joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67545420
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x67548058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x67545508
mov eax, dword [ebx + 4]
mov ecx, 1
mov dword [ebp - 0x20], eax
mov eax, dword [ebx]
test eax, eax
je 0x6754546b
mov ecx, dword [eax + 4]
test byte [0x67548064], 8
jne 0x675454a0
mov eax, dword [ebx + 0x2c]
cmp eax, 1
je 0x675454dd
sub eax, 2
xor edx, edx
cmp eax, 1
jbe 0x67545518
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], str.__p___p__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._vcomp_for_dynamic_next
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
mov dword [ebp - 0x24], ecx
call sym._wine_dbg_log.constprop.0
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebp - 0x24]
cmp eax, 1
jne 0x6754547c
mov eax, dword [ebx + 0x30]
mov edi, dword [ebp - 0x1c]
mov edx, 1
mov dword [edi], eax
mov eax, dword [ebx + 0x34]
mov dword [esi], eax
mov eax, edx
mov dword [ebx + 0x2c], 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
call sym._vcomp_init_thread_data.part.0
mov ebx, eax
jmp 0x67545457
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [esp], 0x67548040
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub esp, 4
mov edx, dword [ebp - 0x28]
mov eax, dword [eax + 0x10]
cmp dword [ebx + 0x28], eax
je 0x67545568
mov dword [ebp - 0x1c], edx
mov dword [esp], 0x67548040
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x1c]
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov edi, dword [ebp - 0x20]
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x6754553f
mov edx, dword [edi + 0x24]
cmp eax, edx
mov edi, edx
cmovbe edi, eax
cmp dword [ebx + 0x2c], 3
je 0x675455c3
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x14]
mov dword [edx], ecx
lea edx, [edi - 1]
imul edx, dword [eax + 0x20]
add edx, ecx
mov dword [esi], edx
mov edx, dword [eax + 0x1c]
mov ecx, edx
mov dword [ebp - 0x1c], edx
mov edx, dword [eax + 0x20]
sub ecx, edi
imul edx, edi
add dword [eax + 0x14], edx
xor edx, edx
test edi, edi
mov dword [eax + 0x1c], ecx
setne dl
test ecx, ecx
jne 0x6754553f
mov eax, dword [eax + 0x18]
mov dword [esi], eax
jmp 0x6754553f
imul edx, ecx
cmp eax, edx
jbe 0x67545582
lea eax, [eax + ecx - 1]
xor edx, edx
div ecx
mov edi, eax
jmp 0x67545582
Function at 0x675455e0
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x14
test byte [0x67548064], 8
jne 0x67545620
mov eax, dword [0x67548058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x67545650
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0xc]
leave
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], 0x6754a088
mov dword [esp + 8], str.omp_in_parallel
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x675455fa
call sym._vcomp_init_thread_data.part.0
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0xc]
leave
lea esp, [ecx - 4]
ret
Function at 0x67545c70
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
test byte [0x67548064], 8
jne 0x67545ce0
mov dword [esp + 8], 0x18
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x67545d0a
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, dword [ebx]
sub esp, 4
mov dword [eax + 0x18], str..._src_wine_dlls_vcomp_main.c:_critsect
mov dword [esi], ebx
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.omp_init_lock
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x67545c8e
call sym._alloc_critsect.part.0
nop

Function at 0x67545d10
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x67548064], 8
jne 0x67545d80
mov ebx, dword [ebx]
test ebx, ebx
je 0x67545d6c
mov eax, dword [ebx]
mov dword [eax + 0x18], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.omp_destroy_lock
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x67545d2d

Function at 0x67545db0
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x67548064], 8
jne 0x67545e00
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlIsCriticalSectionLockedByThread]
sub esp, 4
test eax, eax
jne 0x67545e2a
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.omp_set_lock
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x67545dcd
test byte [0x67548064], 2
jne 0x67545e40
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword [ebx]
mov dword [esp + 0xc], str.omp_set_lock_called_while_holding_lock__p_n
mov dword [esp + 8], str.omp_set_lock
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x67548064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x67545e33
Function at 0x675460b0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
test byte [0x67548064], 8
jne 0x675460f0
mov ebx, dword [edi]
test ebx, ebx
je 0x6754611e
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str._vcomp_enter_critsect
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov ebx, dword [edi]
test ebx, ebx
jne 0x675460d5
mov dword [esp + 8], 0x18
mov dword [esp + 4], 0
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x675461b0
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov edx, dword [ebp - 0x1c]
sub esp, 4
mov eax, dword [edx]
mov dword [eax + 0x18], str..._src_wine_dlls_vcomp_main.c:_critsect
mov eax, ebx
lock cmpxchg dword [edi], edx
test eax, eax
je 0x675461a9
mov eax, dword [edx]
mov dword [ebp - 0x1c], edx
mov dword [eax + 0x18], 0
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
mov edx, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov ebx, dword [edi]
jmp 0x675460d5
call sym._alloc_critsect.part.0
lea esi, [esi]
lea esi, [esi]
Function at 0x675464c0
Capabilities:
Allocate thread local storage
Get system information on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 8]
test byte [0x67548064], 8
jne 0x67546510
cmp ebx, 1
je 0x67546545
cmp ebx, 3
je 0x675465d0
test ebx, ebx
mov ebx, 1
je 0x67546598
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.__p___ld___p__n
mov dword [esp + 8], str.DllMain
mov dword [esp + 4], 0x67548064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
cmp ebx, 1
jne 0x675464ea
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x67548058], eax
cmp eax, 0xffffffff
je 0x675465f0
lea eax, [ebp - 0x3c]
mov ebx, 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
mov dword [0x6754d010], edi
sub esp, 4
mov dword [0x6754d00c], eax
mov dword [0x6754d008], eax
mov dword [0x6754d004], eax
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
test esi, esi
jne 0x67546500
cmp dword [0x67548058], 0xffffffff
je 0x67546500
call sym._vcomp_free_thread_data
mov eax, dword [0x67548058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsFree]
sub esp, 4
jmp 0x67546500
call sym._vcomp_free_thread_data
lea esp, [ebp - 0x10]
mov ebx, 1
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
test byte [0x67548064], 2
jne 0x67546600
xor ebx, ebx
jmp 0x67546500
mov dword [esp + 0xc], str.Failed_to_allocate_TLS_index_n
xor ebx, ebx
mov dword [esp + 8], str.DllMain
mov dword [esp + 4], 0x67548064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x67546500

Function at 0x675466c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6754671b
cmp byte [esi + ebx - 1], 0xa
je 0x675466ef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6754d0c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6b7d45
Capabilities:
Encode data using xor

Disassembly:
cmp al, 9
mov byte [esp + 8], dh
push 0x18ffc0e8
call fcn.0071ff3c
add byte [eax], al
inc ebx
push 0x57646c69
imul ebp, dword [esi + 0x64], 0x7246776f
outsd dx, dword [esi]
insd dword es:[edi], dx
push eax
outsd dx, dword [esi]
imul ebp, dword [esi + 0x74], 0x9c007845
call fcn.006ba517
add byte [eax], al
push ebx
je 0x6b7dd1
imul ebp, dword [esi + 0x64], 0x6554776f
js 0x6b7df7
js 0x6b7df7
inc ecx
add byte [edi - 0x54], ah
mov ebx, 0x17908701
fcmovnu st(0), st(7)
and al, 0x6a
call 0x3371d684
pop es
dec ecx
push esp
iretd
mov byte [0xe41bf828], al
leave
shr esp, 0xb7
adc eax, 0x6df02eca
invalid
out 0x6a, eax
cmp cl, cl
dec esp
popal
sub ch, byte [edi + 0x7c80fb45]
stosd dword es:[edi], eax
and dl, byte [ebx - 0x16]
scasb al, byte es:[edi]
test al, 0xa4
xchg edi, eax
pop eax
push cs
jno 0x6b7d80
mov es, edx
test dword [edi + 0xc18407], eax
sar dword [edi - 0x43], 0x3b
cmp dh, byte [esi + 0x73]
jo 0x6b7da2
jae 0x6b7e69
test al, 0
add byte [edi + 0x65], al
je 0x6b7e43
add byte [eax], al
inc edi
je 0x6b7e43
insb byte es:[edi], dx
popal
jae 0x6b7e77
dec esi
popal
insd dword es:[edi], dx
inc ecx
add al, ch
dec ebp
cmp dword [eax], eax
add byte [edi + 0x57f37f2], ch
mov bh, 0x24
out 0x6a, eax
fsub dword [0x981dae58]
fldcw word [0x4481a66c]
jmp 0xe068063b
cwde
iretd
or edx, ebp
movsd dword es:[edi], dword [esi]
mov eax, dword [0xfbb773aa]
jle 0x6b7efe
scasd eax, dword es:[edi]
cmpsd dword [esi], dword es:[edi]
pop ebx
std
rcr dword [ebx - 0x1e5e7555], 0x91
or cl, ch
nop
insd dword es:[edi], dx
iretd
push ss
mov esi, 0xe7e32361
loope 0x6b7f78
enter 0xffffffffffffaf89, 0xffffffffffffffcb
mov esi, 0xc908a4d9
add dword [ebx], 0xd2f6b268
movsd dword es:[edi], dword [esi]
or dword [ebx + 0x30], ebp
cmp byte [edi - 0x7e], bh
xchg dword [esi - 0x6d], ecx
pop eax
and byte [eax], ch
scasb al, byte es:[edi]
lodsb al, byte [esi]
push ds
dec edx
sbb eax, dword [ebx - 0x80]
push 0xc98ffaaa
ret
mov esi, 0xbf7d48d9
lcall 0x2a93, 0x9bf6b267
inc ah
mov eax, edx
push edi
sbb ebx, dword [esi - 0x5d]
daa
imul esi, dword [ebx - 4], 0x7e
stosd dword es:[edi], eax
push edi
and bl, byte [ebx + 0x20f70816]
ret 0x4a66
Function at 0x87fd16
Capabilities:
Encode data using xor

Disassembly:
push dword [esp]
jmp 0x87fd3d
mov dword [esp + 3], ecx
pop dword [esp]
lea esp, [esp + 3]
mov byte [esp + 1], dh
lea esp, [esp + 3]
jmp 0x86a19f

Function at 0x895505
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [eax + 0xc]
neg ch
jmp 0x895749
mov edi, edx
cmc
sub esp, 0
pushal
jmp 0x895648
mov word [esp], bx
lea esp, [esp + 1]
lea esp, [esp + 8]
and edi, 0xff000000
jmp 0x8955a3
lea esp, [esp + 0x44]
and ecx, 0xff0000
sub esp, 0x10
add esp, 7
jmp 0x89554e
test dword [edi], esi
dec esi
invalid
mov ecx, edi
lea ecx, [ecx*4]
lea ecx, reloc.WINMM.dll_waveOutUnprepareHeader
mov edi, dword [ecx]
pop ecx
jmp 0x895577
xor ecx, edi
shl di, cl
btr edi, edx
call 0x8955b1
cmp byte [ebx + 0x1941ebfa], cl
lahf
punpckhdq mm3, qword [ecx + 0x66f07115]
add eax, esi
inc edx
imul ebp, ebp, 0x46f7047d
jl 0x89558a
shr edi, 0x10
and edi, esi
push ecx
jmp 0x89558f
out dx, eax
adc byte [ecx], ah
not dword [ecx - 0x15]
mov edi, 0x3c8dfa8b
mov ebp, 0
lea edi, reloc.WINMM.dll_waveOutUnprepareHeader
mov edx, dword [edi]
pop edi
jmp 0x8955fc
clc
stc
call 0x895604
pop esi
shr edi, 0x18
call fcn.0089562e
scasb al, byte es:[edi]
sub dword [ecx - reloc.WINMM.dll_waveOutUnprepareHeader], edi
dec edx
fdivr dword [edi - 0x7d9407b6]
cmp eax, 0xb5348d0c
add byte [eax], al
add byte [eax], al
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_waveOutUnprepareHeader
mov ecx, dword [esi]
pop esi
jmp 0x8955c8
and ecx, esi
push esi
mov esi, ecx
jmp 0x89561c
mov ecx, edx
bsr di, bp
shr ecx, 8
mov di, 0x7739
pushal
jmp 0x89550f

Function at 0x89562e
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 2]
jmp 0x89567d
xor ecx, edx
mov dh, 0x48
mov dl, 0x8c
push edx
neg dh
jmp 0x89571b
and edx, ebp
bswap edi
lea edi, [edx + ebx]
stc
jmp 0x89564f
lea esp, [esp + 0x14]
movzx edi, byte [edi*4 + 0x8725b0]
xor ecx, edi
and di, 0x9dd2
jmp 0x895665
xor ecx, dword [eax]
add ebx, 4
xchg dh, dl
call fcn.00895692
mov dword [eax + 0x14], edx
shl ch, 7
bswap ecx
adc cx, 0x90f6
jmp 0x8956f2
mov ecx, dword [eax + 8]
cmc
sub esp, 0xc
add esp, 5
lea esp, [esp + 3]
jmp 0x895727
mov edx, dword [eax + 0xc]
cmc
call fcn.00895731
cli
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffde
sbb byte [edi + 0x22897a1f], cl
mov byte [0x8d3f2cdd], al
and al, 4
lea esp, [esp + 4]
xor ecx, dword [ebx]
stc
lea edi, [eax + 0x10]
jmp 0x8956ac
xor ecx, edx
mov dword [eax + 0x18], ecx
lea edx, [esp + eax]
jmp 0x895702
Function at 0x89564a
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [eax + 0xc]
neg ch
jmp 0x895749
mov edi, edx
cmc
sub esp, 0
pushal
jmp 0x895648
mov word [esp], bx
lea esp, [esp + 1]
lea esp, [esp + 8]
and edi, 0xff000000
jmp 0x8955a3
lea esp, [esp + 0x44]
and ecx, 0xff0000
sub esp, 0x10
add esp, 7
jmp 0x89554e
test dword [edi], esi
dec esi
invalid
mov ecx, edi
lea ecx, [ecx*4]
lea ecx, reloc.WINMM.dll_waveOutUnprepareHeader
mov edi, dword [ecx]
pop ecx
jmp 0x895577
xor ecx, edi
shl di, cl
btr edi, edx
call 0x8955b1
cmp byte [ebx + 0x1941ebfa], cl
lahf
punpckhdq mm3, qword [ecx + 0x66f07115]
add eax, esi
inc edx
imul ebp, ebp, 0x46f7047d
jl 0x89558a
shr edi, 0x10
and edi, esi
push ecx
jmp 0x89558f
out dx, eax
adc byte [ecx], ah
not dword [ecx - 0x15]
mov edi, 0x3c8dfa8b
mov ebp, 0
lea edi, reloc.WINMM.dll_waveOutUnprepareHeader
mov edx, dword [edi]
pop edi
jmp 0x8955fc
clc
stc
call 0x895604
pop esi
shr edi, 0x18
call fcn.0089562e
scasb al, byte es:[edi]
sub dword [ecx - reloc.WINMM.dll_waveOutUnprepareHeader], edi
dec edx
fdivr dword [edi - 0x7d9407b6]
cmp eax, 0xb5348d0c
add byte [eax], al
add byte [eax], al
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_waveOutUnprepareHeader
mov ecx, dword [esi]
pop esi
jmp 0x8955c8
and ecx, esi
push esi
mov esi, ecx
jmp 0x89561c
mov ecx, edx
bsr di, bp
shr ecx, 8
mov di, 0x7739
pushal
jmp 0x89550f

Function at 0x8acc1e
Capabilities:
Encode data using xor

Disassembly:
call 0x8accc5
pop edi
fmul dword [esi + 0x29]
fsubr dword [esi - 0x4d]
xor eax, 0x833fcca5
movsb byte es:[edi], byte [esi]
xlatb
or dword ds:[eax - reloc.WINMM.dll_waveOutUnprepareHeader], ebp
adc byte [ecx + 8], ah
jne fcn.008acca9
add eax, esi
lodsd eax, dword [esi]
sbb ch, byte [esi + 0x3e4415a]
cdq
fcomp dword [edi]
fimul word [ebx + 0x42]
and edx, dword [ecx - reloc.WINMM.dll_waveOutUnprepareHeader]
or ch, byte [eax - 0x6eb522c4]
xchg byte [edx], ch
sub ch, byte [ebx - 0xa7970e1]
imul eax, dword [esi + 0x34], 0xb0436a76
and al, 0x13
loop 0x8accba
jecxz 0x8acc6f
stc
dec edx
les esi, [edi - 0x81e1ec]
fsubr dword [ecx + reloc.WINMM.dll_waveOutUnprepareHeader]
pushfd
push esp
aaa
cld
mov ebx, 0xdb592fc
cmpsb byte [esi], byte es:[edi]
jge 0x8acc9b
lcall 0x8d65, 0x846d3c9c
and al, 0x85
fnsave dword [esi + 0x4d]
sahf
jns 0x8acc7b
invalid
mov dl, 0xec
enter 0xfb2, 0x7e
jmp 0x8accca
jbe 0x8acccd
loopne 0x8acd10
xchg esp, eax
sbb eax, 0x9227d48d
in al, dx
call 0x8acca2
lea esp, [esp + 7]
pop es
lea esp, [esp + 1]
xor eax, eax
call fcn.008acca4
mov bh, 0x3b
inc edi
mov word cs:[ebx + 9], gs
add byte [edi - 0xd], ch
and dword [eax + ebp*4], reloc.WINMM.dll_waveOutUnprepareHeader
push ebp
dec eax
mov edi, 0x6117d343
lodsb al, byte [esi]
imul edi, dword [edi - reloc.WINMM.dll_waveOutUnprepareHeader], 0xffffffe7
jo 0x8accde
popal
in eax, 5
les esp, [edx + 0x51]
rcl byte [esp - 0x7b]
or dword [ecx - 0x16], ebp
outsb dx, byte [esi]
xor eax, 0xcf6528a4
lodsd eax, dword [esi]
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
mov dl, 0x32
cld
xor al, 0x3d
arpl word [edi - 0x51], cx
mov eax, dword [reloc.WINMM.dll_waveOutUnprepareHeader]
jge 0x8acd43
pop esi
hlt
Function at 0x996b9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
lea esp, [esp + 1]
lea esp, [esp + 0x2c]
pushal
neg ah
rdtsc
jmp 0x996bb7
add esp, 0x27
add esp, 0
pushal
sub esp, 0xe
push word [esp + 0x21]
pop dword [esp + 0xd]
jmp 0x996b60
push esp
jmp 0x996b7e
btr ebx, edx
mov ecx, dword [esp]
sub esp, 8
btc ecx, edi
lea ebp, [ebp*4]
jmp 0x996cf7
xor dl, ch
add edi, ebp
mov esi, dword [esp]
mov dx, 0xe21d
btr eax, edx
neg dh
jmp 0x996b9e
push dword [esp + 4]
neg ebp
xchg si, di
mov bp, di
add esp, 7
xchg dword [esp], esi
jmp 0x996be9
xor eax, esi
cpuid
mov dh, byte [esp + 5]
push edx
mov bp, 0x57cd
pop di
jmp 0x996c02
inc ebx
clc
mov byte [esp + 5], ch
sub bp, 0x4df8
inc edi
setbe ah
jmp 0x996c25
mov edx, 0xc7c62f0a
xchg ebp, ebx
lea esp, [esp + 1]
mov bh, byte [esp]
rdtsc
mov word [esp], sp
jmp 0x996c84

Function at 0x996d99
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
not edx
bsf di, ax
mov si, 0x20ed
bswap ebp
lea ebx, [ecx + 0x43]
jmp 0x996d83
mov ax, word [esp + 0x15]
sub esp, 0x18
mov word [esp + 0x1d], sp
mov cx, dx
mov ch, byte [esp + 0x26]
pop dword [esp + 0x15]
jmp 0x996d51
xchg dword [esp + 0x14], eax
inc dl
mov dl, dh
pop cx
pop bx
push esp
jmp 0x996db9
bswap edi
jmp 0x996d69
neg ebp
pop dword [esp + 0xa]
xchg byte [esp + 0xe], cl
mov dword [esp + 0x1b], ebp
pop word [esp + 0x11]
cpuid
jmp 0x996e1d
xchg byte [esp + 4], al
mov ecx, dword [esp + 0x10]
pop word [esp + 0x1d]
cpuid
mov byte [esp + 0x23], ah
push word [esp]
jmp 0x996d9d
xchg byte [esp + 0xc], cl
mov di, 0x2885
lea ebx, [ecx - 0x1b]
add esp, 0x17
jmp 0x996ded
mov dl, 0xcc
btr ebp, esp
lea eax, [eax*4]
lea ebx, [esi + edi]
bswap ecx
xchg ah, bl
jmp 0x996e06
Function at 0x99b6dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ax, cx
lea esi, [ebx*4]
mov bl, bh
bswap ecx
sub esp, 6
jmp 0x99b745
add esp, 6
mov byte [esp + 1], ah
cpuid
rdtsc
and cl, bh
xchg ebx, edi
jmp 0x99b6ac
mov byte [esp + 5], bh
xchg ebx, ecx
pop word [esp + 4]
jmp 0x99b6c4
mov ax, sp
pop edi
lea eax, [esp + ebp]
inc ax
push dword [esp + 0x15]
mov dword [esp + 4], ebp
jmp 0x99b788
mov byte [esp + 3], ah
pop word [esp + 3]
pop word [esp + 2]
push word [esp]
add cx, 0x92b6
pushal
jmp 0x99b725
mov bl, bh
and dx, 0x7382
pop dword [esp + 3]
btr eax, esp
bsr cx, cx
add ebp, ebp
jmp 0x99b771

Function at 0x99b94b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x99b9b3
xchg edi, edx
not edi
cld
xchg byte [esp + 4], cl
pop bp
push edx
jmp 0x99b98a
bswap edi
rdtsc
bswap ecx
rdtsc
mov di, 0x4f1d
stc
jmp 0x99b94d
Function at 0x99bc86
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, ecx
xchg bp, di
rdtsc
lea ebx, [ecx*4]
jmp 0x99bd0d
mov cx, 0x5f31
mov ch, byte [esp + 5]
cpuid
lea edx, [eax + edi]
xchg word [esp + 0xd], di
jmp 0x99bcd8
mov byte [esp + 0x14], ah
lea edi, [ecx + 0xcb]
xor bp, 0xeb34
jmp 0x99bcf1
neg bp
and cl, bh
xchg word [esp + 7], ax
bsf si, ax
push word [esp + 0xd]
mov si, 0x80af
jmp 0x99bcbf
xchg word [esp + 0x1b], ax
mov ah, byte [esp + 0xd]
pop dword [esp + 0x14]
mov al, 0x5e
mov ebp, ecx
jmp 0x99bd3d
mov ebp, 0x2feb30a
push dword [esp + 0xe]
xchg ebx, eax
bsr ax, cx
add al, dh
btc ebx, edi
jmp 0x99bc96
bsr cx, bp
pop word [esp + 0xd]
popal
xchg bh, cl
cld
jmp 0x99bd6b
mov esi, 0xd6b0440c
rdtsc
neg ebx
push esp
mov word [esp], bx
setno bh
jmp 0x99bd26
mov edi, dword [esp]
not si
mov dl, dh
lea ebp, [edx + edx]
setle ch
mov bl, 0xf0
jmp 0x99bdcc
mov ebx, 0xe527a678
mov ecx, 0x46da2840
setp ah
neg edi
mov bx, word [esp]
ror bh, 3
jmp 0x99bd50
mov cx, bx
mov ebx, dword [esp]
lea ebx, [esp + ebp]
xchg ah, bl
xor ebp, esi
rdtsc
jmp 0x99be0c
mov cx, 0x5639
mov cx, word [esp]
mov edx, dword [esp]
mov bl, byte [esp]
jmp 0x99bde5
mov bx, word [esp]
not bh
btr esi, esp
mov bl, byte [esp]
mov edi, 0x7a8f82d4
lea edi, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x99bda5
mov cl, byte [esp]
bsr si, cx
mov ebx, ecx
lea esi, [esp + ecx]
lea eax, [edx + edi]
bswap edi
jmp 0x99be61
not edi
neg bp
lea edx, [edi + edi]
btc edi, ebx
cpuid
setae ch
jmp 0x99bdb6
setp ah
mov al, byte [esp]
lea edi, [eax*4]
lea esi, [ebp - 0x8f]
mov ebx, 0x7657c9ba
mov ebx, ebp
jmp 0x99be91
rdtsc
mov esi, dword [esp]
mov dl, dh
rdtsc
xor dl, ch
not ebx
jmp 0x99be3d
cld
neg ch
mov ebp, 0x5a7b9aea
mov di, word [esp]
rdtsc
add al, dh
jmp 0x99bea7
rcr bh, 3
lea ebp, reloc.WINMM.dll_waveOutUnprepareHeader
not bx
inc dl
rdtsc
mov cx, word [esp]
jmp 0x99be70
mov bp, di
mov esi, ecx
neg esi
xchg dh, al
bsr cx, cx
mov al, 0x76
jmp 0x99bebd
lea ebp, reloc.WINMM.dll_waveOutUnprepareHeader
setge ch
mov di, word [esp]
mov al, 0xe
jmp 0x99c114
bsr dx, bp
mov ah, byte [esp]
mov byte [esp], dh
xchg esi, edx
call int.0099bf55
mov eax, 0xfcedf29b
add esp, 0
mov si, word [esp]
mov ebp, 0x9c1cee94
neg di
xchg ecx, edi
jmp 0x99beeb
inc ax
rdtsc
shl si, cl
setg ah
cpuid
mov ecx, dword [esp]
jmp 0x99bf01
mov byte [esp], bh
mov al, 0x6e
mov byte [esp], dh
rcr bh, 3
neg ebp
lea edx, [edx + edi]
jmp 0x99bf19
setns bh
btc edi, edi
shr eax, 0xf
and bp, 0x67a
add esp, 1
mov ah, byte [esp]
jmp 0x99bfae
stc
pop si
lea edx, [esp + ebx]
mov ax, dx
mov dx, word [esp]
xchg di, cx
jmp 0x99c033
mov edx, dword [esp]
mov edi, 0x52abe296
xchg ch, dl
push edx
xor dl, ch
stc
jmp 0x99c071