joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ba92e
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
bswap ecx
jae 0x6a4605
sal word [esp + eax - 0x29ff530b], 1
lea edx, [eax*4 - 0xb666c74]
dec ecx
imul eax
jno 0x7452a5
xor ebx, ecx
xchg dword [esp + edx - 0x6e3c73d], eax
add ebp, ecx
sub byte [esp + edx*4 - 0x1b8f1cff], 0xb9
or dl, ah
pop ecx
movzx cx, byte [edi + edx - 0x6e3c7cd]
xchg word [esp + edx*2 - 0xdc78f94], ax
mov al, byte [edi + edx - 0x6e3c7cb]
lea edi, [edi + edx - 0x6e3c7cb]
not edx
and dl, dh
adc cl, al
neg byte [esp + 4]
mov word [edi], cx
pop edx
pop ecx
jmp ebp
dec dx
mov word [ebp + edx - 0xffff], ax
lea eax, [edx*8 + 0x27b0b01b]
pop ecx
pop ecx
pop edx
jp fcn.005fcb00
sal eax, 0x47
sal dl, 0x25
xor cl, bl
xor cl, 0xb4
add cl, 0x93
rol cl, 1
dec cl
not cl
cdq
xor bl, cl
lea ecx, [esp + ecx + 0xc]
rol byte [esp + edx*4], 0x43
mov ax, word [ecx + edx*4]
imul edx, dword [esp + edx + 8]
lea ebp, [ebp + edx*8 - 2]
jae 0x5d2597
mov eax, 0xf81d83bb
btr eax, eax
bts eax, eax
mov dx, word [ebp]
movsx ecx, ax
mov cx, word [ebp + 2]
jae 0x6cd870
rol ecx, 1
xor ebx, ecx
add edi, ecx
rol dword [esp + edx*2 - 0x1d8], 0x2a
dec dword [esp + edx - 0xea]
push edx
lea esi, [edx + esi - 0xef]
movzx ecx, byte [esi + edx - 0xee]
jae 0x638926
mov edx, 0xdf9f3499
call fcn.005e475f
mov ecx, 0xb50ebe31
rol cx, 0xcb
push ecx
ror dl, 0x46
ror ecx, 3
inc ecx
rol al, 0x27
jb 0x68f50b
shl al, 0xe1
sub ax, 0x78ae
adc ebp, 2
sal eax, 3
and dx, cx
movzx ecx, al
not dx
not ecx
sub ax, 0x2a30
btr cx, cx
mov word [ebp], dx
sbb esi, 3
call fcn.00605947
sub al, al
neg edx
not edx
jmp 0x70010b
xor ebx, edx
not eax
add edi, edx
mov eax, dword [ebp]
mov dl, byte [ebp + 4]
add ebp, 6
bts ecx, 0x81
shr cl, 0xe3
sbb cl, cl
mov byte ss:[eax], dl
lea edx, [ecx*4 - 0x46fb2af9]
call fcn.006c7b40
call fcn.0066dd77
sal ecx, cl
neg cl
lea edx, [edx + ecx - 0x24ce3f6f]
call fcn.00658268
mov edx, 0xd4bb4da2
lea eax, [edx + edx - 0x6cee4457]
movzx ecx, al
lea esi, [esi + eax - 0x3c8856f1]
shl eax, cl
or ecx, 0xa0aaef86
setns al
mov ecx, dword [esi + eax*4 - 0x2b768000]
sbb edx, eax
xor ecx, ebx
mul eax
bt edx, edx
setae dl
rol ecx, 1
bswap ecx
shr dl, 0x44
cdq
shr dl, 0xe6
xor ecx, 0x8e96b686
bswap ecx
div dl
sub ecx, 0x2e17a283
xor ebx, ecx
bts dx, dx
adc ebp, ecx
btr edx, 5
lea edx, [edx + 0x430af691]
lea esi, [esi + edx - 0x430af59d]
movzx edx, byte [edx + esi - 0x430af59c]
btr eax, eax
xor dl, bl
movsx ecx, al
sub dl, 4
neg dl
inc dl
add ecx, ecx
lea eax, [ecx + ecx - 0x28e5d800]
ror dl, 1
neg ecx
xor al, ch
cwde
xor bl, dl
lea edi, [eax + edi - 0x2802]
bts ax, ax
or al, 4
mov word [edi + eax*8 - 0x14028], dx
call fcn.005d57c6

Function at 0x5bab4f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not ecx
not eax
sal dl, 0x47
mov dword [esp + edx], edx
and ecx, eax
call fcn.0070380f

Function at 0x5bf671
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol edx, 3
sal eax, 0x22
bts ecx, eax
mov dword [esp + ecx - 0x18000100], ecx
xor edx, 0x3c071d29
cwde
call 0x708678
Function at 0x5bf6a5
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0xf92baeae
mov word [eax], cx
call fcn.0070de2f
jae 0x5f9f45
mov dx, word [ebp + eax - 0x49a19206]
ror eax, 0xed
jb 0x710fd9
xchg byte [esp + ecx*2 - 0x64c7e7fd], dl
neg eax
rol word [esp + ecx - 0x3263f3ff], 0x4d
ror eax, 1
sal byte [esp + ecx - 0x3263f3ff], 0x26
xchg dword [esp + ecx - 0x3263f3ff], ecx
xor ebx, eax
call fcn.00728a0b
mov edx, dword [esi]
add esi, 4
mov ecx, 0x7489ddb0
xor edx, ebx
shr cl, 0xe5
neg edx
inc cx
rol edx, 1
shl ecx, cl
movzx eax, cl
xor edx, 0xf72fdc10
ror cl, 0x26
xadd eax, ecx
xor eax, 0x920822b4
not edx
push ecx
xor ebx, edx
add ebp, edx
cwde
mov ecx, edi
movzx edx, byte [esp + eax*8 - 0x319b0]
ror dx, 0xa1
lea edi, [edi + eax*2 - 0xc670]
shr edx, 1
mov dword [eax + edi - 0x6336], ecx
neg dword [esp + eax*2 - 0xc66c]
mul byte [esp + eax - 0x6335]
pop edx
jb fcn.006d5934
mov edx, 0xc13028b7
movzx ecx, dx
mov edx, dword [edi + ecx*4 - 0xa2dc]
mov eax, ecx
shl ax, 0x6e
mov cl, byte [edi + ecx - 0x28b3]
btr ax, ax
add eax, 0xb49ab188
adc edi, 2
sal edx, cl
lea ecx, [eax*2 - 0x517c4af6]
and cx, cx
mov dword [edi + ecx*4 - 0x5eea6068], edx
mov edx, 0xe62b712f
push ecx
btc edx, ecx
lea ebp, [ebp + ecx*4 - 0x5eea606c]
inc byte [esp + ecx*4 - 0x5eea6067]
mov ecx, dword [ebp + ecx*2 - 0x2f753034]
ror al, 0xa7
jne 0x63afff
sbb ecx, ecx
xor ebx, eax
push ecx
add dx, dx
jnp 0x729876
ror dx, 0x45
xor ecx, ebx
lea eax, [edx + eax*2 + 0x61acd706]
rol ecx, 1
pop edx
xor ecx, 0xa1176f07
rol eax, 0xec
jb 0x6e995f
setae dl
not ecx
lea edx, [eax + eax + 0x1782ef37]
xadd eax, edx
lea ecx, [edx + ecx - 0x1baec630]
and ax, ax
xor ebx, ecx
btc edx, eax
jb 0x6552f3
sub dl, dl
adc esi, ecx
movzx ecx, ax
and dx, 0x1724
jp 0x409e8e
adc ebp, 1
add cx, dx
neg eax
mov edx, eax
xor dx, dx
mov word [eax + ebp - 0x6fbdb2f4], cx
sub ax, ax
movzx ecx, dx
xor ecx, dword [esi + eax - 0x6fbd0000]
lea esi, [esi + eax - 0x6fbcfffc]
neg eax
xor ecx, ebx
cwde
neg ecx
sub dl, dl
js 0x71ea34
dec ecx
cdq
lea edx, [eax*2 + 0x4e2b3202]
bswap ecx
xor al, 0x25
neg edx
xor ecx, 0xd8218926
xor ebx, ecx
not dx
add edi, ecx
jmp edi
add ebp, eax
pop edx
xor cl, ch
xor edx, dword [edi + ecx*2]
or cl, byte [edi + ecx*2 + 4]
add edi, 2
mov eax, 0x8118fb12
shr edx, cl
mov ecx, 0x8116811
sal eax, cl
rol al, 0x83
mov dword [edi + ecx*2 - 0x1022d022], edx
not ax
jmp ebp

Function at 0x5c0b3d
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi]
add esi, 4
call fcn.00704335

Function at 0x5c7e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, 0x52a15534
bswap ecx
pop eax
neg edx
movsx eax, cx
inc edx
bswap edx
call fcn.0072fdbf
btr eax, edx
xor ebx, ecx
lea edx, [edx + edx*8 + 0x27af5bae]
jmp fcn.00430fba
Function at 0x5ca56b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
inc dword [esp + edx*4 - 0x83e90]
xor ebx, eax
and cx, word [esp + edx - 0x20fa4]
ja 0x5fd877
bswap eax
mov dword [esp + edx - 0x20fa4], edx
lea eax, [eax + edx*4 - 0x5dc6c810]
or dl, 0x32
setne dl
btr edx, edx
rol eax, 2
xadd dword [esp + ecx*8 - 0x207d200], edx
and ecx, dword [esp + edx - 0x20fa4]
jne 0x5a3c05
mov eax, dword [esi]
mov edx, 0xceac0a92
jmp 0x74bc26
adc edi, eax
jmp 0x6b9346
mov dword [esp + edx*8 - 0x107d20], edi
ret
jmp 0x611c92

Function at 0x5cb24a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x73a0db23
mov dword [esp + eax - 0x73a0db23], eax
mov ecx, edi
shr eax, 0x23
imul al
lea edi, [edi + eax*8 - 0x73a13882]
inc byte [esp + eax*2 - 0x1ce84e1f]
mov word [edi + eax - 0xe742710], cx
pop ecx
lea ebp, [ebp + ecx - 0x73a0dc27]
call fcn.007577bc

Function at 0x5cf4f2
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
neg ebp
rol ebp, 2
neg ebp
rol ebp, 3
mov dword [esp], 0xc92f013d
dec ebp
lea esp, [esp + 4]
call fcn.006143f0

Function at 0x5d0ef8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bts cx, dx
inc dl
pop ecx
pop edx
pop ecx
pop eax
js fcn.006d5934

Function at 0x5d5f7b
Capabilities:
Encode data using xor

Disassembly:
inc edx
call fcn.00741bf3
mov ax, word [edx + ecx*8 - 0x179c8]
lea ecx, [ecx + ecx*4 - 0x12cde846]
adc esi, 2
shr cl, 0x42
mov word [esi], ax
mov edx, dword [ebp]
movsx eax, cl
lea ebp, [ebp + eax*2 - 0x66]
lea ecx, [ecx + eax + 0x25bee634]
jne 0x6702c5
xor edx, ebx
inc al
sub ecx, ecx
xor edx, 0x18471bf
shl cx, 8
not edx
call fcn.005bb7de
push es
wait
sub eax, 0xc18280b5
das
mov ch, 0xdd
invalid

Function at 0x5d5fe9
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
shld edx, eax, cl
mov ecx, 0x3a2cc484
movsx eax, cx
call fcn.0072b710

Function at 0x5d734b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
ror ecx, 3
mov dword [esp], 0x70851734
sub ecx, edx
cbw
idiv dl
neg ecx
call fcn.0066c267

Function at 0x5d7363
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg al
lea eax, [eax - 0x75d2f680]
pop eax
pop ecx
jge fcn.006d5934

Function at 0x5dbbb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea edx, [edx + eax*2 - 0x69050500]
push ecx
not edx
shr ecx, 0x81
inc edx
ror edx, 3
xor al, 0xa7
call fcn.005e9ac5

Function at 0x5dbbcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [edx + esi - 0x1c2e6100]
mov dword [esp + eax*8], 0xada958a3
lea esi, [esi + eax*4 + 4]
xor edx, ebx
lea edx, [edx + eax*4 - 0x6f2e8033]
jmp 0x750ee7
Function at 0x5dc16b
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov dword [edi + ecx*2], edx
movzx eax, cl
lea ebp, [ebp + ecx*2 - 4]
sal byte [esp + ecx + 0xb], 0x85
cbw
mov edx, dword [ebp + ecx]
xor edx, ebx
or word [esp + ecx + 5], ax
ror edx, 1
ror dword [esp + ecx*4 + 8], 0xb
cbw
neg edx
mov dword [esp + ecx], eax
jmp 0x6a14e6
inc byte [esp + ecx + 3]
add esi, edx
push ecx
pop ecx
pop ecx
pop eax
pop eax
pop eax
jmp fcn.005ff9ea
dec edx
cwde
sub al, ah
not edx
xor byte [esp + ecx + 7], ch
lea edx, [edx + ecx*2 - 0x7db91230]
neg al
push eax
xor ebx, edx
jmp 0x65ef3c

Function at 0x5dc849
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
rol edx, 2
not edx
cwde
xor ebx, edx
dec cx
add edi, edx
lea eax, [eax + ecx + 0x3d2a0a13]
mov dword [esp + ecx - 0xde31], ecx
dec dword [esp + ecx - 0xde31]
mov ecx, ebp
call fcn.00629c25

Function at 0x5dce81
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc ebp, edx
pop edx
pop edx
pop edx
pop ecx
pop edx
jmp fcn.006d5934

Function at 0x5ddac1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push edx
push edi
pushfd
mov edi, 0xd7b3d71f
mov dword [esp + 0xc], 0x7fae60f1
mov edi, dword [esp + edi*2 + 0x509851c6]
mov edx, 0xc3882925
test dh, dl
setbe dl
add edx, 0xb5a1a585
cmp dl, 0x1b
lea edx, [edx*8 + 0x26850e9c]
not dl
not edx
mov edx, dword [esp + 8]
call fcn.005b76e8

Function at 0x5e0703
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor eax, ebx
movsx edx, cx
sar dx, 0xe5
shr dx, cl
rol eax, 3
neg dx
mov dword [esp], edx
shl dword [esp + 1], 0x62
adc eax, 0x3c1319b6
dec byte [esp]
not eax
call fcn.00600043
Function at 0x5e2ad6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esi + edx*2 - 0x50]
mov dword [esp], eax
xor edx, ebx
mov ecx, 0x6b137939
rol edx, 1
pop ecx
call fcn.005f7f56
or dx, cx
shr edx, 0xba
lea esi, [esi + edx*2 - 0x4a]
xadd ecx, edx
mov ecx, dword [esi]
mov eax, edx
sbb ax, 0x1e20
push edx
xor ecx, ebx
jmp 0x5f0f48
xor al, bl
add al, dl
sal edx, cl
xor al, 0xab
shl cl, 0x63
sbb al, 0xb2
rol al, 1
push ecx
shl edx, 0x70
xor bl, al
sar dx, 0xa
lea eax, [esp + eax + 4]
jbe 0x6673f0
inc eax
ror ecx, 1
and al, dl
xor ecx, 0x55b2ad00
not ecx
cdq
or dl, ah
push eax
rol ecx, 3
lea ecx, [edx + ecx - 0x1f543f6d]
cdq
neg ax
xor ebx, ecx
add edi, ecx
xchg word [esp + 6], dx
movsx ecx, ax
neg edx
pop ecx
pop ecx
jne fcn.005fcb00
mov ecx, 0xd32346ad
xor ecx, ecx
shl cx, 0x8d
lea ebp, [ebp + ecx*8 - 4]
mov edx, ecx
movsx eax, dx
adc eax, dword [ebp + ecx*2]
xchg ch, dl
sub cl, 0x3c
xor eax, ebx
ror eax, 2
xor ecx, edx
xor eax, 0x380eec2c
dec eax
jmp 0x70e14c
call fcn.00754559
mov ecx, dword [edi]
mov eax, 0x7c250182
lea edx, [eax*4 - 0x566738eb]
mov eax, dword [edi + eax - 0x7c25017e]
add edi, 4
xor edx, edx
and ecx, eax
call fcn.0067ce39
jno 0x73e4f8
not eax
and ecx, 0x5a1d7887
and cl, 0x1c
xor ebx, eax
bt edx, 0xbb
inc dl
adc esi, eax
sub ebp, edx
lea eax, [edx + edx*4 + 0x24810927]
movzx eax, byte [ebp + ecx*2 - 8]
jmp 0x5e640b
xor ebx, ecx
xadd edx, eax
cwd
cwde
adc edi, ecx
lea ecx, [edx + edx*2 + 0x6a10df3c]
xor eax, edi
jmp eax

Function at 0x5e58db
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x202b44b3
mov dword [esp + eax*2 - 0x40568966], eax
sub dx, 0x619b
rol dx, 1
xor dx, 0x63a0
mov ecx, 0xdb103f90
bts cx, 0xa8
call fcn.0062eb89

Function at 0x5e5903
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ax, word ss:[edx + eax - 0x47c]
movsx edx, cx
call fcn.00697678

Function at 0x5e8906
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 4], 0x50b1e2a9
rep movsb byte es:[edi], byte [esi]
mov edi, 0x84a2a287
add di, 0x7314
push dword [esp + 8]
popfd
mov esi, dword [esp + 0xc]
lea edi, [edi + edi*8 + 0xb3dda12]
pop edi
mov edi, dword [esp + 0xc]
lea esp, [esp + 0x10]

Function at 0x5e8b5d
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
bswap eax
sub ecx, edx
add dword [esp + 4], 0xba3dfe92
call fcn.006e9fa0

Function at 0x5eeb88
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0x7109728c
mov edx, dword [esi]
mov eax, dword [esp]
xor edx, ebx
sar cx, 0xe
not ecx
not edx
call fcn.00613543

Function at 0x5eec4e
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], edi
call fcn.0068ce20
sal edx, 0x39
adc edi, eax
xor dx, word [ebp + edx*2 - 0x78000000]
mov eax, 0x6787be80
call fcn.00748f15
mov ecx, 0x35a811b1
mov eax, ebp
bt ecx, 0xb
mov edx, ecx
lea ebp, [ecx + ebp - 0x35a811b3]
mov word [ebp + edx*2 - 0x6b502362], ax
adc edx, 0xdb84b088
lea esi, [ecx + esi - 0x35a811b5]
mov ecx, dword [ecx + esi - 0x35a811b1]
call fcn.0066342e
Function at 0x5eeca2
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + edx - 0x40e3bbad], ecx
rol byte [esp + edx - 0x40e3bbab], 0xc3
sbb eax, 0xd50bb195

Function at 0x5ef2f7
Capabilities:
Read file on windows

Disassembly:
ror cx, 1
xor dword [esp + edx*2 - 0x7e7dfff4], edx
not cx
idiv ax
bts ax, ax
xor cx, 0x8c9b
add cx, 0x1987
xor cx, 0x7612
xor edx, eax
mov dword [esp + edx - 0x40c11d79], eax
dec cx
xor bx, cx
shr dx, 0x2e
shr edx, 0x26
lea edi, [edi + edx - 0x1030402]
mov word [edi + edx*2 - 0x2060800], cx
bts eax, 0x2b
mov ecx, eax
call fcn.006fc739

Function at 0x5f063b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [esp + 4], 0x28461900
lea esp, [esp + 4]
call fcn.006b8afb

Function at 0x5f064d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x438ce7
call fcn.00416c44
jmp edi
xor edx, ebx
not eax
bts ax, 0xf
mov dword [esp], ecx
sbb edx, 0x81a43081
rol ecx, 0xfa
xor edx, eax
sal eax, 0x7c
pop ecx
sbb edx, 0x36377930
lea ecx, [eax + ecx + 0x42884808]
bswap edx
ror ecx, cl
xor edx, 0x2c2e7683
sub eax, ecx
shr cx, cl
sbb edx, 0xd8114015
ror cl, cl
sal cx, 0xc
xor ebx, edx
bts ecx, ecx
push ecx
lea edi, [edi + ecx*2 - 0x10600006]
jae 0x6cad33
xor ecx, eax
xor dl, bl
push eax
ror dl, 1
shr eax, 0x2b
rol ax, 1
sbb dl, 0x8b
xor dl, 0x26
dec ecx
sub dl, 0xa
add ecx, 0xc8b18a11
btr ax, 0x23
xor dl, 0x33
shl cl, 0xe4
cwde
xor bl, dl
sar eax, 0xe1
lea edx, [esp + edx + 4]
and al, ch
jbe 0x4389ac
movzx ax, byte [edx + eax*4 - 0x8428]
sbb edi, 2
inc cl
mov word [edi], ax
call fcn.0067c4f7
mov edx, 0x36882496
movzx ecx, dl
mov edx, dword [edi + edx - 0x36882496]
lea edi, [edi + ecx*2 - 0x128]
call fcn.00627cd9
mov word [edi + eax*2 - 0x50], dx
jmp ebp
add dword [esp + ecx - 0x8300001], eax
xadd word [esp + ecx*2 - 0x10600002], cx
mov dword [edi + ecx - 0x8307db9], edx
jle 0x696f4e
pop ecx
jg fcn.006d5934
mov eax, 0xc909d502
movzx edx, byte [esi]
jmp 0x705d25
movzx ecx, ax
lea esi, [esi + ecx*4 - 0x35407]
jmp 0x66d0d8

Function at 0x5f114d
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [esp + edx*4 - 0x40], ecx
mov eax, dword [edx + ebp - 0x10]
call fcn.00672e75

Function at 0x5f115a
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ax, word [ebp + 2]
call fcn.006dd849

Function at 0x5f1b8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.005b5da8
mov eax, 0xff938c21
fild dword [ebp]
bt eax, eax
jae 0x712a4f
lea ecx, [eax + eax*2 + 0x30ff838]
mov ecx, dword [esi + ecx*4 - 0x72a726c]
movsx edx, al
sal dx, 5
lea esi, [esi + edx*8 - 0x20fc]
adc edx, eax
mul dl
dec eax
xor ecx, ebx
inc ax
cmovl edx, eax
lea ecx, [eax + ecx - 0x1d7fdfbf]
mul al
adc eax, edx
rol dl, 0x84
not ecx
bswap ecx
sar al, 0x64
dec ecx
xor ecx, 0x79207d1b
bswap ecx
push eax
inc edx
push edx
xor ebx, ecx
and byte [esp + 6], ah
btc ax, ax
shl ax, 0xe1
add edi, ecx
pop ecx
pop ecx
jmp edi
Function at 0x5f1ba3
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx edx, ax
neg eax
lea esi, [esi + edx - 0x2024]
mov dword [esp + edx - 0x2028], eax
dec dword [esp + edx - 0x2028]
xor ecx, ebx
bswap ecx
cwde
neg eax
sar dl, 0x24
ror ecx, 3
bswap ecx
call fcn.0073375a

Function at 0x5f6b48
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea ecx, [edx + ecx*8 - 0x4d65bc80]
xor bl, al
lea eax, [esp + eax + 0x18]
mov edx, dword [eax]
mov dword [esp + 8], ecx
sub edi, 4
mov dword [edi], edx
pop edx
pop eax
pop eax
pop ecx
pop eax
pop ecx
jmp fcn.005ff9ea

Function at 0x5f7f95
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and cl, al
movzx eax, dl
add al, dl
not cl
mov dword [esp + edx - 0x5952], edx
mov dword [esp + edx*8 - 0x2ca90], edx
mov word [edi + edx*2 - 0xb2a4], cx
xadd word [esp + edx*4 - 0x16547], dx
js 0x709714
mov dword [esp + edx - 0x59], ebp
ret
not eax
btc dx, 5
rol eax, 0x22
xor ecx, 0xfa06aa98
lea ecx, [ecx + edx*2 - 0x32547f50]
bswap ecx
not ecx
xor ebx, ecx
sal edx, 0x2d
lea edi, [edx + edi - 0x319be004]
mov dword [edi + edx*2 - 0x6337c000], ecx
mov ecx, edx
inc edx
lea ebp, [edx + ebp - 0x319be005]
mul cl
mov eax, dword [edx + ebp - 0x319be001]
push ecx
sar ecx, 0x44
xor eax, ebx
lea eax, [eax + ecx - 0x5f9da005]
or dword [esp + edx - 0x319be001], 0xb39bd625
pop edx
rol eax, 1
sal ecx, 0x31
bswap eax
jp 0x721d16
add ebp, ecx
mov ecx, dword [edi]
mov ax, word ss:[ecx]
mov dword [esp], edx
add edi, 2
xchg byte [esp + 2], dh
mov word [edi], ax
pop ecx
jmp ebp
call fcn.0064d011
Function at 0x5f8ca9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, eax
mov ecx, dword [esi + ecx - 0x60a56ee1]
btc edx, edx
xor ecx, ebx
add ecx, 0x4023d619
dec edx
cmovno ax, dx
rol ecx, 1
and edx, 0x7891c1ad
cdq
add dx, dx
xor ecx, 0xfe0634ae
imul edx, edx
xor eax, 0xd591c4a8
and al, ah
bswap ecx
inc edx
xor ebx, ecx
add edi, ecx
bts dx, dx
rol al, 0xc2
mov eax, dword [ebp + eax*2 - 0x7002f2c2]
push edx
jb 0x6edeaf
or dword [esp + eax*2 - 0x46f08d11], 0x978c4638
lea edi, [edi + eax*2 - 0x46f08d28]
sal word [esp + eax - 0x2378467c], 0x64
and eax, dword [esp + eax - 0x23784684]
mov dword [edi + eax*2 - 0x420], ecx
js 0x69b48b
lea ecx, [edx*8 - 0x556bc2e3]
pop ecx
pop eax
pop ecx
pop eax
pop ecx
pop edx
jge fcn.006d5934
mov edx, 0xb9055f92
mov edx, dword [ebp]
mov ecx, 0x6d07a38a
movsx eax, cl
lea ebp, [ebp + ecx - 0x6d07a386]
xor edx, ebx
xor edx, 0x18471bf
dec eax
not edx
ror ecx, cl
neg edx
bswap edx
dec cx
bswap eax
dec edx
rol edx, 3
xor ebx, edx
add edi, edx
btc ecx, ecx
xchg cx, ax
mov eax, dword [esi]
mov cx, word [eax]
mov eax, 0x55313693
jb 0x726933
mov ecx, 0x60a56e1e
not cl
lea esi, [ecx + esi - 0x60a56ee5]
lea eax, [ecx + ecx*8 - 0x784027f8]
jmp 0x5e9be5
lea edx, [ecx + ecx - 0x4ce7d471]
bt edx, edx
lea esi, [ecx + esi - 0x5bcb2b9]
bswap edx
mov edx, dword [esi + ecx*8 - 0x2de595a8]
movzx eax, cl
sar eax, 0xa3
xor edx, ebx
neg edx
ror edx, 3
xor edx, 0x64a6dc28
or eax, ecx
adc edx, 0xef3dbe97
sub cx, cx
setns al
ror edx, 2
bt eax, 0x17
bts ecx, 0x90
xor ebx, edx
call fcn.00614308
lea ebp, [ebp + edx*2 - 0x46]
xchg word [esp + edx - 0x25], dx
mov dword [esp + edx - 0x25], eax
push edx
bts edx, edx
mov dword [esp + edx*4 - 0x94], 0x269e3bae
push dword [esp + 4]
popfd
mov dword [esp + edx - 0x25], edi
ret 4
xor eax, eax
lea esi, [esi + eax + 2]
cbw
mov edx, eax
lea eax, [eax - 0x6ffa2c59]
mov word [esi + edx*4], cx
or edx, edi
jmp edx
Function at 0x5f9a0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + eax - 0x630e9aef], 0x8420581c
not ecx
and byte [esp + edx - 0x8980ffe], al
dec ecx
inc eax
xor ebx, ecx
and edx, dword [esp + edx - 0x8981000]
sal dl, 0x47
setns byte [esp + eax - 0x630e9af0]
adc edi, ecx
jmp 0x642c32
mov dx, word [esi + eax - 0x630e9af0]
rol ax, 0xa9
cbw
lea esi, [eax + esi - 0x630e0033]
movzx ecx, al
movzx eax, byte [eax + ebp - 0x630e0035]
bswap ecx
shl cl, 0xe4
lea ebp, [ebp + ecx*2 - 0x69ffffff]
xor al, bl
ror ecx, 9
shr cx, 0x86
dec al
ror al, 1
sub al, 0x11
ror cl, 0x67
call fcn.00604b39
mov edx, 0x3058b29
push edx
mov ecx, dword [edx + ebp - 0x3058b29]
movsx eax, dx
dec dword [esp + edx - 0x3058b29]
xor ecx, ebx
inc ecx
bts edx, eax
cwde
neg ecx
shr dword [esp + edx - 0x3058b29], 0x8a
ror eax, 0xb0
xor ecx, 0xdac2221
pop eax
call fcn.005d7292
mov ecx, 0x19999401
mov ax, word [ecx + edi - 0x19999401]
lea ecx, [ecx*8 + 0x74207484]
mov cx, word [ecx + edi - 0x40ed148a]
add edi, 2
mov edx, 0xe62814b9
add ax, cx
push edx
mov word [edi], ax
mov eax, 0x3c148b2e
movzx ecx, word [esp + eax*2 - 0x7829165c]
lea esi, [esi + ecx*8 - 0xa5cc]
mov edx, dword [eax + esi - 0x3c148b2e]
xor eax, dword [esp + eax - 0x3c148b2e]
pop eax
lea eax, [eax + ecx*4 - 0x584719d3]
xor edx, ebx
jmp 0x6185a7

Function at 0x5f9c9b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + ecx*2 - 0x46010], ecx
xor bl, dl
mov dword [esp + ecx - 0x23004], ecx
lea edx, [esp + edx + 8]
mov word [esp + ecx*2 - 0x4600b], cx
add al, byte [edx + ecx - 0x23008]
lea edx, [ecx + ecx*2 + 0x742582ba]
lea edi, [edi + ecx*8 - 0x118042]
mov word [edi + ecx - 0x23008], ax
movzx eax, cl
sub dl, ah
mov ecx, dword [esi + ecx*2 - 0x46010]
lea esi, [esi + eax*4 - 0x1c]
setae dl
xor ecx, ebx
xor ecx, 0xd10c8517
jmp 0x64a156
or dword [esp + eax*2 - 0xc], 0x1d944634
lea ecx, [ecx + edx - 0x30f6fa4a]
sal word [esp + edx - 0x742c11ff], 0x28
rol ecx, 1
bts ax, ax
lea ecx, [ecx + eax*8 - 0x3caad3c9]
sub dword [esp + eax - 0x104], eax
cdq
not ecx
not word [esp + edx + 6]
btc dx, dx
xor ebx, ecx
jmp 0x7210ed
sal byte [esp + edx], 0x66
bswap eax
adc ebp, ecx
movzx ecx, al
div word [esp + edx*2 + 4]
btc eax, eax
pop eax
pop ecx
jae fcn.006d5934
ror dword [esp + eax], 0x79
push eax
lea edi, [edi + eax + 4]
dec word [esp + eax*8 + 4]
sbb word [esp + eax*8 + 5], ax
not ecx
not edx
and ecx, edx
call fcn.006ca0f9

Function at 0x5ff25d
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
call fcn.005cfbd3
mov eax, 0xd002b497
mov eax, dword [ebp]
mov edx, 0xfe8a8e0a
ror edx, 0x4d
lea ebp, [ebp + edx - 0x7057f450]
jae 0x6cf8e2
mov cl, byte [ebp + ecx - 0x672c6c9e]
push 0x7abbe702
adc ebp, 4
call fcn.0061601e
jmp 0x7289c5
or edx, 0xb26421a
bt edx, 0xb6
xor eax, ebx
neg edx
xor eax, 0xc2031b95
dec edx
neg eax
jmp 0x63c7e0
sub eax, 0x368ba38c
rol dx, 0x28
movsx ecx, dl
rol eax, 2
and ecx, edx
call fcn.006dca62
Function at 0x6010ce
Capabilities:
Encode data using base64

Disassembly:
xor ebx, ecx
add esi, ecx
neg byte [esp + eax - 0x1a283f84]
mov ecx, 0x253fb438
mov edx, dword [eax + edi - 0x1a283f8b]
mov eax, dword [edi + eax - 0x1a283f87]
call fcn.005acde1

Function at 0x60429d
Capabilities:
Check for time delay via gettickcount

Disassembly:
ror edx, 0xfd
xor ecx, ebx
neg edx
jle 0x7004a6
ror ecx, 1
call fcn.0065ac73
mov ecx, 0xe10dfb39
movsx eax, cx
movzx edx, cx
mov edx, dword [edi + edx*2 - 0x1f672]
dec ecx
movzx ax, byte [edx]
add edi, 2
mov word [edi], ax
mov ecx, dword [esi]
mov eax, 0x5e3e56bc
lea edx, [eax*2 - 0x78fafb4f]
rol eax, 0x43
lea esi, [edx + esi - 0x4381b225]
jae 0x5ccb83

Function at 0x604a65
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor bl, al
inc dword [esp + ecx - 0x7ffffff1]
lea eax, [esp + eax + 0x10]
mov dword [esp + ecx - 0x7ffffffd], ecx
movzx cx, byte [eax + ecx - 0x7ffffffd]
push 0xe215d70f
sal word [esp + 6], 0x4a
jbe 0x6796d7
sbb edi, 1
shr word [esp + 4], 0xaa
mov word [edi], cx
pop ecx
pop eax
pop ecx
pop edx
pop eax
jp fcn.005ff9ea