joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431a20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x443272
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.0043a976
lea edi, [esi + 0x5c]
mov byte [esp + 0x18], 1
mov ecx, edi
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 2
call fcn.00435b30
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 3
call fcn.00435810
lea ecx, [esi + 0x114]
mov byte [esp + 0x18], 4
call fcn.004353d0
mov al, byte [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov byte [esi + 0x46], al
mov eax, dword [esp + 0x24]
push 0x7fe2
push ebx
mov byte [esp + 0x20], 5
mov dword [esi], 0x4489b8
mov dword [esi + 0x64], ecx
mov dword [esi + 0x54], edx
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], ebx
call dword [sym.imp.USER32.dll_LoadBitmapA]
lea ecx, [esp + 0x28]
mov dword [esi + 0x68], eax
push ecx
mov ecx, edi
call sub.MFC42.DLL_CString::operator_1
push 0x15
mov dword [esi + 0x154], esi
mov dword [esi + 0xc0], esi
mov dword [esi + 0x10c], esi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dl, byte [esp + 0x30]
or edi, 0xffffffff
push 8
mov dword [esi + 0x50], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x4c], dl
mov byte [esi + 0x160], 1
mov dword [esi + 0x48], edi
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], 1
call dword [sym.imp.USER32.dll_GetSysColor]
lea ecx, [esp + 0x28]
mov dword [esi + 0x164], eax
mov dword [esp + 0x18], edi
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x433c90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x443507
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4458f8
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.0043a96a
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.0043a96a
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0x448ca8
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.004347b0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret

Function at 0x436528
Capabilities:
Check os version

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x436540
cmp al, 5
sbb eax, eax
and eax, 2
add eax, 6
ret
push 8
pop eax
ret
Function at 0x43a246
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x454858]
push ebx
xor ebx, ebx
push edi
cmp eax, ebx
jne 0x43a26c
cmp dword [0x454850], ebx
jne 0x43a26c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
jmp 0x43a42b
mov ecx, dword [ebp + 0x10]
cmp ecx, 0xfffffff2
jne 0x43a397
mov edi, dword [ebp + 8]
cmp dword [edi + 0x6a0], ebx
je 0x43a28a
xor eax, eax
jmp 0x43a43f
lea eax, [ebp - 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
mov esi, 0x454830
push dword [ebp - 8]
push esi
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x43a2e9
push dword [0x454850]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_KillTimer]
or dword [0x453c0c], 0xffffffff
or dword [0x453c14], 0xffffffff
or dword [0x453c10], 0xffffffff
push ebx
push 1
mov dword [0x454850], ebx
push dword [ebp + 0xc]
push edi
call fcn.00437607
add esp, 0x10
jmp 0x43a38f
cmp dword [0x453c0c], ebx
jne 0x43a306
push dword [ebp - 4]
lea ebx, [edi + 8]
push dword [ebp - 8]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004392a9
jmp 0x43a31c
push dword [ebp - 4]
lea ebx, [edi + 0x354]
push dword [ebp - 8]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00439333
add esp, 0x14
cmp dword [0x453c14], eax
mov dword [0x453c10], eax
je 0x43a38a
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push ebx
movsd dword es:[edi], dword [esi]
call fcn.00439365
mov esi, dword [ebp + 0xc]
pop ecx
pop ecx
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x24]
neg eax
push eax
mov eax, dword [ebp - 0x28]
neg eax
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push esi
call dword [sym.imp.USER32.dll_GetWindowDC]
mov edi, eax
lea eax, [ebp - 0x18]
push 0xffffffffffffffff
push eax
push edi
push esi
push ebx
call fcn.0043927c
add esp, 0x14
push edi
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x453c10]
mov dword [0x453c14], eax
xor eax, eax
pop esi
jmp 0x43a43f
cmp ecx, 0xfffd
jne 0x43a3c4
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_KillTimer]
push ebx
push 0x37
push 0xfffe
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x454858], eax
jmp 0x43a283
cmp ecx, 0xfffe
jne 0x43a427
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
shl eax, 0x10
or eax, ecx
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00439872
mov eax, dword [0x453c18]
add esp, 0x10
cmp eax, 0xffffffff
je 0x43a283
push ebx
push eax
push dword [0x454854]
push dword [ebp + 0xc]
call fcn.004390fa
add esp, 0x10
jmp 0x43a283
push dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 8]
push 0x113
push dword [ebp + 0xc]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_CallWindowProcA]
pop edi
pop ebx
leave
ret
Function at 0x43a72e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43a786
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x453ea0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43a779
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x43a788
xor eax, eax
pop esi
leave
ret 4

Function at 0x43d2e9
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x443a98
call fcn.0043e598
sub esp, 0xc
push ebx
push esi
push edi
push 1
lea eax, [ebp + 8]
pop ebx
push ecx
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], bl
call fcn.0043d299
cmp eax, ebx
pop ecx
je 0x43d322
xor esi, esi
jmp 0x43d3a4
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x14], eax
test bl, al
je 0x43d344
push 0x80
push dword [ebp + 8]
call esi
and dword [ebp - 0x10], 0
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], bl
call fcn.0043d299
cmp eax, ebx
pop ecx
mov dword [ebp - 0x18], eax
jne 0x43d37d
push dword [ebp + 0xc]
call edi
test bl, al
mov dword [ebp - 0x10], eax
je 0x43d37d
push 0x80
push dword [ebp + 0xc]
call esi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push dword [ebp - 0x14]
mov edi, eax
push dword [ebp + 8]
call esi
cmp dword [ebp - 0x18], ebx
jne 0x43d3a2
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call esi
mov esi, edi
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x411014
Capabilities:
Terminate process

Disassembly:
jmp 0x4115e0
jmp fcn.00411d40
cmp ecx, dword [section..data]
jne 0x4115ea
repz ret
jmp 0x411087
Function at 0x778e13
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x778e59
mov bl, 0x7e
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
clc
jmp 0x778ead
lea esp, [esp + 0x5c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
bswap ebx
inc bx
mov ebx, 0x8bc46992
jmp 0x778e38
and ebx, ecx
push edx
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x778e82

Function at 0x778f1f
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x14
jmp 0x7790e4
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov di, word [esp]
pushal
mov ebx, esi
jmp 0x778fdd
mov dword [ecx], edi
pop ecx
not di
add di, 0x4936
bsf di, ax
mov edi, dword [esp]
jmp 0x778f64
push ecx
mov ecx, esi
lea ecx, [ecx + 4]
jmp 0x778f86
xchg al, ah
mov dword [esp], edx
clc
clc
stc
call fcn.00778fc4
lea ebx, reloc.WINMM.dll_midiStreamOut
mov edi, dword [ebx]
pop ebx
and ebx, ecx
jmp 0x77903a
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x77901d
and ebx, ecx
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x779053
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
bswap ebx
mov bx, word [esp]
mov bl, bh
bsr bx, bp
jmp 0x778ff7
movzx ebx, byte [esi + 0xd]
sub esp, 0x1c
and edx, ecx
jmp 0x7790a9
bswap edx
mov edx, 0x23dee07c
jmp 0x7790f6
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
and edx, ecx
call fcn.00779085
lea esp, [esp + 2]
lea esp, [esp + 0x40]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
neg dx
lea edx, [ebp*4]
jmp 0x779091
mov edx, dword [esi + 8]
push esp
lea esp, [esp + 1]
stc
lea esp, [esp + 3]
jmp 0x778fa1
mov edx, dword [esi + 0xc]
pushal
lea esp, [esp + 0x1f]
lea esp, [esp + 1]
jmp 0x77918d
bsr di, bp
shr edi, 9
jmp 0x779171
mov edi, edx
clc
call fcn.0077914c
dec esp
int3
mov dword [esi + 8], edi
not edi
cmc
sub edi, ebp
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x779107

Function at 0x77908f
Capabilities:
Encrypt data using aes

Disassembly:
cmp al, 0xbd
pushfd
dec esp
jne 0x779081
pop word [esp]
call 0x77908f
jnp 0x77907b
daa

Function at 0x779131
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [eax + 0x1c], edx
jmp 0x779122
lea esp, [esp + 0x14]
cmp ebx, 0x7564c4
call fcn.00778803
mov dword [esp], ebp
jmp 0x779154
lea esp, [esp + 2]
jmp 0x77993a
add esp, 1
lea esp, [esp + 3]
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 0x1e
mov word [esp + 0xe], dx
jmp 0x779136
and edi, ecx
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
call fcn.00779584
Function at 0x779216
Capabilities:
Encrypt data using aes

Disassembly:
pop edi
lea esi, [ebx + edi]
jmp 0x77936a
cmc
sub esp, 0x1a
mov word [esp + 4], di
lea esp, [esp + 2]
and edx, ecx
jmp 0x7791de
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
jmp 0x779230
popal
lea ecx, [ecx*4]
lea ecx, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [ecx]
pop ecx
jmp 0x7791a1
push edx
push word [esp + 1]
add esp, 3
lea esp, [esp + 3]
jmp 0x7791b2
pushal
sub ch, ah
sub cx, 0xb580
mov ebp, 0x71bc8e44
mov esi, ecx
mov dword [esp + 0x18], ebx
jmp 0x7791cb
push ecx
jmp 0x7791f5
and edx, ecx
jmp 0x7792c9
and ebx, ecx
lea esp, [esp + 0x3c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x779219
setg bl
movzx ebx, byte [esi + 0xe]
call fcn.00779216
mov ecx, esi
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
pop ecx
jmp 0x77929d
dec dword [ebp - 4]
push esp
lea esp, [esp + 1]
lea esp, [esp + 3]
push ecx
jmp 0x779255
popal
int1
nop
arpl di, dx
and byte [edx - 0x78], dl
insb byte es:[edi], dx
and al, 5
lea esp, [esp + 8]
jmp 0x779270
push edx
call 0x7792b3
jb 0x77928c
ja 0x7792b9
loope 0x7792d2
mov byte [eax], bl
mov gs, ecx
sbb byte [esi + 0x7e17e4f5], ah
lea esp, [esp + 3]
mov word [esp], bx
sbb al, 0x24
lea esp, [esp + 1]
jmp 0x7792d5
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
call 0x779292
invalid
lea esp, [esp + 4]
jne 0x74aa6c
je 0x74aa01
mov dh, 0x20
mov dh, 0xd1
and byte [edi - 0x6b32a238], bl
sar dword [bp + si], 1
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 3
aas
push es
mov cl, 0x8d
and al, 2
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov ebx, dword [esp]
lea ebx, reloc.WINMM.dll_midiStreamOut
jmp 0x779249
not bl
bswap ebx
Function at 0x779292
Capabilities:
Encrypt data using aes

Disassembly:
pop edi
lea esi, [ebx + edi]
jmp 0x77936a
cmc
sub esp, 0x1a
mov word [esp + 4], di
lea esp, [esp + 2]
and edx, ecx
jmp 0x7791de
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
jmp 0x779230
popal
lea ecx, [ecx*4]
lea ecx, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [ecx]
pop ecx
jmp 0x7791a1
push edx
push word [esp + 1]
add esp, 3
lea esp, [esp + 3]
jmp 0x7791b2
pushal
sub ch, ah
sub cx, 0xb580
mov ebp, 0x71bc8e44
mov esi, ecx
mov dword [esp + 0x18], ebx
jmp 0x7791cb
push ecx
jmp 0x7791f5
and edx, ecx
jmp 0x7792c9
and ebx, ecx
lea esp, [esp + 0x3c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x779219
setg bl
movzx ebx, byte [esi + 0xe]
call fcn.00779216
mov ecx, esi
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
pop ecx
jmp 0x77929d
dec dword [ebp - 4]
push esp
lea esp, [esp + 1]
lea esp, [esp + 3]
push ecx
jmp 0x779255
popal
int1
nop
arpl di, dx
and byte [edx - 0x78], dl
insb byte es:[edi], dx
and al, 5
lea esp, [esp + 8]
jmp 0x779270
push edx
call 0x7792b3
jb 0x77928c
ja 0x7792b9
loope 0x7792d2
mov byte [eax], bl
mov gs, ecx
sbb byte [esi + 0x7e17e4f5], ah
lea esp, [esp + 3]
mov word [esp], bx
sbb al, 0x24
lea esp, [esp + 1]
jmp 0x7792d5
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
call 0x779292
invalid
lea esp, [esp + 4]
jne 0x74aa6c
je 0x74aa01
mov dh, 0x20
mov dh, 0xd1
and byte [edi - 0x6b32a238], bl
sar dword [bp + si], 1
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 3
aas
push es
mov cl, 0x8d
and al, 2
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov ebx, dword [esp]
lea ebx, reloc.WINMM.dll_midiStreamOut
jmp 0x779249
not bl
bswap ebx
Function at 0x7792b3
Capabilities:
Encrypt data using aes

Disassembly:
pop edi
lea esi, [ebx + edi]
jmp 0x77936a
cmc
sub esp, 0x1a
mov word [esp + 4], di
lea esp, [esp + 2]
and edx, ecx
jmp 0x7791de
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
jmp 0x779230
popal
lea ecx, [ecx*4]
lea ecx, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [ecx]
pop ecx
jmp 0x7791a1
push edx
push word [esp + 1]
add esp, 3
lea esp, [esp + 3]
jmp 0x7791b2
pushal
sub ch, ah
sub cx, 0xb580
mov ebp, 0x71bc8e44
mov esi, ecx
mov dword [esp + 0x18], ebx
jmp 0x7791cb
push ecx
jmp 0x7791f5
and edx, ecx
jmp 0x7792c9
and ebx, ecx
lea esp, [esp + 0x3c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x779219
setg bl
movzx ebx, byte [esi + 0xe]
call fcn.00779216
mov ecx, esi
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
pop ecx
jmp 0x77929d
dec dword [ebp - 4]
push esp
lea esp, [esp + 1]
lea esp, [esp + 3]
push ecx
jmp 0x779255
popal
int1
nop
arpl di, dx
and byte [edx - 0x78], dl
insb byte es:[edi], dx
and al, 5
lea esp, [esp + 8]
jmp 0x779270
push edx
call 0x7792b3
jb 0x77928c
ja 0x7792b9
loope 0x7792d2
mov byte [eax], bl
mov gs, ecx
sbb byte [esi + 0x7e17e4f5], ah
lea esp, [esp + 3]
mov word [esp], bx
sbb al, 0x24
lea esp, [esp + 1]
jmp 0x7792d5
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
call 0x779292
invalid
lea esp, [esp + 4]
jne 0x74aa6c
je 0x74aa01
mov dh, 0x20
mov dh, 0xd1
and byte [edi - 0x6b32a238], bl
sar dword [bp + si], 1
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 3
aas
push es
mov cl, 0x8d
and al, 2
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov ebx, dword [esp]
lea ebx, reloc.WINMM.dll_midiStreamOut
jmp 0x779249
not bl
bswap ebx

Function at 0x87da72
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x35f5
mov esi, 0xf6924ea2
add esp, 0
bsr dx, bp
jmp 0x87da5b
cld
btr ecx, edx
bswap edx
mov bp, 0xc379
btc ecx, edi
xchg ah, bl
jmp 0x87da1d
lea edi, [edx*4]
add esp, 0
mov ebp, dword [esp]
bswap ecx
jmp 0x87dacd
lea edx, [eax + edi]
inc cx
mov dx, bx
and cl, bh
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x87da45
clc
bsf di, ax
add esp, 4
xchg byte [esp], dl
jmp 0x87da34
sub di, 0xd410
cld
bsr di, cx
xchg byte [esp], dl
cld
cpuid
jmp 0x87da96
mov si, word [esp]
add esp, 0
mov ax, word [esp]
rdtsc
lea ecx, reloc.WINMM.dll_midiStreamOut
jmp 0x87dab6
Function at 0x87e165
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, bp
mov ebp, eax
bswap ebp
lea eax, [esi - 0xbd]
mov ebp, dword [esp + 6]
jmp 0x87e149
mov byte [esp + 7], ah
inc ebx
pop dword [esp + 0xb]
xchg ch, dl
sub bl, ah
mov dl, 0xb4
jmp 0x87e0fc
neg esi
mov si, 0x5ce9
sub esp, 6
mov byte [esp + 0x25], ah
mov cl, ch
stc
jmp 0x87e114
pop dword [esp + 0x12]
pop cx
neg ah
lea ecx, reloc.WINMM.dll_midiStreamOut
not ah
xchg word [esp + 0x1a], ax
jmp 0x87e5ae
mov dword [esp + 0x23], ecx
push dword [esp + 0x20]
mov ax, word [esp + 0x1d]
xchg byte [esp + 0x22], bl
mov byte [esp + 0x1f], ch
jmp 0x87e137
pop bx
lea esp, [esp + 4]
add esp, 2
lea esp, [esp]
mov ebp, dword [esp]
lea esp, [esp]
jmp 0x87e512
not bh
btc ebx, edi
add esp, 7
mov ecx, dword [esp + 2]
rdtsc
mov ebp, esi
jmp 0x87e19d
xchg byte [esp + 1], al
sub esp, 0xc
pop ax
ror ebx, 7
mov eax, ecx
mov ebp, 0xd2edd55c
jmp 0x87e1c8
mov cl, ch
not bx
push esp
mov ebx, dword [esp + 1]
inc cl
xchg dh, al
call fcn.0087e200
mov edi, dword [esp]
mov edx, esi
push esp
bsf cx, ax
mov edx, dword [esp + 6]
mov dword [esp], ebp
jmp 0x87e288
bsf ax, ax
mov word [esp + 1], bx
inc ebx
rdtsc
call fcn.0087e26d
or dword [eax + reloc.WINMM.dll_midiStreamOut], eax
mov ebp, 0x8a24248a
and al, 0x24
mov ah, byte [esp]
mov ah, byte [esp]
lea ebp, [ebx*4]
lea esp, [esp]
mov bp, bx
mov ecx, dword [esp]
jmp 0x87e217
mov dx, 0x4683
mov word [esp + 2], dx
pop dword [esp]
lea edx, [edx + esi]
setne ch
jmp 0x87e23d
shr ah, 1
add esp, 0x22
cpuid
clc
rdtsc
lea edi, [ecx*4]
jmp 0x87e255
mov byte [esp + 1], ch
mov ebp, ecx
pushal
mov dl, 4
mov esi, dword [esp + 9]
lea edx, [edx + edi]
jmp 0x87e2a0
add esp, 0
push esp
shr ah, 1
lea esp, [esp + 2]
bsr dx, bp
xchg word [esp], bx
jmp 0x87e33a
add esp, 0x24
xchg dword [esp], ecx
push dword [esp]
lea edi, [ecx + edi]
mov edx, 0xed34b696
add esp, 3
jmp 0x87e1eb
Function at 0x87e3b6
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov edi, dword [esp + 9]
neg bx
xchg word [esp + 5], dx
xchg dword [esp + 3], eax
jmp 0x87e3e2
mov bp, di
bsf bp, si
btr eax, esp
xchg di, cx
xchg esi, ebp
mov word [esp + 6], bx
jmp 0x87e4be
bsr bp, bp
xchg dword [esp + 0x18], eax
pop word [esp + 0x18]
xchg byte [esp + 6], dl
lea ebx, [edx + ebp]
mov si, word [esp + 5]
jmp 0x87e459
mov dl, 0x6c
push dword [esp + 0x26]
lea esp, [esp + 0x18]
mov ecx, dword [esp + 0x17]
xchg word [esp + 0x11], di
pop edi
jmp 0x87e419
mov ebx, dword [esp + 0x19]
lea edx, [ebx + esi]
mov si, word [esp + 2]
neg bh
mov dl, 0xf4
mov al, ah
jmp 0x87e4a2
xchg ch, dl
clc
xchg byte [esp + 0x2a], bl
push dword [esp + 0x29]
xchg ebp, esi
lea edi, [edi*4]
jmp 0x87e443
push esp
bsf bp, si
pop word [esp + 0x1e]
cpuid
lea eax, [ecx + edx]
mov dl, 0xec
jmp 0x87e4ef
mov cl, 0x32
pop dword [esp + 3]
and ebx, ecx
bswap edi
pop si
sub esp, 0xa
jmp 0x87e488
push dword [esp + 6]
xchg word [esp + 5], bx
cpuid
xchg word [esp + 0xd], bx
add si, 0xfb26
pushal
jmp 0x87e472
not esi
btr edx, esp
mov ah, byte [esp + 9]
clc
xchg ch, dl
sub bp, 0x52e8
jmp 0x87e553
neg ah
xchg word [esp + 0x18], di
neg ah
neg di
mov bl, 0xc8
pop word [esp + 6]
jmp 0x87e4d6
lea edi, reloc.WINMM.dll_midiStreamOut
mov ah, byte [esp + 3]
mov bl, 0x98
bsr cx, bp
not bh
lea esp, [esp + 1]
jmp 0x87e587
setle ch
mov byte [esp + 7], ch
push word [esp + 0x1c]
push word [esp + 0x21]
mov word [esp + 0x1a], bx
inc cx
jmp 0x87e529
push edx
lea esp, [esp + 1]
sub esp, 8
lea esp, [esp + 1]
lea esp, [esp + 0x28]
popfd
jmp 0x87e808
lea esp, [esp + 0x24]
popal
pushal
pop word [esp + 0x11]
mov word [esp + 2], dx
mov word [esp + 0x16], sp
jmp 0x87e56d
lea esp, [esp + 4]
call fcn.0087e763
pop ebx
leave
pop ecx
cmp bl, cl
outsb dx, byte [esi]
sti
push 0xfffffffffffffff8
lahf
push 0xffffffffffffff9b
pop ds
invalid

Function at 0x87e7df
Capabilities:
Parse pe header

Disassembly:
call fcn.0087d1cc
call 0x87e7af
mov eax, dword [eax + 8]
push eax
jmp 0x87d1c7
Function at 0x402c3c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4ce008], 0x8088405
inc edx
mov dword [ebx + 0x4ce008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4030a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4ce024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403138
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403118
xor eax, eax
push ebp
push 0x403111
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403154
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403118
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4ce024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4ce024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403f24
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4d104c], 0
je 0x403f85
cmp word [0x4d1220], 0xd7b2
jne 0x403f4d
cmp dword [0x4d1228], 0
jbe 0x403f4d
mov eax, 0x4d121c
call dword [0x4d1238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4ce070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403fac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4ce034], 0
jne 0x403fa1
push 0
push 0x4ce068
push 0x4ce070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4040d8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040278c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4d104d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4040a0
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc