joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e2d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5e2d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x5e2d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5e2d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5e2d94
push eax
push esi
call fcn.005e520b
add esp, 8
pop esi
ret 0x10

Function at 0x5e2da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5e2e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x5e2e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x5fb320
push ecx
mov dword [esp + 0x1c], 4
call fcn.005e4dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x5e2dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x5e2e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5e2ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x5e2eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x5fb320
push ecx
mov dword [esp + 0x1c], 4
call fcn.005e4dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x5e2eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x5e2e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x5e3000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x5e3131
push esi
call fcn.005e6145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.005d5080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x5e3131
push 0
push ebp
call fcn.005d53a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.005d5260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x5e308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.005d52f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x5e3121
push 0x5fb918
push edi
call fcn.005e43f0
push eax
push ebx
push esi
call fcn.005e2f60
push 0x5fb8f8
push edi
call fcn.005e43f0
push eax
push ebx
push esi
call fcn.005e2f60
push 0x5fb8d8
push edi
call fcn.005e43f0
push eax
push ebx
push esi
call fcn.005e2f60
push 0x5fb8c0
push edi
call fcn.005e43f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.005e2f60
push 0x5fb8a0
push edi
call fcn.005e43f0
push eax
push ebx
push esi
call fcn.005e2f60
push 0x5fb888
push edi
call fcn.005e43f0
push eax
push ebx
push esi
call fcn.005e2f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5e41b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005e4140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005e4140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005e4140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005e4140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x5e4bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5e4c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5f687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5e4c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5e4c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x1031a1bf
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esp, [esp + 0x20]
jmp 0x102fe682
Function at 0x1031f404
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1031f437
jmp 0x1031f4a0
mov dword [esp], ebp
lea esp, [esp + 3]
add esp, 0x14
js 0x1031f3e0
jns 0x1031f41a
sub ch, byte [ebx + 0x15ad5e3b]
dec esi
fstp dword [esi + 0xf]
mov byte [0x66240c8b], al
shr edx, cl
pop esi
cpuid
mov ecx, dword [esp]
shr dx, cl
jb 0x1031f3e5
jae 0x1031f4a0
mov edx, 0x4ba4f28
sbb esi, dword [edx + 0x6d]
jl 0x1031f3b9
jl 0x1031f458
pop es
and al, 0xeb
pop ss
dec edi
salc
inc ecx
ret
pop edi
mov bl, byte [esp]
mov ecx, dword [esp]
pop ebx
jmp 0x1030c8f6

Function at 0x10333d6f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esi, 0x47
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x10335a35
lea esp, [esp + 4]
ja 0x10333501
sub esp, 5
call 0x103345a4
mov eax, dword [ecx + 0x3c]
mov dl, 0x7c
mov dh, byte [esp]
jmp 0x10335a68
mov ecx, dword [ebp + 8]
stc
neg edx
mov al, byte [esp]
jmp 0x10335a47
and dword [ebp - 0xc], 0
add eax, ecx
mov dl, ch
jmp 0x10335ade
pushal
mov word [esp + 0x14], di
pop dword [esp + 8]
lea esp, [esp + 0x1c]
je 0x1033588b
jne 0x10335ab3
fisttp qword [esi - 0x24]
mov ebx, 0xa65fe756
rcl dword [eax - 0xa]
salc
mov ebp, esp
neg ch
sub esp, 0x18
jmp 0x10335a5d
xor eax, eax
jmp 0x103358cd
mov edx, 0x10b
sub esp, 8
mov dword [esp], ebp
lea esp, [esp + 8]
cmp word [eax + 0x18], dx
jmp 0x10335a72

Function at 0x1033ae23
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, word [esi + 0xe]
lea ebx, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x1033ae3e
lea esp, [esp]
jmp 0x1033ae0d
mov dword [eax], ecx
pop eax
mov bx, word [esp]
jmp 0x1033ae48
push eax
mov eax, ebp
add eax, 0xfffffff8
jmp 0x1033ae28
movzx ecx, word [esi + 0xc]
lea ebx, reloc.WINMM.dll_waveOutUnprepareHeader
btc bx, ax
jmp 0x1033b0c9
lea esp, [esp + 8]
push edi
lea edi, reloc.WINMM.dll_waveOutUnprepareHeader
mov di, word [esp]
jmp 0x1033af15
lea eax, [esi + 0x14]
pushfd
cmc
sub esp, 7
lea esp, [esp + 3]
jmp 0x1033ae7c
lea esp, [esp + 0x20]
jmp 0x1033ad52
mov edi, dword [ebp + 0x10]
pushal
mov dword [ebp + 8], eax
jmp 0x1033aedc
lea esp, [esp + 0x10]
test eax, eax
jle 0x102fefa8
jmp 0x1033ae92
add eax, ecx
mov ebx, edx
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x1033af70

Function at 0x104fd9c7
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 0x41]
pushfd
jmp 0x104fdaa9
mov word [esp + 1], dx
call fcn.104fda52
push esp
pop dword [esp + 1]

Function at 0x104fda39
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
call 0x104fda23
push edi
imul esp, dword [ebp + 0x43], 0x54726168
outsd dx, dword [esi]
dec ebp
Function at 0x104fdad6
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 1]
std
lea ebx, [eax + esi]
dec bl
rcr dl, 1
call fcn.104fd80b
lea esp, [esp + 4]
push 0
call fcn.104fda39
push edx
popal
jae 0x104fda4a
je 0x104fda49
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[ebx + edx*2 + 0x74], si
popal
je 0x104fda86
jae 0x104fda54
add byte [ebp + 0x66032464], cl
pop dword [esp]
push word [esp + 1]
jmp 0x104fd9f4
jne 0x104fdab7
insb byte es:[edi], dx
je 0x104fdab6
inc edx
jns 0x104fdac4
add byte gs:[esi - 1], ah
je 0x104fda7a
add eax, 0x724648d
call 0x104fda14
mov word [esp + 2], cx
pushfd
jmp 0x104fda89
lea esp, [esp + 2]
mov byte [esp], bl
mov byte [esp], bl
call 0x104fda60
invalid
pop word [esp]
pop word [esp + 2]
mov word [esp], di
mov dword [esp], edi
push dword [esp + 1]
push word [esp + 6]
jmp 0x104fdbbf
and al, 1
add dword [esi - 0x77], esp
or al, 0x24
mov word [esp], cx
pop dword [esp]
mov byte [esp], ch
call fcn.104fdb2b
inc ebx
outsd dx, dword [esi]
add byte [eax], al
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
jo 0x104fdb2d
jb 0x104fdb33
push ebx
je 0x104fdb43
imul ebp, dword [esi + 0x67], reloc.WINMM.dll_waveOutUnprepareHeader
and al, 0xeb
mov esi, 0x9245488
mov byte [esp + 9], dl
or dword [eax - reloc.WINMM.dll_waveOutUnprepareHeader], ecx
and al, 0x24
mov byte [esp + 0xa], cl
lea esp, [esp]
pop word [esp + 1]
jmp 0x104fdb62
cmp eax, 0x74ff9f0c
and al, 3
push word [esp + 5]
mov word [esp + 1], sp
mov byte [esp], dh
mov dword [esp + 3], edx
mov word [esp + 6], di
jmp 0x104fdb30
lea esp, [esp + 2]
lea esp, [esp + 8]
push dword [esp + 0xc]
push ax
push sp
jmp 0x104fdb95
push word [esp + 3]
mov dword [esp], edx
mov byte [esp], bh
pushal
push dword [esp + 5]
pushal
jmp 0x104fdbe6
lea esp, [esp + 7]
lea esp, [esp + 1]
mov word [esp], si
call fcn.104fdb83
call 0x104fdbef
inc edi
je 0x104fdc2c
je 0x104fdc4d
imul ebp, dword [esi + 0x67], reloc.WINMM.dll_waveOutUnprepareHeader
inc ecx
add byte [ecx], dl
nop
lea esp, [esp + 0x4a]
call fcn.104fdba8
mov byte [esp + 0xa], ah
mov dword [esp + 1], ecx
mov word [esp + 0xb], cx
call fcn.104fdc4b
lea esp, [esp + 8]
jmp 0x104fdc35
push dword [esp + 5]
jmp 0x104fd9e3
mov dword [esp + 9], edx
pop dword [esp + 2]
push dword [esp + 5]
lea esp, [esp + 4]
jmp 0x104fdda9
invalid
mov byte [esp + 7], bl
pushfd
pop dword [esp + 2]
push dword [esp + 8]
call fcn.104fdd54

Function at 0x104fdad8
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pop dword [esp]
push dword [esp]
jmp 0x104fdaff
pushal
pushal
lea esp, [esp + 0x48]
call 0x104fdb0b
pop esi
mov word [esp], bx
mov dword [esp], eax
push word [esp + 3]
jmp 0x104fdb46
push dword [esp + 3]

Function at 0x104fdb0b
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pop dword [esp]
push dword [esp]
jmp 0x104fdaff
pushal
pushal
lea esp, [esp + 0x48]
call 0x104fdb0b
pop esi
mov word [esp], bx
mov dword [esp], eax
push word [esp + 3]
jmp 0x104fdb46
push dword [esp + 3]
Function at 0x104fdb2b
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [esp], edx
push dword [esp]
pop dword [esp]
mov dword [esp], ebx
call fcn.104fdad8
pop dword [esp]
jmp 0x104fdaee

Function at 0x104fdba8
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push word [esp]
call fcn.104fdbd0
dec esp
inc ebx
dec ebp
popal
jo 0x104fdc0a
je 0x104fdc2b
imul ebp, dword [esi + 0x67], reloc.WINMM.dll_waveOutUnprepareHeader
and al, 7
je 0x104fdc81
popal
insb byte es:[edi], dx
inc esi
jb 0x104fdc76
add byte gs:[ebx], dl
mov ah, byte [0x54876654]
and al, 0xa
and al, 2

Function at 0x104fdbd0
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 1]
std
lea ebx, [eax + esi]
dec bl
rcr dl, 1
call fcn.104fd80b
lea esp, [esp + 4]
push 0
call fcn.104fda39
push edx
popal
jae 0x104fda4a
je 0x104fda49
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[ebx + edx*2 + 0x74], si
popal
je 0x104fda86
jae 0x104fda54
add byte [ebp + 0x66032464], cl
pop dword [esp]
push word [esp + 1]
jmp 0x104fd9f4
jne 0x104fdab7
insb byte es:[edi], dx
je 0x104fdab6
inc edx
jns 0x104fdac4
add byte gs:[esi - 1], ah
je 0x104fda7a
add eax, 0x724648d
call 0x104fda14
mov word [esp + 2], cx
pushfd
jmp 0x104fda89
lea esp, [esp + 2]
mov byte [esp], bl
mov byte [esp], bl
call 0x104fda60
invalid
pop word [esp]
pop word [esp + 2]
mov word [esp], di
mov dword [esp], edi
push dword [esp + 1]
push word [esp + 6]
jmp 0x104fdbbf
and al, 1
add dword [esi - 0x77], esp
or al, 0x24
mov word [esp], cx
pop dword [esp]
mov byte [esp], ch
call fcn.104fdb2b
inc ebx
outsd dx, dword [esi]
add byte [eax], al
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
jo 0x104fdb2d
jb 0x104fdb33
push ebx
je 0x104fdb43
imul ebp, dword [esi + 0x67], reloc.WINMM.dll_waveOutUnprepareHeader
and al, 0xeb
mov esi, 0x9245488
mov byte [esp + 9], dl
or dword [eax - reloc.WINMM.dll_waveOutUnprepareHeader], ecx
and al, 0x24
mov byte [esp + 0xa], cl
lea esp, [esp]
pop word [esp + 1]
jmp 0x104fdb62
cmp eax, 0x74ff9f0c
and al, 3
push word [esp + 5]
mov word [esp + 1], sp
mov byte [esp], dh
mov dword [esp + 3], edx
mov word [esp + 6], di
jmp 0x104fdb30
lea esp, [esp + 2]
lea esp, [esp + 8]
push dword [esp + 0xc]
push ax
push sp
jmp 0x104fdb95
push word [esp + 3]
mov dword [esp], edx
mov byte [esp], bh
pushal
push dword [esp + 5]
pushal
jmp 0x104fdbe6
lea esp, [esp + 7]
lea esp, [esp + 1]
mov word [esp], si
call fcn.104fdb83
call 0x104fdbef
inc edi
je 0x104fdc2c
je 0x104fdc4d
imul ebp, dword [esi + 0x67], reloc.WINMM.dll_waveOutUnprepareHeader
inc ecx
add byte [ecx], dl
nop
lea esp, [esp + 0x4a]
call fcn.104fdba8
mov byte [esp + 0xa], ah
mov dword [esp + 1], ecx
mov word [esp + 0xb], cx
call fcn.104fdc4b
lea esp, [esp + 8]
jmp 0x104fdc35
push dword [esp + 5]
jmp 0x104fd9e3
mov dword [esp + 9], edx
pop dword [esp + 2]
push dword [esp + 5]
lea esp, [esp + 4]
jmp 0x104fdda9
invalid
mov byte [esp + 7], bl
pushfd
pop dword [esp + 2]
push dword [esp + 8]
call fcn.104fdd54
Function at 0x104fdbef
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 1]
std
lea ebx, [eax + esi]
dec bl
rcr dl, 1
call fcn.104fd80b
lea esp, [esp + 4]
push 0
call fcn.104fda39
push edx
popal
jae 0x104fda4a
je 0x104fda49
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[ebx + edx*2 + 0x74], si
popal
je 0x104fda86
jae 0x104fda54
add byte [ebp + 0x66032464], cl
pop dword [esp]
push word [esp + 1]
jmp 0x104fd9f4
jne 0x104fdab7
insb byte es:[edi], dx
je 0x104fdab6
inc edx
jns 0x104fdac4
add byte gs:[esi - 1], ah
je 0x104fda7a
add eax, 0x724648d
call 0x104fda14
mov word [esp + 2], cx
pushfd
jmp 0x104fda89
lea esp, [esp + 2]
mov byte [esp], bl
mov byte [esp], bl
call 0x104fda60
invalid
pop word [esp]
pop word [esp + 2]
mov word [esp], di
mov dword [esp], edi
push dword [esp + 1]
push word [esp + 6]
jmp 0x104fdbbf
and al, 1
add dword [esi - 0x77], esp
or al, 0x24
mov word [esp], cx
pop dword [esp]
mov byte [esp], ch
call fcn.104fdb2b
inc ebx
outsd dx, dword [esi]
add byte [eax], al
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
jo 0x104fdb2d
jb 0x104fdb33
push ebx
je 0x104fdb43
imul ebp, dword [esi + 0x67], reloc.WINMM.dll_waveOutUnprepareHeader
and al, 0xeb
mov esi, 0x9245488
mov byte [esp + 9], dl
or dword [eax - reloc.WINMM.dll_waveOutUnprepareHeader], ecx
and al, 0x24
mov byte [esp + 0xa], cl
lea esp, [esp]
pop word [esp + 1]
jmp 0x104fdb62
cmp eax, 0x74ff9f0c
and al, 3
push word [esp + 5]
mov word [esp + 1], sp
mov byte [esp], dh
mov dword [esp + 3], edx
mov word [esp + 6], di
jmp 0x104fdb30
lea esp, [esp + 2]
lea esp, [esp + 8]
push dword [esp + 0xc]
push ax
push sp
jmp 0x104fdb95
push word [esp + 3]
mov dword [esp], edx
mov byte [esp], bh
pushal
push dword [esp + 5]
pushal
jmp 0x104fdbe6
lea esp, [esp + 7]
lea esp, [esp + 1]
mov word [esp], si
call fcn.104fdb83
call 0x104fdbef
inc edi
je 0x104fdc2c
je 0x104fdc4d
imul ebp, dword [esi + 0x67], reloc.WINMM.dll_waveOutUnprepareHeader
inc ecx
add byte [ecx], dl
nop
lea esp, [esp + 0x4a]
call fcn.104fdba8
mov byte [esp + 0xa], ah
mov dword [esp + 1], ecx
mov word [esp + 0xb], cx
call fcn.104fdc4b
lea esp, [esp + 8]
jmp 0x104fdc35
push dword [esp + 5]
jmp 0x104fd9e3
mov dword [esp + 9], edx
pop dword [esp + 2]
push dword [esp + 5]
lea esp, [esp + 4]
jmp 0x104fdda9
invalid
mov byte [esp + 7], bl
pushfd
pop dword [esp + 2]
push dword [esp + 8]
call fcn.104fdd54
Function at 0x104fdc01
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
lea esp, [esp + 1]
std
lea ebx, [eax + esi]
dec bl
rcr dl, 1
call fcn.104fd80b
lea esp, [esp + 4]
push 0
call fcn.104fda39
push edx
popal
jae 0x104fda4a
je 0x104fda49
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[ebx + edx*2 + 0x74], si
popal
je 0x104fda86
jae 0x104fda54
add byte [ebp + 0x66032464], cl
pop dword [esp]
push word [esp + 1]
jmp 0x104fd9f4
jne 0x104fdab7
insb byte es:[edi], dx
je 0x104fdab6
inc edx
jns 0x104fdac4
add byte gs:[esi - 1], ah
je 0x104fda7a
add eax, 0x724648d
call 0x104fda14
mov word [esp + 2], cx
pushfd
jmp 0x104fda89
lea esp, [esp + 2]
mov byte [esp], bl
mov byte [esp], bl
call 0x104fda60
invalid
pop word [esp]
pop word [esp + 2]
mov word [esp], di
mov dword [esp], edi
push dword [esp + 1]
push word [esp + 6]
jmp 0x104fdbbf
and al, 1
add dword [esi - 0x77], esp
or al, 0x24
mov word [esp], cx
pop dword [esp]
mov byte [esp], ch
call fcn.104fdb2b
inc ebx
outsd dx, dword [esi]
add byte [eax], al
add byte [ebx + 0x6f], al
insd dword es:[edi], dx
jo 0x104fdb2d
jb 0x104fdb33
push ebx
je 0x104fdb43
imul ebp, dword [esi + 0x67], reloc.WINMM.dll_waveOutUnprepareHeader
and al, 0xeb
mov esi, 0x9245488
mov byte [esp + 9], dl
or dword [eax - reloc.WINMM.dll_waveOutUnprepareHeader], ecx
and al, 0x24
mov byte [esp + 0xa], cl
lea esp, [esp]
pop word [esp + 1]
jmp 0x104fdb62
cmp eax, 0x74ff9f0c
and al, 3
push word [esp + 5]
mov word [esp + 1], sp
mov byte [esp], dh
mov dword [esp + 3], edx
mov word [esp + 6], di
jmp 0x104fdb30
lea esp, [esp + 2]
lea esp, [esp + 8]
push dword [esp + 0xc]
push ax
push sp
jmp 0x104fdb95
push word [esp + 3]
mov dword [esp], edx
mov byte [esp], bh
pushal
push dword [esp + 5]
pushal
jmp 0x104fdbe6
lea esp, [esp + 7]
lea esp, [esp + 1]
mov word [esp], si
call fcn.104fdb83
call 0x104fdbef
inc edi
je 0x104fdc2c
je 0x104fdc4d
imul ebp, dword [esi + 0x67], reloc.WINMM.dll_waveOutUnprepareHeader
inc ecx
add byte [ecx], dl
nop
lea esp, [esp + 0x4a]
call fcn.104fdba8
mov byte [esp + 0xa], ah
mov dword [esp + 1], ecx
mov word [esp + 0xb], cx
call fcn.104fdc4b
lea esp, [esp + 8]
jmp 0x104fdc35
push dword [esp + 5]
jmp 0x104fd9e3
mov dword [esp + 9], edx
pop dword [esp + 2]
push dword [esp + 5]
lea esp, [esp + 4]
jmp 0x104fdda9
invalid
mov byte [esp + 7], bl
pushfd
pop dword [esp + 2]
push dword [esp + 8]
call fcn.104fdd54

Function at 0x104fdc50
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
pushfd
jmp 0x104fdcee
pop dword [esp + 0xe]
lea esp, [esp + 0x12]
push dword [esp + 5]
push word [esp + 9]
mov word [esp + 9], sp
push word [esp + 8]
call fcn.104fdcb0