joyce8/EMBER2024-capa huggingface dataset:
Function at 0x99fc9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp]
jae 0x9a0a1c
lea esp, [esp + 2]
mov dword [esp], ecx
pushal
mov byte [esp + 0xe], dh
jmp 0x9a013f
mov byte [esp + 0x12], dl
jmp 0x9a021f
mov byte [esp + 0xe], dh
mov byte [esp + 0x12], dl
call fcn.009a0105
lea esp, [esp + 2]
mov dword [esp], ecx
pushal
jmp 0x9a0217
jmp 0x9a0385

Function at 0x9a00b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], ebx
call fcn.009a00d9
push 0xf0991190
jmp 0x9a01fa
cmc
jmp 0x9a02f9
rol si, 0xd
ja 0x9a01e4
cmc
dec ax
jmp 0x9a02fb
mov ax, cx
setg ah
lea esi, [esp]
call fcn.009a0224
dec ax
mov ebp, dword [esp + 0x2c]
not edi
cpuid
jmp 0x9a023a

Function at 0x9a019e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.009a01df
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0x9a01c9
pushfd
jmp 0x9a00c2

Function at 0x9a01a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.009a01df
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0x9a01c9
pushfd
jmp 0x9a00c2

Function at 0x9a0224
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp], ah
bswap eax
jmp 0x9a027d
pushfd
mov dx, 0xb8e7
rdtsc
lea eax, [eax + esi]
mov ebx, 0xb88b1607
jmp 0x9a02c4
mov dl, 0x3a
mov ch, byte [esp]
mov cx, 0x302
lea eax, reloc.MSVCRT.dll_strncpy
mov ecx, ebp
btr edx, eax
jmp 0x9a02a5
lea esp, [esp + 1]
lea esp, [esp + 3]
sub esp, 0xc0
mov edi, esp
jmp 0x9a025e
rdtsc
lea eax, [eax + esi]
mov ebx, 0xb88b1607
jmp 0x9a02c4
jge 0x9a0248
pushfd
mov dx, 0xb8e7
jmp 0x9a028f
mov ax, word [esp]
lea edx, [eax + edx]
rcr ebx, 0x10
je 0x9a02d3
jne 0x9a02d3
sub dword [ebp + reloc.MSVCRT.dll_strncpy], edi
or al, 0x9f
lea edx, [esp + ebx]
ror ebp, 0
rdtsc
xchg dl, bh
setbe dh
jmp 0x9a02ae
xor ebp, 0x24f0931f
jmp 0x9a02df
mov dx, bp
lea eax, [edi*4]
bt ax, di
ja 0x9a0320
mov bx, ax
jmp 0x9a033b
bswap ebx
lea edx, [esi - 0x91]
jmp 0x9a0325
mov bx, ax
jmp 0x9a0308
not ebp
lea ebx, reloc.MSVCRT.dll_strncpy
rdtsc
rdtsc
stc
jmp 0x9a0345
bswap ebx
lea edx, [esi - 0x91]
jmp 0x9a0325
jge 0x9a035b
jl 0x9a035b
stc
jae 0x9a032f
xchg byte [ebp - 0x39], dh
loope 0x9a03c5
ljmp 0x6320:0xe1cb7c8d
call 0x9a0438
dec ebp
mov edx, eax
call 0x9a0369
pop ss
mov ax, 0x819c
jmp 0x9a03cc
mov bl, 0x4d
lea eax, [eax*4]
jmp 0x9a0419
lea edx, [esi + edi]
lea edx, [edi + 0xab]
lea eax, [eax - 0xeb]
sub esp, 2
dec dx
add esp, 1
jmp 0x9a0407
xchg ebp, eax
add byte [eax], al
add byte [eax], al
jmp 0x9a0392
ror ebp, 0
jg 0x9a036f
mov bl, 0x4d
lea eax, [eax*4]
jmp 0x9a0419
lea edx, [eax*4]
xchg dx, ax
push dword [esp + 0x20]
ret 0x24
rcr dh, 1
add ebx, edx
lea esp, [esp + 1]
xchg dword [esp + 0x20], eax
xchg dh, ah
neg ah
jmp 0x9a03e2
add ebp, dword [esi]
mov eax, 0x6ae84de4
xchg bx, dx
shl ebx, 2
je 0x9a08a6
xchg bh, dh
jmp 0x9a0484
xchg bh, dh
jmp 0x9a0484
jmp 0x9a04bc
Function at 0x9a06bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0xf57982f3
jmp 0x9a08db
dec edx
pop word [esp]
lea esp, [esp + 2]
jmp 0x9a0717
mov word [esp], bx
dec dh
and al, 0xfe
into
jb 0x9a06a9
jae 0x9a079a
jbe 0x9a06c2
arpl word [esi], ax
cmc
aaa
insb byte es:[edi], dx
hlt
neg bl
mov dx, 0xe1a8
mov ax, word [esp]
mov eax, dword [esp]
mov eax, 0x200450b8
call fcn.009a06f9
sub esp, 4
push esp
jmp 0x9a0768
xchg al, dh
dec eax
jae 0x9a0776
rdtsc
jmp 0x9a0778
mov edx, ecx
lea esp, [esp + 8]
dec bl
mov ax, word [esp]
jmp 0x9a0750
rdtsc
jmp 0x9a07be
aam 0x60
pop edx
shr eax, cl
xchg dword [esp + 8], eax
jmp 0x9a0802
dec edx
pop word [esp]
lea esp, [esp + 2]
jmp 0x9a0717
neg bl
not edx
call fcn.009a077a
jno 0x9a07dd
mov dx, word [esp]
jmp 0x9a07e1
mov dx, word [esp]
mov edx, ebx
mov ax, si
call fcn.009a0828
sub ecx, dword [edx - reloc.MSVCRT.dll_strncpy]
add byte [eax], al
add byte [ebx], ch
mov al, byte [esp]
jmp 0x9a0879
add byte [esi - 0x40], al
push esi
xor eax, eax
jb 0x9a07f3
jge 0x9a07ea
je 0x9a0786
inc edi
int3
lea esp, [esp + 0x20]
add bl, 0xd1
rdtsc
rdtsc
bt edx, esi
jmp 0x9a07c7
not ax
bswap eax
jmp 0x9a08f5
lea eax, [ebp*4]
jmp 0x9a00db
mov ah, 0x57
jmp 0x9a08ab
mov al, 0xd9
shr eax, cl
lea esp, [esp + 3]
jmp 0x9a0920
lea eax, reloc.MSVCRT.dll_strncpy
sub esp, 0xf
ja 0x9a08c5
jbe 0x9a09a7
call 0x60822270
test dword [edi], esi
shl edx, 2
inc ax
jg 0x9a08c1
mov ah, 0x57
lea eax, [ebp*4]
jmp 0x9a00db
btc ax, di
jp 0x9a094b
push dx
lea eax, [esi*4]
call fcn.009a0956
dec esi
invalid
mov eax, edx
lea eax, reloc.MSVCRT.dll_strncpy
mov edx, dword [eax]
lea eax, [ecx + ebp]
jmp 0x9a090a
lea esp, [esp + 2]
jmp fcn.009a00f8
push dx
lea eax, [esi*4]
jmp 0x9a092f
mov al, 0xd9
shr eax, cl
lea esp, [esp + 3]
jmp 0x9a0920

Function at 0x9a06f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edx
lea edx, [esi + 0xf8]
mov al, byte [esp + 3]
jmp 0x9a06fb
jmp 0x9a06e3
lea esp, [esp + 4]
neg bl
mov eax, dword [esp]
mov edx, ebx
mov dl, byte [esp]
jmp 0x9a0744
shr eax, cl
jl 0x9a072e
sub esp, 4
push esp
mov edx, ecx
jmp 0x9a076a

Function at 0x9a077a
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf eax, esi
jmp 0x9a07a8
bsf dx, sp
pushal
jno 0x9a0783
bsf dx, sp
pushal
jmp 0x9a0846
pop edx
shr eax, cl
xchg dword [esp + 8], eax
jmp 0x9a0802

Function at 0x9a36b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], dl
pop word [esp]
call 0x9a36bf
ja 0x9a3726
pop dword [esp + 1]
jmp 0x9a371c
lea esp, [esp + 2]
push ebx
push esp
call fcn.009a36f7
pop esi
fdiv qword [edx + 0x15]
in al, 0x51
test eax, 0x3d826bc8
mov dword [esp], eax
pushfd
mov dword [esp], ecx
push ecx
mov dword [esp], edx
push dx
and al, 0x66
push edx
jmp 0x9a36c6

Function at 0x9a36bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], dl
pop word [esp]
call 0x9a36bf
ja 0x9a3726
pop dword [esp + 1]
jmp 0x9a371c
lea esp, [esp + 2]
push ebx
push esp
call fcn.009a36f7
pop esi
fdiv qword [edx + 0x15]
in al, 0x51
test eax, 0x3d826bc8
mov dword [esp], eax
pushfd
mov dword [esp], ecx
push ecx
mov dword [esp], edx
push dx
and al, 0x66
push edx
jmp 0x9a36c6
Function at 0x9a36e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], ebp
call fcn.009a3700
or eax, 0x967b1c8e
push ebp
popfd
and esi, dword [ebx - reloc.MSVCRT.dll_strncpy]

Function at 0x9a36f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], esp
call fcn.009a36e1

Function at 0x9a3700
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ecx
jmp 0x9a3741
lea esp, [esp + 2]
push ax
mov dword [esp + 4], esi
call fcn.009a3705

Function at 0x9a3705
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
pushfd
lea esp, [esp + 3]
jmp 0x9a372b
mov dword [esp + 4], edi
lea esp, [esp + 4]
call fcn.009a3750
push 0xffffffffffffffec
bound eax, qword [0x587946f4]
mov ebx, 0x224648d

Function at 0x9a3750
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebp
lea ebp, [ebp + 0x2e]
call fcn.009a3b98
xchg edi, eax
adc byte [esi + 0xdd210e1], al
pushfd
out dx, eax
mul cl
pushfd
call fcn.009a3bb9
mov cl, bl
mov esi, edx
neg edx
jb 0x9a3c1f
jae 0x9a3c09
and byte [ebx - 0x66], ah
cmc
sbb dh, byte [edi - 0xc]
mov dword [reloc.MSVCRT.dll_strncpy], eax
sbb ebx, dword [eax]
sti
mov dword [reloc.MSVCRT.dll_strncpy], eax
sbb dword [ecx], 0xfffffffc
mov dword [reloc.MSVCRT.dll_strncpy], eax
adc bh, al
hlt
mov ax, word [esp]
jmp 0x9a3c23
mov ax, word [esp]
mov edi, dword [esp + 0x2c]
mov dh, 0xd6
sub cx, 0x43e1
jmp 0x9a3c64
lea ebp, [esp]
neg al
je 0x9a3c68
jne 0x9a459e
mov al, byte [0xb3751ae3]
lodsb al, byte ds:[esi]
retf
jb 0x9a3c34
jae 0x9a3c34
rdtsc
setbe ah
sub esp, 0xc0
call fcn.009a4103
pop esp
jecxz 0x9a3cee
push ss
in eax, 0x51
mov byte [0x2cddba24], al
sahf
rcl dword [eax - 0x2d]
dec edx
in eax, 0xf
leave
push dword [esp]
ret 4
mov al, 0xa
imul ebp, ebx, 0xfebf8dd8
idiv edi
dec dword [ebx + reloc.MSVCRT.dll_strncpy]
and al, 0x87
jl 0x9a3d26
adc al, 0x66
xor eax, 0x310f5127
jmp 0x9a3d23
mov al, cl
inc bx
inc ebx
push dword [esp + 0x14]
ret 0x18
rdtsc
setbe ah
jmp 0x9a3c6d

Function at 0x9a3dd5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edx*4]
mov edx, 0xc0bdd6ed
rdtsc
jmp 0x9a3e01
xchg dword [esp], eax
mov edx, 0xf13ba9eb
lea ebx, [ebx + edi]
jmp 0x9a3e41
mov ebx, dword [esp]
inc dh
sbb edx, 0x683a6497
lea edx, reloc.MSVCRT.dll_strncpy
dec bx
lea eax, [eax - 0x3f]
jmp 0x9a3e2b
Function at 0xa82c7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov dword [esp + 4], ebp
jmp 0xa82dac
cmp bx, si
add esp, 0xf
pop dword [esp]
bsf edi, esi
std
dec bp
jmp 0xa82d11
mov esi, esp
stc
cpuid
rdtsc
mov byte [esp + 0x12], ah
mov cx, word [esp + 0x17]
jmp 0xa82cc1
lea edx, [ebp*4]
xchg dword [esp], esi
xchg di, cx
bswap edi
bswap ebx
mov byte [esp + 3], bh
jmp 0xa82d49
rol di, 0xf
rdtsc
bsf bx, si
mov bp, word [esp + 2]
neg dh
mov esi, 0x926d809
jmp 0xa82ce9
cpuid
cmp bh, cl
not bl
mov ch, 6
not ah
bswap ecx
jmp 0xa82d7a
lea esp, [esp]
mov dx, word [esp + 1]
xchg dword [esp], eax
mov ebp, edi
add esp, 3
pop ax
jmp 0xa82d29
mov byte [esp + 1], ah
rdtsc
rdtsc
neg ecx
cld
not esi
jmp 0xa82d93
mov bl, byte [esp]
sub esp, 0xa
mov word [esp], dx
mov si, 0xa35d
mov cl, byte [esp + 8]
xchg word [esp + 1], ax
jmp 0xa82d5d
add esp, 2
mov ch, byte [esp + 6]
mov bh, dh
push dword [esp]
bsf ebp, ebp
std
jmp 0xa82ddf
mov ax, sp
mov bx, word [esp + 6]
pop word [esp + 9]
xchg byte [esp + 6], dh
sub esp, 0xc
rdtsc
jmp 0xa82cd7
mov edx, dword [esp + 2]
push word [esp + 3]
seto al
mov ah, 0x51
mov cl, 0x7b
xchg ah, al
jmp 0xa82e0f
pop word [esp + 5]
mov edx, dword [esp + 5]
pop dword [esp]
pop word [esp + 1]
inc bh
push word [esp + 3]
jmp 0xa82dc7
not dh
add esp, 3
lea edi, [esp + 0x60]
lea ebp, [eax + edx]
sub esp, 9
jmp 0xa82e3d
neg esi
xchg word [esp + 1], ax
pop bx
lea ebx, [eax + esi]
mov si, word [esp + 2]
rdtsc
jmp 0xa82df9
bswap edi
inc ah
xchg ebp, eax
pop word [esp + 2]
add esp, 8
mov ch, byte [esp]
jmp 0xa82f9a
pop cx
mov bh, 0x31
mov dl, 0x7c
xchg word [esp + 0xf], bp
xchg ah, bl
push dword [esp + 0xb]
call fcn.00a82e7d
jnp 0xa82e95
js 0xa82ecc
ljmp 0x9fa:0x9f0f9f1b
stc
xchg ecx, eax
mov cl, byte [esp]
sub esp, 0x1e
xchg cx, ax
mov byte [esp + 0x13], ah
jmp 0xa82e93
mov edi, dword [esp + 9]
mov bp, di
popal
cpuid
mov al, 0xdd
lea eax, [esi*4]
jmp 0xa82f23
neg dh
cld
xchg cx, ax
neg edx
mov si, word [esp]
bsf ax, sp
jmp 0xa82eba
bsr dx, dx
bsf ecx, eax
bsf ebx, edi
rdtsc
lea eax, [ecx + ebx]
cpuid
jmp 0xa82f68
cpuid
mov edi, eax
pop eax
mov dl, byte [esp]
rdtsc
mov bp, 0x7fef
jmp 0xa82f08
sub edx, esp
xor al, 0x8e
sub esp, 0xc
mov ecx, 0x3343b561
call fcn.00a82f49
xchg word [esp + 1], dx
neg ebx
pop cx
cpuid
push word [esp + 1]
sub esp, 0x12
jmp 0xa82fc5
mov dx, 0x153c
pop di
mov cx, 0xe568
shr dx, 9
inc ebp
clc
jmp 0xa82ef6
xchg ebp, eax
push dword [esp + 0x12]
mov bp, word [esp + 0x13]
jmp 0xa82fd9
cpuid
bswap edi
xchg dword [esp + 0xc], ebx
neg si
mov dx, 0x5fe2
bts edi, eax
jmp 0xa82faf
mov esi, 0x65af7555
sub esp, 6
not bh
bsr cx, ax
add esp, 0xc
mov dl, 0xf3
jmp 0xa84f8f
mov bl, dh
rdtsc
pop edx
call fcn.00a8306e
mov di, dx
xchg dword [esp + 5], ebp
mov word [esp + 4], si
cpuid
xchg bp, cx
mov dword [esp + 7], esp
jmp 0xa832c8
cpuid
lea esp, [esp + 9]
btr ebx, ebx
mov word [esp + 0xc], sp
std
pop si
jmp 0xa8364b
mov edi, dword [esp + 0xb]
mov ch, byte [esp + 2]
xchg dword [esp + 0xc], ebx
xchg word [esp + 9], bx
sub esp, 0xa
not ax
jmp 0xa8385b
Function at 0xa8369d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 6], dl
not dl
pop ax
add esp, 3
add esp, 3
bswap eax
mov bl, 0x42
cpuid
jmp 0xa8367b

Function at 0xa84145
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, 0xeb
or esi, 0x4f1ab575
xchg byte [esp + 1], ch
jmp 0xa84199
xchg word [esp + 1], cx

Function at 0xa84612
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, word [esp]
jmp 0xa8465d
mov byte [esp], bl
add esp, 3
lea esp, [esp]
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0xa8469e
xchg esi, eax
mov word [esp + 1], dx
setl al
sub dl, 0x64
btr ebx, esp
sub bl, ah
jmp 0xa84647
bts edx, ecx
mov cx, word [esp]
mov bl, 0xe7
mov ecx, 0x22035ab4
neg dl
jmp 0xa846b0
mov bx, 0x9a9e
xchg cl, bh
rdtsc
xchg byte [esp], bh
lea esp, [esp]
xchg ebp, ebx
jmp 0xa84688
mov byte [esp], cl
cld
mov dx, si
bsr ebp, edi
mov bl, byte [esp]
mov cl, 0x91
jmp 0xa846e3
mov ebx, esi
mov al, bh
mov dl, byte [esp]
rol dh, cl
mov byte [esp], al
not bh
jmp 0xa84929
mov ah, 0xe9
mov bl, 0xcd
xor ebx, ebp
neg ax
xchg dh, ch
add esp, 0
jmp 0xa848c2
cld
bsf ecx, ebp
pushal
xchg bp, si
pop dx
call fcn.00a8471d
lea edx, [esp - 0xf9]
add bx, dx
lea ebx, [edx*4]
rcl di, cl
mov ah, byte [esp]
mov ah, 0xd2
jmp 0xa84733
lea esp, [esp]
xchg edi, ebp
bswap ebp
lea esp, [esp]
rdtsc
dec edi
jmp 0xa84771
bswap eax
mov dh, 0xaf
lea ebx, [ecx*4]
stc
mov esi, 0x24ee7fda
mov cx, 0x66ef
jmp 0xa84841
mov edx, 0x1b71e988
mov ah, al
bsr esi, edx
mov esi, dword [esp]
mov edx, dword [esp]
mov di, word [esp]
jmp 0xa846f6

Function at 0xa84c4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg cx
mov cl, 0xda
mov ebp, 0x43f7623f
mov dword [esp], edi
rdtsc
xchg byte [esp + 2], dh
jmp 0xa84c56
xchg bx, bp
not ch
xchg bx, bp
jmp 0xa84c33
bswap edi
mov dx, bp
rdtsc
mov byte [esp + 1], ah
dec di
cmc
jmp 0xa84cf5
mov eax, 0xa140badd
cpuid
pop dx
mov edi, dword [esp]
dec eax
neg edx
jmp 0xa84c8b
mov bl, 0xea
xchg ebp, esi
mov dh, 0x7f
neg ch
rdtsc
setp ah
jmp 0xa84ca1
pop ax
not ebx
bswap ebx
mov dx, 0xf9ee
lea esi, [edx + 0xae]
neg di
jmp 0xa84cc1

Function at 0xa85223
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call fcn.00a8502a
push sp
jmp 0xa8522b
lea esp, [esp + 2]
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
jmp 0xa8530d
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xa85025
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xa852e0
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000983f
pop dword [ebp - 0x24]
mov eax, 0xd99455ad
sub eax, 0xc993bd6e
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x38ca7
push 0
mov eax, 0xc3eba5f
sub eax, 0xfc3d79fb
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x4728
mov edi, eax
mov ebx, 0xa33f2d01
add ebx, 0x6cc258ff
add ebx, dword [ebp - 0x24]
mov esi, 0x2ceda38e
add esi, 0xa4123166
xor dword [ebp - 4], esi
mov edx, dword [ebx]
xor dword [ebp - 0x18], eax
add edx, esi
mov dword [ebp - 8], 0x347d14a8
mov dword [edi], edx
mov dword [ebp - 8], 0x79a2c8fe
add edi, 4
add ebx, 0x29853858
add ebx, 0xd67ac7ac
loop 0x10009898
add eax, 0x1eba42c5
sub eax, 0x1eb93352
xor ebx, ebx
add ebx, eax
add eax, 0x95fe7800
sub eax, 0x95fe77fb
mov ecx, 0x52d3d79e
add ecx, 0xbd2c2862
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4142bb
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x41b024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x70], edi
mov dword [0x41cf60], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [edi + 0x3c]
mov dword [edi], str.YYMusic3
mov dword [edi + 4], str.YYMusic2.exe
mov dword [edi + 8], 0x4172e4
mov dword [edi + 0xc], str.Unins.exe
mov dword [edi + 0x10], str.PlayerUpdate.exe
mov dword [edi + 0x2c], 0xa
mov word [edi + 0x30], bx
mov byte [edi + 0x32], bl
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], eax
mov byte [eax], bl
mov byte [ebp - 4], 1
push 0xa0
mov dword [edi + 0x7c], 0x1010101
mov dword [edi + 0x80], ebx
mov dword [edi + 0x84], ebx
call fcn.0040822a
add esp, 4
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x4010aa
push eax
call fcn.00402c10
jmp 0x4010ac
xor eax, eax
lea esi, [ebp - 0x58]
mov dword [edi + 0x34], eax
call fcn.00401110
lea esi, [edi + 0x38]
call fcn.004025d0
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
cmp eax, ecx
je 0x4010d2
push eax
call fcn.004087c1
add esp, 4
push ebx
lea edx, [ebp - 0x68]
push edx
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040805e
mov esp, ebp
pop ebp
ret

Function at 0x401110
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x41b024]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0040c670
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ecx
push 0x26
push 0
mov dword [ebp - 0x10c], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x401180
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esi + 4]
mov dword [esi], eax
mov byte [eax], 0
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401191
sub eax, edx
push edi
mov edi, eax
cmp edi, 0x3f
jl 0x4011b8
lea edx, [edi + 1]
push edx
push 0
mov dword [esi], 0
call fcn.00408a91
add esp, 8
mov dword [esi], eax
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.004087a7
mov edx, dword [esi]
add esp, 0xc
push 0x417314
mov eax, esi
mov byte [edi + edx], 0
call fcn.00402430
push str.YYMusic3
mov eax, esi
call fcn.00402430
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
pop edi
call fcn.0040805e
mov esp, ebp
pop ebp
ret
Function at 0x401950
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x41b024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.00401c10
mov eax, dword [0x41cf60]
mov ecx, dword [eax + 8]
push ecx
call fcn.00401b00
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push 0
push 1
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x401997
push 0
push eax
call esi
mov edx, dword [0x41cf60]
mov eax, dword [edx + 4]
push eax
call fcn.00401b00
push eax
push 0
push 1
call ebx
test eax, eax
je 0x4019b6
push 0
push eax
call esi
mov ecx, dword [0x41cf60]
mov edx, dword [ecx + 0x10]
push edx
call fcn.00401b00
push eax
push 0
push 1
call ebx
test eax, eax
je 0x4019d5
push 0
push eax
call esi
push str.YyfmPlay.exe
call fcn.00401b00
push eax
push 0
push 1
call ebx
test eax, eax
je 0x4019ef
push 0
push eax
call esi
push str.YYNEWS.exe
call fcn.00401b00
push eax
push 0
push 1
call ebx
test eax, eax
je 0x401a09
push 0
push eax
call esi
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 0xb4], 0
test edi, edi
jne 0x401a28
mov edi, 0x4173a4
mov ecx, edi
lea esi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x401a30
sub ecx, esi
mov esi, ecx
cmp esi, 0x3f
jl 0x401a5e
lea eax, [esi + 1]
push eax
push 0
mov dword [ebp - 0xb8], 0
call fcn.00408a91
add esp, 8
mov dword [ebp - 0xb8], eax
push esi
push edi
push eax
call fcn.004087a7
mov ecx, dword [ebp - 0xb8]
add esp, 0xc
push str.SysConfig.ini
lea eax, [ebp - 0xb8]
mov byte [esi + ecx], 0
call fcn.00402430
push 0x64
lea edx, [ebp - 0x70]
push 0
push edx
call fcn.0040c670
mov eax, dword [ebp - 0xb8]
add esp, 0xc
push eax
push 0x64
lea ecx, [ebp - 0x70]
push ecx
push 0x4172e4
push str.RunSetup
push str.SysConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x70]
push edx
call fcn.00401b00
push eax
push 0
push 1
call ebx
test eax, eax
je 0x401ad2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0xb8]
lea ecx, [ebp - 0xb4]
cmp eax, ecx
je 0x401aeb
push eax
call fcn.004087c1
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040805e
mov esp, ebp
pop ebp
ret
Function at 0x4036e0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x41b024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x90]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4037e0
mov edx, dword [0x41cf60]
push edi
lea ecx, [ebp - 0x88]
mov byte [ebp - 0x88], al
mov eax, dword [edx + 4]
mov dword [ebp - 0x8c], ecx
mov ecx, dword [esi]
push eax
push ecx
push str.__s_s___mini
lea edi, [ebp - 0x8c]
call fcn.00402a00
lea edx, [ebp - 0x44]
push 8
mov eax, edx
push str.YYMusic3
push eax
mov dword [ebp - 0x48], edx
mov byte [ebp - 0x44], 0
call fcn.004087a7
mov ecx, dword [ebp - 0x48]
mov byte [ecx + 8], 0
mov edx, dword [esi + 0x54]
add esp, 0x18
push edx
lea eax, [ebp - 0x48]
call fcn.00402430
mov edx, dword [ebp - 0x8c]
mov eax, edx
lea esi, [eax + 1]
pop edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403787
mov ecx, dword [ebp - 0x90]
sub eax, esi
push eax
mov eax, dword [ebp - 0x48]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x44]
cmp eax, ecx
je 0x4037c7
push eax
call fcn.004087c1
add esp, 4
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
cmp eax, edx
je 0x4037e0
push eax
call fcn.004087c1
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040805e
mov esp, ebp
pop ebp
ret