joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52dc8f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0052b4cd
add esp, 0xc
jns 0x52dcb1
test dword [esp + 4], ecx
lea esi, [esi + 0x61b0]
lea esi, [esi - 0x61b0]
je 0x52dcd0
mov edx, edx
jns 0x52dcc7
lea esp, [esp]
ja 0x52dccc
jne 0x52dcd0
xor dword [edi], 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.005242c6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x52dd98
xor eax, eax
jmp 0x52ddf9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005132bc
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0052b4cd
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x52ddc2
xor eax, eax
jmp 0x52ddf9
test ecx, esi
xor esp, 0
jg 0x52ddc9
and edx, edx
jle 0x52ddd7
lea esi, [esi]
ja 0x52ddd1
jne 0x52ddd3
jg 0x52ddd7
mov ebx, 0xe8458bb2
mov eax, dword [ebp - 0x18]
push eax
call fcn.00508f45
add esp, 4
mov esp, esp
jno 0x52ddee
jp 0x52dde9
jne 0x52ddeb
jo 0x52ddee
mov ebp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52f78c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0052b4cd
add esp, 0xc
xor eax, 0x3725
xor eax, 0x3725
xor ebx, dword [esp]
xor ebx, dword [esp]
jg 0x52f7c6
pushf
rol eax, 0x1c
ror eax, 0x1c
popf
jge 0x52f7c3
jle 0x52f7c6
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
jg 0x52f804
or esi, 0
cld
jae 0x52f810
mov ecx, ecx
jb 0x52f810
cmp edi, 0x80e84d8a
jmp 0xe8a0801a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00520551
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x52f89c
xor eax, eax
jmp 0x52f8ff
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005132bc
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0052b4cd
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x52f8fd
ror esp, 0
xor edx, ebx
xor edx, ebx
je 0x52f8d0
jb 0x52f8cd
jne 0x52f8d0
mov ecx, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.00508f45
add esp, 4
xchg ebx, ebx
rol eax, 0
jbe 0x52f8e3
jp 0x52f8ec
je 0x52f8e7
jno 0x52f8e9
jnp 0x52f8ec
mov esp, 0x51104d8b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x52f8ff
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x53286d
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x504998
call fcn.00525cc2
add esp, 0xc
mov byte [0x504998], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x535fe1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x535ff5
jmp 0x5361a6
jo 0x535ff7
or esp, 0
je 0x535ffc
xchg ecx, edi
xchg ecx, edi
jno 0x536024
pushf
js 0x536006
xor esi, 0x4dec
xor esi, 0x4dec
cmp eax, dword [esp]
je 0x536017
popf
jb 0x53601b
xchg esi, edx
xchg esi, edx
jp 0x536021
jo 0x536024
add eax, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x504528], edx
jno 0x536037
or esp, 0
jae 0x536047
jl 0x53603e
mov eax, eax
lea eax, [eax]
lea edi, [edi]
jb 0x536047
mov eax, 0x8bec458b
dec eax
add al, 0x89
or eax, 0x504714
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x504714], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x504710], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x50451c], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x504520], ecx
std
cld
test dword [esp + 4], edi
nop
rol ebx, 0
jg 0x53608d
jb 0x536084
je 0x536086
nop
jnp 0x536089
jle 0x53608d
add eax, 0xf045c603
dec ebp
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
nop
add eax, 0x1774
sub eax, 0x1774
cmp esp, 0x3b9b
ja 0x5360e5
pushf
jl 0x5360d8
xchg ebx, ebx
popf
jg 0x5360de
jl 0x5360e0
mov esp, esp
jbe 0x5360e5
mov edx, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
xchg esp, esp
jb 0x536151
jae 0x536160
jbe 0x536155
js 0x536157
xchg ebx, ecx
xchg ebx, ecx
jbe 0x53615d
jb 0x536160
jmp 0x47639ee7
cmp dword [0x504710], 0
je 0x53617d
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x504710]
push eax
call fcn.005132bc
mov dword [0x504524], eax
js 0x53617f
jle 0x536181
nop
cmc
jl 0x536196
pushf
xchg ebx, ecx
xchg ebx, ecx
popf
jb 0x53618f
jo 0x536191
jns 0x536193
jge 0x536196
xor eax, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0052b4cd
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5375ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0052b4cd
add esp, 0xc
push edx
pop edx
test esp, 0x561d
test esp, 0xd48
jle 0x5375ea
pushf
call 0x5375dc
add esp, 4
jp 0x5375e1
js 0x5375e3
popf
ja 0x5375e7
jg 0x5375ea
sub eax, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
and edi, edi
shr esp, 0
xor esp, 0
jno 0x537640
pushf
or esp, 0
popf
jbe 0x537639
xchg edx, edx
jle 0x53763d
jo 0x537640
jmp 0x813fc3ce
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.005242c6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5376ca
jmp 0x537727
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005132bc
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0052b4cd
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x537727
xchg ebx, ebx
jns 0x5376f9
nop
js 0x5376f9
mov edx, 0xe8458b9c
mov eax, dword [ebp - 0x18]
push eax
call fcn.00508f45
add esp, 4
js 0x537707
jne 0x537714
jne 0x53770b
jne 0x53770d
jbe 0x53770f
xchg edi, edi
je 0x537714
xor eax, 0x51144d8b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x537f06
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0052b4cd
add esp, 0xc
push 0x21
push 0x504f14
lea ecx, [ebp - 0x138]
push ecx
call fcn.00513091
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x53800e
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0052b4cd
add esp, 0xc
push 0xb
push 0x504f38
lea edx, [ebp - 0x138]
push edx
call fcn.00513091
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x538001
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00513091
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x538010
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x53803f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0052b4cd
add esp, 0xc
rol edx, 0
test esp, 0x6da8
je 0x538063
jno 0x538073
xchg esi, ecx
xchg esi, ecx
jbe 0x53806b
jp 0x53806d
js 0x53806f
jo 0x538073
mov edx, 0xec45c641
push eax
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x10], 0x51
mov byte [ebp - 0xb], 0x74
sub edi, 0
rol esi, 8
ror esi, 8
push esi
pop esi
ja 0x5380b0
jbe 0x5380cc
pushf
test dword [esp + 0x10], esi
lea eax, [eax + 0x3cb7]
lea eax, [eax - 0x3cb7]
popf
nop
jle 0x5380c9
ja 0x5380cc
mov esp, 0x80ec4d8a
jmp 0xeca108d6
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.005242c6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x53813e
xor eax, eax
jmp 0x5381b1
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005132bc
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0052b4cd
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x5381af
not edx
not edx
add esp, 0
call 0x538170
add esp, 4
jle 0x53817c
xchg edx, ebx
xchg edx, ebx
jg 0x53817c
sub eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.00508f45
add esp, 4
cmc
sub ebx, 0
jle 0x53818e
xchg ebx, eax
xchg ebx, eax
js 0x53819e
jg 0x538194
ja 0x538196
js 0x538198
xchg ebx, eax
xchg ebx, eax
jns 0x53819e
call 0x10a10d7e
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x5381b1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x7b102e
Capabilities:
Execute anti-debugging instructions

Disassembly:
fnstcw word [eax - 0x49f838fe]
lea esp, [esp + 4]
jmp 0x7b104b
mov ax, word [esp]
bt eax, esp
ja 0x7b1017
jbe 0x7b1017
dec eax
rcl dword [ecx + 0x30], 0xc3
jo 0x7b1009
inc edi
xlatb
mov dl, 0x41
invalid
rol cl, 0
lea edx, [edx*4]
mov al, ah
lea eax, [ebx + edi]
add ax, 0xe1dc
jmp 0x7b109f
pushal
mov eax, dword [esp + 0x17]
jmp 0x7b10cb
sete ah
mov edx, 0x61b81c68
mov dl, dh
rdtsc
lea edx, [ebp*4]
bsf ax, ax
jmp 0x7b10d3
jo 0x7b10bf
mov dx, word [esp]
setne dh
jmp 0x7b1076
mov dx, word [esp]
setne dh
pushal
mov eax, dword [esp + 0x17]
lea esp, [esp + 0x20]
not cl
jmp 0x7b107d
js 0x7b10ed
jns 0x7b10ed
add cl, 8
lea edx, [ecx - 0x23]
lea edx, [ecx + 0xcb]
sub esp, 0xa
jmp fcn.007b11c3

Function at 0x7b17de
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x7b0f25
neg edx
inc dh
bswap edx
jmp 0x7b1737
push edx
mov dx, 0x2bc5
lea edx, [esi + 0xad]
lea eax, [esp + ecx]
jmp 0x7b178e
mov al, 0x4e
sbb ax, 0x6400
neg ax
cmc
jmp 0x7b1747
ja 0x7b1721
push edx
mov dx, 0x2bc5
jmp 0x7b1755
lea edx, [esi + 0xad]
lea eax, [esp + ecx]
jmp 0x7b178e
lea esp, [esp + 4]
xor cl, 0xdf
mov dx, word [esp]
lea eax, [ecx + 0x4b]
mov eax, 0x871459f0
jmp 0x7b17aa
rol ax, cl
jp 0x7b17f5
jnp 0x7b17f5
sbb byte [esi], 0x8c
jmp 0x7b17dc
pop edx
jmp 0x7b185b
jle 0x7b1827
not dx
push edx
lea edx, [ebx*4]
inc al
jmp 0x7b18b9
call 0x7b17de
pop ds
ret
jge 0x7b1831
sub esp, 0x16
bt edx, edi
jmp 0x7b1842
or al, 0x82
in eax, 0x14
mov dword [reloc.WINMM.dll_midiStreamOut], eax
lodsd eax, dword [esi]
sub esp, 0x16
bt edx, edi
xchg word [esp + 0xb], dx
jmp 0x7b188d
xchg word [esp + 0xb], dx
rdtsc
mov edx, edi
jmp 0x7b1891
lea esp, [esp + 4]
rol cl, 0
mov ax, 0xf1fd
mov ax, 0xc1d1
btc eax, edi
jmp 0x7b1816
rcr eax, 0xb
je 0x7b1898
push dword [esp + 0xc]
xchg dword [esp + 0xb], edx
lea esp, [esp + 2]
jmp 0x7b18f7
rdtsc
mov edx, edi
setbe dh
mov dl, 0xe4
jmp 0x7b186f
push dword [esp + 0xc]
xchg dword [esp + 0xb], edx
jmp 0x7b18f3
mov dh, 0xda
mov ax, 0xe61d
mov dx, 0x62a7
mov dh, 0xf2
mov ax, 0x78cf
jmp 0x7b18da
jno 0x7b17c8
pop edx
jmp 0x7b185b
add cl, 8
setnp dh
setns dh
mov dh, bh
bswap edx
jmp 0x7b1904
mov eax, dword [esp]
mov al, byte [esp]
mov al, ah
jmp 0x7b18c2
lea esp, [esp + 2]
lea esp, [esp + 0x18]
not cl
mov eax, 0x6e6e55d2
jmp 0x7b18a2
and ecx, 0x3c
not dx
mov dl, byte [esp]
xchg edx, eax
stc
jmp 0x7b194b
jl 0x7b1966
jge 0x7b1966
mov edx, dword [esi]
bswap eax
xchg ah, al
call fcn.007b192c
inc edi
fisttp dword [ebx + 0x2e]
invalid

Function at 0x955a2f
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 3]
pop word [esp]
push dword [esp + 5]
pop word [esp + 2]
mov byte [esp + 3], ah
mov word [esp + 3], di
jmp 0x9559e6
jmp 0x955a0c

Function at 0x955a50
Capabilities:
Parse pe header

Disassembly:
push dword [esp + 2]
mov word [esp + 2], sp
call fcn.00955a2f

Function at 0x955a79
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x13], esi
pushal
lea esp, [esp + 0x43]
push esp
mov dword [esp], esi
pushal
jmp 0x955a88
lea esp, [esp + 1]
pushal
pop dword [esp + 0x15]
push dword [esp + 0x1a]
jmp 0x955a5e
mov dword [esp + 0x2c], ebp
call fcn.00955ae7
Function at 0x955a91
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x95000e
call fcn.00950013
call 0x95436f
jmp 0x955b5b
movzx ebx, word [eax + 0x3c]
jmp 0x955b41
pop dword [esp]
mov word [esp + 2], sp
push esp
jmp 0x955ad0
pop word [esp + 0x13]
pop dword [esp + 2]
mov byte [esp + 8], ch
jmp 0x955b10
push dword [esp + 0xa]
mov dword [esp + 0x38], esi
push esp
mov dword [esp], ebp
mov byte [esp], ah
pushal
jmp 0x955aba
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
mov eax, dword fs:[0x30]
jmp 0x955b92
lea esp, [esp + 0x13]
pop dword [esp]
mov byte [esp + 1], ch
lea esp, [esp + 3]
jmp 0x955af2
add ebx, eax
cmp word [ebx], 0x4550
jmp 0x955b9c
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x955bc2
mov eax, dword [eax + 8]
push eax
jmp 0x95436a
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x955b79
je 0x94fdec
jne 0x955bc8
cmp esp, dword [eax + reloc.WINMM.dll_midiStreamOut]
inc edi
fisttp qword [ebp + 0x14]
out 0x52, eax
mov bh, 0x2e
mov esp, 0xa3b136db
inc ebx
sal dword [esi + reloc.WINMM.dll_midiStreamOut], cl
xor byte [ebx], dh
sub al, byte [ebp + 0xf]
test byte [edi + 0x2dffff], bh
add byte [ecx], al
add bl, ch
nop
hlt
je 0x954384
sub eax, 0x10000
jmp 0x955b5f

Function at 0x955ae7
Capabilities:
Parse pe header

Disassembly:
push edx
mov word [esp + 2], di
call fcn.00955a91

Function at 0x955b28
Capabilities:
Parse pe header

Disassembly:
pop word [esp + 9]
pop dword [esp]
push word [esp + 3]
lea esp, [esp + 3]
mov dword [esp], esi
jmp 0x955a3a

Function at 0x955c13
Capabilities:
Encode data using xor

Disassembly:
ficomp word [edi - 0x31]
stosb byte es:[edi], al
pop ecx
xchg dword [eax + esi*4], esi
inc ecx
mov al, 0x5e
sub ch, byte [ebp + 0x5cb7443d]
xor al, 0xbe
sub al, 0x4b
invalid
mov word [esp + 2], di
mov dword [esp + 3], esi
mov dword [esp + 8], edx
call fcn.00955a50
mov byte [edi], al
xchg edi, eax
add eax, esp
mov eax, 0x56b8492e
sbb byte [ebp + 0x7f9f6c05], dl
mov al, byte [esi]
insb byte es:[edi], dx
lahf
jg 0x955bc2
push es
xchg esp, eax
push cs
in eax, 0x38
mov ebx, 0x58bd4e2b
push cs
pushfd
xor dl, byte [ebp - 0x5c]
inc esi
js 0x955c34
jmp 0x18074c8
jns 0x955c65
jmp 0x955c4f
lcall 0x38ad, 0xaff980a
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0x56c05646
xor eax, eax
cwde
dec dword [edx]
lodsd eax, dword [esi]
cmp byte [edi + 0x46a95a3f], ch
push esi
rcl byte [esi + 0x31], 0xc0
jne 0x955c4a
jge 0x955c51
je 0x955bed
xchg dword [edx + ebx*8], ebp
sub al, 0xda
dec esi
fdivr qword [ebx - 0x1cb71faa]
jae 0x955c87
in eax, 0x4a
mov esi, 0x2cddba24
xchg ebx, eax
enter 0xffffffffffffc151, 0xffffffffffffffa0
push ebx
clc
dec edx
rol byte [eax + 0x27], cl
shl byte [ebp - 0x38], cl
push edi
invalid
Function at 0x1001cf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100df320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001cf80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001cfb0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001cfb0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001d0ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001cfd9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001d00d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001d06c
sub eax, 1
je 0x1001d06c
sub eax, 2
jne 0x1001d0ab
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10096f90
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001d08a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001d0ab
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001d0ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4