joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4473ee
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043f2e2
xor ebx, ebx
cmp dword [0x5a0a38], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4474c4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4475a4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4536d4
push edi
call esi
cmp eax, ebx
je 0x4475a4
push eax
call fcn.0043f274
mov dword [esp], 0x4536c4
push edi
mov dword [0x5a0a38], eax
call esi
push eax
call fcn.0043f274
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5a0a3c], eax
call esi
push eax
call fcn.0043f274
mov dword [0x5a0a40], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043bf27
test eax, eax
pop ecx
pop ecx
je 0x447492
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043b0eb
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4474c4
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043f274
cmp eax, ebx
pop ecx
mov dword [0x5a0a48], eax
je 0x4474c4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043f274
pop ecx
mov dword [0x5a0a44], eax
mov eax, dword [0x5a0a44]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x447549
cmp dword [0x5a0a48], ecx
je 0x447549
push eax
call fcn.0043f2eb
push dword [0x5a0a48]
mov esi, eax
call fcn.0043f2eb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x447549
cmp edi, ebx
je 0x447549
call esi
cmp eax, ebx
je 0x447516
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x447516
test byte [ebp - 0x18], 1
jne 0x447549
lea eax, [ebp - 0x10]
push eax
call fcn.0043bf5e
test eax, eax
pop ecx
je 0x447531
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043b0eb
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x447540
or dword [ebp + 0x10], 0x200000
jmp 0x447584
or dword [ebp + 0x10], 0x40000
jmp 0x447584
mov eax, dword [0x5a0a3c]
cmp eax, dword [ebp - 8]
je 0x447584
push eax
call fcn.0043f2eb
cmp eax, ebx
pop ecx
je 0x447584
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x447584
mov eax, dword [0x5a0a40]
cmp eax, dword [ebp - 8]
je 0x447584
push eax
call fcn.0043f2eb
cmp eax, ebx
pop ecx
je 0x447584
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5a0a38]
call fcn.0043f2eb
cmp eax, ebx
pop ecx
je 0x4475a4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4475a6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5bbc03
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ecx + eax - 0x65fec4c5]
push eax
sbb eax, eax
ror ecx, 3
sal al, 0x23
js 0x61224c
xor ebx, ecx
cbw
add ebp, ecx
dec eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
call fcn.007659c0
xchg ebx, edi
xchg byte [esi], bh
dec edi
sbb eax, dword [ebp - 0x1abe8517]
xchg byte [ecx + eax*2 - 0x4e], ch
outsb dx, byte [esi]
jp 0x6122a8
in eax, 0x86
insb byte es:[edi], dx
inc ecx
mov dl, 0x6e
sub al, 0xd1
popfd
mov esi, 0xc16b63aa
adc dh, byte [esi - 0x3e9d1f2c]
popfd
popal
not byte [edi - 0x32cbd942]
adc byte [ebx + 0x20a0287b], dh
xor dh, 0x95
and al, 0xb3
pop ss
daa
cmp ecx, dword [ebx + 0x559dc746]
call 0x5cf81dfb
popal
inc ecx
out dx, eax
pop ds
cmp eax, 0xbff7c157
jecxz 0x612265
paddsw mm0, qword [ebp - 0x39]
inc ebp
push ebx
mov ecx, 0x7dd3528d
invalid
inc ebp
mov dword [ebp + 0x53], 0xd3528db9
jge 0x61228f
inc dword [ecx + esi*8 + 0x5577c05f]
aad 0x37
pop ebp
add eax, 0x3862c41e
add esp, edx
xchg esi, ebp
enter 0x12fb, 0x4a
xor eax, 0xebf69a7f
pop ds
push edx
dec ebp
sub byte [edi + edx*4 + 0x2c3b4d01], al
out dx, eax
cmp dword [edi + 0x67], edi
pop edi
xchg ebp, eax
sub byte [eax - 0x5f], 0xce
inc esp
mov cl, 0x8d
retf

Function at 0x5cc611
Capabilities:
Encode data using base64

Disassembly:
not al
ror al, 1
or dx, dx
push edx
inc al
shl dl, 0xc2
xor bl, al
lea eax, [esp + eax + 0x10]
mov dword [esp + edx - 0x30a8], edx
add dword [esp + edx - 0x30a9], edx
mov dx, word [edx + eax - 0x30ac]
call fcn.007b3ca0
call fcn.0073825c

Function at 0x5d0736
Capabilities:
Set environment variable

Disassembly:
shr eax, 0xe3
mov eax, dword [eax + esi - 0xfc50640]
call fcn.006d3b88
lea ecx, [edx + edx*2 - 0x10d56ac4]
sub dl, ch
xor eax, ebx
call fcn.006523d9

Function at 0x5d0755
Capabilities:
Set environment variable

Disassembly:
mov ebx, dword [esp + ebx - 0x4ebc18a2]
mov ecx, dword [esp + 0x18]
call fcn.007b1218

Function at 0x5de016
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xda91f607
mov dword [esp + 0xc], 0xb585aa45
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.00740ed4
call fcn.0070dfdd
Function at 0x60b134
Capabilities:
Encode data using xor

Disassembly:
ror eax, 3
xor ebx, eax
mov dword [esp + edx - 0x2c037ed0], edx
not edx
sub edi, 4
shl dx, 0xc5
xchg dword [esp], edx
sbb byte [esp + edx*2 - 0x5806fda0], 0
mov dword [edi + edx - 0x2c037ed0], eax
push edx
mov eax, 0xae1d2986
bts eax, ecx
mov edx, dword [ebp + edx - 0x2c037ed0]
inc ecx
shl dword [esp + 4], cl
adc ebp, 3
jmp 0x64a870
not edx
ror edx, 3
dec edx
inc al
call fcn.00634ae1
xor ecx, ebx
and dl, 0xbc
ror dl, 0x46
ror ecx, 1
bt ax, 0x30
neg ecx
imul dx
call fcn.007b7058
xor edx, ebx
neg ecx
cwde
bswap edx
lea eax, [eax*4 + 0x43bd5114]
ror edx, 2
xadd dword [esp + ecx - 0x7bd0c3f3], ecx
sbb edx, 0x52bdbd02
sar eax, 0x92
ja 0x764d56
mov eax, 0xc98392b8
sub ebp, 4
mov eax, 0x81c98392
in eax, dx
add al, 0
add byte [eax], al
movzx ecx, al
mov edx, dword [ecx + ebp - 0xb8]
sal ax, 0xce
xor edx, ebx
lea edx, [edx + ecx*2 - 0x738aa692]
bswap edx
or eax, eax
jae 0x6454e7
dec ebp
fbstp tbyte [ebx + 0x41]
or eax, 0x94573f99
pop edi
cmp byte [edx - 0x394767c2], al
outsd dx, dword [esi]
jae 0x64a899
inc eax
fld qword [ebp + 0x2eacf8be]
pop esi
invalid
neg edx
inc ax
inc edx
ror eax, 0xa3
not edx
xor ebx, edx
not word [esp + eax*2 - 0x438]
lea ecx, [eax + ecx*2 - 0x74f18ad2]
add esi, edx
shr cx, cl
pop edx
pop eax
ja fcn.006d2c80
rol al, 0x67
add esi, ecx
movzx ecx, al
xchg ch, cl
mov dword [esp + eax - 0x909], esi
ret

Function at 0x61056a
Capabilities:
Set environment variable
Set registry value

Disassembly:
add ebp, ecx
lea edx, [eax + eax*4 - 0x61e1f6fb]
mov di, word [edi + edx - 0x7dfaad13]
mov dword [esp + edx - 0x7dfaad13], edx
ror ax, 0xa9
pop ecx
pop edx
jb fcn.00717430
setb cl
inc cl
neg edx
bts eax, ecx
xor ebx, edx
add edi, edx
mov edx, ecx
lea eax, [edx*4 + 0x67aaef36]
mov ecx, dword [eax + ebp - 0x67ab8f3a]
rol eax, 0xa2
mov edx, dword [ebp + edx*2 - 0x4ffe]
adc ebp, 7
call fcn.007404b1

Function at 0x617e0b
Capabilities:
Set environment variable

Disassembly:
ror dl, 1
sub cl, ch
dec dl
sub ecx, 0xd8b5f0e
neg dl
not dl
add dl, 0x18
ror dl, 1
mov dword [esp], ecx
xor bl, dl
lea edx, [esp + edx + 8]
ror ecx, 0x9a
call fcn.0079fc93

Function at 0x63ce9f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi + edx - 0x2c8faeb4]
lea esi, [esi + edx*2 - 0x591f5d64]
call fcn.006cbe62
xor ecx, ebx
lea edx, [eax + edx*8 + 0x92c422d]
neg ecx
inc eax
call fcn.006e0fe8
lea ecx, [edx + ecx - 0x3ffd730a]
not edx
not ecx
bts edx, edx
sal edx, 0x4b
xor ecx, 0x10a4d59e
dec dx
inc ecx
add edx, 0x2aa68999
ror eax, 0xce
jnp 0x6ddee1
test eax, ecx
ror ecx, 1
rol edx, 0x69
xor ebx, ecx
mul ax
call fcn.006eff8a
Function at 0x641dd0
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, ecx
mov dword [esp + eax - 0x3906b3e], 0xd92c5019
add esi, ecx
ror byte [esp + eax - 0x3906b3d], 0xa2
movzx dx, byte [eax + edi - 0x3906b3e]
call fcn.00659ed0
mov eax, dword [edi]
mov ecx, 0xd3269223
movsx edx, cx
not cx
mov ecx, dword [edi + 4]
ror dx, 0x61
imul edx, edx
lock xadd dword [eax + edx*8 - 0x5e4d9908], ecx
pushfd
mov eax, 0xaab1fe89
pop eax
inc dx
jp 0x6ca82c
or byte [eax], al
jmp 0x67cf0c
call fcn.00697f78
aad 0x5c
mov ss, esi
inc esi
cld
jo 0x6ca878
js 0x6ca873
xchg ebx, eax
push 0x78d3c178
in eax, dx
test byte [eax + 0xc], al
mov edi, 0x6c7d3f7b
cmp dword [edx - 0x7f], edi
aas
xor eax, 0x1dc08633
leave
rcl byte [ebx - 0x608c08f], cl
pop ss
ja 0x6ca85e
dec edi
out dx, eax
pushfd
and dl, 0x36
mov dl, 0xce
sti
invalid
push ebx
pop ebp
mov ah, 0x8e
xor al, byte [0x7c37b45c]
add eax, 0x7c37b45c
js 0x6ca825
dec ebx
mov dword [0x5bafc6a7], eax
mov ah, 0xfd
invalid

Function at 0x64d4c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
sub cl, 2
sar edx, 0x81
call fcn.00693c4c

Function at 0x670544
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr dx, 0x63
xor al, 0x8d
or dx, 0x6b15
btr dx, dx
adc al, 0x1d
rol word [esp], 0xa8
sar dword [esp], 0x47
xor al, 0xab
ror al, 1
push edx
add dl, 0xb9
jae 0x5d9022
dec ax
adc esi, ecx
bt eax, 0xa3
mov cx, word [edi]
mov dword [esp], 0x18a306af
sbb dword [esp], eax
adc edi, 1
cbw
and byte [esp + 1], al
sbb ebp, 1
movzx eax, byte [ebp]
xor al, bl
jmp 0x5f45d9

Function at 0x696ee1
Capabilities:
Encode data using base64

Disassembly:
mov ebx, ebp
lea esp, [esp + 8]
call fcn.0073c9b9

Function at 0x69a8d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ax, byte [edi + eax*2 - 0x1882194]
add ecx, 0x942ebd99
call fcn.00611eb1

Function at 0x69cb15
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol cl, 1
dec dx
inc eax
add cl, dl
sar ax, 0x6f
add edx, 0xebd7c15
bts ax, 0x34
neg cl
sub cl, al
xor cl, 0x11
mov dword [esp + edx*2 - 0x1d7cf828], eax
add dword [esp + edx*8 - 0x75f3e0a0], 0xbe1aad1d
rol cl, 1
xor bl, cl
pop edx
add ecx, esp
mov dx, word [eax + ecx - 0x754fffff]
lea ecx, [eax + eax*4 - 0xd5e75fa]
lea esi, [esi + eax - 0x75500001]
jmp 0x6b8c0c
shr ax, cl
mov word [ecx + esi - 0x3d318a01], dx
jbe 0x5f415f

Function at 0x6a259a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5d7b1d
mov dword [esp], ebp
sub ebx, eax
shl dword [esp], 0xe8
mov dword [esp + 0xc], ebx
fadd st(1)
and al, 0x24
call 0xc8e8235
mov ebp, dword [esp + 0x24]
bswap ebp
sbb ebp, 0x9505ecb9
not ebp
add ebp, 0xb11e7c8b
push 0x9ca029ad
inc dword [esp + 4]
add ebp, ebx
mov dword [esp + 0x24], ecx
call fcn.005c29d5
xor cl, dl
mov dh, dl
mov dword [0x953f7671], eax
dec ecx
cmp ah, ch
jle 0x6a25a3
lcall 0x32d5, 0x408260a1
jge 0x6a262a
fmul qword [ecx + 0x62817cb4]
invalid
invalid
Function at 0x6ac8e1
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
pop eax
add edi, ecx
mov dword [esp + edx*2], edi
ret 4
ror ecx, 1
mov dword [esp + eax*8], 0x998adca0
or al, ah
push edx
xor ebx, ecx
inc dword [esp + eax*4 + 1]
jl 0x622aba
sub ebp, 4
call fcn.00651e35

Function at 0x6b57ac
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
rol ax, 0xa2
jae 0x691352
lea eax, [ecx*2 - 0x5b730652]
mov eax, dword [esi + ecx - 0x740dae14]
rol edx, 0x8a
xor eax, ebx
rol eax, 1
dec cx
sub eax, 0x851c172d
neg eax
dec eax
call fcn.006f9435
pop edx
xor ecx, ebx
dec dl
bswap eax
lea ecx, [eax + ecx - 0x18a8f120]
cbw
div dl
xor ecx, 0xe3a8fc07
add edx, 0xd120f62a
call fcn.00757a3f
jmp 0x60f9f2
neg edx
xor edx, 0xbeb2d23c
push eax
ror edx, 3
mov ecx, eax
sub edx, 0xbb890889
jmp 0x5e9ce2
and cx, cx
btr ecx, 0xad
xor ebx, eax
add esi, eax
btr cx, 0xbe
mov eax, edx
mov edi, dword [edx + edi - 0x3162a200]
rol dl, 0x65
jae fcn.0079c756
xor ebx, edx
dec ecx
cwde
add esi, edx
or ax, word [eax + edi]
call fcn.00756b47
push edi
pushfd
mov edi, 0xf924aeab
and di, di
push ecx
mov ecx, 0x5c3c9a2a
test edi, 0x9b2761bd
call fcn.005c4c4f
call fcn.00606f0c
mov eax, 0xebb7f6b7
mov ecx, dword [edi]
mov edx, dword ss:[ecx]
lea ecx, [eax*4 - 0x54521374]
neg ax
sar eax, 0xbf
mov dword [edi + ecx - 0x5a8dc768], edx
lea edx, [eax*8 + 0x722ef633]
call fcn.00605040
dec eax
btc ecx, edx
imul cx, cx
ror eax, 2
sub eax, 0x9a8fba3f
rol eax, 1
xor ebx, eax
pop ecx
ror dl, 0xa7
setb dl
adc esi, eax
mov eax, edx
sub dl, 0
call fcn.006c26e6
lea esi, [esi + eax - 0x59f8e5fb]
movzx ecx, byte [esp + eax - 0x59f8e5f7]
movzx edx, ax
dec eax
mov ecx, dword [esi + eax - 0x59f8e5f6]
jge 0x604181
sub ebp, 4
mov eax, dword [ebp]
mov edx, 0x3d0f6e37
movzx ecx, dx
inc cl
xor eax, ebx
neg ecx
call fcn.005f753f
mov ecx, 0xec8fae32
rol ecx, 0x30
mov eax, dword [ebp]
movsx edx, cl
lea edx, [edx*2 - 0x4b76d180]
adc ebp, 3
xor eax, ebx
xchg ecx, edx
bt ecx, edx
lea eax, [eax + edx - 0x220e31e9]
bswap eax
shl dx, 0xc1
sar dx, 0x89
inc eax
add edx, 0x832fa230
or dx, dx
sar dl, 0x87
neg eax
or ecx, 0xb50e58b7
not ecx
lea eax, [edx + eax + 0x70dcd13c]
jae 0x61e4e6
dec edx
rol edx, 1
jmp 0x6ca0cd
mov byte [esp + 2], ah
not edx
xor al, al
ror edx, 1
ror eax, 0xfc
lea edx, [edx + eax - 0x185fb355]
movzx ecx, al
rol edx, 3
xor ebx, edx
add esi, edx
imul cx, word [esp + eax - 0x73fac009]
bt eax, ecx
pop ecx
jae fcn.007782c4
Function at 0x6b7b15
Capabilities:
Encode data using xor

Disassembly:
dec eax
ror eax, 2
lea ecx, [edx + edx*2 - 0x1bed5b5d]
push ecx
shl cx, cl
sbb eax, 0x9a8fba3e
sal dl, 0x85
jne 0x6c9392
rol eax, 1
call fcn.0072bf1a
xor edx, 0x933c13d
bt eax, 0x3e
bswap edx
lea edx, [edx + ecx*2 + 0x723a098a]
bswap edx
xor ebx, edx
sal eax, cl
jp 0x74e133
mov edx, 0xd60dc581
movsx ecx, dl
xor ecx, edx
mov dx, word [ebp + ecx*2 - 0x53e47400]
mov ax, word [ebp + ecx*2 - 0x53e473fe]
or cl, byte [ecx + ebp - 0x29f239fc]
add ebp, 4
shrd dx, ax, cl
jmp 0x6d826f
mov ecx, 0x772988a4
mov eax, 0x1527bda4
mov word [ebp + ecx - 0x772988a4], dx
lea esi, [esi + ecx - 0x772988a8]
mov eax, dword [esi + ecx - 0x772988a4]
bt ecx, 0xbe
xor eax, ebx
movsx edx, cx
jmp 0x77724e
adc edi, edx
movzx dx, byte [ebp + ecx*4 - 0x82e44]
bt ecx, ecx
add al, byte [ebp + ecx*8 - 0x105c86]
sar ecx, cl
lea ebp, [ebp + ecx + 1]
not dl
bts ecx, 0x3c
bt cx, 0x2e
sar cl, 0x82
not al
or dl, al
btr ecx, 2
movzx eax, cl
mov word [ecx + ebp - 0x10000000], dx
cwde
jae 0x67ff06
mov eax, dword [edi]
movzx cx, byte ss:[eax]
add edi, 2
mov eax, 0x1ab6d132
shl eax, 5
movzx edx, ax
mov word [eax + edi - 0x56da2640], cx
setb dl
push eax
mov ecx, dword [ebp + edx - 0x2601]
lea ebp, [eax + ebp - 0x56da263c]
call fcn.007624a1
bswap eax
rol edx, cl
btr ecx, 0x94
sbb eax, 0x91c0a92
bswap eax
btr cx, 0x39
not dx
neg eax
push ecx
push edx
xor ebx, eax
add edi, eax
bt dx, cx
mov dword [esp + ecx - 0x772988a4], edi
ret 4

Function at 0x6bc324
Capabilities:
Packed with generic packer

Disassembly:
add ax, ax
sbb edx, 0xe224cb32
mov dword [esp + eax - 0x7d561316], eax
bswap edx
movzx ecx, ax
not edx
btc eax, ecx
jae 0x725921
lea edx, [edx + ecx*4 - 0xb373705]
shl ecx, cl
not edx
sbb dword [esp + eax - 0x7d161316], 0x469a3c3f
jae 0x705548
dec ecx
xor ebx, edx
call fcn.006b7d55

Function at 0x6d02be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg al
setp al
add ecx, edx
mov dword [esp + eax - 0x5d2ebb00], 0x510ce591
mov dword [edi + eax - 0x5d2ebb00], ecx
call fcn.00422298
mov eax, 0x5d2ebbaf
lea edi, [edi + eax - 0x5d2ebbab]
jl 0x633e83

Function at 0x6d3080
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edx
bswap edx
shr cx, 0xe2
inc eax
setl al
xor ebx, edx
xchg ecx, eax
mov dword [esp + ecx - 0x34fc], ecx
call fcn.006f3ae2
call fcn.0079dae0
shr dl, 0xc2
xor eax, ebx
sar dx, 5
rol eax, 1
call fcn.006f989a
call fcn.00741aac
Function at 0x6da449
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebp + eax - 0x10c]
lea ebp, [eax + ebp - 0x108]
xor ecx, ebx
not ecx
inc ecx
movzx edx, ax
rol dword [ecx + 0xf], 1
mov bh, 0xd0
mov dword [esp + eax*2 - 0x214], edx
call fcn.006d3129
movsb byte es:[edi], byte [esi]
sbb byte [eax], ah
add byte [esi - 0x17b0db], dl
adc byte [ebx + 0x32], al
out dx, al
call dword [ecx + 0x39c1e4]
xor esp, dword [esi + 0x19]
pop ds
idiv bh
lahf
scasd eax, dword es:[edi]
jg fcn.006da449
push dword [edi + 0x351044]
inc esp
aam 0x81
sub byte [eax], al
xchg ebx, eax
dec ecx
je 0x6da4d8
inc eax
jo 0x6da45a
invalid
xchg byte [edx - 0x54975e35], cl
jo 0x6da52e
sub eax, 0x327649fe
cdq
dec esp
jbe 0x6da502
sbb byte [ecx + edx*4 - 0x67925b76], 0xd6
cmp al, 0x2b
ror byte [edi], cl
mov bh, 0xc2
adc eax, dword [edi + edx*2]
ror word [esp + edx + 5], 0x22
movsx ecx, dx
add eax, 0xcabf0f22
call fcn.0065787c
mov dh, 0xf8
nop
mov al, 0xfa
int1
mov eax, 0xd07d854b
sal dword [ebp - 0x16b03c86], cl
pop esi
pop eax
test dword [ecx - 0x317ab1cf], ecx
mov ch, 0x7a
ret
test esi, ecx
into
jo 0x6da564
mov edi, 0x49d4f67a
dec ecx
add eax, 0x57d8625e
inc eax
add eax, 0xb5414991
jp 0x6da4f9
or edx, dword [ebp - 0x7b]
mov edx, 0x89c2ec4e
xor dword [ecx + 0x12], esi
pop edi
push eax
xchg ebx, eax
xchg ecx, eax
push ds
sal bh, cl
jno 0x6da560
cmp esp, dword [edi]
jb 0x6da4b1
mov ebx, 0xa654cb2
cld
mov ah, 0x24
lahf
jp 0x6da4ee
aas
cmpsb byte [esi], byte es:[edi]
jmp 0x6da570
or byte [ebx - 0x64017ec8], bh
sti
mov ebp, 0x2f1f6028
sti
and bh, byte [ebx + 0x44]
invalid
jnp 0x6da5b6
xor dword [0xa0bcfb5a], esi
scasb al, byte es:[edi]
mov dword [esi + 0x7a88cfc3], ebx
xchg esi, eax
and eax, 0x79ef528f
invalid
cwde
cmp dword [ebx - 0x3b0f3b94], 0xffffffb9
mov eax, dword [0xb81737ee]
out 0x7c, eax
add eax, 0xf0668ffe
push es
jmp 0x1bf3189d

Function at 0x6dbff8
Capabilities:
Set environment variable

Disassembly:
dec ecx
not ecx
sal eax, 0xaa
lea edx, [eax + 0x1c39fca0]
adc ecx, 0x338b3aaa
mov dword [esp], edx
xor edx, edx
bswap ecx
call fcn.006d07d9

Function at 0x6ded9d
Capabilities:
Encode data using xor

Disassembly:
setns dl
neg eax
sar edx, 2
not byte [esp + ecx*2 - 0xe5be]
call fcn.00742376
lea esi, [esi + edx*2 - 0x1466994a]
jmp 0x727bf0
and eax, 0xfffffffc
and byte [esp + 7], 7
mov dword [esp], 0xbfa6fc91
sbb eax, ecx
mov esp, eax
call fcn.0072796f
rol edx, 0x86
jb 0x7a0989
mov edx, 0xa334ca4
push edx
jmp 0x66e7e1
neg eax
sub eax, 0xeaa4bfb8
or edx, edx
jnp 0x63f600
call fcn.007a1882

Function at 0x6e0f4a
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec cx
and eax, 0xd5b53526
mov dword [esp], eax
not cx
xor cx, 0x62a1
sar eax, 0xf2
xor bx, cx
call fcn.0072c83e
mov edx, 0x5fbe460e
lea esi, [esi + edx - 0x5fbe460a]
neg dl
lea edx, [ecx*8 - 0x216f6e53]
xor eax, ebx
sub dx, cx
dec eax
bswap eax
xor ecx, 0x6ea71f3c
not eax
lea eax, [eax + edx*8 + 0x46024429]
jle 0x77d8bf
call fcn.005f6eef

Function at 0x6ff5a0
Capabilities:
Encode data using base64

Disassembly:
movzx ecx, al
xor edx, 0x49b131b1
mov dword [esp + eax - 0x18aea0bd], ecx
cwde
rol edx, 1
and eax, ecx
inc edx
ror edx, 1
xor ebx, edx
call fcn.00740e9a
Function at 0x7062c0
Capabilities:
Encode data using xor

Disassembly:
adc ebp, 4
mov dword [esp], 0xcf8c6892
not dl
sal dx, 0xcf
xor eax, ebx
movzx ecx, dl
sub eax, 0xeab74311
neg eax
shl cx, 0x46
lea ecx, [ecx + ecx*2 - 0x656d87fd]
push edx
lea eax, [ecx + eax - 0x3e8afa6c]
mov dword [esp + 0xc], edx
not eax
neg cl
bswap edx
sal cx, 0xca
xor ebx, eax
sub cl, ch
bts edx, ecx
add esi, eax
or edx, 0xf738d1ba
setp cl
rol word [esp + 0x12], 0x4e
pop edx
pop edx
pop ecx
pop edx
pop eax
jp fcn.006d2c80
mov edx, 0x73117121
mov edx, dword [edi + edx - 0x73117121]
mov ecx, dword [edi + 4]
mov eax, 0x424101d
lea eax, [eax*2 + 0x4927188]
lea edi, [edi + eax*4 - 0x336a4700]
xchg ah, al
mov dword fs:[edx + eax*2 - 0x19b58522], ecx
lea ecx, [eax*8 + 0x4bbba1b0]
shl al, 0xe3
mov ecx, dword [ebp + eax - 0xcdac288]

Function at 0x711ee7
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, 0x87b227a3
bt dx, dx
sbb ecx, 0x6b143b1d
shr edx, 0x15
xor ecx, 0xf490a9b0
call fcn.006d0aac

Function at 0x71a175
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
jo 0x5aa57f
add dword [esp + 0x10], 0xff89830d
call fcn.005aa57b
pop eax
xchg bx, dx
pop ebp
push edx
not dword [esp + edx - 0x238c0f3b]
push edx
mov edx, dword [esp + ebx - 0x41da4185]
call fcn.0042c29d

Function at 0x7201fb
Capabilities:
Set environment variable

Disassembly:
je 0x6d1b20
push 0x45f3a0
push str.DNGTrialState
jmp 0x617e31
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x617e3f
jb 0x5f2fa8
xor ebp, ebp
cmp al, 0x1c
clc
sub ebx, ebx
cmp edi, ebx
jle 0x617e37
cmp ebp, ebx
jmp 0x5af89d
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp ebp, ebx
jne 0x7af617
mov dword [esi + 0x18], ebx
jmp 0x66a9d1
mov dword [esi + 0x54], ebx
jmp 0x6bc586
mov dword [esi + 0x1c], ebx
jmp 0x7af617
push 0x457a90
jmp 0x706459
push str.DNGTrialState
jmp 0x5c2aed
movzx ecx, word [esp + edx - 0x19c7338]
rol eax, 1
bswap eax
btr cx, cx
sal edx, 0xf2
xchg edx, ecx
inc eax
mov dword [esp + edx - 0x5d19], 0xf30810a8
not dx
xor ebx, eax
neg edx
imul dx, dx
sub edx, 0x57236e1d
adc ebp, eax
not dx
mov eax, dword [edi]
sal dl, 0xe7
lea edx, [ecx + ecx*8 + 0x32043cb6]
btr dx, 0x18
mov edx, dword [edx + edi - 0x66743cb2]
call fcn.006deb1c
je 0x5f2fa8
mov ebx, dword [esi + 0x68]
cmp sp, 0x1a0e
push 0
test ah, 0x38
add edi, 1
jmp 0x73a674
call fcn.0043d2bc
add esp, 4
cmp eax, ebx
jmp 0x5f2f9d
jmp 0x438f6d
nop
jmp 0x792c7c
Function at 0x72df28
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0xf3399a9], 0x518785bb
not eax
xor edx, ebx
lea edx, [edx + ecx - 0x4f68fc65]
sal eax, 0xce
push ecx
rol edx, 2
lea edx, [ecx + edx - 0x154ae42e]
mov dword [esp + ecx - 0xf3399a5], 0x49a63b03
ror edx, 2
cmp esp, dword [esi + 0x2cac149]
neg edx
xor ebx, edx
add esi, edx
lea edx, [eax + 0x3a9578b3]
add edx, dword [esp + ecx*2 - 0x1e67334f]
mov edx, dword [edi + ecx*2 - 0x1e673352]
shl ecx, 5
ror al, 0x41
mov cx, word ss:[edx]
lea edx, [eax*8 - 0x256f9ecf]
adc edx, eax
inc edx
adc edi, 1
xor al, byte [esp + 4]
imul eax
xchg edx, eax
mov word [edi + eax*2 - 0xe1c], cx
mov dword [edi + eax*2 - 0xe1c], ecx
sbb dword [esp + eax*2 - 0xe1b], 0x4439528f
call fcn.007991c9
dec ecx
push ecx
mov dl, 6
add byte [ecx - 0xd], cl
push ecx
sbb byte [ecx], dl
sub edx, edi
mov ecx, 0x58cc679a
jg 0x72df4c
out 0xd7, eax
jle 0x72df54
out 0x28, eax
sub byte [ecx + 0x1a], dh
jno 0x72dfdd
jle 0x72df96
in eax, dx
push esp
or al, 0x55
inc ecx
dec esi
xchg ecx, eax
or eax, 0x488d2c0f
pop edi
xchg byte [edx + esi*4 - 0x36170f1], dh
or al, 0xd0
or eax, 0x30b58d40
sub edi, dword [0x81a81025]
xor esi, eax
lea esi, [ebp + 0x253d2b30]
adc byte [eax - 0x39ce987f], ch
jno 0x72dfaa
rcl byte [eax + 0x1a8610ab], cl
adc esp, ecx
inc ecx
cmp edx, dword [ebp + 0x5f]
dec edi
adc dword [esi], ecx
xchg dword [edi + 0x55], ecx
je 0x72dfc1
jo 0x72dfc0
push 0xd
sub eax, 0x79425f92
sahf
mov ah, bl
or ah, dl
push ebx
cwde
loop 0x72e068
fstp dword [edx + 0x6921f5c0]
nop
cmc
and dword [ecx - 0x70], ebp
test al, 0xec
clc
inc edx
das
dec ebx
dec ebp
lea ebp, [ebp + 0x6a]
inc ebx
sub byte [edi + 0x484eadf9], al
mov edi, 0x6c98fee
sbb dword [edx + 0x44fd140b], 0xffffffb2
and dword [ebx + 0x129bf867], 0xfaa5f0f7
in al, 8
idiv byte [edx]
jno 0x72e014
xchg ecx, eax
rcl dword [ebx + edi + 0x2ccf970c], 0x98
inc edi
pop ecx
pop edi
or eax, dword [edx + 0x6e81a0ec]
stc
mov dl, 0xce
cmp eax, 0xf8deb9ac
js 0x72e06a
mov al, byte [0xc6f96e81]
ret 0x3dce
sub dword [esi - 7], 0x3dcec2c6
lodsb al, byte [esi]
mov ecx, 0x778f8de
jecxz 0x72e0dd
add dword [edx], eax
invalid
std
std
lds ebp, [eax + 0x2433ed92]
test byte [esi], ch
jnp 0x72e0cd
into
jle 0x72e05d
jge 0x72e056
jg 0x72e0d1
inc edx
mov ebx, 0x47e2a9e
push esi
push edx
xchg edx, eax
mov dh, 0xc6
push ebp
and byte ds:[eax], 0x70
test edx, eax
call 0x21f554ae
sbb esi, ebx
fldcw word [eax + 0x73a16e7f]
shr byte [ebx + esi + 0xe5e33ac], 1
cwde
pop ebx
xor byte [0x314f639d], cl
jp 0x72e055
xor eax, 0x80d63dff
inc esi
dec ebx
retf 0xb9d8
rol dl, cl
inc edx
enter 0xfffffffffffff2b4, 0xffffffffffffffbd
add byte [edi - 0x27a78799], cl
push ds
mov ah, 0xf2
mov ebp, 0x78678f00
pop eax
fcomp dword [esi]
pushfd
and ah, byte [ecx]
dec eax
adc dword [edi - 0x68], ebp
and dword [eax + 0x11], ecx
outsd dx, dword [esi]
cwde
insb byte es:[edi], dx
insb byte es:[edi], dx
cmp al, 0xfe
mov ah, bh
fstp dword [esp + eax*4]
out 0x1a, eax
cld
and dword [ebx - 0x68], edi
xchg al, ch
sub al, 0xc8
invalid