joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10062787
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10062824
push ebx
push esi
call fcn.10062750
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1005c6d5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100627d1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10062823
push edi
push eax
call fcn.1005a8af
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100627f1
call fcn.10058b5a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10062822
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1005c6d5
add esp, 0x20
test eax, eax
jne 0x10062810
push edi
call fcn.10058b5a
jmp 0x10062818
push ebx
call fcn.10058b5a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10062827
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10062838
pop esi
ret
push ebx
push edi
push esi
call fcn.10062750
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1005a8af
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10062860
push ebx
push esi
push edi
call fcn.10043e40
add esp, 0xc
push 0
call fcn.10058b5a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10062fba
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10062ad5

Function at 0x100651dd
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10058efe
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1006524c
cmp esi, dword [ebp - 4]
je 0x10065247
cmp dword [ebp + 0xc], 0
je 0x10065247
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10065224
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10064d2f
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1006524e
xor eax, eax
inc eax
jmp 0x1006524e
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100652b3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1009a340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10058efe
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10058efe
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1006532a
cmp word [ecx], dx
je 0x1006532a
mov eax, dword [0x1008a77c]
push edi
dec eax
push eax
push 0x1008a668
call fcn.10065252
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1006539d
cmp word [eax], dx
je 0x1006539d
mov eax, dword [edi]
test eax, eax
je 0x1006534e
cmp word [eax], dx
je 0x1006534e
lea eax, [ebp - 0x10]
push eax
call fcn.10064c35
jmp 0x10065357
lea eax, [ebp - 0x10]
push eax
call fcn.10064cd0
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100653c7
mov eax, dword [0x1008a664]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1008a358
call fcn.10065252
add esp, 0xc
test al, al
je 0x100653c7
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10065392
cmp word [eax], di
je 0x10065392
lea eax, [ebp - 0x10]
push eax
call fcn.10064c35
pop ecx
jmp 0x100653c9
lea eax, [ebp - 0x10]
push eax
call fcn.10064cd0
jmp 0x1006538f
mov eax, dword [edi]
test eax, eax
je 0x100653b4
cmp word [eax], dx
je 0x100653b4
lea eax, [ebp - 0x10]
push eax
call fcn.10064bea
pop ecx
jmp 0x100653c7
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10065492
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100650d7
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10065492
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10065492
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10065492
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1006541f
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1005ce54
test ebx, ebx
je 0x1006548d
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1005ce54
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10065492
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10065492
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10069c94
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10065494
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100424c3
leave
ret
Function at 0x1006a25a
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1006a1d6
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1006a3c9
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1006a3c9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1006a37e
jg 0x1006a2b6
test eax, eax
je 0x1006a374
push 1
push 0x1000
call fcn.1005e22e
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1006a2d9
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1006a36b
push 0x8000
push ebx
call fcn.1006a107
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1006a302
jg 0x1006a2fd
cmp ecx, 0x1000
jb 0x1006a302
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1004aff6
add esp, 0x10
cmp eax, 0xffffffff
je 0x1006a347
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1006a2fd
jl 0x1006a32e
test ecx, ecx
jne 0x1006a2ef
push dword [ebp - 0xc]
push ebx
call fcn.1006a107
push esi
call fcn.10058b5a
add esp, 0xc
xor ebx, ebx
jmp 0x1006a3d7
cmp byte [edi + 0x24], 0
je 0x1006a35e
cmp dword [edi + 0x20], 5
jne 0x1006a35e
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1006a369
mov ebx, dword [edi + 0x18]
jmp 0x1006a36b
xor ebx, ebx
push esi
call fcn.10058b5a
pop ecx
jmp 0x1006a3d7
test ecx, ecx
jg 0x1006a340
jl 0x1006a37e
test eax, eax
jae 0x1006a340
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1005d6a7
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1006a39e
cmp byte [edi + 0x1c], 0
je 0x1006a340
jmp 0x1006a3cf
push ebx
call fcn.1005d437
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1006a340
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1006a3d7
cmp byte [edi + 0x1c], 0
je 0x1006a3d4
mov ebx, dword [edi + 0x18]
jmp 0x1006a3d7
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1005d6a7
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1006cbc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1006cbed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1006cbed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x105d0
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov word [ebp - 0x10], 0xc
mov word [ebp - 0xe], 0xe
mov dword [ebp - 0xc], 0x10590
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x10510
push 0
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x10623
push 0x105a0
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov esp, ebp
pop ebp
ret

Function at 0x10e05
Capabilities:
Create device object
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x10d84]
test eax, eax
mov ecx, 0xbb40
je 0x10e1c
cmp eax, ecx
jne 0x10e3f
mov edx, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, 0x10d84
shr eax, 8
xor eax, dword [edx]
and eax, 0xffff
mov dword [0x10d84], eax
jne 0x10e3f
mov eax, ecx
mov dword [0x10d84], eax
not eax
mov dword [section..data], eax
pop ebp
jmp 0x10ae0
Function at 0x748dfa
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
lea ecx, [ecx + 0x22]
lea edx, [esi*4]
jmp 0x748e65
inc al
add al, 0xc5
rdtsc
push dword [esp]
ret 4
cmc
mov dx, 0x1812
rdtsc
bswap edx
xchg dword [esp], ecx
bswap edx
jmp 0x748e48

Function at 0x7515ae
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov byte [esp + 1], cl
lea esp, [esp + 4]
jmp 0x7378ee

Function at 0x754426
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
mov edx, dword [esp]
mov word [esp], sp
lea ebx, [ebx + esi]
xchg dword [esp + 4], ebx
jmp 0x754410

Function at 0x7546e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, ebx
push edi
pop dx
lea esp, [esp + 2]
jmp 0x754ca3
not al
pushfd
lea edx, reloc.WINMM.dll_midiStreamOut
xchg dword [esp], edx
mov dh, al
pop dx
jmp 0x75483b
lea esp, [esp + 0xc]
sub al, 5
bswap edx
mov dl, 0xf8
lea edx, [ebp*4]
jmp 0x75472b
ror al, 0
mov edx, 0x4f11b4e
lea edx, [ebx + ebp]
sets dl
clc
jmp 0x754796
lea esp, [esp + 2]
jmp 0x754756
rcr edx, cl
bt edx, ebp
shr dh, 2
mov dh, ch
jmp 0x7547c1
jge 0x7547b1
jl 0x7547b1
jg 0x754780
rcr edx, cl
bt edx, ebp
jmp 0x7547e4
lea esp, [esp + 0x20]
neg al
mov edx, 0x5a812b7
rol dx, cl
jmp 0x75479a
sub cl, al
mov al, bl
bt dx, bp
jle 0x754801
jg 0x7547eb
setp dl
mov eax, ecx
sub esp, 0xe
jle 0x754824
mov dx, bp
neg eax
rdtsc
jmp 0x754853
shr dh, 2
mov dh, ch
jmp 0x7547c1
mov eax, ebp
mov ax, 0xcc1
jmp 0x754807
mov eax, ebp
mov ax, 0xcc1
dec esi
mov dx, 0x5f05
jmp 0x7547cd
neg eax
rdtsc
mov al, dh
call fcn.00754975
imul dword [ebx - 5]
sahf
insd dword es:[edi], dx
fmul dword [esi]
cdq
clc
invalid
mov dx, bp
jmp 0x75480e
mov dx, 0xee67
pushal
bsf dx, bp
js 0x75477a
lea esp, [esp + 2]
jmp 0x754756
mov al, dh
jmp 0x754814
lea esp, [esp + 0xe]
lea edx, [ebp + 0x20]
jmp 0x754bc2
pop word [esp + 0x10]
xchg word [esp + 8], dx
pop dword [esp + 6]
jmp 0x75486a
pop word [esp + 0x10]
xchg word [esp + 8], dx
pop dword [esp + 6]
lea esp, [esp + 0xe]
lea edx, [ebp + 0x20]
pushfd
lea esp, [esp + 1]
jmp 0x754743
lea esp, [esp + 4]
add al, 0xcb
sub esp, 0x1d
jno 0x754bad
jo 0x7549c2
push dword [esp + 5]
rdtsc
lea esp, [esp + 3]
jmp 0x754d84
jmp 0x754d19
bsf bx, dx
push ecx
adc bl, 0x14
jle 0x754cd9
ror bx, 9
mov ah, bh
bsf cx, si
jmp 0x754d23
ror bx, 9
mov ah, bh
bsf cx, si
call 0x754d29
wait
jmp 0x754d5f
jmp 0x754d49
mov bx, word [esp]
jmp 0x754cef
pop eax
jmp 0x7432f6
lea eax, [ebx*4]
mov dword [esp], ecx
mov word [esp], sp
add esp, 4
jp 0x754d2b
jnp 0x754d49
aam 0x5c
xchg ebp, eax
xlatb
and ch, byte [ecx + 0x1eab5839]
dec eax
jmp 0x754d85
add ebp, 4
inc edx
lds eax, [edx + eax*2]
jp 0x754d43
mov bx, word [esp]
bsf bx, dx
jmp 0x754cf3
Function at 0x754975
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
not bl
rdtsc
mov dx, word [esp]
neg dx
jmp 0x7548cf
pop ax
pop dx
bswap edx
jmp 0x754876
pushal
pop ax
bts eax, ebx
lea esp, [esp + 2]
jmp 0x7548d6
lea edx, [edi + ebp]
sub esp, 0x1c
jmp 0x75488c
bts eax, ebx
lea esp, [esp + 2]
jmp 0x7548d6
jnp 0x754894
pushal
pop ax
jmp 0x7548b9
lea esp, [esp + 0x1c]
xor bl, 0x64
pushfd
not dx
mov dword [esp], ebx
jmp 0x754920
neg dx
jb 0x7548b1
lea edx, [edi + ebp]
sub esp, 0x1c
pop ax
pop dx
bswap edx
jmp 0x754876
push word [esp + 2]
pop word [esp + 1]
jmp 0x75494a
neg eax
jne 0x75490a
push word [esp + 2]
pop word [esp + 1]
xchg dword [esp], edx
jmp 0x75494d
setle al
mov edx, 0x91a72e44
mov dx, di
rdtsc
mov ah, al
clc
jmp 0x75499c
xchg dword [esp], edx
lea esp, [esp + 4]
inc bl
mov edx, esi
jmp 0x754933
add bl, 0x47
mov eax, ecx
mov dx, word [esp]
lea eax, [ecx + edx]
jmp 0x754986
retf
xchg dh, ah
lea esp, [esp + 2]
rol bl, 0
not ax
jmp 0x7548f4
mov edx, ebx
mov ax, sp
bsf eax, edx
jl 0x7549a0
jge 0x7549a8
jge 0x754974
jbe 0x7549a7
loopne 0x7549b9
popfd
in al, dx
inc esi
jbe 0x754957
ja 0x754957
cmp ah, ch
jmp 0x754acd
jno 0x7549e3
cmp ah, ch
mov eax, 0xbe29c952
jmp 0x754ad2
in eax, 0xb8
push edx
leave
sub dword [esi + reloc.WINMM.dll_midiStreamOut], edi
add byte [eax - 0xe], dl
pushal
pop es
bnd jne 0x754a2e
jne 0x754a2e
mul dword [edi + 2]
int1
cmp al, 0x6a
test dword [esi - 0x71], esp
inc esp
and al, 0x10
and eax, 0xad5e3bab
push 0x8d38d94e
add al, 0x95
add byte [eax], al
add byte [eax], al
lea eax, [edx*4]
stc
jmp 0x7534e1
rol dword [ebx + 0x26], cl
aad 0x11
rcl byte [edx + ecx*8 - 0x53]
pop esp
out dx, al
inc ecx
ret
jmp 0x7549ec
mov eax, 0xbe29c952
shl edx, 2
neg eax
jae 0x754a6a
lea eax, [edx*4]

Function at 0x823df5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [edi - 6]
mov si, 0xf3b7
xchg dword [esp], edx
std
inc ax
push ebp
jmp 0x823e0d
jmp 0x823dce
cmc

Function at 0x8241bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 6]
pop dx
setns dh
rdtsc
jmp 0x8241c4
mov ah, 0x46
push esi
jmp 0x8241a9
mov word [esp + 9], cx
mov esi, dword [esp + 0x15]
sub esp, 0x1e
cmp dx, 0xb30d
mov dword [esp + 0x1f], esp
xchg word [esp + 0x28], si
jmp 0x824211
pop si
pop eax
lea esp, [esp + 0x1d]
lea esi, reloc.WINMM.dll_midiStreamOut
mov dx, 0x242d
cmc
jmp 0x8241f0
Function at 0x824361
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, 0x3c
jmp 0x824555
bsf eax, ebx
sub esp, 0x1e
lea esp, [esp + 0x43]
bsr eax, edi
lea esi, [ebx + 0x37]
jmp 0x8244d0
rdtsc
mov dl, 0x79
push word [esp + 8]
sub esp, 0x17
lea edx, [esi*4]
mov ax, 0x1c2e
jmp 0x8243aa
mov esi, ebx
mov ax, bp
mov word [esp], si
lea eax, [eax*4]
clc
neg si
jmp 0x82443f
sub esp, 2
pushfd
mov ax, word [esp]
dec si
xchg word [esp + 2], ax
pop word [esp + 1]
jmp 0x8243d9
mov edx, esi
mov ax, word [esp]
sub esp, 0xe
pop word [esp + 0xc]
jmp 0x824467
bswap eax
mov dl, 0x3d
mov byte [esp], ch
or ax, 0x4d05
push word [esp]
mov al, bl
jmp 0x82440b
bswap esi
xchg byte [esp + 1], al
add esp, 0
bswap edx
xchg esi, eax
lea esp, [esp + 1]
jmp 0x824421
not ax
mov edx, 0xe5a721f4
pushfd
call fcn.00824451
cmp dword [esi + 0x2b], esi
popal
inc edi
add al, 0x33
sub al, byte [ebp + 0xf]
enter 0xffffffffffffd48b, 0xfffffffffffffffd
bswap eax
mov edx, esp
std
bswap esi
mov ax, 0xa225
bsf ax, cx
jmp 0x8243f5
mov edx, esi
xchg ah, al
rdtsc
lea edx, reloc.WINMM.dll_midiStreamOut
mov esi, dword [esp]
shl esi, 0x1b
jmp 0x82447e
pop ax
mov ax, dx
inc eax
neg ah
lea esi, [ecx + ecx]
mov edx, 0x60fe82c2
jmp 0x8243c0
adc al, dl
push dword [esp + 6]
xchg dh, al
std
lea eax, reloc.WINMM.dll_midiStreamOut
push word [esp + 2]
jmp 0x824506
Function at 0x824451
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
bts dx, di
push dword [esp + 0xf]
jmp 0x8244a8
mov ah, ch
xchg word [esp + 0xb], si
push dword [esp + 0x11]
rdtsc
jmp 0x8244e5
mov dl, ah
mov esi, dword [esp + 0x18]
pop ax
xchg edx, eax
xchg byte [esp + 0xc], dh
push word [esp + 4]
jmp 0x824492
mov eax, 0x1961a737
mov dword [esp + 8], eax
pop dword [esp + 3]
xchg dword [esp + 0x13], esi
cld
mov ax, word [esp + 2]
jmp 0x824531
mov si, 0xdab1
not dx
xchg dword [esp + 0x14], esi
cmc
mov dword [esp], ecx
jmp 0x82470d
mov dl, bh
bts si, si
xchg dword [esp + 0x13], edx
xchg dx, si
mov ax, word [esp + 0x11]
mov si, 0x2a5f
jmp 0x82451b
lea eax, [esi*4]
not eax
xchg dword [esp + 7], edx
neg si
jmp 0x82462b
mov dword [esp + 2], ebp
sub esp, 0x1f
cmc
rdtsc
pop edx
pop edx
jmp 0x82456b
cld
bswap eax
bswap edx
call fcn.00824594
bswap edx
xchg word [esp + 0x14], si
push word [esp + 0x2a]
jmp 0x824610
push dword [esp + 0x1c]
xchg dword [esp + 0xd], edx
push ebx
xchg byte [esp + 8], dl
mov dl, 0x48
mov dh, byte [esp + 0xf]
jmp 0x8245aa
std
mov dword [esp + 0xe], esi
mov ax, 0x13bf
pop dword [esp + 0x13]
jmp 0x824677
lea edx, reloc.WINMM.dll_midiStreamOut
mov esi, ecx
stc
sub esp, 0xa
sub ax, dx
mov ah, cl
jmp 0x8245fa
mov edx, 0xba2598f5
mov dx, 0xc614
mov esi, edi
xchg byte [esp], ah
mov dword [esp + 8], ebp
mov eax, esi
jmp 0x8245e5
bswap edx
pop ax
mov dh, 0xa9
pop ax
bsr esi, esp
mov si, word [esp + 0x13]
jmp 0x82468f
mov dx, ax
mov al, 0x38
mov dword [esp + 0x15], esi
std
cld
btc dx, cx
jmp 0x824641
xor si, 0x6552
setg ah
lea esp, [esp + 0x13]
xchg word [esp + 3], ax
mov dx, cx
mov edx, esi
jmp 0x824657
bswap edx
setno dh
mov ax, cx
pop eax
stc
mov si, sp
jmp 0x8246dd
push word [esp + 9]
rdtsc
mov word [esp + 9], bp
xchg dword [esp + 1], edx
btc dx, dx
mov dl, 0x65
jmp 0x824586
mov word [esp + 8], bx
xchg word [esp + 0x10], dx
add ax, cx
mov si, word [esp + 3]
not dl
bsf si, bp
call fcn.008246c7
mov es, word [0xe20ffc95]
cmp byte [esi + 0x50be4324], dh
and ebp, dword [edi + 0x30]
js 0x824763
pop ds
dec esi
bsf eax, edx
xchg dword [esp + 0x13], esi
lea esp, [esp + 0x15]
dec ax
push sp
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x8246ac
dec edi
salc
inc ecx
ret
Function at 0x829c4b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], dl
lea ebp, [edi + edi]
add esp, 2
lea ebp, [ecx + 0x7c]
xchg edx, esi
jmp 0x829cff
xchg byte [esp], ah
ror edx, 7
xchg ebx, edx
mov byte [esp + 1], cl
bswap eax
lea ebx, [eax + edx]
jmp 0x829c10
clc
setl dl
jmp 0x829c26
mov ecx, 0x190b768a
std
rdtsc
mov ah, byte [esp]
neg dl
lea esi, [edx - 0x1d]
jmp 0x829c98
rdtsc
lea edi, reloc.WINMM.dll_midiStreamOut
bsf ebp, eax
add eax, 0xd1134094
bsr edx, ebx
add esp, 1
jmp 0x829c51
lea esp, [esp + 1]
lea esp, [esp + 1]
and ebp, 0xad4e7939
jmp 0x829cc1
bsf ebp, ebp
push cx
not dl
rcl cl, cl
mov eax, dword [esp]
mov bx, word [esp + 2]
jmp 0x829c82
cpuid
mov byte [esp], dl
xchg byte [esp], ah
inc edx
xchg ch, cl
not dx
jmp 0x829ce8
lea ebp, [ebx*4]
sub ebx, edi
stc
cld
neg ecx
neg edx
jmp 0x829cab
bsf cx, bp
pushal
pop di
xchg word [esp + 0x30], ax
mov byte [esp + 0x22], bl
jmp 0x829d2f
xchg dl, bl
mov edi, dword [esp]
lea edi, [edx + edi]
pushal
pop dword [esp + 0x11]
lea esp, [esp + 7]
jmp 0x829cd2
inc dx
xchg dx, cx
mov dx, cx
lea esp, [esp]
mov cx, 0x89de
or ebx, 0xa87672e8
jmp 0x829c6a
xchg word [esp + 0x2a], cx
push word [esp + 0x24]
std
not eax
xchg bp, cx
jmp 0x829d46
xchg word [esp + 0x30], cx
mov ax, word [esp + 0xc]
pop cx
bsr ebx, esp
push word [esp + 0x15]
dec ebx
jmp 0x829d19
mov word [esp + 0x10], dx
popal
not bx
mov ebx, dword [esp + 9]
mov ebx, ebp
mov bh, dl
jmp 0x829ec0
mov bl, byte [esp + 2]
pop dword [esp + 0xf]
mov di, word [esp + 0x1e]
inc bp
bswap ebx
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0x829d78
mov bh, 0xe0
xchg dword [esp + 8], edi
pop ebp
mov ch, byte [esp + 4]
setle cl
sub esp, 0x12
jmp 0x829d8e
push dword [esp + 7]
mov dword [esp + 3], edx
neg ebp
not bp
pop di
pop word [esp + 0xe]
jmp 0x829db8
lea esi, reloc.WINMM.dll_midiStreamOut
btc ebx, ecx
mov al, byte [esp + 0x17]
pop word [esp + 2]
std
bt dx, cx
jmp 0x829df1
sub esp, 6
cld
mov dword [esp + 0xb], edx
bsf cx, ax
not bp
lea ebx, [edx + esi]
jmp 0x829e38
Function at 0x4038b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4038bb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4039be
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x448120]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x448120]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x448120]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x448120]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x448120]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x448120]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x448120]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x448120]
xor eax, edx
inc ecx
dec edi
jne 0x4038d6
pop edi
test esi, esi
je 0x4039e0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x448120]
xor eax, edx
inc ecx
dec esi
jne 0x4039c2
pop esi
pop ebx
not eax
ret

Function at 0x403bb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x80
mov ecx, 8
push ebx
push ebp
push esi
mov ebx, dword [esp + 0x98]
push edi
mov esi, eax
lea edi, [esp + 0x30]
mov ebp, 0x10
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x20]
mov ecx, 8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x10]
lea edi, [esp + 0x50]
lea eax, [esp + 0x70]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebx
call fcn.00403c60
add esp, 0xc
xor eax, eax
mov dl, byte [esp + eax + 0x70]
mov cl, byte [esp + eax + 0x30]
xor dl, cl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x20
jl 0x403c09
mov ecx, 8
lea esi, [esp + 0x50]
lea edi, [esp + 0x30]
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x403be5
mov eax, dword [esp + 0x98]
mov ecx, 8
lea esi, [esp + 0x10]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x20]
mov ecx, 8
lea esi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret