joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef72e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ef5a4

Function at 0x4f59d6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f5653

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x106e8
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.00010686
sbb eax, 0x8d0fc3b3
inc ebp
clc
push eax
push dword [ebp + 8]
call sub.ntoskrnl.exe_PsLookupProcessByProcessId
mov edi, eax
cmp edi, esi
jl 0x10762
push 0x10882
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
cmp eax, esi
je 0x10759
lea ecx, [ebp - 4]
push ecx
push 1
push dword [eax]
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov edi, eax
cmp edi, esi
jl 0x10759
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x109ee
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.000109b5
pop ebp
jmp fcn.00010906

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x100a3e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x481d71c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x27], 3
mov byte [ebp - 0x26], 0x8a
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x24], 3
mov byte [ebp - 0x23], 0xff
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x21], 5
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0xc
mov byte [ebp - 0x1d], 0x29
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0x1c
mov byte [ebp - 0x1a], 0x42
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0x50
mov byte [ebp - 0x14], 0x56
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0x50
mov byte [ebp - 0x11], 0x77
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0xf2
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x45
mov byte [ebp - 0xa], 0xff
mov byte [ebp - 9], 0xff
mov byte [ebp - 8], 0xff
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 2]
cmp ecx, 0x20
jne 0x100a3efb
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
cmp eax, 0x52
jne 0x100a3efb
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x41
jne 0x100a3efb
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
cmp ecx, 0x53
jne 0x100a3efb
mov al, 1
jmp 0x100a3fda
mov dword [ebp - 0x2c], 0
jmp 0x100a3f0d
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x28]
cmp ecx, 0xff
je 0x100a3f67
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x2c]
imul ecx, ecx, 3
movzx edx, byte [ebp + ecx - 0x28]
cmp eax, edx
jne 0x100a3f65
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x2c]
imul edx, edx, 3
movzx eax, byte [ebp + edx - 0x27]
cmp ecx, eax
jne 0x100a3f65
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 2]
mov eax, dword [ebp - 0x2c]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x26]
cmp edx, ecx
jne 0x100a3f65
mov al, 1
jmp 0x100a3fda
jmp 0x100a3f04
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
test eax, eax
jne 0x100a3f84
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 1]
cmp edx, 0xfc
jne 0x100a3f84
mov al, 1
jmp 0x100a3fda
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 3]
test ecx, ecx
jne 0x100a3fbd
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 4]
cmp eax, 0x30
jne 0x100a3fbd
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 5]
test edx, edx
jne 0x100a3fbd
call fcn.100d62d0
xor edx, edx
mov ecx, 0x64
div ecx
cmp eax, 4
jne 0x100a3fbd
mov al, 1
jmp 0x100a3fda
push 6
push 0x47e764c
mov edx, dword [ebp + 8]
push edx
call fcn.10141231
add esp, 0xc
test eax, eax
jne 0x100a3fd8
mov al, 1
jmp 0x100a3fda
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10140c7a
mov esp, ebp
pop ebp
ret
Function at 0x100b4e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d30d8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x481d71c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x84]
call fcn.100b4ce0
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x100b4f1b
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.100bb3b0
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x14], 0x10
jb 0x100b4e95
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx]
mov dword [ebp - 0x8c], edx
jmp 0x100b4e9e
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x8c], eax
push 0x47e885c
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.10144cda
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100434f0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x100b4f1b
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.10144fd1
add esp, 0x10
mov edx, dword [ebp - 0x4c]
push edx
call fcn.10144943
add esp, 4
mov byte [ebp - 0x4d], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10085640
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4d]
jmp 0x100b4f43
mov byte [ebp - 0x4e], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10085640
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10140c7a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100b4f70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d3138
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x481d71c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x88]
call fcn.100b4ce0
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x100b5098
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.100bb3b0
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x58], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x14], 0x10
jb 0x100b5005
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
mov dword [ebp - 0x90], edx
jmp 0x100b500e
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x90], eax
push 0x47e848c
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.10144cda
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100434f0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x100b5098
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.10144c01
add esp, 0x10
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov edx, dword [ebp - 0x4c]
push edx
call fcn.10144943
add esp, 4
mov byte [ebp - 0x51], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10085640
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x51]
jmp 0x100b50c0
mov byte [ebp - 0x52], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10085640
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x52]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10140c7a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100ba630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x481d71c]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [0x47e5360]
push 0x4827250
lea ecx, [ebp - 0x118]
push ecx
call fcn.10142f30
add esp, 8
push 0x47e848c
lea edx, [ebp - 0x118]
push edx
call fcn.10144cda
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100ba68a
xor eax, eax
jmp 0x100ba6fa
mov dword [ebp - 8], 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.101452ce
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.101451df
add esp, 4
cmp eax, 4
jne 0x100ba6d6
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.101452ce
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push 1
push 4
lea ecx, [ebp - 8]
push ecx
call fcn.10144c01
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.10144943
add esp, 4
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100ba6f7
lea ecx, [ebp - 0x118]
push ecx
call dword [0x47e536c]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10140c7a
mov esp, ebp
pop ebp
ret
Function at 0x100d54f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100d3900
add esp, 0xc
pop ebp
ret
Function at 0x100f13b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x9c0], 0x270
jne 0x100f13d0
mov ecx, dword [ebp - 8]
call fcn.100f14c0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x9c0]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x9c0], eax
mov edx, dword [ebp - 4]
shr edx, 0xb
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100f1a80
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
movzx eax, byte [0x482bc78]
test eax, eax
je 0x100f1a97
jmp 0x100f1b46
mov dword [ebp - 8], 0x80000000
mov byte [ebp - 2], 0x80
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0xd], 0x80
jmp 0x100f1abb
mov cl, byte [ebp - 0xd]
shr cl, 1
mov byte [ebp - 0xd], cl
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x100f1b05
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 0xd]
and eax, ecx
je 0x100f1adb
mov edx, dword [ebp - 0xc]
xor edx, 0x80000000
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 0x80000000
je 0x100f1afb
mov ecx, dword [ebp - 0xc]
shl ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
xor edx, 0x4c11db7
mov dword [ebp - 0xc], edx
jmp 0x100f1b03
mov eax, dword [ebp - 0xc]
shl eax, 1
mov dword [ebp - 0xc], eax
jmp 0x100f1ab3
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100f19f0
add esp, 4
mov esi, eax
movzx edx, byte [ebp - 1]
push edx
call fcn.100f1bd0
add esp, 4
movzx eax, al
mov dword [eax*4 + 0x482b878], esi
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x100f1aa6
mov byte [0x482bc78], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100f1c90
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call fcn.100de200
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c0], 1
jmp 0x100f1cd2
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
add edx, 1
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c0], edx
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x9c0], 0x270
jae 0x100f1d27
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x9c0]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx*4 - 4]
shr edx, 0x1e
mov ecx, dword [ebp - 8]
xor edx, dword [ecx + eax*4 - 4]
imul edx, edx, 0x6c078965
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x9c0]
and edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x9c0]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4], edx
jmp 0x100f1cbd
mov esp, ebp
pop ebp
ret 4
Function at 0x1013d7b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47e07e0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x481d71c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x47ec7ec
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x47ec8d4
call fcn.10086b20
mov byte [esp + 0x38], 1
call fcn.1013cc3e
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.10086c30
mov dword [esi], 0x47ec8f8
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x5df336
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf05d0814
jmp 0x5df419
push word [esp + 1]
mov byte [esp + 3], ah
lea esp, [esp + 2]
xchg dword [esp + 4], ebx
call fcn.005df320
mov byte [esp + 5], bl
lea ebx, [ebx - 0x6b]
pushal
push word [esp + 0x1d]
jmp 0x5df402
sbb eax, 0xa1e9
add bh, bh
invalid
push ecx
push ebp
mov dword [esp], ebp
mov byte [esp + 2], dl
mov dword [esp], edx
push ebx
call fcn.005df2f4
push ebx
lea esp, [esp + 1]
jmp 0x5df390
pushal
lea esp, [esp + 3]
mov dword [esp + 0x24], ebp
pushfd
mov dword [esp], edi
lea esp, [esp + 3]
jmp 0x5df3cd
lea esp, [esp + 3]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x5df446
cmp byte [ebx], bl
jb 0x5df35b
lea esp, [esp]
and al, 0x24
pushfd
push bx
push dword [esp + 4]
je 0x5df3b7
jne 0x5df3e3
jl 0x5df3ca
jge 0x5df3e3
div dword [ebx]
jl 0x5df432
lea esp, [esp + 3]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
jmp 0x5df413
push dword [esp + 0xd]
lea esp, [esp + 2]
xchg dword [esp + 0x30], ebx
call fcn.005df3b0
lea esp, [esp + 0x24]
jmp 0x5df446
mov cl, 0xbb
mov dx, word [esp]
btr ecx, ecx
jg 0x5df44c
jle 0x5df951
sti
imul ecx, dword [esi], reloc.WINMM.dll_midiStreamOut
inc esp
pop esi
mov byte [esp + 2], ch
insb byte es:[edi], dx
and al, 2
lea esp, [esp + 3]
pushfd
lea esp, [esp + 1]
mov dword [esp], eax
jmp 0x5df363
pushfd
jmp 0x5df2f9
jmp 0x5df951
lea ebp, [esp]
mov ecx, ebp
neg edi
jg 0x5df87a
jle 0x5df7a7
test eax, 0xc5e86bc8
invalid
bsf ecx, edi
lea esp, [esp + 3]
mov edi, esp
mov edx, 0xc0d329bf
mov cx, word [esp]
sub esp, 7
je 0x5df48e
jne 0x5df46c
stc
xchg dword [esp + 4], ecx
mov cl, ah
mov ecx, 0xae687b03
pushfd
jmp 0x5df70f
push word [esp + 3]
lea esp, [esp + 2]
push dword [esp + 8]
ret 0xc
adc edx, 0x228aa803
dec al
jmp 0x5df882
adc edx, 0x228aa803
dec al
sub esp, 0xc0
jmp 0x5df690
mov esi, dword [esp + 0x2c]
mov ecx, 0x52d1dc77
xchg edx, edi
not ch
xchg di, bp
jmp 0x5df451

Function at 0x5df5a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5df5c0
xchg word [esp + 1], dx
mov dl, 0x37
call fcn.005dffdb
pop ebx
mov dl, 0xf
mov dh, 0x16
lea eax, [eax + esi]
xchg cx, ax
jmp 0x5df5f6
Function at 0x5df746
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005df6e6
bswap ecx
mov ch, 0x14
btr cx, bp
jmp 0x5df779
setae ch
mov ch, 0x17
push bp
mov cl, 0xf6
lea esp, [esp + 2]
neg al
jmp 0x5df78e
not cl
mov cx, si
mov ecx, edx
bsr ecx, eax
ja 0x5df842
jbe 0x5df7db
nop
pop ds
invalid
ror al, 0
and ecx, 0x2cb19635
jmp 0x5df7fb
xor cx, 0x4fd6
mov cl, 0x82
jmp 0x5df7e5
mov cl, bl
xor cx, 0x24d8
pushfd
jmp 0x5df84a
lea esp, [esp + 4]
dec al
mov ecx, dword [esp]
bswap ecx
sub ecx, ecx
jmp 0x5df806
ja 0x5df7c3
xor cx, 0x4fd6
mov cl, 0x82
jmp 0x5df7e5
jg 0x5df81c
jle 0x5df81c
rcr dword [edx + esi*8 - 0x6b], 1
aad 0x39
test eax, 0x1eab5839
dec eax
jmp 0x5df81b
pop ds
call fcn.005df84f
pop cx
mov cx, 0x692
lea esp, [esp + 3]
lea esp, [esp + 0xc]
dec al
jmp 0x5df8e3
mov cl, bl
xor cx, 0x24d8
pushfd
jmp 0x5df7b4
stc
not cx
lea ecx, reloc.WINMM.dll_midiStreamOut
jmp 0x5df8af
xchg cl, ch
stc
not cx
lea ecx, reloc.WINMM.dll_midiStreamOut
jmp 0x5df8c5
add bl, al
jge 0x5df91e
xchg al, ch
xchg ch, cl
or eax, ebx
jmp 0x5df905
setl ch
cmc
jle 0x5df8a3
xchg cl, ch
jmp 0x5df88d
or eax, ebx
inc esi
mov cx, si
bswap ecx
call fcn.005df93a
cli
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
aad 0x10
mov word [edx], es
xchg esp, eax
push ebp
cdq
clc
xchg al, ch
xchg ch, cl
jmp 0x5df903

Function at 0x5dffdb
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
rdtsc
neg ch
rdtsc
lea eax, [edi + ebp]
jmp 0x5dffeb
xchg dword [esp], esi
mov eax, ebx
neg ax
sub cx, bx
mov cx, bx
mov ecx, 0x69808f9e
jmp 0x5e002d
xchg dword [esp], esi
cmp dh, cl
lea eax, reloc.WINMM.dll_midiStreamOut
mov al, ah
jmp 0x5e0059
lea esi, [esi + 2]
xchg al, dh
bsr eax, eax
lea eax, [esp - 0x46]
rol cx, 6
mov ax, word [esp]
jmp 0x5e0017
mov edx, 0x37dc2c75
push dword [esp]
ret 4

Function at 0x5ed8f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5ed920
mov dx, 0x5587
xchg word [esp + 0xa], dx
pop dx
mov dx, ax
mov edx, dword [esp + 3]
jmp 0x5ee0ed
push bx
pushal
push word [esp + 0x1c]
mov byte [esp + 0x12], ch
mov dword [esp + 0xd], edx
pushal
jmp 0x5ed8fa
lea esp, [esp + 2]

Function at 0x5f2522
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ecx, ebx
jbe 0x5f2593
pop bp
jmp 0x5f2558
mov dh, byte [esp]
cpuid
neg esi
jmp 0x5f255e
lea esp, [esp + 2]
jmp 0x5f2599
add esp, 4
jnp 0x5f257d
jp 0x5f257d
inc ecx
fimul word [ebx + ebp - 0x1a]
pop eax
mov cl, 0x33
mov dword [reloc.WINMM.dll_midiStreamOut], eax
mov eax, dword [reloc.WINMM.dll_midiStreamOut]
mov dh, byte [esp]
cpuid
neg esi
jmp 0x5f255e
cpuid
mov esi, dword [esp]
jmp 0x5f25b7
pop bp
lea esp, [esp + 2]
pop ebp
btc eax, ebx
jle 0x5f2542
jg 0x5f2574
mov edx, esi
cmc
je 0x5f25c6
mov cx, si
jmp 0x5f25c9
pushal
rdtsc
xchg dl, dh
mov al, 0xcc
lea esp, [esp + 0x24]
rdtsc
jmp 0x5f25a1
mov cx, si
jmp 0x5f261e
lea edi, [ecx*4]
setbe dl
add esp, 4
jge 0x5f2661
jl 0x5f2661
add dword [reloc.WINMM.dll_midiStreamOut], 0x4324b631
mov esi, 0xd94e270c
pop ebx
bsf edx, ecx
jo 0x5f25fe
lea edi, [ecx*4]
jmp 0x5f26fa
pop edi
jmp 0x5df495
setbe dl
jmp 0x5f2608
Function at 0x912a88
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, ax
mov bp, cx
mov esi, dword [esp + 8]
mov ch, byte [esp]
xchg bp, ax
jmp 0x912a4e
sub bx, sp
push word [esp + 0x20]
lea esp, [esp + 0x23]
sub esp, 1
push word [esp + 3]
lea edx, [ecx*4]
jmp 0x912a05
lea esp, [esp + 6]
mov dword [esp], edx
mov word [esp + 2], dx
pop si
jmp 0x912a60
rdtsc
mov word [esp + 9], si
cld
not ebx
rol ecx, cl
mov cl, byte [esp + 4]
jmp 0x912a38
xchg dword [esp], ecx
setne bh
neg dx
lea esi, [ecx + 0xc1]
ror cl, cl
mov ebx, 0x928725aa
jmp 0x912aca
xchg al, dh
mov dl, bl
mov word [esp + 0x1f], cx
jmp 0x912a1b
lea edx, [ebx + esi]
pop si
pop dword [esp + 2]
neg ecx
not bp
mov ebx, ebp
jmp 0x912b1a
mov bh, dl
xchg byte [esp], ch
neg ax
sub esp, 0x14
bsr eax, ebp
setae dh
jmp 0x912a93
pop ebp
lea ebx, [esp + edi]
add esp, 1
lea ebx, [esp + ebx]
mov ah, dl
cpuid
jmp 0x912aa9
not cl
bts bx, bx
mov bx, 0x9fd2
clc
rdtsc
rdtsc
jmp 0x912b49
shr di, 0xe
xchg dword [esp + 1], edx
shl bp, cl
setle al
cpuid
bsr ebp, esp
jmp 0x912ada
mov al, byte [esp + 2]
xchg dword [esp + 6], ebp
xchg cl, dh
xchg word [esp + 0xa], ax
mov word [esp + 3], di
btc eax, esi
jmp 0x912af0
setle al
mov eax, dword [esp + 9]
rdtsc
neg dx
jmp 0x912b5d
not esi
rol bh, 1
lea ebx, [ecx + ecx]
not dx
neg bx
mov si, word [esp + 0xa]
jmp 0x912b33
lea ebp, reloc.WINMM.dll_midiStreamOut
cpuid
mov dh, byte [esp + 4]
stc
mov byte [esp + 0xa], dl
clc
jmp 0x912cf4
mov dx, 0x758
sub esp, 8
call fcn.00912ba4
mov ebp, 0x5a542bfb
mov edx, ebx
xchg byte [esp + 3], dh
xchg edx, esi
lea ebx, [edx + edi]
mov eax, ebx
jmp 0x912c5b