joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9290
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xc], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x10], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0xc]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x10]
mov dword [esp + 0xc], edi
jb 0x4c92b0
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0xc]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x4c9da8
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xc], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x10], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, ebx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, ah
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, ecx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0xc]
and edx, 0xff
mov edx, dword [ebp + edx*8]
movzx ecx, ch
xor edx, dword [ebp + ecx*8 + 3]
mov ecx, esi
shr ebx, 0x10
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
shr eax, 0x18
xor edx, dword [ebp + eax*8 + 1]
mov eax, dword [esp + 4]
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x10]
mov dword [esp + 0xc], edi
jb 0x4c9dc8
mov esi, eax
and esi, 0xff
movzx esi, byte [ebp + esi + 0x800]
movzx edi, dh
movzx edi, byte [ebp + edi + 0x800]
shl edi, 8
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x10
xor esi, edi
mov edi, ebx
shr edi, 0x18
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x18
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
movzx esi, byte [ebp + esi + 0x800]
movzx edi, ah
movzx edi, byte [ebp + edi + 0x800]
shl edi, 8
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x10
xor esi, edi
mov edi, ecx
shr edi, 0x18
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x18
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
movzx esi, byte [ebp + esi + 0x800]
movzx edi, bh
movzx edi, byte [ebp + edi + 0x800]
shl edi, 8
xor esi, edi
mov edi, eax
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x10
xor esi, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x18
xor esi, edi
mov edi, dword [esp + 0xc]
and edx, 0xff
movzx edx, byte [ebp + edx + 0x800]
movzx ecx, ch
movzx ecx, byte [ebp + ecx + 0x800]
shl ecx, 8
xor edx, ecx
mov ecx, esi
shr ebx, 0x10
and ebx, 0xff
movzx ebx, byte [ebp + ebx + 0x800]
shl ebx, 0x10
xor edx, ebx
mov ebx, dword [esp + 8]
shr eax, 0x18
movzx eax, byte [ebp + eax + 0x800]
shl eax, 0x18
xor edx, eax
mov eax, dword [esp + 4]
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x4cec90
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.004e86d0
mov eax, dword [0x5512c0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4cecf5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4cecf5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004e45be
add eax, 0x40
push eax
call fcn.004e9940
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e3e00
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004e9818
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4ced84
call fcn.004cebb0
test eax, eax
je 0x4ced84
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e3e00
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e3e00
add esp, 0x108
ret
Function at 0x4e3b6b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x557cf4], 0
push esi
push edi
jne 0x4e3ae1
call fcn.004e3a4d
test eax, eax
je 0x4e3b26
mov eax, dword [0x557cf4]
cmp eax, 1
jne 0x4e3b02
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4e3b26
jmp 0x4e3b68
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4e3b68
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4e3b2a
xor eax, eax
jmp 0x4e3b68
mov eax, dword [esi]
push dword [0x557cf4]
call edi
mov edi, eax
test edi, edi
je 0x4e3b4c
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4e3b68
lea edi, [esi + 0xff0]
push esi
push dword [0x557cf4]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4e3b52
mov eax, esi
pop edi
pop esi
ret
jmp 0x4e3acd

Function at 0x4e3e00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5512c0]
jne 0x4e3e0a
repz ret
jmp fcn.004e9c1b
Function at 0x4f717e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5512c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004ece16
and dword [ebp - 0x14], 0
cmp dword [0x558b0c], 0
mov dword [ebp - 0x18], eax
jne 0x4f7231
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4f72d9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5187f4
push ebx
call edi
test eax, eax
je 0x4f72d9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x558b0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x558b10], eax
call edi
push eax
call esi
push 0x5187b4
push ebx
mov dword [0x558b14], eax
call edi
push eax
call esi
mov dword [0x558b1c], eax
test eax, eax
je 0x4f7231
push 0x51879c
push ebx
call edi
push eax
call esi
mov dword [0x558b18], eax
mov eax, dword [0x558b18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4f728a
cmp dword [0x558b1c], ecx
je 0x4f728a
push eax
call esi
push dword [0x558b1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4f728a
test ebx, ebx
je 0x4f728a
call edi
test eax, eax
je 0x4f7281
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4f7281
test byte [ebp - 8], 1
jne 0x4f728a
or dword [ebp + 0x10], 0x200000
jmp 0x4f72bd
mov eax, dword [0x558b10]
cmp eax, dword [ebp - 0x18]
je 0x4f72bd
push eax
call esi
test eax, eax
je 0x4f72bd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4f72bd
mov eax, dword [0x558b14]
cmp eax, dword [ebp - 0x18]
je 0x4f72bd
push eax
call esi
test eax, eax
je 0x4f72bd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x558b0c]
call esi
test eax, eax
je 0x4f72d9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4f72db
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3e00
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001609
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
push ecx
nop
push edx
push ebx
push esp
push ebp
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x64

Function at 0x1001618
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov edi, 7
mov dword [ebp - 0xc], 0xa
mov esi, 0xe
mov dword [ebp - 8], 9
mov eax, esi
add eax, dword [ebp - 8]
sub eax, 0x17
mov dword [ebp - 0x24], eax
and dword [ebp - 0x28], 0
jmp 0x10016ae
add dword [ebp - 0x28], 0x642a
mov dword [ebp - 0x20], 0x3826b3a5
mov dword [ebp - 0x24], 0x47d3
jmp 0x10016b7
dec dword [ebp - 0x20]
mov eax, dword [ebp - 8]
sub eax, 9
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], 0x1029000
mov dword [ebp - 0x2c], 0x10056c0
mov eax, edi
add eax, esi
sub eax, 0x12
mov dword [ebp - 0x10], eax
jmp 0x1001695
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x28]
movzx edx, byte [eax]
mov dh, 0x10
movzx ecx, byte [ebp - 0x20]
xor edx, ecx
mov byte [eax], dl
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], eax
jb 0x1001681
jmp 0x1001703
mov eax, dword [ebp - 8]
add eax, esi
sub eax, 0x14
cmp eax, dword [ebp - 0x44]
jbe 0x10016c0
jmp 0x1001667
mov dword [ebp - 0x28], 0xffee96
jmp 0x1001644
add dword [ebp - 0x24], 0x1f22d
jmp 0x100165b
mov eax, esi
sub eax, 0xe
mov dword [ebp - 4], eax
jmp 0x10016dc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov cl, byte [ecx + eax]
mov byte [edx + eax], cl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x19d34
jb 0x10016ca
mov dword [ebp - 0x48], 0x101f4c0
mov dword [ebp - 0x4c], 0x105c000
mov dword [ebp - 0x14], 0x10260c0
mov dword [ebp - 0x30], 0x10000000
jmp 0x100170b
inc dword [ebp - 0x44]
jmp 0x1001822
mov eax, dword [ebp - 8]
sub eax, 9
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
mov cl, byte [ecx + eax]
mov byte [edx + eax], cl
inc dword [ebp - 0x3c]
mov eax, 0x6720
add byte [eax], al
cmp eax, dword [ebp - 0x3c]
ja 0x1001714
mov eax, esi
add eax, dword [ebp - 0xc]
sub eax, 0x16
cmp eax, dword [ebp - 0x44]
jne 0x100169f
inc dword [ebp - 0x20]
jmp 0x100169f
Function at 0x10d1bba2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
jb 0x10d1bb8c
pushal
jmp 0x10d1bbe4
mov byte [esp + 2], dh
mov word [esp + 6], bp
push word [esp + 0xe]
mov dword [esp + 0x40], esi
jmp 0x10d1bbbf

Function at 0x10d2782a
Capabilities:
Encode data using base64

Disassembly:
jmp 0x10d4bd95
jmp 0x10d28910
cmp al, 0x2b
jmp 0x10d4be40
cmp al, 0x30
jmp 0x10d4befc
call fcn.10d4be7c
bound ebx, qword [ebp - 0x14160014]
sbb dword [ebx*8 - 0x2daaeeaa], ebp
xchg dword [esi], ebp
cmp dword [eax], ebx
jmp 0x10d0bf34
jmp 0x10d0c04d
mov al, byte [ecx]
push ecx
jmp 0x10d4bd00
lea esp, [esp + 4]
push ebx
jmp 0x10d4bd42
jmp 0x10d4c45b
cmp al, 0x41
call fcn.10d4bd2c
lea esp, [esp + 4]
jb 0x10d0bf1c
jae 0x10d4bd8e
inc eax
aad 0x45
sub al, 0xdf
sbb edx, edx
inc esi
aam 0xb3
dec esi
lea esi, [edi + 0x66]
push ebx
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x10d4c437
cmp al, 0x5a
call fcn.10d4bd78
cmp al, 0x61
jmp 0x10d4bdbe
jb 0x10d0bfd6
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x10d4bdea
lea esp, [esp + 0xc]
cmp al, 0x7a
call 0x10d4bdf7
mul cl
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x10d4bf57
cmp al, 0x39
call fcn.10d4be23
je 0x10d0c017
push sp
lea esp, [esp + 2]
jmp 0x10d4bebd
cmp al, 0x2f
push bp
lea esp, [esp + 2]
jne 0x10d0bf60
je 0x10d0c017
jb 0x10d0bfa8
sub esp, 0xf
lea esp, [esp + 3]
lea esp, [esp + 0xc]
jmp 0x10d4be39
jbe 0x10d0c017
ja 0x10d0bfd6
sub esp, 5
mov byte [esp], dh
lea esp, [esp + 1]
lea esp, [esp + 4]
sub ecx, 0x41
jmp 0x10d4bdd4
cmp cl, 0x5a
movzx ecx, cl
ja 0x10d4bd16
jbe 0x10d4c411
sub ecx, 0x47
jmp 0x10d4bdd4

Function at 0x10d27b70
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x10d0e9de
pushfd
or dword [esp], reloc.WINMM.dll_midiStreamRestart
popfd
cpuid
nop
jmp 0x10d0e9f5
pop ebx
ret
jmp 0x10d27bab
lea esp, [esp + 8]
jmp 0x10d0e9d2
Function at 0x10d2bc6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x4ac4cdaa
jmp 0x10d2be76
mov edx, dword [esp + 1]
mov edx, 0x3e2efb4
rdtsc
jmp 0x10d2bc8d
mov eax, ebp
xchg al, dh
mov word [esp + 1], bx
jmp 0x10d2bc56
lea esp, [esp + 4]
inc cl
lea eax, [eax*4]
xchg edx, eax
jmp 0x10d2bc9f
ror cl, 0
not edx
mov dl, al
lea eax, [ebp*4]
mov dl, 0x74
jmp 0x10d2bc77
lea eax, [eax*4]
bsr edx, ebx
jb 0x10d2bd45
jae 0x10d2bd45
test byte [eax], dl
xchg cl, ah
adc bl, dl
sbb cl, byte [ebp + 0x5097641d]
pushfd
out dx, eax
mul byte [eax - 0x77]
je 0x10d2bcec
adc al, 0x48
jle 0x10d2bcf6
mov ah, cl
and ax, 0x5098
jmp 0x10d2bd1c
push edi
mov byte [0x77e77912], al
adc ah, cl
pop edx
lcall 0x5098, 0x2566e18a
mov ah, cl
and ax, 0x5098
bts dx, cx
btc eax, ebx
inc cl
rdtsc
dec ax
jmp 0x10d2bdc6
bts dx, cx
btc eax, ebx
call 0x10d2bd29
dec ecx
push si
lea eax, [ebx*4]
jmp 0x10d2bd8b
neg cl
rcl dl, 0
jmp 0x10d2bcd9
inc ax
mov dl, 0x33
xchg dword [esp], ebx
xchg dh, dl
lea eax, [esp + 0xa2]
jmp 0x10d2bdb6
lea edx, [ecx*4]
mov ax, 0x5307
sub esp, 1
lea esp, [esp + 1]
lea ebx, [ebx - 0x25]
setle dl
jmp 0x10d2bd4c
xchg byte [esp], dh
mov dx, bp
mov ah, byte [esp]
lea esp, [esp + 2]
xchg dword [esp], ebx
setle dh
jmp 0x10d2bd62
xchg ah, al
setg ah
jmp 0x10d2be24
lea edx, reloc.WINMM.dll_midiStreamRestart
btr dx, ax
push dword [esp]
ret 4
jb 0x10d2bda0
xchg ah, al
setg ah
jmp 0x10d2be24
mov eax, ecx
jmp 0x10d2be00
not eax
jmp 0x10d2bde6
shl edx, 2
jmp 0x10d2be09
mov ah, al
not eax
mov al, 0x72
xchg ah, al
jmp 0x10d2b913
mov edx, ecx
shr eax, 0x1c
jge 0x10d2bdfc
not eax
mov eax, ecx
call fcn.10d2be61
mov ecx, 0x124648d
xchg dword [esp + 4], ebx
call 0x10d2be43
cwde
pushal
lea eax, [ebx*4]
mov ah, 0xc4
lea ebx, [ebx - 0x34]
jmp 0x10d2bea6
mov eax, 0xb50a6bb4
neg ax
jmp 0x10d2c9d0
neg ax
lea eax, [eax + esi]
bt ax, ax
cmc
push dword [esp + 0x54]
ret 0x58
mov eax, edx
sub esp, 0x1e
sub esp, 0x11
inc eax
lea esp, [esp + 3]
xchg dword [esp + 0x54], ebx
jmp 0x10d2be8c
neg eax
call 0x10d2bec1
mov dword [ebx + reloc.WINMM.dll_midiStreamRestart], ecx
add byte [eax], al
and ch, byte [edx + 0x68aa5f38]
inc eax
iretd
jno 0x10d2beb9
neg eax
jmp 0x10d2bebb
Function at 0x10d2c56e
Capabilities:
Execute anti-debugging instructions

Disassembly:
setge ch
lea ecx, [ebx*4]
jmp 0x10d2c480
lea edx, [edx + ebp]
bswap edx
lea eax, reloc.WINMM.dll_midiStreamRestart
sub esp, 0x13
push word [esp + 0xb]
jmp 0x10d2c469
call fcn.10d2bfc4
lea eax, reloc.WINMM.dll_midiStreamRestart
sub esp, 0x13
push word [esp + 0xb]
jmp 0x10d2c469
jno 0x10d2c42b
lea edx, [edx + ebp]
bswap edx
jmp 0x10d2c44a
bt edx, eax
inc ah
je 0x10d2c4b6
lea esp, [esp + 1]
jmp 0x10d2c4ba
mov ecx, dword [ebp - 4]
lea edx, [edx + esi]
mov dh, 0x5e
mov dh, 0xe2
xchg ah, al
cmc
jmp 0x10d2c460
add ecx, ebx
cmc
jmp 0x10d2c4d2
stc
cmp edx, 0x9202d894
jmp 0x10d2c4bc
lea esp, [esp + 1]
jmp 0x10d2c48f
mov edx, ecx
xchg al, ah
mov ax, 0x4bcd
stc
jnp 0x10d2c4dd
jp 0x10d2c4dd
and dword [edi], reloc.WINMM.dll_midiStreamRestart
shl byte [ecx], cl
test al, 0xda
xor eax, 0xf9c47324
jae 0x10d2c498
stc
cmp edx, 0x9202d894
jmp 0x10d2c49f
call 0x10d2c56e
lea esp, [esp + 8]
inc edx
mov ax, word [esp]
mov ah, 0x71
jmp 0x10d2c512
jg 0x10d2c41f
setge ch
lea ecx, [ebx*4]
jmp 0x10d2c429
lea eax, [esi + 0xa5]
neg ah
jp 0x10d2c547
jnp 0x10d2c547
dec ecx
iretd
not edx
call fcn.10d2c531
invalid
mov ax, word [esp + 3]
bswap eax
mov dword [esp], ebp
lea eax, [esp + esi]
pop eax
call 0x10d2c574
in eax, dx
push 0xdc6899fe
or eax, 0x8f7c1585
dec ebx
mov ah, 0xff
je 0x10d2c595
add ebp, ebx
mov ecx, 0x42b390b8
and ebp, ebx
push eax
scasb al, byte es:[edi]
sub edi, dword [ebx - reloc.WINMM.dll_midiStreamRestart]
dec esp
ret 0x54a5
mov dword [esp], ebp
lea eax, [esp + esi]
add al, 0x34
pop eax
jmp 0x10d2c55c
out 0x81, al
jo 0x10d2c54b
loope 0x10d2c608
std
test byte [edi - 0x3b], dh
int1
jle 0x10d2c58e
mov eax, dword [esi - reloc.WINMM.dll_midiStreamRestart]
mov ax, word [esp + 3]
bswap eax
jmp 0x10d2c58a
mov word [edi], ds
sub si, 4
sub esi, 4
inc edx
jmp 0x10d2c4fd
Function at 0x10d2c574
Capabilities:
Execute anti-debugging instructions

Disassembly:
setge ch
lea ecx, [ebx*4]
jmp 0x10d2c480
lea edx, [edx + ebp]
bswap edx
lea eax, reloc.WINMM.dll_midiStreamRestart
sub esp, 0x13
push word [esp + 0xb]
jmp 0x10d2c469
call fcn.10d2bfc4
lea eax, reloc.WINMM.dll_midiStreamRestart
sub esp, 0x13
push word [esp + 0xb]
jmp 0x10d2c469
jno 0x10d2c42b
lea edx, [edx + ebp]
bswap edx
jmp 0x10d2c44a
bt edx, eax
inc ah
je 0x10d2c4b6
lea esp, [esp + 1]
jmp 0x10d2c4ba
mov ecx, dword [ebp - 4]
lea edx, [edx + esi]
mov dh, 0x5e
mov dh, 0xe2
xchg ah, al
cmc
jmp 0x10d2c460
add ecx, ebx
cmc
jmp 0x10d2c4d2
stc
cmp edx, 0x9202d894
jmp 0x10d2c4bc
lea esp, [esp + 1]
jmp 0x10d2c48f
mov edx, ecx
xchg al, ah
mov ax, 0x4bcd
stc
jnp 0x10d2c4dd
jp 0x10d2c4dd
and dword [edi], reloc.WINMM.dll_midiStreamRestart
shl byte [ecx], cl
test al, 0xda
xor eax, 0xf9c47324
jae 0x10d2c498
stc
cmp edx, 0x9202d894
jmp 0x10d2c49f
call 0x10d2c56e
lea esp, [esp + 8]
inc edx
mov ax, word [esp]
mov ah, 0x71
jmp 0x10d2c512
jg 0x10d2c41f
setge ch
lea ecx, [ebx*4]
jmp 0x10d2c429
lea eax, [esi + 0xa5]
neg ah
jp 0x10d2c547
jnp 0x10d2c547
dec ecx
iretd
not edx
call fcn.10d2c531
invalid
mov ax, word [esp + 3]
bswap eax
mov dword [esp], ebp
lea eax, [esp + esi]
pop eax
call 0x10d2c574
in eax, dx
push 0xdc6899fe
or eax, 0x8f7c1585
dec ebx
mov ah, 0xff
je 0x10d2c595
add ebp, ebx
mov ecx, 0x42b390b8
and ebp, ebx
push eax
scasb al, byte es:[edi]
sub edi, dword [ebx - reloc.WINMM.dll_midiStreamRestart]
dec esp
ret 0x54a5
mov dword [esp], ebp
lea eax, [esp + esi]
add al, 0x34
pop eax
jmp 0x10d2c55c
out 0x81, al
jo 0x10d2c54b
loope 0x10d2c608
std
test byte [edi - 0x3b], dh
int1
jle 0x10d2c58e
mov eax, dword [esi - reloc.WINMM.dll_midiStreamRestart]
mov ax, word [esp + 3]
bswap eax
jmp 0x10d2c58a
mov word [edi], ds
sub si, 4
sub esi, 4
inc edx
jmp 0x10d2c4fd
Function at 0x10d4bd2c
Capabilities:
Encode data using base64

Disassembly:
mov byte [esp], dh
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x10d4bd49

Function at 0x10d4bd78
Capabilities:
Encode data using base64

Disassembly:
add byte [eax], al
dec ecx
fdiv qword [edx + 0x15]
in al, 0x21
test eax, 0x2ee8c8
call 0x10d4bdab
call 0x10d4bdab
jae 0x10d4bd6e
jg 0x10d4bd9b
jmp 0xa6d558b8
and bh, 0x12
cmpsd dword [esi], dword es:[edi]
or byte [edi + 0x5b916207], dl
mov ah, byte [0x796ec754]
mov dword [esp], edx
lea esp, [esp + 8]
jbe 0x10d0c017
ja 0x10d0bf1c

Function at 0x10d4bdab
Capabilities:
Encode data using base64

Disassembly:
add byte [eax], al
dec ecx
fdiv qword [edx + 0x15]
in al, 0x21
test eax, 0x2ee8c8
call 0x10d4bdab
call 0x10d4bdab
jae 0x10d4bd6e
jg 0x10d4bd9b
jmp 0xa6d558b8
and bh, 0x12
cmpsd dword [esi], dword es:[edi]
or byte [edi + 0x5b916207], dl
mov ah, byte [0x796ec754]
mov dword [esp], edx
lea esp, [esp + 8]
jbe 0x10d0c017
ja 0x10d0bf1c

Function at 0x10d4bdf7
Capabilities:
Encode data using base64

Disassembly:
jmp 0x10d4bd95
jmp 0x10d28910
cmp al, 0x2b
jmp 0x10d4be40
cmp al, 0x30
jmp 0x10d4befc
call fcn.10d4be7c
bound ebx, qword [ebp - 0x14160014]
sbb dword [ebx*8 - 0x2daaeeaa], ebp
xchg dword [esi], ebp
cmp dword [eax], ebx
jmp 0x10d0bf34
jmp 0x10d0c04d
mov al, byte [ecx]
push ecx
jmp 0x10d4bd00
lea esp, [esp + 4]
push ebx
jmp 0x10d4bd42
jmp 0x10d4c45b
cmp al, 0x41
call fcn.10d4bd2c
lea esp, [esp + 4]
jb 0x10d0bf1c
jae 0x10d4bd8e
inc eax
aad 0x45
sub al, 0xdf
sbb edx, edx
inc esi
aam 0xb3
dec esi
lea esi, [edi + 0x66]
push ebx
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x10d4c437
cmp al, 0x5a
call fcn.10d4bd78
cmp al, 0x61
jmp 0x10d4bdbe
jb 0x10d0bfd6
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x10d4bdea
lea esp, [esp + 0xc]
cmp al, 0x7a
call 0x10d4bdf7
mul cl
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x10d4bf57
cmp al, 0x39
call fcn.10d4be23
je 0x10d0c017
push sp
lea esp, [esp + 2]
jmp 0x10d4bebd
cmp al, 0x2f
push bp
lea esp, [esp + 2]
jne 0x10d0bf60
je 0x10d0c017
jb 0x10d0bfa8
sub esp, 0xf
lea esp, [esp + 3]
lea esp, [esp + 0xc]
jmp 0x10d4be39
jbe 0x10d0c017
ja 0x10d0bfd6
sub esp, 5
mov byte [esp], dh
lea esp, [esp + 1]
lea esp, [esp + 4]
sub ecx, 0x41
jmp 0x10d4bdd4
cmp cl, 0x5a
movzx ecx, cl
ja 0x10d4bd16
jbe 0x10d4c411
sub ecx, 0x47
jmp 0x10d4bdd4

Function at 0x10d4be23
Capabilities:
Encode data using base64

Disassembly:
push dword [esp + 1]
jmp 0x10d4be56
lea esp, [esp + 8]
jbe 0x10d0c017
ja 0x10d0bfa8