joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c982
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x43c9bf
cmp dword [ebp + 0x14], edi
je 0x43c9bf
cmp ecx, edi
jne 0x43c9c6
call fcn.0043e070
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0043b127
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x43c9da
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x43c9fb
cmp ebx, 0xffffffff
je 0x43c9ea
push ebx
push edi
push ecx
call fcn.0043dba0
add esp, 0xc
cmp esi, edi
je 0x43c9a7
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x43c9a7
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x43ca17
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x43ca1e
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x43cb0f
test word [esi + 0xc], 0x10c
je 0x43ca72
mov eax, dword [esi + 4]
test eax, eax
je 0x43ca72
jl 0x43cb70
cmp ebx, eax
mov edi, ebx
jb 0x43ca43
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x43cb17
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0043a515
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x43cb07
cmp ebx, dword [ebp - 0xc]
jb 0x43cadf
cmp dword [ebp - 0xc], 0
je 0x43ca9c
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x43ca91
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x43ca98
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x43caa7
mov eax, SysReAllocString
cmp ebx, eax
ja 0x43caa7
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x43cb43
push eax
push dword [ebp - 8]
push esi
call fcn.00443fc2
pop ecx
push eax
call fcn.00444ef9
add esp, 0xc
test eax, eax
je 0x43cb82
cmp eax, 0xffffffff
je 0x43cb70
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x43cb07
push esi
call fcn.00443fef
cmp eax, 0xffffffff
pop ecx
je 0x43cb74
cmp dword [ebp - 4], 0
je 0x43cb43
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x43ca26
mov eax, dword [ebp + 0x14]
jmp 0x43c9c1
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43cb2e
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0043dba0
add esp, 0xc
call fcn.0043e070
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x43c9b7
cmp dword [ebp + 0xc], 0xffffffff
je 0x43cb59
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0043dba0
add esp, 0xc
call fcn.0043e070
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x43c9b7
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x43c9c1
or dword [esi + 0xc], 0x10
jmp 0x43cb74
Function at 0x43ef43
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x46b338]
je 0x43ef5e
inc edi
cmp edi, 0x17
jb 0x43ef4f
cmp edi, 0x17
jae 0x43f0de
push ebp
push 3
call fcn.0044759e
cmp eax, 1
pop ecx
je 0x43f0aa
push 3
call fcn.0044759e
test eax, eax
pop ecx
jne 0x43ef92
cmp dword [0x46b060], 1
je 0x43f0aa
cmp ebx, 0xfc
je 0x43f0dd
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x5a0078
push ebp
call fcn.0043ad06
add esp, 0xc
test eax, eax
je 0x43efc8
push esi
push esi
push esi
push esi
push esi
call fcn.0043b02b
add esp, 0x14
push 0x104
mov esi, 0x5a0091
push esi
push 0
mov byte [0x5a0195], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43f00c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0043ad06
add esp, 0xc
test eax, eax
je 0x43f00c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0043b02b
add esp, 0x14
push esi
call fcn.0043d490
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x43f051
push esi
call fcn.0043d490
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x5a038c
push 0x452bdc
sub ecx, eax
push ecx
push eax
call fcn.004474eb
add esp, 0x14
test eax, eax
je 0x43f051
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0043b02b
add esp, 0x14
jmp 0x43f053
xor esi, esi
push 0x452bd8
push ebx
push ebp
call fcn.0043d18b
add esp, 0xc
test eax, eax
je 0x43f073
push esi
push esi
push esi
push esi
push esi
call fcn.0043b02b
add esp, 0x14
push dword [edi*8 + 0x46b33c]
push ebx
push ebp
call fcn.0043d18b
add esp, 0xc
test eax, eax
je 0x43f095
push esi
push esi
push esi
push esi
push esi
call fcn.0043b02b
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0044732e
add esp, 0xc
jmp 0x43f0dd
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x43f0dd
cmp ebp, 0xffffffff
je 0x43f0dd
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x46b33c]
push dword [esi]
call fcn.0043d490
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44732e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043f222
xor ebx, ebx
cmp dword [0x5a0a58], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x447404
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4474e4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4536d4
push edi
call esi
cmp eax, ebx
je 0x4474e4
push eax
call fcn.0043f1b4
mov dword [esp], 0x4536c4
push edi
mov dword [0x5a0a58], eax
call esi
push eax
call fcn.0043f1b4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5a0a5c], eax
call esi
push eax
call fcn.0043f1b4
mov dword [0x5a0a60], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043be67
test eax, eax
pop ecx
pop ecx
je 0x4473d2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043b02b
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x447404
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043f1b4
cmp eax, ebx
pop ecx
mov dword [0x5a0a68], eax
je 0x447404
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043f1b4
pop ecx
mov dword [0x5a0a64], eax
mov eax, dword [0x5a0a64]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x447489
cmp dword [0x5a0a68], ecx
je 0x447489
push eax
call fcn.0043f22b
push dword [0x5a0a68]
mov esi, eax
call fcn.0043f22b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x447489
cmp edi, ebx
je 0x447489
call esi
cmp eax, ebx
je 0x447456
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x447456
test byte [ebp - 0x18], 1
jne 0x447489
lea eax, [ebp - 0x10]
push eax
call fcn.0043be9e
test eax, eax
pop ecx
je 0x447471
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043b02b
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x447480
or dword [ebp + 0x10], 0x200000
jmp 0x4474c4
or dword [ebp + 0x10], 0x40000
jmp 0x4474c4
mov eax, dword [0x5a0a5c]
cmp eax, dword [ebp - 8]
je 0x4474c4
push eax
call fcn.0043f22b
cmp eax, ebx
pop ecx
je 0x4474c4
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4474c4
mov eax, dword [0x5a0a60]
cmp eax, dword [ebp - 8]
je 0x4474c4
push eax
call fcn.0043f22b
cmp eax, ebx
pop ecx
je 0x4474c4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5a0a58]
call fcn.0043f22b
cmp eax, ebx
pop ecx
je 0x4474e4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4474e6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5ab611
Capabilities:
Authenticate hmac
Get file version info

Disassembly:
lea esi, [esi + edx*8 - 0x19994]
lea edx, [ecx + ecx*4 - 0x1c6f1878]
shl edx, cl
call fcn.0061c1c8
mov ecx, 0x89106a0
lea ebp, [ebp + ecx - 0x89106a4]
xor cx, 0xc1a8
mov eax, dword [ebp + ecx*2 - 0x11238e10]
call fcn.006733f4
Function at 0x5ac57c
Capabilities:
Encode data using xor

Disassembly:
not al
call fcn.0066536d
mov edx, 0xbcac76a7
fild dword [edi]
not edx
mov eax, edx
shr eax, 0x82
mov eax, dword [esi + edx - 0x43538958]
sete dl
lea esi, [esi + edx - 0x435388fc]
movsx ecx, dl
sbb ecx, edx
xor eax, ebx
xadd edx, ecx
ror ecx, 0xf8
inc edx
lea eax, [edx + eax + 0x6d0e4999]
bts dx, dx
xor eax, 0xbb16080d
inc cl
inc eax
ror eax, 1
inc ecx
dec ecx
push ecx
dec eax
dec edx
push ecx
xor eax, 0x309eff3d
xor ebx, eax
add ebp, eax
call fcn.005caa48
call fcn.0069e7c4
mov edx, dword [ebp]
add ebp, 4
mov ecx, 0x5b839c8a
neg ecx
xor edx, ebx
neg cl
shl ecx, 0xf
call fcn.00633cdf
push edx
pop edi
mov ch, 0x9e
das
pop ebp
dec sp
dec esp
mov byte [esi + 0x6b], ch
xchg esi, eax
push ebx
loop 0x5ac664
mov cl, 0x95
xor eax, ecx
or ebx, dword [esi - 0x98b126d]
enter 0x4209, 0xffffffffffffffa3
cdq
mov edi, 0xce71dd0f
cmp al, 5
aad 0xb1
pushal
xchg ebp, eax
iretd
mov dword [0x38f02c11], eax
test eax, 0xecb86584
pop eax
lcall 0x9b54, 0x47597c40
sub dword [ecx - 1], ecx
in eax, 0xf4
jmp dword [edx]
jecxz 0x5ac637
cli
mov byte [0xd7c312e3], al
xor dword [ecx + 0x4704273d], eax
mov edx, 0xabf2c900
sbb eax, edi
in eax, dx
unpcklps xmm0, xmmword [edi]
jecxz 0x5ac67c
ret
pop es
outsd dx, dword [esi]
push ebx
in eax, 0xf8
popal
xor eax, 0x346849d2
outsb dx, byte [esi]
loope 0x5ac668
dec ecx
xchg edi, eax
dec esi
fimul word [ecx + 0x44]
jle 0x5ac6bb
add eax, dword [edi - 0x49c9239f]
or dword [edi + 0x73780c8e], ebp
or dword [edx + eax*8 + 0x49], esp
invalid
sub ebp, dword [ebx]
cmp bl, bl
bound ecx, qword [edi - 3]
rcr dword [esi + 0x49], 0x7f
invalid
mov eax, dword [0xb6377ac8]
push esp
outsb dx, byte [esi]
rol al, 2
mov ch, 0xd9
sub byte [ecx - 0x4a1ff295], dh
movsd dword es:[edi], dword [esi]
cwde
jp 0x5ac6ad
or byte [esi + 0x40], al
sub dword [ecx + 0xe740fec], edi
cmp dword [esi], 0xb
cmovbe esi, dword [edx - 0x26]
stosb byte es:[edi], al
xchg ebx, edx
adc al, 0xd9
test dword [esi], edi
mov edx, 0x2caf598f
int3

Function at 0x5bb980
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg cl
mov dword [esp], 0xa7918fa1
xor cl, 0x94
rol cl, 1
mov edx, dword [esp + 1]
neg cl
xor bl, cl
lea ecx, [esp + ecx + 8]
shr edx, 0x24
jp 0x649758
not edx
mov word [ecx], ax
pop ecx
pop eax
jmp esi

Function at 0x5c17d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
not eax
inc eax
shr edx, cl
je 0x60f78d
neg eax
shr ecx, 0xd0
xor ebx, eax
mov dword [esp + edx*2 - 2], edx
sar dword [esp + edx*2 - 2], cl
call fcn.0041f21c

Function at 0x5c7bc4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + edx - 0x65afebf0], edx
inc eax
not eax
lea eax, [eax + edx - 0x590c2c53]
xor ebx, eax
sub dword [esp + ecx - 0x65afeb0c], ecx
rol dword [esp + edx - 0x65afebec], 0x5e
sar word [esp + edx - 0x65afebef], 0x2b
add esi, eax
sub cx, dx
call fcn.0069af93

Function at 0x5d4da1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor ebx, edx
not byte [esp + eax - 0x91]
shl byte [esp + eax*2 - 0x12e], 0xa1
add edi, edx
pop eax
pop edx
pop eax
pop edx
jmp fcn.00750bd0
Function at 0x5e71df
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], ebx
call fcn.006879b3
mov eax, dword [esi]
add esi, 4
call fcn.006a2332

Function at 0x5e9584
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ax
and cx, dx
mov dword [esp + edx - 0x7bfff108], ecx
xor bx, ax
lea ebp, [edx + ebp - 0x7bfff112]
sal ecx, cl
mov word [ebp + edx - 0x7bfff110], ax
call fcn.00772251
mov edx, 0xef0e301d
sub dx, dx
mov ecx, dword [edi]
sal edx, 0x46
mov eax, dword [edi + 4]
inc dl
jg 0x764aa9
adc edi, 3
sal edx, 0x6d
jns 0x784325
cmp byte [edx - 0x62], cl
mov al, 0x29
push ecx
pop ss
or byte [edx], bh
sub cl, dl
dec ecx
std
mov dl, bl
sub ebx, dword [edi - 0x3c]
mov al, byte [0xf190f04d]
enter 0xffffffffffffa7d7, 0xffffffffffffffa9
ret
adc ecx, eax
call fcn.0068fa48
mov eax, 0x41a7caa2
imul eax
mul eax
mov ecx, dword [edi + edx - 0x11ee17ae]
jb 0x70b612
xchg ebp, eax
imul al
push ss
loope 0x7842c9
invalid

Function at 0x5f042a
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
xor ecx, ebx
mov dword [esp + eax*8 - 0x7c8d6198], edx
xor ecx, 0x660b28a2
lea ecx, [ecx + eax - 0x41b321ed]
ror ecx, 3
call fcn.005bb249

Function at 0x5f0ba2
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x5c14], 0xdd99a615
mov dword [esp + ecx - 0x5c10], ecx
mov dword [edi + ecx*2 - 0xb828], edx
xor dword [esp + eax*2 - 0xaf], ecx
cwde
pop eax
pop edx
jge fcn.007443b7
call fcn.00762965
Function at 0x5f7ad2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sar edx, 0x31
bswap eax
bts ecx, edx
rol eax, 1
inc dword [esp + ecx - 0x40ff]
or ecx, 0xd3903035
not eax
mov dword [esp], edx
btc dx, cx
bswap eax
xor ebx, eax
dec cl
mov dword [esp + 3], edx
add ebp, eax
call fcn.00706dd5

Function at 0x5fbb12
Capabilities:
Encode data using xor

Disassembly:
not eax
call fcn.00604dfe
pop esp
movsd dword es:[edi], dword [esi]
js 0x5fbb33
movsd dword es:[edi], dword [esi]
and dword [ecx - 0x2d898596], edx
and al, 0x8a
imul ebx, dword [eax], 0x367839a2
add ecx, esp
cli
xchg word [ecx + 0x62], bp
add ebx, 0xffffff8f
mov dword [edx + 0x69a71eff], edx
or ecx, dword [edx - 0x3e3677e8]
cmp byte [ecx], dl
mov al, 0x76
scasb al, byte es:[edi]
pop es
mov byte [0x6a8f8fdf], al
mov cs, word [ebx*4 - 0x79cf23e3]
loopne 0x5fbb7d
daa
xor al, 0x5d
nop
sahf
daa
in al, 0x22
cmc
fcomp dword [esi - 0x27b38df9]
stosb byte es:[edi], al
daa
inc ebx
push esp
adc eax, 0xd57588d8
push cs
daa
cmp byte [edx - 0xf], bl
nop
daa
ror dword [edx - 0x558227f8], 1
push ds
jnp 0x5fbb55
rcl edi, 1
xor eax, 0xd49c0056
and al, 0x1a
leave
push ebp
scasd eax, dword es:[edi]
cmp eax, 0xd53a711a
in eax, 0x6c
pop esp
fistp word [ecx + eax*8 - 0x1b]
salc
push ecx
sbb esi, dword [edi]
sbb ah, al
pop es
cmp eax, 0x66fb3c1a
leave
in eax, 0x31
dec esp
inc esi
outsb dx, byte [esi]
iretd

Function at 0x6042f1
Capabilities:
Execute anti-debugging instructions
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
lea esi, [esi + eax - 0x1595]
shr dl, cl
sar al, 0xa5
lea ecx, [eax + eax*4 - 0x40559cda]
mov dword [esp + eax - 0x15fc], eax
mov word [esi + eax*8 - 0xafe0], dx
mov ecx, dword [eax + ebp - 0x15fc]
bt eax, 0x29
lea ebp, [ebp + eax*2 - 0x2bf4]
xor byte [esp + eax*4 - 0x57ef], 0xa3
xor ecx, ebx
shl dword [esp + eax - 0x15fc], 0x88
neg eax
jne 0x6c1d50
sbb ecx, 0xe0ae2227
sar dword [esp], 0x1d
jbe 0x6ffd51
call fcn.00684b07
xor ebx, ecx
add edi, ecx
movzx ecx, ax
shl edx, 0xc1
mov dword [esp + edx - 2], edi
ret 4
push eax
ror ecx, 1
movsx edx, al
not ecx
mul word [esp + edx]
shr edx, 0x73
neg ecx
bswap ecx
inc edx
jnp 0x6cec6b
Function at 0x606543
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dx
not al
xor bl, al
pop edx
add eax, esp
bt edx, 0x20
jae 0x7750d5
sub dword [esp + edx*2 - 0x44e3434c], edx
adc al, 0x8b
jmp 0x5eae35
wait
mov eax, 0x9866fffc
cbw
cbw
inc edx
or eax, eax
rol edx, 1
mov dword [esp + ecx*4 - 0x22a01e78], 0x1d010c3b
bswap edx
ror cl, 0xc6
rol edx, 3
not edx
inc edx
call fcn.00422388
mov cx, word [edi]
mov eax, 0x9100c0b5
push eax
add edi, 2
sub esi, 1
movzx eax, byte [esi]
mov edx, 0x8d0f3113
rol edx, 0x95
xor al, bl
btc edx, edx
xor al, 3
sal byte [esp + edx - 0x2271a1a4], 0xe3
fucom st(3)
je 0x627af2
xor ebx, dword [0x11995619]
loopne 0x60653f
push esi
cdq
adc eax, esp
popfd
in al, 0x69
xor al, 0xad
cmp ah, ch
mov dword [eax + 0x69c4e5c5], esi
lodsb al, byte gs:[esi]
jecxz 0x60659d
leave
jmp 0x6065fa
js 0x606592
jmp 0xbde07318
rol al, 1
ror dword [esp + edx*2 - 0x44e3434c], 0xc3
jb 0x5fb504
neg edx
mov word [eax + edx - 0x70518990], cx
movzx ecx, dx
btc ecx, ecx
movzx eax, cl
lea esi, [esi + edx - 0x70518994]
mov eax, dword [edx + esi - 0x70518990]
add dx, cx
xor eax, ebx
or ecx, edx
sal dx, 0x2a
bts ecx, 0xbd
ror eax, 1
call fcn.007850d4

Function at 0x608fb5
Capabilities:
Create thread

Disassembly:
push ecx
jmp 0x5d38e7
push 0
jmp 0x640b70
push ebx
pushfd
mov edi, 0x993a420d
call fcn.0068f089
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp + 8]
jmp 0x5b0cd5
push 0x41af60
mov dword [esp + 0x14], eax
jmp 0x788e29
mov dword [esp + 0x1c], esi
jmp 0x79d8c5
mov dword [esp + 0x18], 0x41aec0
jmp 0x741fd9
call fcn.0043a911
mov edx, dword [esp + 0x14]
test al, al
add esp, 0xc
jmp 0x41cb2a

Function at 0x60d5fd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg ecx
xchg edx, eax
ror ecx, 1
call fcn.00685ea5
btc dx, 0x20
ror dx, 0xe1
bswap eax
sar dx, cl
ror eax, 1
neg dl
xor ebx, eax
call fcn.006fc576

Function at 0x61f151
Capabilities:
Encode data using xor

Disassembly:
not eax
xor eax, 0xd70c2bb8
movzx edx, cx
mov eax, 0xfd70c2b
mov bh, 0xd1
sar cl, 0x82
mov dword [esp + ecx - 0x52626614], 0xf5b0779a
xor ebx, eax
neg cx
push ecx
add esi, eax
movzx eax, dx
add word [esp + eax*2 - 0xcca1], cx
cbw
mov dx, word [ebp + edx*2 - 0xcca2]
sal byte [esp + eax*2 - 0xa2], 0xe6
shr eax, cl
mov cl, byte [eax + ebp + 2]
call fcn.006e8204
pop esp
aad 0xb4
popal
cli
cmc
xor ch, 0xec
sbb byte [eax], bl
cmp byte [esi + 0x7f19adb6], cl
cmpsb byte [esi], byte es:[edi]
test dword [edi - 0x6b], esp
push es
ja 0x61f154
and cl, dl
invalid

Function at 0x621fdf
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0xacaba788
not ecx
mov byte [esp + 2], al
and edx, 0xe8b0971e
call fcn.005fb3c3

Function at 0x623f93
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol al, 1
not al
inc cx
inc al
xor al, 0x3b
mov dword [esp + ecx - 0x7db30ab8], ecx
xor bl, al
lea edi, [ecx + edi - 0x7db30abe]
push ecx
pop edx
mov word [ecx + edi - 0x7db30abc], ax
dec cx
mov dword [esp + edx - 0x7db30abc], 0x278c39b5
call fcn.0068a0ec
Function at 0x62689d
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Read file on windows

Disassembly:
mov dword [esp + eax - 0xee03], esi
ret
xchg cx, ax
mov cx, word [edi + eax*4 - 0x3b802]
jb 0x6c848b
mov dword [esp + edx*2 - 0x410d200], 0x951ecc02
xor bl, al
lea eax, [esp + eax + 4]
mov cx, word [eax + ecx - 0x51ae3ec8]
call fcn.0061ec42
lea esi, [esi + edx - 0x73bdc42a]
movzx ecx, byte [esi + edx - 0x73bdc429]
bt edx, edx
xor cl, bl
lea edx, [edx + edx - 0xdf9b87e]
xor cl, 0x88
sar dl, 0x81
ror cl, 1
inc cl
shl dl, 0x45
rol cl, 1
neg dl
bts dx, dx
xor bl, cl
jmp 0x71c06c
lea eax, [edx + eax + 0x2a8664ff]
sbb edx, edx
and cx, dx
neg eax
lea eax, [eax + ecx*2 - 0x2f731ce2]
sal cl, 0xa5
xor eax, 0xb5ae2f2c
xor edx, ecx
adc cx, cx
jbe 0x76c262
movzx eax, dl
add esi, ecx
inc dword [esp + eax - 0x28]
sar byte [esp + eax - 0x28], 0x22
mov dx, word [eax + edi - 0x28]
mov ecx, dword [esp + eax*4 - 0xa0]
jnp 0x5f495d
push edi
call fcn.00608fb5
lea edi, [edi + eax*2 - 0x1dc00]
add dx, cx
btc eax, eax
mov word [edi + eax*8 - 0x77018], dx
jae 0x5edaba
add ecx, esp
mov byte [ecx], al
mov ecx, 0x860a1524
sub esi, 4
and ecx, edx
mov eax, dword [esi]
lea edx, [edx + edx*4 + 0xa833734]
ror dx, 0x4b
xor eax, ebx
bt ecx, ecx
rol eax, 1
sar cx, 0xab
or dl, dl
jae 0x6a1534

Function at 0x62aef1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, byte [edx + ebp - 0x3f52e0ed]
xor al, bl
mov dword [esp + edx - 0x3f52e0ed], edx
xor al, 0xab
sar dl, 0x81
not al
inc edx
ror al, 1
call fcn.006c0211

Function at 0x62de32
Capabilities:
Check os version
Execute anti-debugging instructions
Get number of processors

Disassembly:
btc cx, 0x8b
mov dword [ecx + edi - 0xff9d], eax
neg edx
mov dword [esp + ecx*4 - 0x3fe74], edx
mov eax, dword [ecx + ebp - 0xff9d]
xchg dword [esp + ecx - 0xff99], edx
ror dx, 0xc7
lea ebp, [ebp + ecx*2 - 0x1ff36]
xor eax, ebx
ror edx, 0x99
shl edx, 0xc3
ror eax, 3
lea eax, [ecx + eax + 0x7f9b0b7b]
not eax
pop ecx
call fcn.004113a1

Function at 0x635506
Capabilities:
Set environment variable

Disassembly:
jne 0x5ede85
xor ebp, ebp
cmc
test byte [esi + 0xc], 4
jmp 0x79ff2e
not edi
mov edi, dword [esp + 0xc]
jb 0x762902
jg 0x635512
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x1c]
call fcn.00634874
mov eax, 0x71961af
call fcn.0073a06e
call fcn.00438af0
lea esp, [esp + 4]
test ecx, eax
test al, al
jmp 0x5ede7c
Function at 0x63e7b4
Capabilities:
Set environment variable
Set registry value

Disassembly:
neg ecx
not ecx
call fcn.0065b832
add edi, eax
movzx eax, dx
lea edx, [eax + eax*2 - 0x787256d0]
mov eax, dword [ebp + eax - 0x9808]
movzx cx, byte ss:[eax]
add ebp, 2
mov word [ebp], cx
dec edx
mov eax, edx
movzx ecx, ax
mov dword [esp + ecx - 0x7147], edi
ret 0xc
add dl, al
mov dword [esp], 0x8c0deab4
rol ecx, 0xf
mov word [ecx + edi - 0x7d0ce651], dx
mov ecx, dword [ebp + ecx - 0x7d0ce651]
jae 0x60800e
jae 0x5c57da
adc ebp, 3
mov edx, 0x8c097527
xor ecx, ebx
sar edx, 0x7f
xadd dword [esp], edx
neg ecx
movzx eax, dx
inc ecx
cdq
idiv word [esp + edx*8 + 2]
xor ecx, 0x71b906a2
sal word [esp + edx - 0x2ce], 0x4f
sbb edx, 0x46876505
dec ecx
xadd dx, ax
shr dx, 0xae
xor ebx, ecx
bts dx, dx
bt edx, eax
adc esi, ecx
mov dword [esp + eax - 0x9dc8], esi
ret

Function at 0x650aca
Capabilities:
Set environment variable

Disassembly:
mov cl, byte [edi + 8]
mov dword [esp], 0x58182b0b
adc edi, 6
sar byte [esp], 0xe7
shld edx, eax, cl
mov ecx, 0xdd2b602d
lea eax, [ecx*2 - 0x4558f5fc]
mov dword [eax + edi - 0x74fdca5e], edx
lea ebp, [ebp + eax - 0x74fdca62]
mov eax, dword [ebp + eax - 0x74fdca5e]
xor eax, ebx
lea edx, [ecx*4 + 0xd14b09e]
call fcn.00781ce3
mov ecx, 0x9ebe392f
mov edx, 0x2720390f
imul ecx, ecx
mov ecx, dword [ebp + edx*2 - 0x4e40721e]
lea ebp, [edx + ebp - 0x2720390b]
bt edx, edx
sar dl, 2
bswap edx
xor ecx, ebx
not ecx
lea ecx, [edx + ecx + 0x2b786ee6]
xor ecx, 0x10a97237
dec ecx
not dl
xor edx, edx
xor ebx, ecx
shr dx, 0xaa
movsx eax, dl
and edx, eax
adc esi, ecx
mov ecx, dword [edi + edx*2]
or eax, 0x7893473a
neg dx
add edx, dword [edi + edx*2 + 4]
bts eax, eax
jae 0x72f9bf
lock xadd dword [ecx + eax - 0x7c93473a], edx
pushfd
not eax
push eax
mov ecx, dword [esp + 4]
push eax
sub byte [esp + 3], al
mov dword [edi + 4], edx
mov dword [edi], ecx
push eax
mov dword [esp + 0xc], 0x5bb1c628
pop eax
pop edx
pop eax
pop ecx
jmp esi

Function at 0x651196
Capabilities:
Get file version info

Disassembly:
mov edx, dword [edx + esi - 0x770c0bb6]
mov dword [esp + ecx - 0x770c0bb6], 0xd60065bf
neg byte [esp + eax*2 - 0x6eb8438f]
xor edx, ebx
sub dword [esp + eax*2 - 0x6eb84390], eax
xadd cl, ah
neg edx
dec dword [esp + ecx - 0x770c0bd7]
setg al
xor edx, 0x8b97600c
bts ax, cx
sub word [esp + ecx - 0x770c0bd6], cx
sbb edx, 0x6d82da33
lea eax, [ecx + ecx*8 + 0x42a6ff92]
neg edx
xor edx, 0x158e1023
inc edx
xor ebx, edx
add ebp, edx
movzx edx, ax
mov edx, dword [edi + ecx - 0x770c0bd7]
xadd word [esp + ecx - 0x770c0bd7], ax
setl al
mov ecx, dword [edi + eax - 0x7213a1fc]
lea edi, [edi + eax - 0x7213a1fc]
jp 0x6f827f
and edx, ecx
not edx
sal dword [esp + eax - 0x7213a200], 0xbf
mov dword [edi + eax - 0x7213a200], edx
mov dword [esp + eax - 0x7213a200], ebp
ret

Function at 0x657b9f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [edi + ecx - 0x5d9b4f30]
mov edx, dword [edi + ecx - 0x5d9b4f2c]
call fcn.006bcf7d