joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42349b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4234bf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4234da
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x428116
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42814e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00426477
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0042644f
jmp 0x42815a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x429cea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x429d2c
call fcn.0043c1fd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x429d2c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x429d23
xor eax, eax
jmp 0x429d34
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00429d3a
pop edi
pop esi
pop ebx
ret 4

Function at 0x42bdb2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x42bdd4
cmp dword [edi + 0x3c], 0
jne 0x42bdd4
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0043c1fd
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0042be01
pop edi
pop esi
pop ebx
ret 8

Function at 0x42be4f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.0043c1fd
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42be80
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0042be93
pop edi
pop esi
pop ebx
ret 8
Function at 0x42c185
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4459f0
call fcn.00412bfc
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0043c1fd
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x42c1c4
call fcn.0043c1fd
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42c1d2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42c1e0
or eax, 0xffffffff
jmp 0x42c2c8
mov ecx, esi
call fcn.0042c0fb
mov dword [ebp - 0x14], eax
call fcn.00427c65
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x42c217
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x42c217
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.00427c19
push dword [ebp - 0x14]
call fcn.0042774b
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0042be93
cmp eax, edi
je 0x42c28a
test byte [esi + 0x24], 0x10
je 0x42c258
push 4
mov ecx, esi
pop ebx
call fcn.0042a57b
test ah, 1
je 0x42c250
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.00429f41
cmp dword [esi + 0x1c], edi
je 0x42c28a
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0042a6ec
jmp 0x42c28a
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x42c29e
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x42c2b7
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x42c2b7
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0042c135
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x43ccb4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.0043c1fd
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43ccf1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43ccf1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x43ccf5
xor eax, eax
jmp 0x43cd73
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.00425d85
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x43cd2d
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x43cd17
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.0043ce64
push ebx
mov edi, eax
call fcn.00425dae
test edi, edi
pop ecx
je 0x43cd6f
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.0043cc2d
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0043cd78
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x43d409
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43d437
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43d455
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043d36f
jmp 0x43d455
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43d455
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0043d36f
test edi, edi
mov eax, edi
jne 0x43d43f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x194e6ba
Capabilities:
Encrypt data using aes

Disassembly:
mov dl, byte [esp]
jmp 0x1920fee
mov edi, dword [esp]
jmp 0x194e6ee
lea esp, [esp + 4]
mov ecx, 0xff
jmp 0x1920fe5

Function at 0x194e98e
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
lea esp, [esp]
mov byte [esp], ah
lea esp, [esp + 1]
jmp 0x194e9e7
push edi
pushal
mov dword [esp], ebx
popal
jmp 0x194eae4
lea edi, [edi*4]
lea edi, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [edi]
pop edi
sub esp, 0xa
call fcn.0194ea2d
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov di, 0xf367
lea edi, reloc.WINMM.dll_midiStreamOut
jmp 0x194eb27
mov di, 0xcd95
mov edi, edx
call fcn.0194ebf8
shr edi, 0x18
sub esp, 0x1e
pop word [esp + 0x17]
sub esp, 0x18
jmp 0x194ebb9
pushal
lea esp, [esp + 0x20]
movzx ebx, byte [esi + 0xa]
push ebp
jmp 0x194ebe0
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
and ebx, ecx
lea esp, [esp + 0x58]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x194eb72
push dword [esp + 2]
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
and edi, ecx
jmp 0x194eb91
lea esp, [esp + 0xc]
popal
jmp 0x194ec49
pushal
bswap esi
setno ch
mov dword [esp + 8], ebx
sub esp, 0xc
jmp 0x194ebc8
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [ebp]
pop ebp
call fcn.0194ec24
movzx ebx, byte [esi + 0xd]
stc
jmp 0x194ef30
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
btr edi, esp
lea edi, [ebx*4]
bt edi, edx
jmp 0x194ecba
lea esp, [esp + 0x4c]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
lea edx, [eax*4]
jmp 0x194ec8b
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
clc
mov edi, edx
sub esp, 0x16
jmp 0x194eccd
lea esp, [esp + 2]
jmp 0x194ed29
and edx, ecx
sub esp, 0x18
mov byte [esp + 0x12], dh
push word [esp + 0x11]
lea esp, [esp + 2]
jmp 0x194eca5
shr edi, 0x18
stc
call fcn.0194ed11
lea esp, [esp + 3]
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
push word [esp + 0x15]
lea esp, [esp + 2]
jmp 0x194ece6
and edx, ecx
stc
pushal
add esp, 0xb
push word [esp + 0xe]
jmp 0x194eeca
Function at 0x194ea05
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 0x10
cmc
jmp 0x194e83f
movzx ebx, byte [esi + 2]
stc
stc
jmp 0x194e7bb
and ebx, ecx
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
stc
jmp 0x194e7d7
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
movzx ebx, byte [esi + 5]
jmp 0x194e8b2
lea esp, [esp + 2]
jmp 0x194e802
and ebx, ecx
pushal
pop dword [esp + 8]
pop word [esp + 0x15]
mov byte [esp + 4], dh
jmp 0x194e828
lea edx, [edx*4]
lea edx, reloc.WINMM.dll_midiStreamOut
mov edi, dword [edx]
pop edx
jmp 0x194e7f2
lea esp, [esp + 2]
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
not dh
jmp 0x194e899
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
and edx, ecx
stc
sub esp, 0xa
jmp 0x194e868
mov edx, dword [esi + 4]
mov dword [esi], edi
mov edi, 0x85b2f22e
sub esp, 0x1e
jmp 0x194e915
and edx, ecx
push edx
sub esp, 6
clc
lea esp, [esp + 3]
lea esp, [esp + 3]
jmp 0x194e88a
and edi, ecx
sub esp, 0xe
stc
lea esp, [esp + 2]
jmp 0x194e9db
mov di, 0xb19f
bsr di, bp
mov edi, edx
call fcn.0194e8c3
lea esp, [esp + 1]
shr edi, 0x18
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
push edx
jmp 0x194e8cc
pop dword [esp + 0xc]
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
bsr di, cx
mov edi, dword [esp]
jmp 0x194e8e2
and edi, ecx
push edx
mov edx, edi
jmp 0x194e856
lea ecx, reloc.WINMM.dll_midiStreamOut
mov edi, dword [ecx]
pop ecx
call fcn.0194e9ad
out dx, al
jl 0x194e9f1
sbb esi, esi
dec eax
jg 0x194ea20
test byte [eax + 0x7f], 0x46
int1
push ecx
mov ecx, edi
lea ecx, [ecx*4]
jmp 0x194e9c4
add bl, bh
jb 0x194e9d5
xchg dword [edx - 0x40], esi
push dword [edi - 0x19]
xor byte [ecx - 0x31], 0xe7
push 0xaa6899fe
add eax, 0x541aec83
sub esp, 0x1a
push esp
sub esp, 0x1a
push esp
push dword [esp + 0x12]
lea esp, [esp + 2]
jmp 0x194e940
and al, 2
jmp 0x194ea7f
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
movzx ebx, byte [esi + 9]
clc
call fcn.0194ea47
push eax
invalid
and ebx, ecx
cmc
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x194ea5e

Function at 0x194ebf8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [esp + 1], dh
push dword [esp]
jmp 0x194eb32

Function at 0x194ec24
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 0
lea esp, [esp + 3]
and ebx, ecx
pushal
push word [esp + 0x1b]
jmp 0x194ec2a
lea esp, [esp + 1]
jmp 0x194ec04
sub esp, 0x16
push esp
lea esp, [esp + 0x3c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x194ec5f

Function at 0x194ed11
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
call fcn.0194ee7b
in eax, dx
invalid
mov word [esp], sp
add esp, 1
lea esp, [esp + 3]
jmp 0x194ecfa
Function at 0x194ed32
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x14
call 0x194ed3b
in al, dx
jmp 0x194edc0
push esp
and edx, ecx
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x194eda4
and edx, ecx
call fcn.0194ee2e
or byte [edi + 0x18996a0f], bl
invalid
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x194ed8d
mov word [esp + 0xe], bx
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
mov byte [esp + 0x1b], dh
mov word [esp + 6], dx
jmp 0x194ed40

Function at 0x194ed3b
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x14
call 0x194ed3b
in al, dx
jmp 0x194edc0
push esp
and edx, ecx
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x194eda4
and edx, ecx
call fcn.0194ee2e
or byte [edi + 0x18996a0f], bl
invalid
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x194ed8d
mov word [esp + 0xe], bx
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
mov byte [esp + 0x1b], dh
mov word [esp + 6], dx
jmp 0x194ed40

Function at 0x194eddb
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ecx
push word [esp + 1]
push word [esp + 3]
jmp 0x194ee02

Function at 0x194ee0b
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
dec dword [ebp - 4]
call fcn.0194eddb
mov dword [esi + 0xc], edi
call 0x194ee0b
test eax, 0x2474ff66
add dword [esi - 1], esp
je 0x194ee38
add edi, edi
je 0x194ee3c
push es
jmp 0x194ee5a
mov word [esp], dx
pop word [esp]
lea esp, [esp + 2]
and al, 2
jmp 0x194edf3
lea esp, [esp + 0x14]
jne 0x1920fe5
je 0x1920fac
dec ecx
salc
inc esp
and ebx, esi
insb byte es:[edi], dx
invalid

Function at 0x194ee2e
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
dec dword [ebp - 4]
call fcn.0194eddb
mov dword [esi + 0xc], edi
call 0x194ee0b
test eax, 0x2474ff66
add dword [esi - 1], esp
je 0x194ee38
add edi, edi
je 0x194ee3c
push es
jmp 0x194ee5a
mov word [esp], dx
pop word [esp]
lea esp, [esp + 2]
and al, 2
jmp 0x194edf3
lea esp, [esp + 0x14]
jne 0x1920fe5
je 0x1920fac
dec ecx
salc
inc esp
and ebx, esi
insb byte es:[edi], dx
invalid
Function at 0x1b73845
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xb
add esp, 0xd
rdtsc
pop word [esp + 2]
mov dl, dh
inc bp
jmp 0x1b738cd
sub esp, 0xc
mov ebx, esi
xchg ecx, esi
lea ecx, [esi*4]
mov dx, di
jmp 0x1b73811
btr ecx, esp
jmp 0x1b7382e
xchg edx, ebp
mov di, 0x82af
lea ebx, [esp + ebx]
mov dword [esp], eax
rdtsc
mov ecx, esi
jmp 0x1b738b4
lea ebp, [esi - 0x45]
inc ecx
bsf dx, ax
xor ax, 0x4fcc
clc
inc si
jmp 0x1b73875
mov cl, 0xa
ror edi, 0xd
mov dl, dh
bswap eax
rcr edx, 0x1d
xchg byte [esp], al
jmp 0x1b7388b
bswap edi
lea ebx, [ebp + 0x27]
xchg di, dx
mov dword [esp], ecx
bswap ecx
lea ebp, [eax + ebx]
jmp 0x1b73ab2
mov ax, sp
mov ax, 0x1c43
mov edi, eax
mov si, word [esp + 4]
neg bp
bswap esi
jmp 0x1b738a3
lea esp, [esp + 1]
mov ah, byte [esp + 1]
mov word [esp], sp
setne ah
jmp 0x1b7393f
mov dx, 0xf47f
mov dl, dh
cpuid
btc ebx, ebx
lea esp, [esp + 0x1c]
bsr di, bp
jmp 0x1b738e2
mov cx, 0xb9b9
cpuid
neg ebx
pop di
rdtsc
push word [esp + 0x17]
jmp 0x1b738fa
mov ebp, dword [esp + 1]
pop edi
xchg byte [esp], cl
xchg byte [esp], al
pushal
setno ch
jmp 0x1b73913
xor ax, 0xe41c
clc
lea edi, [ebp + 0xbf]
pop word [esp]
xchg bh, cl
jmp 0x1b73989
and bp, 0x609a
setg ah
lea esi, [eax - 0xb1]
cpuid
push esp
cpuid
jmp 0x1b7392e
mov al, ah
call fcn.01b7396c
mov dword [esp], ecx
sub esp, 0x18
mov al, ah
push dword [esp + 0x15]
mov bp, sp
pop esi
jmp 0x1b73a0e
xchg word [esp + 5], ax
lea ebp, [ebx*4]
mov dl, 0x74
jmp 0x1b739ef
add esp, 5
pop word [esp + 0xd]
mov dword [esp + 6], ebp
xchg byte [esp + 0xa], bl
mov ax, word [esp + 6]
pop word [esp + 0xc]
jmp 0x1b73a6b
push dword [esp + 8]
sub esp, 0
mov byte [esp + 0x15], dh
mov word [esp + 0xc], dx
rol ax, cl
sete ah
jmp 0x1b739cd
lea esp, [esp + 0xb]
btr eax, edx
mov ax, 0x71bb
xchg ch, dl
mov al, ah
inc ax
jmp 0x1b739a2
pop word [esp + 2]
xchg byte [esp + 2], al
mov dword [esp], esi
push dword [esp]
lea eax, [ecx + 0x8b]
lea esp, [esp + 1]
jmp 0x1b73a88
mov cx, word [esp + 6]
btc edx, edi
mov byte [esp + 5], bh
lea ebx, [edx*4]
rdtsc
jmp 0x1b73a21
pop word [esp + 4]
pop edi
mov si, word [esp + 3]
lea eax, [ebp*4]
lea ecx, [esi + 0xed]
not bp
jmp 0x1b73a4d
xchg byte [esp + 3], al
mov al, 0xe
mov ecx, dword [esp + 5]
lea ebp, [ecx + 0x83]
pop ebp
call fcn.01b73af4
dec esp
fmul dword [esi + 0x29]
fsubr dword [esi - 0x5e]
xor eax, 0x943fcca5
mov esp, 0x2ed3b426
nop
xlatb
bswap ebp
bswap ebp
rdtsc
mov byte [esp + 1], dh
cld
pop edx
xchg si, cx
jmp 0x1b73957
Function at 0x1b7413d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dl, ch
pop dword [esp + 0xf]
mov esi, dword [esp + 9]
mov al, 0x36
bsr bx, cx
jmp 0x1b74074
inc bl
pushal
not cx
lea edx, reloc.WINMM.dll_midiStreamOut
pop ebp
pop word [esp + 9]
jmp 0x1b73ffb
xchg ebp, edx
inc al
cld
xchg ch, dl
mov byte [esp], ah
lea esi, [esp + edi]
jmp 0x1b74012
mov esi, dword [esp + 7]
rdtsc
xchg dh, al
xchg cx, dx
mov di, word [esp + 9]
mov eax, dword [esp + 0x10]
jmp 0x1b740b5
cpuid
lea ecx, [eax*4]
setnp ah
mov cl, ch
mov bp, bx
jmp 0x1b7403a
pop word [esp + 0x11]
sete ch
xchg word [esp + 1], ax
xchg dword [esp + 8], esi
mov dx, word [esp + 0xf]
push word [esp + 8]
jmp 0x1b7405b
rdtsc
cpuid
neg ebp
xchg word [esp + 7], bp
cpuid
mov di, sp
jmp 0x1b740df
mov cl, 0x22
stc
mov al, ah
rdtsc
mov ebx, dword [esp + 1]
sub esp, 0x16
jmp 0x1b74091
popal
sub esp, 0xe
neg ah
rdtsc
mov word [esp], di
push dword [esp + 0x14]
jmp 0x1b74112
cld
xchg ebp, ebx
mov dword [esp + 9], esi
pop esi
not dx
btr ebp, esp
jmp 0x1b740c5
pop word [esp + 6]
lea eax, [esi + 0x6d]
add esp, 8
neg ax
bsr bp, cx
mov bx, 0x419f
jmp 0x1b7402b
mov si, word [esp + 0x15]
push word [esp + 0xa]
lea edx, [ecx*4]
mov byte [esp + 1], bh
lea eax, [edi*4]
pop dword [esp + 0x14]
jmp 0x1b741ae
pop dword [esp + 6]
jmp 0x1b740f7
pop word [esp + 1]
neg ebp
mov si, dx
mov cl, ch
jmp 0x1b74754
mov cl, 0x9a
mov cl, 0xa2
sub esp, 0x14
setnp dh
add esp, 0x25
jmp 0x1b74198
mov eax, 0x430e2726
lea edx, [edi*4]
xchg ecx, edx
lea ebp, [ecx*4]
pop esi
lea eax, [esi*4]
jmp 0x1b7440e

Function at 0x1b78152
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x15
mov ch, byte [esp]
mov byte [esp + 0xf], ch
sub bl, ah
bswap edi
inc al
jmp 0x1b781e2
xchg dword [esp], edi
xchg dword [esp + 0x1c], ebp
lea esi, [edx + edi]
mov al, 0x9e
pop word [esp + 0x23]
jmp 0x1b78128
mov dl, dh
shr dh, 7
mov al, ah
ror ebp, 5
mov ecx, eax
cld
jmp 0x1b781f5
pushal
rdtsc
setae ch
cpuid
xchg word [esp], di
xchg dword [esp + 0x11], ecx
jmp 0x1b78274
neg edx
lea edi, [eax*4]
bsr bp, cx
mov ebx, dword [esp]
bswap ebx
lea esp, [esp]
jmp 0x1b7819e
inc cl
xchg ecx, eax
mov si, di
lea esp, [esp + 0x15]
add esp, 1
lea esp, [esp]
jmp 0x1b781c3
mov di, 0x2c0f
mov dl, 0x84
mov ebp, dword [esp]
cpuid
mov byte [esp], dh
stc
jmp 0x1b781ad
mov edi, dword [esp]
bsf bp, si
cpuid
mov ecx, 0xaf475fe4
xchg di, bp
mov cl, 0xa2
jmp 0x1b7825b
lea esp, [esp + 0x47]
mov al, byte [esp]
lea ebx, [eax + 0xa9]
mov edx, dword [esp]
mov ecx, 0xf65788e6
mov dx, di
jmp 0x1b78222
bsr bp, bp
bswap edi
mov dl, dh
mov bl, 0x40
mov ebx, 0xc6b0a304
setg ah
jmp 0x1b782a2
rdtsc
mov bh, byte [esp + 0x15]
cld
neg dx
sub esp, 0xe
sub esp, 0x18
jmp 0x1b78241
mov cl, ch
mov si, 0xe707
xchg bp, bx
lea eax, [ecx + 0xa3]
lea edx, [eax - 0x89]
call fcn.01b78286
Function at 0x1b78605
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
rdtsc
pop word [esp]
mov bp, sp
jmp 0x1b7864c
mov word [esp], bx
rdtsc
push esp
add esp, 5
mov cx, 0x6a23
neg ax
jmp 0x1b786aa
push edx
sub ebp, eax
add esp, 1
call fcn.01b78684
outsb dx, byte [esi]
jmp 0x2a29ee9
xchg word [esp], bx
mov si, 0x7485
lea esi, reloc.WINMM.dll_midiStreamOut
add bp, 0x5ad6
inc di
pop bx
jmp 0x1b7865f

Function at 0x1b78abc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, reloc.WINMM.dll_midiStreamOut
neg ax
pop bp
mov dword [esp + 0xc], ebp
xchg byte [esp + 0xa], bl
jmp 0x1b78b65
ror esi, 0x1b
mov edi, 0xf66b18da
cpuid
xchg ah, bl
xchg byte [esp + 0xc], cl
jmp 0x1b78a88
setg ah
lea ebp, [eax + 0x51]
mov ecx, dword [esp + 2]
push dword [esp + 4]
jmp 0x1b78aa2
xchg byte [esp + 0x10], al
btc edx, ebx
pop word [esp + 5]
xchg byte [esp + 6], bl
xchg ebp, ebx
lea ecx, [ebp*4]
jmp 0x1b78b3d
xchg edx, ecx
inc bl
mov ch, byte [esp + 0x11]
mov byte [esp + 0x11], dh
lea esi, [ecx*4]
xchg ch, dl
jmp 0x1b78afa
bswap edx
xchg ecx, edx
mov cx, di
pop word [esp + 4]
add esp, 0xf
lea esp, [esp + 3]
jmp 0x1b78b7b
sub esp, 4
xchg word [esp + 8], ax
rdtsc
pop word [esp]
and edx, ecx
push dword [esp + 0xf]
jmp 0x1b78b26
xchg byte [esp], cl
add esp, 0
setbe ah
cpuid
bsr di, bp
mov edi, dword [esp]
jmp 0x1b78d3f
mov cl, ch
mov byte [esp], ah

Function at 0x1b78e38
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop word [esp + 0x11]
mov dword [esp + 3], ecx
mov word [esp + 4], di
pop word [esp + 0x11]
jmp 0x1b78ef3
pop word [esp + 0x19]
push word [esp + 0xb]
call fcn.01b78ebb
or dword [ebp + reloc.WINMM.dll_midiStreamOut], edx
test byte [esi], al
xchg esp, eax
push cs
fidiv dword [edi]
push ds
imul ecx, dword [eax + reloc.WINMM.dll_midiStreamOut], 0xf1ab24bd
int3

Function at 0x1b78e74
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 2]
jmp 0x1b78e7e
mov dword [esp + 0x74], ebp
pushal
mov dword [esp + 9], ebp
pop dword [esp + 2]
pop word [esp + 0x17]
pop word [esp + 0xf]
jmp 0x1b78ea2
mov byte [esp + 9], bh
lea esp, [esp + 0xb]
pop word [esp + 6]
mov dword [esp + 3], ebp
jmp 0x1b78ecd