joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4045d9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4045f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040667a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40461a
test byte [esp + 8], 2
je 0x40461a
mov dword [0x40c028], 0xd
mov dword [0x40c02c], 5
jmp 0x4045f5
xor eax, eax
ret

Function at 0x40524d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b928
cmp edx, dword [eax]
je 0x40526f
add eax, 8
inc ecx
cmp eax, 0x40b9b8
jl 0x405260
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b928]
jne 0x40539d
mov eax, dword [0x40c024]
cmp eax, 1
je 0x405377
test eax, eax
jne 0x4052a0
cmp dword [0x40b3c4], 1
je 0x405377
cmp edx, 0xfc
je 0x40539d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4052d7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00406bc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004054b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40531a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004054b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x409504
push edi
call fcn.00407740
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00406bc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406bd0
lea eax, [ebp - 0xa0]
push 0x4094e4
push eax
call fcn.00406bd0
push dword [esi + 0x40b92c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00406bd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004076a9
add esp, 0x2c
pop edi
jmp 0x40539d
lea eax, [ebp + 8]
lea esi, [esi + 0x40b92c]
push 0
push eax
push dword [esi]
call fcn.004054b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x7d8831
Capabilities:
Hash data with md5

Disassembly:
pushal
lea esp, [esp + 0x20]
mov dword [eax + 0x10], 0x98badcfe
push esp
jmp 0x7d88c4
lea esp, [esp + 4]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
jmp 0x7d8816
lea esp, [esp + 4]
mov dword [eax + 0x14], 0x10325476
call fcn.007d88a6

Function at 0x7d8fe3
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esp + 0xc]
call fcn.007a60a0
and ax, 0x69ba
setne dh
jmp 0x7d8fec
lea esp, [esp + 4]
lea ecx, [esi + 8]
jmp 0x7d8fc2
movzx eax, byte [ecx]
mov di, 0xe4b9
mov byte [esi + 0x58], al
mov edx, eax
jmp 0x7d903a
lea edi, [edi + edi]
movzx ecx, byte [esi + 9]
mov byte [esi + 0x59], cl
btr eax, edx
jmp 0x7d901f
Function at 0x7d90cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
jb 0x7d8995
mov al, byte [esp]
lea ecx, [esp + ebp]
call fcn.007d8fe3
mov di, ax
movzx edx, byte [esi + 0xa]
pushal
jmp 0x7d907a
movzx eax, byte [esi + 0xb]
lea edi, [ebp - 0xf]
xchg di, cx
pushal
jmp 0x7d90b0
pop word [esp]
lea esp, [esp + 2]
jmp 0x7d9049
lea esp, [esp + 0x20]
mov byte [esi + 0x5a], dl
mov eax, 0xb60e9a76
mov ch, bh
push esp
jmp 0x7d9062
movzx ecx, byte [esi + 0xc]
mov al, 0x3e
mov dh, byte [esp]
push esp
jmp 0x7d9162
mov byte [esi + 0x5d], dl
mov ecx, 0xa950854
cmp ax, 0x6c92
rdtsc
xchg cl, ch
jmp 0x7d913b
lea esp, [esp + 0x20]
mov byte [esi + 0x5b], al
jmp 0x7d908b
mov dword [esp], ecx
push dword [esp]
lea esp, [esp + 8]
jmp 0x7d900e
movzx ecx, byte [esi + 0xf]
inc edi
mov byte [esi + 0x5f], cl
btr edx, edx
bsf di, ax
jmp 0x7d9123
mov byte [esi + 0x5e], al
lea eax, reloc.WINMM.dll_midiStreamOut
mov ch, byte [esp]
xor dl, ch
jmp 0x7d90db
lea esp, [esp + 0x1c]
movzx edx, byte [esi + 0x10]
sub esp, 0xe
pop di
xchg cl, ch
jmp 0x7d914b
sub esp, 0x1c
xchg dword [esp + 4], ecx
jmp 0x7d9108
movzx eax, byte [esi + 0xe]
xchg edi, edx
add edi, ebp
bswap ecx
bsr cx, bp
jmp 0x7d90f8
lea esp, [esp + 0xc]
mov byte [esi + 0x60], dl
lea edi, [ecx + edx]
setne ah
jmp 0x7d920c
lea esp, [esp + 4]
mov byte [esi + 0x5c], cl
lea edi, [ecx + ebx]
movzx edx, byte [esi + 0xd]
jmp 0x7d909a
btr eax, esp
movzx ecx, byte [esi + 0x12]
mov dl, dh
bsf di, si
mov dh, 0xc3
jmp 0x7d91ef
lea esp, [esp + 4]
mov byte [esi + 0x61], al
bsf ax, si
rdtsc
mov ch, byte [esp]
jmp 0x7d9175
mov byte [esi + 0x63], dl
mov cl, ch
rdtsc
jmp 0x7d91cf
movzx edx, byte [esi + 0x13]
mov al, 0x7e
lea eax, [ebp - 0x3f]
mov edi, dword [esp]
mov al, 0x8e
jmp 0x7d91a9
movzx eax, byte [esi + 0x14]
neg dh
stc
setl cl
jmp 0x7d9222
mov byte [esi + 0x62], cl
mov ch, byte [esp]
rdtsc
mov edi, dword [esp]
jmp 0x7d91bf
mov ax, 0x1d2d
movzx eax, byte [esi + 0x11]
mov cl, ch
sub esp, 6
lea esp, [esp + 2]
jmp 0x7d9197
mov byte [esi + 0x64], al
movzx ecx, byte [esi + 0x15]
mov di, 0x517f
rcl edi, 0x13
pushal
jmp 0x7d92de
movzx eax, byte [esi + 0x17]
shr edi, 1
bswap edi
mov di, word [esp]
sub esp, 2
jmp 0x7d92bf
lea edi, [ecx*4]
jmp 0x7d9256
clc
mov byte [esi + 0x66], dl
mov al, 0x2a
mov al, byte [esp]
mov di, sp
jmp 0x7d926d
xchg edi, eax
invalid
mov dx, word [esp + 4]
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
movzx edx, byte [esi + 0x16]
mov eax, dword [esp]
jmp 0x7d9286
invalid
lea esp, [esp + 2]
pop edi
call fcn.007d93f3
rcr dword [ebx - 0x35], cl
scasb al, byte es:[edi]
pop ebp
out dx, eax
cmp edi, dword [edx + edx*2 + reloc.WINMM.dll_midiStreamOut]
mov dword [ecx], ebx
js 0x7d9265
cmp ebp, dword [eax - reloc.WINMM.dll_midiStreamOut]
jl 0x7d9306
xchg word [esp + 7], di
pop es
lea esp, [esp + 0x20]
mov byte [esi + 0x65], cl
sub esp, 0x1e
xchg word [esp + 0x1b], ax
jmp 0x7d92a9
in al, 0x6e
cld
wait
jbe 0x7d92be
inc esi
jno 0x7d929d
invalid
and al, 8
add esp, 0x84
call fcn.007d92f4
Function at 0x953d5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
or ax, 0xff78
setle bh
mov ax, sp
mov al, ah
lea edx, [esp + edi]
mov bl, bh
jmp 0x953d7e
mov dx, word [esp]
or edx, eax
mov dword [esp + 1], ebx
lea eax, [edi*4]
mov dl, byte [esp]
jmp 0x953cfe
bts edx, ebx
lea edx, reloc.WINMM.dll_midiStreamOut
mov dl, 0xc4
mov eax, edx
mov dh, ch
mov ax, word [esp]
jmp 0x953d1b
mov dword [esp + 6], eax
xchg ah, dh
mov dx, word [esp]
jmp 0x953d39
rdtsc
mov dl, dh
setno ah
cld
neg edx
mov dl, 0x64
jmp 0x953e1d
mov dl, 0xdc
mov dl, 0x24
neg eax
mov dx, di
bts ebx, ebx
mov dh, byte [esp]
jmp 0x953d68
xchg dh, dl
push dword [esp + 4]
mov dx, 0xfcf5
xchg bh, dh
jmp 0x953da4
xchg word [esp], bx
mov byte [esp], ch
push esp
mov edx, edi
bswap edx
mov bx, cx
jmp 0x953dc8
bswap edx
mov edx, ebx
mov edx, 0x1575ee0
rdtsc
add al, dh
bts ebx, edi
jmp 0x953de0
xchg ah, bl
mov dx, word [esp]
mov bx, word [esp]
mov ebx, ebp
rdtsc
sub esp, 2
jmp 0x953e05

Function at 0x953f57
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x953fae
not dh
bswap eax
rdtsc
rdtsc
mov bh, byte [esp + 8]
clc
jmp 0x953f8d
neg ah
clc
xchg byte [esp + 6], dl
push edx
lea ebx, [ebp*4]
bswap edx
jmp 0x953f59

Function at 0x954205
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, 0x39f9
xchg dh, al
mov al, ah
bsr bx, cx
xchg dword [esp + 9], ebx
neg dh
mov dword [esp + 0x17], eax
jmp 0x954186
jmp 0x9541a8

Function at 0x9542c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x11], ch
mov dword [esp + 7], ebp
lea ebx, [ebp*4]
jmp 0x9542ed

Function at 0x95446f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x9544db
neg ah
bts ebx, ebx
inc dx
mov edx, 0x727b26e
jmp 0x954570
pop edx
mov ax, bx
mov dword [esp + 0x33], eax
mov eax, dword [esp + 0x2d]
mov bl, bh
setbe dh
jmp 0x954471
bswap eax
setbe bh
pop word [esp + 0x31]
mov dh, byte [esp + 0x2d]
cmc
rdtsc
jmp 0x954549
rdtsc
pop bx
xchg byte [esp + 5], bl
mov dl, 4
xchg dx, ax
mov eax, ecx
jmp 0x954520
pop edx
and dh, bh
not ebx
lea edx, [esp + esi]
mov edx, 0xc8f2ec48
pop word [esp + 5]
jmp 0x954616
push word [esp + 0x1d]
btr edx, edx
pop dword [esp + 0x12]
mov dh, 0xa2
mov dl, dh
cmc
jmp 0x954538
mov word [esp + 0xe], dx
add esp, 0x23
stc
sub esp, 0x18
xchg bh, dh
call fcn.009545b4
not dx
pop dword [esp]
mov edx, ebp
pop bx
push dword [esp + 4]
clc
jmp 0x954646
setae dh
lea edx, [ebp*4]
rdtsc
sbb eax, ebp
call fcn.00954630
rcl dword [eax - 0x2d]
dec edx
pop word [esp + 0x27]
push word [esp + 1]
mov bl, bh
pop bx
mov bh, byte [esp + 0x29]
lea ebx, [ebp - 0x97]
jmp 0x9545db
xchg word [esp + 0xb], bx
clc
lea eax, [eax*4]
sub esp, 2
jmp 0x9545ff

Function at 0x954cb0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
pushal
inc ebx
pushal
lea esp, [esp + 0x44]
jmp 0x954ce4
push word [esp + 0x17]
mov word [esp + 0x10], bx
xchg word [esp + 0xe], bx
jmp 0x954d05
stc
btr edx, esp
mov ebx, 0xb5b8a930
xchg edx, eax
sub esp, 0x1c
xchg dh, al
jmp 0x954ccd
Function at 0x954d3b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x954e47
not edx
bt eax, ebx
rdtsc
mov ebx, dword [esp]
rcl ax, cl
rdtsc
jmp 0x954df1
mov bx, word [esp]
push esp
pop edx
bswap ebx
mov ax, sp
shr bh, 3
jmp 0x954d81
bsf bx, ax
lea eax, [edi*4]
lea esp, [esp + 3]
bsf dx, ax
mov edx, esi
neg dx
jmp 0x954d99
neg ax
neg dx
lea ebx, [ecx + edi]
inc bl
rdtsc
mov dl, dh
jmp 0x954e1c
neg bx
cld
lea eax, reloc.WINMM.dll_midiStreamOut
not dh
mov dx, word [esp]
ror eax, 0x1d
jmp 0x954dcb
lea esp, [esp]
neg dh
bsf dx, ax
xchg dx, bx
lea eax, [eax - 0x49]
jmp 0x954e31
rdtsc
lea ebx, [eax + 0xd9]
mov edx, dword [esp]
rol dx, cl
neg bh
add esp, 0
jmp 0x954e06
neg edx
not bx
mov bl, bh
setae dh
xchg byte [esp], al
neg bh
jmp 0x954e85
neg edx
mov bx, word [esp + 4]
mov dh, byte [esp + 5]
pop dword [esp]
mov dh, 0xc2
add esp, 7
jmp 0x954db1
lea ebx, [ecx + 0xf3]
pop ebx
not eax
lea esp, [esp]
mov ebx, 0x7ced8702
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x954ec9
mov ebx, 0xcaa47f4c
xchg ebx, edx
shl dx, cl
mov byte [esp], ah
setg bh
sub esp, 6
jmp 0x954e5f
xchg ebx, eax
xchg edx, eax
mov ax, 0x1aa1
mov ax, di
mov eax, ecx
xchg word [esp + 0x18], bx
jmp 0x954fdb
xchg byte [esp + 0xe], al
rdtsc
mov byte [esp + 0x21], dh
lea edx, [edx*4]
jmp 0x954e9a
mov eax, dword [esp]
neg dx
lea edx, [ecx - 0x8b]
pushal
bswap edx
mov dword [esp + 7], esi
jmp 0x954eb2
push word [esp + 0x22]
bswap edx
or bx, 0x9906
call fcn.00954f54
dec ecx
outsb dx, byte [esi]
je 0x95502f
jb 0x955038
outsd dx, dword [esi]
arpl word [ebx + 0x65], bp
dec ecx
outsb dx, byte [esi]
arpl word [edx + 0x65], si
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0x954fdb
dec ebx
neg dh
xchg dword [esp + 0xc], ebx
mov al, ah
mov dx, 0xe8bb
mov dword [esp + 0x12], esi
jmp 0x954fb5
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[edi], cl
mov ebx, dword [ebx]
jle 0x954fc8
sbb edi, dword [esi - 0x73]
imul ebp, dword [esi - reloc.WINMM.dll_midiStreamOut], 0x648dffff
and al, 8

Function at 0x954f54
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov bx, dx
mov bl, byte [esp]
clc
lea edx, [eax - 0x61]
mov dl, 0x64
jmp 0x954f25
btc eax, edx
mov dl, 0xb4
rdtsc
mov al, byte [esp]
bsr ax, cx
add al, dh
jmp 0x954efb
bswap eax
mov ebx, dword [esp + 0x29]
mov ax, si
setnp dh
mov eax, esp
neg eax
jmp 0x954f95
mov edx, 0x89da784c
mov byte [esp + 0x1f], ch
mov bl, bh
btr ebx, esp
lea esp, [esp + 1]
jmp 0x954f13
lea edx, [ecx + edi]
neg ax
bswap ebx
jmp 0x954f3b
lea esp, [esp + 0x4e]
cmp dx, 0xfe7e
mov edx, dword [esp + 0x44]
lea esp, [esp + 0x5c]
popfd
jmp 0x955009
bswap edx
bsr dx, cx
lea edx, [esi + 0x25]
sub esp, 0x12
sub esp, 0x1c
pushal
jmp 0x954f5e
sub esp, 0x14
mov dh, ch
pop dword [esp]
mov dx, word [esp + 0xe]
mov eax, dword [esp + 0x3e]
neg dh
jmp 0x954f78
push 0xc77042e1
add dword [esp], reloc.WINMM.dll_midiStreamOut
call fcn.00954fee
Function at 0x9583f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x9583f9
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor dword cs:[esi], ebp
cmp byte [esi], ch
xor byte [eax], al
pushfd
cld
jmp 0x958439
pop word [esp + 6]
mov dword [esp + 3], eax
push dword [esp + 2]
clc
push dword [esp + 2]
add esp, 4
jmp 0x958465
push esp
mov byte [esp], ch
stc
add esp, 1
sub esp, 0xa
pop word [esp + 5]
jmp 0x95840e
mov cl, ch
xchg byte [esp + 2], cl
mov ecx, dword [esp + 1]
bswap edi
mov dword [esp], eax
jmp 0x958475
lea esp, [esp + 1]
lea esp, [esp + 0xc]
pushal
rdtsc
and eax, ecx
push edx
jmp 0x95844b
mov edi, 0x2b13e3c2
lea esp, [esp + 3]
mov bp, 0x3f07
inc bl
lea esp, [esp]
cld
jmp 0x95868b
lea ebp, reloc.WINMM.dll_midiStreamOut
add esp, 0x20
cpuid
sub esp, 0x14
push dword [esp + 0x21]
mov si, dx
jmp 0x958525
rdtsc
xchg dword [esp + 0x16], ecx
neg dh
sub esp, 0
pushal
cmc
jmp 0x9584a5
btc ebp, edi
not ch
push esp
lea esp, [esp + 0x43]
mov si, word [esp]
clc
jmp 0x958585
push word [esp + 0x31]
mov dword [esp + 0x1e], eax
push word [esp + 0xd]
xchg dword [esp + 0x12], ecx
jmp 0x9584d4
push dword [esp + 0x16]
xchg di, dx
btr ecx, esp
not ax
mov byte [esp + 0x2d], ch
pop ebx
jmp 0x9584ea
mov cl, ch
sub esp, 8
mov dword [esp + 0x36], eax
mov ebp, dword [esp + 0x35]
xchg word [esp + 0x20], di
and edi, ecx
jmp 0x958502
push dword [esp + 8]
xchg word [esp + 0x11], bp
mov ebp, dword [esp + 0xf]
mov di, word [esp]
jmp 0x958566
mov cl, ch
bsf di, si
lea ebx, [esp + ebx]
xchg ecx, esi
not eax
sub esp, 0x16
jmp 0x95853b
lea edi, [esi*4]
mov cx, dx
push word [esp + 0x15]
mov dh, byte [esp + 3]
inc bp
jmp 0x9585b1
mov ax, sp
xchg bh, cl
mov cl, ch
lea ebx, [eax - 0x19]
mov edx, esi
not eax
jmp 0x958554
mov dword [esp + 0x17], eax
pop ebx
push word [esp + 0x25]
xchg si, bx
mov byte [esp + 0x30], dh
cpuid
jmp 0x958669
mov cx, word [esp + 8]
mov dword [esp + 0xf], esi
mov ecx, dword [esp + 0xd]
mov ecx, 0x61702876
and cl, bh
sub esp, 0x1e
jmp 0x958595
lea esp, [esp + 0xe]
mov word [esp + 0x18], bx
ror dh, 7
mov ax, 0x78eb
setbe ch
lea eax, [ebp*4]
jmp 0x9584c5
lea edi, [edx*4]
btc ebx, edi
mov edi, eax
sete bh
call fcn.00958618
rdtsc
cpuid
xchg dword [esp + 0x32], esi
pop dword [esp + 0x20]
lea ebx, [edx + edi]
mov ebp, 0x67d84f2e
jmp 0x958635
sub esp, 0x1a
rdtsc
mov word [esp + 8], bx
inc cx
sub esp, 0xe
xchg edx, esi
jmp 0x9585d1
Function at 0x958a7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 4]
xchg dword [esp + 2], esi
stc
lea edx, reloc.WINMM.dll_midiStreamOut
mov edi, ebp
rdtsc
jmp 0x958acd
xchg dword [esp + 6], ebx
jmp 0x958a5a
xchg dword [esp + 7], eax
mov ebp, dword [esp + 8]
mov al, ah
bswap edi
setbe ch
jmp 0x958aa5

Function at 0x958e8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ebx
inc bx
mov al, ah
xchg bh, cl
add al, dh
bswap ebp
jmp 0x958e6c
inc ebx
lea ecx, [edi*4]
mov word [esp + 0x18], bx
lea ebx, [esi + 0x4d]
mov word [esp + 0x1d], bx
setl bh
jmp 0x958de3
mov word [esp + 0x1c], bx
mov si, dx
xchg ecx, ebp
cpuid
mov byte [esp + 0x17], bh
mov word [esp], sp
jmp 0x958e00
pop di
bsf cx, si
xchg edx, ebp
xchg di, bx
clc
mov ecx, 0xfc634a2c
jmp 0x958e2e
push dword [esp + 5]
xchg ebx, eax
pop dword [esp + 0x1b]
push dword [esp + 0xf]
pop si
sub esp, 0x18
jmp 0x958ebd
rdtsc
mov ch, byte [esp + 4]
pushal
mov bl, 0x90
cpuid
jmp 0x958e59
mov al, ah
xchg edi, eax
sub esp, 4
btc esi, ebx
xchg byte [esp + 0x24], cl
sub esp, 6
jmp 0x958fa4
mov bp, word [esp + 0x2b]
shr ch, 5
setge bh
lea ebp, [edx*4]
lea ebx, reloc.WINMM.dll_midiStreamOut
pop eax
jmp 0x958e97
popal
mov ah, byte [esp + 5]
sub esp, 0x18
lea ebx, [edi + ebp]
lea edi, reloc.WINMM.dll_midiStreamOut
xor dl, ch
jmp 0x958ee5
sub esp, 8
not cx
lea edi, [ebp + 0x4f]
mov bh, byte [esp + 0xb]
push esp
push word [esp + 0xd]
jmp 0x958f08
lea esp, [esp + 0x43]
inc eax
mov dx, sp
cpuid
mov bx, word [esp]
pushal
jmp 0x958f44

Function at 0x9590fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, reloc.WINMM.dll_midiStreamOut
mov bx, word [esp + 0x1a]
rdtsc
pop word [esp + 0xd]
xchg byte [esp + 0x1c], dl
jmp 0x95911d
jmp 0x9590e2
inc dl
btr ebp, esp
mov eax, dword [esp + 5]
lea ecx, reloc.WINMM.dll_midiStreamOut
xchg dword [esp + 8], ebx
inc cl
jmp 0x95914d
lea ebp, [ecx - 0xd3]
cmc
push edx
cpuid
lea edi, reloc.WINMM.dll_midiStreamOut
mov bl, bh
jmp 0x959100

Function at 0x959361
Capabilities:
Execute anti-debugging instructions

Disassembly:
and esi, ecx
xchg bh, cl
mov di, sp
xchg bx, ax
rdtsc
mov ch, byte [esp + 0x1d]
jmp 0x95932b
sub esp, 0xe
cmc
popal
mov al, 0xbe
mov word [esp + 0x17], dx
mov dword [esp + 0x14], esi
jmp 0x959387
rdtsc
pop dword [esp + 0xf]
xor dl, ch
mov dword [esp + 1], eax
mov ch, byte [esp + 0xc]
mov si, word [esp + 0x1a]
jmp 0x959315
push dword [esp + 0x17]
mov word [esp + 0xe], di
jmp 0x959341
setg ah
mov bx, 0xe891
pop edx
cpuid
mov dword [esp + 0xb], ecx
lea edi, [ebx*4]
jmp 0x95939f
xchg dword [esp + 0x11], ebx
xchg di, si
push dword [esp + 0x1b]
pop dx
mov ebx, 0xe712c8fa
xchg dword [esp + 0x18], edx
jmp 0x95936c
setae ah
lea eax, [ebx*4]
push dword [esp + 0xe]
btc edx, edi
mov dx, 0x2e99
lea ebx, [edi + ebp]
jmp 0x9593e5
cpuid
mov dword [esp + 0x27], eax
mov bl, 0xa8
add esp, 5
call fcn.00959460
iretd
setl dh
btc ebp, ebx
sub esp, 0x10
xchg bh, cl
mov dh, byte [esp + 0x20]
mov ax, word [esp + 6]
jmp 0x9593cf
Function at 0x95942d
Capabilities:
Execute anti-debugging instructions

Disassembly:
not esi
mov bp, word [esp + 0xe]
push word [esp + 3]
mov edx, esi
xchg edx, eax
xchg dword [esp + 2], edx
jmp 0x959447
rdtsc
mov di, word [esp + 0xc]
lea ecx, [ebx*4]
setp ah
jmp 0x9593fb
jmp 0x959415
xchg ch, dl
push dword [esp + 0x1c]
cld
add esp, 0x1f

Function at 0x9598fc
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.00958376
mov word [esp + 0x20], sp
pop dword [esp + 0x1a]
lea esp, [esp + 1]
jmp 0x959904
lea esp, [esp + 3]
mov byte [esp + 0x13], dh
push esp
pop word [esp + 0x21]
mov dword [esp + 6], ebp
jmp 0x9598cb
pushal
lea esp, [esp + 0x21]
pushal
jmp 0x9598e4
mov dword [esp + 0x88], edi
lea esp, [esp + 0x88]
jmp 0x959a06
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x958371
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x95998b
Function at 0x42fbc0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c6f5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004b926c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42fc42
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004b675a
mov eax, dword [eax]
push 0xb1cd20
push eax
call fcn.004a4d34
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004b94f7
test bl, bl
je 0x42fc42
push 0xb1cd20
lea ecx, [esp + 0xc]
call fcn.004b98d3
push 0xb1cd2c
lea ecx, [esp + 0xc]
call fcn.004b98d3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42fc7e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004b94f7
jmp 0x42fd49
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42fd02
lea edx, [esp + 0x7c]
push 0xb1cd28
push edx
call fcn.004a4d34
add esp, 8
test eax, eax
je 0x42fd02
lea eax, [esp + 0x7c]
push 0xb1cd24
push eax
call fcn.004a4d34
add esp, 8
test eax, eax
je 0x42fd02
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42fc92
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004b94f7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x430560
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4305c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4305d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c6fdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0xb2c7e4]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x430708
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x430636
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004b94f7
xor eax, eax
jmp 0x43077f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004b9680
push esi
lea ecx, [esp + 0xc]
call fcn.004b990f
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0xb1cd60
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x43075d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00430560
test eax, eax
jne 0x43075d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00430560
test eax, eax
jne 0x43075d
lea eax, [esp + 0x14]
push 0xb1cd3c
push eax
call fcn.004a5e40
mov esi, eax
add esp, 8
test esi, esi
jne 0x43073c
lea ecx, [esp + 0x14]
push 0xb1cd38
push ecx
call fcn.004a5dc0
mov esi, eax
add esp, 8
test esi, esi
jne 0x43073c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x43073f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004b9630
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x43064e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004b94f7
xor eax, eax
jmp 0x43077f
mov byte [esi], 0
push 0xb1cd34
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004b94f7
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4