joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68f25b9a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5c79c
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x68f6edd8]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x68f76274
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor esi, esi
cmp eax, esi
jne 0x68f25bf8
xor al, al
jmp 0x68f25cab
push 0x104
lea ecx, [esp + 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x68f25bf1
lea eax, [esp + 0x54]
push 0x5c
push eax
call dword [sym.imp.MSVCR80.dll_wcsrchr]
cmp eax, esi
pop ecx
pop ecx
je 0x68f25bf1
mov word [eax + 2], si
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], esi
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::Set_wchar_t_const__
mov dword [esp + 0x270], esi
push str.GrooveStdURLLauncher.exe
lea ecx, [esp + 0x18]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::Append_wchar_t_const__
push 0x3c
lea eax, [esp + 0x1c]
push esi
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x40], eax
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x28], str.open
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
or dword [esp + 0x270], 0xffffffff
cmp dword [esp + 0x14], esi
je 0x68f25ca9
lea ecx, [esp + 0x14]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov al, bl
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.68f53fd7
mov esp, ebp
pop ebp
ret 0xc

Function at 0x68f26c55
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x68f6edd8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
push eax
mov ecx, ebx
or ecx, 0x8000
push ecx
push eax
mov byte [ebp - 0x20d], al
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x68f26ce3
push edi
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::Set_wchar_t_const__
push dword [esi]
lea eax, [ebp - 0x214]
push eax
call sym.GrooveUtil.DLL_public:_static_class_GCStrRetVal___stdcall_raw_GCStr::ToLower_wchar_t_const__
mov edi, dword [eax]
mov ecx, esi
call fcn.68ef1154
cmp ebx, 0x1c
mov dword [esi], edi
mov byte [ebp - 0x20d], 1
je 0x68f26cd3
cmp ebx, 0x23
je 0x68f26cd3
cmp ebx, 0x26
jne 0x68f26ce2
push edi
push str._smicrosoft_officeoffice12_
jmp 0x68f26cd9
push edi
push str._smicrosoftofficegroove_
push esi
call sym.GrooveUtil.DLL_public:_long_int___cdecl_GCStr::Format_wchar_t_const__
add esp, 0xc
pop edi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x20d]
xor ecx, ebp
call fcn.68f53fd7
leave
ret
Function at 0x68f27f7e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f5c63c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x68f6edd8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x30], ebx
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x68f28026
cmp word [esi], bx
je 0x68f28026
cmp dword [ebp + 0x10], ebx
je 0x68f28026
mov dword [esp + 0x14], ebx
mov byte [esp + 0x30], 1
mov dword [esp + 0x20], ebx
mov byte [esp + 0x30], 2
push esi
lea ecx, [esp + 0x18]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCCharIterator::SetText_wchar_t_const__
push dword [ebp + 0x10]
lea ecx, [esp + 0x18]
call sym.GrooveUtil.DLL_public:_long_int___thiscall_GCCharIterator::Skip_long_int_
cmp eax, 0xffffffff
je 0x68f2800e
push eax
push esi
lea eax, [esp + 0x18]
push eax
call sym.GrooveUtil.DLL_public:_static_class_GCStrRetVal___stdcall_raw_GCStr::First_wchar_t_const___unsigned_long_int_
mov esi, dword [eax]
lea ecx, [esp + 0xc]
call fcn.68ef1154
mov dword [esp + 0xc], esi
jmp 0x68f28018
push esi
lea ecx, [esp + 0x10]
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStr::Set_wchar_t_const__
mov byte [esp + 0x30], bl
lea eax, [esp + 0x14]
push eax
call fcn.68f2a08a
mov eax, dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp + 0xc], ebx
mov dword [esi], eax
or dword [esp + 0x30], 0xffffffff
cmp ebx, ebx
je 0x68f28045
lea ecx, [esp + 0xc]
call sym.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x68f2f1b7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
push 0
push dword [0x68fabe50]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x68f2f1e5
lea eax, [ebp - 4]
push eax
push 0x40
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
leave
ret 4

Function at 0x68f3070f
Capabilities:
Get thread local storage value

Disassembly:
push 4
mov eax, 0x68f5e5a4
call fcn.68f54c62
push dword [0x68fabe74]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x68f30778
push 0x14
call dword [sym.imp.GrooveNew.DLL_void____cdecl_GrooveNew_unsigned_int_]
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x68f30761
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x10], eax
mov byte [ebp - 4], bl
jmp 0x68f30763
xor esi, esi
or dword [ebp - 4], 0xffffffff
push esi
mov eax, 0x68fabe74
call fcn.68f0fff5
push esi
call fcn.68f308cd
mov eax, esi
call fcn.68f54d3a
ret
Function at 0x68f357e7
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x68f6edd8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 8], bl
jle 0x68f358d6
push esi
push edi
push 3
xor edx, edx
pop ecx
cmp ebx, dword [ebp + 0x10]
jge 0x68f35823
mov eax, dword [ebp + 0xc]
mov al, byte [ebx + eax]
jmp 0x68f35825
xor al, al
movzx eax, al
shl edx, 8
inc ebx
or edx, eax
dec ecx
jne 0x68f35816
mov edi, ebx
sub edi, dword [ebp + 0x10]
push 3
pop ecx
xor esi, esi
mov al, dl
and al, 0x3f
shr edx, 6
cmp esi, edi
jge 0x68f3584d
mov byte [ebp + ecx - 0xc], 0x3d
jmp 0x68f35873
cmp al, 0x1a
jae 0x68f35855
add al, 0x41
jmp 0x68f3586f
cmp al, 0x34
jae 0x68f3585d
add al, 0x47
jmp 0x68f3586f
cmp al, 0x3e
jae 0x68f35865
sub al, 4
jmp 0x68f3586f
setne al
lea eax, [eax*4 + 0x2b]
mov byte [ebp + ecx - 0xc], al
dec ecx
inc esi
cmp esi, 3
jle 0x68f3583b
mov esi, dword [ebp - 0x14]
test esi, esi
mov edi, 0x68f77674
je 0x68f3588b
mov edi, 0x68f73159
push dword [ebp - 0x10]
call fcn.68f357bd
push dword [ebp - 0x10]
lea edi, [ebp - 0xc]
call fcn.68f357bd
cmp ebx, dword [ebp + 0x10]
mov edi, 0x68f7766c
jge 0x68f358b2
cmp esi, 0xf
je 0x68f358b2
mov edi, 0x68f73159
push dword [ebp - 0x10]
call fcn.68f357bd
inc esi
and esi, reloc.OLEAUT32.dll_SafeArrayDestroy
jns 0x68f358c8
dec esi
or esi, 0xfffffff0
inc esi
cmp ebx, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
jl 0x68f35811
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
mov al, 0xa
call fcn.68f357a0
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop ebx
call fcn.68f53fd7
leave
ret 0xc
Function at 0x68f36599
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 3
xor edi, edi
call fcn.68f36227
mov ebx, eax
cmp ebx, 0xa
jne 0x68f365eb
inc dword [0x68fa839c]
call fcn.68f36188
cmp eax, ebx
jne 0x68f365b9
test esi, esi
je 0x68f366eb
push dword [ebp - 8]
push esi
call fcn.68f3528d
push esi
jmp 0x68f366ff
lea eax, [ebx - 0x41]
cmp eax, 0x19
ja 0x68f365f8
sub bl, 0x41
jmp 0x68f36632
lea eax, [ebx - 0x61]
cmp eax, 0x19
ja 0x68f36605
sub bl, 0x47
jmp 0x68f36632
lea eax, [ebx - 0x30]
cmp eax, 9
ja 0x68f36612
add bl, 4
jmp 0x68f36632
cmp ebx, 0x2b
jne 0x68f3661b
mov bl, 0x3e
jmp 0x68f36632
cmp ebx, 0x2f
jne 0x68f36624
mov bl, 0x3f
jmp 0x68f36632
cmp ebx, 0x3d
jne 0x68f366d2
xor bl, bl
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
shl eax, 6
movzx ecx, bl
or eax, ecx
inc edi
cmp edi, 4
mov dword [ebp - 0x10], eax
jne 0x68f365b9
push 3
lea eax, [ebp - 2]
pop ecx
mov dl, byte [ebp - 0x10]
shr dword [ebp - 0x10], 8
mov byte [eax], dl
dec eax
dec ecx
jne 0x68f36650
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov eax, edi
call fcn.68f0254d
cmp eax, dword [ebp - 0xc]
jbe 0x68f366a7
test esi, esi
jne 0x68f36684
mov eax, 0x400
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.MSVCR80.dll_malloc]
jmp 0x68f36696
shl dword [ebp - 0xc], 2
push dword [ebp - 0xc]
mov dword [ebp - 0x14], esi
push esi
call dword [sym.imp.MSVCR80.dll_realloc]
pop ecx
mov esi, eax
test esi, esi
pop ecx
jne 0x68f366ab
push str.out_of_memory_while_processing_BASE64_data_n
call fcn.68f36bc8
test esi, esi
je 0x68f366c9
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, esi
push eax
call dword [sym.imp.MSVCR80.dll_memcpy_s]
add esp, 0x10
add dword [ebp - 8], edi
and dword [ebp - 0x10], 0
jmp 0x68f365b7
cmp ebx, 0x20
je 0x68f365b9
cmp ebx, 9
je 0x68f365b9
test esi, esi
je 0x68f36708
push esi
jmp 0x68f36711
cmp dword [ebp - 0x14], 0
je 0x68f36740
push dword [ebp - 8]
push dword [ebp - 0x14]
call fcn.68f3528d
push dword [ebp - 0x14]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
jmp 0x68f36740
cmp dword [ebp - 0x14], 0
je 0x68f36718
push dword [ebp - 0x14]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
cmp ebx, 0xffffffff
je 0x68f36740
jmp 0x68f3672e
cmp eax, 0xa
jne 0x68f3672e
call fcn.68f36188
cmp eax, 0xa
je 0x68f3673a
call fcn.68f36227
cmp eax, 0xffffffff
jne 0x68f3671f
jmp 0x68f36740
inc dword [0x68fa839c]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x68f3bf66
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
Function at 0x68f3bfae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.68f3b69c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.68f3b651
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.68f3b69c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.68f3b651
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.68f3b68c
cdq
or ch, byte [edx - 0x335a7fc4]
cli
invalid

Function at 0x68f3c389
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x6b75b], al
inc dword [eax]
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.68f3b69c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.68f3b651
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.68f3b68c
sal dword [esi - 0x4a00ac8c], 0x68
stc
invalid
Function at 0x68f3c5a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, 0x8fffff0
mov al, byte [0x2ff845c6]
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.68f3b69c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.68f3b651
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.68f3b68c
sub eax, 0x680efdbb
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.68f3b68c
ret

Function at 0x68f3cabe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x6dc]
push eax
call fcn.68f3b69c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.68f3b651
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x68f3d81f
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.68f3b5fd
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x68f3ca99
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x68f3cae2
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
or eax, 0xfffffc6c
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x68f3ca8c
call fcn.68f3b68c
and dl, 0xaf
invalid
invalid
movsd dword es:[edi], dword [esi]
aam 0xf8

Function at 0x68f3cb00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
clc
invalid
call dword [esi + eax*8 - 0x7b]
invalid
clc
invalid
dec dword [edi - 0x3a]
test ebx, ebx
clc

Function at 0x68f3d015
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0x68f3d02d
call fcn.68f3b651
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
add byte [edx + 1], ch
Function at 0x68f42b41
Capabilities:
Get file version info

Disassembly:
push 0x43c
mov eax, 0x68f594e3
call fcn.68f54ccb
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x222]
push ebx
push eax
mov edi, ecx
mov word [ebp - 0x224], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x224]
push 0x105
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x224]
push eax
mov dword [ebp - 0x43c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jbe 0x68f42c9a
push edi
call dword [sym.imp.GrooveNew.DLL_void____cdecl_GrooveNew_unsigned_int_]
pop ecx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x440], eax
mov dword [ebp - 4], ebx
push eax
push edi
push dword [ebp - 0x43c]
lea eax, [ebp - 0x224]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x68f42c7b
push 0x4b0
push ebx
lea eax, [ebp - 0x324]
push str.StringFileInfo_04X_04XProductName
push eax
call fcn.68f42e1e
add esp, 0x10
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x324]
push eax
push dword [ebp - 0x438]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x68f42c37
mov eax, dword [ebp - 0x444]
cmp eax, dword [esi]
mov edi, eax
je 0x68f42c7b
push eax
call fcn.68ef25a7
push eax
push edi
mov ecx, esi
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStackStrBase::Set_wchar_t_const__const__unsigned_long_int_
jmp 0x68f42c7b
call sym.GrooveUtil.DLL_public:_static_struct_HINSTANCE______stdcall_GCGrooveResourceModule::GetHandle_void_
push eax
push 0x2d52
lea eax, [ebp - 0x434]
push eax
call fcn.68f08ee6
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x434]
cmp eax, dword [esi]
mov edi, eax
je 0x68f42c6d
push eax
call fcn.68ef25a7
push eax
push edi
mov ecx, esi
call sym.GrooveUtil.DLL_public:_void___thiscall_GCStackStrBase::Set_wchar_t_const__const__unsigned_long_int_
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x434]
call fcn.68ef3ef5
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x438], ebx
je 0x68f42c9a
push dword [ebp - 0x438]
call dword [sym.imp.GrooveNew.DLL_void___cdecl_GrooveDelete_void__]
pop ecx
mov dword [ebp - 0x440], ebx
call fcn.68f54d4e
ret
Function at 0x68f44cd1
Capabilities:
Get thread local storage value

Disassembly:
push 8
mov eax, 0x68f56981
call fcn.68f54c62
push dword [0x68fac040]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
xor esi, esi
cmp ebx, esi
jne 0x68f44d28
push 0x10
call dword [sym.imp.GrooveNew.DLL_void____cdecl_GrooveNew_unsigned_int_]
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x68f44d15
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov byte [ebp - 4], 0
jmp 0x68f44d17
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ebx, eax
push eax
mov eax, 0x68fac040
call fcn.68f0fff5
mov al, byte [ebp + 8]
mov esi, dword [ebx + 4]
mov byte [ebp - 0x14], al
test esi, esi
setge al
mov edi, 0x80070057
push edi
push 0x2e73696d
push eax
call fcn.68ef3ed8
cmp esi, dword [ebx + 4]
jl 0x68f44d65
lea eax, [esi + 1]
push eax
call fcn.68f44f53
cmp esi, dword [ebx + 4]
jl 0x68f44d65
push edi
push 0x2e736977
call fcn.68ef1014
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x14]
mov dword [ebx + esi*8], eax
xor eax, eax
mov dword [ebx + esi*8 + 4], eax
call fcn.68f54d3a
ret 4
Function at 0x68f51aee
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x68f61f22
call fcn.68f54c62
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
push 0x14
call dword [sym.imp.GrooveNew.DLL_void____cdecl_GrooveNew_unsigned_int_]
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x68f51b33
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push eax
call fcn.68f515f5
mov dword [ebp + 0x18], eax
jmp 0x68f51b36
mov dword [ebp + 0x18], ebx
mov byte [ebp - 4], bl
lea esi, [ebp - 0x10]
call fcn.68f51e3e
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 2
inc dword [edi + 0x18]
cmp dword [edi + 0x18], 1
jne 0x68f51b7c
cmp dword [edi + 0x1c], ebx
jne 0x68f51b7c
mov esi, dword [edi + 0x24]
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
cmp eax, ebx
jge 0x68f51b7c
push 0x68f79740
push esi
push eax
call fcn.68ef1079
mov byte [ebp - 4], bl
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp + 0x18]
mov dword [ebp - 0x10], ebx
push ebx
push 0x68f51ddd
call dword [sym.imp.MSVCR80.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x68f51baa
push 0x2e6b6831
call fcn.68ef2114
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x10]
call fcn.68f51e3e
call fcn.68f54d3a
ret 0x14

Function at 0x68f51bbe
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x68f61eed
call fcn.68f54c62
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
push 0x14
call dword [sym.imp.GrooveNew.DLL_void____cdecl_GrooveNew_unsigned_int_]
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x68f51c00
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push eax
call fcn.68f5183c
mov dword [ebp + 0x14], eax
jmp 0x68f51c03
mov dword [ebp + 0x14], ebx
mov byte [ebp - 4], bl
lea esi, [ebp - 0x10]
call fcn.68f51e3e
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 2
inc dword [edi + 0x18]
cmp dword [edi + 0x18], 1
jne 0x68f51c49
cmp dword [edi + 0x1c], ebx
jne 0x68f51c49
mov esi, dword [edi + 0x24]
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
cmp eax, ebx
jge 0x68f51c49
push 0x68f79740
push esi
push eax
call fcn.68ef1079
mov byte [ebp - 4], bl
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp + 0x14]
mov dword [ebp - 0x10], ebx
push ebx
push 0x68f51e0b
call dword [sym.imp.MSVCR80.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x68f51c77
push 0x2e6b6832
call fcn.68ef2114
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x10]
call fcn.68f51e3e
call fcn.68f54d3a
ret 0x10