joyce8/EMBER2024-capa huggingface dataset:
Function at 0x623013
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
sub esi, 2
jmp fcn.0041b0e7
lea ecx, [ecx + eax - 0x1f7fd1e9]
rol ecx, 1
sub ecx, 0xbdb8830b
movsx edx, ax
mov dword [esp], 0x4bf11b5
not ecx
xor ebx, ecx
bts edx, 0x1d
rol ax, 0x23
cwde
adc ebp, ecx
mov ecx, 0xea2ccc1c
jmp 0x5b453e

Function at 0x62c5f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp]
xor edx, ebx
mov ecx, 0x6b97eeaf
mov dword [esp + ecx - 0x6b97eeaf], 0x2e8f27b8
xor edx, 0xa5bda724
sar dword [esp + ecx - 0x6b97eeaf], 0x8b
shl ecx, cl
rol edx, 1
call fcn.005d2bba
clc

Function at 0x6326fc
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp]
and eax, eax
call fcn.00661036
lea ebp, [eax + ebp - 0x788bbf85]
lea edx, [eax*2 - 0x32cd62fe]
mov eax, dword [ebp + eax - 0x788bbf81]
xor eax, ebx
mov dword [esp], 0xe60c8322
rol eax, 2
jmp 0x6cff18

Function at 0x6327f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edx
pop edx
jmp fcn.006e9493
call fcn.00415120
sub edi, edi
lea esi, [ebx + 0x80]
jmp 0x6a0330
dec dword [esp + 4]
bswap edx
xor ebx, edx
add edi, edx
jmp 0x6ef7a2
mov edx, dword [eax + ebp - 0x5fb69ebe]
mov dword [esp + ecx*2 - 0x1d116da0], eax
lea ebp, [ebp + eax - 0x5fb69eba]
jg 0x6b1cb5
jne 0x748910
mov ecx, edi
lahf
cwde
mov eax, esi
jmp 0x5e7409
xor edx, 0x589eec0a
jmp 0x5fba62
xor byte [esp + eax - 0x5fb69ebe], ah
xor edx, ebx
sub ax, ax
push ecx
shl word [esp + ecx*2 - 0x1d116d9d], 0xea
lea edx, [edx + ecx*2 - 0x4a1f5628]
ror ecx, cl
bt cx, ax
bswap edx
or eax, ecx
and al, byte [esp + 2]
sbb edx, 0xefbf79b1
idiv byte [esp]
rol edx, 1
rol ecx, cl
jae 0x64bad3
jmp 0x5a97c7

Function at 0x63b70e
Capabilities:
Get file version info

Disassembly:
jno 0x697cb1
jne 0x697ca4
mov ecx, 0x9d17740b
jmp 0x66821b
mov ax, word [esi + 2]
mov cl, byte [esi + 4]
call fcn.0061f9c6
jb 0x6a2f9d
mov ecx, dword [esp + ecx*4 - 0x4e0a522c]
push dword [esp + 4]
popfd
lea esp, [esp + 0x14]
call fcn.005b2b1c
lea esp, [esp + 4]
sar si, 0x8e
test esp, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmc
jmp 0x60296e
call 0x4276db
mov eax, 0xf321308f
movsx ecx, ax
mov ecx, dword [esi + ecx*2 - 0x611e]
lea edx, [eax*2 + 0x311c1016]
dec ax
lea esi, [edx + esi - 0x175e7130]
ror eax, 0x96
adc eax, eax
xor ecx, ebx
push edx
xchg word [esp + eax*8 - 0x4c23bcc8], ax
lea ecx, [ecx + eax*8 + 0x66e7bb07]
neg ecx
inc dx
sal dl, 0x41
or dl, dl
bswap ecx
dec eax
cwde
sbb ecx, 0xca844232
jmp 0x714b38
adc ebp, 3
shr dword [esp], 0x67
shrd dx, ax, cl
mov word [ebp], dx
mov ecx, dword [esp]
mov dword [esp + ecx - 0x14be80d], edi
ret
xor ebx, ecx
sub word [esp + eax*2 - 0xe264], dx
inc eax
add edi, ecx
mov ecx, edx
mov dx, word [ebp + eax*4 - 0x1c4d0]
xor word [esp + eax*2 - 0xe268], ax
ror eax, cl
mov ax, word [eax + ebp - 0x4d00001a]
dec ecx
shr cl, 0x44
mov cl, byte [ecx + ebp - 0x175e7102]
jns 0x6fce97
Function at 0x64a589
Capabilities:
Read file on windows

Disassembly:
rol eax, 3
sub eax, 0x5196b193
not eax
pop edx
mov edx, 0xf1127332
rol eax, 1
xor ebx, eax
add ebp, eax
movzx ecx, dl
lea eax, [ecx + edx - 0x27799b5d]
mov edx, dword [edi + ecx*2 - 0x64]
call fcn.0060b2ae

Function at 0x666695
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [eax + ebp - 0x6fffaa29]
call fcn.006247d0
mov edx, 0x2500b182
sub edx, edx
mov ecx, edx
mov eax, dword [edi + edx*2]
adc cl, 0xa6
dec cx
mov cl, byte [edi + edx*4 + 4]
sub edx, edx
inc dx
lea edi, [edi + edx*2 + 4]
mov byte ss:[eax + edx*8 - 8], cl
movzx eax, dl
mul dx
mov eax, dword [ebp + edx*2]
movzx ecx, dx
push edx
lea ebp, [ebp + edx*2 + 4]
add dword [esp + edx*8], edx
add ecx, edx
xor eax, ebx
ror eax, 3
call fcn.007081dd
jle 0x5d5db6
mov eax, dword [esi]
mov ecx, 0xcb27c8a4
ror cl, 0x87
adc esi, 4
bt cx, 2
xor ecx, 0x67b5ebb7
xor eax, ebx
not cx
neg eax
not cx
inc cl
neg cl
dec eax
sub ecx, ecx
rol cl, 0x61
neg eax
xadd cl, ch
xor ecx, ecx
ror eax, 1
shl cl, 0x45
neg cx
jg 0x70bba5
lea eax, [eax + ecx + 0x7d1c62b1]
bswap eax
jb 0x73fea9
ror ecx, 0x42
sar ecx, 0x4b
sbb eax, 0xb926c0a4
sar ecx, 0x9b
sar cl, 5
adc cl, cl
rol eax, 2
xor cx, cx
adc eax, 0xa4377806
not cx
inc cl
neg eax
xor ebx, eax
add ebp, eax
ror ecx, 0xf7
mov ecx, dword [edi + ecx - 0x1fe0000]
push 0x71bb049a
mov eax, dword [edi + 4]
inc byte [esp + 1]
call fcn.0074a3fa
mov eax, 0x160715b4
shr al, 0xc2
lea esi, [esi + eax - 0x16071529]
movzx edx, ax
lea eax, [eax*2 + 0x2d232a95]
xor ecx, ebx
sar edx, 0xa6
ror ecx, 1
bt eax, edx
btr edx, 0x17
btr edx, eax
dec ecx
lea eax, [edx*2 + 0x6c2f060a]
bts edx, eax
cbw
not ecx
and eax, edx
dec ecx
shl edx, 0xa7
rol ecx, 2
xor ebx, ecx
shl edx, 0xb9
adc edi, ecx
lea ecx, [edx + edx*8 - 0x45ff1bf9]
shr dl, 0xc2
call fcn.005f0f62
mov ecx, dword [esi]
jmp 0x73c541

Function at 0x6699d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esp, esi
pop ebp
mov esi, 0x5ab4a535
pop edi
movsx edx, si
sub edx, 0xc02aca87
popfd
xchg esi, edx
pop esi
push edx
mov ebx, edx
pop eax
pop eax
jmp 0x74e862
btr eax, eax
mov edx, dword [ebp + edx*4 - 0x3c4]
xor edx, ebx
not cl
bt eax, 0xa6
jb 0x5ec68b
dec edx
sub eax, 0x71e1d34
cwde
jg 0x745259
pop eax
pop edx
pop eax
jmp loc.0042bd51
sar cx, 0x2b
adc edx, eax
pop eax
not cl
mov eax, ecx
mov dword [eax + esi - 0x6723ff0f], edx
bt eax, eax
neg ecx
lea ebp, [eax + ebp - 0x6723ff13]
movsx edx, cx
jnp 0x60fd0f
pop edx
push ebx
not ebx
mov ecx, dword [esp + 4]
not ebx
mov ebx, dword [esp + ebx - 0x5ab4a52d]
lea esp, [esp + 0xc]
ret
Function at 0x66addc
Capabilities:
Get file version info

Disassembly:
mov edx, 0x422855be
ror edx, 0x99
lea ebp, [edx + ebp - 0x142adf1d]
xor eax, ebx
sub eax, 0xea12ca89
mov ecx, edx
imul cx, dx
jo 0x5d9040
bswap eax
dec eax
or dl, ch
push ecx
rol eax, cl
neg dword [esp + edx - 0x142adfa3]
sal cx, cl
neg ecx
inc eax
or dword [esp + edx*4 - 0x50ab7e8c], 0x9305423b
pop ecx
xor ebx, eax
shl cl, 0x23
not edx
add edi, eax
neg cl
movsx eax, cx
mov edx, dword [esi + eax - 0x7f08]
mov ecx, dword [esi + eax - 0x7f04]
call fcn.00642da9
lea ecx, [ecx + edx*4 - 0x55058e9b]
neg ecx
pop eax
shr eax, 0xf0
div dl
rol ecx, 1
bt eax, 0x84
mul ax
mul dl
not ecx
call fcn.005a6070
mul ecx
call fcn.006c1bdb
mov eax, 0xee2be338
mov eax, dword [ebp]
jmp 0x5a91d5

Function at 0x678700
Capabilities:
Execute anti-debugging instructions
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jp 0x68a3f5
bswap edx
jb 0x71e68c
mov ecx, dword [edi + 4]
call fcn.005ca481
mov ecx, 0x178c868d
rol cl, 0x24
mov edx, 0x5184559a
mov edx, dword [ecx + ebp - 0x178c86d8]
movsx eax, cx
sbb cl, ch
xor cl, 0x93
mov cl, byte [ebp + ecx - 0x178c86bd]
adc ebp, 2
shr edx, cl
shr eax, 0x10
mov dword [ebp + eax - 0xffff], edx
lea ecx, [eax - 0x7acea1c5]
mov edx, eax
lea edi, [edi + eax*4 - 0x40000]
jb 0x5c3b2b
sub esi, 4
mov edx, 0x78ba762f
mov ecx, dword [esi + edx - 0x78ba762f]
xor dl, dh
movsx eax, dx
xor ecx, ebx
btr edx, eax
mul eax
setae al
xor ecx, 0xfc12419f
not ecx
bts eax, eax
neg eax
bswap ecx
add eax, 0x5e8c6381
je 0x716241
xor eax, edx
xor ecx, 0x6132bf0c
jmp loc.0042062b
ror cl, 1
sub dword [esp + edx*8 - 0x32fff9], 0x1a35e481
lea eax, [edx*8 + 0x7f368601]
not cl
pop edx
add ax, word [esp + edx - 0x30]
rol cl, 1
inc cl
cwde
shr byte [esp + edx - 0x2f], 0x23
xor bl, cl
lea ecx, [esp + ecx + 8]
inc eax
cmovge eax, edx
mov dx, word [edx + ecx - 0x33]
mov ecx, dword [esp + 3]
lea ebp, [ecx + ebp - 0x1f99044d]
sal byte [esp + ecx*4 - 0x7e641127], 0x45
call fcn.005ec748
sub edi, 1
push 0xcc39cf0a
movzx ecx, byte [edi]
mov edx, dword [esp]
mov dword [esp + 4], edx
xor cl, bl
shr edx, 0x9a
push edx
adc cl, 0x16
rol edx, 0xed
jae 0x667b2c
mov eax, 0x9ea4a389
mov eax, dword [edi]
push 0x37279a93
jmp 0x64abc9
idiv ax
add edx, dword [edi + eax*2 - 2]
sal cx, 0xa6
xor edx, ebx
lea edx, [eax + edx + 0x203d5985]
bswap ecx
jmp 0x739936
fild dword [edi + eax - 0x4d96]
rol cx, 0x63
mov edx, dword [ecx + esi - 0x2a916cb2]
push ecx
lea esi, [esi + ecx - 0x2a916cae]
sbb cl, al
xor edx, ebx
or al, ch
dec edx
cwde
bswap eax
rol edx, 3
sar eax, cl
sbb edx, 0xf69e9102
sar word [esp + ecx*2 - 0x5522d837], 0x8b
xchg cx, ax
call fcn.005d2252
push eax
dec ecx
xor ebx, edx
call fcn.006a6bf7
add eax, eax
bswap edx
btr ecx, 0xa7
inc eax
not edx
jb 0x5da6e0
Function at 0x67cbad
Capabilities:
Check for time delay via gettickcount

Disassembly:
inc eax
xor ebx, edx
sal ecx, cl
adc ebp, edx
movsx edx, ax
or dword [esp], edx
mov eax, dword [edi]
btr dx, 0x8f
mov dx, word [edi + 4]
call fcn.0061b93e
mov eax, dword [esi]
add esi, 4
movzx edx, cl
bswap edx
xor eax, ebx
ror dx, 0xe8
xor eax, 0x473b30b1
neg eax
sub eax, 0x7aae981e
inc edx
jno 0x7072f3
shl cx, 0xd
or cl, byte [edi + ecx - 0x40001ffc]
mov dword [esp], 0xa9a5e015
call 0x5b59a1
mov edx, 0x2d196e2a
lea edx, [edx + edx*4 - 0x78f4cb50]
lea esi, [edx + esi - 0x688a5b86]
mov edx, dword [esi + edx - 0x688a5b82]
push 0xd5b0d235
xor edx, ebx
mov ecx, dword [esp]
not edx
rol edx, 3
and byte [esp + 2], ch
jae 0x6a9994
not edx
and eax, 0x96f0e
add ax, ax
ror edx, 1
xor cx, word [esp + ecx - 0x45999e10]
adc dword [esp + eax*8 - 0xe020], 0x2a263c16
lea eax, [ecx*2 + 0x129f0993]
sbb edx, 0xaa169fa0
sar al, 4
shr byte [esp + ecx - 0x4599db88], 0xa1
neg edx
bt ecx, eax
jb 0x5bc509
jmp 0x73bc96
js 0x73645e
lea edx, [edx + edx - 0x2342a56a]
mov word ss:[eax], cx
shr word [esp + 2], 0x6e
push edx
pop edx
pop eax
jmp ebp
rol eax, 2
rol cl, 0xc3
or cl, 0xbb
inc cx
xor ebx, eax
ror edx, 0xc6
xchg cl, dl
ror dx, 0x2a
adc ebp, eax
mov edx, dword [edi + edx - 0x4683f00]
movsx eax, cx
not eax
shl al, 3
mov cx, word [edi + 4]
push eax
add dword [esp], 0x4d0b6e99
adc edi, 5
mov word [edx], cx
pop eax
jmp ebp
not edx
sbb byte [esp + 2], 0x1a
inc edx
xor ebx, edx
add ebp, edx
mov eax, dword [edi]
movsx edx, cx
add dl, dh
neg cx
mov cx, word [edi + 4]
btr dx, dx
adc edi, 6
jmp 0x6aaa2a
mov ecx, 0xec33421a
jmp 0x60ed22

Function at 0x67d592
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
adc edi, eax
neg cl
bts cx, dx
jmp edi
xor edx, ebx
add cl, al
adc al, cl
shl cl, cl
ror edx, 1
call fcn.00747528
or byte [esp], ch
adc esi, 4
ror edx, cl
neg cx
xor eax, ebx
bt edx, ecx
xchg ecx, edx
and byte [esp + 1], ch
not eax
sal ecx, cl
shr cx, 0xc2
ror eax, 3
xor eax, 0x1798d40e
dec eax
bt edx, ecx
neg eax
ror ecx, 0x31
sal byte [esp + 1], 0xe6
xor ebx, eax
pop ecx
sub dx, dx
jle 0x5f7dc1
call fcn.005d9f52
mov edx, dword [ebp]
add ebp, 4
mov ecx, 0xfe1ce193
mov eax, ecx
jmp 0x615d7a

Function at 0x6801fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg eax
neg edx
mov dword [esp + ecx - 0x1f], 0xd9be9c8b
btr cx, cx
dec eax
rol ecx, cl
mov dword [esp + edx - 0x63fbffdd], ecx
not eax
and edx, ecx
sar dx, 0x48
xor ebx, eax
dec ecx
jl 0x6bf10f
mov ecx, dword [edi + ecx - 0x67203e26]
call fcn.00625ea1
setl cl
add ebp, eax
xadd byte [esp + edx], cl
not dword [esp + edx + 1]
push ecx
mov dword [esp + edx*2], ebp
ret 0xc
Function at 0x68649d
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xor edx, ebx
xor eax, eax
ror edx, 1
bswap edx
neg eax
movsx ecx, al
xor edx, 0xeb116006
jmp 0x6ef9f6
btr eax, 0x1b
adc esi, 3
movsx edx, al
xor ecx, ebx
shr eax, 0xee
inc al
xor ecx, 0xe63f089d
not ecx
not ax
jmp 0x6b754d
adc esi, 1
xor dl, bl
add eax, dword [esp]
neg dl
xor dl, 0x1f
or eax, eax
push eax
call fcn.006176a5
call fcn.0066a1fb
btc edx, 0x13
add esi, ecx
sal edx, 0x57
ja 0x697273
jmp esi
rol cx, 0xc9
sbb eax, 0x7e139bb7
btr ecx, 0x35
shl ecx, cl
dec ecx
xor ebx, eax
rol edx, 0xf6
adc esi, eax
mov eax, dword [ebp + edx*2 - 0x263558a8]
xchg edx, ecx
dec cx
lea ebp, [ebp + ecx - 0x131aac4f]
jno 0x7036c9
mov eax, 0x4b439b3
movzx ecx, al
bts eax, eax
mov cl, byte [eax + edi - 0x4bc39b3]
mov dl, byte [edi + eax - 0x4bc39b1]
lea eax, [eax + eax*4 - 0x59eedb78]
adc edi, 2
inc ax
add al, al
adc cl, dl
mov word [edi], cx
movsx edx, al
mov eax, dword [esi + edx*2 - 0x20]
lea esi, [esi + edx*2 - 0x1c]
lea ecx, [edx*2 - 0x5aee1efd]
add dx, cx
shl cx, 0xa1
xor eax, ebx
lea ecx, [ecx + edx + 0x6d10b899]
xor eax, 0x8a9b8a81
xor dl, 0x2d
lea eax, [eax + edx - 0x762e4051]
xor eax, 0xd6af2012
neg eax
call fcn.0064db0c
mov ecx, 0xe8b6c418
mov cl, byte [edi + 8]
call fcn.00627a02
mov ecx, 0x1c3f8aac
mov eax, dword [ebp + ecx*2 - 0x387f1558]
movsx edx, cx
xadd cx, dx
lea ebp, [ebp + ecx - 0x1c3f1554]
push ecx
jnp 0x733b1a
adc ebp, 5
mov byte [edx], al
mov eax, 0x98a15225
mov ecx, dword [esi]
jmp 0x5d33be
inc ecx
btr dx, dx
call fcn.00677e82
imul edx, edx
ror eax, 1
dec word [esp + edx - 1]
neg eax
not eax
sub dword [esp + edx*2 - 2], ecx
xor ebx, eax
xor dx, word [esp + edx]
lea edi, [edi + edx - 0xe556]
jne 0x71ccdb
xor eax, ebx
mov dword [esp + edx - 0x7fffffff], edx
inc eax
jmp 0x6de846
pop ecx
sal ecx, 0x83
mov dword [edi + edx*4 - 0x39548], eax
js 0x71973a
jae 0x729a8b
call fcn.005ed47a
cwde
jns 0x67101b
xor eax, ebx
or edx, ecx
push edx
bswap eax
rol eax, 1
inc eax
call fcn.005bf2a7
mov eax, 0xb4848fbc
mov edx, dword [esi]
and eax, 0x25326a00
lea esi, [eax + esi - 0x240009fc]
jae 0x5cbda1
push eax
jmp 0x718a67

Function at 0x68be13
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + edx - 0x10041], 0x3132d8a4
rol ecx, 3
xor ebx, ecx
neg dword [esp + edx - 0x1003d]
add ebp, ecx
cdq
neg byte [esp + 4]
call fcn.006c1f45
not eax
lea eax, [ebx + 0x380]
movsx ebx, bp
lea ebx, [ebp - 0x20]
jmp 0x5ab497

Function at 0x69bfdc
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + ecx - 0x6b9b5e88], 0xe73ae831
mov cl, byte [esi + edx - 0x5e86]
call fcn.005cfad8
mov ecx, 0x7faa1907
lea ebp, [ebp + ecx - 0x7faa190b]
jmp 0x676840
Function at 0x6b8f1a
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
lea edx, [ecx + edx - 0x50ffe0aa]
sal ecx, 0xcb
mov dword [esp + ecx*2 - 0x103af000], eax
pop eax
not edx
je 0x6f5020
sar eax, 0x79
sal ax, 0xa3
ror edx, 2
xor edx, 0x2528faaa
btr ecx, eax
neg edx
ror ax, 4
xor ebx, edx
shr ax, 0x26
jns 0x708eae
mov edx, 0xbd344207
movzx eax, dl
mov edx, dword [eax + edi - 7]
mov eax, dword [eax + edi - 3]
mov ecx, 0x2ab04983
mov ecx, dword [edi + ecx*2 - 0x556092fe]
push 0x5aab7534
inc byte [esp + 2]
call fcn.007505ce
sub edi, 1
jmp 0x725c87
adc ebp, edx
mov edx, 0x758d86b6
not dl
mov eax, dword [ecx + edi - 0x81d7800]
not cx
mov edx, dword [edi + ecx*8 - 0x40ec3ff4]
lea edi, [edi + ecx*8 - 0x40ec3ff0]
shr ecx, cl
mov dword ss:[ecx + eax], edx
lea eax, [ecx*4 + 0x209c7fb5]
lea edx, [eax + ecx*4 - 0x426121f2]
add ecx, ebp
jmp ecx
jmp 0x433e7c

Function at 0x6b93b8
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
lea ebp, [eax + ebp - 0x7d3494fc]
mov dword [esp + eax - 0x7d349500], eax
lea edx, [eax + eax*2 + 0x383f59a8]
xor ecx, ebx
bswap edx
call fcn.006cc1d5

Function at 0x6c9cf8
Capabilities:
Get file version info

Disassembly:
push eax
call fcn.0043d5d0
mov ebx, eax
test ch, dl
add ebx, 1
jmp 0x721bb8
jbe 0x6a305e
push eax
jmp 0x617269
push 0
movzx edx, bp
seta dl
lea edx, [ebp]
push edx
jmp 0x73e871
call fcn.00439fc3
add esp, 4
mov ebx, eax
movzx edx, cx
setl cl
mov dword [ebp - 0x24], ebx
push ebx
mov ecx, dword [ebp + 0x484]
push ecx
cmovge dx, cx
jmp 0x6127ed
call fcn.0043b4f9
add esp, 4
sets ah
mov eax, esp
mov dword [ebp - 0x24], 0
movsx ax, ch
cbw
xchg al, al
push 0x5c
movsx eax, bx
lea eax, [ebp]
jmp 0x5abef2
mov dword [esp + ecx - 0x4c6a59], ebp
ret
mov dword [esp + edx - 0x6238a020], edx
add ebp, eax
shr ecx, 0x29
lea edx, [ecx + edx*4 - 0x3e501b44]
jp 0x6b3279
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp + 0x484], eax
test eax, eax
jmp 0x5fe13d
mov dword [ebp - 0x84], ebx
push ebx
call fcn.0044da3b
add esp, 0xc
and cl, 0xb
mov eax, ebx
mov dh, 0xa6
adc edx, edi
lea edx, [eax + 1]
mov cl, byte [eax]
clc
cmp esp, 0x3f3c5402
jmp 0x41eddb
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x6a305e
push ebx
jmp 0x6a3042

Function at 0x6e3537
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol eax, 1
and word [esp + ecx*2 - 0x564020ba], cx
pop edx
dec eax
mov edx, ecx
pop edx
bswap eax
bswap ecx
call fcn.00741474
Function at 0x6e5bba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [edi], cx
sar dx, 0xc8
mov edx, dword [esi]
mov ecx, dword [esp]
jns 0x6a04f3
adc esi, 4
call fcn.00645182
jl 0x64db82
mov esi, dword [esp + 0x14]
movsx dx, dh
mov dh, bh
xor al, bl
dec al
bts edx, ecx
mov dword [esp + edx - 0x618b0001], ecx
ror al, 1
lea edx, [ecx + edx + 0x3b386239]
not al
inc al
xadd dword [esp + ecx - 0x618b93e0], ecx
dec ecx
sub ecx, edx
not al
not dl
xor word [esp + ecx - 0x633c9dc4], 0x532
rol al, 1
lea ecx, [ecx*8 + 0xd865927]
sar ecx, cl
sbb al, 0xa5
neg dx
shl byte [esp + ecx - 0x4ed4], 0x46
sbb byte [esp + ecx - 0x4ed3], dh
xor bl, al
lea eax, [esp + eax + 4]
rol dx, 0x49
sub dx, 0x8737
movzx cx, byte [ecx + eax - 0x4ed6]
lea edx, [edx*8 - 0x677b5d59]
sbb edi, 1
jmp 0x5ae70c

Function at 0x6e874f
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
btr ecx, ecx
mov eax, dword [esi + ecx - 0x440f4095]
jae 0x721c56
call fcn.0071b39e
not ecx
mov eax, 0x47aa6f28
ror ecx, 1
movsx edx, ax
xadd word [esp + edx*4 - 0x1bc9f], dx
dec ecx
call fcn.005c3899
mov esi, 0x46117f8e
pushfd
sar si, 0xe3
jbe 0x72069d
mov ecx, 0x442f4095
jmp 0x5c7283
mov dword [esp], 0xe00b7c9b
mov dword [esp], edi
mov edi, 0x1b138783
push esi
jmp 0x68b17b
btr edi, edi
mov edi, eax
cld
push 0x610b6588
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp]
push dword [esp + 4]
popfd
mov esi, dword [esp + esi - 0x610b6580]
mov edi, dword [esp + 0xc]
lea esp, [esp + 0x10]
mov esi, edx
jnp 0x6fe536
dec eax
rol dword [esp + 4], 0xe8
add word [esp + 6], dx
xor eax, 0x7e88171b
sub word [esp + 4], dx
inc dx
jle 0x729d39
rol eax, 3
xor ebx, eax
sal ecx, cl
neg edx
add edi, eax
ror word [esp + edx - 0xaffff], 0x2e
mov dword [esp + edx*8 - 0x580000], edi
ret 4

Function at 0x6f37ac
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], ecx
xchg dword [esp + 1], ecx
mov edx, dword [ebp]
mov dword [esp + 8], ecx
dec cx
and eax, 0x244c8900
or byte [esi - 1], ah
leave
adc ebp, 4
xor edx, ebx
call fcn.006d656f
rcl edi, cl
js 0x6f37b5
inc dword [esp + ebp*8 - 0x2222001f]
psraw mm3, qword [eax + eax]
jge 0x6f3808
ljmp 0xf6c6:0x77650015
cmpsb byte [esi], byte es:[edi]
out dx, eax
inc eax
sub eax, dword [edi + edi*8 + 0x7dcab22]
in al, 0x64
shr byte [0x2fa1e417], 0x93
pmulhuw mm1, qword [edi - 0x1d]
or al, 0x9d
std
sbb esp, dword [edx]
mov eax, 0x8be40e24
arpl word [esp], ax
adc ebp, ebp
sbb eax, 0x5c041be0
pop eax
hlt

Function at 0x6fcd09
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + edx - 0x400000], ebp
ret 8
cwde
sub ecx, eax
and dword [esp + edx*2 + 8], 0xe0b25ab9
xor ebx, ecx
bts edx, 0x36
btc eax, eax
adc ebp, ecx
lea ecx, [edx + edx*4 - 0x1ec9f47b]
sub ax, dx
jge 0x5bb562
idiv eax
add word [esp + edx], ax
neg ecx
not byte [esp + edx*4 + 8]
jmp 0x61948c
sub ecx, 0x893c3f88
not ecx
btr ax, 0x8e
mov dword [esp + edx], eax
rol ecx, 1
jmp 0x636d60
Function at 0x6ff40e
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xor ebp, edx
movsx edx, ax
mov edi, esi
add eax, 0x298f801
movzx ecx, ax
jle 0x74224b
sal ecx, 0xc4
neg edx
xor ebx, edx
inc word [esp + ecx*2 - 0x440be]
sar ecx, 0xb3
adc ax, 0x7885
add edi, edx
add dword [esp + eax*4 - 0x56012218], eax
jp 0x6581cf
pop ecx
jnp fcn.005d0be1
bt dx, 0xa
bswap eax
xor eax, 0x5d282eb5
mov dword [esp], 0xbe07e30c
sub dword [esp], edx
rol eax, 1
xchg byte [esp], dl
or cl, 0x26
lea eax, [ecx + eax - 0x5f5e594f]
bts edx, ecx
dec dx
xor ebx, eax
add edi, eax
call fcn.0064fb56
mov eax, 0xf12d998d
mov edx, dword [esi]
movzx ebp, al
sar ebp, 0x8e
lea esi, [esi + ebp + 4]
jns 0x6b15c3
mov eax, 0x99b7ab7
jmp 0x7327ca
bswap edx
call fcn.00608930
mov eax, 0xfd9bc98a
mov edx, dword [ebp]
shr eax, 0x64
bt eax, 0x97
lea ebp, [ebp + eax - 0xfd9bc94]
movsx ecx, ax
lea ecx, [eax + eax*4 - 0x706739cb]
cmovb eax, ecx
xor edx, ebx
call fcn.00662077
pop ecx
pop edx
jmp esi
lea ebp, [ebp + eax - 0x99b7ab3]
xor edx, ebx
lea ecx, [eax*2 + 0x652c4e0f]
lea ecx, [ecx + ecx*2 - 0x36da396f]
sal ecx, 0x37
not edx
and ax, ax
not eax
ror edx, 1
shl ax, 0x66
sub ecx, ecx
lea edx, [edx + ecx*2 + 0x33b81582]
bswap edx
xor ebx, edx
call fcn.0068bbcf
mov eax, 0xc480f93b
mov edx, dword [esi]
cbw
neg eax
movzx ecx, al
lea esi, [esi + eax - 0x3b7fffc1]
xor edx, ebx
rol ax, cl
jb 0x71491c
mov word [esi + ecx*8 - 0x19030], dx
cdq
btc edx, eax
mov edx, dword [ecx + ebp - 0x3206]
shr ax, cl
cbw
lea ebp, [ecx + ebp - 0x3202]
bt ax, 0x3e
btc cx, 0x8c
xor edx, ebx
ror edx, 2
sub edx, 0x843d2b19
and eax, 0x7da0d00b
not edx
push ecx
ja 0x6e4269
Function at 0x700ef6
Capabilities:
Get file version info

Disassembly:
dec eax
mov dword [esp + 4], ecx
xor ebx, eax
sar ecx, cl
lea edx, [ecx + 0x3e175dab]
setae cl
add esi, eax
mov dword [esp + edx*2 - 0x7c2d00c2], ecx
mov ax, word [edi + edx*2 - 0x7c2d00c2]
neg ecx
and cx, 0x3dae
call fcn.0074ee30

Function at 0x706b9d
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea ebp, [ebp + edx - 0xf81a]
bt ecx, edx
lea ecx, [edx + ecx*4 - 0x4ec02fd3]
mov word [ebp + edx*4 - 0x3e060], ax
lea eax, [edx + edx*2 - 0x42655fc6]
cwd
pop edx
pop eax
pop eax
jae fcn.006d770b

Function at 0x70939c
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
sub eax, 0x8ab0d792
ror eax, 3
movsx ecx, dl
and edx, 0xf916e60f
xor ebx, eax
push edx
add ebp, eax
dec edx
mov ax, word [edi]
jne 0x649908
mov dword [esp + eax*2 - 0x42023f3e], ecx
ror edx, 1
shl ecx, cl
sbb byte [esp + eax*2 - 0x42023f3d], ch
bswap edx
sub byte [esp + eax*2 - 0x42023f3d], 0xbf
rol edx, 1
dec edx
bswap edx
xchg word [esp + eax - 0x21011f9f], cx
xor ebx, edx
inc dword [esp + eax - 0x21011f9f]
shr ecx, cl
or eax, 0x539b0db0
adc esi, edx
movzx edx, ax
mov edi, dword [eax + edi - 0x739b1fbf]
sar dword [esp + eax - 0x739b1fbf], 0xc
lea ecx, [ecx + edx*2 - 0x29cb1e5b]
pop eax
jae fcn.006051f4
jmp 0x5f1f3b

Function at 0x71217e
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
not ecx
or cx, cx
mov eax, ecx
lea esi, [esi + eax - 0x78eba24d]
btr cx, 0x26
call fcn.0060f65c
rol dword [esp + ecx*4 - 0x10a172dc], cl
jae 0x5d7876
cmp ebp, 0x2527a9aa
mov di, 0xf907
adc esi, eax
mov eax, dword [ebp + ecx - 0x4285cb7]
xchg word [esp + edx*4 - 0x115f33], cx
add dl, dh
mov ecx, dword [ecx + ebp - 0x4287ffe]
shl dword [esp + edx - 0x45724], 0x1f
lea ebp, [ebp + edx*4 - 0x115c88]
adc dword [esp + edx - 0x45724], edx
mov dword [eax + edx*8 - 0x22b920], ecx
movzx ecx, dx
inc edx
mov dword [esp + edx*8 - 0x22b928], esi
ret
not eax
call fcn.0065e4f2
mov edx, 0x106f580
mov eax, edx
mov eax, dword [ebp + edx - 0x106f580]
and dx, 0x589a
mov edx, dword [ebp + edx*2 - 0x20ca0fc]
mov ecx, 0x42913b13
ror ecx, 0xc3
imul ecx, ecx
mov cl, byte [ebp + 8]
push 0x74aeed3e
push 0x27070f1b
adc ebp, 5
shrd eax, edx, cl
mov edx, dword [esp + 4]
mov dword [ebp + edx - 0x74aeed3e], eax
lea edi, [edi + edx - 0x74aeed42]
and dword [esp + edx - 0x74aeed3e], edx
mov ecx, dword [edx + edi - 0x74aeed3e]
jo 0x5a7fe6
call fcn.006f86f5

Function at 0x714d99
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
movsx eax, cl
sbb dl, 0x91
inc ecx
not dl
call fcn.00677699
dec dl
add al, ah
sub eax, 0x8ea25616
call fcn.0066bb82
mov ecx, 0x78050b9f
call fcn.00648cf3
mov word [ebp], dx
mov dword [esp], eax
call fcn.005e28f8
movzx edx, byte [ebp]
mov ecx, 0x3a211c35
lea ebp, [ebp + ecx*2 - 0x74423869]
xor dl, bl
sub cx, cx
jbe 0x60a0e7