joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ad93e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006ee80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, ecx
call fcn.007ab47e
mov ebx, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
jne 0x7ad997
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov ebx, eax
xor edx, edx
xor esi, esi
xor edi, edi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
push ebp
mov ecx, ebx
call fcn.007a882e
mov ebp, dword [esp + 0x70]
mov edi, eax
add edi, ebp
mov ecx, ebx
mov dword [esp + 0x28], edi
call fcn.007a881e
mov edx, dword [esp + 0x74]
mov ecx, esi
add eax, edx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.007acfee
mov ebp, dword [eax]
lea edx, [esp + 0x38]
push edx
mov ecx, dword [eax + 4]
mov eax, dword [esi + 0x1c]
push eax
mov dword [esp + 0x24], ecx
call dword [0x10071564]
push 0
lea ecx, [esp + 0x4c]
call fcn.007e8389
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], 0
call fcn.007bcb8e
add esp, 0xc
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x18]
call fcn.007aae9e
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x38]
push 2
push edx
push eax
mov byte [esp + 0x70], 1
call dword [0x1007112c]
mov ecx, ebx
call fcn.007a879e
mov ebx, eax
mov eax, edi
cmp eax, ebx
jge 0x7ada62
push edi
mov ecx, esi
call fcn.007aafae
push eax
push ebp
mov ecx, esi
call fcn.007ab16e
cmp eax, dword [esp + 0x40]
jg 0x7ada5e
inc edi
mov ebp, eax
cmp edi, ebx
jl 0x7ada3c
mov eax, ebx
jmp 0x7ada68
cmp edi, ebx
jl 0x7ada66
mov eax, ebx
jmp 0x7ada68
mov eax, edi
lea ecx, [eax - 1]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jle 0x7ada79
mov dword [esp + 0x30], eax
jmp 0x7ada84
cmp edi, ebx
jl 0x7ada7f
mov edi, ebx
dec edi
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
call fcn.007a875e
mov ebp, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebp
mov edi, eax
jge 0x7adacb
push edi
mov ecx, esi
call fcn.007aaece
push eax
push ebx
mov ecx, esi
call fcn.007ab29e
cmp eax, dword [esp + 0x44]
jg 0x7adac3
inc edi
mov ebx, eax
cmp edi, ebp
jl 0x7ada9d
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x7adad5
cmp edi, ebp
jl 0x7adacf
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x7adad5
mov eax, dword [esp + 0x2c]
mov ecx, edi
dec ecx
cmp eax, ecx
jle 0x7adade
mov ecx, eax
jmp 0x7adae7
cmp edi, ebp
jl 0x7adae4
mov edi, ebp
lea ecx, [edi - 1]
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x28]
mov edx, esi
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x14]
call fcn.007aaebe
lea ecx, [esp + 0x48]
mov dword [esp + 0x64], reloc.WINMM.dll_midiStreamStop
call fcn.007e83fb
mov ecx, dword [esp + 0x5c]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
Function at 0x7b3a5e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1006f338
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x7b3a97
inc eax
mov dword [esi + 0x10], eax
jmp 0x7b3baa
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x7b3aab
mov eax, 0xffffffc7
jmp 0x7b3bac
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x7b3abc
cmp dword [esi + 8], eax
jne 0x7b3aab
cmp dword [esi + 8], eax
jne 0x7b3ad5
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x7b3ad5
mov eax, 0xffffffc7
jmp 0x7b3bac
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x7b3ae9
push eax
mov ecx, ebx
call fcn.007b328e
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.007899ce
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x7b3b1a
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.007899ee
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.007b29fe
test eax, eax
mov dword [esp + 0x38], eax
je 0x7b3b4d
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.WINMM.dll_midiStreamStop
mov dword [esp + 0x10], 0x100758a0
call fcn.00789bce
mov eax, dword [esp + 0x38]
jmp 0x7b3bac
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.007b38be
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x7b3b91
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.007b38de
mov esi, eax
test esi, esi
jne 0x7b3bc1
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.007b38be
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x7b3b63
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.WINMM.dll_midiStreamStop
mov dword [esp + 0x10], 0x100758a0
call fcn.00789bce
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.WINMM.dll_midiStreamStop
mov dword [esp + 0x10], 0x100758a0
call fcn.00789bce
mov eax, esi
jmp 0x7b3bac
Function at 0x7bd22e
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1006fc28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x10071564]
push 0
lea ecx, [esp + 0x20]
call fcn.007e8389
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.007bcb8e
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.007e82b7
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.007e4b92
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.007e4b92
push 1
push 0
push 0
mov ecx, esi
call fcn.007e4b3a
push 1
push 0
push 1
mov ecx, esi
call fcn.007e4b3a
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], reloc.WINMM.dll_midiStreamStop
call fcn.007e83fb
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x7bd3ae
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1006fc48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.007e8389
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.007bcb8e
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.007e82b7
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x10071564]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x7bd472
cmp dword [esp + 0x40], 1
jne 0x7bd470
cmp ecx, eax
jge 0x7bd472
mov eax, ecx
cmp eax, 0xc8
jge 0x7bd47e
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.007bd22e
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x10071560]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], reloc.WINMM.dll_midiStreamStop
call fcn.007e83fb
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x7bdc7e
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1006fcf3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.007e2fca
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], reloc.WINMM.dll_midiStreamStop
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], reloc.WINMM.dll_midiStreamStop
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x100710f4]
push eax
mov ecx, edi
call fcn.007e8631
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.007e9b4d
test eax, eax
je 0x7bdd9a
mov ecx, dword [esp + 0x3c]
call fcn.007e865e
mov ecx, dword [esi + 0x1c]
mov ebp, dword [reloc.WINMM.dll_midiStreamStop]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x7bdd5e
push edi
mov ecx, esi
call fcn.007e5cac
mov ecx, esi
call fcn.007bdf3e
cmp dword [esp + 0x38], 1
jne 0x7bdd93
or ecx, reloc.WINMM.dll_midiStreamStop
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.007e5de7
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x7bff7e
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x7bffb1
push esi
call fcn.007c30de
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x7bffaa
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x7c0037
mov eax, dword [esi + reloc.WINMM.dll_midiStreamStop]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x7c0020
mov eax, dword [esi + 8]
test eax, eax
je 0x7bffd5
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + reloc.WINMM.dll_midiStreamStop]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x7c001c
cmp eax, 2
je 0x7c0020
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x7bffc8
cmp eax, 3
je 0x7bfffb
cmp eax, 1
jne 0x7bffc8
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x7bffc8
mov edx, dword [esi + reloc.WINMM.dll_midiStreamStop]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x7bffc8
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.007c005e
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x7c0046
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.007c005e
add esp, 4
pop esi
ret
Function at 0x81a234
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jle 0x8888e0
pushal
mov dword [esp + 0x1c], 0xeff0b2e9
push dword [esp + 4]
push ebp
jmp 0x884a1e
push ebp
pop ss
out dx, al
push es
xchg esp, eax
lcall 0x505f, 0x7290a7d6
mov edi, dword [ebp - reloc.WINMM.dll_midiStreamStop]
mov cl, 0x35
lodsb al, byte [esi]
invalid
call 0x88172b
push esi
call 0x835907
leave
lcall 0xe888, 0x6c6d329c
inc eax
test byte [eax + 0xebc6a36], bh
enter 0x46f8, 0xffffffffffffff90
push 0x8448ff38
scasb al, byte es:[edi]
xchg byte [edi - 0x1a], ch
in eax, 0xc6
clc
adc cl, byte [esi]
jbe 0x8849ef
cdq
ficomp word [esp + edx*2]
test byte [0xc50f48d0], al
out dx, eax
inc byte [ecx]
mov edx, 0x6bd999fe
dec esp
mov bl, 0xb9
xor byte [edi], bh
push eax
sbb byte [esi], dh
dec ecx
dec ecx
push esp
mov esp, 0x271ce4d9
std
mov edx, 0x2d4db26a
imul esp, dword [edi], reloc.WINMM.dll_midiStreamStop
add al, 0x9f
dec ebp
sub eax, 0x627b2769
daa
mov dh, 4
lahf
aam 0xc5
ja 0x884a29
xor dword [ebp - 0x37], edi
movsd dword es:[edi], dword [esi]
sbb byte [ebx + 0x6e], al
loop 0x884a72
mov dword [reloc.WINMM.dll_midiStreamStop], eax
mov ecx, ecx
stosd dword es:[edi], eax
xlatb
cmc
in al, dx
and al, 0x30
cmp dword [reloc.WINMM.dll_midiStreamStop], esi
cmp dword [esp + esi*4], ebx
add ah, byte [eax]
mov dl, 0xb8
test byte [eax + 0x72c49898], 0x67
inc esp
sub byte [eax + 0x52], ch
nop
rcr byte [esi + 0x60], 1
mov edi, 0x4a0eb39f
movsd dword es:[edi], dword [esi]
loope 0x884a7c
inc esp
mov ah, 0xc1
pop ss
jmp 0x884a66
push 0x9ee43694
call fcn.0082a3e6
mov dword [esp + 0x20], 0xc4f7d1ba
pushfd
mov byte [esp], 0x1e
mov byte [esp], ch
lea esp, [esp + 0x24]
jmp 0x7610b4

Function at 0x921bb7
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00921c36
jae 0x921bc3
xor ecx, ecx
call fcn.00921c36
jae 0x921bed
xor eax, eax
call fcn.00921c36
jae 0x921bfe
mov al, 0x10
call fcn.00921c36
adc al, al
jae 0x921bdf
jne 0x921c2b
stosb byte es:[edi], al
jmp 0x921bc4
call fcn.00921c42
dec ecx
loop 0x921c0a
mov eax, ebp
call fcn.00921c40
jmp 0x921c2c
lodsb al, byte [esi]
shr eax, 1
je 0x921c52
adc ecx, 2
mov ebp, eax
jmp 0x921c2c
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00921c40
cmp eax, 0x7d00
jae 0x921c2a
cmp eax, 0x500
jae 0x921c2b
cmp eax, 0x7f
ja 0x921c2c
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x921bc4
pop ebp
ret 8
Function at 0xa02a9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0x9a978ac4
jmp 0xa02f01
mov dh, 0x6a
inc dh
rdtsc
call fcn.00a02ad1
ficomp word [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
out dx, eax
cmp al, 0xbf
das
dec edx
mov ecx, 0x1c8d1272
outsd dx, dword [esi]
jbe 0xa02b1c
not cl
mov edx, 0xf4d04896
pushal
jmp 0xa02bb1
jmp 0xa02b4f
push esp
mov edx, dword [esp + 0x1d]
push dword [esp + 0x28]
ret 0x2c
bsr ax, cx
clc
xchg dword [esp + 4], edx
cmc
pushal
mov ax, word [esp + 0x1c]
jmp 0xa02b39
mov dh, 0x72
mov dh, byte [esp + 0x15]
adc dx, 0x6c0c
jmp 0xa02cb9
lea edx, reloc.WINMM.dll_midiStreamStop
mov dx, word [esp + 4]
jmp 0xa02b76
inc dh
jb 0xa02b96
lea edx, reloc.WINMM.dll_midiStreamStop
mov dx, word [esp + 4]
mov dh, 0x72
mov dh, byte [esp + 0x15]
adc dx, 0x6c0c
jmp 0xa02cb9
cmc
bsf dx, ax
mov ax, word [esp]
jmp 0xa02c19
btc eax, edi
xor dl, ch
jmp 0xa02bd0
mov dl, byte [esp]
jmp 0xa02c00
xchg edx, eax
sub esp, 0x1a
mov dx, 0x365d
jmp 0xa02c77
mov edx, esi
mov dh, bh
bts edx, esp
jns 0xa02bf7
mov dl, byte [esp]
xchg edx, eax
sub esp, 0x1a
mov dx, 0x365d
lea esp, [esp + 2]
jmp 0xa02c7b
add edx, eax
jle 0xa02bf0
btc eax, edi
xor dl, ch
cmc
bsf dx, ax
mov ax, word [esp]
jmp 0xa02c19
mov edx, ecx
mov edx, edi
mov dl, 0x5c
bsf dx, ax
jmp 0xa02ca2
add eax, ebp
rol cl, 0
mov dh, byte [esp]
jmp 0xa02c87
lea esp, [esp + 2]
lea esp, [esp + 0x18]
ror cl, 0
mov al, byte [esp]
jmp 0xa02c4e
rdtsc
ror dx, cl
jle 0xa02ce6
bswap eax
jmp 0xa02cd0
jp 0xa02c5e
add eax, ebp
jmp 0xa02c60
add esp, 0x13
push dword [esp + 1]
lea esp, [esp + 1]
lea esp, [esp + 0x10]
rol cl, 0
jmp 0xa02c3a
lea eax, [edi + edi]
mov dh, bh
jmp 0xa02d2c
bswap eax
lea eax, [edi + edi]
mov dh, bh
jmp 0xa02d2c
sub esp, 0x1a
jmp 0xa02d6b
sub esp, 0x1a
lea edx, [edx + edi]
lea esp, [esp + 2]
jmp 0xa02d72
dec cl
mov eax, dword [esp]
bsr ax, bp
jae 0xa02d0d
jb 0xa02d16
inc edx
mov dh, 0xbe
jmp 0xa02d76
neg edx
jb 0xa02d39
inc edx
mov dh, 0xbe
adc dx, 0x55f0
jmp 0xa02d7b
lea edx, [edx + edi]
lea esp, [esp + 2]
mov eax, ecx
jmp 0xa02d52
adc dx, 0x55f0
shl eax, 2
mov dx, word [esp]
not edx
jmp 0xa0300b
mov eax, dword [eax + reloc.WINMM.dll_midiStreamStop]
call 0xa02dfc
mov ax, word [esp]
lea edx, [esp + edx]
mov eax, ecx
inc ax
bswap edx
jmp 0xa02f98
xchg dword [esp + 0x34], edi
push esp
ror ah, 1
xchg byte [esp + 2], dh
sub esp, 6
pop dword [esp]
jmp 0xa02fcd
lea edi, [edi + 0x96]
rcl ax, cl
xchg dh, al
neg dx
sub esp, 0x14
clc
jmp 0xa02f5c
xchg dword [esp], edi
mov dh, byte [esp]
pushal
xchg dh, dl
mov word [esp + 0x1a], bx
lea edx, [eax + edi]
jmp 0xa02f7b
lea esp, [esp + 2]
push dword [esp + 0x38]
ret 0x3c
bswap edx
mov edx, dword [esp]
jmp 0xa02251
Function at 0xa03ce2
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xc
cmc
lea esp, [esp + 0xb]
mov byte [esp], bh
lea esp, [esp]
jmp 0xa03b3e
lea esp, [esp + 1]
xchg dword [esp], ebp
stc
cmc
clc
pushal
call fcn.00a03b1d
lea eax, [eax + edx]
add esp, 0xf
lea esp, [esp + 1]
jmp 0xa03b5e
bswap eax
jmp 0xa03b9c
mov dx, 0x396f
mov dx, ax
mov dx, 0x7301
lea eax, [ecx + edx]
bt eax, esp
jo 0xa03bf1
jno 0xa03bc6
mov cl, 0x22
mov al, 0xd7
and bl, byte [ecx + esi*8 + 0x6192f767]
fstp qword [edx]
jne 0xa03c24
popfd
jmp 0xa024a9
dec cl
mov dx, 0x8db5
lea eax, [esi*4]
neg dh
jmp 0xa03bf3
cmc
pushal
pop dx
add esp, 9
lea esp, [esp + 1]
jmp 0xa03c6b
jmp 0xa03bc6
jnp 0xa03bdb
cmc
pushal
jmp 0xa03bfd
pop dx
add esp, 9
lea esp, [esp + 1]
jmp 0xa03c6b
mov dl, 0x24
ror edx, 0x1f
jmp 0xa03c7b
mov dl, 0xfc
xchg ah, dh
lea eax, [ebp + 0x1f]
cmc
mov eax, ecx
bt edx, esp
jmp 0xa03cf8
mov edx, dword [esp]
mov dl, 4
lea edx, reloc.WINMM.dll_midiStreamStop
ror cl, 0
xchg edx, eax
jmp 0xa03c1f
lea esp, [esp + 0x14]
add cl, 0x96
mov eax, dword [esp]
bswap edx
rdtsc
jmp 0xa03c44
jp 0xa03c2a
mov dl, 0xfc
xchg ah, dh
jmp 0xa03d8c
lea esp, [esp + 0xc]
add cl, 0x32
mov al, ah
push esp
mov ah, byte [esp + 1]
lea eax, [esi + 0xb5]
jmp 0xa03cd7
lea esp, [esp + 2]
jmp 0xa03cac
bswap edx
mov dl, dh
push edx
call 0xa03ce2
shl dword [esi - 0x77], 1
and al, 8
xchg word [esp + 4], ax
bts eax, edi
jmp 0xa03d32
xchg ah, dh
sub esp, 0xe
jg 0xa03cd1
lea esp, [esp + 2]
jmp 0xa03cd5
inc eax
jbe 0xa03d38
mov edx, 0xd8a81060
lea eax, [ecx*4]
jmp 0xa03daf
pop ax
lea esp, [esp + 2]
jmp 0xa03d58
jl 0xa03d50
inc edx
cmc
jmp 0xa03d1b
mov edx, 0xd8a81060
lea eax, [ecx*4]
jmp 0xa03d61
inc edx
cmc
pop ax
lea esp, [esp + 2]
lea esp, [esp + 8]
ror cl, 0
jmp 0xa03d05
mov dx, word [esp]
and ecx, 0x3c
mov dx, cx
stc
jmp 0xa03d97
rdtsc
sub esp, 0
jmp 0xa03dfb
lea eax, [ebp + 0x1f]
cmc
mov eax, ecx
jmp 0xa03c34
jnp 0xa03d72
rdtsc
sub esp, 0
jmp 0xa03dfb
mov dx, word [esp]
jmp 0xa03d65
mov edx, dword [esi]
pop esi
lea eax, [eax + edi]
setb al
bswap eax
mov eax, dword [esp]
jmp 0xa03f30
cpuid
mov dword [esp + 4], edi
not ax
mov eax, dword [esp]
mov al, byte [esp]
popal
jmp 0xa03db5
push esi
pushal
lea ebp, [ecx*4]
setbe ah
jmp 0xa03dd4
mov dword [ecx + ebp], edx

Function at 0xa231a6
Capabilities:
Encrypt data using aes

Disassembly:
lea edi, [edi*4]
jmp 0xa231e6
lea esp, [esp + 0x28]
add esi, 0x10
xor edi, ecx
jmp 0xa232a6
shr edi, 0x18
cmc
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
call fcn.00a23222
cmp al, 0xaa
cmp byte [edi - 0x56], bl
pop ds
dec ebx
loop 0xa23272
insb byte es:[edi], dx
jg 0xa2329e
mov edi, edx
push esp
pop word [esp]
pop dword [esp]
mov byte [esp], dh
lea esp, [esp + 2]
and al, 0x8d
and al, 2
jmp 0xa2323c
add al, ch
cdq
add byte [eax], al
add ah, ah
jno 0xa2325c
xor byte [ebx - 0x4b], 0xe6
jb 0xa23261
xchg dword [edx - 0x3f], esi
ljmp 0xcf21:0xf524048f
mov esi, 0x2ddebb2b
cdq
into
pop ecx
mov edx, dword [esi]
pushal
mov di, word [esp + 0x16]
pop word [esp + 1]
push word [esp + 5]
jmp 0xa23258
Function at 0xa233d7
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
and edx, ecx
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
call 0xa2337c
push word [esp + 0x11]
mov word [esp + 0xc], bx
jmp 0xa233ad

Function at 0xa23533
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
call fcn.00a232f3
lea esp, [esp + 2]
and ebx, ecx
jmp 0xa239bc
lea esp, [esp + 0x10]
movzx ebx, byte [esi + 5]
sub esp, 0x10
call fcn.00a233d7
sub esp, 0x1a
sub esp, 8
add esp, 0xb
lea esp, [esp + 3]
jmp 0xa2347d
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
not bh
shl bx, cl
jmp 0xa2351e
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
clc
call fcn.00a23453
sub esp, 0
push edx
mov byte [esp], ch
add esp, 1
lea esp, [esp + 3]
jmp 0xa23467
and ebx, ecx
sub esp, 0x10
mov byte [esp + 0xa], ch
lea esp, [esp + 0x10]
jmp 0xa2354a
sub esp, 0xe
lea esp, [esp + 0xb]
lea esp, [esp + 3]
jmp 0xa234c8
mov ebp, ebx
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamStop
mov ebx, dword [ebp]
pop ebp
jmp 0xa234e9
movzx ebx, byte [esi + 6]
clc
push ebp
jmp 0xa23502
movzx ebx, byte [esi + 9]
cmc
and edx, ecx
call 0xa23533
dec edx
mov dword [esp], ecx
jmp 0xa23896
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
mov ebx, 0x9c548b64
sbb bx, 0xab2a
lea ebx, [ebp - 0x87]
jmp 0xa23526
mov edi, edx
sub esp, 0x16
mov word [esp + 0xa], dx
sub esp, 4
pop dword [esp + 0xa]
jmp 0xa235f0
bsf di, si
jmp 0xa23572
mov esi, ebx
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_midiStreamStop
mov ebx, dword [esi]
pop esi
jmp 0xa2358d
sub esp, 4
call 0xa235b9
outsd dx, dword [esi]
int1
popal
add bl, dh
inc esi
outsd dx, dword [esi]
pushal
pop es
inc edi
push ebx
mul dword [edi + 2]
int1
js 0xa2365a
lea esp, [esp + 2]
shr edi, 0x18
clc
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0xa235d5
mov dword [esi + 4], edi
lea edi, [edi*4]
push esi
jmp 0xa235a5
push edx
pop word [esp]
pushal
lea esp, [esp + 2]
jmp 0xa2366b
pop edx
clc
jmp 0xa2362d
and ebx, ecx
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
not bx
jmp 0xa236cf
mov edx, dword [esi + 8]
sub esp, 6
pushal
add esp, 0x1d
lea esp, [esp + 1]
jmp 0xa2361d
movzx ebx, byte [esi + 0xa]
call fcn.00a236b8
cdq
adc al, byte [eax + 0x19a112e7]
xchg edi, eax
pop es
bound edx, qword [ecx - 0x61f77ea6]
stc
or byte [ebp + 0x648d5425], bh
and al, 2
lea esp, [esp + 2]
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
mov edx, 0x69612468
xor dl, ch
jmp 0xa2368b
cmc
stc
and edx, ecx
sub esp, 0xe
mov dword [esp + 7], eax
jmp 0xa236ec
pop word [esp]
lea esp, [esp + 2]
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
stc
cmc
jmp 0xa23731
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
mov bx, word [esp]
sub esp, 0x12
pop word [esp + 5]
jmp 0xa2341c

Function at 0xa2373e
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
sub esp, 0x10
jmp 0xa23788
lea esp, [esp + 0x14]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
inc edx
lea edx, [eax*4]
mov dx, 0x679f
jmp 0xa23766