edx, dword [esp]
bswap eax
jmp 0x509275
lea edx, [ebx*4]
rdtsc
jmp 0x5092ce
not bl
mov edx, ebp
setle dh
setnp ah
mov ah, bl
setb dh
jmp 0x5092a7
neg bl
mov ax, di
stc
jae 0x509335
jb 0x50930a
out 0x77, eax
adc ah, cl
pop edx
lahf
sbb byte [esi - 0xa57e717], cl
in al, 0x17
jle 0x5092f8
mov dword [edi - 7], ebp
invalid
not bl
xchg dl, dh
mov dx, word [esp]
mov dx, 0x7729
jmp 0x50931d
lea edx, [esi*4]
lea edx, [ebp + 0xe6]
mov ax, 0x5906
jmp 0x509346
pushal
lea ebp, [ecx + 0xbc]
mov edx, eax
dec ax
js 0x509348
mov dword [esp + 0x14], ebx
jmp 0x50934d
lea edx, [esi*4]
lea edx, [ebp + 0xe6]
mov ax, 0x5906
jmp 0x5092f4
jmp 0x509442
mov ax, word [esp]
popal
setb ah
jmp 0x50935b
mov al, byte [esp]
jmp 0x509451
mov ax, dx
not ax
call fcn.005093ab
xchg ebp, eax
mov al, 0xd
push dword [esp + 0x38]
ret 0x3c
mov dword [esp + 0x14], ebx
mov ax, word [esp]
popal
setb ah
mov al, byte [esp]
bswap eax
shl edx, 2
mov al, 0x81
mov eax, dword [esp]
jmp 0x5093da
Function at 0x509177
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ecx*4]
lea esp, [esp + 1]
jmp 0x50915a
add al, 0x8d
add byte [eax], al
add byte [eax], al
lea esp, [esp + 1]
lea esp, [esp + 0x14]
not dl
call 0x509166
loopne 0x509150
mov esp, 0xf000000
xchg ecx, eax
ror byte [ebx + 0x1e82404], 0
add byte [eax], al
and eax, dword [ebx + reloc.WINMM.dll_midiStreamOut]
sub esp, 0
lea esp, [esp + 3]
jmp 0x5091f9
mov eax, ebp
lea eax, [eax + ebx]
jmp 0x5091cd
neg ax
jmp 0x5091b1
inc esi
dec dh
jmp 0x50920b
call 0x50924d
mov edx, ebp
rdtsc
lea edx, reloc.WINMM.dll_midiStreamOut
not eax
mov ah, 0x12
jmp 0x509298
add cl, dl
bts dx, si
jns 0x5091c8
neg ax
mov eax, ebp
lea eax, [eax + ebx]
jmp 0x5091cd
jle 0x5091d6
jg 0x5091d6
rdtsc
lea edx, reloc.WINMM.dll_midiStreamOut
not eax
jmp 0x509237
mov ah, 0x12
jmp 0x509298
xor bl, 0x85
mov dx, 0x2675
mov edx, esp
mov al, byte [esp]
jmp 0x5092bd
inc bl
rdtsc
mov ax, word [esp]
mov edx, dword [esp]
bswap eax
jmp 0x509275
lea edx, [ebx*4]
rdtsc
jmp 0x5092ce
not bl
mov edx, ebp
setle dh
setnp ah
mov ah, bl
setb dh
jmp 0x5092a7
neg bl
mov ax, di
stc
jae 0x509335
jb 0x50930a
out 0x77, eax
adc ah, cl
pop edx
lahf
sbb byte [esi - 0xa57e717], cl
in al, 0x17
jle 0x5092f8
mov dword [edi - 7], ebp
invalid
not bl
xchg dl, dh
mov dx, word [esp]
mov dx, 0x7729
jmp 0x50931d
lea edx, [esi*4]
lea edx, [ebp + 0xe6]
mov ax, 0x5906
jmp 0x509346
pushal
lea ebp, [ecx + 0xbc]
mov edx, eax
dec ax
js 0x509348
mov dword [esp + 0x14], ebx
jmp 0x50934d
lea edx, [esi*4]
lea edx, [ebp + 0xe6]
mov ax, 0x5906
jmp 0x5092f4
jmp 0x509442
mov ax, word [esp]
popal
setb ah
jmp 0x50935b
mov al, byte [esp]
jmp 0x509451
mov ax, dx
not ax
call fcn.005093ab
xchg ebp, eax
mov al, 0xd
push dword [esp + 0x38]
ret 0x3c
mov dword [esp + 0x14], ebx
mov ax, word [esp]
popal
setb ah
mov al, byte [esp]
bswap eax
shl edx, 2
mov al, 0x81
mov eax, dword [esp]
jmp 0x5093da

Function at 0x522a79
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebx*4]
jmp 0x522aaf
mov ax, word [esp]
lea eax, [eax + esi]
sub esp, 8
jno 0x522a99
dec dx
mov dx, di
call fcn.00522af5
invalid
Function at 0x522c87
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
jmp 0x522cc6
ror dl, 0
not ax
mov eax, 0x15026e97
mov ah, byte [esp]
call 0x522cae
mov ax, di
mov ax, word [esp]
mov ax, word [esp]
mov ax, word [esp]
mov eax, esp
jmp 0x522c8a
Function at 0x530e4b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
jmp 0x50fb88
xchg edx, ebx
push ebx
jmp 0x4f2e0f
setl bh
push ebp
push esi
mov esi, edi
jmp 0x4f2dec
lea esp, [esp + 4]
push edi
btc ebx, edx
setl dl
stc
jmp 0x4f2e8d
mov ebx, dword [esp]
lea ebx, [eax*4]
sub esp, 0x1b
jmp 0x4f2e6f
mov si, word [esp]
rcl esi, 0xc
movzx esi, byte [eax + 1]
xor edx, esi
jmp 0x4f2e46
lea esp, [esp + 3]
movzx esi, byte [eax + 2]
shl edx, 8
mov di, 0xad15
jmp 0x4f2f00
xor dx, 0x8bda
movzx edx, byte [eax]
shl edx, 8
setle bh
jmp 0x4f2e5c
mov dword [ecx], edx
movzx edx, byte [eax + 4]
movzx esi, byte [eax + 5]
jmp 0x4f2ee8
movzx esi, byte [eax + 3]
bswap ebx
shl edx, 8
xor edx, esi
jmp 0x4f2e9d
shl edx, 8
xchg bp, di
lea ebx, [esi*4]
neg bx
ror bl, 2
jmp 0x530f56
lea ebp, [ebx + ebp]
clc
mov ebp, dword [esp]
jmp 0x4f2ece
xchg bl, bh
xor edx, esi
bsr bp, sp
mov bx, 0xcb
jmp 0x4f2ec1
push ebx
jmp 0x4f2e02
not di
ror bp, 2
clc
jmp 0x530ed6
movzx esi, byte [ebp]
pop ebp
clc
shl edx, 8
bsf edi, ebx
jmp 0x530e25
neg bl
push esi
mov esi, ecx
jmp 0x530e9b
and bh, al
shl edx, 8
xor edx, esi
pushal
jmp 0x530e49
movzx esi, byte [eax + 9]
mov bh, 0xc8
bswap edi
jmp 0x530ebd
cmc
not ebx
xchg si, di
jmp 0x530e6d
add esi, 4
mov dword [esi], edx
pop esi
movzx edx, byte [eax + 8]
jmp 0x530e83
xor edx, esi
shr bx, cl
bsf bp, bp
xor bl, ah
jmp 0x530ee8
shl edx, 8
not bp
xchg bx, di
jmp 0x530ea7
xor edx, esi
movzx esi, byte [eax + 7]
mov edi, edx
mov ebp, 0x25fc20aa
jmp 0x530e63
movzx esi, byte [eax + 0xa]
xchg bl, bh
btr di, ax
mov bx, word [esp]
lea ebp, [eax + edi]
jmp 0x530f23
push ebp
mov ebp, eax
add ebp, 6
jmp 0x530e3b
xor edx, esi
push bp
stc
pop si
jmp 0x530f33
shl edx, 8
mov bx, 0x62c1
push cx
mov byte [esp], dl
pop bp
jmp 0x530f0d
movzx esi, byte [eax + 0xb]
shl edx, 8
inc ebx
mov di, sp
jmp 0x530f92
add esi, 8
mov dword [esi], edx
pop esi
sub esp, 0x17
lea esp, [esp + 3]
jmp 0x530f79
xor edx, esi
clc
bsr bp, dx
mov bh, dl
not ebx
jmp 0x530f02
push edi
jmp 0x530fc6
movzx edx, byte [eax + 0xc]
jmp 0x530f63
xor edx, esi
push esi
mov esi, ecx
jmp 0x530f40
xor edx, esi
jmp 0x530fe7
shl edx, 8
jmp 0x530f99
mov edi, eax
lea edi, [edi + 0xd]
movzx esi, byte [edi]
pop edi
jmp 0x530faf
movzx eax, byte [eax + 0xf]
jmp 0x53106d
movzx esi, byte [eax + 0xe]
jmp 0x530fd1
lea esi, [esi + 0xc]
mov dword [esi], edx
pop esi
pushal
jmp 0x53104a
shr eax, 0x10
jmp 0x531034
xor edx, eax
push esi
mov esi, ecx
jmp 0x53100d
mov esi, 0x6e38813b
pushal
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x5310a0
mov dword [esp + 0x1c], edx
push esp
mov word [esp + 1], sp
lea esp, [esp + 4]
popal
jmp 0x531016
shl edx, 8
xor edx, esi
shl edx, 8
jmp 0x53102d
mov eax, dword [eax*4 + reloc.WINMM.dll_midiStreamOut]
lea esp, [esp + 0x4c]
xor eax, 0x1000000
lea edi, [edi*4]
jmp 0x5310c4
lea esi, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 0x1c]
and eax, esi
jmp 0x531077
shr edi, 8
mov ebx, esi
lea ebp, [eax*4]
sets bh
jmp 0x53122c
mov edi, edx
mov bx, sp
bsf bx, cx
lea ebp, [ecx + edx]
jmp 0x5310ae
and edi, esi
setb bh
call fcn.005311c1