joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4106c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42d6bb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x438300]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00427730
push 4
mov dword [esp + 0x24], 0
call fcn.00414fa9
mov edi, eax
add esp, 4
test edi, edi
je 0x410742
call fcn.0042756d
mov dword [edi], eax
call fcn.0042739b
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004276f1
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x410737
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00427719
jmp 0x410744
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x411760
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x42e568
mov eax, dword fs:[0]
push eax
sub esp, 0xac
push ebp
push esi
push edi
mov eax, dword [0x438300]
xor eax, esp
push eax
lea eax, [esp + 0xbc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xcc]
cmp dword [ebp + 0x18], 8
jb 0x41179e
mov eax, dword [ebp + 4]
jmp 0x4117a1
lea eax, [ebp + 4]
push 0x432d48
push eax
call fcn.004141f9
mov esi, eax
add esp, 8
test esi, esi
jne 0x411811
lea eax, [esp + 0x9c]
push ebp
push eax
mov edx, str.Cant_open_file
call fcn.00412350
lea ecx, [esp + 0x88]
push ecx
mov edi, 0x43368c
mov ecx, eax
mov dword [esp + 0xd0], esi
call fcn.0040dac0
add esp, 0xc
lea edx, [esp + 0x3c]
push edx
mov edi, eax
mov byte [esp + 0xc8], 1
call fcn.0040a880
push 0x4356a4
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], vtable.cioe16.0
call fcn.0041b378
push 2
push 0
push esi
call fcn.00414d74
add esp, 0xc
push esi
call fcn.00414c7c
mov edi, eax
add esp, 4
cmp edi, 0x7f400
jbe 0x411836
mov edi, 0x7f400
push edi
mov eax, ebx
call fcn.0040b6b0
push 0
push 0
push esi
call fcn.00414d74
add esp, 0xc
test edi, edi
jle 0x4118bb
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
jne 0x41185c
call fcn.00415357
mov eax, dword [ebx + 0xc]
push esi
push 1
push edi
push eax
call fcn.004148a9
add esp, 0x10
cmp eax, 1
je 0x4118bb
push esi
call fcn.00414ec1
add esp, 4
lea edx, [esp + 0x64]
push ebp
push edx
mov edx, 0x43375c
call fcn.00412350
add esp, 8
lea ecx, [esp + 0x14]
push ecx
mov edi, eax
mov dword [esp + 0xc8], 2
call fcn.0040a880
push 0x4356a4
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], vtable.cioe16.0
call fcn.0041b378
push esi
call fcn.00414ec1
add esp, 4
mov ecx, dword [esp + 0xbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xb8
ret

Function at 0x412350
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x42dbb1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x438300]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x10], ebx
xor eax, eax
mov word [esp + 0x18], ax
mov eax, edx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
lea esi, [eax + 2]
jmp 0x4123a0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4123a0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.00406eb0
mov ecx, dword [esp + 0x44]
push ebx
push ecx
or eax, 0xffffffff
lea esi, [esp + 0x1c]
mov dword [esp + 0x40], 1
call fcn.0040e4c0
push 0xffffffffffffffff
push ebx
xor edx, edx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push eax
mov ecx, edi
mov word [edi + 4], dx
call fcn.004068c0
mov byte [esp + 0x38], bl
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x10], 1
jb 0x41240f
mov eax, dword [esp + 0x18]
push eax
call fcn.004148f0
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x412424
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x434890
call fcn.00415dcc
mov eax, dword [ebp + 8]
test eax, eax
mov esi, 0x10000
je 0x412442
lea esi, [eax + 0x10000]
push 0x1c
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.00415d50
add esp, 0xc
push 0xfffffffffffffffe
pop edi
push 0x1c
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jbe 0x4124bc
cmp dword [ebp - 0x24], 0x1000
jne 0x412489
test dword [ebp - 0x20], 0x100
jne 0x412489
and dword [ebp - 4], 0
mov eax, 0x5a4d
cmp word [esi], ax
je 0x412494
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
lea esi, [eax + ecx]
jmp 0x412455
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x412486
mov dword [ebp - 4], edi
mov eax, esi
call fcn.00415e11
ret 4
xor eax, eax
jmp 0x4124a6

Function at 0x4124c0
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4348b0
call fcn.00415dcc
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
xor edi, edi
cmp eax, edi
jne 0x4124e2
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4124f9
push 0xc1
jmp 0x412595
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
je 0x412510
push 0xbf
jmp 0x412595
movzx eax, word [esi + 0x14]
cmp ax, di
je 0x412590
movzx eax, ax
lea ebx, [eax + esi + 0x18]
mov dword [ebp - 0x1c], edi
movzx eax, word [esi + 6]
cmp dword [ebp - 0x1c], eax
jae 0x412590
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0x28
lea edi, [eax + ebx]
push str..detour
push edi
call fcn.00415fc0
pop ecx
pop ecx
test eax, eax
jne 0x412584
mov eax, dword [edi + 0xc]
xor ecx, ecx
cmp eax, ecx
je 0x412590
cmp dword [edi + 0x10], ecx
je 0x412590
mov edx, dword [ebp + 8]
lea esi, [eax + edx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x412590
cmp dword [esi + 4], 0x727444
jne 0x412590
cmp dword [esi + 8], ecx
jne 0x412572
mov dword [esi + 8], eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4125a4
inc dword [ebp - 0x1c]
jmp 0x412523
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.00415e11
ret 4
Function at 0x4126a8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
mov eax, 0x150
cmp dword [esi], eax
jne 0x412787
cmp dword [ebp + 0xc], eax
jb 0x412787
and dword [ebp - 4], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push 0x40
push dword [esi + 4]
call edi
test eax, eax
je 0x412781
push ebx
lea eax, [ebp - 8]
push eax
push 0x40
mov ebx, 0xf8
push ebx
push dword [esi + 8]
call edi
test eax, eax
je 0x412772
mov eax, dword [esi + 0xc]
test eax, eax
je 0x412714
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push 4
push eax
call edi
test eax, eax
je 0x412765
push 0x40
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.00416050
push ebx
lea eax, [esi + 0x54]
push eax
push dword [esi + 8]
call fcn.00416050
mov eax, dword [esi + 0xc]
add esp, 0x18
test eax, eax
je 0x41274b
push 4
lea ecx, [esi + 0x14c]
push ecx
push eax
call fcn.00416050
add esp, 0xc
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], 1
test eax, eax
je 0x412765
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push 4
push eax
call edi
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
push ebx
push dword [esi + 8]
call edi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
push 0x40
push dword [esi + 4]
call edi
pop ebx
mov eax, dword [ebp - 4]
pop edi
jmp 0x412794
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
leave
ret 8

Function at 0x4127df
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x4348f0
call fcn.00415dcc
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov edx, dword [ebp - 0x30]
cmp word [edx], ax
jne 0x412847
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x412847
mov ecx, dword [eax + 0xd8]
lea esi, [ecx + edx]
cmp dword [ebp + 0xc], esi
jb 0x412847
mov eax, dword [eax + 0xdc]
add eax, ecx
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x412847
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x412850
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.00415e11
ret
Function at 0x412948
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
push edi
mov ebx, 0x10000
cmp esi, 0x7ff80000
jbe 0x41296b
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x41296e
mov dword [ebp - 4], ebx
cmp esi, 0x80000000
jae 0x412981
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
jmp 0x412988
mov dword [ebp - 8], 0xfff80000
mov eax, dword [0x439e24]
mov ecx, dword [0x439e20]
test eax, eax
jne 0x4129a2
test ecx, ecx
je 0x4129b7
mov eax, ecx
mov dword [0x439e24], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x4129b7
cmp edx, dword [ebp - 4]
jb 0x4129b7
cmp edx, dword [ebp - 8]
jbe 0x412a88
mov eax, ecx
test ecx, ecx
jmp 0x4129db
test eax, eax
je 0x4129d6
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4129d6
cmp ecx, dword [ebp - 4]
jb 0x4129d6
cmp ecx, dword [ebp - 8]
jbe 0x412a88
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x439e24], eax
jne 0x4129bd
mov eax, esi
and eax, 0xffff
sub esi, eax
mov edi, esi
cmp esi, dword [ebp - 4]
jbe 0x412b1d
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x412a08
mov edi, 0x6fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x412b1d
cmp dword [ebp - 0x30], ebx
jne 0x412a27
cmp dword [ebp - 0x34], ebx
jae 0x412a3a
mov edi, dword [ebp - 0x3c]
add edi, 0xffff0000
cmp edi, dword [ebp - 4]
ja 0x4129f6
jmp 0x412b1d
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x439e24], eax
test eax, eax
je 0x412b1d
mov ecx, dword [0x439e20]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x439e20], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x412a7a
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, dword [ebp - 4]
jb 0x412b22
cmp esi, dword [ebp - 8]
ja 0x412b22
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.00415d50
add esp, 0xc
mov eax, esi
jmp 0x412b24
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x412ac9
mov esi, 0x80010000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x412b22
cmp dword [ebp - 0x14], ebx
jne 0x412b14
cmp dword [ebp - 0x18], ebx
jb 0x412b14
movzx ecx, si
test ecx, ecx
je 0x412af8
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x18], eax
add dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x439e24], eax
test eax, eax
jne 0x412a56
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
lea esi, [eax + ecx]
cmp esi, dword [ebp - 8]
jb 0x412ab7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412b4a
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x434910
call fcn.00415dcc
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x412ba5
and dword [ebp - 4], 0
mov ecx, 0x5a4d
mov eax, dword [ebp - 0x30]
cmp word [eax], cx
jne 0x412b9e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412b9e
cmp word [ecx + 0x14], 0
je 0x412b9e
mov dword [ebp - 4], 0xfffffffe
jmp 0x412ba7
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.00415e11
ret

Function at 0x412bbf
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
xor edi, edi
cmp dword [0x439e2c], edi
je 0x412bd2
mov eax, 0x10dd
jmp 0x412c2d
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x439e2c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x412bcb
push esi
mov esi, dword [0x439e20]
mov dword [0x439e28], edi
mov dword [0x439e3c], edi
mov dword [0x439e38], edi
mov dword [0x439e30], edi
mov dword [0x439e34], edi
jmp 0x412c26
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x412c10
xor eax, eax
pop esi
pop edi
pop ecx
ret

Function at 0x412c30
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x439e2c], eax
je 0x412c46
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x439e3c]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x412c91
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x412c82
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x412c82
call fcn.00412b29
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.004148f0
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x412c55
mov dword [0x439e3c], ebx
call fcn.00412921
mov esi, dword [0x439e38]
cmp esi, ebx
je 0x412cbe
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.004148f0
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x412ca6
pop edi
pop esi
mov dword [0x439e38], ebx
mov dword [0x439e2c], ebx
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x412f15
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x439e30]
test eax, eax
jne 0x412f85
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 8]
cmp edi, eax
jne 0x412f31
xor eax, eax
jmp 0x412f84
push esi
push 8
call fcn.00414fa9
mov esi, eax
pop ecx
test esi, esi
jne 0x412f45
push 8
pop edi
jmp 0x412f60
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x412f71
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.004148f0
pop ecx
and dword [0x439e34], 0
mov dword [0x439e30], edi
mov eax, edi
jmp 0x412f83
mov eax, dword [0x439e38]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x439e38], esi
xor eax, eax
pop esi
pop edi
ret 4
Function at 0x41358c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x438300]
jne 0x413596
repz ret
jmp fcn.004163b5

Function at 0x420972
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419a16
and dword [ebp - 4], 0
cmp dword [0x43a8e4], 0
mov ebx, eax
jne 0x420a23
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x420ad4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x420ad4
push eax
call fcn.004199a4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43a8e4], eax
call esi
push eax
call fcn.004199a4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43a8e8], eax
call esi
push eax
call fcn.004199a4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43a8ec], eax
call esi
push eax
call fcn.004199a4
pop ecx
mov dword [0x43a8f4], eax
test eax, eax
je 0x420a23
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004199a4
pop ecx
mov dword [0x43a8f0], eax
mov eax, dword [0x43a8f0]
cmp eax, ebx
je 0x420a7b
cmp dword [0x43a8f4], ebx
je 0x420a7b
push eax
call fcn.00419a1f
push dword [0x43a8f4]
mov esi, eax
call fcn.00419a1f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x420a7b
test edi, edi
je 0x420a7b
call esi
test eax, eax
je 0x420a72
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x420a72
test byte [ebp - 0xc], 1
jne 0x420a7b
or dword [ebp + 0x10], 0x200000
jmp 0x420ab4
mov eax, dword [0x43a8e8]
cmp eax, ebx
je 0x420ab4
push eax
call fcn.00419a1f
pop ecx
test eax, eax
je 0x420ab4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x420ab4
mov eax, dword [0x43a8ec]
cmp eax, ebx
je 0x420ab4
push eax
call fcn.00419a1f
pop ecx
test eax, eax
je 0x420ab4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43a8e4]
call fcn.00419a1f
pop ecx
test eax, eax
je 0x420ad4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x420ad6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x426c4a
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x42d439
call fcn.00428455
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x426d5c
cmp byte [esi + 0x42], bl
je 0x426d5c
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x426c86
xor al, al
jmp 0x426d5e
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040ed70
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004111c0
mov ecx, eax
call fcn.0040b780
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004111c0
mov ecx, eax
call fcn.0040b780
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x426cf6
dec eax
je 0x426cfa
dec eax
dec eax
je 0x426d58
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406870
mov al, bl
jmp 0x426d5e
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004111c0
mov ecx, eax
call fcn.0040b780
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x426d3a
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004111c0
mov ecx, eax
call fcn.0040b780
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00414a5d
add esp, 0x10
cmp edi, eax
jne 0x426ce4
cmp byte [esi + 0x42], 0
je 0x426d58
test edi, edi
jne 0x426c94
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040b4d0
jmp 0x426c94
mov bl, 1
jmp 0x426ce6
mov al, 1
call fcn.0042849f
ret
Function at 0x426e05
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x42d37b
call fcn.00428455
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x426e2f
lea eax, [ebp + 8]
push eax
call fcn.0040ef70
pop ecx
jmp 0x426faa
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x426e5d
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x426e5d
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x426faa
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0x426fa5
cmp dword [esi + 0x3c], ebx
jne 0x426e86
push eax
push edi
call fcn.00426615
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x426faa
jmp 0x426fa5
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.0040ed70
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.004111c0
mov ecx, eax
call fcn.0040b780
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004111c0
mov ecx, eax
call fcn.0040b780
lea edx, [ebp - 0x38]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x426f77
cmp eax, 1
jg 0x426fb2
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004111c0
mov ecx, eax
call fcn.0040b780
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0x426f1c
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004111c0
mov ecx, eax
call fcn.0040b780
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00414a5d
add esp, 0x10
cmp edi, eax
jne 0x426f99
lea eax, [ebp - 0x30]
mov byte [esi + 0x42], 1
cmp dword [ebp - 0x3c], eax
jne 0x426fe2
test edi, edi
ja 0x426f42
cmp dword [ebp - 0x18], 0x20
push 0
lea ecx, [ebp - 0x2c]
jae 0x426f9e
push 8
call fcn.0040b4d0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004111c0
mov ecx, eax
call fcn.0040b780
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004111c0
mov ecx, eax
call fcn.0040b780
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2e]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x426ed3
push 0
lea ecx, [ebp - 0x2c]
push 1
call fcn.00406870
mov eax, 0xffff
call fcn.0042849f
ret 4
cmp eax, 3
jne 0x426f99
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.00426615
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x426fd1
mov esi, 0xffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406870
mov ax, si
jmp 0x426faa
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406870
mov ax, word [ebp + 8]
jmp 0x426faa
Function at 0x76511e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x765023
xchg dword [esp + 4], ecx
mov dl, 0x48
mov dx, word [esp]
push ecx
btr dx, si
jmp 0x7650f1
not edx
shr dh, cl
je 0x765088
jne 0x765088
lea edx, [ecx + ebx]
mov dh, 0xb7
jmp 0x7650f8
push dword [esp + 8]
ret 0xc
mov dx, word [esp]
neg dx
jmp 0x765188
ror al, 0
jmp 0x7650d0
mov dh, byte [esp]
dec al
sbb edx, 0xcd8d421c
jo 0x7651d0
sbb edx, 0xdf611fed
lea edx, reloc.WINMM.dll_midiStreamOut
mov dl, 0xd5
jmp 0x7651fe
sbb edx, 0xdf611fed
lea edx, reloc.WINMM.dll_midiStreamOut
mov dl, 0xd5
call 0x765369
clc
invalid
jmp 0x7651ba
bt dx, ax
jmp 0x76523a
lea edx, [edi*4]
mov dh, byte [esp]
jmp 0x7651dc
sub esp, 0xd
jns 0x7652f5
mov edx, dword [esp + 3]
jmp 0x7652b9
add al, 0x8b
mov dl, 0x14
mov dh, bh
mov edx, eax
mov dx, word [esp]
jmp 0x765224
mov ah, byte [esp]
mov dx, di
jmp 0x76528c
mov ah, byte [esp]
mov dx, di
dec esi
mov eax, esp
jmp 0x765295
btr ax, si
jns 0x7652d5
setnp dh
mov dh, 0x55
mov dx, word [esp]
not al
shl ax, 0xe
jmp 0x7652dc
lea esp, [esp + 1]
jmp 0x7652fd
mov dx, word [esp]
not al
shl ax, 0xe
jmp 0x7652dc
setnp dh
mov dh, 0x55
jmp 0x7652bf
clc
neg bl
bswap edx
mov ax, bp
bts dx, di
jmp 0x76533c
mov edx, dword [esp + 3]
and al, 3
lea esp, [esp + 1]
add cl, al
clc
jno 0x765286
jo 0x765270
setle dh
xchg dh, dl
rdtsc
inc eax
push edx
jmp 0x765345
rdtsc
inc eax
push edx
jmp 0x765345
je 0x765308
setle dh
xchg dh, dl
jmp 0x765326
lea esp, [esp + 4]
inc bl
sub esp, 0x12
jbe 0x76537c
ja 0x7653fe
fld qword [edx + ebx*8 - 0x43]
dec esp
rep insd dword es:[edi], dx
int1
popal
add bl, dh
inc ebp
insd dword es:[edi], dx
pushal
pop es
inc esi
jae 0x7652f7
push ebp
push 0xffffffffffffff80
ret 0xf6c7
mov dword [esp + 7], edi
cmc
lea edx, [ebx*4]
mov word [esp + 7], di
jmp 0x7653a2
xchg word [esp + 1], dx
lea esp, [esp + 2]
jmp 0x7653da
mov word [esp + 7], di
xchg word [esp + 1], dx
jmp 0x7653a7
jmp 0x7655ac
lea esp, [esp + 0x10]
neg bl
mov ax, di
sub esp, 0x1e
jnp 0x7653c4
xchg byte [esp + 0x15], ah
not dh
mov dh, 0xe8
mov ax, sp
lea esp, [esp + 2]
jmp 0x765555
mov dword [esp + 7], edi
cmc
lea edx, [ebx*4]
jmp 0x7653b8
mov ax, sp
lea esp, [esp + 2]
rol bl, 0
call fcn.00765435
xchg byte [esp + 0x15], ah
not dh
mov dh, 0xe8
jmp 0x76554e

Function at 0x765123
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, 0xc3
mov dl, byte [esp]
stc
sbb dh, cl
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0x765138
xchg dword [esp], eax
btc edx, esp
neg edx
mov dl, 0x94
not dx
jmp 0x76517b
lea eax, [eax + 0x110]
bswap edx
call 0x765165