joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446d34
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x597240]
cmp byte [eax + 0xc], 0
je 0x446ea1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x446e9a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x598afc], 0
jne 0x446d88
push 0x446ea8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x446eb0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598afc], eax
cmp dword [0x464bbc], 0
jne 0x446e83
push 0x446ec0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x464bbc], eax
cmp dword [0x464bbc], 0
je 0x446e83
push 0x446ecc
mov eax, dword [0x464bbc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598b00], eax
push 0x446edc
mov eax, dword [0x464bbc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598b04], eax
push 0x446ef0
mov eax, dword [0x464bbc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598b08], eax
push 0x446f08
mov eax, dword [0x464bbc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598b0c], eax
push 0x446f20
mov eax, dword [0x464bbc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598b10], eax
push 0x446f34
mov eax, dword [0x464bbc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598b14], eax
push 0x446f4c
mov eax, dword [0x464bbc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598b18], eax
push 0x446f64
mov eax, dword [0x464bbc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598b1c], eax
push 0x446f80
mov eax, dword [0x464bbc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598b20], eax
push 0x446f8c
mov eax, dword [0x464bbc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598b24], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446ea1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44ad70
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004042b0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44adbf
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404520
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452598
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4525e8]
test si, 4
je 0x4525ac
or bl, 1
test si, 8
je 0x4525b6
or bl, 4
test si, 1
je 0x4525c0
or bl, 8
test si, 2
je 0x4525ca
or bl, 0x10
test si, 0x10
je 0x4525d4
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4525e3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4525ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x452624]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x452605
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x452614
or bl, 4
test esi, 0x20000000
je 0x45261f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x458ce8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x458cfa
add esp, 0xfffffff0
call fcn.00403840
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041cf94
mov eax, dword [0x596ef4]
mov dword [eax + 4], ebx
mov dword [eax], 0x45908c
mov eax, dword [0x596f00]
mov dword [eax + 4], ebx
mov dword [eax], 0x459098
mov eax, ebx
call fcn.004590a4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4151ac]
call fcn.004034d8
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4151ac]
call fcn.004034d8
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4151ac]
call fcn.004034d8
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4151ac]
call fcn.004034d8
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4151ac]
call fcn.004034d8
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4554bc
push eax
push 0
push 0
mov eax, dword [0x59704c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41e9f4]
call fcn.0042018c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41e9f4]
call fcn.0042018c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41e9f4]
call fcn.0042018c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004594f4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4593bc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4593bc
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4593bc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x458e37
call fcn.00403898
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4591a0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45934b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45932c
mov dl, 1
mov eax, dword [0x4155c8]
call fcn.004034d8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004042b0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45931b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00447094
test al, al
je 0x45930e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45935c
lea eax, [ebp - 0x254]
call fcn.00409340
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45930e
xor eax, eax
push ebp
push 0x459307
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x459394
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4592f0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404520
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4592f0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404520
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45930e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x459211
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041912c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459352
lea eax, [ebp - 0x260]
call fcn.004042b0
ret

Function at 0x459c94
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x598b48]
cmp byte [eax + 0xa5], 0
jne 0x459d05
cmp dword [0x598b60], 0
jne 0x459cc6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x459c50
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x598b60], eax
cmp dword [0x598b5c], 0
jne 0x459ce1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x598b5c], eax
cmp dword [0x598b64], 0
jne 0x459d05
push esp
push 0
push 0
push 0x459bf4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x598b64], eax
pop edx
ret
Function at 0x45a398
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x598b48]
cmp dword [eax + 0x30], 0
je 0x45a442
cmp dword [ebx + 0x94], 0
jne 0x45a43c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45a328
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45a43c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45a402
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45a43c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417528
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45a411
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45afa0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45afd5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043a0
jmp 0x45afe2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404304
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45c0f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c135
mov eax, esi
call fcn.00442670
test al, al
je 0x45c135
mov eax, dword [ebx + 0x84]
call fcn.0044236c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c135
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044236c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45de0c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404760
mov eax, dword [ebp - 8]
call fcn.00404760
xor eax, eax
push ebp
push 0x45ded7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404770
push eax
call sub.kernel32.dll_LoadLibraryExA_1
test eax, eax
mov eax, dword [ebp - 4]
call fcn.00404770
push eax
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [0x598b9c], eax
cmp dword [0x598b9c], 0
je 0x45deb1
mov eax, dword [ebp - 8]
call fcn.00404770
push eax
mov eax, dword [0x598b9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x598ba0], eax
mov eax, dword [0x598ba4]
push eax
push 0x40
push 0x22233f4
push 0x598ba0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.nTDLL_ZwProtectVirtualMemory
mov edx, 0x598ba0
mov eax, sub.kernel32.dll_GetCPInfo
mov ecx, 4
call fcn.0045de00
mov eax, dword [0x598b9c]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dede
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042d4
ret
Function at 0x90ae1e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x8f4c5a
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x8f4c76
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x8f4c62
jmp 0x8f4c81
ret
jmp 0x8f4c4f

Function at 0x9231ac
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00923210
mov ebx, dword [ebp + 0xc]
jmp 0x923233
lea esp, [esp + 4]
jmp 0x8f31b4

Function at 0x9231d9
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.009231ac
sub ah, byte [ecx + 0x67a35031]
insb byte es:[edi], dx
loop 0x8f3251
pop ss
loop 0x8f3236
mov dword [reloc.WINMM.dll_midiStreamOut], eax
add dword [ebx + reloc.WINMM.dll_midiStreamOut], ecx
and eax, edx
lea ebx, [esp + esi]
mov bl, byte [esp]
jmp 0x9231c2
lea esp, [esp + 0x28]
jne 0x8f31d3
dec ebx
mov ebx, dword [esp]
jmp 0x923181
mov ebx, eax
jmp 0x8f31b4
push dword [esp + 2]
pushal
jmp 0x92319c
Function at 0x923318
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], ecx
lea esp, [esp + 4]
jmp 0x8f3208

Function at 0x924843
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
lea esp, [esp + 8]
sub edx, 0x47
jmp 0x9239d0

Function at 0xa0d94e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, eax
shr edi, 0x19
mov esi, ecx
push esp
bswap esi
stc
jmp 0xa0d931
rdtsc
mov cl, ch
not di
mov di, dx
popal
push esp
jmp 0xa0d8b3
mov word [esp + 4], bx
pop word [esp + 0x21]
bsf bp, ax
mov edi, esi
rdtsc
lea esi, [esi*4]
jmp 0xa0d8cb
push esp
push dword [esp + 0xe]
xchg word [esp + 0x21], di
push word [esp + 0x15]
mov cl, ch
rdtsc
jmp 0xa0d8e3
mov bh, byte [esp + 5]
mov bl, bh
mov word [esp + 1], dx
ror esi, 0xf
xchg si, bx
jmp 0xa0d9a6
inc al
push word [esp + 0x19]
add esp, 0xf
bsf bx, ax
mov ax, 0xefd5
mov al, 0xde
jmp 0xa0d919
jmp 0xa0d904
inc edx
not ebx
mov bl, bh
pop di
mov cx, bx
neg edx
jmp 0xa0d982
mov dx, bx
xchg dh, al
push word [esp + 3]
xchg si, ax
mov byte [esp + 7], ch
cpuid
jmp 0xa0d950
mov dl, 0x34
push word [esp + 6]
lea ecx, [ebp*4]
push dword [esp + 8]
push dword [esp]
sub esp, 2
jmp 0xa0da54
mov ecx, 0x3a089664
xchg ch, dl
pop word [esp + 7]
rdtsc
lea esp, [esp]
and eax, ecx
jmp 0xa0d96e
mov dl, 0xc
pop ecx
xchg ecx, ebx
lea esp, [esp + 4]
call fcn.00a0da38
cld
mov word [esp + 0x16], sp
xchg dword [esp + 2], eax
push edx
cpuid
mov dword [esp + 0x1a], esi
jmp 0xa0dab3
mov al, ah
call fcn.00a0da9a
setbe bh
mov word [esp + 7], dx
not ah
mov bp, word [esp + 1]
not si
setae ah
jmp 0xa0dbde
lea esi, [eax + 0xb1]
cmc
xchg dh, al
mov bl, bh
mov di, word [esp + 0x24]
popal
jmp 0xa0daec
push dword [esp]
sub esp, 0x1c
mov eax, esi
pop dx
mov bl, 0xe8
xchg dx, di
jmp 0xa0db0a
lea esp, [esp + 4]
xchg byte [esp + 2], al
mov dl, dh
setnp ah
push word [esp + 4]
xchg byte [esp + 6], dl
jmp 0xa0db39

Function at 0xa0dd15
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bx
xchg dword [esp + 0xc], edx
xchg word [esp + 0x13], bx
sub bx, 0x308
jmp 0xa0de36
bswap edi
xchg ebx, edx
mov esi, 0x69fd8110
xor dl, ch
xchg edx, ecx
mov edx, dword [esp]
jmp 0xa0dd41
mov bl, 0x60
rdtsc
lea ecx, [ecx*4]
rdtsc
lea edi, [eax - 0x59]
not si
jmp 0xa0dd5a
sub esp, 0xc
lea ebx, [edx + edx]
mov dx, 0xbffb
cmc
pushal
lea esp, [esp + 0x4a]
jmp 0xa0dd94

Function at 0xa0e419
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 9], ebp
add al, dh
mov bx, 0x9ad1
xchg word [esp + 1], dx
xchg bx, di
xchg ah, bl
jmp 0xa0e3f8
shr ah, 1
rdtsc
lea edx, [ecx - 0x33]
mov edi, ebp
mov bl, 0xf8
xchg dword [esp], ebx
jmp 0xa0e3c4
mov esi, dword [esp + 9]
clc
inc cl
cmc
xchg esi, eax
xchg word [esp + 9], bx
jmp 0xa0e450
cmc
xchg dx, ax
setg dh
pop dword [esp]
stc
jmp 0xa0e3e8
mov di, 0xbc79
pop dword [esp + 2]
cld
sub esp, 8
pushal
rdtsc
jmp 0xa0e48b
mov word [esp + 8], bx
lea ebx, [eax - 0x51]
lea edi, [ebx + ebp]
btc ebp, edi
mov al, ah
jmp 0xa0e472
neg edx
cpuid
cpuid
xchg esi, eax
add al, dh
lea ebx, [esi - 0x25]
jmp 0xa0e426
lea esp, [esp + 0x27]
xchg ch, dl
setnp ch
xchg byte [esp + 8], al
bswap eax
mov byte [esp + 3], ch
jmp 0xa0e437
Function at 0xa0e702
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 5]
jmp 0xa0e917
mov ebx, dword [esp + 6]
xchg dword [esp + 0x25], esi
xchg byte [esp + 6], bl
rdtsc
not esi
xchg ah, bl
jmp 0xa0e811
bswap esi
lea ecx, [edi*4]
push dword [esp + 2]
mov ebp, 0xf053c608
jmp 0xa0e76f
mov bh, byte [esp + 2]
pushal
xchg word [esp + 0x25], ax
xchg dword [esp + 0x10], edx
xchg ch, dl
mov ah, byte [esp + 1]
jmp 0xa0e787
xchg ecx, eax
xchg di, ax
not bh
mov ax, sp
push word [esp + 8]
jmp 0xa0e86a
add esp, 0xd
mov cl, 0x12
setl bh
not dh
lea edi, [ecx + 0x8b]
lea edi, [ebp*4]
jmp 0xa0e7b6
xchg word [esp + 1], si
rdtsc
cld
lea ecx, [ecx*4]
xchg dh, al
lea esp, [esp + 0x11]
jmp 0xa0e7cc
pop word [esp + 0x23]
sub eax, eax
xchg ebp, edx
mov word [esp + 0x1e], di
bswap eax
rcl ax, cl
jmp 0xa0e7ec
mov si, dx
mov di, word [esp]
setg dh
xchg byte [esp], bl
xchg dx, ax
jmp 0xa0e853
btr edx, esp
add esp, 0
setns dh
btc ebp, edi
not ecx
lea edi, [esi*4]
jmp 0xa0e826
xchg dh, al
lea esp, [esp]
call fcn.00a0e89d
inc edi
je 0xa0e8a7
imul ebp, dword [ebp + 0x54], reloc.WINMM.dll_midiStreamOut
out dx, al
lea esp, [esp + 4]
pop word [esp]
rdtsc
bsf dx, si
add esp, 8
xchg dx, di
jmp 0xa0e83c
fmul dword [ebx - reloc.WINMM.dll_midiStreamOut]
fnstsw word [edi]
mov word [esp], sp
neg di
bswap ebp
mov bp, sp
jmp 0xa0e8fc
xchg edi, ebx
ror ah, 1
btc ebx, edi
xchg byte [esp], al
shl si, cl
mov byte [esp + 1], dh
jmp 0xa0e7a0
mov ebp, eax
mov word [esp], bx
lea ebx, [ecx + ebx]
btc eax, edi
add esp, 2
call fcn.00a0e8db
inc ebp
jae 0xa0e976
popal
jo 0xa0e97b
add byte [esi - 1], ah
je 0xa0e93f
push word [esp + 5]
xchg byte [esp + 6], dl
add eax, 0x6245486
mov dword [esp + 3], ecx
mov word [esp + 6], sp
mov dword [esp], eax
lea ebp, [ecx*4]
jmp 0xa0e8c5
btc edi, ebx
bsf cx, ax
xchg si, bx
xchg esi, edi
cpuid
mov al, 0x9e
jmp 0xa0ea01
pop edx
rdtsc
push dword [esp + 0xb]
pop ax
xchg word [esp + 0x1a], ax
xchg byte [esp + 0x1c], cl
jmp 0xa0e935
inc al
cld
btr eax, esp
mov word [esp + 0xe], dx
pop dword [esp + 0xb]
mov byte [esp + 0x19], dh
or ecx, dword [eax - reloc.WINMM.dll_midiStreamOut]
shr byte [ebp + 0x69], cl
imul edx, dword fs:[ebx + 0x74], 0x6d616572
push edx
jae 0xa0e9ff
jmp 0xa0e94f
popal
jb 0xa0ea02
add byte [edi + 0x1c8b66f2], al
and al, 0x66
mov ebp, dword [esp + 0x1e]
mov ecx, dword [esp + 6]
stc
lea ecx, [edi + ebp]
jmp 0xa0e968
invalid
push word [esp + 5]
push dword [esp + 5]
mov dl, dh
bswap ecx
btc eax, ebx
neg esi
xchg word [esp + 0x1a], si
jmp 0xa0ea7f
mov word [esp + 0xb], dx
bsr ax, cx
lea esp, [esp + 1]
lea esp, [esp + 0x20]
popal
call fcn.00a0ea5c

Function at 0xa11b9a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x2b9d1762
cld
xchg ah, bl
mov cx, 0xe56d
mov ebp, 0x538e4d6
neg di
jmp 0xa11b82
stc
mov ecx, ebp
push dword [esp + 0x10]
jmp 0xa11b57
Function at 0xa11e5d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, ebp
lea ebx, [ecx*4]
bswap ebx
push word [esp]
pop word [esp]
sub esp, 0x18
jmp 0xa11e46
mov ebp, ecx
pop eax
lea eax, [ebx + ebx]
inc cl
xchg dh, al
mov ecx, 0xd945873a
jmp 0xa11df2
xchg ch, dl
xchg dword [esp + 0xe], ebp
btr edx, esp
mov ebx, dword [esp + 0xf]
bswap ecx
jmp 0xa11e63
shl si, cl
cpuid
bswap ecx
shr edi, 0x1f
cpuid
stc
jmp 0xa11e2f
clc
add esp, 1
jmp 0xa11e1e
pop dword [esp + 0x11]
mov esi, 0x81c32554
add edx, ebp
mov si, word [esp + 0xb]
mov dh, byte [esp + 0xb]
mov eax, 0xad9f70e8
jmp 0xa11eed
mov dx, word [esp + 2]
mov esi, 0x1d80314c
bswap eax
btc edi, ebx
cpuid
sete ch
jmp 0xa11ea0
cpuid
pushal
xchg dword [esp + 7], ecx
xchg bh, cl
mov ebp, dword [esp + 0xd]
inc eax
jmp 0xa11ecc

Function at 0xa1240f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, bx
mov bx, word [esp + 6]
clc
mov ax, word [esp + 6]
xchg bx, cx
push esp
jmp 0xa12463
mov si, 0x1fb5
mov ecx, esi
mov edx, esi
cmc
mov si, dx
xchg dword [esp], ecx
jmp 0xa123b4
not esi
mov cl, ch
mov ax, 0x2e87
xchg ah, bl
mov cl, ch
ror ebp, 1
jmp 0xa123d3
btr edx, edx
mov dword [esp + 3], eax
jmp 0xa123ea
push edx
xchg dword [esp + 0xf], eax
setae ah
xchg byte [esp + 0xe], cl
rdtsc
jmp 0xa12473
pop ax
xchg dword [esp], ecx
pop word [esp]
xchg bp, ax
pop di
pushal
jmp 0xa12418
xchg ecx, edx
cpuid
mov al, ah
mov byte [esp + 2], bh
add esp, 7
cpuid
jmp 0xa1242e
cpuid
rdtsc
btc ecx, edi
cpuid
push edx
mov dx, 0xe7dd
jmp 0xa12445
mov word [esp + 0x18], bx
mov byte [esp + 0x11], dh
xchg di, ax
push dword [esp + 0x14]
jmp 0xa124bd
xchg edx, ebp
mov bx, dx
mov word [esp + 0x26], di
setns dh
lea eax, [esi*4]
pop dword [esp + 0x1e]
jmp 0xa1249c

Function at 0xa124d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 6]
mov ebp, dword [esp + 0xc]
rcl bp, cl
pop bx
jmp 0xa1251f
setg bh
cld
stc
push esp
xchg bp, ax
xchg bh, cl
jmp 0xa12508
xchg dh, al
xchg word [esp + 5], si
bsr cx, bp
bsr ax, cx
mov dl, dh
pop dword [esp + 3]
jmp 0xa124e6

Function at 0xa12afc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0x22]
xchg byte [esp + 0xc], cl
bswap edi
sub esp, 0x18
lea esp, [esp + 0x41]
jmp 0xa12b8a
bsf bp, si
push dword [esp + 8]
pop word [esp + 3]
not ecx
stc
jmp 0xa12b72
mov cl, 0x52
rdtsc
clc
sub esp, 0xc
push dword [esp + 6]
mov bl, 0x70
jmp 0xa12b2a
lea esp, [esp + 9]
lea edi, [esp + edi]
xchg ch, dl
add esp, 8
lea ebp, [esp + ebp]
mov byte [esp + 3], ah
jmp 0xa12bca
bsf di, si
lea eax, reloc.WINMM.dll_midiStreamOut
mov al, ah
mov esi, 0xffd4d9a
jmp 0xa12b50
btc ecx, edi
sub esp, 4
xor dl, ch
btr edi, edx
neg dh
bswap edx
jmp 0xa12b40
pop ecx
rdtsc
btr edx, edx
mov ebp, 0x8f2aca66
call fcn.00a12c0a
xchg edi, eax
push cs
pushfd
sti
push ss
xchg ecx, eax
pop ds
xchg dh, al
btc edi, ebx
neg bh
mov dl, 0xb4
xchg byte [esp], al
mov byte [esp + 1], bh
jmp 0xa12b9b
mov di, 0x8795
mov ebx, dword [esp]
setnp bh
mov ebp, dword [esp + 3]
setae ah
not cx
jmp 0xa12bb2
Function at 0xa12dcc
Capabilities:
Get number of processors
Parse pe header

Disassembly:
mov dword [esp], esi
push dword [esp + 2]
pushal
jmp 0xa12e59
lea esp, [esp + 0x1d]
call fcn.00a12e1e

Function at 0xa12e62
Capabilities:
Get number of processors
Parse pe header

Disassembly:
call fcn.00a1201f
pop word [esp + 0xc]
lea esp, [esp + 3]
jmp 0xa12e96
mov eax, dword fs:[0x30]
jmp 0xa12f0f
mov dword [esp + 0x7c], edi
lea esp, [esp + 0x7c]
jmp 0xa12e6d
mov eax, dword [eax + 8]
push eax
jmp 0xa1201a
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0xa12eef
Function at 0x40776b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
jne 0x407780
xor eax, eax
jmp 0x4077c2
mov ecx, esi
call fcn.00407813
test eax, eax
je 0x40777c
mov ecx, esi
mov byte [esi + 0x38], bl
call fcn.00407832
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
lea eax, [ebp + 8]
push eax
push ebx
push esi
push 0x4079e2
push ebx
push ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [esi], eax
mov eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x407850
Capabilities:
Resume thread

Disassembly:
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret