joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ba862
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [esp + 0x18], edi
jne 0x4ba976
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov ebx, eax
cmp ebx, edi
je 0x4ba976
mov eax, dword [esp + 0x14]
sub eax, 0xf020
je 0x4ba967
sub eax, 0x10
je 0x4ba942
sub eax, 0x30
je 0x4ba935
sub eax, 0xc0
je 0x4ba8c6
mov eax, dword [esi]
push edi
push dword [esp + 0x18]
mov ecx, esi
push 0x112
call dword [eax + 0x24]
jmp 0x4ba971
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
mov ebp, 0xf120
test eax, 0x1000000
je 0x4ba8fd
push 0
push 0xf030
push ebx
call edi
push 3
push ebp
push ebx
call edi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1cc]
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x20000000
je 0x4ba971
push 0
push 0xf020
push ebx
call edi
push 3
push ebp
push ebx
call edi
push 9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x6c]
jmp 0x4ba971
mov eax, dword [esi]
push edi
push edi
push 0x10
mov ecx, esi
call dword [eax + 0x20]
jmp 0x4ba971
push edi
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
push 0xf120
push ebx
call edi
push 3
push 0xf030
push ebx
call edi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1d4]
jmp 0x4ba971
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1d0]
push 1
pop eax
jmp 0x4ba978
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4c61f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0046ddb0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4c62bb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4c62bb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4c626e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4c6279
or bh, 8
and edi, 0x8000000
je 0x4c6294
mov eax, dword [0x5258bc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4c62bb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c6690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4c66bb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4c66df
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4c66fa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x4cb44a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4cb482
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ce3d3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ce3ab
jmp 0x4cb48e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4ccb0a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ccb4c
call fcn.004d4518
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4ccb4c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4ccb43
xor eax, eax
jmp 0x4ccb54
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ccb5a
pop edi
pop esi
pop ebx
ret 4

Function at 0x4ce69e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x4ce6c0
cmp dword [edi + 0x3c], 0
jne 0x4ce6c0
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004d4518
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.004ce6ed
pop edi
pop esi
pop ebx
ret 8

Function at 0x4d205f
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4ddaec
call fcn.0046d048
push ecx
push ecx
push esi
push 0x10
call fcn.004ce490
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
test esi, esi
je 0x4d20ac
mov ecx, esi
call fcn.004cefcb
mov eax, dword [0x518cb0]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [esi], vtable.CArchiveException.0
mov dword [esi + 8], eax
call fcn.004ce0b5
jmp 0x4d20ae
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push 0x508178
push eax
mov dword [ebp - 0x10], esi
call fcn.0046f97b
pop esi

Function at 0x4d559a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d55c8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d55e6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d5500
jmp 0x4d55e6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d55e6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d5500
test edi, edi
mov eax, edi
jne 0x4d55d0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x4027e0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov word [ebp - 0x42], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x30]
jae 0x40218f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x68]
mov dword [esp], eax
call fcn.00402840
sub esp, 4
cmp dword [ebp + 8], 0
jbe 0x402154
cmp dword [ebp + 0xc], 3
jbe 0x402154
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0
mov eax, esp
lea ecx, [ebp - 0x68]
mov dword [eax], ecx
mov dword [eax + 4], 0x14d
call fcn.00401e60
mov dword [ebp - 0x74], eax
jmp 0x4020f3
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x40214f
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp + 0xc]
jne 0x40214a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x24]
mov ecx, dword [ebp - 0x48]
shl ecx, 1
add eax, ecx
mov ax, word [eax]
mov word [ebp - 0x42], ax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x1c]
movzx ecx, word [ebp - 0x42]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x70], 2
jmp 0x402164
jmp 0x40214f
jmp 0x402154
mov eax, dword [ebp - 0x2c]
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x68]
call fcn.00402900
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x402181
jmp 0x40217c
jmp 0x40218f
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
jmp 0x402088
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x38]
add eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4021d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x45d200], eax
pop esi
pop edi
pop ebp
ret
Function at 0x61754a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
xchg edx, edi
sub esp, 6
lea esp, [esp + 2]
jmp 0x61758b
lea esp, [esp + 8]
movzx ebx, byte [esi + 0x11]
lea edi, [eax - 0xe1]
jmp 0x617568

Function at 0x6176a4
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x1a
mov dword [esp + 0xf], eax
sub esp, 0xa
jmp 0x6176f9
lea esp, [esp + 4]
movzx ebx, byte [esi + 5]
jmp 0x61768b
pushal
mov cl, byte [esp]
setbe ch
mov esi, eax
mov dword [esp + 8], edx
sub esp, 0xc
jmp 0x617852
and edx, ecx
pushal
push ebp
jmp 0x6176d1
not dx
mov edx, dword [esi + 4]
call fcn.0061774e
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 0x18
add esp, 0xd
lea esp, [esp + 4]
jmp 0x61780f
pop ebp
and edx, ecx
lea esp, [esp + 0x44]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x617766
movzx ebx, byte [esi + 6]
sub esp, 0xc
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
clc
jmp 0x617834
and ebx, ecx
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x6177b5
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
pushal
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x6177d5
mov word [esp + 3], dx
lea esp, [esp + 3]
and edi, ecx
push esp
jmp 0x6177f1
stc
call fcn.0061781d
lea esp, [esp + 0xc]
popal
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamOut
mov edx, dword [ebp]
jmp 0x6177a5

Function at 0x61774e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esi], edi
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
lea edi, [ebx + ebp]
jmp 0x61778b
shr edi, 0x18
sub esp, 2
lea esp, [esp + 2]
jmp 0x617771
add esp, 1
sub esp, 0x12
lea esp, [esp + 1]
jmp 0x617727
mov edi, edx
sub esp, 0x16
mov word [esp + 4], bx
clc
lea esp, [esp + 2]
jmp 0x617735

Function at 0x617b57
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, 0xb20f0814
bts edi, ebx
mov di, 0xa109
xor di, 0xa4ec
jmp 0x617b16
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [esi]
pop esi
jmp 0x617ab4
setae dh
mov dword [esp + 4], ebx
sub esp, 4
lea esp, [esp + 4]
popal
jmp 0x617acb
sub esp, 0x1c
add esp, 5
lea esp, [esp + 3]
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 0x14
jmp 0x617b7c
mov edi, edx
stc
clc
shr edi, 0x18
jmp 0x617af3
push esi
pushal
mov eax, 0xd2fc191c
lea edi, [edi*4]
jmp 0x617ae2
mov byte [esp + 2], ah
mov dword [esi + 8], edi
jmp 0x617b32
and edi, ecx
cmc
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
cmc
jmp 0x617c04
mov byte [esp + 2], ah
jmp 0x617b60
pushal
and ebx, ecx
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
call fcn.00617be8
Function at 0x617e53
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [esp + 0x16], ch
pop word [esp + 0x11]
shr edi, 0x18
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x61793b
ror edi, 0x19
sub esp, 0x1a
lea esp, [esp + 2]
mov edi, edx
sub esp, 0x1a
jmp 0x617900
and edi, ecx
push esp
pop word [esp]
pushal
lea esp, [esp + 2]
jmp 0x6179b9
lea eax, reloc.WINMM.dll_midiStreamOut
mov edi, dword [eax]
pop eax
jmp 0x61799f
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [ebp]
pop ebp
btr edi, edx
jmp 0x61792a
lea ebx, [esi + 0xad]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
push edx
jmp 0x617a86
and ebx, ecx
lea esp, [esp + 0x54]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
bswap ebx
jmp 0x617976
push eax
mov eax, edi
lea eax, [eax*4]
jmp 0x617949
mov dl, 0x24
mov dword [esp + 8], ebx
clc
push esp
lea esp, [esp + 4]
popal
jmp 0x617960
sub esp, 0xc
cmc
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
and edx, ecx
jmp 0x617a1e
movzx ebx, byte [esi + 0xd]
and edx, ecx
sub esp, 0x1a
pop word [esp + 3]
jmp 0x6179ec
cmc
sub esp, 0x18
lea esp, [esp + 0x3c]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
mov dx, word [esp]
jmp 0x617b93
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov ebx, 0x9de85dee
mov bl, bh
neg bx
jmp 0x617a0e
mov byte [esp + 5], ah
mov dword [esp + 9], ecx
jmp 0x617a49
push word [esp + 1]
lea esp, [esp + 3]
lea esp, [esp + 3]
and ebx, ecx
pushal
jmp 0x617a6a
push ebp
pushal
cmc
shr ah, 1
jmp 0x6179da
mov dx, word [esp]
mov edx, dword [esi + 0xc]
call fcn.00617b57
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
push esp
jmp 0x617bca
and edx, ecx
call 0x617bd2
call 0xfcf69061
inc esp
pop edi
add cl, bh
jmp 0x617bea
and ebx, ecx
pushal
push word [esp + 0xf]
call fcn.00617c34
mov al, byte [0x32c7a032]
hlt
lea ebx, [ebx + 4]
mov dword [ebx], edi
pop ebx
mov edi, 0xa4e6ddba
stc
jmp 0x617aaa
mov edx, dword [esi + 8]
push ebx
mov ebx, esi
jmp 0x617c51
mov dx, word [esp]
jmp 0x617cbf
Function at 0x70cd47
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dx
lea ebp, [ebp + 0xd7]
pop bp
pushal
lea esp, [esp + 0x42]
btr esi, edx
jmp 0x70cd7d
mov si, word [esp + 0x14]
neg ch
jmp 0x70cd25
xchg dh, al
lea esp, [esp + 1]
mov dx, sp
mov al, ah
xor ebp, esi
btc ecx, edi
jmp 0x70cdda
sete dh
pop ax
bswap esi
rdtsc
bswap eax
bswap edi
jmp 0x70cd50
add al, dh
mov edx, dword [esp]
inc edx
neg bp
push edx
xchg cx, dx
jmp 0x70cd66
mov edx, dword [esp]
xchg byte [esp], cl
mov edx, dword [esp]
ror ah, 1
bsf cx, si
mov edi, dword [esp]
jmp 0x70ce8e
mov di, 0x6e7f
rcr ebx, 0x19
lea ebp, [edx*4]
rcr edi, 0x15
lea esp, [esp]
setl bh
jmp 0x70cda5
xchg ebp, ebx
mov si, word [esp]
bsr bx, cx
lea edi, [edx*4]
xchg byte [esp], bl
lea esp, [esp]
jmp 0x70cdbd
xchg ebp, edx
mov bl, byte [esp]
mov bl, byte [esp]
xor dl, ch
sub esp, 2
lea esp, [esp + 1]
jmp 0x70ce3b
bswap ebp
inc ecx
mov dl, byte [esp]
mov dx, 0x6da9
xchg bh, cl
mov si, 0x139f
jmp 0x70cdf3
mov dword [esp + 0xb], ecx
lea eax, [edi + edi]
inc cx
mov ebx, 0x5f42afc6
lea esp, [esp + 0x21]
pop ecx
jmp 0x70ce0d
lea esp, [esp]
bswap edx
mov ecx, 0xf72e2e16
neg ecx
xchg dh, al
mov bl, bh
jmp 0x70ce75
mov bx, 0x9483
mov bp, word [esp]
mov esi, dword [esp]
pushal
lea edx, [esp + ebx]
push dword [esp + 5]
jmp 0x70ce26
xchg esi, edi
mov edi, esi
xchg byte [esp], dl
bsf bp, ax
xor dl, ch
xchg ah, bl
jmp 0x70cf11
xchg byte [esp], bl
lea esp, [esp]
bswap esi
rdtsc
lea esi, [esi + 0x2d]
lea esp, [esp]
jmp 0x70ce60
push dword [esp + 9]
lea ebx, [edx + ebx]
mov al, 0xe
mov edx, dword [esp + 0xe]
btr ecx, esp
jmp 0x70cef4
xchg bp, bx
xchg ch, dl
xchg dx, cx
mov ebp, 0x326db8a0
not ecx
push dword [esp + 4]
jmp 0x70cea0
rdtsc
lea edi, [edx*4]
pushal
push edx
not edx
xchg ecx, esi
jmp 0x70cfb5
mov bh, byte [esp + 2]
xchg dx, di
xchg word [esp + 9], ax
setp ch
pop ecx
xchg byte [esp + 2], bl
jmp 0x70cecb
mov dx, 0x9205
lea edi, [ecx + edx]
push edx
not ch
push dword [esp + 2]
mov ebp, 0xfdbbce48
jmp 0x70ceb6
popal
xchg esi, eax
sub esp, 2
pop bx
push dword [esp]
pop di
jmp 0x70cf9a
mov word [esp + 2], sp
rdtsc
not edi
sub esp, 0x1c
inc bp
clc
jmp 0x70cfe8
pop word [esp + 0x17]
ror ebx, 0xb
btr esi, edx
cpuid
lea esi, [ecx + ebx]
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x70cf26
pop esi
pop di
cld
add esp, 3
mov cl, ch
mov dword [esp + 0xd], ebp
jmp 0x70cf4b
setl bh
inc cl
push esp
neg ah
xchg word [esp + 0xf], di
bsf bp, ax
jmp 0x70cf67
mov cl, 0xea
pop word [esp + 3]
xchg si, ax
mov dword [esp], ecx
neg ecx
setnp bh
jmp 0x70cf35
xchg dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
btr edi, esp
mov ax, 0x8f55
pop dword [esp + 0x1d]
bswap edx
jmp 0x70cf87
xchg word [esp + 0x1b], bp
sub bx, 0x6ac0
xchg bh, cl
push word [esp + 0x11]
bsf bp, ax
cld
call fcn.0070d969
push edx
mov bp, word [esp + 0xc]
mov bl, bh
ror ebx, 0x13
mov dh, byte [esp + 0x1b]
jmp 0x70cfcc

Function at 0x70d72f
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
xchg byte [esp], bl
lea ebx, [eax*4]
xchg dh, al
lea ecx, [edx*4]
pop ax
rol dx, cl
jmp 0x70d706
Function at 0x70d969
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ebx
xchg word [esp + 2], di
xchg edi, esi
xchg bx, cx
pushal
sub esp, 0x14
jmp 0x70d093
mov ecx, ebp
mov eax, 0x8a113108
mov eax, 0xa4f7b526
and dx, 0x51ca
xchg dh, al
push dword [esp + 3]
jmp 0x70cff8
mov cl, 0x9a
neg edi
lea esp, [esp + 1]
bsf bp, si
mov ah, byte [esp + 4]
setae bh
jmp 0x70d017
pushal
push dword [esp + 0x23]
mov byte [esp + 0x2b], ch
xchg byte [esp + 0x28], al
btc eax, edi
jmp 0x70d07c
lea esp, [esp + 0x1c]
inc ax
mov edx, dword [esp + 6]
xchg bh, cl
cpuid
btc edi, ebx
jmp 0x70d053
mov word [esp + 0xc], bx
cmc
xchg si, ax
mov bp, word [esp + 0x25]
jmp 0x70d0e8
pop bp
xchg ebx, edx
lea eax, [esp + ebx]
mov dword [esp + 0x1b], eax
pop word [esp + 5]
add esp, 0x14
jmp 0x70d069
lea edx, [esi - 0x25]
cld
mov al, 0x7e
mov bl, bh
lea edi, [esp + edi]
lea ebx, reloc.WINMM.dll_midiStreamOut
aaa
jmp 0x70d137
rdtsc
mov dx, bx
ror eax, 3
mov edi, dword [esp]
setbe bh
neg esi
jmp 0x70d0a8
push word [esp + 0x1e]
pushal
lea esp, [esp + 0x4f]
cpuid
stc
inc dl
jmp 0x70d0c6
not ch
push esp
mov edx, 0x9faadc92
cpuid
rdtsc
neg si
jmp 0x70d03e
xchg dh, al
push word [esp + 1]
add esp, 1
call fcn.0070d62d
push ds
xchg esp, eax
or ch, byte [ebp - 0x64]
jle 0x70d0b8
add dword [ecx + reloc.WINMM.dll_midiStreamOut], edx
add eax, dword [edi - reloc.WINMM.dll_midiStreamOut]
in al, dx
add dh, byte [edx - 0x723774b4]
sub al, 0x38
xchg ebp, edx
mov bl, 0x40
sub esp, 2
mov dl, 0x4c
mov ecx, eax
lea ebp, [eax + edi]
jmp 0x70d11a
pop word [esp]
xchg byte [esp], bl
xchg word [esp], dx
lea esi, [ecx*4]
xchg word [esp], cx
mov byte [esp], ah
jmp 0x70d106
mov ax, word [esp + 0xc]
bsf bx, ax
popal
pop dword [esp]
mov al, ah
mov ebp, 0xadff736a
jmp 0x70d155
jmp 0x70d654

Function at 0x70dafa
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bp, di
sub esp, 0x12
mov bl, bh
xchg ch, dl
xchg byte [esp + 0x17], al
mov eax, 0x5361f1c2
jmp 0x70db34
push dword [esp + 6]
add esp, 9
mov dword [esp + 3], esi
mov ecx, eax
rdtsc
jmp 0x70dadb
mov bp, 0xaa57
xchg ecx, eax
mov word [esp + 6], sp
xchg ah, bl
jmp 0x70dcca
mov eax, dword [esp + 3]
mov cx, bx
neg ecx
pop di
mov cx, word [esp + 0x18]
jmp 0x70db1d
push dword [esp + 1]
bsf di, si
mov dword [esp + 4], ecx
call fcn.0070db9e
mov dh, byte [esp + 1]
bswap ecx
mov dword [esp + 0xb], esi
not ax
inc edx
jmp 0x70dc12
mov byte [esp + 1], dh
mov ax, 0xba07
xchg esi, ebx
call fcn.0070dc73
dec esi
retf 0x3f58
push word [esp + 2]
mov word [esp], dx
mov bp, bx
xchg dword [esp + 6], esi
xchg word [esp + 3], cx
neg si
jmp 0x70dbb8
lea ebx, [eax*4]
shl bx, cl
sub esp, 2
rdtsc
bsr di, bp
lea esp, [esp + 0x13]
jmp 0x70dc35

Function at 0x70e09f
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 3]
mov dword [esp + 0x54], edi
lea esp, [esp + 0x54]
jmp 0x70e0cd

Function at 0x70e0c4
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0070d011
mov eax, dword [eax]
jmp 0x70e0db
lea esp, [esp + 0x2b]
call fcn.0070e09f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x70e0ad
mov eax, dword [eax + 8]
jmp 0x70e18c
push eax
jmp 0x70d00c
Function at 0x70e435
Capabilities:
Execute anti-debugging instructions

Disassembly:
not edi
bswap edx
mov word [esp], di
lea ecx, [eax + 0x81]
jmp 0x70dda0
cpuid
mov edx, eax
mov bl, bh
push esp
push word [esp + 4]
add esp, 0
jmp 0x70dd78
pop word [esp + 5]
cpuid
mov cx, word [esp + 5]
mov ebp, ecx
mov dl, 0x94
call fcn.0070ddf5
cmp ch, byte [eax + 0x4aa8593e]
push esp
lds edx, [ebp + 0x3c]
iretd
xor dl, ch
lea ecx, [esi - 0x6d]
mov dword [esp], ebp
mov si, dx
mov edx, esi
setle dh
jmp 0x70dd8f
rdtsc
not dh
pop bp
mov ecx, 0xc65e33ec
rdtsc
pop word [esp + 2]
jmp 0x70ddc7
pop eax
xchg byte [esp + 2], bl
mov cl, 0x4a
cpuid
cmc
cmc
jmp 0x70df54
rdtsc
mov ebx, ebp
sub cx, 0x68f8
mov dword [esp + 6], esi
lea eax, [esi*4]
setnp bh
jmp 0x70e008
bswap ebx
bsr ax, bp
inc ecx
pop dword [esp + 6]
mov dword [esp + 2], esi
xchg byte [esp], al
jmp 0x70e1e8
mov cx, dx
jmp 0x70e41c