joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c729c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5c72a4
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c746c
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x5c7484
mov eax, ebx
call fcn.005bc97c
mov eax, dword [ebp - 8]
call fcn.0040e650
test al, al
je 0x5c72ee
mov byte [ebx + 0x591], 1
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005c4420
jmp 0x5c7451
mov byte [ebx + 0x591], 0
cmp dword [ebx + 0x558], 0
jne 0x5c7310
mov dl, 1
mov eax, dword [0x59c020]
call fcn.0059c440
mov dword [ebx + 0x558], eax
mov eax, dword [ebx + 0x558]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c7b5c
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x18], 0x5c7ff4
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5c8fe0
mov dword [eax + 0x30], 2
mov dl, 1
call fcn.0059d468
lea eax, [ebp - 0x10]
mov ecx, 0x5c74a4
mov edx, dword [ebx + 0x544]
call fcn.00407078
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, ebx
call fcn.005c0d48
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x568]
call fcn.00406c64
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x5c74a4
mov edx, dword [ebx + 0x544]
pop eax
call fcn.00407078
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.005c0f48
mov dword [ebx + 0x584], eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x5c74a4
mov edx, dword [ebx + 0x544]
pop eax
call fcn.00407078
mov eax, dword [ebp - 0x18]
call fcn.00406cf0
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebx + 0x544]
call fcn.0040e698
test al, al
jne 0x5c73d2
mov eax, dword [ebx + 0x544]
call fcn.0040e6bc
lea eax, [ebp - 0x1c]
mov ecx, 0x5c74c8
mov edx, dword [ebx + 0x544]
call fcn.00407078
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 4]
mov eax, ebx
call fcn.005c0c7c
mov eax, dword [ebp - 4]
test eax, eax
je 0x5c73fe
sub eax, 4
mov eax, dword [eax]
dec eax
jle 0x5c7429
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x5c74a4
mov edx, dword [ebx + 0x544]
pop eax
call fcn.00407078
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0x558]
call fcn.0059d478
jmp 0x5c7451
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x5c74a4
mov edx, dword [ebx + 0x544]
pop eax
call fcn.00407078
mov edx, dword [ebp - 0x24]
mov ecx, 0x5c74e8
mov eax, dword [ebx + 0x558]
call fcn.0059d478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7473
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00406c5c
ret
Function at 0x5c76cc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c77c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x584]
call fcn.0040df48
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x5c77e0
call fcn.00407078
mov eax, dword [ebp - 4]
call fcn.00406cf0
push eax
call sub.KERNEL32.DLL_OutputDebugStringW
cmp dword [ebx + 0x584], 1
jne 0x5c77a6
xor eax, eax
push ebp
push 0x5c779c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x599a5c]
call fcn.00599b3c
mov ebx, eax
lea eax, [ebx + 0x70]
mov edx, 0x5c7840
call fcn.00406c64
mov eax, dword [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.0059a054
push 0x5c7894
call sub.KERNEL32.DLL_OutputDebugStringW
mov eax, ebx
call fcn.00599ba8
push 0x5c78e0
call sub.KERNEL32.DLL_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c77a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c77c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406c5c
ret
Function at 0x40c5a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c60c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044fc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408e04
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c613
lea eax, [ebp - 0xc]
call fcn.00404284
ret

Function at 0x423170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x48ba24
cmp dword [edi], 0
jne 0x4231ec
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x48ba20]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4895e4
mov ecx, 2
call fcn.004028fc
mov edx, 0x423148
lea eax, [esi + 5]
call fcn.00423168
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00423168
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4231c1
mov dword [0x48ba20], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4246f8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4246fe
ret

Function at 0x426ce4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x426d35
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x426d1c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x426d0c
jmp 0x426d35
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x426d1d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x483c7c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
push edi
xor ecx, ecx
push ebp
push 0x483da8
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x483d97
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x88]
dec ecx
je 0x483d3d
dec ecx
jne 0x483d8e
cmp eax, 4
jg 0x483ce8
mov dword [ebp - 4], 4
jmp 0x483d9e
cmp eax, 5
jne 0x483cfd
test edx, edx
jne 0x483cfd
mov dword [ebp - 4], 5
jmp 0x483d9e
cmp eax, 5
jne 0x483d13
cmp edx, 1
jne 0x483d13
mov dword [ebp - 4], 6
jmp 0x483d9e
cmp eax, 5
jne 0x483d26
cmp edx, 2
jne 0x483d26
mov dword [ebp - 4], 6
jmp 0x483d9e
cmp eax, 6
jl 0x483d34
mov dword [ebp - 4], 7
jmp 0x483d9e
mov dword [ebp - 4], 0xffffffff
jmp 0x483d9e
cmp eax, 4
jne 0x483d4d
test edx, edx
jne 0x483d4d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x483d9e
cmp eax, 4
jne 0x483d72
cmp edx, 0xa
jne 0x483d72
cmp byte [ebp - 0x83], 0x41
jne 0x483d69
mov dword [ebp - 4], 2
jmp 0x483d9e
mov dword [ebp - 4], 1
jmp 0x483d9e
cmp eax, 4
jne 0x483d85
cmp edx, 0x5a
jne 0x483d85
mov dword [ebp - 4], 3
jmp 0x483d9e
mov dword [ebp - 4], 0xffffffff
jmp 0x483d9e
mov dword [ebp - 4], 0xffffffff
jmp 0x483d9e
mov dword [ebp - 4], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x483db2
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x485944
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x48598c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.00418c9c
push 0
push 0x48599c
call sub.user32.dll_FindWindowA
test eax, eax
je 0x485982
push ebx
push eax
call sub.user32.dll_GetWindowRect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x485996
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40977c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x40974f
add esp, 0xfffffff0
call fcn.004039e4
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [edi + 4]
mov edx, esi
call 0xc407f0b9
pop edx
cmp ch, byte [esi + 0x3e]
xor ecx, ebx
mov eax, dword [esp]
add esp, 4
mov esi, eax
add esp, 0xfffffffc
mov dword [esp], esi
add esp, 0xfffffffc
mov ebx, esp
mov dword [ebx], edx
mov edx, 0x70fbdb6a
push 0xffffffffffffffdb
sti
jo 0x40970a
salc
push 0x70bbf5be
pop esi
xor edx, esi
xor ebx, ebx
add ebx, dword [edx]
xor ebx, ecx
mov dword [eax], ebx
add edx, 4
mov esi, 4
add eax, esi
mov esi, 0x1504
mov ebx, 0xcad952f
mov ebx, 0x402050
xor esi, ebx
xor esi, edx
mov edi, 0x115fa9f8
mov ebx, edi
shl edi, 4
add edi, 0xea056080
cmp esi, edi
jne 0x40978a
ret

Function at 0x40a91f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404914
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40a942
mov eax, edi
add eax, eax
call fcn.00402e04
mov esi, eax
jmp 0x40a944
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40a97d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40a967
mov eax, esp
cmp esi, eax
je 0x40a98a
mov eax, esi
call fcn.00402e20
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40a9c4
cmp bl, 0
je 0x40a9c0
cmp bl, 0x41
jl 0x40a9bb
cmp bl, 0x5a
jg 0x40a9bb
or bl, 0x20
xor al, bl
inc esi
jmp 0x40a99f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40a904

Function at 0x40b5b4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b5fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b548
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b601
lea eax, [ebp - 4]
call fcn.00404c88
ret
Function at 0x40b818
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b8af
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40b863
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00404dd4
jmp 0x40b899
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x40b87c
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404cec
jmp 0x40b88f
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b6d8
mov ebx, eax
test esi, esi
je 0x40b88f
dec esi
jmp 0x40b86a
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b8b6
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40b8c0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00408134
add esp, 0x208
pop ebx
ret

Function at 0x40ba24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40bb5c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40bb46
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40ba81
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bb46
cmp dword [ebp - 0x14], 0
jne 0x40ba98
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404c98
mov bl, 1
jmp 0x40bb46
cmp dword [ebp - 0x14], 0x70000000
jb 0x40baa6
call fcn.00409734
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00404dd4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004054ac
push eax
lea eax, [ebp - 0x10]
push eax
mov esi, dword [esp]
sub esp, 0xfffffffc
pop edi
mov ebx, esi
push ebx
mov edx, 0xff77ff6e
add edx, 9
cmp edx, 5
jne 0x40baef
add edx, 0x85
push edx
mov ecx, edi
push ecx
mov edx, dword [esp]
sub esp, 0xfffffffc
mov eax, dword [esp]
add esp, 4
lea eax, [eax - 0x10001]
mov esi, eax
push esi
mov ebx, edx
add esp, 0xfffffffc
mov dword [esp], ebx
test eax, eax
je 0x40bb36
mov ecx, eax
push ecx
mov edi, 0xaa23bc
mov eax, edi
shl edi, 4
add edi, 0xf59e5b9b
call edi
jmp 0x40baf4
pop edi
pop esi
call edi
lea esp, [esp + 4]
jmp dword [esp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb63
lea eax, [ebp - 4]
call fcn.00404c88
ret
Function at 0x40c5a0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x417d98
mov eax, esi
mov edx, 8
test al, 1
je 0x40c5bc
shr eax, 1
xor eax, 0xedb88320
jmp 0x40c5be
shr eax, 1
dec edx
jne 0x40c5af
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40c5a8
pop esi
ret

Function at 0x40c5d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x417d94], 0
jne 0x40c5f7
call fcn.0040c5a0
push 1
push 0x417d94
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40c622
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x417d98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40c5fd
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40e304
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40e30c
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40e3f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040b8ec
mov edx, dword [ebp - 8]
mov ecx, 0x40e414
xor eax, eax
call fcn.0040e1e8
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x40e3c7
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x40e326
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.0040de10
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00407e04
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040be74
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x68
call fcn.0040dde0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x406c78]
call fcn.00409740
call fcn.00403f88
jmp 0x40e326
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e400
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c90
ret
Function at 0x10047b87
Capabilities:
Encode data using xor

Disassembly:
fst dword ds:[ecx]
invalid
lcall 0xe0b8, 0x4457f52a
xor dword [ecx], ecx
mov bh, byte [eax - 0x54]
sahf
and al, byte gs:[eax]
cmp dword [ecx], edx
dec ebx
sbb eax, 0x37795295
jns 0x10047bc0
jns 0x10047bc0
jb 0x10047b71
scasb al, byte es:[edi]
das
outsd dx, dword [esi]
push ebx
frstor dword [edi - reloc.WINMM.dll_midiStreamProperty]
movsd dword es:[edi], dword [esi]
js 0x10047bda
cmp ah, 0x4a
jmp 0x10047bf0
pop ebp
jp 0x10047b39
ficomp dword [edx]
jmp dword [ebx]
in eax, 0xb7
xchg edi, eax
adc eax, 0xcd1645a5
inc edx
dec esp
mov al, byte [0x22f82371]
jae 0x10047bc2
xor dword [ebx], edx
loopne 0x10047c53
and ah, bl
invalid
xchg esi, eax
invalid
lcall 0x1227, 0xee2a4c45
ja 0x10047ba9
rcl dword [esp + edi*4 + reloc.WINMM.dll_midiStreamProperty], cl
int1
xor dword [ebx - reloc.WINMM.dll_midiStreamProperty], esp
dec ecx
add bh, al
invalid

Function at 0x101813c1
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x101813c7
ret
Function at 0x102920d6
Capabilities:
Encode data using xor

Disassembly:
call 0x102920fc
mov byte [0x132ffe9b], al
cwde
or dword [edi], ebx
mov bl, 0x24
loope 0x1025ddab
mov ecx, 0x95ba0340
add ch, al
inc eax
inc ebp
add eax, dword [eax]
cmp al, 0x41
jmp 0x102920de
lea esp, [esp + 0x10]
mov al, byte [ecx]
jmp 0x102920c0
jb 0x1025dd7d
jae 0x10292112
sbb al, 0x8e
sbb al, 0x7b
xchg esi, eax
push edx
mov fs, word [ebx]
mov bl, 0xd6
and eax, 0x9011e6e2
cmp al, 0x5a
push si
lea esp, [esp + 2]
jbe 0x1025dd29
ja 0x1025dd7d

Function at 0x103093d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 5
sub esp, 0x17
mov ah, 0xaf
mov eax, 0x6c4b5685
jmp 0x10309433
not si
clc
mov eax, esi
mov ah, byte [esp + 6]
xchg dword [esp + 4], edi
pop dword [esp + 4]
jmp 0x10309392
rdtsc
push dword [esp + 2]
xchg esi, eax
sub esp, 0xb
jmp 0x103093a8
pop word [esp + 0xa]
mov bh, byte [esp + 0x16]
xchg dword [esp + 0x1e], ebx
rdtsc
pop word [esp + 0x13]
mov word [esp + 1], si
setle al
xchg word [esp + 0x1e], di
jmp 0x103093de
mov ecx, dword [esp + 7]
xchg dword [esp + 0xc], eax
push cx
lea ebp, [edi - 0x1b]
bsf ecx, ebp
mov dh, byte [esp + 0x26]
jmp 0x103093f4

Function at 0x1030961b
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x19
lea edx, [ebp + 0xb7]
mov ch, 0x7f
lea ebp, [ebp + 0x6c]
mov bx, 0xe265
jmp 0x10309622
sub esp, 0x10
xchg ebx, esi
jmp 0x10309600
bts ax, dx
lea ebp, [esi + edi]
push dword [esp + 3]
neg dx
neg ax
stc
jmp 0x1030967a
mov ax, word [esp]
mov bp, sp
shr bh, cl
mov al, byte [esp]
jmp 0x1030968b
bswap ecx
lea esp, [esp + 7]
mov cx, 0xbc35
bswap esi
mov edx, eax
cld
jmp 0x10309663
or esi, 0x157fb47
rdtsc
mov esi, 0xeb8608c1
clc
mov byte [esp], bh
add ebp, 0x7f704bc5
jmp 0x1030970e
xchg word [esp], cx
not ebx
bts di, si
mov ecx, esi
cpuid
rdtsc
jmp 0x103096f3
mov edi, dword [esp]
xchg bl, ch
not ebx
rdtsc
cmc
mov ax, word [esp + 2]
jmp 0x103096cb
bts ax, di
mov byte [esp + 1], ch
mov cx, di
xchg ecx, edi
setne ah
mov byte [esp], bh
jmp 0x1030973f
lea ecx, [ebp - 0xd]
push bp
mov si, 0xe295
xchg byte [esp + 1], bl
mov eax, ebx
btr di, sp
jmp 0x103096e2
xchg word [esp], bp
rdtsc
mov word [esp], dx
mov cx, 0x36af
bsr ax, bx
call fcn.10309723
xchg word [esp + 1], cx
sub esp, 8
mov dx, 0x1887
mov bl, dh
pop cx
jmp 0x10309796
pop dword [esp + 1]
rdtsc
shr dl, 1
push ecx
push dword [esp]
lea esp, [esp]
jmp 0x103097ab
stc
mov ax, 0xa7ef
mov bl, byte [esp + 0xb]
bswap edi
mov bl, ch
xchg dword [esp], edx
jmp 0x1030983b
pop dword [esp + 8]
call 0x103097dd
lea ebp, [edx*4]
sete cl
call 0x10309854
test dword [ebx - reloc.WINMM.dll_midiStreamProperty], eax
push ss
lea esp, [esp + 0x41]
sub esp, 0x1c
jmp 0x1030990e
xchg dword [esp + 0xd], ecx
xchg dh, bl
mov di, 0x6fc

Function at 0x10309723
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
jmp 0x10309783
add esp, 0xd
sbb bx, 0xa1a3
pop dword [esp]
push dword [esp + 1]
mov bl, 0xda
jmp 0x1030976c
lea eax, [edx*4]
bsf ebp, esi
dec edx
mov ax, word [esp]
jmp 0x10309756
sub esp, 0x18
add esp, 0xa
rdtsc
setle ah
neg edi
bsf ax, di
jmp 0x10309726
Function at 0x1030a417
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 3]
push dword [esp + 5]
lea esp, [esp + 9]
lea esp, [esp + 1]
jmp 0x1030a401
Function at 0x4011a0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x64dac0
mov ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx + 0x48]
test edx, edx
je 0x40122b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInStop]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInReset]
mov dword [ebp - 8], 0
jmp 0x4011ed
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 2
jge 0x40120f
push 0x20
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4 + 0x34]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
jmp 0x4011e4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.WINMM.dll_waveInClose]
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + 0x49]
test eax, eax
je 0x401285
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.WINMM.dll_waveOutReset]
mov dword [ebp - 0xc], 0
jmp 0x401256
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x401278
push 0x20
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x34]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
jmp 0x40124d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x44]
push ecx
call dword [sym.imp.WINMM.dll_waveOutClose]
mov dword [ebp - 0x10], 0
jmp 0x401297
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 2
jge 0x401303
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4 + 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.005f2f5f
add esp, 4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4 + 0x34]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.005f2f5f
add esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx*4 + 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.005f2f5f
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*4 + 0x3c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.005f2f5f
add esp, 4
jmp 0x40128e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret