joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448818
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x44883e
mov eax, esp
push eax
push 0x4487e0
call sub.user32.dll_EnumWindows
jmp 0x448851
mov eax, esp
push eax
push 0x4487c0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x4488dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x448930]
test si, 4
je 0x4488f1
or bl, 1
test si, 8
je 0x4488fb
or bl, 4
test si, 1
je 0x448905
or bl, 8
test si, 2
je 0x44890f
or bl, 0x10
test si, 0x10
je 0x448919
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x448928
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x448934
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x448970]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44894e
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44895d
or bl, 4
test esi, 0x20000000
je 0x448968
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4509dc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4509ee
add esp, 0xfffffff0
call fcn.00403eb0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a2ac
mov eax, dword [0x4597c8]
mov dword [eax + 4], ebx
mov dword [eax], 0x450d80
mov eax, dword [0x4597d4]
mov dword [eax + 4], ebx
mov dword [eax], 0x450d8c
mov eax, ebx
call fcn.00450d98
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41205c]
call fcn.00403b74
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41205c]
call fcn.00403b74
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41205c]
call fcn.00403b74
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41205c]
call fcn.00403b74
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41205c]
call fcn.00403b74
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44c240
push eax
push 0
push 0
mov eax, dword [0x459914]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41e02c]
call fcn.0041f54c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41e02c]
call fcn.0041f54c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41e02c]
call fcn.0041f54c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00451210
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4510e0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4510e0
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4510e0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x450b2b
call fcn.00403f08
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x450ec4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45106f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x451050
mov dl, 1
mov eax, dword [0x412480]
call fcn.00403b74
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004049b8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45103f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044265c
test al, al
je 0x451032
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x451080
lea eax, [ebp - 0x254]
call fcn.00409534
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x451032
xor eax, eax
push ebp
push 0x45102b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4510b8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x451014
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404c28
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x451014
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404c28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451032
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x450f35
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00416158
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451076
lea eax, [ebp - 0x260]
call fcn.004049b8
ret

Function at 0x4519e8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45ec94]
cmp byte [eax + 0xad], 0
jne 0x451a59
cmp dword [0x45ecb0], 0
jne 0x451a1a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4519a4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45ecb0], eax
cmp dword [0x45ecac], 0
jne 0x451a35
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45ecac], eax
cmp dword [0x45ecb4], 0
jne 0x451a59
push esp
push 0
push 0
push 0x451948
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45ecb4], eax
pop edx
ret
Function at 0x451c5c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x451c73
add esp, 0xfffffff0
call fcn.00403eb0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a2ac
mov eax, dword [0x459900]
cmp word [eax + 2], 0
jne 0x451c9b
mov eax, dword [0x459900]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045394c
mov eax, dword [0x4599a8]
cmp word [eax + 2], 0
jne 0x451cb5
mov eax, dword [0x4599a8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00453b58
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41205c]
call fcn.00403b74
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41205c]
call fcn.00403b74
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41205c]
call fcn.00403b74
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41e808]
call fcn.004246d4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x451e6c
mov eax, dword [0x45982c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00424aa8
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45422c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45982c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cc70
test eax, eax
je 0x451dbc
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408eec
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cca4
test eax, eax
je 0x451dd0
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404c28
mov byte [ebx + 0xd4], 0
push ebx
push 0x4533d8
call fcn.0041b428
mov dword [ebx + 0xc8], eax
mov eax, dword [0x459738]
cmp byte [eax], 0
jne 0x451e21
mov eax, ebx
call fcn.00451fb0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00454440
mov eax, ebx
call fcn.00454fa4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x451e61
call fcn.00403f08
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452230
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x4522cf
cmp dword [ebx + 0x94], 0
jne 0x4522c9
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4521b8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4522c9
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45228f
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4522c9
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414400
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45229e
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4524e8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x45ec94]
cmp dword [eax + 0x30], 0
je 0x452645
test bl, bl
jne 0x452596
cmp dword [esi + 0x9c], 0
jne 0x45258b
mov eax, esi
call fcn.00454e20
push eax
push 0x452414
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45255c
mov eax, dword [0x45ec94]
call fcn.00455410
test al, al
je 0x45255c
mov eax, dword [0x45ecb8]
call fcn.00405874
mov edi, eax
cmp edi, 0
jl 0x45255c
push 0
mov eax, dword [0x45ecb8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x452546
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45258b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414400
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45256b
inc dword [esi + 0x9c]
jmp 0x452645
cmp dword [esi + 0x9c], 0
jle 0x452645
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x452645
cmp dword [esi + 0x44], 0
je 0x4525f1
mov eax, dword [0x45ec94]
call fcn.00455410
test al, al
je 0x4525f1
mov eax, dword [0x45ecb8]
call fcn.00405874
mov edi, eax
cmp edi, 0
jl 0x4525f1
push 5
mov eax, dword [0x45ecb8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4525db
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x452620
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414400
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x452600
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x45ecb8
mov ecx, 1
mov edx, dword [0x4523f4]
call fcn.00405a28
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x45312c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x453196
mov eax, ebx
call fcn.00455410
test al, al
jne 0x453196
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404aa8
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x453183
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4531a3
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a0c
jmp 0x4531a3
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a0c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x454624
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x454692
mov eax, esi
call fcn.0043d494
test al, al
je 0x454692
mov eax, dword [ebx + 0x84]
call fcn.0043d198
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x454692
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x454686
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043d198
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043523c
jmp 0x454692
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00454460
pop esi
pop ebx
ret
Function at 0x455c6c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x13c], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e38
xor eax, eax
push ebp
push 0x455e24
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0045577c
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.0045579c
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x455df0
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404c28
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00408db0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004082fc
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 4]
call fcn.004082fc
mov edx, dword [ebp - 0x140]
pop eax
call fcn.00404de0
je 0x455d94
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404c28
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004082fc
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.004082fc
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.00404de0
jne 0x455ddd
mov eax, dword [ebp - 0x118]
xor edx, edx
push edx
push eax
mov eax, dword [edi]
cdq
cmp edx, dword [esp + 4]
jne 0x455daa
cmp eax, dword [esp]
pop edx
pop eax
je 0x455dd8
push 0
mov eax, dword [ebp - 0x128]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [0x45ed0c]
mov eax, dword [eax + 0x368]
xor edx, edx
call fcn.0042712c
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.004557bc
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x455cef
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455e2b
lea eax, [ebp - 0x14c]
mov edx, 7
call fcn.004049dc
lea eax, [ebp - 4]
call fcn.004049b8
ret
Function at 0xa7467d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa746e2
push ecx
push edx
push edx
lea esp, [esp]
mov dword [esp], ebx
push esp
call fcn.00a746c1
rol byte [ecx - 0x2f], 1
mov al, 0x43
adc byte [edx + 0x2f79002], 0xc7
push eax
invalid
push eax
push ecx
lea esp, [esp + 2]
mov byte [esp], dh
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0xa7467f

Function at 0xa8084f
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0xa6607f
jmp 0xa80839

Function at 0xa989c4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xa98a27
mov cx, word [esp]
lea edx, [edi + 0xef]
bt edx, eax
mov ecx, eax
mov si, word [esp]
mov dword [reloc.WINMM.dll_midiStreamOut], eax
mov esi, dword [esp]
call fcn.00a98a0f
mov byte [edx + ebx*4], al
std
or al, 0xbc
mov cl, 0x21
inc eax
mov bl, 2
xor byte [ebx], dh
sub al, byte [ebp + 9]
enter 0x648d, 0x24
adc cl, ch
aam 0xb6
cld
inc dword [edi + reloc.WINMM.dll_midiStreamOut]
in al, 0x76
in al, 0x83
jle 0xa989d1
imul byte [ebx - 5]
sahf
insd dword es:[edi], dx
test al, 0xe
cdq
clc
invalid
xchg edx, ecx
lea esp, [esp + 4]
push esi
push edi
jmp 0xa989c6

Function at 0xa98a0f
Capabilities:
Encrypt data using speck

Disassembly:
xchg dword [esp], esi
jmp 0xa98a11
jmp 0xa989f9
lea esp, [esp + 4]
push 0x3f
sub esp, 0x1e
mov edx, 0x4326e13d
jmp 0xa98a31
lea edx, [eax*4]
neg si
lea esp, [esp + 2]
mov esi, eax
mov edx, dword [esp]
jmp 0xa98b17
and ecx, edx
cmc
and esi, edx
jmp 0xa98a63
pop edx
pushfd
push dword [esp + 3]
shr esi, 0xc
pushfd
jmp 0xa98a79
mov dx, 0xf47
lea edx, [ebx*4]
shr ecx, 0x12
lea esp, [esp + 0x1c]
jmp 0xa98a95

Function at 0xa9934d
Capabilities:
Encode data using base64

Disassembly:
pushfd
mov word [esp + 1], dx
jmp 0xa98e5f
lea esp, [esp + 4]
mov byte [edx + 3], 0x3d
jmp 0xa98939
stc
pushal
call fcn.00a99084
lea esp, [esp + 4]
jne 0xa988a0
je 0xa990e0

Function at 0xa99545
Capabilities:
Encode data using xor

Disassembly:
cmp cl, 0x30
call fcn.00a99584
push ebx
invalid
lea esp, [esp + 8]
cmp bl, 0x2f
jne 0xa642c1
test edx, esp
lodsd eax, dword [esi]
cld
dec dword [edi]
test byte [edi - 0x7f000352], dh
stc
pop edx
je 0xa6439c
fcom qword [ecx]
mov dword [reloc.WINMM.dll_midiStreamOut], eax
imul esp, esp, 0x5fec1d7a
adc dword [ecx], reloc.WINMM.dll_midiStreamOut
adc byte [ebx + 0x324648d], dl
lea esp, [esp + 3]
jmp 0xa994d2
call fcn.00a99523
lea esp, [esp + 4]
jb 0xa98f4d
jae 0xa9959a
cld
insb byte es:[edi], dx
loop 0xa994da
je 0xa99508
stc
fdivr dword [ebx]
adc al, byte [eax - 0x1d179e07]
invalid
cmp cl, 0x7a
jbe 0xa98eb9
ja 0xa98f4d
pushfd
setg dl
or dword [ebx + reloc.WINMM.dll_midiStreamOut], esp
mov al, byte [0x4ddd4463]
adc al, 0xe7
push ebx
lodsb al, byte [esi]
mov edi, 0x24648d86
add al, 0xf
xchg ah, dl
lodsd eax, dword [esi]
cld
dec dword [edi]
xchg dword [eax + 0xffffcad], edx
test ch, ah
clc
invalid
Function at 0xb6224f
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr esi, edx
mov dword [esp], esp
rdtsc
mov si, sp
jmp 0xb62256
mov dword [esp], eax
mov word [esp], ax
xchg byte [esp], bl
mov ebp, dword [esp + 2]
rdtsc
mov ebp, eax
jmp 0xb62211
mov ax, word [esp + 3]
jmp 0xb62227
adc esi, 0x6311a6b3
pop si
rcl dx, cl
pushfd
cld
not ebx
jmp 0xb622cb
xchg cl, al
lea edx, [esi*4]
pushal
xchg word [esp + 0x22], dx
jmp 0xb622a7
push dword [esp + 0xc]
rol ebx, cl
mov byte [esp + 0xb], ah
popal
lea ebx, reloc.WINMM.dll_midiStreamOut
cpuid
jmp 0xb62291
mov dword [esp + 2], edx
not ax
mov bh, 0xda
rdtsc
sub esp, 6
mov di, 0xb697
jmp 0xb62267
Function at 0xb65bf7
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x14
add esp, 0x28
pop word [esp]
call 0xb65bf7
mov ecx, dword [ebx]
wait
dec byte [0x22ac23e5]
inc ebp
mov ah, 0x56
aaa
mov ecx, 0x52bb4829
sbb byte [ecx - 0x1c169efd], cl
inc ebx
mov bh, bh
add esp, 7
push word [esp + 2]
lea esp, [esp + 1]
jmp 0xb65c48
call 0xb65c2e
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
pushfd
pushal
jmp 0xb65bcd
cpuid
bsr eax, ecx
setae cl
xchg cx, ax
mov edi, 0xbfd41d17
jmp 0xb65fce
lea esp, [esp + 8]
pushal
cmp edi, 0xa677821
mov dh, byte [esp]
sete bl
bts cx, cx
jmp 0xb65c32
bt edi, edi
mov bh, ah
mov dword [esp], eax
clc
setge dh
push ebx
jmp 0xb65d35
xchg dx, ax
inc edx
bsf ebp, eax
neg si
mov ch, 0x76
push ebx
jmp 0xb65c85
pop ax
cpuid
mov dh, 0x2c
mov dword [esp], edx
push dword [esp + 6]
jmp 0xb65d07
mov eax, 0xd77c6cf5
mov esi, 0x12471a67
lea ecx, [edi*4]
mov ecx, esp
pop edi
jmp 0xb65caa
mov si, bp
mov dl, byte [esp + 4]
mov bh, 0xda
mov dword [esp + 2], edx
mov ax, word [esp + 7]
sub esp, 0xe
jmp 0xb65cc0
setnp bl
bswap ebx
cpuid
mov esi, ebp
rdtsc
mov edi, dword [esp + 1]
jmp 0xb65d72
mov cl, byte [esp + 8]
mov word [esp + 3], dx
pop dword [esp + 4]
lea ecx, [ecx*4]
std
setne bh
jmp 0xb65cf1
shl esi, cl
xchg bp, cx
cpuid
mov cx, 0x3c79
push word [esp + 3]
mov edi, dword [esp + 5]
jmp 0xb65cda
mov bl, byte [esp + 0x16]
mov edi, 0xc47bb833
lea ebp, [ebp*4]
not ebp
cmp edi, 0xa4d5505
neg bh
jmp 0xb65dd2
bswap ebp
std
mov ax, 0xc298
not ebp
neg cx
sub esp, 0xe
jmp 0xb65d4b
mov si, sp
setp bh
btc edx, esp
dec cx
xchg byte [esp], dl
jmp 0xb65dae
bsf si, bx
mov bl, byte [esp + 1]
clc
bsf di, dx
add esp, 2
seto cl
jmp 0xb65d83
lea ecx, reloc.WINMM.dll_midiStreamOut
rol ax, cl
bswap ecx
lea eax, [ecx + esi]
mov ebx, edx
setb dl
jmp 0xb65de6
mov dword [esp + 0x13], edx
lea esp, [esp + 0x1d]
xchg word [esp], ax
mov bh, byte [esp]
mov bl, bh
dec esi
jmp 0xb65d99
mov ebx, dword [esp]
mov di, bp
bswap esi
mov esi, 0xfe9cabcf
dec edx
mov ah, byte [esp]
jmp 0xb65e3e
mov edi, edx
mov ecx, 0x56e07fa5
sub bx, bx
lea ebp, [ebx*4]
mov ebx, ebp
mov si, word [esp]
jmp 0xb65c9b
xchg byte [esp], dl
mov ebx, dword [esp]
bsr si, di
btr eax, ecx
mov ebp, 0x2ce4856d
mov edi, 0x6e93d63f
jmp 0xb65e67
add esp, 0
xchg byte [esp], al
mov di, 0x1b03
bts si, bp
xchg bl, al
inc ecx
jmp 0xb65e1d
lea esp, [esp + 2]
shr cl, 1
mov byte [esp], ch
lea esp, [esp + 1]
jmp 0xb65e8b
bsf ebx, ebp
bt eax, eax
rdtsc
pushfd
dec eax
mov eax, ebp
jmp 0xb65e51
btc eax, edx
rcr di, cl
call fcn.00b65ecf
dec eax
salc
inc esp
and ebx, esi
pop ecx
invalid
push word [esp]
mov ecx, dword [esp + 1]
xor cl, 0xef
mov byte [esp + 1], ah
cmc
cld
jmp 0xb65e75
mov al, 0x7a
inc ax
mov ebx, ecx
mov si, ax
mov esi, ebx
lea ebx, [edx*4]
jmp 0xb65e01

Function at 0xb666ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xb66739
cld
mov cl, byte [esp + 6]
sub esp, 0xd
mov al, byte [esp + 0x14]
rdtsc
mov ax, word [esp + 0x1b]
jmp 0xb66723
Function at 0xb66bfd
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 4], esi
pushfd
mov dword [esp], edx
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0xb66c43
lea esp, [esp + 1]
push word [esp + 2]
push dword [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 8], ebp
jmp 0xb66be7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xb66c28