joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40589c
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405b5a
test bl, 8
mov dword [ebp - 0xc], eax
je 0x4058db
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7a3008], eax
jmp 0x405a65
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x4058f5
test eax, eax
je 0x405a13
test bl, 2
je 0x405a13
mov esi, 0x7a0570
push edi
push esi
call fcn.004060d4
cmp dword [ebp + 8], 0
je 0x405914
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40591a
push edi
call fcn.00405ab3
cmp byte [edi], 0
jne 0x405928
cmp byte [0x7a0570], 0x5c
jne 0x405933
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405a09
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405a97
cmp byte [eax], 0
je 0x405979
cmp byte [ebp - 0x1c], 0
je 0x405979
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x40598f
mov al, byte [esi + 1]
test al, al
je 0x4059e8
cmp al, 0x2e
jne 0x40598f
cmp byte [esi + 2], 0
je 0x4059e8
push esi
push ebx
call fcn.004060d4
test byte [ebp - 0x14c], 0x10
je 0x4059b4
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4059e8
push dword [ebp + 0xc]
push edi
call fcn.0040589c
jmp 0x4059e8
push dword [ebp - 4]
push edi
call fcn.00405854
test eax, eax
jne 0x4059e0
cmp dword [ebp - 4], eax
je 0x4059d8
push edi
push 0xfffffffffffffff1
call fcn.004051fb
push 0
push edi
call fcn.00405eb3
jmp 0x4059e8
inc dword [0x7a3008]
jmp 0x4059e8
push edi
push 0xfffffffffffffff2
call fcn.004051fb
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405957
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405a13
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405a65
cmp dword [ebp - 0xc], esi
jne 0x405a27
inc dword [0x7a3008]
jmp 0x405a65
push edi
call fcn.00406448
test eax, eax
je 0x405a65
push edi
call fcn.00405a6c
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405854
test eax, eax
jne 0x405a5d
cmp dword [ebp - 4], esi
je 0x405a1f
push edi
push 0xfffffffffffffff1
call fcn.004051fb
push esi
push edi
call fcn.00405eb3
jmp 0x405a65
push edi
push 0xffffffffffffffe5
call fcn.004051fb
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405b5a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7a0970
push esi
call fcn.004060d4
push esi
call fcn.00405b05
mov edi, eax
test edi, edi
jne 0x405b7b
xor eax, eax
jmp 0x405bcd
push edi
call fcn.004063af
test byte [0x7a2f7c], 0x80
je 0x405b94
mov al, byte [edi]
test al, al
je 0x405b77
cmp al, 0x5c
je 0x405b77
sub edi, esi
jmp 0x405bac
call fcn.00406448
test eax, eax
je 0x405ba6
test byte [eax], 0x10
je 0x405b77
push esi
call fcn.00405ab3
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405b98
call fcn.00405a6c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405c48
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405c67
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405c6d
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405c9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a3d4]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405ce1
test edi, edi
jne 0x405ca7
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405cdb
Function at 0x405d43
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov dword [0x7a12f8], 0x4c554e
mov edi, 0x400
mov ebp, 0x7a12f8
je 0x405d8f
push 1
push 0
push esi
call fcn.00405c6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405eae
cmp eax, edi
jg 0x405eae
mov esi, 0x7a16f8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405eae
cmp eax, edi
jg 0x405eae
push esi
push ebp
push str._s_s_r_n
push 0x7a0ef8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x7a2f74]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00406167
push 4
push 0xc0000000
push esi
call fcn.00405c6d
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x405eae
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405ea7
push edi
push esi
push ebp
call fcn.00405ce5
test eax, eax
je 0x405ea7
push str._Rename__r_n
push esi
call fcn.00405bd2
test eax, eax
jne 0x405e45
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405e7a
add eax, 0xa
push 0x40a3d8
push eax
call fcn.00405bd2
mov ebp, eax
test ebp, ebp
je 0x405e76
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405e67
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405e61
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x405e7c
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x7a0ef8
push eax
call fcn.00405c28
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00405d14
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405eb3
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x405ed6
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405d43
pop ecx
pop ecx
inc dword [0x7a3010]
ret 8

Function at 0x405fbb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 4], 0x400
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405f5a
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x40602a
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp + 0xc]
push esi
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and byte [esi + 0x3ff], 0
test edi, edi
pop edi
jne 0x40602a
cmp dword [ebp + 0xc], 1
je 0x40602d
cmp dword [ebp + 0xc], 2
je 0x40602d
and byte [esi], 0
pop esi
leave
ret 0x14
Function at 0x40646f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406493
xor eax, eax
test eax, eax
je 0x4064a5
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4064a5
xor ecx, ecx
jmp 0x4064a8
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406594
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a1afc], 0
push esi
jne 0x4065cb
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4065a5
mov dword [ecx*4 + 0x7a1af8], eax
inc ecx
cmp ecx, 0x100
jl 0x4065a0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4065fc
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a1af8]
xor eax, esi
inc ecx
dec edx
jne 0x4065de
pop edi
not eax
pop esi
ret 0xc
Function at 0x408d90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40800d
lea edi, [esi - 0x700d]
push edi
jmp 0x408daa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x408db1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x408da0
mov eax, 1
add ebx, ebx
jne 0x408dc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x408db8
jne 0x408dd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408db8
xor ecx, ecx
sub eax, 3
jb 0x408de8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408e5a
mov ebp, eax
add ebx, ebx
jne 0x408df3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x408e00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x408e24
inc ecx
add ebx, ebx
jne 0x408e10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x408e05
jne 0x408e21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408e05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x408e44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x408e35
jmp 0x408da6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x408e44
add edi, ecx
jmp 0x408da6
pop esi
mov edi, esi
mov ecx, 0x58
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x408e62
cmp byte [edi], 1
jne 0x408e62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x408e67
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x408ed6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x91a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9268]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x408e94
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9270]
or eax, eax
je 0x408ed0
mov dword [ebx], eax
add ebx, 4
jmp 0x408eb1
call dword [esi + 0x926c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x408f07
cmp al, 0xef
ja 0x408efa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x408edc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x408ee9
mov ebp, dword [esi + 0x9274]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x408f3b
sub esp, 0xffffff80
jmp 0x40124a
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x47c15bec
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x45dc1894
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d7a
nop
nop
sub eax, 0x403d20
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x89a150
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esp
call 0x89a0dd
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x89a16b
pushfd
call 0x89a172
mov eax, 0x24148b66
xchg bx, cx
mov dx, sp
mov edx, dword [esp]
jmp 0x89b15e
pop ebx
xchg dword [esp + 0x34], esi
mov al, byte [esp]
btr dx, sp
call fcn.0089a5e4
xchg bl, al
lea esi, reloc.WINMM.dll_waveOutUnprepareHeader
sete dl
push edx
lea edi, [ecx + ebx]
not bx
jmp 0x89a64d
mov ch, 0x1e
xchg dword [esp], esi
clc
rol edi, cl
sub esp, 0x14
pushal
jmp 0x89ac54

Function at 0x89a172
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esp
call 0x89a0dd
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x89a16b
pushfd
call 0x89a172
mov eax, 0x24148b66
xchg bx, cx
mov dx, sp
mov edx, dword [esp]
jmp 0x89b15e
pop ebx
xchg dword [esp + 0x34], esi
mov al, byte [esp]
btr dx, sp
call fcn.0089a5e4
xchg bl, al
lea esi, reloc.WINMM.dll_waveOutUnprepareHeader
sete dl
push edx
lea edi, [ecx + ebx]
not bx
jmp 0x89a64d
mov ch, 0x1e
xchg dword [esp], esi
clc
rol edi, cl
sub esp, 0x14
pushal
jmp 0x89ac54
Function at 0x89a3cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
jmp 0x89a439
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
mov ax, 0x8b3
clc
jmp 0x89a484
not al
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
xor edx, dword [edi - 0x3e]
cli
not ah
jmp 0x89a41c
mov dl, bl
mov ah, bl
not eax
mov al, 7
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
mov ax, 0x3652
jmp 0x89a3f2
not dl
lea eax, [eax*4]
neg al
jg 0x89a460
jle 0x89a44a
mov dh, 0x35
movsd dword es:[edi], dword [esi]
int3
sub bl, cl
setnp ah
mov edx, 0x2de2a36c
mov eax, 0x476d1169
jmp 0x89a408
neg ah
jmp 0x89a462
neg ah
call 0x89a468
jno 0x89a3f6
and al, 4
dec dl
rcl ah, cl
jb 0x89a4e9
mov ah, dl
mov ax, cx
not ax
cmc
cmc
jmp 0x89a490
jae 0x89a3b9
bswap eax
jmp 0x89a439
cmc
cmc
push esp
jmp 0x89a4cc
lea esp, [esp + 4]
inc dl
btc ax, dx
jg 0x89a4b6
jle 0x89a5a2
dec ecx
int3
mov ah, dl
mov ax, cx
not ax
jmp 0x89a48e
lea eax, [edi*4]
pushfd
mov dword [esp], ebx
cmp al, bh
jmp 0x89a51e
ror dl, 0
mov ah, dh
xchg ah, al
bswap eax
jmp 0x89a493
jmp 0x89a4ac
pop word [esp]
call fcn.0089a501
jae 0x89a53d
mov eax, 0x968f5afc
jmp 0x89a542
mov eax, 0x968f5afc
sub cl, dl
not edx
jmp 0x89a54c
add dx, sp
jno 0x89a582
pushfd
xchg edx, eax
jmp 0x89a56c
cmp al, bh
pop word [esp]
jmp 0x89a522
inc esi
mov al, byte [esp]
mov dl, byte [esp]
lea eax, [ecx*4]
jmp 0x89a587
pushfd
xchg edx, eax
jmp 0x89a56c
mov dx, 0x6bd2
not ax
mov ax, word [esp]
xchg edx, eax
lea edx, [ebx + edi]
jmp 0x89a5c5
in al, 0xef
mul cl
and byte [ebp + 0xbd04], cl
add byte [eax], al
lea eax, [edi*4]
pushfd
mov dword [esp], ebx
jmp 0x89a564
call 0x89a619
jo 0x89a59d
ja 0x89a5ca
loope 0x89a60b
mov ds, word [eax]
mov gs, ecx
sbb dl, bl
cmc
in al, 0x17
jle 0x89a60e
rol bl, 0
jne 0x89a5af
je 0x89a5af
pushfd
and al, 0x57
js 0x89a601
push word [esp + 4]
jmp 0x89a5eb
lea esp, [esp + 2]
jmp 0x89a622
mov al, byte [0xb3f632c7]
stosb byte es:[edi], al
lds esi, [esi - 1]
je 0x89a629
push word [esp + 4]
lea esp, [esp + 2]
add al, 0x8d
and al, 2
jmp 0x89a622
push ss
jg 0x89a5f9
jnp 0x89a62e
in eax, dx
pop esp
xchg edi, eax
or al, 0x82
in eax, 0x14
rcr byte [ecx], 1
rdtsc
mov dl, dh
mov dx, ax
jmp 0x89a5cc
lea esp, [esp + 8]
sub bl, 0xbb
mov ax, word [esp]
neg edx
jmp 0x89a68a
invalid
not edx
mov edx, dword [esp]
mov edx, dword [esp]
sub dx, dx
mov eax, ebx
push sp
jmp 0x89a668
mov edx, dword [esp]
sub dx, dx
mov eax, ebx
jmp 0x89a642
lea esp, [esp + 2]
rol bl, 0
je 0x89ab2d
neg eax
jmp 0x89ab2f
jo 0x89a635
not edx
mov edx, dword [esp]
jmp 0x89a65e
neg eax
call fcn.0089a706
push dword [esp + 1]
lea esp, [esp + 1]
jmp 0x89ab73
mov dword [edi], edx
mov ebx, esp
mov eax, 0xfaf53b21
jmp 0x89ab59
Function at 0x89a468
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
jmp 0x89a439
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
mov ax, 0x8b3
clc
jmp 0x89a484
not al
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
xor edx, dword [edi - 0x3e]
cli
not ah
jmp 0x89a41c
mov dl, bl
mov ah, bl
not eax
mov al, 7
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
mov ax, 0x3652
jmp 0x89a3f2
not dl
lea eax, [eax*4]
neg al
jg 0x89a460
jle 0x89a44a
mov dh, 0x35
movsd dword es:[edi], dword [esi]
int3
sub bl, cl
setnp ah
mov edx, 0x2de2a36c
mov eax, 0x476d1169
jmp 0x89a408
neg ah
jmp 0x89a462
neg ah
call 0x89a468
jno 0x89a3f6
and al, 4
dec dl
rcl ah, cl
jb 0x89a4e9
mov ah, dl
mov ax, cx
not ax
cmc
cmc
jmp 0x89a490
jae 0x89a3b9
bswap eax
jmp 0x89a439
cmc
cmc
push esp
jmp 0x89a4cc
lea esp, [esp + 4]
inc dl
btc ax, dx
jg 0x89a4b6
jle 0x89a5a2
dec ecx
int3
mov ah, dl
mov ax, cx
not ax
jmp 0x89a48e
lea eax, [edi*4]
pushfd
mov dword [esp], ebx
cmp al, bh
jmp 0x89a51e
ror dl, 0
mov ah, dh
xchg ah, al
bswap eax
jmp 0x89a493
jmp 0x89a4ac
pop word [esp]
call fcn.0089a501
jae 0x89a53d
mov eax, 0x968f5afc
jmp 0x89a542
mov eax, 0x968f5afc
sub cl, dl
not edx
jmp 0x89a54c
add dx, sp
jno 0x89a582
pushfd
xchg edx, eax
jmp 0x89a56c
cmp al, bh
pop word [esp]
jmp 0x89a522
inc esi
mov al, byte [esp]
mov dl, byte [esp]
lea eax, [ecx*4]
jmp 0x89a587
pushfd
xchg edx, eax
jmp 0x89a56c
mov dx, 0x6bd2
not ax
mov ax, word [esp]
xchg edx, eax
lea edx, [ebx + edi]
jmp 0x89a5c5
in al, 0xef
mul cl
and byte [ebp + 0xbd04], cl
add byte [eax], al
lea eax, [edi*4]
pushfd
mov dword [esp], ebx
jmp 0x89a564
call 0x89a619
jo 0x89a59d
ja 0x89a5ca
loope 0x89a60b
mov ds, word [eax]
mov gs, ecx
sbb dl, bl
cmc
in al, 0x17
jle 0x89a60e
rol bl, 0
jne 0x89a5af
je 0x89a5af
pushfd
and al, 0x57
js 0x89a601
push word [esp + 4]
jmp 0x89a5eb
lea esp, [esp + 2]
jmp 0x89a622
mov al, byte [0xb3f632c7]
stosb byte es:[edi], al
lds esi, [esi - 1]
je 0x89a629
push word [esp + 4]
lea esp, [esp + 2]
add al, 0x8d
and al, 2
jmp 0x89a622
push ss
jg 0x89a5f9
jnp 0x89a62e
in eax, dx
pop esp
xchg edi, eax
or al, 0x82
in eax, 0x14
rcr byte [ecx], 1
rdtsc
mov dl, dh
mov dx, ax
jmp 0x89a5cc
lea esp, [esp + 8]
sub bl, 0xbb
mov ax, word [esp]
neg edx
jmp 0x89a68a
invalid
not edx
mov edx, dword [esp]
mov edx, dword [esp]
sub dx, dx
mov eax, ebx
push sp
jmp 0x89a668
mov edx, dword [esp]
sub dx, dx
mov eax, ebx
jmp 0x89a642
lea esp, [esp + 2]
rol bl, 0
je 0x89ab2d
neg eax
jmp 0x89ab2f
jo 0x89a635
not edx
mov edx, dword [esp]
jmp 0x89a65e
neg eax
call fcn.0089a706
push dword [esp + 1]
lea esp, [esp + 1]
jmp 0x89ab73
mov dword [edi], edx
mov ebx, esp
mov eax, 0xfaf53b21
jmp 0x89ab59

Function at 0x89a501
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, dh
mov al, byte [esp]
mov ah, 3
mov eax, dword [esp]
rcr eax, 0x1d
jmp 0x89a527
lea esp, [esp + 2]
lea esp, [esp + 4]
add dl, 0xfb
jmp 0x89a4eb