joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a277
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0043a1b6
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043e100
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43a2c6
cmp dword [ebp - 0x1c], 5
jb 0x43a2de
jmp 0x43a2da
cmp dword [ebp - 0x10], 1
jne 0x43a2de
cmp dword [ebp - 0x1c], 4
ja 0x43a2da
jne 0x43a2de
cmp dword [ebp - 0x18], 0
jbe 0x43a2de
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x452538
call fcn.0043a04c
test eax, eax
jge 0x43a2ff
mov byte [0x5a1cf4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043afb6
add ebp, 0x78
leave
ret

Function at 0x43afb6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46b070]
jne 0x43afc0
repz ret
jmp fcn.004400cd
Function at 0x43cee2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x43cf1f
cmp dword [ebp + 0x14], edi
je 0x43cf1f
cmp ecx, edi
jne 0x43cf26
call fcn.0043e5d0
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0043b687
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x43cf3a
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x43cf5b
cmp ebx, 0xffffffff
je 0x43cf4a
push ebx
push edi
push ecx
call fcn.0043e100
add esp, 0xc
cmp esi, edi
je 0x43cf07
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x43cf07
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x43cf77
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x43cf7e
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x43d06f
test word [esi + 0xc], 0x10c
je 0x43cfd2
mov eax, dword [esi + 4]
test eax, eax
je 0x43cfd2
jl 0x43d0d0
cmp ebx, eax
mov edi, ebx
jb 0x43cfa3
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x43d077
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0043aa75
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x43d067
cmp ebx, dword [ebp - 0xc]
jb 0x43d03f
cmp dword [ebp - 0xc], 0
je 0x43cffc
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x43cff1
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x43cff8
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x43d007
mov eax, SysReAllocString
cmp ebx, eax
ja 0x43d007
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x43d0a3
push eax
push dword [ebp - 8]
push esi
call fcn.00444526
pop ecx
push eax
call fcn.0044545d
add esp, 0xc
test eax, eax
je 0x43d0e2
cmp eax, 0xffffffff
je 0x43d0d0
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x43d067
push esi
call fcn.00444553
cmp eax, 0xffffffff
pop ecx
je 0x43d0d4
cmp dword [ebp - 4], 0
je 0x43d0a3
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x43cf86
mov eax, dword [ebp + 0x14]
jmp 0x43cf21
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43d08e
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0043e100
add esp, 0xc
call fcn.0043e5d0
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x43cf17
cmp dword [ebp + 0xc], 0xffffffff
je 0x43d0b9
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0043e100
add esp, 0xc
call fcn.0043e5d0
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x43cf17
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x43cf21
or dword [esi + 0xc], 0x10
jmp 0x43d0d4
Function at 0x43f4a3
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x46b338]
je 0x43f4be
inc edi
cmp edi, 0x17
jb 0x43f4af
cmp edi, 0x17
jae 0x43f63e
push ebp
push 3
call fcn.00447b0e
cmp eax, 1
pop ecx
je 0x43f60a
push 3
call fcn.00447b0e
test eax, eax
pop ecx
jne 0x43f4f2
cmp dword [0x46b060], 1
je 0x43f60a
cmp ebx, 0xfc
je 0x43f63d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x5a01b8
push ebp
call fcn.0043b266
add esp, 0xc
test eax, eax
je 0x43f528
push esi
push esi
push esi
push esi
push esi
call fcn.0043b58b
add esp, 0x14
push 0x104
mov esi, 0x5a01d1
push esi
push 0
mov byte [0x5a02d5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43f56c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0043b266
add esp, 0xc
test eax, eax
je 0x43f56c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0043b58b
add esp, 0x14
push esi
call fcn.0043d9f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x43f5b1
push esi
call fcn.0043d9f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x5a04cc
push 0x452bdc
sub ecx, eax
push ecx
push eax
call fcn.00447a5b
add esp, 0x14
test eax, eax
je 0x43f5b1
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0043b58b
add esp, 0x14
jmp 0x43f5b3
xor esi, esi
push 0x452bd8
push ebx
push ebp
call fcn.0043d6eb
add esp, 0xc
test eax, eax
je 0x43f5d3
push esi
push esi
push esi
push esi
push esi
call fcn.0043b58b
add esp, 0x14
push dword [edi*8 + 0x46b33c]
push ebx
push ebp
call fcn.0043d6eb
add esp, 0xc
test eax, eax
je 0x43f5f5
push esi
push esi
push esi
push esi
push esi
call fcn.0043b58b
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0044789e
add esp, 0xc
jmp 0x43f63d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x43f63d
cmp ebp, 0xffffffff
je 0x43f63d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x46b33c]
push dword [esi]
call fcn.0043d9f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44789e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043f782
xor ebx, ebx
cmp dword [0x5a0b98], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x447974
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x447a54
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4536d4
push edi
call esi
cmp eax, ebx
je 0x447a54
push eax
call fcn.0043f714
mov dword [esp], 0x4536c4
push edi
mov dword [0x5a0b98], eax
call esi
push eax
call fcn.0043f714
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5a0b9c], eax
call esi
push eax
call fcn.0043f714
mov dword [0x5a0ba0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043c3c7
test eax, eax
pop ecx
pop ecx
je 0x447942
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043b58b
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x447974
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043f714
cmp eax, ebx
pop ecx
mov dword [0x5a0ba8], eax
je 0x447974
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043f714
pop ecx
mov dword [0x5a0ba4], eax
mov eax, dword [0x5a0ba4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4479f9
cmp dword [0x5a0ba8], ecx
je 0x4479f9
push eax
call fcn.0043f78b
push dword [0x5a0ba8]
mov esi, eax
call fcn.0043f78b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4479f9
cmp edi, ebx
je 0x4479f9
call esi
cmp eax, ebx
je 0x4479c6
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4479c6
test byte [ebp - 0x18], 1
jne 0x4479f9
lea eax, [ebp - 0x10]
push eax
call fcn.0043c3fe
test eax, eax
pop ecx
je 0x4479e1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043b58b
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4479f0
or dword [ebp + 0x10], 0x200000
jmp 0x447a34
or dword [ebp + 0x10], 0x40000
jmp 0x447a34
mov eax, dword [0x5a0b9c]
cmp eax, dword [ebp - 8]
je 0x447a34
push eax
call fcn.0043f78b
cmp eax, ebx
pop ecx
je 0x447a34
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x447a34
mov eax, dword [0x5a0ba0]
cmp eax, dword [ebp - 8]
je 0x447a34
push eax
call fcn.0043f78b
cmp eax, ebx
pop ecx
je 0x447a34
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5a0b98]
call fcn.0043f78b
cmp eax, ebx
pop ecx
je 0x447a54
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x447a56
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5b3bb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [ebp + ecx - 0x63ab32a]
lea eax, [ecx + ecx*2 + 0x7198a22a]
mov ax, word [ebp + ecx - 0x63ab328]
mov cl, byte [ebp + ecx*4 - 0x18eacca4]
mov dword [esp + 4], 0xdf17c706
add ebp, 4
shld dx, ax, cl
mov word [ebp], dx
mov eax, dword [esi]
mov edx, 0x7530e117
bt edx, 0x34
mov dword [esp + edx - 0x7530e117], 0x4d2a0d83
lea esi, [esi + edx - 0x7530e113]
adc word [esp + edx - 0x7530e111], 0x1707
adc dx, word [esp + edx - 0x7530e112]
and edx, dword [esp + edx - 0x753000db]
xor eax, ebx
lea edx, [edx + edx*8 - 0x234e7376]
lea edx, [edx*4 + 0x2914891d]
sub eax, 0x1346189
movzx ecx, dl
sal edx, cl
btc edx, ecx
ror eax, 1
xor eax, 0x26bde6b4
lea eax, [eax + ecx*2 - 0x763f8dfc]
call fcn.0066a18c
call fcn.0068157c

Function at 0x5bbe2b
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea ecx, [ecx*2 - 0x4ff8f7fe]
xor edx, ebx
call fcn.005e8b73
Function at 0x5c17d9
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x5aa9d091
call fcn.005cffc9
mov edx, 0x449e7a06
mov eax, dword [ebp + edx - 0x449e7a06]
mov edx, dword [ebp + edx - 0x449e7a02]
mov ecx, 0x2d12d40f
jmp 0x6b6d95
mov eax, dword [eax + edi - 0x9738]
sar edx, cl
xor eax, ebx
btc edx, ecx
inc ecx
rol byte [esp + edx - 0x10], 0xe1
bswap eax
shl ecx, 0xf8
sete byte [esp + edx - 0x11]
or dword [esp + ecx - 0x25000000], ecx
not eax
btr edx, ecx
sbb ecx, 0x4608ab84
xor eax, 0x5cafce05
call fcn.00669f15
std
pop edi
jne 0x64a7fb
wait
mov eax, 0xe03c8452
cmc
imul eax, dword [ebx], 0xc20e40c0
outsb dx, byte [esi]
inc ebx
vpcmpgtd xmm4, xmm7, xmmword [ebx + 0x28]
jbe 0x64a7e3
nop
jl 0x64a7ab
fsubr qword [esi - 0x65]
cld
pop edx
push ecx
mul dword [ebx + 0x43]
push ecx
mov dl, bh
cli
bound eax, qword [ebx]
ja 0x64a7b9
inc ebp
sbb dword gs:[eax + 0x3c], 0x6f
xor al, 0x22
pushal
pushal
xchg esi, eax
pushfd
mov edi, 0xbd3a5a69
pop esi
dec esp
test dword [edi + edi*2 + 0x7c4054de], ebp
lahf
cmp dword [edx - 0x26], ebx
xchg ebp, eax
or ebp, dword [0x6b09468c]
xor byte [eax + 5], ah
arpl word [esi - 0x515ff68], cx
xchg byte [esi], cl
push sp
or al, bh
enter 0xb9a, 0xffffffffffffff80
mov ebx, edi
neg byte [esi - 0x3ce1b8b8]
fist word [esi]
push edi
invalid
invalid
and ah, byte [ecx + 0x76a4bbea]
xor al, 0x7c
rcl dword [edi - 0x1e], cl
inc edi
and edx, dword [ecx + 0x41]
pop edi
mov ebx, esp
pop ebp
fisubr dword [edx]
mov al, byte [0xd2a28ecc]
inc eax
pop esp
popfd
sbb byte [eax], cl
insd dword es:[edi], dx
pop ecx
and byte [edi - 0xf28f6d5], ch
jl 0x64a7b6
inc ebp
lodsd eax, dword [esi]
lea ebx, [esi]
xchg esp, eax
xor dword [ebx + 0x7633c9f0], 0xfffffff3
xor esi, dword [esi - 0xd]
fcom dword [esi - 0x1e]
stosd dword es:[edi], eax
push eax
cmp esi, ebx
mov eax, 0x5824f4a9
lodsd eax, dword cs:[esi]
pop ebx
mov dh, 0x73
mov byte [0x35b647d1], al
mov cl, 0xc
mov edx, 0x43783bf5
sub dword [esi], 0xc
in al, 0x8a
pushfd
das
push cs
xor al, 5
inc esi
sti
mov byte [0xf5df6bd3], al
mov bl, byte [edi - 0x43]
les ebx, [edx - 0x43c8f304]
cmp byte [ebp - 0x538cb90e], ah
mov ch, 0x12
jns 0x64a894
mov bh, 0xa8
jp 0x64a82d
invalid
xchg ebp, eax
jnp 0x64a854
pop eax
sub byte [ecx - 9], ah
loope 0x64a88d
invalid
mov ecx, 0xbc158124
mov dword [ebp], eax
movzx eax, word [esp]
shr word [esp + eax*8 - 0x4b9bf], cl
and word [esp + eax - 0x9738], cx
lea edi, [edi + eax*4 - 0x25ce4]
movsx edx, byte [esp + eax - 0x9738]
jae 0x64a748
shr cx, 0x4b
mov cl, byte [ecx + ebp - 0x2d120012]
adc ebp, 5
jmp 0x6e7858
jmp 0x725237
push 0x6a239738
shrd eax, edx, cl
jmp 0x662d28

Function at 0x5c7f02
Capabilities:
Set environment variable
Set registry value

Disassembly:
sub ax, ax
mov dword [esp], eax
rol ecx, 3
call fcn.006bf6b4

Function at 0x5d5900
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
shl ecx, cl
jns 0x5d591d
mov ecx, dword [esp + 4]
add dword [esp + 0x14], 0xff916793
push dword [esp + 8]
popfd
lea esp, [esp + 0x18]
call fcn.005d900a
mov eax, 0x1119b2
not ax
mov eax, dword [ebp + eax*2 - 0x23cc9a]
mov ecx, 0xc9accc18
call fcn.0066adc2
Function at 0x5d593b
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi]
mov ecx, 0x3aaa6904
movsx edx, cx
lea esi, [ecx + esi - 0x3aaa6900]
sub dl, cl
rol dl, 0x26
xor eax, ebx
dec cl
xor eax, 0xec85b188
push ecx
sub ecx, 0x4b06d410
adc byte [esp + edx*2 - 0xd1fd], dl
neg eax
bt cx, dx
bswap eax
call fcn.0063b9cd
push eax
inc byte [esp + edx*2 - 0x68a6a4a5]
xor ecx, ebx
neg ecx
not ecx
inc ecx
neg ecx
sar eax, 0xc7
imul dx
xor ebx, ecx
sub dword [esp + eax*8 - 0x3fe6928], eax
adc ebp, ecx
lea ecx, [edx + eax*4 - 0x3bd7cb65]
sub edx, edx
neg dword [esp + eax*2 - 0xff9a4a]
xor dl, byte [eax + esi - 0x7fcd25]
cwde
add esi, 1
sub ecx, 0xb89f93ab
xor dl, bl
jmp 0x5cfb48
not dl
inc dl
push ecx
ror dl, 1
not dl
sal eax, cl
jp 0x61ee8f
call fcn.00402e30
mov esi, dword [ebp - 0x40]
jmp 0x64b2ac
not dl
call fcn.00676a6e
jmp 0x5cd92a
btr cx, cx
xor bl, dl
xchg ecx, eax
lea eax, [ecx*2 - 0x7e577f6]
xadd ax, cx
sbb edi, 1
mov word [edi], dx
push eax
pop ecx
pop edx
pop ecx
jmp fcn.005b2808
jmp 0x5cf561

Function at 0x5d6c32
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor dx, 0x2020
bswap ecx
xor dword [esp + edx - 0x37ffdfdc], eax
pop edx
xor ecx, 0x393c5b88
mul al
ror dl, 0x61
jo 0x759f1d
neg eax
xor eax, 0xd515809a
shl edx, 0x17
and dx, 0xd14
movzx ecx, dl
ror eax, 1
xor ebx, eax
imul dx, dx
adc ebp, eax
dec edx
fld qword [edi + ecx]
add ecx, ebp
jmp ecx
movzx edx, al
neg ecx
shl dl, 0x41
neg edx
jp 0x438db5
sbb ecx, 0x91167381
pop eax
movsx eax, dx
bswap ecx
not ecx
ror edx, 0xc5
jae 0x43586d
mov edx, 0xe2254409
sub esi, 4
movzx eax, dl
sub eax, eax
je 0x657527
xor ebx, ecx
lea eax, [edx + edx + 0x6420c52f]
mul ax
sar edx, 0xfd
add edi, ecx
jmp 0x425cb1
rol ecx, 2
bswap ecx
not ax
jmp 0x6e8a73

Function at 0x5dc3cb
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
shl byte [esp + 8], 0x78
or byte [esp + 8], 0x85
mov dword [esp + 8], 0x1bd41fc2
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.0070934f

Function at 0x5f1f5b
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xadd ax, dx
xor dx, 0x3a00
mov ecx, dword [ebp + ecx*2 - 0x751bbc42]
mov dword [esp + eax - 0x79e39961], 0x291dc88c
imul dl
xor ecx, ebx
jmp 0x75ae63
cbw
lea ecx, [eax + ecx + 0x40568950]
ror ecx, 3
idiv eax
shr word [esp + 2], 4
bswap ecx
ror dl, 1
lea eax, [eax*2 - 0x4b71657a]
push eax
xor ecx, 0x9ba802af
rol ax, 0xd
dec ecx
xor ebx, ecx
call fcn.00656c3a
Function at 0x5f8e6f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [edx + ebp - 0x650f39e], ecx
pop edx
jns fcn.006d770b
mov ecx, dword [ebp]
mov eax, 0x5ba6ef3d
lea ebp, [ebp + eax - 0x5ba6ef39]
jmp 0x6f8bd6
dec ecx
jge 0x5ae04f
xor ebx, eax
sub dl, dl
adc esi, eax
not dl
pop edx
pop edx
pop eax
jmp loc.0042bd51
add edi, ecx
xor word [esp + edx*4 + 1], ax
pop ecx
and al, ch
or edx, edi
jmp edx
xor ecx, ebx
cdq
mul dx
ror ecx, 3
shl dl, 1
cwde
not ecx
cwde
ror ecx, 3
xor eax, eax
jae 0x7349cd
lea ecx, [eax + ecx + 0x8bc6321]
imul dx, dx
sbb ax, word [esp + edx - 0x6410]
setl al
bswap ecx
sbb ecx, 0xda232197
cdq
xor ebx, ecx
jmp 0x6a0655

Function at 0x5fd1db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jnp 0x624574
adc edi, 3
shld ax, dx, cl
mov ecx, 0xbf87509e
mov word [edi], ax
pop edx
mov edx, dword [ebp]
bswap ecx
add ebp, 4
call fcn.006508c4
setae al
jmp ebp
and edx, ecx
sar dx, 0xc4
not al
shr dx, 3
neg al
not al
dec dx
neg al
rol ecx, 0x5e
add ecx, ecx
btc edx, 8
adc al, dl
btc ecx, ecx
xor bl, al
and edx, edx
lea ecx, [ecx + edx*4 - 0x4265c6c9]
ja 0x68b215
mov ecx, 0xd4b092ba
inc ecx
mov ecx, dword [ebp]
mov eax, 0x9aab0101
add ebp, 4
mov edx, 0xa5abc89a
xor ecx, ebx
bts eax, edx
lea eax, [edx*4 - 0x4770a9cd]
not ecx
jae 0x643a1d
adc eax, esp
xadd dx, cx
xor ecx, 0xd193fb8d
mov cx, word [edx + eax - 0x1f3a]
movsx eax, dx
setp al
cbw
lea ebp, [ebp + edx*2 - 0x3e76]
not dx
adc eax, eax
mov word [ebp + edx*2 - 0x1c18a], cx
jae fcn.006d770b

Function at 0x601820
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + ecx - 0x2aa97c1e]
call fcn.006499d8
mov edx, 0xe388002
mov edx, dword [edx + edi - 0xe388002]
add edi, 4
mov ecx, 0xfe278616
movzx ecx, byte [esi]
add esi, 1
mov eax, 0x9231992b
bswap eax
xor cl, bl
shr eax, 0xe7
imul eax, eax
push eax
sbb cl, 0xa3
ror eax, 1
xor word [esp + 2], 0xb881
xor cl, 0x39
push eax
ror ax, 0xab
not cl
adc cl, 0x87
neg eax
xor bl, cl
lea ecx, [esp + ecx + 8]
sar dword [esp + eax - 0x5b65db6f], 0x8c
mov dword [ecx + eax - 0x5b65db73], edx
mul dword [esp + eax - 0x5b65db70]
movzx ecx, byte [esp + edx - 0x5b143ac0]
inc edx
mov edx, dword [esi + ecx - 0x5d]
shl ax, 0x8f
jbe 0x62a9d3
lea esi, [esi + eax - 0x4019fffc]
call fcn.0075a7cf

Function at 0x6018f9
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [edx + eax*2 - 0x588215fe]
lea edx, [ecx + 0x1318913e]
or edx, 0x661c0f2d
mov dword [esp + 4], edx
sbb ebp, 4
rol dx, 0x47
mov dword [ebp], eax
pop ecx
pop eax
jb fcn.006d770b
mov dword [esp + eax - 0x588717c4], edi
ret 0x14
Function at 0x60a10d
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xor ebx, ecx
add esi, ecx
jmp esi
mov word ss:[ecx + eax*2 - 0x5686319c], dx
or al, 0x12
movsx edx, al
setnp dl
lea ebp, [ebp + eax*2 - 0x568631c0]
mov ecx, dword [ebp + eax*2 - 0x568631bc]
ja 0x6735df
call fcn.00690693
mov eax, 0xd4bce731
jmp 0x64dacb
mov edx, eax
mov ecx, dword [edi]
mov dx, word [edi + 4]
not eax
lea edi, [edi + eax*2 - 0x56863196]
jmp 0x5f0f19
not edx
xor ecx, ebx
dec ecx
shl al, 0xc1
inc edx
bswap ecx
ror dl, 0x64
rol ecx, 2
cbw
cbw
bswap ecx
neg ax
jbe 0x40dc78

Function at 0x60db7d
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi + 0x12848]
mov edx, dword [esi + 0x12840]
sub ch, 2
sbb ecx, esi
mov ecx, dword [eax + edx]
test ebp, esi
test edx, 0x12be2e12
add eax, 4
test sp, 0xc2ae
clc
mov dword [esi + 0xc], ecx
cmp di, ax
clc
stc
mov dword [esi + 0x1283c], ecx
stc
clc
mov dword [esi + 0x12848], eax
cmp dword [esi + 0xc], 0
je 0x65a515
call fcn.00656198
mov edx, esi
jmp 0x67b162
push ebp
mov ebp, esp
cmc
test sp, dx
clc
and esp, 0xfffffff8
test edi, esi
clc
sub esp, 0x2c
stc
clc
push ebx
push esi
shrd si, cx, 0x3d
mov esi, eax
cmp cl, ah
cmp esp, 0xf9036ab2
cmp byte [esi + 0x12828], 0
push edi
jne 0x5d36f4
mov ecx, dword [esi + 4]
bswap eax
lahf
movzx eax, si
push ecx
movsx ax, cl
cwde
push 1
cmove ax, bx
setae al
lea eax, [esi + 0xc]
jmp 0x75b031
call fcn.006a7069
push 0xfc4
mov ah, 0xbc
mov eax, edx
lea eax, [esi + 0x18]
push 0x20
jmp 0x6d054d
push eax
jmp fcn.0063a287
push eax
jmp fcn.00434595
push 4
jmp 0x751e3d

Function at 0x611217
Capabilities:
Set environment variable
Set registry value

Disassembly:
push str.DNGTrialTimesLeft
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
jmp 0x602389
ror word [esp + edx*2 + 8], 0x49
adc esi, ecx
mov dword [esp + edx + 4], edx
not dx
add al, byte [edx + ebp - 0xffff]
movzx ecx, word [esp + edx - 0xfff7]
mov dword [esp + edx*8 - 0x7fff8], 0x5a213a89
lea ebp, [ebp + edx*2 - 0x1fffd]
add edx, edx
call fcn.0073ae58
push edi
jmp 0x6cf36b
push 0x45f34c
jmp 0x662063
jmp loc.00439195
not ecx
sar ax, 0x8c
cbw
cbw
bswap ecx
dec ecx
cdq
xor ebx, ecx
shl eax, 0x95
jp 0x5c7f10
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
jmp 0x5b8049
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xb8]
sub edx, esi
movzx eax, bp
mov al, 0x1d
lahf
push edx
lea eax, [esp + 0x28]
jmp 0x5e8443
Function at 0x615dcc
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
pop edx
jbe fcn.005b2808
pop ecx
jmp edi
mov ecx, dword [ecx + esi - 0x5a3b1f65]
lea esi, [esi + eax*2 - 0x3ec8]
xor ecx, ebx
rol ecx, 1
not ecx
neg ecx
dec ecx
mov edx, eax
not ecx
push eax
mov dword [esp + eax - 0x1f62], 0x45a0523a
and ax, 0xe4a6
dec ecx
pop eax
xor ebx, ecx
imul dl
btc edx, eax
adc ebp, ecx
shl word [esp + eax*4 - 0xa28e], 0x29
jb 0x428912
not eax
add cx, word [esp + ecx - 0x7456c6d1]
bswap eax
ror eax, 1
xor ebx, eax
xadd edx, ecx
xor cl, byte [esp + edx - 0x74563ebf]
adc esi, eax
xor byte [esp + edx - 0x74563ec5], dh
sar edx, cl
pop ecx
pop ecx
pop edx
pop eax
pop ecx
ja fcn.006051f4

Function at 0x619062
Capabilities:
Set environment variable
Set registry value

Disassembly:
add edi, 4
shrd ax, dx, cl
mov word [edi], ax
mov ecx, 0x503d553d
mov dword [esp + ecx - 0x503d553d], ecx
movsx eax, cx
mov eax, dword [ebp + ecx - 0x503d553d]
pop ecx
mov dword [esp + ecx - 0x503d553d], ecx
btr ecx, 0xae
lea ebp, [ebp + ecx - 0x503d1539]
xor eax, ebx
call fcn.0063dc40

Function at 0x6194b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dx, word [ebp + ecx - 0x6fe685c4]
neg dword [esp + ecx - 0x6fe685ba]
xor cx, 0x9cba
mov ax, word [ebp + eax + 1]
xor cl, cl
mov dword [esp + ecx - 0x6fe618fc], ecx
call fcn.005f0687

Function at 0x61c323
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
adc al, dl
mov dword [esp + edx*4 - 0x2b5d9c00], ecx
pop ecx
imul ecx, dword [esp + edx - 0xad766fc]
neg al
sub al, 5
xor bl, al
sar edx, 0xac
lea eax, [esp + eax + 8]
neg edx
movzx cx, byte [eax]
sbb esi, 1
mov eax, 0x7413f600
mov word [esi + eax - 0x7413f600], cx
mov ecx, dword [ebp + eax - 0x7413f600]
xchg byte [esp + eax - 0x7413f5fa], al
shl al, 0x81
lea ebp, [ebp + eax - 0x7413f66c]
xor ecx, ebx
ror ecx, 2
btr eax, 0x37
lea ecx, [eax + ecx - 0x2f745f39]
mul dl
mov dword [esp + eax - 0x74133c60], 0xb113f93f
call fcn.006215ac

Function at 0x621f4a
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
not cx
sar al, 0xe4
inc eax
or dx, cx
bt eax, 0xab
shl al, 0xc3
lea ecx, [eax*2 - 0x487ae164]
mov word [ebp], dx
sbb edi, 4
neg ecx
mov ecx, dword [edi + ecx - 0x55ec18e4]
xor ecx, ebx
mov dword [esp], 0x93a9f910
lea edx, [eax + eax*4 + 0x30bbd407]
call fcn.0070b897

Function at 0x622eae
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + ecx - 0x3d9f0038], edi
xchg word [esp + ecx - 0x3d9f005c], bx
mov dword [esp + ebx - 0x7da9ffff], ecx
pop ecx
mov dword [esp + ecx - 0x3d9f0038], esi
lea esi, [esp + ecx*2 - 0x7b3e00bc]
pop ecx
jmp 0x629e80
lea ecx, [ebx + esi - 0x7daa00bf]
jmp 0x6bf745
jmp 0x6ff189