joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408520
Capabilities:
Get file attributes

Disassembly:
call fcn.00405338
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x408534
dec eax
and al, 0x10
sete al
ret

Function at 0x4095fc
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x37], 0xef
test dl, dl
je 0x409608
or byte [eax + 0x37], 0x10
mov byte [eax + 0x52], dl
mov ecx, dword [eax + 0x28]
jecxz 0x409624
push eax
je 0x409625
call dword [0x41a11c]
pop eax
push 5
push dword [eax + 0x28]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x174], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x41a11c]
ret

Function at 0x40c57c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c5b5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403830
jmp 0x40c5be
mov eax, ebx
mov edx, esi
call fcn.00403794
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c5c8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c5e9
mov al, byte [esp]
jmp 0x40c5eb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40cc70
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40cae8
mov eax, dword [0x41a930]
cmp byte [eax], 0
je 0x40ccec
mov eax, dword [0x41a800]
call fcn.00402754
call fcn.00402624
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040ba70
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40cd34
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40cd22
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41a7cc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x41b660]
call fcn.004043e8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40d6e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d744
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004039a4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040b944
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d74b
lea eax, [ebp - 0xc]
call fcn.00403740
ret
Function at 0x40e52c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40e716
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40e560
mov eax, dword [ebp - 8]
call fcn.00403740
jmp 0x40e700
mov eax, dword [ebp - 4]
call fcn.004039d0
mov dword [ebp - 0xc], eax
test byte [ebp - 0xc], 3
je 0x40e59f
push 0x40e72c
push dword [ebp - 4]
push 0x40e750
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403a90
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x40ae14]
call fcn.0040cd38
call fcn.00403180
mov eax, dword [ebp - 0xc]
shr eax, 2
lea eax, [eax + eax*2]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
call fcn.00403830
mov ebx, 1
mov esi, 1
cmp ebx, dword [ebp - 0xc]
jg 0x40e6d5
mov edx, 4
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + ebx - 1]
cmp ecx, 0x3d
jg 0x40e5f4
je 0x40e63a
sub ecx, 0x2b
je 0x40e630
sub ecx, 4
je 0x40e635
dec ecx
sub ecx, 0xa
jb 0x40e622
jmp 0x40e63f
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x40e606
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x40e614
jmp 0x40e63f
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
sub cl, 0x41
mov byte [eax], cl
jmp 0x40e66a
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
sub cl, 0x47
mov byte [eax], cl
jmp 0x40e66a
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
add cl, 4
mov byte [eax], cl
jmp 0x40e66a
mov byte [eax], 0x3e
jmp 0x40e66a
mov byte [eax], 0x3f
jmp 0x40e66a
mov byte [eax], 0
jmp 0x40e66a
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x20]
push eax
push 0
mov ecx, 0x40e760
mov dl, 1
mov eax, dword [0x40ae14]
call fcn.0040cd74
call fcn.00403180
inc ebx
inc eax
dec edx
jne 0x40e5d3
mov eax, dword [ebp - 8]
call fcn.00403c28
xor edx, edx
mov dl, byte [ebp - 0x14]
shl edx, 2
xor ecx, ecx
mov cl, byte [ebp - 0x13]
shr ecx, 4
or edx, ecx
mov byte [eax + esi - 1], dl
mov eax, dword [ebp - 8]
call fcn.00403c28
xor edx, edx
mov dl, byte [ebp - 0x13]
shl edx, 4
xor ecx, ecx
mov cl, byte [ebp - 0x12]
shr ecx, 2
or edx, ecx
mov byte [eax + esi], dl
mov eax, dword [ebp - 8]
call fcn.00403c28
xor edx, edx
mov dl, byte [ebp - 0x12]
shl edx, 6
xor ecx, ecx
mov cl, byte [ebp - 0x11]
or edx, ecx
mov byte [eax + esi + 1], dl
add esi, 3
cmp ebx, dword [ebp - 0xc]
jle 0x40e5cb
mov edx, dword [ebp - 4]
mov eax, 0x40e784
call fcn.00403cb8
mov ebx, eax
test ebx, ebx
je 0x40e700
mov eax, dword [ebp - 0xc]
sub eax, ebx
inc eax
mov ebx, eax
mov edx, dword [ebp - 0x10]
sub edx, ebx
inc edx
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.00403c70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e71d
lea eax, [ebp - 0x18]
call fcn.00403740
ret

Function at 0x40f0cc
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.004027b8
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x410e34
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
mov byte [0x41a5f0], 1
push esp
xor edx, edx
mov al, 1
call fcn.00404fe4
push eax
call sub.wsock32.dll_WSAStartup
test eax, eax
sete al
add esp, 0x190
ret

Function at 0x410e70
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403bc0
xor eax, eax
push ebp
push 0x4110a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 4]
call fcn.004083cc
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.00408394
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 4]
call fcn.004037d8
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00406dbc
test eax, eax
jl 0x410f21
lea ecx, [ebp - 0x110]
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00406eb0
cmp dword [ebp - 0x110], 0
je 0x410f21
mov ecx, esi
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00406eb0
jmp 0x41106f
cmp byte [0x41a5f0], 0
jne 0x410f36
mov eax, esi
call fcn.00403740
jmp 0x41106f
lea eax, [ebp - 0x104]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004027b8
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 4]
call fcn.0040841c
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x410ff5
mov edx, dword [eax + 0xc]
test edx, edx
je 0x410fec
mov edi, dword [edx]
test edi, edi
je 0x410fe3
push esi
xor eax, eax
mov al, byte [edi]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x12c], 0
xor eax, eax
mov al, byte [edi + 1]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x124], 0
xor eax, eax
mov al, byte [edi + 2]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
xor eax, eax
mov al, byte [edi + 3]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x114], 0
lea edx, [ebp - 0x130]
mov ecx, 3
mov eax, 0x4110bc
call fcn.004084b4
jmp 0x410ffc
mov eax, esi
call fcn.00403740
jmp 0x410ffc
mov eax, esi
call fcn.00403740
jmp 0x410ffc
mov eax, esi
call fcn.00403740
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00406dbc
test eax, eax
jl 0x41101a
mov ecx, dword [esi]
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00406f5c
jmp 0x411042
push dword [ebp - 4]
push 0x4110d0
push dword [esi]
lea eax, [ebp - 0x134]
mov edx, 3
call fcn.00403a90
mov edx, dword [ebp - 0x134]
mov eax, dword [ebx + 0x40]
call fcn.0040a2a8
cmp dword [esi], 0
jne 0x41106f
lea eax, [ebp - 0x138]
mov ecx, 0x4110dc
mov edx, dword [ebp - 4]
call fcn.00403a1c
mov edx, dword [ebp - 0x138]
mov eax, dword [0x41a83c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
call fcn.00412984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4110ac
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.00403764
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00403764
lea eax, [ebp - 4]
call fcn.00403740
ret
Function at 0x411384
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403bc0
xor eax, eax
push ebp
push 0x4114ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x4113ca
inc eax
jne 0x4113f8
push 0x411508
push dword [esi + 0xc]
push 0x411524
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.004082e0
push dword [ebp - 0x18]
lea eax, [esi + 4]
mov edx, 4
call fcn.00403a90
xor ebx, ebx
jmp 0x4114d0
push 4
lea eax, [esi + 0x4c]
push eax
push 0x1005
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
je 0x411430
push 4
lea eax, [esi + 0x4c]
push eax
push 0x1006
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x411451
lea eax, [esi + 4]
mov edx, 0x411530
call fcn.00403794
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 8], 0xffffffff
xor ebx, ebx
jmp 0x4114d0
cmp dword [esi + 0x58], 0
je 0x41147e
mov eax, dword [esi + 0x58]
call fcn.00403bd0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov ax, word [esi + 0x5c]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
jmp 0x41149f
mov eax, dword [ebp - 4]
call fcn.00403bd0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push edi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x4114d0
lea eax, [esi + 4]
mov edx, 0x411550
call fcn.00403794
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 8], 0xffffffff
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4114f5
lea eax, [ebp - 0x18]
call fcn.00403740
lea eax, [ebp - 4]
call fcn.00403740
ret
Function at 0x413f20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, eax
lea esi, [esp + 4]
mov eax, ebx
call fcn.00403740
push esp
push 0x20019
push 0
push 0x414008
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413f9a
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x413f58
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x414030
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x413f9a
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.004039a4
jmp 0x413ffd
push esp
push 0x20019
push 0
push 0x414008
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413ffd
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x413fbd
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x414030
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x413ffd
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.004039a4
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x406e52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x406e61
pop dword [ebp - 0xc]
mov eax, 0x1b8051a8
sub eax, 0x1b3fe347
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x35fa1
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x3ab5
mov edx, eax
mov edi, 0xb3c06241
add edi, 0x4c80d983
add edi, dword [ebp - 0xc]
mov esi, 0xcb1a8f22
add esi, 0x2738ba1c
xor dword [ebp - 4], ebx
mov ebx, dword [edi]
xor dword [ebp - 4], 0x3d3f9c0f
sub ebx, esi
mov dword [edx], ebx
mov dword [ebp - 4], 0x5edfc50b
add edx, 0xe9cce598
sub edx, 0xe9cce594
add edi, 0xda1a08e8
add edi, 0x25e5f71c
loop 0x406eb5
add eax, 0xdda7
xor ebx, ebx
add ebx, eax
add eax, 0x81e9cf9f
add eax, 0x7e163066
mov ecx, 0xc8c2920
sub ecx, 0xc4c2920
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x653a77
Capabilities:
Encrypt data using aes

Disassembly:
lea ebp, [eax - 0x49]
push dword [esp + 2]
mov byte [esp + 3], ah
jmp 0x653aaf
lea esp, [esp + 8]
and eax, 0xff000000
lea ebp, [ecx - 3]
jmp 0x653b9d
lea ebp, [esp + ebp]
add ebp, ebp
xor eax, edi
rol ebp, 0xd
jmp 0x653b5d
shr edi, 0x18
mov bp, 0x8acf
mov bp, 0x15bd
lea esp, [esp + 4]
movzx edi, byte [edi*4 + 0x631244]
jmp 0x653b0d
and edi, esi
mov bp, 0x22af
bswap ebp
push esp
jmp 0x653b87
mov edi, edx
cmp bp, 0x5742
jmp 0x653b47
lea esi, reloc.WINMM.dll_mmioCreateChunk
xchg bp, ax
mov dword [esp], edx
stc
popal
jmp 0x653b2e
mov edi, dword [edi*4 + reloc.WINMM.dll_mmioCreateChunk]
lea ebp, [esi*4]
jmp 0x653f84
xor eax, edi
sub esp, 6
lea esp, [esp + 2]
pushal
jmp 0x653b77
pop dword [esp]
call fcn.00653c12
mov dword [edi], eax
jmp 0x653bfa
popal
lea ebp, [ebp + 8]
mov eax, dword [ebp]
pop ebp
sub esp, 0xc
jmp 0x653be3
lea esp, [esp + 0x20]
xor eax, dword [ecx]
bsr di, cx
lea edi, [ecx + 0x10]
sub esp, 8
jmp 0x653ba9
push dword [esp + 0xa]
push word [esp + 0xb]
lea esp, [esp + 2]
jmp 0x653c41
push ebp
pushal
push esp
mov dword [esp + 0xc], ecx
lea esp, [esp + 4]
jmp 0x653bb5
pushal
xchg bh, dh
xchg ah, bl
sub esp, 4
bswap ebx
mov dword [esp + 0xc], ecx
jmp 0x653ca3
lea ebp, [ebp + 0x14]
mov dword [ebp], ebx
pop ebp
jmp 0x653c85
xor eax, ebx
clc
push ebp
jmp 0x653c19
mov dword [ecx + 0x18], eax
call 0x653c66
push esi
jmp 0x653d31
push esp
mov byte [esp + 2], dh
mov dword [esp], ecx
lea esp, [esp + 8]
popal
jmp 0x653c29
pushal
mov dword [esp + 9], ecx
xor eax, edi
dec edi
jmp 0x653bd1
mov esi, ecx
lea esi, [esi + 0x1c]
mov dword [esi], edx
pop esi
call fcn.00653d18
lea esp, [esp + 0x20]
mov ebp, 0xff00
and edi, ebp
sub esp, 0
jmp 0x653cc3
sub esp, 0x1c
lea ebp, [ecx - 0xc3]
mov dword [esp + 3], eax
jmp 0x653d80
Function at 0x653f9b
Capabilities:
Encrypt data using aes

Disassembly:
mov bl, bh
movzx eax, byte [eax + 0xf]
bt edi, edx
lea edi, [ebx + ebp]
mov bl, byte [esp]
jmp 0x653946
xor edx, esi
movzx esi, byte [eax + 0xe]
bsf di, si
bswap edi
xchg edi, ebx
jmp 0x653911
shl edx, 8
clc
mov di, bx
xor edx, esi
jmp 0x653955
lea ebp, [edx + ebx]
xchg esi, ebp
sete bh
lea esi, [eax - 0xd1]
jmp 0x6539e3
movzx edx, byte [eax + 0xc]
mov bl, byte [esp]
shl edx, 8
mov bl, 0xdc
jmp 0x653936
bsr ax, cx
mov eax, edx
xchg edi, ebx
shr eax, 0x10
jmp 0x65398a
lea esp, [esp + 0x30]
mov esi, 0xff
lea ebp, [edx + ebx]
lea ebx, [eax + edi]
mov bp, word [esp]
jmp 0x6539cc
xor edx, eax
sub esp, 0x10
xchg ebx, eax
mov dword [ecx + 0xc], edx
bsf ax, si
jmp 0x653979
and eax, esi
inc edi
bsr di, bp
mov bl, byte [esp]
jmp 0x653a07
sub esp, 0x1c
jmp 0x6539b3
shl edx, 8
rcl bx, cl
setle bh
pushal
jmp 0x6539a3
lea esp, [esp + 0x1c]
xor eax, 0x1000000
stc
jmp 0x653ae4
mov eax, dword [eax*4 + reloc.WINMM.dll_mmioCreateChunk]
xchg edi, ebp
lea ebp, [ebp*4]
mov di, word [esp]
neg bx
jmp 0x6539ef
mov dword [ecx + 8], edx
xchg bl, bh
xchg ebx, edx
inc ebp
btr edi, edi
jmp 0x65396b
push ebp
mov ebp, edi
lea ebp, [ebp*4]
jmp 0x653a4b
lea ebp, reloc.WINMM.dll_mmioCreateChunk
mov edi, dword [ebp]
pop ebp
xchg bl, bh
ror ebp, 0x1f
mov bl, 0x14
call fcn.00653aad
ljmp 0xec8b
shr edi, 8
mov bp, sp
bswap ebp
and edi, esi
jmp 0x653a3b
mov edi, edx
bswap ebp
jmp 0x653a63
xor edx, esi
lea esp, [esp + 4]
movzx esi, byte [eax + 0xd]
mov bl, bh
jmp 0x653a2b
bswap edi
jmp 0x653afc
Function at 0x71a99f
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
xchg esi, ebp
rcl di, cl
stc
cmc
lea ebp, reloc.WINMM.dll_mmioCreateChunk
jmp 0x71a938
mov dh, byte [esp + 6]
mov dword [esp + 9], esi
bswap esi
pop dword [esp + 0xb]
xchg dh, al
jmp 0x71a966
rdtsc
push dword [esp + 0xa]
bswap eax
btr ebp, edx
lea edi, [ecx + 0xbb]
mov bx, 0x4def
jmp 0x71a923
mov ebx, dword [esp + 0xf]
xchg ah, bl
mov bl, 0x60
mov cl, ch
xchg word [esp + 1], bp
xchg cx, bx
jmp 0x71a990
jmp 0x71a94f
inc dl
mov dword [esp + 6], esi
btr edx, esp
call 0x71a99f
dec esp
xor dl, ch
mov ecx, 0x1473388c
push word [esp + 0x10]
jmp 0x71a9ea
push word [esp + 0xa]
mov si, 0x453b
lea ecx, [eax + edi]
rdtsc
cpuid
shr bh, 3
jmp 0x71afa1
xchg byte [esp], bl
xchg ebp, ebx
cpuid
xchg word [esp + 5], bp
mov dh, byte [esp + 0x19]
setbe ah
jmp 0x71aa49
mov byte [esp + 0x17], ch
rdtsc
rcl dx, cl
lea edx, [eax - 0x19]
not ch
mov dword [esp + 0xd], ebp
jmp 0x71aa1c
pop esi
push word [esp + 0x15]
lea ebp, [ecx + 0x4b]
not ebp
mov bl, 0xf0
neg cx
jmp 0x71aa5f
sub esp, 0xe
xchg ch, dl
xchg bx, si
push dword [esp]
rdtsc
jmp 0x71aacc
mov ax, 0x2f9f
setp bh
pop edi
xchg di, cx
inc esi
bswap esi
jmp 0x71aa35
neg bx
xchg edi, edx
sub bl, ah
setae ch
xchg dword [esp + 8], edx
rdtsc
jmp 0x71ab29
cpuid
mov dh, byte [esp + 0xd]
add esp, 5
lea esp, [esp + 0x10]
neg eax
mov cx, word [esp + 3]
jmp 0x71aa85
xchg byte [esp + 0xf], dl
mov ebp, dword [esp + 0x11]
bsf si, si
lea eax, [esi*4]
mov cl, 0x1a
pop ecx
jmp 0x71aaa5
lea edx, [edi + ebp]
mov dword [esp + 5], eax
xchg cx, bx
cpuid
inc ecx
setl bh
jmp 0x71aa75
xchg byte [esp], dl
mov bp, sp
mov dh, byte [esp]
mov ax, 0xf26b
btr eax, esp
mov eax, ecx
jmp 0x71abac
mov ch, byte [esp + 0xf]
mov byte [esp + 3], ah
add esp, 7
xor dl, ch
mov di, word [esp + 6]
add esp, 9
jmp 0x71aafe
mov byte [esp], dh
mov di, sp
xchg ch, dl
lea eax, [edx + edi]
inc ebx
mov byte [esp], ah
jmp 0x71ab91
mov bp, sp
shr edi, 0xf
lea eax, [ebx + ebp]
clc
mov bx, sp
xchg byte [esp], cl
jmp 0x71ab40
mov edx, 0xa7688348
push word [esp + 0x10]
call fcn.0071abf0
cmc
jle 0x71ab74
mov eax, dword [esi - reloc.WINMM.dll_mmioCreateChunk]
add byte [ebx - 6], 0x66
mov ebp, dword [esp]
mov bp, word [esp]
mov bh, byte [esp]
mov bx, dx
lea esi, [esi*4]
sub esp, 0x1e
jmp 0x71ab76
mov al, 0x6e
mov edx, dword [esp]
mov dh, byte [esp]
clc
xor cx, 0x352c
inc esi
jmp 0x71ab64
pushal
inc di
add al, dh
pop di
mov di, sp
xchg di, bx
jmp 0x71aae9
pop di
add esi, ebp
and bx, 0xe04a
pushal
lea esp, [esp + 0x59]
rdtsc
jmp 0x71ac07
cpuid
push dword [esp + 0x18]
cpuid
rdtsc
mov word [esp + 0x10], dx
sub esp, 0x1c
jmp 0x71ad2b
Function at 0x71acb2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp], al
mov al, 0xe6
rdtsc
mov al, ah
mov cl, 0x92
push word [esp]
jmp 0x71ac8b
popal
bsf di, ax
bsr si, cx
lea ebp, [eax + 0xd9]
add di, 0x5bd6
btc edx, edi
jmp 0x71ac19
cpuid
mov dword [esp], ecx
mov word [esp], di
inc al
setnp bh
jmp 0x71ac9c
mov cx, 0xe281
mov ax, 0x6ae9
rdtsc
mov dl, dh
mov bp, dx
xchg dword [esp], edx
jmp 0x71ac58
neg cx
cpuid
rcr ah, 1
xchg dword [esp], ebp
mov al, ah
ror ch, 5
jmp 0x71ac70
mov si, 0x497f
sub esp, 0x14
cmc
btr esi, esp
bsr bx, cx
pop eax
jmp 0x71acdc
setle ch
xchg bh, cl
lea edi, [edi*4]
mov bl, 0xe0
jmp 0x71ac3f
mov dword [esp + 0xe], ecx
not bh
mov bh, byte [esp + 3]
mov di, word [esp + 0x22]
jmp 0x71ad11
xchg cx, ax
mov dword [esp + 5], eax
mov word [esp + 0xc], bx
sub esp, 0x12
mov byte [esp + 0x13], ch
mov al, ah
jmp 0x71acc5
btc esi, ebx
pop ebp
pop dword [esp]
mov byte [esp], bh
cpuid
inc ebp
jmp 0x71af40
lea esp, [esp + 3]
lea ebp, [edx + ebx]
xchg dh, al
lea eax, [ecx*4]
bswap edx
jmp 0x71acf3
push dword [esp + 0x12]
clc
mov ecx, 0x5af827dc
mov al, ah
mov dword [esp + 0xf], ecx
call fcn.0071ad40
cmp al, 0xf
xchg esi, eax
lea ecx, [esp + ebx]
xchg word [esp + 0xd], di
mov dword [esp + 0x15], eax
pop dword [esp + 0xc]
mov dx, bx
mov si, 0x7dab
jmp 0x71ad5f
mov bh, byte [esp + 0xd]
inc bp
mov esi, eax
inc cl
setae dh
neg ecx
jmp 0x71ad77
mov bh, byte [esp + 0x19]
mov ah, byte [esp + 0xb]
bswap eax
mov bl, 0x90
neg ch
setae dh
jmp 0x71ade8
mov bx, word [esp + 6]
pop word [esp + 9]
mov al, ah
xchg word [esp + 0x15], dx
cpuid
mov ebx, 0x714dcd6
jmp 0x71ae67
Function at 0x71ad40
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x18], ebp
jmp 0x71adbf
mov dword [esp + 0xf], esi
stc
ror bh, 3
mov ebx, dword [esp + 5]
pop dx
xchg bh, cl
jmp 0x71ada8
add esp, 7
bsf si, si
add esp, 0x13
cmc
rdtsc
jmp 0x71ae20
bsr bx, bp
bswap ebx
mov ebx, ebp
bswap ebp
pop dword [esp + 0xa]
rdtsc
jmp 0x71ad90
lea eax, [ebx*4]
xchg dword [esp + 0x14], eax
cld
bsf bp, si
mov cx, 0x8f29
push dword [esp + 0x18]
jmp 0x71ad46
xchg cx, di
sub esp, 0x10
add esp, 0xd
mov di, 0xb1b
pop di
inc edx
jmp 0x71ae3c
lea ebp, [esi*4]
xchg word [esp], cx
mov word [esp], sp
mov word [esp], bx
mov di, 0x9923
btr ebp, esp
jmp 0x71adfc
mov ebx, 0xc259b17a
xchg byte [esp], bl
add esp, 0
mov word [esp], dx
sub esp, 0x14
xchg dh, al
jmp 0x71af17
mov bh, byte [esp + 0x17]
sete bh
xchg bx, si
lea esp, [esp + 0xf]
mov edi, esi
xchg ebx, esi
jmp 0x71aeca
rcr eax, 7
rdtsc
mov edx, ebp
mov bp, dx
xchg bx, ax
mov ebp, 0x28e50046
jmp 0x71ae7d
pop edx
pop ebp
mov word [esp + 0x1c], sp
push dword [esp + 0xc]
pop dword [esp + 0x12]
pop bp
jmp 0x71aefc
lea ecx, [eax*4]
mov ebp, ecx
pushal
sub esp, 0
rol si, cl
mov dword [esp + 1], ebp
jmp 0x71aeab
push esp
ror esi, 0xf
mov dword [esp + 7], eax
xchg byte [esp + 0x10], cl
mov byte [esp + 0x11], dh
mov word [esp + 4], dx
jmp 0x71ae97
mov byte [esp + 0x15], dh
add esp, 0xf
mov ebp, dword [esp + 5]
pop dword [esp + 6]
setnp ah
xor ebp, esi
jmp 0x71af86
mov bl, bh
rdtsc
ror esi, 9
mov word [esp + 0xb], di
mov ax, word [esp + 5]
mov bh, byte [esp + 4]
jmp 0x71aee5
xchg ecx, ebp
pop word [esp + 1]
mov cl, ch
rdtsc
bsf bx, ax
mov bx, 0x7f55
jmp 0x71b026
pop dword [esp + 5]
lea esp, [esp + 3]
mov bp, word [esp + 4]
cpuid
inc ecx
pop di
jmp 0x71af5d
xchg ebx, esi
xchg ch, dl
call fcn.0071afdd
and si, 0xff3a
xchg ebp, ecx
call 0x71b03c
mov ebx, 0xd24648d
lea ecx, [esp + edi]
mov byte [esp + 3], ah
mov cl, ch
jmp 0x71b06f
xchg ebp, ebx
add al, dh
mov bp, 0x951b
mov dl, 0x7c
not ah
pop dword [esp + 1]
jmp 0x71b0b4
xchg word [esp + 3], bx
pop word [esp + 3]
call fcn.0071b131
push dword [ebp - 0x1b]
invalid
mov di, word [esp + 0xc]
pop dword [esp]
neg cx
mov esi, 0x9cde5d54
xchg dword [esp], esi
lea edx, [edi + edi]
jmp 0x71b09d

Function at 0x71b17a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0x12]
mov cx, 0xc599
rdtsc
mov cx, 0x762d
jmp fcn.0071b1dd