joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000928d
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov ebx, dword [ebp + 0x3c]
push edi
add ebx, ebp
push 0x40
lea eax, [ebx + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [eax + 0x38]
mov dword [esp + 0x24], eax
push 0x3000
add eax, 0x14
push eax
mov edi, ecx
push 0
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x100093bd
push 0x40
mov edx, ebp
mov ecx, esi
call fcn.1000adab
mov esi, dword [esi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, dword [edi]
push eax
mov edx, ebx
mov ecx, esi
call fcn.1000adab
movzx ecx, word [ebx + 0x14]
lea eax, [esi + 0x18]
movzx esi, word [esi + 0x14]
lea edx, [ebx + 0x18]
movzx ebx, word [ebx + 6]
add ecx, edx
add esi, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
test ebx, ebx
je 0x10009352
mov ebp, ecx
sub ebp, esi
mov edi, ebx
push 0x28
lea edx, [esi + ebp]
mov ecx, esi
call fcn.1000adab
add esi, 0x28
dec edi
jne 0x10009316
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
test ebx, ebx
je 0x10009352
lea esi, [ecx + 0x14]
mov ecx, dword [esi - 8]
mov edx, dword [esi]
push dword [esi - 4]
add ecx, dword [edi]
add edx, ebp
call fcn.1000adab
lea esi, [esi + 0x28]
dec ebx
jne 0x1000933b
mov edx, dword [edi]
mov esi, dword [esp + 0x18]
push esi
mov ecx, edx
call fcn.100061ce
push dword [esp + 0x1c]
mov edx, dword [edi]
mov ecx, dword [0x1000f5a8]
call fcn.1000626d
mov eax, dword [esi + 0x60]
test eax, eax
je 0x10009396
cmp dword [esi + 0x64], 0
je 0x10009396
mov edx, dword [edi]
mov ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
shl ecx, 2
sub eax, ecx
mov eax, dword [eax + edx + 4]
add eax, edx
mov dword [edi + 4], eax
mov edx, dword [edi]
add edx, dword [esp + 0x20]
mov ecx, dword [0x1000f5a8]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 4]
and dword [edx + 0xc], 0
and dword [edx + 0x10], 0
mov dword [edx + 4], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x10009b52
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x424
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x1000f5a8]
mov esi, ecx
mov ecx, dword [eax + 0xc]
push 0x2328
add ecx, eax
call fcn.10005fa3
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1000610d
lea eax, [esp + 0x228]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x20]
push eax
xor ebp, ebp
push ebp
push 0x1000d430
lea eax, [esp + 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor eax, eax
inc eax
cmp esi, eax
jne 0x10009bcf
mov edx, str..pdf
jmp 0x10009bd9
cmp esi, 2
jne 0x10009be2
mov edx, str..exe
lea ecx, [esp + 0x20]
call fcn.1000ad37
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
lea eax, [esp + 0x38]
push eax
mov esi, ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10009c49
mov ebx, dword [esp + 0x18]
push ebp
lea eax, [esp + 0x14]
push eax
push ebx
push dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10009c2b
cmp dword [esp + 0x10], ebx
push 1
pop ebx
cmove esi, ebx
jmp 0x10009c2e
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10009c49
push ebx
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
push ebp
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x14]
call fcn.1000ad9b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret
Function at 0x1000a007
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x408
mov edx, dword [ebp + 8]
push esi
mov eax, dword [edx + 0x3c]
add eax, 0x18
add eax, edx
push edi
mov ecx, dword [eax + 0x38]
add ecx, edx
push eax
mov dword [0x1000f5a8], ecx
call fcn.1000626d
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x1000f5ac], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xc]
push ecx
xor esi, esi
push eax
mov dword [esp + 0x14], esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0xc], 1
jle 0x1000a082
mov eax, dword [eax + 4]
movzx ecx, word [eax]
cmp ecx, 0x2d
je 0x1000a06b
cmp ecx, 0x2f
jne 0x1000a082
cmp word [eax + 2], 0x6b
jne 0x1000a082
cmp word [eax + 4], si
jne 0x1000a082
call fcn.10007ff0
jmp 0x1000a138
push 0x100
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x210]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x5c
lea eax, [esp + 0x14]
mov ecx, esi
pop edi
movzx edx, word [eax]
cmp dx, di
jne 0x1000a0be
mov ecx, eax
jmp 0x1000a0c3
test dx, dx
je 0x1000a0c8
add eax, 2
jmp 0x1000a0b2
test ecx, ecx
je 0x1000a0d1
xor eax, eax
mov word [ecx], ax
lea eax, [esp + 0x10]
movzx ecx, word [eax]
cmp cx, di
jne 0x1000a0e1
mov esi, eax
jmp 0x1000a0e6
test cx, cx
je 0x1000a0eb
add eax, 2
jmp 0x1000a0d5
test esi, esi
je 0x1000a0f4
xor eax, eax
mov word [esi], ax
lea edx, [esp + 0x210]
lea ecx, [esp + 0x10]
call fcn.1000acb3
test eax, eax
je 0x1000a133
lea ecx, [esp + 0x210]
call fcn.10009c5d
call fcn.10009b0f
cmp eax, 1
je 0x1000a12a
cmp eax, 2
je 0x1000a12a
call fcn.100098a9
jmp 0x1000a138
mov ecx, eax
call fcn.10009b52
jmp 0x1000a138
call fcn.10005259
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1000a140
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx + 0x3c]
add eax, 0x18
add eax, edx
push eax
mov ecx, dword [eax + 0x38]
add ecx, edx
mov dword [0x1000f5a8], ecx
call fcn.1000626d
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x1000f5ac], eax
xor eax, eax
push eax
push eax
push eax
push 0x100054c5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000a185
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 4

Function at 0x1000a188
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx + 0x3c]
add eax, 0x18
add eax, edx
push eax
mov ecx, dword [eax + 0x38]
add ecx, edx
mov dword [0x1000f5a8], ecx
call fcn.1000626d
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x1000f5ac], eax
xor eax, eax
push eax
push eax
push eax
push 0x10001689
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000a1cd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 4
Function at 0x1000a1d0
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx + 0x3c]
add eax, 0x18
add eax, edx
push eax
mov ecx, dword [eax + 0x38]
add ecx, edx
mov dword [0x1000f5a8], ecx
call fcn.1000626d
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x1000f5ac], eax
xor eax, eax
push eax
push eax
push eax
push 0x10002acc
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000a215
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 4

Function at 0x1000a218
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx + 0x3c]
add eax, 0x18
add eax, edx
push eax
mov ecx, dword [eax + 0x38]
add ecx, edx
mov dword [0x1000f5a8], ecx
call fcn.1000626d
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x1000f5ac], eax
xor eax, eax
push eax
push eax
push eax
push 0x10004e3b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000a25d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 4

Function at 0x1000a260
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push edi
mov ebx, dword [ebp + 0x3c]
push 0x40
add ebx, ebp
push 0x3000
lea eax, [ebx + 0x18]
mov dword [esp + 0x24], ecx
push dword [eax + 0x38]
mov dword [esp + 0x24], eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [esp + 0xc], edi
test edi, edi
je 0x1000a392
push esi
push 0x40
mov edx, ebp
mov ecx, edi
call fcn.1000adab
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.1000adab
movzx eax, word [ebx + 0x14]
lea edx, [esi + 0x18]
movzx esi, word [esi + 0x14]
lea ecx, [ebx + 0x18]
movzx ebx, word [ebx + 6]
add eax, ecx
add esi, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x1000a31d
mov ebp, eax
sub ebp, esi
mov edi, ebx
push 0x28
lea edx, [esi + ebp]
mov ecx, esi
call fcn.1000adab
add esi, 0x28
dec edi
jne 0x1000a2e1
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
test ebx, ebx
je 0x1000a31d
lea esi, [eax + 0x14]
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, ebp
add ecx, edi
call fcn.1000adab
lea esi, [esi + 0x28]
dec ebx
jne 0x1000a306
mov ebx, dword [esp + 0x18]
push ebx
mov edx, edi
mov ecx, edi
call fcn.100061ce
push dword [esp + 0x1c]
mov ecx, dword [0x1000f5a8]
mov edx, edi
call fcn.1000626d
add ebx, 0x60
mov eax, dword [ebx]
test eax, eax
je 0x1000a38e
cmp dword [ebx + 4], 0
je 0x1000a38e
lea esi, [eax + edi]
push 0x1000e03c
push esi
mov edx, ebx
mov ecx, edi
call fcn.1000631e
mov ebp, dword [esp + 0x20]
push str._aP_workmem_size
add eax, edi
push esi
mov edx, ebx
mov ecx, edi
mov dword [ebp + 4], eax
call fcn.1000631e
push str._aP_max_packed_size
add eax, edi
push esi
mov edx, ebx
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.1000631e
add eax, edi
mov dword [ebp + 0xc], eax
xor eax, eax
inc eax
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x1000afad
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
xor edi, edi
push edi
push 0x8000000
push 3
push edi
push 1
mov ebx, edx
push 0x80000000
push ecx
mov dword [ebx], edi
mov dword [ebp], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000afe3
mov eax, 0x80004005
jmp 0x1000b037
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp], eax
cmp eax, 0xffffffff
jne 0x1000affc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000afdc
test eax, eax
je 0x1000aff3
mov ecx, eax
call fcn.1000ad8b
mov dword [ebx], eax
test eax, eax
je 0x1000aff3
push edi
lea ecx, [esp + 0x18]
push ecx
push dword [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000b02e
mov ecx, dword [ebx]
call fcn.1000ad9b
mov edi, 0x80004005
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x1000b235
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x1000b276
push ebp
mov ebp, dword [esp + 0x14]
mov al, byte [esp + 0x18]
mov edx, dword [esi]
add al, bl
cmp dword [esp + 0x1c], 0
movzx ecx, al
je 0x1000b267
add edx, ebx
xor edx, ebp
rol edx, cl
jmp 0x1000b26d
ror edx, cl
xor edx, ebp
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x1000b24d
pop ebp
test edi, edi
je 0x1000b284
mov eax, dword [esp + 0x10]
xor byte [esi], al
inc esi
dec edi
jne 0x1000b27e
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x1000bcad
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x1000c96c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [edx + 4]
push ebp
push esi
mov esi, ecx
mov ecx, dword [edx]
mov ebp, dword [esi + 4]
add ebx, dword [esi]
add ebp, dword [edx + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [edx + 8]
lea eax, [esi + 8]
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x14
lea eax, [ebp*2 + 1]
imul eax, ebp
lea edi, [ebx*2 + 1]
imul edi, ebx
ror eax, 5
mov edx, eax
xor edx, ecx
ror edi, 5
mov ecx, edi
xor edi, esi
ror edx, cl
mov ecx, dword [esp + 0x10]
mov esi, ebx
add edx, dword [ecx + 4]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov ebx, edx
ror edi, cl
mov ecx, ebp
add edi, dword [eax]
add eax, 8
dec dword [esp + 0x18]
mov ebp, edi
mov dword [esp + 0x10], eax
jne 0x1000c9a0
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 0xa8]
add eax, dword [esp + 0x14]
mov dword [ecx + 0xc], edi
pop edi
mov dword [ecx], eax
mov eax, dword [esi + 0xac]
add eax, dword [esp + 0x14]
pop esi
pop ebp
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
pop ebx
add esp, 0x10
ret 4
Function at 0x1000ca23
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [edx + 0xc]
push ebp
mov ebp, dword [edx + 4]
push esi
mov esi, dword [edx]
sub esi, dword [ebx + 0xa8]
push edi
mov edi, dword [edx + 8]
sub edi, dword [ebx + 0xac]
mov dword [esp + 0x14], ecx
lea ecx, [ebx + 0xa0]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x18], 0x13
mov dword [esp + 0x10], ecx
mov eax, ebx
mov ebx, edi
mov edi, ebp
sub edi, dword [ecx + 4]
mov ebp, esi
mov esi, eax
lea edx, [ebp*2 + 1]
imul edx, ebp
lea eax, [ebx*2 + 1]
imul eax, ebx
ror edx, 5
mov ecx, edx
rol edi, cl
mov ecx, dword [esp + 0x10]
sub esi, dword [ecx]
ror eax, 5
mov ecx, eax
xor edi, eax
rol esi, cl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
sub ecx, 8
xor esi, edx
dec eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
test eax, eax
jns 0x1000ca61
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
sub ebp, dword [ebx]
sub ecx, dword [ebx + 4]
mov dword [eax + 8], edi
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
pop ebp
mov dword [eax + 0xc], ecx
pop ebx
add esp, 0x10
ret 4

Function at 0x1000cadc
Capabilities:
Encrypt data using rc6

Disassembly:
sub esp, 0x1d4
push ebx
push ebp
push esi
xor esi, esi
mov ebp, ecx
push edi
mov dword [esp + 0x18], ebp
mov ebx, esi
mov ecx, esi
mov edi, esi
movzx eax, byte [ecx + edx]
shl edi, 8
or edi, eax
inc ecx
test cl, 3
jne 0x1000cb0d
mov dword [esp + ebx*4 + 0xe4], edi
inc ebx
mov edi, esi
cmp ecx, 0x10
jb 0x1000caf4
xor ecx, ecx
push 0x2c
mov dword [esp + 0x20], 0xb7e15163
inc ecx
pop edx
mov eax, dword [esp + ecx*4 + 0x18]
sub eax, 0x61c88647
mov dword [esp + ecx*4 + 0x1c], eax
inc ecx
cmp ecx, edx
jb 0x1000cb20
cmp ebx, edx
mov edi, ebx
cmovb edi, edx
imul edi, edi, 3
mov eax, esi
mov dword [esp + 0x10], eax
mov ecx, esi
test edi, edi
je 0x1000cb9d
mov ebp, eax
mov edx, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0x10]
add edx, ebp
add edx, ecx
ror edx, 3
mov dword [esp + eax*4 + 0x1c], edx
lea ecx, [edx + ebp]
add ebp, dword [esp + esi*4 + 0xe4]
mov dword [esp + 0x14], edx
add ebp, edx
xor edx, edx
ror ebp, cl
inc eax
push 0x2c
pop ecx
div ecx
lea eax, [esi + 1]
mov ecx, dword [esp + 0x14]
mov dword [esp + esi*4 + 0xe4], ebp
mov dword [esp + 0x10], edx
xor edx, edx
div ebx
mov eax, dword [esp + 0x10]
mov esi, edx
dec edi
jne 0x1000cb4a
mov ebp, dword [esp + 0x18]
push 0x2c
pop edx
mov edi, ebp
mov ecx, edx
lea esi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d4
ret
Function at 0x6919ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebx
mov dword [esp], ecx
call fcn.006919f1

Function at 0x6919f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edx
jmp 0x6919fa
pushfd
mov word [esp], ax
lea esp, [esp]
mov dword [esp], esi
mov dword [esp], edx
mov dword [esp], ebx
jmp 0x691a2d
pushal
mov dword [esp + 6], ebx
mov word [esp + 0xf], si
mov dword [esp + 0x1c], esp
call fcn.00691a17

Function at 0x691a17
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf06833cc
jmp 0x691aa6
mov byte [esp], al
push word [esp + 1]
jmp 0x691a40
jo 0x691a56
lea esp, [esp + 2]
mov dword [esp + 0x1c], ebp
jmp 0x691a5e
lea esp, [esp + 2]
mov dword [esp + 0x1c], ebp
call fcn.00691a8a
mov dword [esp + 0x1c], esi
push ax
pushal
pop dword [esp + 0xf]
mov word [esp + 9], bp
lea esp, [esp + 2]
jmp 0x691ac6
lea ecx, [ecx*4]
jmp 0x691aaf
not cx
mov cx, 0x69ef
jmp 0x691a90
mov ebp, dword [esp + 0x2c]
lea edi, [ecx - 0xcc]
not cl
xchg dh, al
jmp 0x691aea
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
pushfd
jmp 0x6919d9
jmp 0x691b0c
lea edi, [esp]
mov esi, dword [esp]
adc esi, ebx
jbe 0x691ad4
ja 0x691ad4
sub esp, 0xc0
mov esi, esp
mov cl, 0x1d
cpuid
xchg bh, al
jmp 0x691af6

Function at 0x695c66
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [esi*4]
lea eax, [edx*4]
jmp 0x6953e6
Function at 0x6b896f
Capabilities:
Encrypt data using aes

Disassembly:
mov ch, dh
mov dx, 0x2a9a
mov ecx, dword [esp]
stc
jmp 0x6b8c69
btr bp, si
xor edx, esi
jmp 0x6b89a3
shl edx, 8
xor edx, esi
mov di, word [esp]
jmp 0x6b8b20
movzx esi, byte [eax + 0xe]
lea edi, [edi*4]
movzx eax, byte [eax + 0xf]
lea ebx, [eax + ecx]
mov bh, byte [esp]
jmp 0x6b8977
and eax, esi
setno bh
push ecx
jmp 0x6b8a5f
add esi, 0xb922422c
lea ebp, reloc.WINMM.dll_midiOutPrepareHeader
btc di, cx
mov di, 0xb8ac
push eax
jmp 0x6b89e6
mov bl, 0xf9
shr eax, 0x10
xchg ebx, esi
mov esi, 0x46ddbed3
jmp 0x6b8a03
bswap ebx
setle bh
neg bx
lea esp, [esp + 0x38]
xor eax, 0x1000000
jmp 0x6b8a73
mov ecx, eax
lea ecx, [ecx*4]
lea ecx, reloc.WINMM.dll_midiOutPrepareHeader
mov eax, dword [ecx]
pop ecx
jmp 0x6b8a3d
mov bh, cl
lea ebp, reloc.WINMM.dll_midiOutPrepareHeader
mov edi, edx
shr edi, 8
jmp 0x6b8aea
mov edi, dword [edi*4 + reloc.WINMM.dll_midiOutPrepareHeader]
lea ebp, [ebx*4]
jmp 0x6b8abb
mov dword [ecx + 0xc], edx
pushal
mov dword [esp + 0x1c], edx
popal
jmp 0x6b8a2f
stc
not bp
jmp 0x6b8ad1
lea ebp, [ebp*4]
bswap ebx
mov ebx, dword [esp]
and edi, 0xff0000
bswap ebx
jmp 0x6b8aa5
push esi
mov esi, ecx
add esi, 4
jmp 0x6b8af6
mov bl, byte [esp]
neg bx
mov bl, 0x1b
and edi, esi
jmp 0x6b8a82
mov ebx, dword [esi]
pop esi
shl ebp, cl
and eax, 0xff000000
clc
jmp 0x6b8b07
xor eax, edi
mov ebp, dword [esp]
mov edi, ecx
jmp 0x6b8b47
shl edx, 8
mov bx, 0xf63a
xor edx, eax
bsf ebp, ebp
jmp 0x6b8a9a
lea ebp, [eax*4]
lea esp, [esp + 3]
jmp 0x6b8b54
pushal
mov dword [esp], edx
popal
sub esp, 0xb
lea ebp, [eax + esi]
jmp 0x6b8b31
shr edi, 0x18
mov bp, word [esp]
rcr bp, cl
movzx edi, byte [edi*4 + 0x68f3d4]
jmp 0x6b8ba3
sub esp, 0x15
mov word [esp + 0xe], dx
lea esp, [esp + 1]
jmp 0x6b8bc5
xor eax, edi
lea edi, [ecx + 0x18]
lea edi, [esi + esi]
mov edi, edx
jmp 0x6b8b8d
lea ebp, [edi*4]
sub esp, 0x14
jmp 0x6b8cd4
and edi, esi
bswap ebp
mov edi, dword [edi*4 + reloc.WINMM.dll_midiOutPrepareHeader]
neg ebp
jmp 0x6b8baf
mov word [esp], bx
call fcn.006b8bd4
mov dword [ecx + 0x14], ebx
add bl, ch
xchg bl, bh
mov dword [ecx + 0x18], eax
jmp 0x6b8c35
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
push dx
jmp 0x6b8bea
mov ebx, 0x690bd8
jmp 0x6b8c60
xor edx, eax
mov dword [ecx + 0x1c], edx
inc cx
jmp 0x6b8c1f
lea edi, [ecx + 0x10]
sub esp, 0xb
lea esp, [esp + 3]
xor ebx, eax
jmp 0x6b8c14
lea esp, [esp + 0xc]
jmp 0x684189
mov eax, edi
mov edx, dword [eax + 0xc]
xchg di, cx
call fcn.006b8ca8
push esp
int 0x5d
and al, 0xd7
adc eax, esi
pop esi
int3
xor eax, edi
lea esp, [esp + 0x44]
xor eax, dword [ecx]
jmp 0x6b8c52
mov ebp, 0xff00
sub esp, 0x17
lea esp, [esp + 3]
and edi, ebp
jmp 0x6b8c88

Function at 0x6b8e95
Capabilities:
Encrypt data using aes

Disassembly:
cmc
xor ecx, edi
mov edi, 0x3717e984
mov edi, edx
jmp 0x6b8d2d
sub esp, 6
push dword [esp + 3]
lea esp, [esp + 2]
lea esp, [esp + 0xc]
and edi, 0xff000000
jmp 0x6b8d51
add esp, 3
lea esp, [esp + 1]
lea esp, [esp + 0x30]
and ecx, 0xff0000
push edx
jmp 0x6b8d91
clc
mov edi, dword [edi*4 + reloc.WINMM.dll_midiOutPrepareHeader]
push ebp
jmp 0x6b8e07
Function at 0x6bc55b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
jne 0x6bc28b
mov bh, dl
jmp 0x6bc583
mov bx, ax
bswap ebx
pushal
lea esp, [esp + 0x20]
pop ebx
jmp 0x6851cf

Function at 0x77a974
Capabilities:
Parse pe header

Disassembly:
call fcn.0077a024
jmp 0x77a9b5
lea esp, [esp + 3]
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
mov eax, dword fs:[0x30]
jmp 0x77a9fb
lea esp, [esp + 3]
mov byte [esp + 3], dl
mov byte [esp + 1], ch
push word [esp]
jmp 0x77a976
mov eax, dword [eax + 8]
jmp 0x77aa1b
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x77a9e5
push eax
jmp 0x77a01f
Function at 0x407140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45ff42
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x38]
mov ecx, esi
call dword [sym.imp.K8UIRender.dll_public:_void___thiscall_GameMgr::GMWindowImplBase::constructor_void_]
test edi, edi
mov dword [esp + 0x30], 0
mov dword [esi], vtable.GameMgr::GMBossKeyDlg.0
mov dword [esi + 0x20], vtable.GameMgr::GMBossKeyDlg.1.0
mov dword [esi + 0x210], edi
je 0x40719f
lea ecx, [edi + 4]
call dword [sym.imp.K8UIRender.dll_public:_struct_HWND______thiscall_GameMgr::GMWindowWnd::GetHWND_void_const]
mov edi, eax
jmp 0x4071a1
xor edi, edi
lea eax, [esp + 0xc]
push 0x467
push eax
call dword [sym.imp.K8UIRender.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_GameMgr::LoadStr_unsigned_int_]
add esp, 8
mov byte [esp + 0x30], 1
cmp dword [eax + 0x18], 8
jb 0x4071c4
mov eax, dword [eax + 4]
jmp 0x4071c7
add eax, 4
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 1
push 0x86c00000
push eax
push edi
mov ecx, esi
call dword [sym.imp.K8UIRender.dll_public:_struct_HWND______thiscall_GameMgr::GMWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4
Function at 0x408f80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45f90c
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esi + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
xor ebx, ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x36], bl
mov byte [esi + 0x37], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4