joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4647cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], vtable.CArray_class_CTaskField__class_CTaskField_.0
mov dword [esi + 4], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 8], ebp
lea ebx, [esi + 0x1c]
mov ecx, ebx
mov dword [esp + 0x30], ebp
call fcn.00421fb0
push 0x20
mov byte [esp + 0x34], 1
call fcn.00429d46
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebp
mov byte [esp + 0x30], 2
je 0x4242e9
mov ecx, eax
call fcn.004226c0
jmp 0x4242eb
xor eax, eax
mov ecx, eax
mov byte [esp + 0x30], 1
mov dword [esi + 0x14], eax
call fcn.00422990
mov ecx, esi
call fcn.004248f0
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.004239e0
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov byte [esp + 0x34], 3
call fcn.00421e20
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00421ba0
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 8]
cmp eax, ebp
jle 0x42439d
xor ebx, ebx
nop
test ebx, ebx
jl 0x4243b4
cmp ebp, eax
jge 0x4243b4
mov eax, dword [edi + 4]
add eax, ebx
push eax
lea ecx, [esp + 0x1c]
call fcn.00428f40
mov edx, dword [esi + 8]
sub esp, 0x10
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x44], 4
mov dword [esp + 0x4c], edx
call fcn.00428f40
mov ecx, dword [esp + 0x48]
push ecx
mov ecx, esi
call fcn.004247d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00426980
mov eax, dword [edi + 8]
add ebp, 1
add ebx, 0x10
cmp ebp, eax
jl 0x424340
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4
call fcn.0042b3b4
int3
Function at 0x426850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x464c58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 8]
sub esp, 0x28
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov dword [esp + 0x40], 0
call fcn.00424280
push edi
mov ecx, esi
call fcn.004266d0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00423af0
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x28
Function at 0x428d60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x465033
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
lea eax, [esp + 0x40]
mov ebx, 1
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], ebx
call fcn.00421d90
push 0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x46c134
mov byte [esp + 0x48], 2
call fcn.00421e50
lea ecx, [esp + 0x24]
call fcn.00421cf0
push 0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x46c138
mov edi, eax
call fcn.00421e50
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 3
call fcn.00421b90
sub eax, ebx
push eax
push 2
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x30]
call fcn.00422140
mov byte [esp + 0x44], 4
mov ecx, eax
mov byte [esp + 0x44], 5
call fcn.00421cf0
lea ecx, [esp + 0x20]
mov esi, eax
mov byte [esp + 0x34], 2
call fcn.00421ba0
add esi, ebx
cmp edi, ebx
jl 0x428e38
cmp esi, ebx
jl 0x428e38
sub esi, edi
sub esi, ebx
push esi
mov esi, dword [esp + 0x40]
add edi, ebx
push edi
push esi
lea ecx, [esp + 0x20]
call fcn.00422140
jmp 0x428e48
mov esi, dword [esp + 0x3c]
push 0x468780
mov ecx, esi
call fcn.00421e50
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x34], bl
call fcn.00421ba0
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 0
call fcn.00421ba0
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret

Function at 0x429910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4652b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
push edi
mov esi, ecx
push 0x46c2d8
lea ecx, [esp + 0x10]
call fcn.00421e50
lea eax, [esp + 0x24]
push 6
push eax
mov dword [esp + 0x4c], 0
call fcn.00421190
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x50], 1
call fcn.00429490
lea edi, [esi + 0xcc]
push eax
mov ecx, edi
mov byte [esp + 0x48], 2
call fcn.00421e20
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 1
call fcn.00421ba0
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 0
call fcn.00421ba0
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
call fcn.00421ba0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x14], esp
push edi
call fcn.00421d90
lea eax, [esp + 0x3c]
push eax
call fcn.00404af0
add esp, 0x10
push eax
mov ecx, edi
mov dword [esp + 0x48], 3
call fcn.00421e20
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 0xffffffff
call fcn.00421ba0
mov ecx, dword [esp + 0x4c]
push ecx
push 0x85
mov ecx, esi
mov byte [esi + 0x10c], 0
call fcn.0042a727
mov ecx, dword [esp + 0x3c]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x40
ret 4
Function at 0x42a727
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x42a747
cmp dword [edi + 0x54], 0
jne 0x42a747
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00435f5a
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0042a6ee
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x42fdd5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x42fe0e
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0042fd98
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0042ebab
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x43182c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x43186f
call fcn.00435f5a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43186f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43188a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004313e3
test ebx, ebx
mov esi, eax
je 0x431888
test edi, edi
je 0x431888
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x434cb4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x434cfa
call fcn.00435f5a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x434cfa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x434d3d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x434d26
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x434d26
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x434d3a
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x439c5b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x439c89
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x439ca7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00439bc5
jmp 0x439ca7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x439ca7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00439bc5
test edi, edi
mov eax, edi
jne 0x439c91
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x494378]
test ecx, ecx
je 0x439d6a
jmp 0x439c5a
ret 8

Function at 0x449d8c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x485934]
jne 0x449d96
repz ret
jmp fcn.00456e8b
Function at 0x45b553
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0044dff6
xor ebx, ebx
cmp dword [0x495200], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x45b628
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x45b593
xor eax, eax
jmp 0x45b6ec
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4743b8
push edi
call esi
cmp eax, ebx
je 0x45b58c
push eax
call fcn.0044df93
mov dword [esp], 0x4743a8
push edi
mov dword [0x495200], eax
call esi
push eax
call fcn.0044df93
mov dword [esp], 0x474394
push edi
mov dword [0x495204], eax
call esi
push eax
call fcn.0044df93
mov dword [0x495208], eax
lea eax, [ebp - 8]
push eax
call fcn.0044bb5d
test eax, eax
pop ecx
pop ecx
je 0x45b5f6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044e5b6
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x45b628
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0044df93
cmp eax, ebx
pop ecx
mov dword [0x495210], eax
je 0x45b628
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044df93
pop ecx
mov dword [0x49520c], eax
mov eax, dword [0x49520c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x45b6a1
cmp dword [0x495210], esi
je 0x45b6a1
push eax
call fcn.0044dfff
pop ecx
call eax
cmp eax, ebx
je 0x45b66e
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x495210]
call fcn.0044dfff
pop ecx
call eax
test eax, eax
je 0x45b66e
test byte [ebp - 0x18], 1
jne 0x45b6a1
lea eax, [ebp - 0xc]
push eax
call fcn.0044bb94
test eax, eax
pop ecx
je 0x45b689
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044e5b6
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x45b698
or dword [ebp + 0x10], 0x200000
jmp 0x45b6d2
or dword [ebp + 0x10], 0x40000
jmp 0x45b6d2
mov eax, dword [0x495204]
cmp eax, esi
je 0x45b6d2
push eax
call fcn.0044dfff
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x45b6d2
mov eax, dword [0x495208]
cmp eax, esi
je 0x45b6d2
push dword [ebp - 4]
push eax
call fcn.0044dfff
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x495200]
call fcn.0044dfff
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4600a6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x485934]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0046003b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00446e00
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4600f5
cmp dword [ebp - 0x1c], 5
jb 0x46010d
jmp 0x460109
cmp dword [ebp - 0x10], 1
jne 0x46010d
cmp dword [ebp - 0x1c], 4
ja 0x460109
jne 0x46010d
cmp dword [ebp - 0x18], 0
jbe 0x46010d
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x474d84
call fcn.0045ff2c
test eax, eax
jge 0x46012e
mov byte [0x4927ec], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00449d8c
add ebp, 0x78
leave
ret
Function at 0x55c1b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x55b21d
push 0
jmp 0x55b25a
movzx ebx, byte [eax]
jmp 0x55b246
pop ecx
sub ecx, 0x10014764
mov dword [ecx + reloc.WINMM.dll_midiStreamOut], eax
jmp 0x55b17a
add ebx, 0x268c0383
cmp ebx, 0x268c044f
je 0x55b2b0
jne 0x55abb6
call 0x55b25f
jmp 0x55c199
call 0x55b290
jmp 0x55c20d
mov dword [esp + 0x24], eax
jmp 0x55c0fe
sbb bl, 0x64
je 0x55b329
pop esp
invalid
popal
inc dword [esp + 8]
call 0x55c273
loop 0x55c17e
mov eax, dword [reloc.WINMM.dll_midiStreamOut]
mov bl, 0xaa
pop eax
sub eax, 0x2eeb7cf1
call dword [eax + 0x2ee9ac08]
jmp 0x55c1c4
call 0x55c1b8
push edx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x55c219
dec ebx
jns 0x55c1b8
jmp 0x55c225
test eax, eax
jmp 0x55c2a1
mov dword [ecx + reloc.WINMM.dll_midiStreamOut], eax
movzx ebx, byte [eax]
add ebx, 0xfd102245
jmp 0x55c230
pop ecx
sub ecx, 0x10014e70
jmp 0x55c1ee
aaa
ret 0x27d
push eax
call fcn.0054b90a
jmp 0x55b28b
cmp ebx, 0xfd102311
adc ch, bh
je 0x55c294
jne 0x55b29d
mov ch, 0x3b
stosd dword es:[edi], eax
into
cmp eax, 0xb21c9d8c
aad 0x24
loope 0x55c234
or byte [ebx - 0x3c62823e], ch
test dword [edx - 0x73], edx
and al, 1
je 0x55b160
jne 0x55c1a7

Function at 0x5687e4
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x568a17
dec dword [ebp - 0x10]
jmp fcn.0056618d
lea esp, [esp + 8]
jbe fcn.0056618d
ja 0x5689fe
pop edi
rol byte [eax + 0x27], cl
shr byte [ebx + eax*8 + 0x57], cl
invalid

Function at 0x667b82
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, bh
pop ax
pushal
jmp 0x667bc9
lea esp, [esp + 0x43]
neg si
btr esi, edx
bsr cx, bp
xchg bp, dx
jmp 0x667c36
lea ebx, [eax + 0x91]
mov al, ah
rcl bx, cl
sub esp, 4
xchg dh, al
neg ebx
jmp 0x667c5d
mov al, 0x1e
xchg di, cx
rdtsc
call fcn.00667c46
jge 0x667c10
insb byte es:[edi], dx
or eax, dword [esi]
loopne 0x667c66
salc
inc ecx
ret
mov si, word [esp]
lea eax, [ecx - 0x9b]
rdtsc
clc
cpuid
lea ebp, [ebx + edi]
jmp 0x667bf0
btr edi, esp
not ax
mov bl, bh
mov dl, 0x24
sub bl, ah
rdtsc
jmp 0x667c1b
push dword [esp]
add esp, 5
btc ebp, edi
bsf si, ax
mov edx, esi
jmp 0x667c04

Function at 0x667c85
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov dl, 4
jmp 0x667cd4
xchg word [esp + 4], di
mov word [esp + 2], dx
pushal
mov bp, sp
mov word [esp + 0xc], bx
xchg word [esp + 0xf], bp
jmp 0x667cab
Function at 0x667e8e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, sp
mov bx, word [esp + 4]
rdtsc
mov word [esp + 4], di
setne dh
mov si, 0x7d03
jmp 0x667e9e
mov ebp, 0x980d0592
inc ecx
xchg word [esp + 7], ax
xchg si, bx
jmp 0x667e69
rol bp, cl
mov dl, dh
xchg word [esp + 1], di
pop word [esp + 0xb]
add esp, 5
push word [esp + 8]
jmp 0x667f0c
push edx
not ah
lea ecx, [edx*4]
push edx
not ch
pop si
jmp 0x667f48
sub esi, eax
xchg dword [esp + 5], ecx
btc eax, edi
xchg byte [esp], al
setp bh
lea ebx, [ebx*4]
jmp 0x667ef3
lea ebx, [ecx*4]
mov bx, word [esp]
lea eax, [esi - 0x2d]
mov esi, eax
btc edi, edi
xchg byte [esp], al
jmp 0x667f95
mov bx, word [esp + 0xe]
cmc
lea esp, [esp + 0x10]
add esp, 3
jmp 0x667f24
mov word [esp], sp
call fcn.00667fe7
pop ebp
iretd
lea esi, [eax + edi]
bsf cx, si
mov si, 0x67cd
rdtsc
mov word [esp], bx
bsr ax, cx
jmp 0x667f7a

Function at 0x667fe7
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebx
bswap ebp
sub esp, 0xe
mov byte [esp + 6], ah
mov dword [esp + 0xf], esi
lea edi, [ecx*4]
jmp 0x668eb5
mov esi, 0x7a82e370
btr edx, edx
lea edi, reloc.WINMM.dll_midiStreamOut
xchg byte [esp + 4], cl
jmp 0x667fc4
xchg word [esp], dx
bswap ebx
bswap esi
rdtsc
inc cl
rdtsc
jmp 0x6680ab
mov word [esp], bx
xchg byte [esp], bl
bswap esi
setae bh
inc bl
inc eax
jmp 0x667ffb
mov byte [esp + 2], bh
add esp, 0x15
push word [esp + 3]
xchg word [esp + 1], si
pop word [esp + 1]
pop edi
jmp 0x668017
xchg ecx, ebx
inc edi
btc ecx, edi
call fcn.0066804e
push edi
dec ecx
dec esi
dec ebp
dec ebp
insb byte es:[edi], dx
insb byte es:[edi], dx
add ch, cl
pop esp
neg eax
cpuid
mov edx, 0x742e6478
mov ebp, esi
mov byte [esp], dh
mov byte [esp], ah
jmp 0x66807a
lea esp, [esp + 2]
add esp, 0
mov eax, 0x84831892
lea edi, [edi*4]
bswap edi
inc bp
jmp 0x668091
push dword [esp]
mov ax, sp
mov byte [esp + 0xf], ch
mov ebx, eax
mov byte [esp + 3], bh
sub esp, 0
jmp 0x668035
mov ah, byte [esp + 0x11]
lea eax, [esp + ebx]
mov bp, word [esp + 0x14]
lea edi, [edi*4]
mov cl, 0x1a
mov edi, ebp
jmp 0x6681b1
push dword [esp + 0xa]
mov bp, sp
cld
xchg dword [esp], edx
inc ebx
rdtsc
jmp 0x6685a4
Function at 0x668433
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 2], ax
lea edx, reloc.WINMM.dll_midiStreamOut
cmc
mov si, word [esp + 1]
mov ebx, dword [esp + 2]
bswap ebx
pop ax
jmp 0x6683f5
setbe ah
inc al
jmp 0x66840b

Function at 0x66a9a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf dx, si
not esi
mov edx, esi
pop bp
rdtsc
xchg si, bp
jmp 0x66a98c
lea eax, [esp + ebx]
btr edx, esp
setbe dh
and bp, 0xa172
jmp 0x66a9a9
mov si, word [esp + 2]
jmp 0x66a977
lea edx, [eax + 0x41]
mov si, 0xf5a9
pop edx
cld
xchg byte [esp], bl
cpuid
jmp 0x66a9bd
btc edi, ebx
mov di, 0xece1
not edx
xchg ah, bl
cpuid
sub esp, 0xc
jmp 0x66a9e6

Function at 0x66ac30
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [ecx + 0x63]
lea edi, [ecx*4]
xchg esi, ebp
xchg dx, ax
clc
setno bh
jmp 0x66ac3e
xchg word [esp], si
push dword [esp + 2]
push dword [esp + 6]
jmp 0x66ac10
lea esp, [esp + 0xa]
not ch
xor ecx, esi
bswap ebx
xchg byte [esp], cl
xchg dh, al
jmp 0x66ace4
clc
mov cx, bx
lea ecx, [eax + edx]
mov byte [esp + 3], ch
xchg dx, cx
jmp 0x66acc7
lea ebp, [edi*4]
xchg byte [esp + 2], bl
mov ecx, dword [esp + 4]
xchg ebp, ebx
shl di, cl
lea edi, [esp + edx]
jmp 0x66ac7b
push word [esp + 2]
rcr edx, 0x1b
xchg ebp, eax
mov word [esp], di
btc ebx, ebx
neg edx
jmp 0x66ac92
push dword [esp + 3]
btr ebx, edx
add esp, 4
mov byte [esp + 3], ch
xchg di, bp
mov byte [esp + 1], bh
jmp 0x66ad26
and cx, 0xbdd2
sub esp, 0
mov dl, dh
mov bl, 0x28
mov edx, esi
lea esp, [esp]
jmp 0x66acb3
add esp, 0x27
mov si, word [esp + 8]
lea eax, [ebp - 0x17]
mov esi, ecx
push dword [esp + 5]
jmp 0x66ad50
pushal
rdtsc
mov byte [esp + 0x28], bh
mov dh, byte [esp + 0x1f]
xchg word [esp + 0x19], di
jmp 0x66acf7
add esp, 3
inc dl
sub esp, 0xe
rdtsc
mov bh, byte [esp + 0xb]
stc
jmp 0x66ad0e
cpuid
lea ecx, [esi + 0x65]
neg dx
push edx
xchg bx, bp
inc ax
jmp 0x66ad6a
lea edx, [ebx + esi]
xchg di, bp
lea edx, [esi*4]
mov bx, word [esp + 8]
xchg word [esp + 6], ax
cld
jmp 0x66ad37
shr eax, 0x1d
not ch
lea ebp, [esp + eax]
pop dword [esp + 4]
xchg word [esp + 8], bx
xchg dword [esp + 2], edi
jmp 0x66bc4f
mov dx, word [esp + 3]
add esp, 3
ror ebp, 0x1f
mov eax, ecx
setl ch
call fcn.0066bb91
cpuid
sub esp, 0
sub esp, 8
btc edi, edi
lea esp, [esp + 2]
popal
jmp 0x66bc38
mov di, 0xea7d
mov byte [esp], bh
lea ebx, [edx + esi]
mov si, word [esp]
lea ecx, reloc.WINMM.dll_midiStreamOut
jmp 0x66bf4b
mov si, word [esp]
xchg ebp, eax
mov cl, ch
rdtsc
mov ecx, dword [esp]
xchg byte [esp], bl
jmp 0x66bc1d
pop si
setnp ch
lea edi, [eax*4]
lea ebp, [edx + esi]
mov bp, word [esp + 2]
mov al, ah
jmp 0x66bbc9
lea edi, [ecx*4]
inc bl
bswap edx
mov di, word [esp]
add esp, 0
call fcn.0066bd3c
push dword [esp + 2]
btr edx, edx
mov word [esp + 1], dx
rol cx, cl
jmp 0x66bfc5
xchg dh, al
call fcn.0066bfe0
hlt
pop dword [esp + 3]
lea esp, [esp + 6]
xchg word [esp], bp
mov ax, word [esp]
push word [esp + 2]
mov edi, dword [esp + 4]
jmp 0x66bfae
Function at 0x66bd3c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bh, cl
mov edx, ecx
mov ch, byte [esp + 1]
lea edi, [ebx + ebp]
xchg bh, cl
neg dh
jmp 0x66bcfb
pop dword [esp + 0x10]
mov bp, 0x628d
mov byte [esp + 0x1d], ah
pop esi
lea esp, [esp + 0x17]
mov ah, byte [esp + 1]
jmp 0x66bc6a
mov byte [esp + 1], dh
xchg ch, dl
xchg word [esp], bx
pushal
rdtsc
mov bh, byte [esp + 0x11]
jmp 0x66bc8b
mov al, 0xd6
xchg dh, al
btr edi, edx
xchg byte [esp], dl
sub esp, 0x18
xchg edx, ecx
jmp 0x66bd24
lea ecx, [esi - 0xb5]
xchg dx, si
rdtsc
xor dl, ch
pop bx
xchg cx, bx
jmp 0x66bcbd
push edx
mov word [esp], sp
rdtsc
not ah
shr ch, 5
mov dx, 0x7ea1
jmp 0x66bcdb
mov al, 0x8e
push word [esp + 0x11]
mov cl, ch
bswap ecx
bswap edi
mov cx, di
jmp 0x66bdf1
lea edi, [esi*4]
add esp, 9
cld
mov edx, eax
lea esi, [edx + edi]
jmp 0x66bd0d
pop bx
jmp 0x66bcaa
mov ax, word [esp + 0xd]
add ebx, ebp
lea edi, [eax - 0xc9]
push word [esp + 2]
jmp 0x66bdd9
rdtsc
mov dword [esp + 4], ecx
bswap eax
pop dx
btc esi, ebx
not ecx
jmp 0x66bd43
lea ebp, [esp + eax]
push dword [esp + 8]
lea ecx, [eax + edx]
pop di
xchg dh, al
mov word [esp], dx
jmp 0x66bd5b
mov dx, 0xe341
sub esp, 0x1e
setg ch
pop word [esp + 0x1b]
call fcn.0066bf34
mov dl, 0x35
movsd dword es:[edi], dword [esi]
int3
bsf bp, ax
xchg ah, bl
lea esp, [esp + 2]
mov ebx, esi
lea ebx, reloc.WINMM.dll_midiStreamOut
bsf ax, si
jmp 0x66bd86
pop bp
neg ecx
add esp, 0
lea esp, [esp + 0xc]
push word [esp]
pop ecx
jmp 0x66bda1
xchg dx, ax
bswap edx
mov cl, 0x32
xchg byte [esp + 2], dl
push edx
neg ch
jmp 0x66bdbf
bsr di, bp
xchg dword [esp], ecx
sub esp, 0x12
mov esi, 0x3a4135dc
lea esp, [esp + 0x18]
neg bh
jmp 0x66bd72

Function at 0x66c042
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, esi
stc
jmp 0x66c05d
pop dword [esp + 2]
xchg word [esp + 1], ax
lea esp, [esp + 0xa]
mov ebp, ecx
push esp
pop esi
jmp 0x66c0b9

Function at 0x66c4d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, 0x963f
xchg word [esp], dx
ror ch, 5
cpuid
xchg ah, bl
neg edx
jmp 0x66c4ed
pop edx
push dword [esp + 9]
mov dword [esp], eax
cpuid
xchg edx, edi
mov bp, di
jmp 0x66c476
sub esp, 0x18
mov bp, 0xc541
lea esp, [esp + 0xf]
lea ebx, [ebp*4]
mov di, sp
pop ebx
jmp 0x66c48d
btr ecx, edx
jmp 0x66c4a7
lea eax, [esi - 0x35]
push word [esp + 1]
mov ebp, 0xcf9ec8f0
xchg dword [esp + 3], eax
jmp 0x66c501
xchg ecx, ebp
rdtsc
lea esi, [eax - 0xb9]
mov edi, esi
push dword [esp + 2]
pop ax
jmp 0x66c4d5
rol bx, cl
lea edx, [ebx + esi]
xchg di, cx
lea ebx, reloc.WINMM.dll_midiStreamOut
xchg bp, ax
jmp 0x66c52d

Function at 0x66c66e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 3]
sub esp, 0xc
pop dword [esp + 6]
cmc
xchg word [esp + 7], dx
jmp 0x66c676
mov cl, 0x52
push edx
add esp, 5
jmp 0x66c655
push word [esp + 7]
add esp, 0xe
mov ecx, dword [esp + 1]
bsf bp, si
mov word [esp + 2], bx
jmp 0x66c6cf
mov bp, di
bswap ecx
mov dword [esp], ecx
mov dword [esp], esi
rdtsc
lea esp, [esp + 3]
jmp 0x66c6a5