joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60b82a
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
pop eax
sub esi, 4
mov ecx, dword [esi]
xor ecx, ebx
mov eax, 0xfa85982
not ecx
sar eax, 0x1e
mov edx, eax
lea ecx, [ecx + eax*2 - 0x4a3238b9]
jne 0x637d6f
ror ecx, 3
not ax
bswap ecx
inc al
xchg edx, eax
xor ebx, ecx
add edi, ecx
movzx ecx, dl
xor ecx, dword [eax + ebp]
bts edx, eax
btr edx, edx
mov edx, dword [ebp + eax*2 + 4]
btc ax, 0x2f
sar al, 0x44
sar eax, 0x52
lea ebp, [eax + ebp + 4]
not al
jbe 0x5c8f7a
xor ebx, ecx
lea edx, [edx + eax*8 + 0x6d989abf]
mov dword [esp], 0xe582ba31
add ebp, ecx
sal dword [esp], 0xc1
movzx ecx, dl
movzx eax, byte [edi + ecx - 0x80]
jl 0x6e82f7
shr ecx, 0xc8
sar ecx, 0x6d
lea edi, [edi + ecx*2 + 1]
not edx
ror cl, 0xe6
xor al, bl
rol al, 1
dec word [esp + ecx*2 + 1]
rol dword [esp + edx*2 - 0x650810fe], 0x7f
sar dx, 0xc3
xor al, 0x17
add edx, ecx
neg al
ror edx, 0x53
ror al, 1
sar ecx, 0xec
not al
ror dl, 0x26
neg cx
rol al, 1
neg dword [esp + ecx]
adc al, 0x3c
and edx, ecx
xor bl, al
lea eax, [esp + eax + 4]
push edx
btc dx, dx
add cl, byte [eax + edx*2 - 2]
or byte [esp + edx*2 + 1], dl
lea esi, [esi + edx*8 - 0xa]
sal dword [esp + edx + 3], 0x19
sal dx, 0xef
mov word [esi + edx*8 - 0x40000], cx
lea eax, [edx*2 + 0x79b3743d]
mov ecx, eax
pop ecx
pop eax
js fcn.006806bf
lea edx, [esp + edx + 8]
call fcn.0069c13a

Function at 0x60cb98
Capabilities:
Read file on windows

Disassembly:
push ecx
movsx edx, cl
not ax
sal dword [esp + 8], cl
rol ecx, cl
call fcn.00711936

Function at 0x60d724
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
shrd edx, eax, cl
mov dword [ebp], edx
sub esi, 4
mov ecx, dword [esi]
mov eax, dword [esp + 4]
add eax, 0xfff64a2f
jmp eax
lea edi, [edi + eax*4 - 0x63d20af]
xor dl, bl
ror eax, 0x7a
adc dl, 3
xor dl, 0x84
push eax
add dl, 5
sar byte [esp + eax - 0x63d20afd], 0xc5
xor dl, 0x8a
push eax
mov byte [esp + eax - 0x63d20afc], 6
xor bl, dl
sub dword [esp + eax - 0x63d20afc], 0x4f071191
lea edx, [esp + edx + 0xc]
setne al
mov dword [esp + eax - 0x63d20af9], eax
mov dword [eax + edx - 0x63d20b01], ecx
push eax
mov eax, dword [edi + eax - 0x63d20b01]
mov ecx, 0x54bdb81e
movsx edx, cl
or dx, 0xeb10
lea edi, [edi + edx*4 - 0x3ac74]
or byte [esp + edx*2 - 0x1d63a], dh
xor eax, ebx
shr cl, 2
dec eax
sub ecx, 0x941db2b7
rol edx, cl
sub edx, edx
not eax
jg 0x5b37e9
dec eax
xadd cl, dl
dec word [esp + edx - 0x4a]
xor eax, 0xc33982b3
push edx
rol cx, 0x4a
jb 0x67319c
sbb eax, 0xa8b0b306
sar ecx, 0xd8
or edx, edx
btc dx, cx
not eax
shr word [esp + edx - 0x4b], 0xc1
lea edx, [ecx + 0x78bb792]
xor ebx, eax
add ebp, eax
lea eax, [edx + edx*8 - 0x46f84dd]
mov dword [esp + edx - 0x78bb752], ebp
ret 0x10

Function at 0x611a74
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xor edx, 0xbe1a042c
cbw
xor ebx, edx
add esi, edx
or cx, word [esp + eax*8 + 5]
neg ecx
jg 0x63733b
mov ebp, dword [ebp + eax*2]
pop ecx
add ecx, 0xfffc120f
jmp ecx
Function at 0x616542
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
push 0xf3179d92
pushfd
pop dword [esp]
call fcn.005cd044
lea ecx, [edx + 0x13209401]
mov dword [ebp + ecx*2 - 0x26412800], eax
movsx eax, dx
lea edi, [edi + ecx*4 - 0x4c825004]
sal eax, 0x15
call fcn.006013d6

Function at 0x6190d6
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + edx*8], 0x108ebd25
call fcn.006d66e4
mov eax, 0x4493089c
mov cl, byte [esi + eax - 0x4493089a]
sal al, 0x27
setns al
lea esi, [esi + eax - 0x449307ff]
lea eax, [eax*8 + 0x4b39113f]
ja fcn.005f1f89
adc dl, cl
movzx ecx, al
mov word [ecx + esi - 0x47], dx
imul ecx
or cl, 0x1d
mov ecx, dword [edi + eax*2 - 0x61b1562]
lea eax, [edx + eax*8 + 0x56912306]
btc ax, ax
lea edi, [eax + edi - 0x6efd58a9]
lea eax, [edx + eax*2 - 0x48d9c644]
xor ecx, ebx
xadd ax, dx
imul ax, ax
xadd edx, eax
bswap ecx
sbb eax, 0xaebd8816
dec ecx
push edx
cdq
dec al
xor ecx, 0x15288f1f
xor edx, eax
not eax
rol ecx, 2
xor ebx, ecx
call fcn.00631569
Function at 0x629dc5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or cl, cl
sub ecx, 0x91afa29c
popfd
btr ecx, 9
or ecx, ecx
lea ebp, [ebp + eax - 0xc093a88]
bswap eax
call fcn.006ef730
not dl
push eax
call fcn.0073f57a
mov eax, 0xd4000b1f
lea edx, [eax*4 - 0x75eff8c3]
movsx ecx, ax
lea ebp, [ebp + ecx*2 - 0x1642]
push ecx
btr dx, cx
mov ecx, dword [ebp + ecx*2 - 0x163e]
setb dl
xor ecx, ebx
neg ecx
xor eax, eax
xor ecx, 0x5f9ed9aa
lea ecx, [eax + ecx + 0xd3d9abb]
sub ax, 0xf386
xadd al, ah
not ecx
xor dword [esp + eax*2 - 0xf50c], edx
rol eax, 0x93
ror ecx, 1
xor ebx, ecx
add esi, ecx
shl edx, 0xb8
jbe 0x669f3e
mov eax, 0x5cb61d8d
push eax
movzx cx, byte [edi + eax - 0x5cb61d8d]
ror ax, 1
mov al, byte [eax + edi - 0x5cb68ec4]
adc edi, 1
and cl, al
mov eax, dword [esp]
inc byte [esp + eax - 0x5cb61d8b]
lea eax, [eax*2 + 0x6e8354bb]
not cl
mul dword [esp + eax*2 - 0x4fdf1faa]
mov word [eax + edi - 0x7f805951], cx
lea ecx, [edx + eax*2 - 0x2d597448]
sub ecx, 0x2f3db90f
lea ebp, [edx + ebp - 0xe76a890]
sub word [esp + eax - 0x7f805950], 0x4a1b
sub edx, 0x9d3ba116
mov edx, dword [ebp + edx - 0x713b0776]
and word [esp + eax - 0x7f805950], 0xc929
bswap eax
xor edx, ebx
lea eax, [ecx + ecx - 0x78e1bb55]
dec edx
call fcn.005ae1e7
mov edx, 0x66176caf
fild dword [esi + edx - 0x66176caf]
call fcn.005be66a
mov edx, ecx
add ebp, 4
xadd edx, ecx
inc dl
xor eax, ebx
lea edx, [edx*8 - 0xd73ddf2]
btc ecx, ecx
call fcn.005cdfe9
add dl, byte [edi + edx*8]
mov cl, byte [edi + 2]
call fcn.006af97f
movzx ecx, ax
lea edi, [edi + eax*8 - 0x6049d41c]
push edx
jae 0x5a61c1
inc dl
rol word [esp + 2], cl
xor dl, 0x25
or dword [esp], 0x62973e12
shl ax, cl
jp 0x734abb
inc dl
and ax, 0xe787
btc eax, 0x86
neg dl
and eax, dword [esp]
cwde
xor bl, dl
lea edx, [esp + edx + 4]
mov ecx, dword [eax + edx - 0x740]
lea edi, [edi + eax*8 - 0x3a04]
lea edx, [eax*2 + 0x75b6f820]
imul edx
mov dword [edi + edx - 0x355], ecx
movzx ecx, al
adc cx, 0x13bd
lea ebp, [edx + ebp - 0x359]
xor word [esp + edx - 0x354], 0x6410
mul ecx
mov ecx, dword [ebp + eax - 0x26bdf000]
shl edx, 0x79
xor ecx, ebx
sal dl, 0x61
cbw
sub word [esp + eax - 0x26bd0000], dx
dec ecx
inc edx
lea edx, [eax + eax*4 - 0xf4d8cfc]
inc word [esp + eax*2 - 0x4d79ffff]
neg ecx
or dword [esp + eax - 0x26bd0000], edx
inc ecx
shl word [esp + eax*2 - 0x4d79ffff], 0xea
idiv dl
jmp 0x74593b
bswap ecx
not ecx
xor ebx, ecx
call fcn.005cd55a

Function at 0x62d63f
Capabilities:
Execute syscall

Disassembly:
lea ebp, [ebp + eax - 0x70310682]
imul al
mov dword [esp + eax - 0x70313f01], eax
bts eax, eax
movzx eax, byte [ebp + eax - 0x70313f03]
mov ecx, 0x3cbfbcaf
xor al, bl
bt ecx, 0x27
neg al
movzx edx, word [esp + ecx - 0x3cbfbcaf]
rol al, 1
not dword [esp + ecx*2 - 0x797f795e]
sub al, 0x8b
rol al, 1
call fcn.0072a841
Function at 0x645b01
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov word [esi + eax*2], dx
mov dword [esp + eax], 0x1ca30d38
pop edx
pop edx
je fcn.005a704f
mov eax, 0xf1a8fcb7
movzx edx, byte [edi]
imul eax, eax
jo 0x679f4b
lea edi, [eax + edi - 0x37a8cad0]
xor al, al
mov ecx, 0xd19f1924
sar al, cl
xor dl, bl
rol dl, 1
btc eax, eax
xor dl, 0x17
btc ax, cx
call fcn.00640bb9

Function at 0x65b7ba
Capabilities:
Check for time delay via gettickcount

Disassembly:
movzx eax, cl
lea edx, [edx + eax - 0x6f34f92f]
bswap edx
xor edx, 0x8328382b
call fcn.00724506

Function at 0x65e9e2
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xor ebx, ecx
and al, 0x10
xchg al, dl
adc edi, ecx
btr dx, 0x3a
sal ax, 0xc9
mov edx, dword [ebp + edx - 0xa1f5010]
shr eax, 0xe7
mov eax, dword ss:[edx + eax*4 - 0xb1a310]
mov ecx, 0x673760b6
movzx edx, cx
sub ecx, 0x7f8fb283
mov dword [ebp + edx*8 - 0x305b0], eax
mov eax, 0xdab8800e
xor cl, 0x80
jmp edi
adc edi, 2
sal cl, 4
and dl, al
call fcn.0060c868
ror ax, 0x41
not ecx
lea ecx, [ecx + edx*8 - 0x34e23ae8]
jno 0x736d83
xadd dx, ax
xor ecx, 0xa00c0d8e
jmp 0x5d1d21

Function at 0x66f5d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
not eax
mov dword [esp], 0x880cbe26
add ebp, 4
mov edx, dword [esp + 2]
shr eax, 0x9b
call fcn.0065a710

Function at 0x676d69
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xadd dx, ax
mov eax, dword [edi + edx*4 - 0x4a3212dc]
sbb edx, edx
pop edx
adc edi, 4
and ecx, eax
push 0x573b51a5
call fcn.005aa500
Function at 0x676d89
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [edi]
mov cl, 0x33
mov ecx, dword [ebp - 0x34]
push ecx
mov cx, di
mov ecx, dword [ebp - 0x30]
push ecx
jmp 0x6cc0c0
jne 0x68ae52
xor esi, eax
and esi, 0xffffff
cmc
xor esi, dword [ebx + 0x398]
jmp 0x6d1992
mov dword [ebp - 0x58], eax
stc
cmc
test esi, esi
jmp 0x5f94a1
jns 0x6a9e26
mov eax, dword [ebx + 0xb4]
cmp edi, 0xa60156b8
mov eax, dword [eax + 0x20]
test eax, eax
je 0x6a9e26
cmp dword [ebx + 0x21c], 0
jmp 0x629d48
jne 0x6a9e12
mov ecx, eax
btr edx, ebp
and ecx, 0xf
shrd dx, cx, 0xe
neg dx
sub dh, 0xc
shr eax, 4
bt edx, eax
sbb dl, 0xa5
and edx, ebp
mov ecx, dword [ecx*4 + 0x455998]
mov edx, edi
or ecx, eax
mov ax, 0x7fa4
mov edx, dword [edi]
setne al
push ecx
mov ecx, edi
cwde
mov eax, dword [edx + 0x34]
call eax
movzx eax, al
test esp, esp
test eax, eax
jne 0x6a9df7
mov eax, SysReAllocStringLen
jmp loc.0043477a
mov edx, dword [ebx + 0xc0]
not ah
mov dword [ebp - 0x85], edx
cdq
bswap ax
lea ecx, [ebp - 0x90]
mov eax, dword [ebp - 0x18]
jmp 0x6797c8
push ebx
jmp 0x66b563
call fcn.0042c9e0
mov dword [ebp - 0x8a], eax
jmp 0x62a217
add dword [esp + 4], 0xff8ade71
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.005b9fa5
mov ecx, esi
cmp ecx, ebp
and ecx, 0xff000000
cmp ecx, 0xf8000000
jmp 0x5c945c
mov dword [eax + 8], ecx
not cx
cmovb edx, eax
mov dword [eax + 0xc], 0x10
jmp 0x5c8fef
push 0
push esi
jmp 0x6352fb
mov ecx, esi
shr ecx, 0x1c
stc
mov byte [ebp - 0x21], cl
ror eax, cl
btc ax, 0xb0
mov eax, dword [ebp - 0x58]
shr eax, 4
cmp bh, al
jmp 0x5e6519
mov dword [ebx + 0x21c], 1
cwd
sar ah, 0xa3
mov cl, byte [ebp - 0x21]
setg dh
add eax, 0x761a12b3
stc
and esi, 0x7fffffff
cbw
mov dword [ebp - 0xa0], esi
sal ax, cl
sbb si, si
mov edx, dword [ebp - 0xa0]
add ah, 0x22
cmovb eax, esi
and edx, 0x8000000
cbw
mov dword [ebp - 0x50], edx
movzx esi, cl
bt eax, esp
bts eax, esi
mov dword [ebp - 0x1c], esi
cbw
and eax, ecx
mov eax, esi
cmp bp, bp
and eax, 1
cmp ax, ax
clc
cmc
mov dword [edi + 0xc], eax
clc
mov al, cl
test bp, dx
and al, 2
jmp 0x6dfb66
push eax
jmp 0x6df45c
mov byte [ebp - 0x90], 0x20
mov byte [ebp - 0x8b], 0x20
jmp 0x6ef030
mov dword [ebp - 0x8f], esi
push 0
jmp 0x68a6ad
push edi
jmp 0x72e09f
mov byte [ebp - 0x86], 0x28
mov byte [ebp - 0x81], 0x2a
jmp 0x6dce7d
call edx
jmp loc.0043477a
mov edx, dword [edx + 0x38]
jmp 0x6f141c

Function at 0x67a606
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
movzx ecx, byte [ebp + eax*2 - 0x558]
dec eax
call fcn.00757a99
Function at 0x683f12
Capabilities:
Check os version
Get number of processors

Disassembly:
mov ax, word [ebp]
mov dx, word [ebp + 2]
jmp 0x6ffb0a
neg eax
shr ecx, cl
bt ecx, 0xac
bswap eax
setae cl
lea eax, [eax + ecx*4 - 0x4c05b2b3]
inc ecx
jge 0x702dba
shrd ax, dx, cl
mov word [ebp], ax
mov edx, 0x3f05723a
lea edi, [edi + edx - 0x3f05723e]
shr dl, 0xe6
lea ecx, [edx + edx*2 - 0x4273f6f5]
dec cx
mov eax, dword [edi + edx - 0x3f057200]
imul dx, dx
and edx, edx
xor eax, ebx
add dl, cl
dec cl
lea eax, [eax + edx - 0x7a2d2496]
not cl
neg eax
or dl, ch
rol eax, 2
neg ecx
or dx, 0xf02
jg 0x5b0795
mov edx, 0x7992a18f
movzx ecx, dl
mov eax, dword [edx + ebp - 0x7992a18f]
shl edx, 0x32
call fcn.0072860e
jmp 0x5a6d76
inc ecx
ror ax, 0xc
mov dword [esp + edx*4 - 0x30260], edx
xor ecx, 0x2f1cb107
xor ebx, ecx
shl eax, 0x72
setae dl
bswap eax
add esi, ecx
mov edx, dword [edi + edx - 0xc000]
mov dword [esp + eax*2 - 0x1c171], 0x662c8d98
lea ecx, [eax + eax - 0x7cce1879]
neg cl
lea edi, [edi + eax*2 - 0x1c170]
neg ax
ror dword [esp + eax - 0x1f42], cl
lea ebp, [ebp + eax*2 - 0x3e8d]
and eax, ecx
lea eax, [ecx*4 + 0x12b152ab]
inc ecx
movzx eax, byte [ebp + eax*4 - 0x7dffcafc]
dec dword [esp + 3]
xor al, bl
inc ecx
call fcn.0070d1c6
mov eax, 0x8a11280c
jmp 0x5d6a01
mov ecx, 0x7f282e23
mov cl, byte [ebp + ecx - 0x7f282e1f]
add ebp, 4
jmp 0x5b9e5d

Function at 0x68e478
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005e1456
mov edx, dword [ebp]
add ebp, 4
jmp 0x619511

Function at 0x692a60
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
ror cx, 0x86
sar edx, cl
neg eax
rol edx, 0x94
push ecx
imul cx, dx
dec eax
add cx, dx
bts edx, 0xaf
not eax
add dl, dh
inc ecx
and dx, word [esp + edx*4 - 0x201ff]
xor ebx, eax
btr ecx, ecx
setae byte [esp + edx*4 - 0x200]
adc edi, eax
call fcn.0069360a
cmovb cx, cx
sal word [esp + eax*2 - 0xcc14], 0x81
lea edi, [edi + eax*2 - 0xcc14]
xor edx, ebx
cwde
dec edx
inc dword [esp + eax*4 - 0x19830]
mov word [esp + eax*8 - 0x3305d], ax
neg edx
dec edx
sar byte [esp + eax - 0x6605], cl
xadd al, ah
rol edx, 2
xor ebx, edx
add eax, 0x17ba0bb7
adc ebp, edx
not ecx
mov dword [esp + eax*2 - 0x2f743052], ebp
ret 4
mov ecx, dword [esi + ecx*8 - 0x903352c]
mov dword [esp + eax*8 - 0x33530], eax
lea esi, [eax + esi - 0x669e]
add al, ah
jns 0x7090ab
xor eax, ebx
or cx, cx
sub dl, cl
imul edx, ecx
ror eax, 1
jmp 0x5a6bc6
mov dword ss:[edx + eax*2 - 0xcc18], ecx
movzx ecx, byte [esp + eax*2 - 0xcc18]
push eax
mov edx, dword [edi + eax*2 - 0xcc18]
jne 0x67ff01
pop eax
jmp esi
Function at 0x69d24a
Capabilities:
Encode data using xor

Disassembly:
dec edx
rol dl, 0x81
and ax, cx
mov dword [esp + 4], edx
shr dl, 0xe3
mov word [esi], ax
movsx ecx, dx
mov edx, dword [edi + ecx*8 - 0x190f8]
btc cx, cx
shl dword [esp + ecx - 0xb21b], cl
movzx eax, cl
lea edi, [edi + ecx*4 - 0x2c878]
sub ecx, 0x9d18e109
mov dword [esp + ecx - 0x62e7d116], ecx
xor edx, ebx
bswap edx
or ecx, esp
sbb byte [ebp - 0x15f37377], bl
sbb byte cs:[ebp - 0x35f02ccd], bl
pop eax
ror edx, 2
call fcn.0069e052
test eax, 0x14742e65
xor byte [esi + 0x3fad5844], ch
mov dword [edx - 0x43097dda], ebx
pop ebp
shr dword [edx + 0x8951b8a], 0x90
inc edi
scasd eax, dword es:[edi]
in eax, 0x68
and al, 0x12
cmp dword [esi - 0xc7b7eae], ecx
mov eax, 0x48af3652
daa
cmp al, 0xd7
cmc
or dh, dl
sar cl, cl
inc ecx
add byte [0xe1c00056], cl
cdq
ja 0x69d27c
xor dword [edi + 0x120eece1], esi
call 0x3144eb7
popfd
mov dl, 0x44
psadbw mm3, qword [edx]
mov ebx, 0x2780471b
ret 0x55da

Function at 0x6a78b7
Capabilities:
Check for time delay via gettickcount
Execute anti-debugging instructions

Disassembly:
rol cl, 1
mov dword [esp + eax*2 - 0x7460005c], eax
add ax, 0xcabf
sar edx, 0x4b
adc cl, 0x37
xor bl, cl
lea ecx, [esp + ecx + 8]
dec byte [esp + eax - 0x3a30cae8]
mov ax, word [eax + ecx - 0x3a30caed]
sub edi, 2
movzx ecx, byte [esp + 2]
sal byte [esp + ecx - 0x2d], 0x23
mov word [edi + ecx*8 - 0x180], ax
movsx eax, word [esp + ecx - 0x2c]
call fcn.00657a91
mov eax, 0x5a355f2a
jmp 0x74913d
mov ecx, dword [esi + eax - 0x5a355f2a]
mov eax, dword [esi + eax - 0x5a355f26]
call fcn.005db71b
mov dword [esi + 0x94], ebx
cmovns ecx, ebp
cdq
mov dword [esi + 0x354], ebx
bswap ecx
cmovae eax, esi
mov dx, 0x5202
mov byte [esp + 0x18], 0x8b
movzx edx, sp
mov eax, edi
mov byte [esp + 0x19], 0xf8
cmovle dx, dx
cwde
cwd
mov byte [esp + 0x1a], 0x3b
movsx eax, di
cbw
mov byte [esp + 0x1b], 0xfb
movzx cx, dh
jmp loc.004038a0

Function at 0x6a8342
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb ebp, 0x8f246016
rol ebp, 3
bswap ebp
sub ebp, 0xe68730a1
jmp 0x6850ab
Function at 0x6a9d8f
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push edx
lea ebp, [ebp + edx*2 + 2]
or dword [esp + edx], edx
ror dx, 0x25
or al, cl
jmp 0x7221e7
xor ebx, eax
add edi, eax
mov eax, dword [ecx + esi - 0x52bd5800]
lea esi, [esi + ecx - 0x52bd57fc]
ror cx, 0xc3
xor ecx, ecx
jle 0x6fe2f5
mov edx, 0xd3a42eb4
movzx ax, byte [ebp]
sub edx, edx
shr dx, 0x2e
mov cl, byte [ebp + edx*4 + 2]
jbe 0x5d013d
add byte [eax - 0x53], bh
push ecx
aad 0x5e
push ebx
dec esp
sub ch, bh
jp 0x6326f4
inc ebx
mov ecx, 0x7d4a84d5
ret 0x59ea
aad 0xda
fidivr word [edi - 0x78]
mov dword [0x4048798d], eax
cdq
xor dword [edx + 0xb], edx
jmp 0x632745
jae 0x632771
mov dword [ebx], eax
mov bh, 0x3d
iretd
jmp 0x7835548f
sar dword [esp + 4], 0xec
neg cl
call fcn.0068b878
mov dword [esp + eax*2 - 0x7fffff6], edi
ret
sar eax, 0x25
shr dl, cl
shr eax, 0x86
mov dword [esp + eax - 0x3fffffb], 0x8bb6b51b
mov word [ebp + eax*4 - 0xfffffec], dx
mov edx, eax
dec word [esp + eax*2 - 0x7fffff5]
jno 0x6a10a3
mov ecx, 0x52bda3ab
bt ecx, 0x25
lea ebp, [ebp + ecx - 0x52bda3af]
mov eax, dword [ebp + ecx - 0x52bda3ab]
movsx edx, cl
xor eax, ebx
sar dl, 4
not eax
ror eax, 2
not eax
xor eax, 0x38988a00
bt cx, 0x14
push edx
rol eax, 2
shl cx, cl
jb 0x63268a
lea ebp, [ebp + ecx - 1]
lea edx, [ecx + ecx - 0x4adb34d0]
xor edx, 0x7dbe0136
add cl, byte [ebp + ecx]
xor cl, bl
push edx
inc cl
jmp 0x63c03b
movzx ecx, dl
not al
mov word [ebp + ecx], ax
call fcn.006c6615

Function at 0x6ad2e3
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
call fcn.005eb8a5
mov edx, 0x1c32f192
call fcn.006b329e

Function at 0x6c7d27
Capabilities:
Read file on windows

Disassembly:
mov ecx, 0x2b2061af
xor eax, ebx
call fcn.00693328
mov cx, word [edx + eax - 0xcbc069]
cwde
sbb esi, 1
lea edx, [eax + eax + 0x60397bb9]
mov word [esi + edx - 0x6038fc8b], cx
bts dx, 0xa5
pop eax
pop edx
jae fcn.006806bf

Function at 0x6d4703
Capabilities:
Create thread

Disassembly:
xor ebx, edx
add esi, edx
call fcn.00698ab4

Function at 0x6dbc1c
Capabilities:
Encode data using xor

Disassembly:
bts cx, cx
neg ecx
mov dword [esp + ecx - 0x1ff], esi
ret
sbb edx, 0x81001ab0
mov dword [esp + eax - 0x6550a24d], ecx
xor edx, 0x33bf30b5
xadd dword [esp + eax - 0x6550a24d], ecx
lea edx, [edx + eax - 0x55a27cca]
rol ecx, 0x33
bswap edx
inc eax
ja 0x6ecfbb
js 0x6ce05c
and word [esp + 2], cx
adc cx, cx
add esi, edx
jmp 0x63dda0
sbb eax, eax
neg edx
bswap edx
cbw
xor ebx, edx
or word [esp + ecx - 0x126b2a83], cx
xor ecx, eax
adc edi, edx
movzx edx, cx
movzx cx, byte [eax + esi]
xchg dword [esp + eax], edx
inc dl
add al, byte [esi + eax*2 + 2]
inc word [esp + 2]
call fcn.005ea6c2
push ecx
pushfd
mov ecx, 0xaabc40d
movzx cx, cl
call fcn.005ab2d2
sub eax, 0x903bda51
cwde
imul esi, ebx, 0x3e
invalid
Function at 0x6e866d
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x86
not cx
push ecx
mov dword [esp + edx - 0x20172289], ecx
xor al, 0xac
inc edx
ror al, 1
and word [esp + edx*2 - 0x402e451a], dx
call fcn.0068268e
pushal
push esi
sbb edx, esi
jo 0x6e86cf
xchg bl, ah
in al, dx
jmp 0x6e86f4
popfd
xor esp, edi
clc
xor dword [edi - 0x35caaf64], edx
and bl, byte [eax + edi*2]
inc edi
xor eax, 0xf3be0bc8
pushfd
pushfd
outsb dx, byte [esi]
std
cmp dword [eax], 0x68c1f71d
add edi, dword [ebp + 0x74eebe01]
dec ecx
sub al, 0x76
add eax, 0x6e1e36f1
adc eax, 0x5b65c1f2
push es
sti
inc ebx
je 0x6e86bd
retf
inc ecx
jl 0x6e8721
pop ss
mov esi, 0xad2bddf5
push cs
jle 0x6e86f1
add dword [ebx + edi], edx
cmp ch, 0xc4
xor byte [ebx], ch
clc
test al, bl
movsb byte es:[edi], byte ss:[esi]
invalid
jmp 0x19187aa7

Function at 0x6f22cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x630106
mov eax, dword [eax]
bswap ecx
xchg ch, ch
movsx cx, bh
lea ecx, [esp + 0x5e]
push ecx
jmp 0x5d9961
push esi
jmp 0x642d5e
push 0x800000ff
jmp 0x630104
test eax, eax
jmp 0x5a7358
call eax
mov edi, ebx
jmp 0x6b4ee1
call edx
mov dword [esp + 0x38], eax
jmp 0x70b525
mov dword [esp + 0x34], eax
jmp 0x663827
mov ecx, dword [esp + 0x14]
rdtsc
lea eax, [esp + 0x5c]
movzx edx, sp
setae dh
lea edx, [esp + 0x3c]
jmp 0x718a8b
call fcn.00419820
test eax, eax
jl 0x663881
mov ecx, dword [esp + 0x18]
shr dl, cl
cmp dh, 0xb8
neg si
mov edx, dword [ecx + 0x64]
mov esi, dword [esp + 0x38]
cmc
mov dword [edx + eax*4], esi
neg si
cmovns edx, eax
sub dh, 0x8a
mov edx, dword [ecx + 0x68]
test dl, 0xb
mov esi, dword [esp + 0x24]
clc
stc
mov dword [edx + eax*4], esi
and dh, 0x8c
mov ecx, dword [ecx + 0x6c]
sar edx, cl
mov edx, dword [esp + 0x34]
test esi, 0xcd89cf98
mov dword [ecx + eax*4], edx
sbb cx, cx
add ecx, 0xb59b15b4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x48]
btr edx, ecx
cmp edi, 0xea294ba3
mov edx, dword [esp + 0x44]
cmc
lea eax, [eax + 1]
cmp di, 0xd93f
test bh, 0xb
cmp esi, esi
lea edx, [edx + ecx]
test edi, 0xa17f805
cmc
test cx, cx
cmp eax, edx
mov dword [esp + 0x14], eax
jmp 0x74b2f2
push edx
jmp 0x6f22df
mov dword [esp + 0x24], 0
call fcn.0042a910
mov ecx, dword [ebx + 8]
cbw
mov edx, dword [ecx]
cbw
mov esi, dword [esp + 0x28]
bswap ax
cbw
movzx eax, cx
mov edx, dword [edx + 0x14]
cmova ax, si
lahf
lea eax, [esp + 0x24]
push eax
mov eax, 0x290fc3bb
lahf
not ax
lea eax, [esp + 0x62]
jmp 0x6d1e4f
push eax
jmp 0x5d73ea
mov dword [esp + edx*2 - 0x195c380c], ecx
rol eax, 2
sal edx, 0x45
inc eax
call fcn.00685f25
push esi
jmp 0x750321
call fcn.0042a910
mov ecx, dword [ebx + 8]
movzx eax, ax
mov dx, bp
mov eax, dword [ecx]
xchg dh, dh
bswap edx
mov eax, dword [eax + 0x18]
setp dh
lea edx, [esp + 0x5e]
jmp 0x6a8619
call fcn.0042cfb0
mov eax, dword [esp + 0x18]
test sp, dx
cmp edi, ebp
mov eax, dword [eax + 0x10]
jmp 0x5e3833
jl 0x661fc5
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x178], 0xffffffff
lea eax, [esp + 0x3c]
jmp 0x5f8524
call eax
mov edi, dword [esp + 0x14]
mov esi, 0x93b7462c
bswap esi
lea esi, [esp + 0x3c]
jmp 0x6560bc
Function at 0x6fa2f7
Capabilities:
Set environment variable

Disassembly:
je 0x5bff82
mov ebx, dword [esi + 0x30]
push 0
add edi, 1
call fcn.0043d77c
lea esp, [esp + 4]
cmp sp, 0xfe1f
cmp eax, ebx
jb 0x5bff82
sub ebp, ebp
cmp edx, 0x8aadd18f
cmp edi, esi
sub ebx, ebx
cmc
cmp sp, sp
cmp edi, ebx
jmp fcn.005b3d30
test byte [esi + 0xc], 8
jmp 0x5bff54
inc edx
not ecx
inc cl
neg edx
shr al, 0x63
lea ecx, [eax + ecx*8 + 0x3ebee5a7]
setnp cl
xor edx, 0x82205e14
pop eax
mov eax, ecx
xchg ecx, eax
xor ebx, edx
call fcn.0074f59a
mov eax, 0x671c3a9f
bt eax, 0x8c
lea ebp, [ebp + eax - 0x671c3aa3]
call fcn.006c18a3
mov ecx, dword [edi]
mov eax, 0x348f383a
mov eax, dword [eax + edi - 0x348f3836]
mul ecx
mov ecx, 0xce120eb6
not ecx
bt ecx, ecx
mov dword [edi + ecx*2 - 0x63dbe292], edx
movzx edx, cl
mov dword [edi + ecx*2 - 0x63dbe28e], eax
lea ebp, [ebp + edx - 0x4d]
mov ecx, dword [ebp + ecx*2 - 0x63dbe292]
call fcn.00602ede
je 0x677456
movzx ecx, word [esi + 0x36]
test edx, edi
jmp loc.004276f2

Function at 0x6fef6b
Capabilities:
Set environment variable

Disassembly:
jmp loc.00439342
inc eax
or dx, 0x4e2d
push edx
neg eax
bswap eax
btc edx, 0x38
dec eax
xor ebx, eax
shr dx, 0x87
push edx
adc esi, eax
ror edx, cl
movsx eax, dx
pop ecx
pop eax
jae fcn.0071cad5
movzx ecx, ax
jmp fcn.006d25b7
mov ecx, 0xe636089e
mov eax, ebp
btc ecx, ecx
lea ecx, [ecx*4 - 0xbe6d3e4]
sbb ebp, 3
mov edx, ecx
imul edx, edx
jno 0x6c170a
mov dword [ebp], eax
mov eax, 0x200a889
lea edi, [eax + edi - 0x200a88d]
sal edx, 0x34
btc eax, edx
mov eax, dword [edi + edx - 0x59000000]
bts ecx, 0xba
jb 0x7232c3
push eax
jmp 0x7388f0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
jmp 0x5d0354
jmp 0x614f84
mov dword [esp], 0xab0a540f
bt ebx, esi
mov dword [esp], ecx
rol esi, 0xaf
not ebx
call fcn.006d85e0
mov dword [esp + 0x14], ebp
jne 0x6ecc95
jmp 0x6329c4
xor eax, ebx
jmp 0x69c7d5
push str.DNGTrialDaysLeft
jmp 0x681311

Function at 0x6ffa12
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi + 0x12848]
adc dx, di
cmovbe ecx, ebp
mov dx, si
mov edx, dword [esi + 0x12840]
rcl ecx, 0x8a
mov ecx, dword [eax + edx]
stc
lea eax, [eax + 4]
test ax, dx
mov dword [esi + 0xc], ecx
clc
cmp esi, 0xf6307c0b
mov dword [esi + 0x1283c], ecx
clc
mov dword [esi + 0x12848], eax
push edi
jne 0x5e4ded
mov ecx, dword [esi + 4]
xchg al, al
push ecx
push 1
cwde
bswap ax
cmovb eax, edi
lea eax, [esi + 0xc]
jmp 0x5e7bb3
push ebp
sub ebp, 0x931761a7
mov ebp, esp
stc
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
clc
test dh, 0x88
mov esi, eax
cmp byte [esi + 0x12828], 0
jmp 0x6a4a39