Function at 0x6e828c
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Read file on windows
Resolve function by parsing pe exports

Disassembly:
lea eax, [esp + 0x1be8]
movzx ebx, si
mov edi, 0x1fc1b16
movsx edi, dx
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [0x5007b4]
xchg edi, edi
movsx edi, dx
mov edi, edx
jmp 0x72be38
lea esi, [ebx + 0x78]
jmp 0x5f13a4
je 0x71ca9e
mov eax, dword [esp + 0x14]
mov dword [eax], 2
jmp 0x6544f3
jne 0x6cfe67
mov edx, dword [esp + 0x14]
shr eax, 0x55
or ah, 0xf4
bsf ax, cx
mov dword [esp + 0x1bf0], 0xffffffff
xor cx, di
sar al, 0xdb
mov eax, dword [esp + 0x1c]
rcl cx, 0xe8
or ecx, ebp
add eax, 0xfffffff0
mov dword [edx], 2
sbb ch, 0x90
bts cx, dx
bt ecx, 0x80
lea ecx, [eax + 0xc]
or edx, 0xffffffff
test bx, bp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x757a1a
mov dword [ecx], 3
jmp 0x686630
test eax, eax
jmp 0x6c8842
mov ecx, dword [esp + 0x10]
movzx edx, sp
mov dl, 0x98
mov ecx, dword [ecx + 0x80]
push ebx
movzx edx, di
mov dh, 0x6d
mov edx, eax
jmp 0x6c2c2a
push ecx
jmp 0x6f1ba8
or edx, 0xffffffff
lock xadd dword [ecx], edx
jmp 0x6dce78
mov dword [ebx + 0x80], eax
jmp 0x57afa3
jbe 0x70ddb7
mov edx, ecx
jmp 0x70ddb7
mov dword [edi], 0
jmp 0x6086ed
mov dword [esp + 0x1bf8], 0
jmp 0x768968
call eax
lea eax, [eax + 0x10]
movzx cx, ch
sub si, 0x2336
xor si, di
mov dword [esp + 0x1c], eax
btr ecx, 8
adc si, si
xadd esi, esi
mov ecx, dword [esp + 0x18]
push 0x4e9080
add ecx, 0x55c
bswap esi
push ecx
jmp 0x558fa2
call fcn.0045028b
add esp, 0xc
test ch, bh
cmp dword [esi], 0
jmp 0x686624
call fcn.0068ab6b
imul ebx, ebx, 0x2c
jmp 0x57ddef
call fcn.0044fddd
mov esp, ebp
mov bp, sp
pop ebp
jmp 0x75f3f6
jmp 0x6629a5
lea ecx, [esp + 0x1c]
jmp 0x686310
call fcn.00432e51
mov ebx, dword [esp + 0x14]
add esp, 4
xchg ecx, ecx
jmp 0x41e0c7
push 4
push edi
call fcn.00451cce
lea esp, [esp + 0x10]
clc
test eax, eax
jmp 0x5595bf
push ebx
jmp 0x664741
cmp ecx, ebx
jbe 0x685030
mov ebx, ecx
lea eax, [eax + 0x2c]
test bp, bp
cmc
sub edi, 1
jmp 0x7a44d9
call fcn.00404550
sub eax, eax
mov ecx, dword [esp + 0x1be8]
cmovp bx, sp
mov dword fs:[0], ecx
mov ecx, 0x140d19dd
bswap si
pop ecx
inc bl
movsx ebx, di
bt cx, bp
pop edi
pop esi
mov ch, 0xd7
ror bl, 0xa8
pop ebx
mov ecx, dword [esp + 0x1bd0]
jmp 0x77b754
jne 0x6d719e
mov dword [edi], 1
mov dword [esp + 0x1bf0], 0xffffffff
xor dx, sp
and dl, al
mov eax, dword [esp + 0x1c]
btc dx, bp
add eax, 0xfffffff0
or dh, 0x10
cdq
lea edx, [eax + 0xc]
cmp esp, ecx
test sp, 0x6932
or ecx, 0xffffffff
cmp cx, sp
test eax, 0x5e61d8
lock xadd dword [edx], ecx
jmp 0x6deb77
call fcn.004044b0
mov edx, dword [eax]
mov cl, 0xbc
mov ecx, eax
mov eax, dword [edx + 0xc]
jmp 0x604ee1
mov dword [edi], eax
jmp 0x726228
push eax
mov ah, 0x36
mov eax, dword [edx + 4]
call eax
jmp 0x686315
call fcn.0062acfe
add esp, 4
test eax, eax
jmp 0x6cd597
jne 0x78212f
mov eax, dword [esp + 0x14]
mov cx, bx
sbb ch, 0x8c
mov cl, 0xbc
mov dword [eax], 5
shld ecx, ebx, 0x41
bt cx, 7
mov dword [esp + 0x1bf0], 0xffffffff
sete ah
mov eax, esi
bsf cx, sp
mov eax, dword [esp + 0x1c]
bsf ecx, ebx
lea eax, [eax - 0x10]
lea ecx, [eax + 0xc]
clc
test bp, bp
jmp 0x5b0d16
jne 0x78526f
mov edx, dword [esp + 0x14]
jmp 0x7a2233
jg 0x686315
mov ecx, dword [eax]
not dh
movsx dx, bl
mov edx, dword [ecx]
jmp 0x6b4756
mov eax, dword [edi]
rol eax, 0xd
jmp 0x739b8d
setne cl
clc
test ecx, ecx
jne 0x6867b7
push 0x80004005
jmp 0x6867b2
push ebp
shl ebp, 0x25
mov ebp, esp
sar al, cl
dec ah
and esp, 0xfffffff8
cbw
push 0xffffffffffffffff
sets al
push 0x4c03fb
movzx ax, cl
setns al
mov eax, dword fs:[0]
push eax
mov ah, bh
movsx ax, bl
push ecx
mov eax, 0x1bd4
jmp 0x6e828c
mov ecx, dword [esi]
jmp 0x76b017
dec edx
test edx, edx
jmp 0x6cd9cf
dec ecx
clc
cmp esp, ebp
test ecx, ecx
jmp 0x6cd9cf
call fcn.00455970
mov eax, dword [0x4f65e8]
cmp bl, 0x2e
xor eax, esp
test bh, 0x3f
mov dword [esp + 0x1bd0], eax
clc
seto al
shl ah, 0xcf
push ebx
rol bl, 0xd3
btc bx, 0x8b
push esi
movzx eax, bx
shld ebx, ebp, 0x5f
push edi
mov eax, dword [0x4f65e8]
xor eax, esp
push eax
mov edi, esp
jmp 0x55084b
push edx
push 0x2c
jmp 0x77c161
call fcn.00432e51
add esp, 4
jmp 0x5be513
mov ecx, dword [eax]
cmp ebp, 0x74c5b9b
clc
jmp 0x685026
xor ecx, ecx
sbb dl, 0x50
clc
mov edx, 0x2c
mul edx
xchg cl, cl
seto cl
stc
clc
neg ecx
test dx, si
cmc
or ecx, eax
push ecx
jmp 0x6f3051
mov ecx, dword [0x5007b8]
jmp 0x62140e
jmp 0x6629a5
jne 0x7120a9
mov ecx, dword [esp + 0x14]
jmp 0x56bc76
mov dword [esp + 0x10], ebx
jmp 0x72fc8d
mov dword [esp + 0x14], edi
jmp 0x782280
xor eax, 0x1bfedf72
jmp 0x6b4296
call fcn.00451cce
mov ebx, dword [edi]
jmp 0x76544c
jmp 0x6cd9cf
ret
add esp, 0x10
cmp esi, 0x35923ba5
cmp eax, ebx
jmp 0x5592a5
push esi
jmp 0x5f11bc
push ecx
mov di, bp
not di
push 1
lea edi, [ebx + 0x7c]
jmp 0x668c71
xor ecx, esp
jmp 0x64dba5
push eax
jmp 0x74c371
mov ecx, dword [esi]
mov edx, dword [edi]
jmp 0x587e16
call fcn.0068ab6b
mov dword [esp + 0x18], eax
call fcn.00442dd9
xor ecx, ecx
rcr cl, 0xf7
stc
setbe cl
test eax, eax
jmp 0x6d16bf
mov edi, dword [edi]
xor edx, edx
cmp si, 0x6a7a
sub ebx, ebx
cmc
cmp esp, 0x74b575f0
test edi, edi
jbe 0x7a44df
mov eax, dword [esp + 0x10]
shld ecx, esi, 0xff
mov eax, dword [eax + 0x80]
sub ch, 2
mov ch, 0xb4
bts ecx, ebp
lea eax, [eax + 0x24]
lea esp, [esp]
shr cl, 0x9e
btr cx, bx
add cx, 0x5188
mov ecx, dword [eax + 4]
cmp ecx, edx
jmp 0x5d9931
mov dword [edx], 4
jmp 0x723341
jne 0x7852b6
push edx
call fcn.00432e51
lea esp, [esp + 4]
mov dword [0x5007cc], eax
cmc
cmp ebx, 0x8400
jae 0x67d3e9
mov ebx, 0x8400
jmp 0x67d3e9