joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40256e
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x714
push ebx
push esi
mov esi, 0x104
push edi
lea eax, [ebp - 0x50c]
push esi
push eax
push dword [0x4056b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 7]
push 0x3f
mov byte [ebp - 8], bl
pop edx
stosw word es:[edi], ax
mov ecx, edx
lea edi, [ebp - 0x207]
mov byte [ebp - 0x208], bl
mov byte [ebp - 0x308], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x307]
mov byte [ebp - 0x408], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x407]
mov byte [ebp - 0x108], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x50c]
push eax
call dword [sym.imp.MSVCRT.dll__splitpath]
push str..DLL
lea eax, [ebp - 0x208]
push str.ATRES
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.MSVCRT.dll__makepath]
add esp, 0x28
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x4041c0
push 1
push ebx
push 0x4041b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, ebx
jl 0x40270b
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0xc], ebx
je 0x402684
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
cmp dword [ebp + 0x10], ebx
je 0x402695
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4026a6
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
push dword [ebp + 0x1c]
lea edx, [ebp - 0x108]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
lea edx, [ebp + 8]
push edx
push 0x4041d0
mov ecx, dword [eax]
push eax
call dword [ecx]
mov edi, eax
cmp edi, ebx
jl 0x402702
lea eax, [ebp - 0x714]
push esi
push eax
push 0xffffffffffffffff
push dword [ebp + 0x18]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x714]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edi, eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x108]
push ebx
push eax
push 1
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4033e5
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x405760], edi
je 0x40341c
push str.WebExAppSharingMutex
push edi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
cmp esi, edi
je 0x40341c
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
mov dword [0x405760], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [0x405750]
mov edi, dword [0x40574c]
test ebx, ebx
je 0x403483
test edi, edi
je 0x403483
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ApSetHwndforBacktoMeeting
push edi
call esi
test eax, eax
je 0x403457
push dword [esp + 0x14]
push ebx
call eax
push str.ApOnlineWebExRecord
push edi
call esi
test eax, eax
je 0x403470
push dword [esp + 0x1c]
push 1
push dword [esp + 0x20]
push ebx
call eax
push str.ApStartShareApplicationWithoutDelay
push edi
call esi
test eax, eax
je 0x403483
push dword [esp + 0x14]
push ebx
call eax
pop edi
pop esi
pop ebx
ret

Function at 0x403736
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
push 0x3e8
push 0x65
push dword [0x4056b0]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4037f1
push esi
push dword [0x4056b0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov edi, eax
push dword [0x4056b0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4037f1
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
push 0x405640
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 2
push 0
push 0
lea eax, [ebp - 0x108]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4037f1
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x4037f3
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x403847
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x403862
xor eax, eax
leave
ret
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
mov byte [ebp - 0x110], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
mov esi, 0x104
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov edi, eax
cmp edi, ebx
je 0x4039ab
cmp edi, esi
jb 0x4038a9
xor edi, edi
jmp 0x4039ab
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x4039ab
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x316]
mov word [ebp - 0x318], bx
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
jne 0x4038f0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x318]
push esi
push eax
lea eax, [ebp - 0x110]
push 0xffffffffffffffff
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp edi, ebx
je 0x4039a2
mov eax, dword [ebp - 8]
lea edx, [ebp + 8]
push ebx
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x318]
push edx
push ebx
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
jge 0x403938
xor edi, edi
jmp 0x4039a2
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov edi, eax
cmp edi, ebx
jbe 0x40397c
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [edi + 1]
cmp eax, dword [ebp + 0x10]
jbe 0x403969
mov edi, eax
jmp 0x40397c
push dword [ebp + 0x10]
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x4039a2
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x41eed0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4a04cc
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x41ef50
arpl word [edx + esi], si
xor byte [eax], 0xdf
pop ecx
sub esp, ebx
adc esp, dword [edx + 0x4d36237a]
insb byte es:[edi], dx
rcl ecx, cl
test al, 0xfb
jns 0x41ef52
add dword [eax - 0x10e7e3ca], ebp
xchg ebx, esi
xor bh, byte [ebx]
mov dl, 0x47
pop eax
mov al, byte [0x70e0846a]
imul dword [ebx]
mov ecx, 0xd6d2c95b
xchg ebx, eax
mov ecx, esi
leave
push cs
sal dword [esi], 1
ror cl, 0xff
clc
push ecx
dec ebx
enter 0xffffffffffffaff1, 0x41
invalid
invalid
inc edx
cmp eax, 0x8315b488
stosd dword es:[edi], eax
mov ah, 0xcd
fisttp word [ecx]
fiadd dword [ebx]
invalid
Function at 0x44e370
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.DATA
lea edi, [esi - 0x37000]
push edi
or ebp, 0xffffffff
jmp 0x44e392
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44e399
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44e388
mov eax, 1
add ebx, ebx
jne 0x44e3ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44e3bc
jne 0x44e3db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44e3db
dec eax
add ebx, ebx
jne 0x44e3c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x44e3a0
add ebx, ebx
jne 0x44e3d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x44e42d
xor ecx, ecx
sub eax, 3
jb 0x44e3f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44e462
sar eax, 1
mov ebp, eax
jmp 0x44e3fe
add ebx, ebx
jne 0x44e3fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44e3cc
inc ecx
add ebx, ebx
jne 0x44e40c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44e3cc
add ebx, ebx
jne 0x44e419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44e40e
jne 0x44e42a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44e40e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44e44c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44e43e
jmp 0x44e38e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44e44c
add edi, ecx
jmp 0x44e38e
pop esi
mov edi, esi
mov ecx, 0xc0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44e46a
cmp byte [edi], 5
jne 0x44e46a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44e46f
lea edi, [esi + 0x4c000]
mov eax, dword [edi]
or eax, eax
je 0x44e4e7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x558b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x558f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44e49c
mov ecx, edi
jns 0x44e4cb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x558f4]
or eax, eax
je 0x44e4e1
mov dword [ebx], eax
add ebx, 4
jmp 0x44e4b9
call dword [esi + 0x55904]
mov ebp, dword [esi + 0x558f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44e51b
sub esp, 0xffffff80
jmp 0x4019a8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x56f828
Capabilities:
Encode data using xor

Disassembly:
jmp 0x56f729
mov dword [esp + 0x24], eax
jmp 0x56f733
mov dword [esp + 0x24], eax
jmp 0x56f85b
call 0x56e68b
jmp 0x56f794
mov dword [esp + 0x24], eax
jmp 0x56f956
mov edx, ecx
lea edx, reloc.WINMM.dll_midiStreamOut
mov dword [edx], eax
pop edx
jmp 0x56f765
pushfd
cmp byte [ebx], bl
jb 0x56f783
pop ecx
sub ecx, 0x1001932c
push edx
jmp 0x56f713
popal
jmp 0x56f7af
je 0x56f7d2
jne 0x56e665
pop ebx
rcl dword [ecx + 0x30], 0xc3
jg 0x56f725
jp 0x56f7b9
les ecx, [edi]
mov dh, 0x18
movzx ebx, byte [eax]
add ebx, 0x769c5052
cmp ebx, 0x769c511e
jmp 0x56f74f
jmp 0x56f871
jb 0x56f79a
in al, 0x20
test eax, 0x3d826bc8
push 0
pushfd
jmp 0x56f7cb
pop eax
sub eax, 0x8c4142ab
jmp 0x56f841
inc dword [esp + 8]
popfd
ret
or byte [esi + 0x5bd08f9], bl
movsd dword es:[edi], dword [esi]
xor eax, 0x542aaf5c
salc
inc esp
and ebx, esi
sbb eax, edi
cmp dword [esp + 4], 0
jne 0x56f776
pushal
jmp 0x56e686
call 0x56f828
dec ebp
popal
jo 0x56f874
imul esp, dword [ebp + 0x77], reloc.WINMM.dll_midiStreamOut
insb byte es:[edi], dx
add bl, ch
mov esi, esi
ror dword [ebx + reloc.WINMM.dll_midiStreamOut], 1
pushfd
lea esp, [esp + 2]
jmp 0x56f88d
call 0x56f853
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
inc edx
push edi
aas
mov ebx, gs
mov edx, 0x1119eb61
wait
or ebp, dword [esi - 0x63]
sub eax, 0xf592fc79
add al, 0xc0
inc ecx
leave
pop ecx
cmp bl, cl
js 0x56f859
jmp 0x56f815
popal
jmp 0x56f877
inc dword [esp + 8]
popfd
ret
or byte [ebp + 0x2444ffc3], bl
or bl, ch
add cl, byte es:[edi + 0x54897a1f]
test al, 0x20
mov dh, 0xd1
and byte [esi + 0x63f2cdd], bl
inc dword [esp + 8]
jmp 0x56f8a3
lea esp, [esp + 8]
sub ecx, 0x100193cb
mov dword [ecx + reloc.WINMM.dll_midiStreamOut], eax
jmp 0x56f8a5
popfd
ret
movzx ebx, byte [eax]
add ebx, 0x83aaaef9
jmp 0x56fa00
popal
jmp 0x56f9b0
inc dword [esp + 8]
pushal
xchg al, ah
popal
call fcn.0056f99a
cld
pushal
not byte [ecx - 0x62fd2ba0]
or eax, 0x6c10a754
jg 0x56f9b4
adc eax, dword [eax]
add byte [eax], al
inc ebx
jb 0x56fa38
popal
je 0x56fa3b
inc esi
imul ebp, dword [ebp + 0x4d], 0x69707061
outsb dx, byte [esi]
push edi
add byte [eax - 0x18], dl
add ebx, dword [edx + reloc.WINMM.dll_midiStreamOut]
in eax, dx
invalid
cmp ebx, 0x83aaafc5
je 0x56fa64
jne 0x56e66e
push ebp
jmp 0x56fa51
ret 0x54a5
inc esp
and al, 6
lea esp, [esp + 0xc]
popfd
ret
cmp ebx, 0x4991addb
je 0x56fa92
jne 0x56e690
test dword [esp + ebp*8 - 1], edx
push esp
in al, dx
invalid
push esi
jo 0x56fa25
div byte [eax - 0x1a]
xor dword [eax - 0x3a], reloc.WINMM.dll_midiStreamOut
ja 0x56fa13
cli
jle 0x56fa37
mov eax, dword [esi - reloc.WINMM.dll_midiStreamOut]
mov ebp, eax
movzx ebx, byte [ebp]
pop ebp
add ebx, 0x4991ad0f
jmp 0x56fa2e
add byte [ebx + eax*4 + 0x4247c], bl
jmp 0x56fa96
inc dword [esp + 8]
jmp 0x56fb28
invalid
jne 0x56fa80
pushal
jmp 0x56e731
popfd
ret
Function at 0x5b93b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebx, edx
pushal
pop word [esp + 0x16]
sub esp, 0x1c
lea esp, [esp + 2]
jmp 0x5b93d7
lea esp, [esp + 4]
jb fcn.005b90be
mov ebx, dword [esi + 0x14]
jmp 0x5b938f
lea esp, [esp + 0x38]
jae fcn.005b90be
jb 0x5b93e5
sbb dword [edi + 0x31817217], eax
mov edx, 0x3bb70495
ret
cmp eax, ebx
push cx
mov word [esp], si
lea esp, [esp + 2]
jmp 0x5b93c1
sub eax, edx
mov edx, dword [esi + 0x1c]
lea edi, [edi*4]
sub esp, 7
jmp 0x5b9577
mov edi, dword [eax + ecx]
cmc
add edi, ecx
jmp fcn.005b90be
lea esp, [esp + 3]
lea esp, [esp + 4]
lea eax, [edx + eax*4]
neg edi
jmp 0x5b952d
Function at 0x642a62
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x13
lea esp, [esp + 0xc]
pushal
mov cl, byte [esp]
stc
neg esi
jmp 0x6429e0
jmp 0x6429f6

Function at 0x642b62
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr al, cl
mov dx, bp
push dword [esp]
mov di, sp
sub esp, 0xc
mov edi, ebx
jmp 0x642b3c
mov al, byte [esp + 2]
clc
mov ax, 0x322e
xchg ch, cl
lea ecx, [ecx + 0x7e]
lea edi, reloc.WINMM.dll_midiStreamOut
jmp 0x642aed
bsr ax, cx
inc ebp
mov byte [esp + 0xa], ah
rcl ebp, 0x1a
cpuid
lea esp, [esp + 6]
jmp 0x642b03
xchg dword [esp + 2], ebx
mov eax, edi
lea ebx, [edi*4]
xchg byte [esp + 3], bh
mov byte [esp + 0xd], dl
pushfd
jmp 0x642b8d
mov dword [esp + 1], ecx
lea eax, reloc.WINMM.dll_midiStreamOut
and ebx, ebp
mov dword [esp + 7], ecx
rdtsc
jmp 0x642b28
dec ecx
xchg esi, edx
push word [esp + 0xf]
rdtsc
mov si, 0x7d72
pop ebx
jmp 0x642bce
mov dh, 0x19
rdtsc
lea esi, [edx + ebp]
lea ecx, [ebx*4]
mov di, 0x8e21
cpuid
jmp 0x642b77
mov ebp, esi
neg ax
lea eax, [esp + ecx]
xchg bx, si
mov bp, 0x2096
lea ebx, [edi + edi]
jmp 0x642bb8

Function at 0x642f82
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg bh
pop word [esp + 5]
std
rdtsc
setne al
push dword [esp + 0xf]
jmp 0x642f6c
sub esp, 6
jmp 0x642f4c

Function at 0x64341d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, bh
xchg cx, ax
adc cx, di
bswap esi
mov ebx, 0xef1f6c40
mov ebp, ebx
jmp 0x643405
lea edx, reloc.WINMM.dll_midiStreamOut
rdtsc
dec ch
xchg dword [esp + 5], ebp
mov dword [esp + 2], ebx
pop dword [esp + 5]
jmp 0x6433d7
mov dx, 0xf491
xchg byte [esp + 8], ch
sub esp, 0x10
shl bl, cl
rol bp, 1
xchg edx, ebp
jmp 0x643435
jmp 0x6433ed
xchg byte [esp + 2], al
cpuid
ror ecx, cl
mov ax, word [esp + 7]
shl bp, cl
jmp 0x6434c7
inc edx
rdtsc
lea esp, [esp + 0x11]
xchg dword [esp + 6], eax
bsf di, cx
lea esp, [esp]
jmp 0x64341f
stc
mov ah, byte [esp]
not cx
setg dl
mov al, 0x30
xchg byte [esp + 2], bh
jmp 0x64346d
mov al, dh
mov cl, ah
mov ch, 0xf0
lea esp, [esp + 0xa]
xchg word [esp], si
push word [esp + 1]
jmp 0x643484
Function at 0x643508
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov dword [esp + 7], edi
jmp 0x643547
neg cx
sub esp, 0x16
xchg byte [esp + 0x16], ah
pop bp
cld
jmp 0x64371a
setb dh
xchg bp, di
xchg dword [esp + 0x1a], edi
xchg dword [esp + 0xb], ebx
lea edx, [ebp*4]
mov bp, word [esp + 6]
jmp 0x643531
mov di, 0x7180
mov bl, byte [esp + 8]
xchg bh, al
push word [esp + 6]
xchg dword [esp + 6], edx
setle dh
jmp 0x6435d4
lea ebp, [esp + 6]
xchg word [esp + 3], di
lea ecx, [eax + ebp]
setl dl
cpuid
pop edx
jmp 0x643581
push dword [esp + 0xc]
mov word [esp + 3], bx
mov ebx, 0x4d82ff33
pop edx
jmp 0x64362c
push dword [esp + 1]
neg cl
mov dword [esp + 3], ecx
cmc
bsr eax, esp
rdtsc
jmp 0x6435be
xchg word [esp + 1], cx
shl di, cl
xchg bx, cx
mov dword [esp], eax
push dword [esp + 6]
mov ah, bl
jmp 0x6435aa
xchg dword [esp + 0xc], esi
pop cx
cld
mov ecx, ebp
mov word [esp + 5], sp
xchg ebx, esi
jmp 0x64365a
rdtsc
xchg byte [esp + 0xc], dl
pop word [esp + 3]
push ebp
xchg bh, ah
clc
jmp 0x643644
xchg byte [esp + 6], cl
bsr ebp, ebp
bsf edx, ecx
mov dword [esp + 9], ebp
btc cx, bx
xchg byte [esp + 0xb], dl
jmp 0x643601
xchg dword [esp + 1], edi
mov esi, edx
sub esp, 6
mov byte [esp + 0xa], cl
mov bx, ax
jmp 0x6436b1
bswap ecx
lea ecx, [eax*4]
push ebp
bsf eax, eax
xchg byte [esp + 2], al
mov dword [esp + 0xe], ecx
jmp 0x643613
xchg dh, ch
lea esp, [esp + 3]
ror ebx, 0x11
lea eax, reloc.WINMM.dll_midiStreamOut
mov dword [esp + 2], edi
xchg word [esp + 8], bp
jmp 0x6435eb
pushal
dec bh
inc bl
mov byte [esp + 0x10], bl
lea edx, [ecx + ebp]
bsr ecx, ecx
jmp 0x6436dc
mov word [esp + 5], ax
std
bswap ebp
mov al, 0xf1
xchg dword [esp + 0xb], ebp
mov ebx, 0xd8d1c0a4
jmp 0x643695
not cl
sub esp, 7
lea esp, [esp + 0x45]
rdtsc
bsr di, bx
jmp 0x6436f1
sub esp, 3
neg dx
bsr edx, edx
xchg dword [esp + 0x29], ebp
xchg dword [esp + 0xa], ecx
bswap ecx
jmp 0x6436c6
bsf edx, edx
mov bh, byte [esp]
rdtsc
mov edx, 0x913f6c84
bsr ebx, ebx
mov eax, ebx
jmp 0x64374a
lea esp, [esp + 0x32]
push word [esp + 3]
mov esi, 0xb0e7db7f
stc
not esi
push dword [esp + 7]
jmp 0x643678
neg ch
call fcn.00643757
cmpsb byte [esi], byte es:[edi]
xor esp, dword [ebx - reloc.WINMM.dll_midiStreamOut]
xor al, 0xaa
int 0x3c
call 0xd28817ec
leave
ror cl, cl
xchg bp, si
dec cl
rdtsc
std
std
jmp 0x643734

Function at 0x64378f
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb al, al
jmp 0x643797
lea ebp, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 4]
neg si
not ax
xchg byte [esp], al
lea eax, [esi*4]
jmp 0x643816
seto al
std
bt si, si
mov dx, word [esp]
xchg bx, dx
cmp ecx, ecx
jmp 0x6437cf
btc bp, ax
mov bx, word [esp]
mov cx, bx
mov cx, word [esp]
neg bx
rdtsc
jmp 0x6437e5
Function at 0x647ec9
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call fcn.00642b1e
jmp 0x642b19
call 0x646cbc
jmp 0x647ed4
mov eax, dword [eax + 0x1c]
jmp 0x647eea
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x647e8f
push bx
mov dword [esp], esp
lea esp, [esp + 2]
jmp 0x647ea5
pop eax
jmp 0x647ef5
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x646cb7
sub eax, 0x246cbc
jmp 0x647f36
push eax
jmp 0x643adb
Function at 0x1008c2b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1008c66
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1008c43
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1008c82
dec esi
je 0x1008c7b
dec esi
jne 0x1008c87
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc