joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60632b
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
rol al, 1
neg al
dec ecx
ror cx, 0x2d
xor bl, al
add eax, esp
bt cx, 0xa7
jae 0x5d4b2b
mov word [eax], dx
mov edx, dword [ebp]
movzx eax, cl
jae 0x5d2734
jb 0x678943
scasw ax, word es:[edi]
or dword [eax + edx*8], esp
int 0x86
fisubr dword [edi]
jo 0x5bbb52
dec edi
cld
daa
push eax
mov byte [0x725011fe], al
xor byte [esi - 0x75], al
ret 0x2baf
jmp 0x5bbb6d
salc
std
xchg edi, eax
pop esi
cli
in al, 4
aad 0x97
push esp
insd dword es:[edi], dx
and byte [eax + 0x37], ch
jne 0x5bbb4e
fcom dword [edi - 0x55bd6598]
stc
fisub dword [ecx]
xor eax, 0xd7702810
sub byte [eax - 0x29], dh
mov eax, dword [0x772fd004]
les ebp, [edi]
mov edx, 0x390df186
push eax
sbb al, 0xf
movmskps ebx, xmm4
hlt
xor ecx, 0x3c9c4c97
xor cl, 0x28
xor bl, dl
neg cx
jne 0x707889
sub ebp, 4
mov edx, 0x81b717bc
movsx ecx, dx
rol cx, 0x25
mov ecx, dword [ebp + ecx*2 - 0x1ef04]
mov eax, edx
setae dl
xor ecx, ebx
call fcn.0066c71d
rol edx, 1
mov dword [esp + ecx*4 - 0xe06c], ecx
xor ebx, edx
rol dword [esp + ecx - 0x380f], 0x99
mov eax, dword [esp + 8]
add eax, 0xfffdcda8
jmp eax
call fcn.00725135
sub esi, 4
mov eax, 0x69b89cbd
mov ecx, eax
neg ecx
mov edx, dword [esi + eax - 0x69b89cbd]
call fcn.0061297c
sbb ecx, eax
bswap ecx
adc esi, 3
or cx, 0xe030
xor edx, ebx
mov dword [esp], eax
xor edx, 0xd00a3a80
rol edx, 2
sub edx, 0xad1c3594
inc word [esp + 7]
not edx
xadd eax, ecx
bswap ecx
or byte [esp + ecx*4 - 0x1fd28bb6], ch
dec edx
bswap eax
imul cx, word [esp + ecx - 0x7f4a2e8]
neg edx
inc byte [esp + ecx - 0x7f4eb0d]
jnp 0x5eb694
mov edx, 0x2e0d399d
movzx eax, dl
mov ecx, 0xe1b093b5
mov dx, word [esi + edx - 0x2e0d399d]
add ecx, 0xa23fe2b6
ror eax, 0xf4
sar ecx, 0xc7
lea esi, [esi + eax - 0x9cffe]
movzx eax, byte [ebp + eax*2 - 0x13a000]
xor cl, ch
adc ebp, 1
xor al, bl
dec al
sub cl, cl
ror al, 1
sub al, 0x11
jmp 0x670751
jmp 0x5bbacb
lea ebp, [ebp + eax*8 - 0x7ec]
xor edx, ebx
ror edx, 3
xor edx, 0x83991c21
neg cx
not ecx
inc edx
jmp 0x7251a1
lea esi, [ecx + esi - 0x3c9c4c7a]
xor edx, ebx
xor edx, 0x203cddba
neg ax
push eax
lea edx, [edx + ecx*2 + 0x51d5d82b]
rol dword [esp + ecx*2 - 0x793898fc], cl
neg edx
ror edx, 2
xchg byte [esp + ecx - 0x3c9c4c7d], al
not edx
inc byte [esp + ecx - 0x3c9c4c7e]
xor cx, 0xc490
dec edx
neg edx
rol edx, 2
call fcn.0074cde7
shl cl, cl
neg cx
mov word [ecx + edx - 0x3c9c4c7e], ax
movzx eax, cl
mov edx, dword [esi + eax*2 - 0xfc]
jns 0x691655
mov eax, dword [edx + esi - 0x421ba31c]
lea ecx, [edx + edx*2 + 0x279351a1]
xor eax, ebx
or dl, 0xb5
add ecx, 0x3c972293
setno dl
rol eax, 2
not eax
xor edx, ecx
lea eax, [eax + ecx*4 + 0x3e324968]
dec ecx
call fcn.0066de2b
jmp 0x60423c
add edx, esp
jmp 0x6d9912
ror cl, 0x61
not edx
dec edx
lea ecx, [ecx + eax + 0x36381f04]
not al
xor ebx, edx
dec cx
add edi, edx
shr eax, 0xea
xor eax, edi
jmp eax
Function at 0x607c99
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor ebx, eax
mov dword [esp + edx*2 - 0x474fa88c], ecx
pop edx
imul ecx, ecx
add esi, eax
sar ecx, 0x7d
mov eax, dword [edi + edx - 0x7f8c1217]
lea edx, [ecx + edx - 0x5a548770]
sbb ecx, 0x4d84c78c
xchg cl, dl
mov ecx, dword [edi + edx - 0x25378a6b]
lock xadd dword [eax + edx*2 - 0x4a6f14de], ecx
jmp 0x70e64e
pushfd
sub edx, edx
pop eax
call fcn.0073b772

Function at 0x60ea44
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
sal cl, 0xa7
sbb dl, 0x14
bt ecx, 0x31
dec cx
not dword [esp + 4]
ror dl, 1
neg dl
pop ecx
mov ecx, 0x493d6aa9
not dl
imul ecx, dword [esp + ecx - 0x493d6aa9]
xor bl, dl
call fcn.006bb4a8
movzx ecx, byte [ebp]
mov edx, dword [esp + 4]
lea eax, [edx*2 - 0x5f51d0ff]
xor cl, bl
imul dl
ror edx, 0x18
neg cl
push edx
xor cl, 0x86
rol eax, 0x59
adc dword [esp + eax*2 - 0x15a81c4c], eax
lea eax, [eax + edx - 0x1c55ddc]
sbb cl, 0xb
ror cl, 1
xor bl, cl
dec eax
push eax
lea ecx, [esp + ecx + 0x10]
shr dl, 0x81
or edx, 0x158498b8
mov dx, word [ecx]
sbb edi, 2
xor eax, eax
mov word [edi + eax], dx
lea edx, [eax + eax + 0x152c3b30]
jge 0x6d56b8
pop edx
pop edx
pop edx
pop edx
je fcn.005ff9ea

Function at 0x60eb9c
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + eax + 4], eax
xadd byte [esp + eax + 7], ah
lea ebp, [ebp + eax*4 - 4]
movsx edx, al
adc word [esp + eax + 0xa], ax
xor edx, dword [ebp + eax*8]
xor edx, ebx
neg al
ror edx, 3
xor edx, 0x6526ceb8
neg edx
inc edx
lea ecx, [eax*2 - 0x6ca4e61]
bswap edx
shl al, 0x24
xor ebx, edx
inc dword [esp + eax + 8]
add esi, edx
idiv byte [esp + eax*4 + 9]
pop eax
pop edx
pop eax
jmp fcn.005ff9ea
Function at 0x60fb6b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc al, 7
dec cl
shl cl, 0xe7
inc cx
neg al
jmp 0x7261ab
xor edx, 0x742ca735
xor ebx, edx
btr cx, cx
adc ebp, edx
mov edx, 0x690238ac
movzx ax, byte [ecx + edi - 0x589d]
mov cl, byte [edi + ecx*8 - 0x2c4e6]
lea edi, [edi + edx - 0x690238aa]
sal dx, 0xcb
neg word [esp + edx - 0x69026000]
or al, cl
not al
movsx ecx, dl
mov word [edx + edi - 0x69026000], ax
mov dword [esp + edx - 0x69026000], ebp
ret
movsx eax, cx
mov dword [edi + ecx*8 - 0x6c0820], edx
xor cx, ax
jae fcn.0074b007
sub ebp, 4
push 0x7b2f3e0d
pop ecx
mov edx, dword [ebp + ecx - 0x7b2f3e0d]
mov dword [esp + ecx - 0x7b2f3e0d], 0xd002dca3
xor edx, ebx
movsx eax, cl
inc edx
or eax, eax
not edx
bswap edx
mov word [esp + eax*4 - 0x33], cx
jns 0x6d18a2
sub esi, 4
mov eax, 0xff02589d
cdq
mov edx, dword [esi]
push eax
xor edx, ebx
inc edx
sal byte [esp + 3], 1
not edx
jbe 0x671735
dec edx
bswap edx
movsx ecx, ax
lea edx, [edx + ecx*4 - 0x3e355a83]
and word [esp + ecx*2 - 0xb139], cx
jp 0x5ef46a
neg edx
ror edx, 2
rol dword [esp + ecx - 0x7b2f3e0d], 0x13
or cl, 0x2f
sbb edx, 0xb296c610
add ecx, ecx
mov word [esp + eax - 0xb], ax
xor ebx, edx
add esi, edx
lea ebp, [ebp + eax - 0xe]
mov al, byte [eax + ebp - 0xd]
xor al, bl
movzx edx, cx
pop ecx
inc al
rol al, 1
imul dx, dx
jb 0x5aaf71
xor bl, al
bts ecx, edx
setae cl
shl cl, 0xc2
adc eax, esp
mov edx, dword [ecx + eax - 0xd8104]
lea edi, [edi + ecx*4 - 0x360414]
jmp 0x5f4326
Function at 0x6127c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edx
pop ebx
mov ebp, ecx
pop esi
neg ecx
pop ebp
jg 0x65f7fd
mov dl, byte [edi + edx - 0x4b3518f2]
call fcn.0060b7d5
adc ebp, 4
mov ecx, edx
sar edx, cl
xor eax, ebx
sub dl, 0xb0
sbb eax, 0x42891b26
neg dx
not dx
ror eax, 3
call fcn.006eb0a5
mov ecx, dword [esi]
mov edx, 0xc0b510bf
movzx eax, dx
lea esi, [esi + eax - 0x10bb]
xor ecx, ebx
ror ecx, 1
neg ecx
ror ecx, 2
lea edx, [eax + edx*8 + 0x1ab6e01e]
inc al
bswap ecx
jno 0x71acf2
xor ebx, ecx
add edi, ecx
mov ecx, dword [ebp + eax*2 - 0x2180]
movzx ax, byte [ecx + eax*2 - 0x2180]
call fcn.006708e8
lea edx, [eax + eax*2 + 0xd9460b0]
not ecx
mov byte [esp + 1], ah
dec eax
rol edx, 0x7d
xor ebx, ecx
ror eax, 0x97
add edi, ecx
inc ax
sar dx, 0xc5
pop eax
pop ecx
jne fcn.006a47f1
mov ecx, 0x658f70b0
mov edx, dword [ecx + esi - 0x658f70b0]
mov eax, ecx
lea esi, [eax + esi - 0x658f70ac]
xor edx, ebx
div cl
jmp 0x74e387
or al, 7
mov edx, dword [ebp + ecx*8 - 0x1c0]
or dword [esp + ecx - 0x38], ecx
ja 0x737e4c
movsx edi, cl
pop ecx
call fcn.005da984
and edx, 0xa7291a22
mov ecx, dword [esi + edx*2 - 0x40123444]
xor ecx, ebx
inc ecx
rol ecx, 3
neg ecx
ror ecx, 2
bt edx, edx
movsx eax, dl
lea ecx, [ecx + edx + 0x4d93416c]
call fcn.005e7d1b
imul edx, edx
rol ecx, 1
and eax, eax
shl edx, 0xea
jae 0x6303a4
ret 0x1d5b
mov eax, dword [ebp + ecx*2 - 0x6c]
lea ecx, [ecx + ecx*8 + 0x130d3927]
sbb ecx, 0x3717af00
dec cx
mov cl, byte [ebp + 8]
sal word [esp + 2], 0xa1
adc ebp, 6
shld edx, eax, cl
shr dword [esp], 0x7e
push 0x922c2009
mov dword [ebp], edx
pop ecx
pop eax
jmp edi
xor edx, 0x1faa5f2a
cbw
push ecx
lea edx, [ecx + edx - 0x4f647603]
sub ax, 0xb7bb
neg edx
bswap ecx
rol ecx, cl
or eax, 0xb514baaa
bswap edx
ror edx, 2
xor dword [esp + ecx*8 - 0x708f65b0], 0xc299610
and ecx, ecx
xadd word [esp + ecx*8 - 0x708f65ae], ax
xor ebx, edx
shr ecx, 0x16
shl eax, 0xe1
add edi, edx
imul ecx
jo 0x650abe
mov esp, edi
mov ecx, 0xa8247da9
jmp 0x5e1269
Function at 0x612ef5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dx, word [edi + ecx*4 - 0x261c7ef4]
add cx, cx
movsx eax, cl
mov ax, word [edi + ecx*2 - 0x130e7ef2]
xchg ch, cl
imul ecx, ecx
adc edi, 1
xor cx, 0x2a31
call fcn.006ec027
mov esi, dword [esp + ebp*2 - 0xe64]
jmp 0x5cf0dc
mov ecx, dword [esp + ebp - 0x726]
mov ebp, dword [esp + ebp*8 - 0x39b8]
mov dword [esp + 0x14], 0xd68faa01
mov eax, dword [esp + 0x1c]
lea esp, [esp + 0x20]
ret
lea eax, [ecx*4 + 0x5a39483d]
movzx edx, byte [esi + ecx*2 - 0xb53e76]
xor dl, bl
shl eax, 0x7b
not dl
sbb dl, al
xor dl, al
ror dl, 1
dec ecx
sar al, 0xa6
xor bl, dl
lea ecx, [eax*4 - 0x34b8377]
lea edx, [esp + edx + 8]
xchg word [esp + ecx*2 - 0x3968f90f], ax
movzx cx, byte [eax + edx - 0x48000100]
jmp 0x678f18
bswap eax
push ecx
adc cl, 0xb1
xor ebx, eax
mov dword [esp + ecx - 0x5a9f37], edx
xor edx, dword [esp + ecx*2 - 0xb53e74]
adc ebp, eax
lea esi, [esi + ecx*8 - 0x2d4f9d9]
neg byte [esp + ecx - 0x5a9f3b]
jp 0x5d8bd9
push 0x3502160e
mov edx, dword [edi]
movzx ax, byte [edx]
mov ecx, 0xa5ab8419
add ecx, ecx
jbe 0x6e0d9c
mov ecx, 0x9871fbd
lea edx, [ecx*2 + 0x6594299b]
jmp 0x5a50c7
lea edi, [eax + edi - 0x48000102]
mov word [edi + eax - 0x48000100], cx
movsx edx, ax
sal byte [esp + eax - 0x480000fc], 0xe6
imul eax, edx
pop eax
pop ecx
jb fcn.006d836e
mov dword [edi + edx*2 - 0xed32aa6], ecx
sbb al, al
shr word [esp + edx*2 - 0xed32aa6], 0x48
sub eax, 0x662e3f9d
pop eax
jb fcn.006d5934
jns 0x678fd9
test al, 0xef
outsd dx, dword [esi]
retf
lea edi, [ecx + edi - 0x4b570830]
xchg dword [esp + ecx - 0x4b570832], ecx
mov word [edi + ecx*2 - 0x6a042c1c], ax
lea ebp, [ebp + ecx*2 - 0x6a042c20]
mov edx, dword [esp + ecx*2 - 0x6a042c1c]
imul edx, edx
mov eax, dword [ecx + ebp - 0x3502160e]
xor eax, ebx
ror eax, 1
bswap eax
push ecx
push ecx
sar cl, 5
not eax
dec eax
or dword [esp + ecx - 0x350215f8], 0x589eb639
dec edx
xor eax, 0xa387ba8f
xor ebx, eax
call fcn.006e66d8
mov esp, ebp
mov edx, 0x3083073a
movsx ebp, dx
pop edx
lea edi, [ebp + ebp*8 + 0x31be9f99]
pop edi
push ebp
push dword [esp + 4]
popfd
push ebp
mov ebx, dword [esp + ebp*4 - 0x1cdc]
jmp 0x5aa90f

Function at 0x615953
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov byte [esp + 0x28], 0xe8
cmovae eax, esp
cbw
mov byte [esp + 0x29], 1
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
lahf
jmp 0x69038c
mov dword [esp + edx*4 - 0x1c4a4], edx
lea edx, [edi + edx - 0x71a9]
jb 0x720b28
call fcn.00697e4b
mov dword [esi + 0x204], edx
movzx cx, dh
jmp 0x5e792a
mov eax, dword [esp + 0x28]
not cl
mov dword [esi + 0x208], eax
mov cx, 0xbd02
lea ecx, [esi + 0x254]
jmp 0x6ff862
mov eax, 0x168b56be
movzx ecx, ax
mov eax, dword [ebp + ecx - 0x56be]
and ecx, ecx
lea ebp, [ebp + ecx*8 - 0x2b5ec]
ja 0x653404
Function at 0x618462
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
adc al, 0x87
push edx
ror al, 1
shl dword [esp + ecx*4], 0x3b
adc al, 0x81
imul cx, word [esp + edx - 0x709cffff]
xor bl, al
dec cl
sar dword [esp + edx - 0x709d0000], cl
lea eax, [esp + eax + 4]
shr dl, 4
inc ecx
adc dx, word [edx + eax - 0x709d0000]
and cx, cx
push ecx
lea edi, [edi + ecx*2 - 0x202]
shr cl, 0x85
dec cx
and dword [esp + ecx*2 - 0x1fa], ecx
mov word [ecx + edi - 0xff], dx
lea esi, [esi + ecx*8 - 0x7fc]
shl ecx, cl
mov eax, dword [esi + ecx - 0x80000000]
xor eax, ebx
jmp 0x7240f4
xor edx, 0x90a7b52c
bt ecx, ecx
neg cl
adc ax, 0x2987
dec edx
mov dword [esp], 0x89a1e039
push ecx
rol al, 0x27
bswap edx
lea edx, [edx + eax - 0x7cbc435e]
xor ebx, edx
call fcn.0065749d
mov eax, 0xed3c1918
neg eax
movzx eax, byte [esi + eax*2 - 0x2587cdd0]
mov edx, 0xcf88638f
bswap edx
xor al, bl
sub dx, dx
sbb al, 0x22
movzx ecx, dl
shl ecx, 0xaf
je 0x6dbb5a
fstp st(1)
push edx
pushfd
mov edx, 0x8abed5a5
mov dl, 0xbe
mov dx, 0x62b1
cmp edx, 0xde3545b3
setbe dl
call fcn.00645a79
sub ecx, ecx
lea edi, [edi + ecx*2 + 2]
sbb edx, edx
mov word [edi + edx], ax
mov eax, edx
cbw
call fcn.00403968
ror al, 1
neg edx
jbe 0x5bcc99
neg eax
or dword [esp + ecx - 0x7ffffffc], ecx
call fcn.005be2b3
mov edx, 0x413bc48f
movzx ecx, dl
mov ecx, dword [edi + ecx*2 - 0x11e]
movzx eax, dx
movzx ax, byte ss:[ecx + eax*4 - 0x3123c]
mov ecx, edx
jmp 0x61f468
Function at 0x61a18b
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
bt ecx, 0x19
mov edx, dword [esi + ecx*8 - 0x30]
xadd ax, cx
xor edx, ebx
jmp 0x5a40e6
ror eax, 1
shr cl, 0x21
dec eax
xor eax, 0xd08a383c
or dl, dl
mov dword [esp + ecx - 0x73efce56], edx
xor ebx, eax
xadd word [esp + edx - 0x40e3bbad], dx
add ebp, eax
bswap ecx
neg dword [esp + edx - 0x40e3bbad]
pop edx
jno fcn.0074f54d
push dword [esp + 4]
popfd
call fcn.0074e005
mov edx, 0xe38bca06
push edx
mov edx, dword [ebp]
mov ecx, dword [esp]
push ecx
push ecx
mov ecx, dword [ebp + 4]
dec dword [esp + 7]
add ebp, 4
mov eax, dword [esp + 2]
add edx, ecx
btr eax, 0xb6
movsx ecx, byte [esp + 8]
mov dword [ebp + ecx*2 - 0xc], edx
shr al, cl
sar eax, 0xf7
ror dword [esp + ecx + 2], 0xf0
lea esi, [ecx + esi - 0xa]
jb 0x42c48d
mov edx, 0x10bb8ea6
lea ebp, [ebp + edx*4 - 0x42ee3a9c]
movsx eax, dl
mov ecx, dword [ebp + edx*2 - 0x21771d4c]
bts eax, edx
inc dx
ror dx, 0x81
xor ecx, ebx
dec edx
sal edx, 0xe6
lea eax, [edx + eax*8 - 0x27d3fcfb]
ror ecx, 2
lea ecx, [edx + ecx + 0x1ba6ca37]
bswap ecx
neg ecx
xadd eax, edx
jge 0x72df2c
sar ecx, cl
ror eax, 1
xor word [esp + edx*4 - 4], cx
xor ebx, eax
imul ecx, edx
adc edi, eax
lea edx, [edx + edx + 0x32829a1f]
pop edx
jmp fcn.00605d25
xor ebx, ecx
sub eax, eax
bswap edx
sub eax, edx
add esi, ecx
btr eax, 0x22
mov edx, edi
movzx ecx, al
setb al
lea edi, [edi + ecx - 0xfd]
xor cl, 0x28
lea ecx, [ecx + ecx + 0x4c230b32]
mov dword [edi + ecx - 0x4c230cd4], edx
bswap ecx
inc cx
jne fcn.005ff9ea
xor al, 0xb
mov ecx, dword [esp]
sub byte [esp + 3], cl
rol al, 1
movzx edx, cl
add al, 0xe
rol dword [esp + edx*2 - 0x100], 3
or edx, dword [esp + edx*2 - 0x100]
rol al, 1
and dword [esp + edx*2 - 0x60cc0900], edx
sbb edx, edx
inc al
push ecx
rol byte [esp + edx + 7], 0x61
rol al, 1
ror byte [esp + edx*2 + 2], 0x83
sbb word [esp + edx*8 + 5], 0x869b
adc al, 0xad
neg al
sub al, 0x30
pop ecx
xor bl, al
sal ecx, 0xed
lea eax, [esp + eax + 4]
not cx
bts edx, edx
or word [esp + edx*8 - 6], dx
mov cx, word [ecx + eax - 0x3810ffff]
mov eax, 0x2385496
sal eax, 0x2f
cwde
lea esi, [esi + edx*2 - 4]
shr byte [esp + edx - 1], 0x44
mov word [esi + eax], cx
add eax, dword [ebp + edx*2 - 2]
movzx ecx, word [esp + edx*8 - 8]
sal word [esp + edx], 0x47
ror cx, 0xad
lea ebp, [ebp + edx*4]
jbe 0x5eecb6
xor eax, ebx
add ecx, dword [esp + edx*2 - 2]
add edx, edx
lea eax, [eax + edx*2 + 0x36977199]
sal dword [esp + edx - 2], 0xf
sub ecx, edx
ror eax, cl
dec dl
add dl, byte [esp + ecx - 0x60b43fff]
bswap eax
jns 0x70b0bb
Function at 0x61e748
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
ror eax, 2
ror ecx, 0x75
xor eax, 0xe22e1883
sar ecx, cl
rol eax, 2
xor ebx, eax
add edi, eax
sal ecx, 0xac
shr dword [esp + edx - 0x42be774e], 0x5f
add dword [esp + edx - 0x42be774e], edi
ret
ror dl, 1
movsx ecx, al
sub dl, 0xb5
xadd ecx, eax
xor eax, ebx
inc cx
or ecx, dword [esp + edx - 0x42be774e]
sbb eax, 0x5d02872b
add cx, word [esp + edx - 0x42be774e]
js 0x5b351e
mov ecx, 0xdb2f9708
movzx eax, cl
call fcn.0070a6be
sub ebp, 4
mov edx, dword [ebp]
pop ecx
xor edx, ebx
inc ecx
sar ecx, 0x6e
not edx
setns cl
neg edx
movsx eax, cl
add edx, 0xf986ec88
xor edx, 0x813b599d
xor al, ah
xor ebx, edx
shl eax, cl
adc esi, edx
mov edi, dword [edi + ecx*2 - 0x12402]
mov edx, eax
neg dl
rol eax, cl
jae fcn.006dfa75
mov eax, dword [edx + esi - 0x42be774e]
mov dword [esp + ecx - 0xa7], edx
jb 0x5dc0fd
jmp 0x5d66eb

Function at 0x6218f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + edx - 0x32c5fb82], edx
xadd edx, ecx
adc ebp, eax
pop eax
pop edx
pop ecx
pop edx
jmp fcn.006d5934

Function at 0x62364a
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ebx
xor ecx, 0x198ffaa6
rol ecx, 1
lea ecx, [ecx + eax - 0x378d5aa6]
bswap ecx
inc al
xor ebx, ecx
dec al
add ebp, ecx
mov ecx, dword [edi]
call fcn.0060afa4
pop esi
and dword [esi + 0x13], esp
jecxz 0x623654
push edx
das
sub byte [ebx - 0x50], ah
retf
Function at 0x623bd3
Capabilities:
Check os version
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
call fcn.006d55a9
call fcn.006a8ccb
call fcn.006da15c
mov edx, 0x91a5c833
sub esi, 4
mov edx, dword [esi]
mov eax, 0x5731c1a3
jmp 0x6d6361
lea ebp, [ebp + eax*4 - 0x8000004]
bt ax, 0x95
push eax
mov dword [ebp + eax*8 - 0x10000000], edx
pop ecx
jae fcn.00698520
neg cx
neg cl
lea ebp, [ebp + edx*4 - 0x400]
ror edx, 0x82
js 0x6f1243
xor edx, 0xf0bbec2a
xor eax, ebx
sub cx, 0x27bd
dec eax
rol dword [esp + ecx*2 - 0x1b086], 0xef
sbb dword [esp + ecx*2 - 0x1b086], 0x82b027a0
sub byte [esp + ecx - 0xd840], cl
rol eax, 1
push edx
lea eax, [eax + edx + 0xa82a469]
sar word [esp + ecx*2 - 0x1b084], 0xa1
add edx, ecx
sar dword [esp + ecx*2 - 0x1b082], cl
neg eax
shr dl, cl
or cx, cx
ror eax, 2
jmp 0x5d994a
rol edx, 2
sub edx, 0xbfa805a5
movsx ecx, al
add eax, 0x70a70ab6
xor ebx, edx
add edi, edx
add al, 1
jae 0x66dc35
adc al, al
not dl
neg al
sets byte [esp + eax*4 - 0xae]
or cl, dl
mov word [edi + eax*2 - 0x58], cx
lea edx, [eax + eax*8 - 0xa53e156]
mov dword [esp + eax - 0x2c], ebp
ret
sbb esi, 1
movzx ecx, byte [esi]
movsx edx, al
cwde
shr eax, 0x21
xor cl, bl
add cl, 0xa1
rol cl, 1
neg cl
sal ax, 0x6e
jb 0x672927
mov edx, 0x2b07492a
lea eax, [edx + edx*4 + 0x4d8a5604]
mov ecx, dword [edi + edx - 0x2b07492a]
ror edx, 0x6d
jae 0x734179
sbb cl, al
div ax
or dx, ax
imul ax
xor bl, cl
xadd dl, al
sal eax, 0x99
adc ecx, esp
neg al
sar ax, 0xc5
mov edx, dword [ecx + eax*4 - 0x8000000]
movzx ecx, al
jbe 0x63a06e
lea edx, [edx + eax*2 + 0x4e28e3ef]
jmp 0x64d025
xor edx, ebx
xor edx, 0x9ca4511c
jmp 0x6c6a6a
rol cx, 0x81
neg eax
push ecx
not dword [esp + ecx - 0x7836]
not dword [esp + ecx*4 - 0x1e0d8]
xor ebx, eax
sub word [esp + ecx - 0x7835], 0x67b3
add esi, eax
xor dx, word [esp + ecx - 0x7834]
adc dword [esp + ecx - 0x7836], ecx
mov dword [esp + ecx - 0x7836], esi
ret
jmp 0x6eb0ee
dec eax
xor dx, dx
not ecx
ror eax, 1
or dl, 0x9c
js 0x6dac97
shr ecx, cl
mov eax, dword [ecx + ebp]
sub ecx, dword [esp + ecx*2]
xor eax, ebx
btr dx, cx
inc cl
neg dx
ror eax, 1
neg eax
dec eax
sub dl, cl
shl ecx, cl
adc ecx, dword [esp]
not eax
sbb eax, 0x7db91230
shl edx, 0x2c
jae 0x70306f
rol ecx, 2
inc dx
lea edx, [edx + edx*2 + 0x4f95e836]
neg ecx
xor dword [esp + eax - 0x784b8a00], edx
rol ecx, 1
xor ebx, ecx
xor eax, 0x468389a1
adc esi, ecx
mov dword [esp + eax - 0x3ec803a1], esi
ret
mov edx, dword ss:[ecx + edx - 0x4951583a]
mov dword [edi + eax - 0x24aec3d6], edx
lea ebp, [ebp + eax*2 - 0x495d87b0]
movsx ecx, ax
lea edx, [eax + ecx - 0x7eeea2f4]
mov eax, dword [ebp + eax*2 - 0x495d87ac]
ror cl, 0xe5
adc cl, 0x29
btc dx, cx
xor eax, ebx
xchg dh, cl
bswap edx
xor eax, 0xf18cf6a8
jmp 0x6daef8
Function at 0x62664e
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
movsx edx, cl
lea ebp, [ebp + edx*8 - 0xb2]
mov dx, word [edx + ebp - 0x16]
movsx eax, cx
xor ecx, ecx
xor dx, bx
not dx
xor dx, 0xa482
dec dx
ror dx, 1
xor bx, dx
shr cl, 5
lea edi, [ecx + edi - 2]
cbw
mov word [edi + ecx*2], dx
rol ax, 0x6f
lea edx, [eax - 0x506bf369]
lea ebp, [ebp + ecx - 4]
or cl, al
mov ecx, dword [ebp + ecx*2 - 0x16]
cwde
js 0x6dee8d
shl ax, 0xf
xor ecx, ebx
inc ecx
rol dx, 0x64
adc al, dh
imul dx, dx
rol ecx, 3
rol al, 0x64
imul al
cdq
adc ecx, edx
shl ax, 0x83
js 0x74d434
jmp fcn.005ff9ea
mov ecx, dword [ebp]
xor ecx, ebx
and eax, 0xfb3c1b2a
ror ecx, 1
imul ax, dx
mov dword [esp], edx
lea edx, [eax + edx*2 + 0x5323582e]
neg ecx
mul word [esp + 2]
pop edx
sbb ecx, 0x323aa9a4
sal eax, 0x11
not ecx
lea ecx, [ecx + eax + 0x25eaf00b]
cwde
sbb edx, edx
dec eax
bswap ecx
jno 0x6c454d
mov eax, dword [esi]
mov edx, 0x938ce50c
movsx ecx, dx
add esi, 4
not cl
xor eax, ebx
xchg ecx, edx
call fcn.00634a37
xor ebx, ecx
jmp 0x6dfcf7
lea edi, [edi + eax - 0x693e13da]
ror eax, 0x33
pop eax
btc eax, 0x3b
mov word [edx], cx
movsx ecx, ax
jmp ebp
bts dx, 0xb6
ror edx, 0x77
add esi, ecx
mov edx, dword [edi]
lea ecx, [eax + eax*4 - 0x717281d1]
sar cl, 0x67
mov ax, word [edi + 4]
sete cl
ror cl, 0x27
adc edi, 6
imul ecx, ecx
push ecx
mov word [ecx + edx - 0x4439f804], ax
not dword [esp + ecx - 0x4439f804]
jno 0x5a3f47
sub dword [esp + ecx - 0x4439f804], ecx
mov dword [esp + ecx - 0x4439f804], esi
ret
neg ecx
xor ebx, ecx
btc edx, eax
adc esi, ecx
jmp 0x5b809e

Function at 0x62b470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ebp, 2
jmp 0x620473
dec ecx
xadd ax, dx
xor ebx, ecx
add edi, ecx
lea ecx, [eax + eax*2 + 0x6db33da5]
xor ecx, 0xb51d0e89
call fcn.0062bc9e
movsx eax, dl
xor ebx, ecx
rol edx, 0x94
lea edi, [edi + eax*4 - 0x50]
mov dword [edi + eax - 0x13], ecx
adc ax, 0xe63b
movsx ecx, dx
mov ecx, dword [eax + esi - 0xe64f]
jo 0x674eab
bt eax, eax
jae 0x5fd5b0
lea esi, [eax + esi - 0xe64b]
not eax
bts edx, 0x34
xchg edx, eax
xor ecx, ebx
ror ax, 0xeb
bt dx, ax
jae 0x6b89c0
not ecx
cdq
jb 0x70461f
lea edx, [edx + ecx - 0x6dbfb229]
bswap ecx
call fcn.004037e1
jmp 0x68aba8
sal cl, 2
not dl
setbe cl
not cl
xor bl, dl
add cl, ch
pop ecx
lea edx, [esp + edx + 4]
mov dword [edx + ecx*4 - 0x1cc8b5c], eax
or ecx, ecx
rol dword [esp + ecx*4 - 0x1cc8b5c], cl
mov dword [esp + ecx*4 - 0x1cc8b5c], esi
ret

Function at 0x62b6c6
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
and edx, eax
shr eax, 0x97
adc dx, word [ebp + eax*4]
and ax, 0x9633
call fcn.00751ae4
jno 0x650c49
mov edx, dword [ebp]
mov ax, word ss:[edx]
mov edx, 0xfba27fa0
add ebp, 2
shl dx, 0xae
mov word [ebp], ax
jns 0x6580b2
movsx ecx, word [esp + eax - 0x6dbb5800]
pop ecx
jns fcn.005ff9ea
Function at 0x62d50c
Capabilities:
Read file on windows

Disassembly:
bswap edx
xor edx, 0x273ba335
mov dword [esp + eax*4], 0x7815a228
sal cl, 0xc4
lea eax, [eax*8 - 0x1fd9a7d7]
dec edx
btc eax, ecx
bswap edx
rol eax, 0x25
xor ebx, edx
add edi, edx
call fcn.0062d7f6

Function at 0x62d586
Capabilities:
Read file on windows

Disassembly:
xor eax, 0x10562b
ror eax, 2
call fcn.00638c8e

Function at 0x63258c
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor dl, bl
bswap ecx
not dl
dec dl
not eax
xor dl, 0
ror dl, 1
xadd al, cl
add eax, eax
jno 0x6eb585
xor bl, dl
lea edx, [esp + edx + 0x14]
pop ecx
mov byte [esp + eax - 0x174], ah
movzx cx, byte [edx + eax*2 - 0x2e8]
call fcn.00657c8c

Function at 0x633cb3
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
add esi, ecx
xor al, dh
mul word [esp + 4]
pop edx
pop edx
jo fcn.005ff9ea
fld qword [edi]
mov eax, 0xeab25cbf
lea ecx, [eax*2 + 0x4681f628]
movsx edx, cl
lea esi, [esi + ecx*4 - 0x6f9abe9c]
and ecx, edx
mov eax, dword [ecx + esi - 0x1be6afa6]
xor eax, ebx
rol ecx, 0xdb
neg eax
add ecx, edx
add ecx, 0x6b997320
bts ecx, 0xbc
ror eax, cl
sar dx, cl
xor eax, 0x64a6dc28
lea eax, [ecx + eax + 0x52c51654]
or edx, ecx
add dx, dx
ror eax, 2
sal cl, cl
xor ebx, eax
or dx, cx
sbb cl, 0x35
add ebp, eax
call fcn.005ec526

Function at 0x6356a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shrd ax, dx, cl
call fcn.006611c7
mov ecx, dword [ebp]
call fcn.0060906a

Function at 0x63f554
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
xor ebx, eax
add ebp, eax
pop ecx
jmp fcn.006d5934

Function at 0x63fbd2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
pop eax
pop edx
pop eax
pop edx
pop edx
jb fcn.006d5934
mov eax, 0xd6a75581
pop edx
jmp ebp

Function at 0x64448c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub edx, 0xc109f9ba
call fcn.0073c6bc

Function at 0x648eaf
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea edi, [eax + edi - 0xc166]
neg eax
mov dword [edi + edx*2 - 0x60b1652], ecx
ror eax, 0x68
lea ebp, [ebp + edx*4 - 0xc162ca8]
mov edx, dword [ebp + edx*8 - 0x182c5948]
call fcn.00710f06