joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416ac0
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov ebx, dword [esp + 0x40]
mov eax, dword [0x47f070]
test eax, eax
je 0x416bd2
mov edi, dword [eax]
test edi, edi
js 0x416bc8
mov eax, dword [0x47f070]
test eax, eax
je 0x416be1
mov esi, dword [eax]
test esi, esi
je 0x416b84
mov eax, dword [0x47f074]
test eax, eax
je 0x416c01
mov edi, dword [eax]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov edi, eax
mov dword [esp], esi
call sym._SetLastError_4
push ecx
mov dword [esp + 0x2c], edi
test edi, edi
je 0x416b75
mov eax, edi
lea esi, [esp + 0x2c]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x416b67
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
mov dword [esp], 1
call ecx
cmp eax, 6
je 0x416b94
cmp eax, 8
jne 0x416bbc
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x416b30
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [0x47f078]
test eax, eax
je 0x416bf0
mov edi, dword [eax]
jmp 0x416b22
mov dword [ebx + 0xc], 0
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x10], eax
mov dword [esp + 0x2c], edi
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x416b7a
mov eax, esi
call sym._uw_install_context.isra.2
nop
mov eax, 3
add esp, 0x30
pop ebx
pop esi
pop edi
ret
call dbg.fc_key_init_once
jmp 0x416ae1
call dbg.__shmem_grabber_use_fc_key
mov dword [0x47f070], eax
jmp 0x416ad7
call dbg.__shmem_grabber_use_fc_key
mov dword [0x47f070], eax
jmp 0x416aee
call dbg.__shmem_grabber_fc_static
mov dword [0x47f078], eax
mov edi, dword [eax]
jmp 0x416b22
call dbg.__shmem_grabber_fc_key
mov dword [0x47f074], eax
jmp 0x416b05
Function at 0x416cec
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [0x47f070]
test eax, eax
je 0x416d8d
mov eax, dword [eax]
test eax, eax
js 0x416d83
mov eax, dword [0x47f070]
test eax, eax
je 0x416d9c
mov eax, dword [eax]
test eax, eax
je 0x416d68
mov eax, dword [0x47f074]
test eax, eax
je 0x416db9
mov edi, dword [eax]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov edi, eax
mov dword [esp], esi
call sym._SetLastError_4
push eax
mov dword [esp + 0x1c], edi
lea esi, [esp + 0x1c]
mov edx, esi
mov eax, ebx
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x416d75
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
je 0x416d7c
call sym._abort
mov eax, dword [0x47f078]
test eax, eax
je 0x416dab
mov edi, dword [eax]
jmp 0x416d46
call dbg._Unwind_ForcedUnwind_Phase2
jmp 0x416d5e
mov eax, esi
call sym._uw_install_context.isra.2
call dbg.fc_key_init_once
jmp 0x416d09
call dbg.__shmem_grabber_use_fc_key
mov dword [0x47f070], eax
jmp 0x416d03
call dbg.__shmem_grabber_use_fc_key
mov dword [0x47f070], eax
jmp 0x416d16
call dbg.__shmem_grabber_fc_static
mov dword [0x47f078], eax
mov edi, dword [eax]
jmp 0x416d46
call dbg.__shmem_grabber_fc_key
mov dword [0x47f074], eax
jmp 0x416d29

Function at 0x416dc8
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x416de8
mov dword [esp], ebx
call dbg._Unwind_SjLj_RaiseException
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov eax, dword [0x47f070]
test eax, eax
je 0x416e78
mov edi, dword [eax]
test edi, edi
js 0x416e64
mov eax, dword [0x47f070]
test eax, eax
je 0x416e88
mov esi, dword [eax]
test esi, esi
je 0x416e54
mov eax, dword [0x47f074]
test eax, eax
je 0x416ea8
mov edi, dword [eax]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov edi, eax
mov dword [esp], esi
call sym._SetLastError_4
push ecx
mov dword [esp + 0x1c], edi
lea edx, [esp + 0x1c]
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x416e6c
call sym._abort
lea esi, [esi]
mov eax, dword [0x47f078]
test eax, eax
je 0x416e98
mov edi, dword [eax]
jmp 0x416e38
call dbg.fc_key_init_once
jmp 0x416dfb
lea eax, [esp + 0x1c]
call sym._uw_install_context.isra.2
lea esi, [esi]
call dbg.__shmem_grabber_use_fc_key
mov dword [0x47f070], eax
jmp 0x416df5
call dbg.__shmem_grabber_use_fc_key
mov dword [0x47f070], eax
jmp 0x416e08
call dbg.__shmem_grabber_fc_static
mov dword [0x47f078], eax
mov edi, dword [eax]
jmp 0x416e38
call dbg.__shmem_grabber_fc_key
mov dword [0x47f074], eax
jmp 0x416e1b

Function at 0x417090
Capabilities:
Get thread local storage value

Disassembly:
push ebx
sub esp, 0x28
call sym._GetLastError_0
mov ebx, eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sym._TlsGetValue_4
push ecx
mov dword [esp], ebx
mov dword [esp + 0x1c], eax
call sym._SetLastError_4
push ebx
mov eax, dword [esp + 0x1c]
add esp, 0x28
pop ebx
ret
Function at 0x4170c0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x4170e4
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sym._GetLastError_0

Function at 0x4173cc
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov dword [ebp - 0x1c], ecx
not dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x4e
and eax, 0xfffffff0
call fcn.00417548
sub esp, eax
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov esi, str.gcc_shmem_tdm2
mov ecx, 0xe
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0xe], 0x2d
lea eax, [ebx + 0xf]
mov edi, eax
mov esi, edx
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x1c]
lea edx, [ebx + eax + 0xf]
mov cl, 0x20
mov al, 0x61
mov edi, edx
rep stosb byte es:[edi], al
mov edi, dword [ebp - 0x1c]
add edi, 0x2f
mov byte [ebx + edi], 0
mov esi, dword [ebp - 0x1c]
mov byte [ebx + esi + 0xe], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov byte [ebx + esi + 0xe], 0x2d
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
je 0x417481
int3
mov dword [esp], ebx
call sym._FindAtomA_4
push ecx
test ax, ax
jne 0x417514
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
call sym._malloc
mov esi, eax
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [ebp - 0x20], eax
add eax, ebx
mov ecx, 0x20
mov edx, esi
shr edx, cl
and edx, 1
je 0x4174bc
mov byte [eax], 0x41
inc eax
dec ecx
jne 0x4174b0
mov dword [esp], ebx
call sym._AddAtomA_4
push edx
test ax, ax
je 0x417510
movzx eax, ax
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
mov ecx, edi
mov edx, ebx
call dbg.get_ptr_from_atom
mov ebx, eax
cmp eax, esi
je 0x41752d
mov dword [esp], esi
call sym._free
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._ReleaseMutex_4
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
push edx
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
int3
movzx eax, ax
mov edx, dword [ebp - 0x20]
add edx, 0x10
mov dword [esp], edx
mov ecx, edi
mov edx, ebx
call dbg.get_ptr_from_atom
mov ebx, eax
jmp 0x4174ee
xor eax, eax
mov edi, esi
mov ecx, dword [ebp + 0xc]
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4174ee
mov dword [esp], esi
call dword [ebp + 0x10]
jmp 0x4174ee
Function at 0x401000
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x10]
push ebx
mov ebx, eax
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._GetUserNameExW_12
sub esp, 0xc
test al, al
jne 0x401078
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xea
jne 0x401078
mov eax, dword [ebp - 0x10]
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test eax, eax
je 0x401078
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._GetUserNameExW_12
sub esp, 0xc
test al, al
jne 0x40107a
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [esi]
nop
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4011f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x34
cmp edx, 0xffffffff
je 0x401330
mov ebx, edx
mov edi, edx
mov eax, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff5
mov dword [ebp - 0x14], eax
call eax
lea ecx, [ebp - 0x10]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x401250
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x20], edx
call edx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [ebp - 0x1c], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x401243
mov edx, dword [ebp - 0x20]
call edx
mov ecx, dword [ebp - 0x18]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov esi, dword [ebp - 0x14]
sub esp, 0x20
mov dword [esp], 0xfffffff5
call esi
mov ecx, dword [ebp - 0x18]
sub esp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
mov edi, eax
mov ebx, eax
jmp 0x401208
Function at 0x4019b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401a08
cmp byte [esi + ebx - 1], 0xa
je 0x4019dc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4060a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x402480
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x36320ea7
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x238c7ffd
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x9f5851
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x9f5881
mov ebx, 0x1a323d8f
lea esp, [esp + 2]
jmp 0x9f58c0
mov bx, word [esp + 1]
xchg bh, al
setne dl
push word [esp + 1]
jae 0x9f586b
jb 0x9f591f
retf
jmp 0x9f58ed
lea esp, [esp + 4]
neg ebp
mov ah, byte [esp]
dec dh
jns 0x9f58aa
not ah
jmp 0x9f58ef
mov ah, 0x10
mov bl, 0x87
bts ax, bx
jg 0x9f58fd
jle 0x9f58fd
or bl, byte [edi + 0x17996a0f]
pushal
invalid
not ah
neg ebp
mov ax, word [esp]
lea edx, reloc.WINMM.dll_midiStreamOpen
jmp 0x9f58d1
rol ebp, 0
jmp 0x9f5906
not ax
add ebp, dword [esi]
lea ebx, [ebx*4]
not ah
jmp 0x9f5940
mov ebx, 0x1a323d8f
lea esp, [esp + 2]
jmp 0x9f58c0
lea edx, reloc.WINMM.dll_midiStreamOpen
lea edx, reloc.WINMM.dll_midiStreamOpen
jmp fcn.009f592a

Function at 0x9f5d67
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x28f50652
jmp 0x9f5de1
mov eax, dword [esp + 1]
jmp 0x9f5dd6
add esp, 0
js 0x9f5d51
mov eax, dword [esp + 1]
jmp 0x9f5dd6
mov ax, 0xe917
push ax
lea esp, [esp + 2]
jmp 0x9f5da7
mov ax, 0xe917
push ax
lea esp, [esp + 2]
jmp 0x9f5dbd
shl edx, 2
push ebx
dec eax
jbe 0x9f5df7
btc eax, edx
jmp 0x9f5676
mov edx, ebx
mov ax, bx
neg eax
jle 0x9f5d9d
jg 0x9f5d87
jmp 0x9f5dff
btc eax, edx
jmp 0x9f5676
mov eax, esp
mov al, byte [esp]
mov eax, 0x9464a022
mov edx, dword [edx - reloc.WINMM.dll_midiStreamOpen]
btc eax, edx
jmp 0x9f5e79
jno 0x9f5fe1
jo 0x9f5fe1
sub esp, 1
jle 0x9f5ecd
mov ah, ch
inc eax
jmp 0x9f5eb7
lea esp, [esp + 1]
mov dx, 0xa1c3
rcl ax, 0xf
mov ah, byte [esp]
call fcn.009f5ee8
retf
lea esp, [esp + 1]
mov dx, 0xa1c3
rcl ax, 0xf
jmp 0x9f5e9f
mov ah, ch
inc eax
jmp 0x9f5e93
call 0x9f5e4d
push dword [esp]
jmp 0x9f600b
xchg dword [esp + 2], edx
rol bl, 0
jnp 0x9f6062
mov eax, ebp
setns dl
bswap edx
jmp 0x9f602c
lea eax, [ecx*4]
adc eax, edx
jmp 0x9f6050
setns dl
bswap edx
lea eax, [ecx*4]
adc eax, edx
sub esp, 9
lea esp, [esp + 1]
jmp 0x9f607c
mov eax, ebp
jmp 0x9f6042
and ebx, 0x3c
rdtsc
rdtsc
xchg ah, dh
jmp 0x9f60a5
rol bl, 0
rdtsc
xchg dh, al
not dh
inc dh
jmp 0x9f60a1
jns 0x9f6066
js 0x9f6066
sub esi, 4
mov dx, bp
bts eax, ebx
js 0x9f60fe
jns 0x9f60d2
mov al, 0x30
cmpsb byte [esi], byte es:[edi]
sal dword [eax], 0x8e
scasb al, byte es:[edi]
sub eax, 0x8437c4bd
mov eax, 0x46cbac3e
invalid
mov edx, dword [esp]
jmp 0x9f6101
jmp 0x9f615c
mov edx, dword [esp]
mov eax, dword [ebx + edi]
mov bl, 0x47
lea ebx, [ecx*4]
xchg dh, bl
call fcn.009f60d7
mov dword [esi], eax
mov dl, byte [esp]
mov ebx, dword [esp]
bsr ax, sp
jb 0x9f60d9
bswap edx
jmp fcn.009f60de
bswap edx
jmp fcn.009f60de

Function at 0x9f6143
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, ecx
push word [esp + 1]
jns 0x9f60e3
js 0x9f6188
inc ebp
into
pop esp
cmp edx, esi
aad 0x63
xchg esi, eax
shl dword gs:[esi], 1
push ecx
mov edx, edi
lea esp, [esp + 2]
jmp 0x9f6172
Function at 0xa0554b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dh, bl
cmc
jnp 0xa054cf
jp 0xa054b8

Function at 0xa05621
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x5935e972
mov eax, 0x234fbe64
mov word [esp + 1], bp
xchg dword [esp], eax
add cl, dl
jmp 0xa05636
jb 0xa0560b
mov eax, 0x5935e972
mov eax, 0x93338c2e
jmp 0xa056b9

Function at 0xa060f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
jmp 0xa06145
pop dx
lea esp, [esp + 1]
jmp 0xa060e0
mov dl, cl
mov dl, 0xa8
push ebp
jmp 0xa06124
mov dl, cl
mov dl, 0xa8
push ebp
mov dx, 0xe91
jmp 0xa06167
mov dx, 0xe91
jmp 0xa06167
mov dh, 0x5c
mov dh, 0x45
lea edx, [ecx + ebp]
jmp 0xa06151
inc eax
mov dx, ax
bts dx, sp
jnp 0xa06114
jp 0xa060fe
rol eax, 0
mov dx, bp
setp dl
sub esp, 0xe
jmp 0xa0618e
lea esp, [esp + 4]
add eax, 0x64b8a9b4
mov edx, 0xe9c66792
mov dx, word [esp]
jmp 0xa0612a

Function at 0xa0629b
Capabilities:
Execute anti-debugging instructions

Disassembly:
hlt
stc
jns 0xa062d1
js 0xa062bb
std
jp 0xa0628b
invalid
xchg dh, dl
jmp 0xa062d3
xchg dh, dl
lea esp, [esp + 4]
sub ebx, 0x5d772f3e
rol dx, 0
jmp 0xa062f0
jae 0xa06306
mov al, byte [esp]
lea eax, [esi*4]
jmp 0xa0631b
mov al, byte [esp]
lea eax, [esi*4]
mov ax, 0x18d4
jmp 0xa0639b
mov ax, 0x18d4
mov ah, byte [esp]
jmp 0xa0639e
mov ah, byte [esp]
neg ebx
call fcn.00a06324

Function at 0xa062b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
jle 0xa0621a
cmp eax, ecx
cmp eax, esi
jmp 0xa06274
cmp eax, ecx
cmp eax, esi
lea edx, [esp + edi]
rol ebx, 0
jl 0xa06240
sub esp, 8
mov eax, ebp
pop word [esp + 3]
lea esp, [esp + 2]
jmp 0xa0625a
sub esp, 8
jmp 0xa06249
mov eax, ebp
pop word [esp + 3]
lea esp, [esp + 2]
jmp 0xa0625a
lea esp, [esp + 4]
neg ebx
mov ax, 0x42f6
setle ah
rdtsc
jmp 0xa0628f
lea edx, [esp + edi]
jmp 0xa06221
rdtsc
neg dx
call fcn.00a0629b
aaa
mov bh, 0x27
inc edx
mov cl, 0xa
sub al, byte [ebp - 0xc]
out 0xe, eax
cdq
mov dl, 0x10
not ax
ror ebx, 0
jl 0xa06279
jge 0xa062e9
btr dx, cx
jmp 0xa06204
rdtsc
neg dx
jmp 0xa0627e

Function at 0xa06324
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
jne 0xa0636a
xchg byte [esp + 2], ah
mov edx, esp
jmp 0xa0634e
jmp 0xa06348

Function at 0xa06503
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt eax, ebp
jmp 0xa06563
jno 0xa065c9
mov ax, dx
add esp, 0
jmp 0xa065cf
mov ax, dx
add esp, 0
call fcn.00a0654d

Function at 0xa0654d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa06583
mov ax, word [esp]
mov ax, 0x746
mov al, cl
mov ah, 0x3d
jmp 0xa06591
rol dl, 0
bsr eax, edi
ja 0xa0656d
mov ax, word [esp]
jmp 0xa065ab
add cl, dl
bswap eax
lea eax, reloc.WINMM.dll_midiStreamOpen
mov dl, byte [esp]
mov ax, 0x746
mov al, cl
mov ah, 0x3d
jmp 0xa06591
Function at 0xa06b0e
Capabilities:
Execute anti-debugging instructions

Disassembly:
setbe dl
xchg byte [esp], cl
mov dword [esp + 8], ebx
stc
jmp 0xa06b3f
lea esp, [esp + 4]
popal
jmp 0xa06b79
jl 0xa06b6d
sub esp, 2
lea esp, [esp + 2]
jmp 0xa06b29
mov ecx, eax
cld
rep movsb byte es:[edi], byte [esi]
jmp 0xa06bb3
pop esi
popfd
jmp 0xa063df
sub esp, 2
lea esp, [esp + 2]
lea esp, [esp + 4]
popal
mov edi, edx
jmp 0xa06b4a
mov ch, al
xchg cl, ch
mov ecx, dword [esp]
lea esp, [esp + 4]
pop edi
jmp 0xa06b51

Function at 0xa06bf6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jns 0xa056eb
js 0xa056eb
add edx, 0x2ccd917d
jmp 0xa05ad6
add edx, 0xc7243a17
jmp 0xa05b20
call fcn.00a05621
adc al, 0x72
neg ax
jmp 0xa059f3
adc al, 0x72
neg ax
dec dl
bsr ax, cx
jmp 0xa0565e
mov ax, word [esp]
xchg al, ah
mov eax, 0x920d4a88
inc ax
jnp 0xa059ee
jp 0xa0586f
push dword [esp + 6]
jmp 0xa0566c
bts ax, di
jl 0xa05b1b
setne ah
push bp
inc al
lea esp, [esp + 2]
jmp 0xa05b41
push bp
inc al
lea esp, [esp + 2]
jmp 0xa05b41
setne ah
jmp 0xa05b05
bsr eax, esp
jmp 0xa05b57
mov al, byte [esp]
xchg al, ah
setle ah
jmp 0xa05da8
mov edx, dword [edx - reloc.WINMM.dll_midiStreamOpen]
lea eax, [eax + ebx]
mov eax, edi
lea eax, reloc.WINMM.dll_midiStreamOpen
jmp 0xa056d9
jb 0xa05b29
mov al, byte [esp]
xchg al, ah
jmp 0xa05f67
mov al, bl
not ax
jmp 0xa061f8
mov ax, 0x5174
push edx
ret
mov esp, edi
mov eax, dword [esp]
lea eax, [edi + ebp]
mov ah, byte [esp]
jmp 0xa05ba9
setle ah
call fcn.00a05b9a
stc
jnp 0xa06051
lea eax, [ebp*4]
jmp 0xa05fde
lea esp, [esp + 2]
jmp 0xa06064
sets ah
mov dx, word [esp]
push ebx
jmp 0xa05faf
lea eax, [ebp*4]
sets ah
mov dx, word [esp]
push ebx
lea esp, [esp + 2]
mov edx, ebx
mov eax, 0x2683a851
sar dword [eax + reloc.WINMM.dll_midiStreamOpen], cl
not ax
call fcn.00a05f8f
mov dl, byte [esp + 3]
shr dx, cl
jo 0xa060ae
jno 0xa060ae
ja 0xa06065
jne 0xa0609e
out dx, eax
sub byte [edi + eax - 0x74674652], dl
ret
not edx
stc
jb 0xa060b6
bsr dx, bp
bsr edx, ebp
jmp 0xa060c1
ror eax, 0
lea edx, [ecx + edx]
jmp 0xa06098
bsr dx, bp
clc
jmp 0xa061bd
clc
mov dh, 6
jmp 0xa061bf
setns dl
xchg dh, dl
not dx
mov edx, esp
call fcn.00a060f6
jo 0xa061a4
pop edx
lea edx, [eax + eax]
jmp 0xa061c8
pop edx
lea edx, [eax + eax]
bswap edx
push ebx
lea esp, [esp + 2]
jmp 0xa061d5
mov dh, 6
lea esp, [esp + 4]
inc eax
mov edx, esi
jmp 0xa0617f
bswap edx
push ebx
lea esp, [esp + 2]
jmp 0xa061d5
add ecx, eax
jmp 0xa06449
dec eax
not edx
mov ah, byte [esp]
jmp 0xa0633a
mov al, bl
not ax
lea esp, [esp + 4]
add dl, 0x85
jmp 0xa05aa0
sub esi, 4
xchg al, ah
xchg al, dl
xchg al, dl
call fcn.00a062b2
xchg byte [esp + 2], ah
mov edx, esp
mov dword [ebp], ebx
jmp 0xa06382
xchg ebx, eax
rdtsc
mov edx, ebp
mov bl, 0x79
jmp fcn.00a06353
mov ah, byte [esp]
jmp 0xa0633a
jbe 0xa061dd
dec eax
not edx
jmp 0xa0640b
mov word [esp + 1], ax
rol dl, 0
shr al, 5
js 0xa061f3
jns 0xa05b75
jmp 0xa064ca

Function at 0xa7c524
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
jmp 0xa2e9d4
Function at 0xb032b1
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp + 4], ebx
pushfd
mov word [esp], si
jmp 0xb032ec
push si
mov dword [esp], ebp
mov byte [esp + 4], ah
push word [esp + 3]
mov dword [esp + 8], esp
pushfd
jmp 0xb032d6

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401060
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
cmp dword [ebp - 0x10], 0
je 0x4010c0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
mov ax, word [edx]
mov word [ebp - 2], ax
add dword [ebp - 0xc], 2
cmp word [ebp - 2], 0
jne 0x40108b
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
sar ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
ja 0x4010c0
mov edx, dword [ebp - 0x10]
push edx
call fcn.00401612
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x4010cc
cmp dword [ebp - 8], 8
jle 0x4010d0
xor eax, eax
jmp 0x40110c
cmp dword [ebp - 8], 0
jne 0x4010df
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
push 0x100
push 0x412ff0
mov ecx, dword [ebp - 8]
add ecx, 0x65
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call section..text
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10