joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ebx, dword [esp + 0x20]
mov eax, dword [sym.imp.libLLVM_17.dll_vtable_for_llvm::cl::Option]
add eax, 8
mov dword [ecx], eax
mov word [ecx + 4], 0
movzx eax, word [ecx + 6]
and eax, 0xffff8000
or eax, 1
mov word [ecx + 6], ax
lea ebp, [ecx + 0x30]
xorps xmm0, xmm0
movups xmmword [ecx + 8], xmm0
movups xmmword [ecx + 0x14], xmm0
mov dword [ecx + 0x24], ebp
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 1
lea eax, [ecx + 0x48]
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], 1
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
call fcn.0043bd02
mov edi, eax
mov ecx, dword [esi + 0x28]
lea eax, [ecx + 1]
cmp eax, dword [esi + 0x2c]
ja 0x42a6aa
mov eax, dword [esi + 0x24]
mov dword [eax + ecx*4], edi
inc dword [esi + 0x28]
xorps xmm0, xmm0
movups xmmword [esi + 0x4c], xmm0
movups xmmword [esi + 0x55], xmm0
mov dword [esi], 0x440030
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov eax, dword [sym.imp.libLLVM_17.dll_vtable_for_llvm::cl::parser_unsigned_int_]
add eax, 8
mov dword [esi + 0x74], eax
lea eax, [esi + 0x78]
mov dword [esi + 0x78], 0x440064
mov dword [esi + 0x88], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
and eax, 0x1f
shl eax, 9
or word [esi + 6], ax
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
mov dword [esp], ebx
mov dword [esp + 4], eax
sub esp, 8
movsd xmm0, qword [esp + 8]
movsd qword [esp], xmm0
mov ecx, esi
call fcn.0043bd2c
mov eax, dword [esp + 0x24]
movsd xmm0, qword [eax]
movsd qword [esi + 0x14], xmm0
mov eax, dword [esp + 0x28]
movsd xmm0, qword [eax]
movsd qword [esi + 0x1c], xmm0
mov ecx, esi
call fcn.0043bd14
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
lea ecx, [esi + 0x24]
push 4
push eax
push ebp
call fcn.0043bc84
mov ecx, dword [esi + 0x28]
jmp 0x42a600
Function at 0x435620
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
mov esi, dword [esi]
mov ebx, dword [esi]
mov dword [edi + 0x4c], ebx
mov byte [edi + 0x58], 1
mov esi, dword [esi]
mov dword [edi + 0x54], esi
mov edx, dword [edx]
movzx esi, word [edi + 6]
shl edx, 5
and edx, 0x60
and esi, 0xffffff9f
or esi, edx
mov word [edi + 6], si
movsd xmm0, qword [ecx]
movsd qword [edi + 0x14], xmm0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x435749
mov ebx, dword [eax]
lea eax, [ecx + ecx*4]
lea eax, [ebx + eax*4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
add eax, 0x64
mov dword [esp + 0xc], eax
nop dword [eax + eax]
mov esi, dword [ebx]
mov dword [esp + 0x14], esi
mov ebp, dword [ebx + 4]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 8]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x43dad8
mov byte [esp + 0x38], 1
mov dword [esp + 0x34], edx
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 1
mov ecx, dword [esp + 0xc]
call fcn.00435760
sub esp, 8
mov esi, dword [esp + 0x50]
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x68]
lea edi, [edx + edx*8]
lea edi, [edi + edi*2]
add edi, edx
movups xmm0, xmmword [eax]
movups xmmword [ecx + edi], xmm0
mov dword [ecx + edi + 0x10], 0x43dae8
mov edx, dword [eax + 0x14]
mov dword [ecx + edi + 0x14], edx
movzx eax, byte [eax + 0x18]
mov byte [ecx + edi + 0x18], al
mov dword [ecx + edi + 0x10], 0x43dad8
inc dword [esi + 0x68]
mov eax, dword [esi + 0x60]
mov dword [esp + 0x1c], ebp
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
movsd xmm0, qword [esp + 0x18]
movsd qword [esp + 4], xmm0
mov dword [esp], eax
call fcn.0043bcf6
add ebx, 0x14
cmp ebx, dword [esp + 0x10]
jne 0x435690
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436560
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x436571
jmp dword [eax*4 + 0x440d08]
cmp dword [0x4460ac], 0
je 0x436673
push 0x4460b0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4460c8]
test edi, edi
je 0x436668
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4365bb
mov edi, dword [edi + 8]
test edi, edi
je 0x436668
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x4365b0
test esi, esi
je 0x4365b0
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x4365b0
cmp dword [0x4460ac], 0
jne 0x4365f0
push 0x4460b0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4460ac], 1
jmp case.default.0x436571
call fcn.00435e50
jmp case.default.0x436571
cmp dword [0x4460ac], 0
je case.default.0x436571
push 0x4460b0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4460c8]
test edi, edi
je 0x4366c3
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x436647
mov edi, dword [edi + 8]
test edi, edi
je 0x4366c3
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x436640
test esi, esi
je 0x436640
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x436640
push 0x4460b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4460ac]
cmp eax, 1
jne case.default.0x436571
mov eax, dword [0x4460c8]
test eax, eax
je 0x4366a2
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x436690
mov dword [0x4460c8], 0
mov dword [0x4460ac], 0
push 0x4460b0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x436571
push 0x4460b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x436800
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x43d004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x436866
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x436866
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x436866
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x436866
mov edx, dword [esp + 0xc]
sub edx, dword [0x43d004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x436856
add esi, 0x28
dec ecx
je 0x436866
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x436850
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x436850
mov eax, esi
pop esi
pop edi
ret
Function at 0x3e4c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x3e4c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x3e4c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3e4c06a
add dl, dl
jne 0x3e4c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3e4c0dc
xor eax, eax
add dl, dl
jne 0x3e4c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3e4c17d
add dl, dl
jne 0x3e4c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3e4c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3e4c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3e4c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x3e4c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x3e4c075
mov eax, 1
add dl, dl
jne 0x3e4c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3e4c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3e4c0e1
sub eax, ebx
mov ebx, 1
jne 0x3e4c128
mov ecx, 1
add dl, dl
jne 0x3e4c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x3e4c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3e4c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3e4c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x3e4c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x3e4c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3e4c136
cmp eax, 0x7d00
jae 0x3e4c16d
cmp eax, 0x500
jb 0x3e4c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3e4c075
cmp eax, 0x7f
ja 0x3e4c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3e4c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x3e4c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x3e4c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x7f9a8a
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax + 0x14], reloc.WINMM.dll_midiStreamOut
push word [esp + 5]
mov dword [esp + 0x11], esi
lea esp, [esp + 2]
lea esp, [esp + 0x20]
mov dword [eax + 0x10], 0x98badcfe
jmp 0x7f984d
mov dword [eax + 8], reloc.WINMM.dll_midiStreamOut
mov dword [eax + 0xc], 0xefcdab89
pushal
mov dword [esp + 0xb], esi
jmp 0x7f9879
lea esp, [esp + 4]
mov dword [eax], 0
push edx
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x7f98a3
mov word [esp], di
mov dword [esp], eax
mov byte [esp + 2], ch
jmp 0x7f98e9

Function at 0x91b6b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
and cl, bh
stc
mov al, ah
pop dx
sub esp, 0xc
pop dword [esp + 3]
jmp 0x91b69c
add esp, 9
add esp, 0xe
clc
xchg byte [esp], al
inc bx
bswap ebx
jmp 0x91b61e
pop edx
rdtsc
btr ebp, edx
mov di, 0xc8c7
bswap edi
mov cl, 0x92
jmp 0x91b642
mov ebx, ebp
inc ebx
mov ch, byte [esp + 3]
bswap ecx
inc cx
mov dl, 0x1c
jmp 0x91b710
pop bx
mov ebx, dword [esp + 6]
mov ecx, esi
mov dx, word [esp + 6]
cpuid
xchg edx, edi
jmp 0x91b66e
setae ah
btr edi, edx
mov dword [esp], ecx
lea eax, [edx*4]
xchg ah, bl
jmp 0x91b685
not ax
pop word [esp + 0xb]
mov di, 0x1941
mov dword [esp + 0x13], ecx
jmp 0x91b65e
mov bp, 0x22e5
mov eax, 0x67646852
mov di, 0xb1b5
pushal
lea eax, [ecx - 0xcb]
popal
jmp 0x91b725
mov ecx, dword [esp + 3]
cpuid
mov ebp, dword [esp + 6]
rcr bh, 3
mov edi, ebp
xchg ah, bl
jmp 0x91b6c7
neg ah
xchg dword [esp], eax
xchg byte [esp + 4], dl
bswap ebp
setno bh
push word [esp + 3]
jmp 0x91b6f0
xchg dh, al
xchg byte [esp + 6], dl
mov si, 0xc54f
inc ebp
inc bx
xchg ah, bl
jmp 0x91b89d
mov ecx, 0x37eba240
pop edi
lea ebp, [eax - 0x51]
xor dx, 0xd694
shr bh, 3
add esp, 7
jmp 0x91b82b
sub esp, 8
btr ebx, esp
bswap edx
sub esp, 0x18
mov byte [esp + 0x25], bh
mov ebp, dword [esp + 0x12]
jmp 0x91b762
pop word [esp + 0x19]
call fcn.0091b79e
lea edx, [ebp*4]
mov byte [esp + 0x19], bh
bswap ebx
lea eax, [ebp + 0x37]
popal
jmp 0x91b80e
rdtsc
stc
xchg byte [esp + 0xc], dl
pop bx
sub esp, 2
mov ebp, 0x52081a8c
jmp 0x91b7b4
neg ebp
push edx
lea eax, [ebx + esi]
pop ax
pop bp
pushal
jmp 0x91b855
inc dl
xchg byte [esp], dl
mov byte [esp], dh
bswap eax
mov bx, word [esp]
lea esp, [esp + 1]
jmp 0x91b7e8
neg ah
mov dword [esp + 1], esi
push esp
pop word [esp + 0x11]
mov cl, ch
lea ecx, [ebx + edi]
jmp 0x91b7d5
mov di, dx
xchg edx, edi
xchg byte [esp + 0xa], bl
mov dword [esp + 0x18], esi
xchg byte [esp + 0x18], al
btc ecx, edi
call fcn.0091b7f5
lea esp, [esp + 1]
call fcn.0091b99f
adc cl, byte [edi + 0x3e897a1f]
mov eax, 0x20d1b620
xchg edi, eax
invalid
mov cl, ch
mov bp, dx
not cx
mov dx, sp
lea ebx, [eax + edx]
inc dl
jmp 0x91b789
Function at 0x91bc5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 6], bl
mov eax, dword [esp + 3]
jmp 0x91bf92
xchg dword [esp + 8], edx
bswap ecx
pushal
lea esp, [esp + 0x11]
mov ebp, dword [esp + 0xd]
stc
mov al, 0xe
jmp 0x91bcb0
neg eax
mov dl, byte [esp]
mov ebx, dword [esp]
add al, dh
mov cl, 0x12
mov di, 0xfb6f
jmp 0x91bcc7
bsf bx, ax
bsr bx, bp
rdtsc
mov cl, ch
pop ax
lea esi, reloc.WINMM.dll_midiStreamOut
jmp 0x91bcef
pop ebp
inc edx
lea ecx, reloc.WINMM.dll_midiStreamOut
pop edx
bsr ax, cx
pop edx
jmp 0x91bd44
mov byte [esp + 5], dh
xchg dword [esp + 0xa], ecx
pop eax
mov ebp, dword [esp + 0xd]
bswap ebx
lea ebp, reloc.WINMM.dll_midiStreamOut
jmp 0x91be3e
Function at 0x91c58b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 9]
mov byte [esp + 0x23], ch
lea edi, [eax + 0xb1]
jmp 0x91c551

Function at 0x92022f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, 0x7a8c732
mov ebp, 0xfb56273a
mov bx, word [esp]
lea ebx, reloc.WINMM.dll_midiStreamOut
bsr bp, cx
jmp 0x9201f5
rdtsc
cmc
mov dx, 0x8a45
rdtsc
mov ebp, dword [esp]
cpuid
jmp 0x9201c7
lea eax, [eax*4]
mov cx, word [esp]
xchg di, bp
bswap ebx
setp ah
neg edi
jmp 0x92024b
lea esp, [esp + 0x41]
cmc
lea ecx, [esp + edi]
neg bh
clc
mov dx, word [esp]
jmp 0x9201e5
push dword [esp + 6]
jmp 0x920213
setl ch
mov ebp, dword [esp]
sub esp, 0x1a
sub esp, 4
bswap esi
xchg ebx, eax
jmp 0x920353
inc bl
lea edx, [ebx*4]
xchg ebp, esi
lea esi, [edi*4]
xchg si, cx
jmp 0x920235
bsf si, ax
mov ebx, eax
mov di, 0x6e29
lea eax, [ecx + edi]
xchg dh, al
mov edx, ecx
jmp 0x9202dc
mov cx, word [esp + 0x12]
lea esi, [edx*4]
sub esp, 2
inc bp
inc esi
setle ch
jmp 0x920280
btr ebx, edx
not di
lea ebp, [ebx*4]
lea ebx, [esp + esi]
cmc
inc esi
jmp 0x920323
bswap ebp
xor dl, ch
push word [esp + 0xf]
neg edi
bswap ecx
pop dword [esp + 2]
jmp 0x9202b5
mov cx, 0xc903
cld
cpuid
pop ax
mov dword [esp + 7], esi
mov bx, 0xd2b9
jmp 0x92029e
bsf bp, si
add esp, 0xd
cpuid
lea edx, [esi + edi]
xchg edi, esi
push word [esp + 9]
jmp 0x92033d
xchg dh, al
setge dh
xchg si, di
lea esi, [esi + 0xb5]
mov cx, word [esp + 0x10]
xor bx, 0xb4ec
jmp 0x920309
mov edi, esi
pushal
cpuid
pop dword [esp + 0x18]
push dword [esp + 0xc]
sub esp, 0x1c
jmp 0x92038d
xchg dx, ax
pop dword [esp + 0x10]
xchg dword [esp + 0xa], ebx
bswap edi
clc
mov bx, word [esp + 0x14]
jmp 0x9202f6
lea eax, [ecx*4]
bswap eax
mov dx, sp
call fcn.009203a0
xor byte [edx + 0x40a25730], ah
jb 0x920367
ja 0x920394
loope 0x92038a
mov byte [eax], bl
mov gs, ecx
sbb byte [edi - 0x72e81b0b], bh
and al, 0x49
cmc
in al, 0x17
lea esp, [esp + 0x49]
cld
bsf ax, si
neg ah
bswap esi
mov esp, 0xfdcf6c6
into
bsr cx, bp
jmp 0x920367
Function at 0x9205c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
setge dh
add esp, 2
xchg bh, cl
mov ebx, ebp
rdtsc
jmp 0x920517
pushal
xchg bh, cl
sete ah
lea esp, [esp + 0x1d]
pop esi
lea esp, [esp + 1]
jmp 0x92048b
xchg ch, dl
xor dl, ch
push word [esp]
push word [esp + 3]
jmp 0x920500
lea eax, [edi*4]
xchg byte [esp], al
inc ebp
mov bp, sp
mov ah, byte [esp]
sub esp, 2
jmp 0x9204ba
xchg dword [esp], eax
lea esp, [esp + 2]
mov edx, dword [esp + 1]
mov si, word [esp + 4]
bsr dx, cx
jmp 0x92052f
bsf ax, si
lea esi, [ebp - 0xbf]
mov al, ah
btc eax, edi
jmp 0x9204e6
and di, 0xeec2
lea ebx, reloc.WINMM.dll_midiStreamOut
sub ebp, eax
rdtsc
mov dh, byte [esp]
bsr dx, cx
jmp 0x9204d0
mov ax, 0x1087
pop di
mov bx, sp
add esp, 2
sub esp, 2
xchg ch, dl
jmp 0x92059b
mov dword [esp], ebp
mov ebx, dword [esp + 1]
ror eax, 0x11
bsf di, si
mov word [esp + 2], bx
mov word [esp + 2], di
jmp 0x9204a9
xchg dx, di
btr ebp, edx
mov edx, 0xe019b492
bsr bx, bp
cpuid
mov ax, word [esp + 1]
jmp 0x920974
lea edi, [edx*4]
sub bl, ah
neg dx
xchg word [esp], bx
xchg ecx, edi
mov word [esp], bx
jmp 0x920571
jmp 0x920554
lea esp, [esp + 1]
and eax, ecx
bsf si, si
not ah
pop di
xchg esi, eax
call fcn.00920617
xchg esi, edx
and edx, ecx
neg ah
lea ebx, [eax + edi]
ror edi, 0x19
cld
jmp 0x9209c9
lea ebx, [eax - 0xf9]
mov si, 0xc061
add esp, 0
mov esi, ecx
jmp 0x920a14
lea esp, [esp + 1]
mov dx, word [esp]
neg eax
lea edx, [ecx + ebx]
xchg edi, eax
jmp 0x920998
inc bl
not bp
sub esp, 0x12
pop dword [esp + 4]
sub esp, 0x16
mov ax, word [esp + 0x23]
jmp 0x920a5a
btr ecx, esp
mov al, 0xe
xchg dh, al
mov bl, bh
mov byte [esp], ch
mov byte [esp], dh
jmp 0x9209f6
mov word [esp + 0x16], dx
setno ah
xchg ecx, eax
bsr cx, cx
jmp 0x920aa0
xor bx, 0x1aa4
push word [esp + 0x1d]
cpuid
mov byte [esp + 1], dh
jmp 0x920a44
mov ebx, dword [esp]
mov cl, ch
rdtsc
and bx, 0x97ba
mov ax, word [esp]
bswap ebp
jmp 0x920aee
pop word [esp + 0x1d]
lea ebp, reloc.WINMM.dll_midiStreamOut
pushal
lea esp, [esp + 0x45]
mov bl, 0x20
bsf bx, si
jmp 0x920a83
sub esp, 2
mov word [esp], dx
cld
mov di, word [esp]
bsr si, bp
cpuid
call fcn.00920ad1
Function at 0x920617
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov ch, byte [esp + 2]
lea esi, [ebx*4]
add esp, 4
xor si, 0x51b4
mov bl, 0xb8
jmp 0x920601
bswap ebp
push dword [esp + 2]
mov edx, ecx
shr esi, 7
add esp, 3
xchg byte [esp], cl
jmp 0x9205c6
xchg ch, dl
mov dl, 0x44
cpuid
lea eax, [eax - 0x91]
mov byte [esp], ch
stc
jmp 0x920926
jmp 0x9205ee
mov al, ah
sub esp, 0x16
pop dx
mov dword [esp + 8], eax
bsf di, si
jmp 0x92067a
cld
btc ebp, edi
sub ax, 0x47c8
bswap ebp
lea ebp, [edx*4]
mov cl, ch
jmp 0x920619
cmc
mov bh, byte [esp]
xchg byte [esp], cl
cpuid
mov eax, 0xca3f9a3e
bsf ax, si
jmp 0x920634
push dword [esp + 1]
xchg word [esp + 0x18], si
not ebx
jmp 0x920730
lea edi, [edi*4]
lea ecx, [eax*4]
sub esp, 0x1c
jmp 0x920664
lea edi, [eax*4]
mov dx, sp
mov dh, byte [esp]
lea ebx, reloc.WINMM.dll_midiStreamOut
mov byte [esp], dh
cmc
jmp 0x920650
mov cl, 0x12
call fcn.009206d8
push ebx
invalid
add dx, 0x4c56
setns ah
lea eax, [edx + ebx]
rdtsc
xchg cx, si
mov cx, bx
jmp 0x9206aa
add esp, 0x18
mov bp, word [esp + 0x13]
pushal
mov bp, dx
push word [esp + 0x21]
lea esp, [esp + 0x41]
jmp 0x9206c3
lea edi, reloc.WINMM.dll_midiStreamOut
xchg byte [esp + 0x10], cl
xchg edx, edi
push word [esp + 0x27]
mov dx, 0x31a3
shr edx, 0x17
jmp 0x9206ee
btr edx, edx
bswap edi
shl ax, cl
xchg ch, dl
sete ah
bsf bp, si
jmp 0x920691
Function at 0x9206d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bh
shr bh, 3
xchg dword [esp], edx
push word [esp + 1]
mov eax, ecx
jmp 0x920705
mov eax, 0x46847c3c
add esp, 1
mov dword [esp], eax
sub esp, 2
mov si, sp
mov word [esp + 2], bx
jmp 0x920845
cmc
mov dword [esp + 5], ecx
pop word [esp]
neg eax
pop dword [esp]
bsr bp, cx
jmp 0x9207a5
lea ebx, [esp + esi]
push dword [esp + 0xe]
mov byte [esp + 0xb], ah
bsf dx, si
add esp, 8
lea edi, [edi*4]
jmp 0x92074a
xchg dword [esp], edx
bsf ax, ax
not ah
btc ebp, edi
pushal
mov esi, 0xfef84c8c
jmp 0x9207d4
push word [esp]
inc cx
mov esi, ebp
bswap ebx
bswap edi
ror eax, 0x1f
jmp 0x920789
push word [esp + 0xb]
cpuid
xchg word [esp + 0x17], ax
neg ebx
push edx
push word [esp + 0x27]
jmp 0x92080a
pop esi
cpuid
mov cl, ch
rdtsc
mov ebx, dword [esp + 3]
shr edi, 0x15
jmp 0x9207b6
lea eax, [esp + esi]
not dh
mov bp, word [esp + 5]
lea edx, [ebx*4]
mov bp, bx
mov bh, byte [esp + 0xb]
jmp 0x92076e
lea esp, [esp + 2]
popal
sub esp, 2
xchg ch, dl
bswap ecx
xchg bh, cl
jmp 0x920883
mov dword [esp + 3], ecx
sub esp, 0xa
inc bx
pop dword [esp + 6]
xchg dh, al
not bh
jmp 0x9207ed
pop di
xchg word [esp], bx
push dword [esp]
rol cx, cl
rdtsc
add al, dh
jmp 0x920822
mov eax, dword [esp + 1]
pop bp
mov cx, sp
pop di
xor dl, ch
mov edx, 0xf9ecfd90
jmp 0x920909
xchg dword [esp], esi
pop ebp
lea ecx, reloc.WINMM.dll_midiStreamOut
xchg byte [esp + 2], cl
mov ebp, 0x303d0fc6
bsr bx, cx
jmp 0x920857
add ebp, ebp
cmc
push edx
mov ax, 0x9f35
setle dh
mov bl, bh
jmp 0x9208ea
lea esi, [eax + 0xb1]
mov ax, word [esp]
inc si
xchg esi, ebx
mov al, ah
mov ebx, 0x926db2c2
jmp 0x92089c
lea esp, [esp + 1]
sub bl, ah
call fcn.00920959
sub byte [edi + 0x38b14227], dh
sub al, byte [ebp - 0xc]
out 0xe, eax
btr ebp, esp
xchg edx, ebp
mov esi, dword [esp + 2]
add esp, 2
xchg byte [esp], dl
rdtsc
jmp 0x9208d4
pop cx
lea esp, [esp]
lea ecx, [esi*4]
mov ax, sp
mov bp, dx
mov esi, dword [esp]
jmp 0x9208bd

Function at 0x920a3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dl, ch
mov word [esp + 5], sp
mov edx, 0xe6efa04c
add esp, 7
setne bh
lea eax, [esi*4]
jmp 0x920989
rdtsc
mov ebp, 0x48dcfda2
pop dword [esp]
neg edx
push dword [esp]
lea ebp, reloc.WINMM.dll_midiStreamOut
jmp 0x9209ae
push dword [esp + 4]
xchg byte [esp + 2], bl
jmp 0x9209df
Function at 0x920b14
Capabilities:
Execute anti-debugging instructions

Disassembly:
setp ah
mov edx, 0x7104b6fe
call 0x920b14
push 0xffffffffffffff85
jmp 0x920b53
mov ax, word [esp]
bsf si, ax
rol bx, cl
xchg ebp, edx
jmp 0x920c53
mov edx, 0xc35cfeac
cpuid
setns bh
mov eax, dword [esp + 3]
btr eax, edx
xchg dword [esp + 4], eax
jmp 0x920b3d
not ch
mov esi, 0xc9638fca
rdtsc
lea edi, [eax*4]
sub esp, 0x1c
pop cx
jmp 0x920c05
rdtsc
ror dh, 7
add esp, 1
xchg ebp, esi
xchg dh, al
rdtsc
jmp 0x920b92
sub esp, 0xe
cpuid
pop dword [esp]
mov al, 0x7e
lea esp, [esp + 0xd]
pop ecx
jmp 0x920bae
cpuid
xchg word [esp + 7], cx
stc
lea ebx, reloc.WINMM.dll_midiStreamOut
neg ebx
xchg ebp, eax
jmp 0x920c1b
xchg word [esp + 0xa], ax
xchg ecx, edi
xchg byte [esp + 0xc], al
mov dword [esp + 0xd], ecx
add al, dh
btc edi, edi
jmp 0x920bdf
add esp, 0x13
sub bl, ah
mov cl, 0x22
xchg dword [esp + 2], esi
rdtsc
not bh
jmp 0x920c85
mov edi, ecx
mov ecx, 0xc18896c4
mov esi, 0x9a3f8982
xchg dword [esp + 2], ebx
rcr bh, 3
cpuid
jmp 0x920bce
mov ebx, dword [esp + 7]
cmc
clc
inc eax
mov word [esp + 3], di
mov edx, 0xffc2634e
jmp 0x920c31
mov word [esp + 0xe], dx
xchg ah, bl
pop word [esp + 1]
call fcn.00920ce9
mul dword [esi - 0xc]
xchg ebx, eax
outsb dx, byte [esi]
lahf
add ebx, dword [ebx + reloc.WINMM.dll_midiStreamOut]
jle 0x920cce
lea edx, [esp + esi]
xchg edi, eax
mov si, dx
cpuid
sub esp, 0xc
setae dh
jmp 0x920c66
imul ecx, dword [ebp - reloc.WINMM.dll_midiStreamOut], 0xffffffc1
cmpsb byte [esi], byte es:[edi]
xor ah, byte [eax - 0x5b7bcd39]
aaa
cmpsd dword [esi], dword es:[edi]
ret 0x9631

Function at 0x920de4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [esi*4]
mov bx, word [esp]
setle ah
add esp, 1
xchg byte [esp], dl
mov bl, bh
jmp 0x920e5e
xor dl, ch
xchg ch, dl
lea esp, [esp + 4]
xchg word [esp], si
mov byte [esp + 1], dh
jmp 0x920dbd
sub edi, eax
setbe bh
mov esi, dword [esp]
stc
xchg esi, ebx
mov cl, byte [esp]
jmp 0x920e45
cmc
stc
inc ebx
xchg ebx, ecx
xchg esi, edi
xchg cx, si
jmp 0x920df6
mov bx, word [esp]
mov dx, bx
mov ecx, dword [esp]
mov ah, byte [esp + 1]
pop si
mov eax, 0xb52b1224
jmp 0x920e0f
rdtsc
sub esp, 0x14
setns ch
xchg dword [esp], ebp
xchg word [esp + 7], cx
jmp 0x920f1f
rdtsc
neg ah
push word [esp + 1]
neg ch
pop bp
mov edx, 0x4ff29108
jmp 0x920e2e
neg ebx
lea ebp, [eax + 0xa9]
pushal
neg ch
push word [esp + 0xd]
mov edx, dword [esp + 3]
mov edx, 0x98f02634
mov ah, byte [esp + 0xb]
mov bp, word [esp + 4]
jmp 0x920ed6
xchg dword [esp + 0xe], ecx
mov edx, 0xc512a042
xor dl, ch
lea eax, reloc.WINMM.dll_midiStreamOut
mov ebp, dword [esp + 0x13]
xchg ecx, ebx
jmp 0x920eed