joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b0460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pop eax
jns fcn.006d5934
and al, 0xc4
sub eax, 0x719c8e86
ja 0x5ce4da
and eax, 0xef74a18b
cmp eax, 0xde2fde6d
xor al, 0x55
sub ebx, dword [edx - 0x1a]
fsubr st(4)
aam 0xe5
invalid
cmp al, 0x72
push ebx
ror dword [ecx + 0x6a56d2c6], cl
dec eax
or al, 0xab
push ss
stc
mov byte [0x55cc7231], al
outsb dx, byte [esi]
loope 0x5ce4c3
cli
mov esp, 0x90b1b88
daa
xor eax, 0x350282b
xchg edi, eax
salc
clc
stosd dword es:[edi], eax
fnstcw word [ecx + 0x6d870b42]
cmp edi, dword [ebp + ebx - 0x436e896a]
xchg esi, eax
dec edi
cmp al, 0xf9
mov esp, 0x1360b783
mov edx, 0xb26462bd
inc esp
and al, 0x10
push ds
inc ebx
cld
pop edi
pop es
mov dl, 0x42
test edi, 0x4368198a
sub ah, byte [esi]
imul ecx, dword [edx], 0xa9b282ba
mov eax, dword [0x7623f181]
sbb byte [esi], dh
shl edx, 0xe5
jne 0x747910
inc ecx
bswap eax
call fcn.007500b0
mov dx, word [ecx + eax - 0x2739c000]
or dword [esp + eax - 0x2739bffc], 0xf0951e81
lea ecx, [eax + eax*2 + 0x7dbc9daa]
cwde
sbb edi, 2
pop ecx
rol eax, 7
mov ecx, eax
mov word [edi], dx
jb 0x5ce4b3
sbb ebx, dword [edx]
bswap ecx
movsx eax, dl
lea ecx, [ecx + edx*2 - 0x5ca38a42]
shl eax, 8
bswap ecx
inc dx
xor al, dh
xor ebx, ecx
ror edx, 0x8e
cdq
adc esi, ecx
neg dx
lea ecx, [edx + edx*2 + 0x10876d0f]
mov edi, dword [edi + edx*4]
bts dx, 0x26
adc al, 0xb
ror eax, cl
jnp fcn.005ff9ea
push es
pop ecx
push esp
adc al, 0xaf
pushal
movsb byte es:[edi], byte [esi]
cli
fcom qword [eax - 0x5a233287]
jbe 0x7478ed
aad 0xee
invalid

Function at 0x6b0ec5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ebp, ecx
add dl, al
sal eax, 0xf8
jmp ebp
mov dword [esp + ecx - 0x5da67744], edx
xor ebx, eax
not word [esp + ecx - 0x5da67744]
add edi, eax
mov eax, dword [ebp + ecx - 0x5da67744]
mov cl, byte [ebp + ecx - 0x5da67740]
add ebp, 2
ror edx, 0x72
shr eax, cl
call fcn.006b5468
lea esi, [eax + esi - 0x5913c99b]
sub ax, ax
not dl
xor ecx, ebx
bts ax, dx
ror eax, 0x37
lea ecx, [ecx + eax*4 - 0x73934a90]
bswap edx
sar dl, 0xa4
bswap ecx
ror ecx, 2
sub ecx, 0x9602f8b5
xor ebx, ecx
sal edx, 0xd9
bswap eax
jb 0x5dfdf2

Function at 0x6b4ac5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg eax
xor edx, ebx
and al, cl
mov dword [esp + eax - 0x649a7084], 0xd2acb2be
sbb edx, 0x3d89c8b4
neg dword [esp + eax - 0x649a7084]
bt ecx, ecx
rol al, cl
not edx
jb 0x74b075
xor ax, cx
rol edx, 2
cwde
dec ecx
neg edx
sub edx, 0xe4111ab6
xor ebx, edx
call fcn.006d755a
xor dl, dl
rol ecx, 2
sal edx, 0xa8
ror edx, 0xe9
movsx eax, dx
neg ecx
sal eax, 0x6c
xor ebx, ecx
sub edx, 0x4f2dee17
and eax, eax
xor dx, ax
adc ebp, ecx
xadd al, ah
jno 0x6fd6ae
mov dword [esp + 4], 0x70d997c4
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.006954fd
mov edx, dword [edi]
movzx ecx, al
xor al, ch
adc ecx, dword [ecx + edi + 4]
or eax, eax
call fcn.0074cbfc
Function at 0x6b5ce6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.006ebfba
sbb edx, 0x3caacb88
not edx
and cx, ax
rol cl, cl
xor ebx, edx
add ebp, edx
jmp fcn.006d5934
mov eax, 0x1e17eeb8
movsx edx, ax
mov edx, esp
jmp 0x6f8df2
cmp esi, ecx
lea esp, [esp + 4]
ja 0x5e8933
jmp 0x67954e
lea ecx, [eax - 0x1e17ee44]
sub eax, eax
neg ax
lea eax, [esi + eax*8 - 0x80]
and eax, 0xfffffffc
call fcn.0060cc2d
and dword [eax], 0x58
add byte [esi], dh
push 0x6d
sub byte [eax + ebp - 0x10], 0x80
arpl word [eax], ax
mov edx, 0xb67f9833
xchg edx, eax
rcl byte [esp + ebx*4 + 0x7f]
inc esp
adc byte [edi - 0x3a6f4601], 0x67
add byte [ebp + 0x44bca1bd], al
sub byte [ebx - 0x69c997], 0xc1
lds esp, [edx]
cdq
invalid

Function at 0x6b83ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not dword [esp + eax*2 + 4]
adc eax, dword [esi + eax]
xor eax, ebx
ror cx, 0xe5
xor eax, 0xe3af1925
ror eax, 1
dec eax
ror eax, 1
xor ebx, eax
add ebp, eax
shr cx, 0xc8
mov edx, 0x6338a918
pop edx
pop edx
jne fcn.0074f54d

Function at 0x6c36bf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + edx - 0x4e3d0500], 0x9512de98
sub al, 8
xchg byte [esp + edx - 0x4e3d04fd], dh
shl dx, 0x4e
xor bl, al
lea edi, [edx + edi - 0x4e3d0002]
xchg dh, dl
mov word [edx + edi - 0x4e3d0000], ax
imul dx, dx
pop eax
jae fcn.006d5934

Function at 0x6c3a96
Capabilities:
Encode data using base64

Disassembly:
lea edx, [eax + edx + 0x481c37cb]
btr eax, 0x2a
xor edx, 0xdd9ba890
and cx, ax
or ecx, 0x383b4a2b
ror edx, 3
xor ebx, edx
call fcn.0067ca9c
mov ecx, 0xb3c1b80
mov edx, ecx
mov eax, dword [esi + ecx*8 - 0x59e0dc00]
not edx
mov ecx, dword [esi + ecx - 0xb3c1b7c]
sal edx, 0x16
sar edx, 0x4f
lea esi, [esi + edx*2 - 0x7ef8]
and edx, 0x838fe02
rol edx, 0xff
sub edx, 0x2e3d55ae
mov dword fs:[eax], ecx
mov edx, dword [ebp]
mov eax, 0x7100db1f
lea ebp, [ebp + eax - 0x7100db1b]
lea ecx, [eax + eax*2 + 0x1bb00291]
xor edx, ebx
bswap edx
xor eax, 0x84ab6c0d
ror edx, 1
dec edx
or cl, al
xor edx, 0xb12fe613
dec ax
xor ebx, edx
sub eax, 0xa39731a3
shl cx, 6
call fcn.006f9f09
Function at 0x6c4219
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [edx + esi - 0x2e09646f]
call fcn.0075ae0e
xor bl, cl
mov eax, dword [esp + 0x10]
lea ecx, [esp + ecx + 0x14]
call fcn.0073a4eb
mov eax, 0x4bb3b60d
call fcn.0067abd5
lea ecx, [eax + eax + 0x32bf97]
sal ecx, 0x57
add edi, edx
ror eax, 0xe1
mov dword [esp + eax - 0x3ecf7bee], edi
ret 0x10
add ecx, eax
lea eax, [edx*4 + 0x5db23a30]
mov dword [esp + edx - 0x2e09646f], edx
mov dword [ebp + edx*2 - 0x5c12c8de], ecx
add dword [esp + edx - 0x2e09646b], 0x2f39449b
mov ecx, dword [esp + edx - 0x2e09646e]
and dword [esp + edx - 0x2e096469], ecx
lea esi, [edx + esi - 0x2e096473]
or word [esp + edx*2 - 0x5c12c8d5], cx
ja 0x634912
mov dword [esi], ecx
mov eax, dword [ebp]
add ebp, 4
xor eax, ebx
neg eax
dec dword [esp]
ror eax, 1
push 0x6c812a39
mov dword [esp + 8], 0x6db95a3e
sub eax, 0x3d886ca3
pop edx
xor eax, 0xb8a06010
mov ecx, edx
not dword [esp + ecx - 0x6c812a35]
rol eax, 1
bts dx, dx
xor ebx, eax
add edi, eax
and ecx, edx
call fcn.005ab127
test eax, 0x5526b85d
mov dword [ecx + 0x5b], 0xffcc19d3
inc ebx
invalid

Function at 0x6c6a2c
Capabilities:
Encode data using base64
Encrypt data using speck
Query or enumerate registry value
Resolve function by parsing pe exports
Set environment variable
Set registry value

Disassembly:
ror ax, 0xac
lea ecx, [ecx + eax - 0x7db91230]
jae 0x71793b
movzx ecx, byte [ebp + edx - 1]
inc ax
mov dword [esp + eax - 0x61bc1c04], 0x76985b0e
xor cl, bl
add cl, dl
neg cl
jmp 0x7562bf
imul dl
xor ebx, ecx
btc edx, edx
dec eax
adc esi, ecx
mov ecx, edx
rol dx, 0xa3
jae fcn.005ff9ea
neg eax
rol dword [esp + edx - 0x9d], 0xab
mov ecx, 0x73e90b3
xor dl, dh
ror eax, 3
inc dword [esp + edx*4 - 0x274]
inc eax
bswap eax
jmp 0x5adb01
imul edx
xor bl, cl
lea ecx, [esp + ecx + 4]
imul edx
cwd
or edx, dword [ecx + eax*2]
lea edi, [edi + eax*8 - 4]
pop ecx
sal ax, cl
mov dword [edi + eax*8], edx
imul ax, ax
lea ecx, [eax*8 - 0x605ac0e0]
and eax, 0x31967d31
lea ebp, [ebp + eax*4 - 4]
mov ecx, dword [eax + ebp]
sal ax, 0xa6
mov edx, eax
inc dl
xor ecx, ebx
ror ecx, 1
xor dl, al
sal dl, 1
neg ecx
neg eax
dec ecx
not ecx
ror eax, 0x2d
jae 0x627c84
ror cl, 1
mul al
cmovno edx, dword [esp + edx - 1]
adc cl, 0x2b
cdq
jmp 0x72b44f
Function at 0x6cb22e
Capabilities:
Set environment variable

Disassembly:
mov dword [esi + 0x48], ebx
jmp 0x5d079d
nop
jmp 0x704000
mov dword [esi + 0x44], ebx
jmp 0x5cca94
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x673416
je 0x70bc20
mov ebx, dword [esi + 0x30]
stc
cmc
push 0
add edi, 1
jmp 0x70bc07
call fcn.00439200
add esp, 4
test al, al
jne 0x63640c
xor ebp, ebp
test sp, 0xb5aa
test byte [esi + 0xc], 8
jmp 0x604d9a
je 0x653c62
push 0x45f3a0
jmp 0x6b5945
push 0x457aa0
push str.DNGTrialState
jmp 0x5f27fe
jne 0x5d079d
mov dword [esi + 0x28], ebx
jmp 0x5e2f63
je 0x63640c
movzx ecx, word [esi + 0x36]
push ecx
xor ecx, edi
add cx, 0xef21
mov ecx, dword [esi + 4]
stc
cmp si, dx
add edi, 1
jmp 0x6363f5
push str.DNGTrialState
jmp 0x7438cd
dec edx
dec ecx
mov dword [esp + eax], ecx
not edx
lea edx, [ecx + edx - 0x801cade]
btr eax, eax
ror edx, 2
sar dword [esp + eax*2], 0xad
adc al, ah
xor ebx, edx
call fcn.0068c9de
call fcn.00439070
lea esp, [esp + 4]
test al, al
jne 0x6cb263
xor ebp, ebp
stc
test byte [esi + 0xc], 4
jmp 0x69f8c6
jle 0x7438d3
cmp ebp, ebx
jmp 0x648036
jmp 0x43942d
call fcn.0043d77c
lea esp, [esp + 4]
cmc
cmp esp, edx
cmp eax, ebx
jb 0x70bc20
sub ebp, ebp
cmp si, cx
xor ebx, ebx
cmp edi, ebx
jmp 0x6e7ddc
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp ebp, ebx
jmp 0x673410

Function at 0x6d18df
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [ecx + edi - 0x720ef00]
pop edx
jmp fcn.006d5934
movsx eax, byte [esp + ecx*8 - 0x39077800]
jmp 0x64575e
mov dword [esp + edx + 0x4f653ed0], 0x720c03b
not eax
lea eax, [eax + ecx + 0x4687530d]
add dl, cl
xor ebx, eax
xadd dword [esp + edx + 0x4f653e20], ecx
rol cx, 0xaa
adc ebp, eax
jmp 0x667c71

Function at 0x6d2547
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push edx
sal dx, 0x45
mov dword ss:[ecx], eax
add edx, 0xccb0e181
movzx eax, byte [esp]
mov dword [esp + eax - 0xae], edi
ret
xor ebx, eax
or ecx, dword [esp + 8]
mov dword [esp + 4], 0x1dbd23a1
inc edx
adc ebp, eax
rol dword [esp + 6], cl
movzx ecx, byte [esi]
adc esi, 1
mov eax, 0x481d271f
xor cl, bl
dec cl
xor cl, 0x8d
call fcn.00701d7a
sub ebp, 4
mov edx, 0x429f950e
inc edx
neg edx
mov ecx, dword [ebp]
lea eax, [edx*8 + 0x111b303b]
div dl
sub eax, eax
xor ecx, ebx
ror ecx, 1
bt eax, 0x8d
jae 0x7107bd
add ebp, 4
neg word [esp + 2]
xor ecx, ebx
mov edx, 0x3090e225
rol ecx, 1
lea ecx, [ecx + edx*2 - 0x7938dace]
lea edx, [edx*8 + 0x4226c226]
xor ecx, 0x4d1ed502
movsx eax, dx
rol ecx, 1
cdq
sal eax, 0x83
xor ecx, 0x1014eb11
sal edx, 6
cdq
sbb ecx, 0x78279a91
bts eax, 0xae
xor ebx, ecx
add edi, ecx
mov ecx, dword [esi]
pop edx
sub eax, edx
mov eax, dword [eax + esi - 0x45a7e0cb]
add edx, 0x329aa50d
adc esi, 8
jmp 0x674260

Function at 0x6d53a9
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor ebx, edx
mov dword [esp + eax - 0x618], 0x8f927589
add edi, edx
movsx edx, cx
jmp 0x6dadf9
Function at 0x6da15c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi]
movzx dx, byte [ecx]
mov dword [esp], 0xc60c2d33
add esi, 2
mov word [esi], dx
mov edx, dword [ebp]
sar dword [esp], 0x6a
mov eax, dword [esp]
adc ebp, 4
lea eax, [eax*8 + 0x6191051c]
mov ecx, eax
xor edx, ebx
btc ax, 0xe
inc edx
push eax
bt cx, 0xbf
bswap edx
or cx, ax
sbb byte [esp + eax - 0x611d5d73], ch
neg edx
call fcn.00744148

Function at 0x6dd953
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 4]
add edi, 4
jmp 0x6dfce3
lea edx, [edx + ecx + 0x3a84afc]
xor ebx, edx
call fcn.00719eeb
mov eax, 0xd583cc3c
mov ecx, dword [edi]
dec eax
jne 0x64fe6a
or ecx, eax
not ecx
mov eax, 0xcb3b9114
bt eax, eax
mov dword [edi], ecx
jb 0x6f7122
movsx edx, al
jb 0x719e9a
sub ebp, 4
mov eax, 0x1087b784
movzx ecx, al
mov eax, dword [eax + ebp - 0x1087b784]
xor eax, ebx
mov edx, ecx
ror eax, 2
bswap eax
add ecx, ecx
ror eax, 1
lea eax, [eax + ecx - 0x123d4c08]
call fcn.005ca651

Function at 0x6de7ea
Capabilities:
Check os version
Execute anti-debugging instructions
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jp 0x5e46d8
inc ecx
xor ax, ax
xor ebx, ecx
imul al
not al
call fcn.00701094
xor ecx, ecx
xor ebx, eax
dec cx
xchg dx, cx
push ecx
add edi, eax
mov cx, word [esi + ecx*2 - 0x8058]
movsx eax, dx
add esi, 2
or dword [esp], eax
xor cx, bx
add cx, dx
not dl
push eax
dec dword [esp + 4]
xor cx, ax
not dl
ror eax, 0x78
btc eax, 0xb4
sbb cx, 0x4b00
rol cx, 1
add cx, 0x47b5
call fcn.00736cb7
setno cl
rol edx, 3
inc edx
not ecx
idiv al
not edx
neg edx
mov dword [esp], eax
xor ebx, edx
pop eax
neg ax
add esi, edx
call fcn.006eace4
lea eax, [ecx + eax + 0x6a06d6fc]
xor ecx, edx
sar ecx, 0x8b
not eax
bswap eax
js 0x5ab9f5
mov ebx, 0x4a2cb20
mov esp, ebp
movzx eax, bl
pop esi
movzx edx, ax
idiv bx
pop edx
xadd eax, ebx
jns 0x6e1c0d
mov edx, dword [ecx + esi - 0x3e80d791]
cmovo cx, ax
xor edx, ebx
and ecx, ecx
jno 0x708882
lea ecx, [eax*8 + 0x612902b]
rol ecx, cl
adc esi, edx
movzx edx, cx
jmp esi
not edx
rol ecx, cl
sub eax, eax
or cx, 0xb60c
inc edx
inc cl
xadd eax, ecx
rol edx, 1
xor edx, 0x5686113d
call fcn.005cdcc6
mov eax, 0xf11037be
lea ecx, [eax*8 + 0x6ba74b4]
cwde
mov edx, edi
lea edi, [eax + edi - 0x37c0]
or ax, ax
mov word [edi + eax*2 - 0x6f7c], dx
push eax
cwde
mov ecx, dword [esi + eax - 0x37be]
lea esi, [esi + eax*2 - 0x6f78]
xor ecx, ebx
cdq
shr ax, 1
sbb eax, dword [esp + eax*2 - 0x37be]
bswap ecx
cwd
rol ecx, 3
or edx, dword [esp + edx - 0xffff]
lea ecx, [edx + ecx + 0x87f2d1b]
rol ecx, 1
dec ecx
rol ecx, 3
jmp 0x5cccfd
Function at 0x6e16fa
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
lea ecx, [eax + 0x64101622]
lea ebp, [eax + ebp + 2]
je 0x6441bc
xor cx, cx
rol eax, 2
jmp 0x6d999b
mov word [ebp + ecx - 0x64101622], dx
sbb eax, eax
cwde
adc eax, edi
jmp eax
mov ax, word [esi + edx - 0xfffd]
lea esi, [esi + edx - 0xfffd]
call fcn.00714c9d
bswap eax
shr ecx, 0xb5
xor eax, 0x6521378a
jmp 0x640f74
lea ecx, [ecx + ecx*8 - 0x61dc5766]
neg eax
xor ecx, 0xef0284b7
xor ebx, eax
sal dl, 0xa7
adc edi, eax
mov ax, word [ebp + ecx - 0x71212c2d]
or dx, word [edx + ebp + 2]
mov cl, byte [ebp + ecx - 0x71212c29]
jmp 0x5a97f7
xor ecx, ebx
lea eax, [edx + 0x11a9641e]
not ecx
call fcn.00604312
xor edx, ebx
ror edx, 1
bswap eax
inc edx
bswap edx
lea edx, [eax + edx - 0x76bf1cca]
bt eax, 0x24
not cx
rol edx, 2
dec edx
xor eax, eax
xor ebx, edx
or cl, ah
adc edi, edx
mov edx, ecx
and dl, ah
mov ecx, dword [ebp + eax*4]
movzx dx, byte ss:[ecx + eax*2]
jno 0x622342
mov edx, 0xf0a8cbc
add edx, edx
push edx
mov eax, dword [edi + edx*2 - 0x3c2a32f0]
xor edx, edx
add edx, dword [edi + edx*2 + 4]
not word [esp + 1]
lock xadd dword [eax], edx
mov eax, 0x5619c106
not byte [esp + eax - 0x5619c104]
pushfd
pop eax
mov dword [esp], eax
mov eax, 0xd1135a0e
pop eax
mov ecx, 0x2130b81e
push ecx
mov dword [edi + ecx*2 - 0x42617038], edx
call fcn.0068c978
mov eax, 0x5eb57bb9
mov edx, dword [ebp + eax - 0x5eb57bb9]
or ax, ax
lea ecx, [eax + eax*4 - 0x4f798f42]
lea ebp, [ebp + eax - 0x5eb57bb5]
dec cx
xor edx, ebx
dec edx
ror edx, 1
inc edx
ror edx, 1
xor edx, 0x110aad36
rol al, 0x81
sbb eax, eax
ror edx, 2
lea ecx, [ecx + eax + 0xa95880a]
xor ebx, edx
bt ax, cx
add edi, edx
not cx
mov cx, word [esi]
movzx edx, ax
jmp 0x69c77a

Function at 0x6e3676
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
mov dx, word [edi + 2]
add edi, 2
call fcn.005be4c3
mov eax, 0x9e1fd8b6
push eax
mov ecx, dword [ebp]
lea edx, [eax + eax*2 + 0x49881e1f]
xor ecx, ebx
call fcn.006cac2d
Function at 0x6f0448
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [eax + edi - 0x20], edx
sal eax, 0x65
movsx edx, ax
mov dword [edi + eax - 0x480], ecx
jmp esi
and ecx, ecx
inc edx
xor ebx, edx
mov dword [esp + eax*4 - 0x3fffc], ecx
xor dword [esp + eax - 0xffff], ecx
adc esi, edx
lea edx, [ecx*8 - 0x4e6bbaf6]
xchg word [esp + eax - 0xffff], dx
mov ecx, dword [edi + eax*4 - 0x3fffc]
mov edx, dword [edi + eax*2 - 0x1fffa]
shl eax, 0x90
pop eax
lock xadd dword [ecx + eax*8 - 0x24150], edx
pushfd
movsx ecx, ax
shr ax, cl
pop ecx
adc eax, eax
jge 0x5d2565
mov edx, 0x4170d87
neg edx
movsx ecx, dx
mov dx, word [ebp]
mov ax, word [ebp + 2]
mov cl, byte [ebp + 4]
push 0x541b63a3
adc ebp, 3
shld dx, ax, cl
mov eax, 0x37287c34
mov word [ebp + eax - 0x37287c34], dx
lea edx, [eax + eax*8 + 0x7b8f87a4]
rol dword [esp + eax*2 - 0x6e50f868], 0x93
mov ecx, dword [eax + esi - 0x37287c34]
setb byte [esp + eax*2 - 0x6e50f868]
lea eax, [edx + eax*4 - 0x37cbffd2]
setb byte [esp + eax - 0x10d1d676]
lea esi, [esi + eax - 0x10d1d672]
sbb dl, ah
call fcn.0041f6d5

Function at 0x6f6408
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor ebx, edx
add ebp, edx
lea ecx, [eax*4 - 0x15c8d2c9]
inc ecx
mov ecx, dword [edi + eax*4]
sub al, ah
adc al, al
adc eax, dword [edi + eax + 4]
mul ecx
mov ecx, 0xe03a8386
not cx
mov dword [edi], edx
lea edx, [ecx + ecx*8 + 0x30a9e53c]
shl edx, cl
mov dword [edi + 4], eax
jmp ebp
neg edx
ror eax, cl
not edx
neg edx
xor cx, 0xd394
or cl, al
lea ecx, [ecx - 0x1c586b72]
inc edx
neg al
bswap eax
ror edx, 2
jmp 0x609fd2
call fcn.006e98ab
ror edx, 2
and ecx, eax
sbb cx, cx
not cx
lea edx, [edx + ecx*8 - 0x4bfacc48]
sar eax, cl
sbb ecx, 0xe51c1a11
jno 0x62d4ea

Function at 0x6f86e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [ebp]
add ebp, 4
mov dword [esp], 0xfc3e8307
xor eax, ebx
add eax, 0xa296e62f
bswap eax
call fcn.006f2844
Function at 0x6fb308
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xor edx, 0x3f3f6519
sar ecx, cl
call fcn.00434656
mov ecx, 0xa93a8024
lea eax, [ecx + ecx*2 - 0x65f955fc]
mov ecx, dword [edi]
neg ax
mov edx, dword [edi + 4]
bswap eax
shr eax, 0xd
lea edi, [edi + eax - 0x486a5]
sal ax, 0x65
cwde
bts eax, eax
mov dword ss:[ecx], edx
lea ecx, [eax + eax*4 + 0x4d285782]
btc eax, eax
mov eax, dword [esi + ecx - 0x4d2783a7]
neg ecx
call fcn.0068176b

Function at 0x6fb358
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
dec edx
dec ecx
btc ecx, eax
bswap edx
jb 0x6bdac7
xadd cx, ax
inc cx
inc edx
xor ebx, edx
add edi, edx
btr ecx, eax
mov edx, dword [ebp + ecx*8 - 0x41eeb8]
xadd eax, ecx
dec ecx
push eax
mov ecx, dword [ebp + eax - 0x2ad8ab56]
lea ebp, [eax + ebp - 0x2ad8ab56]
btc ax, ax
adc edx, ecx
mov dword [eax + ebp - 0x2ad8af5a], edx
neg dword [esp + eax*2 - 0x55b15eb4]
mov ecx, eax
call fcn.0067daf4
mov edx, 0x6ca8de32
mov eax, 0x5e9bb4b7
lea esi, [esi + edx - 0x6ca8de36]
dec al
mov eax, dword [eax + esi - 0x5e9bb4b6]
sub dl, dl
sub ecx, 0x1f3fd894
xor eax, ebx
shr edx, cl
rol eax, 1
bt cx, cx
ror ecx, cl
adc dl, 0x13
sbb eax, 0x838e5bb3
neg edx
not ecx
neg ecx
rol eax, 1
ror dx, 6
neg eax
xor ebx, eax
add edi, eax
dec dl
jmp edi
ror al, 1
not edx
neg dl
xor bl, al
lea eax, [esp + eax + 8]
xor edx, edx
mov word [eax + edx*2], cx
jle 0x663c48
sal dx, 0xce
mov dword [esp + edx*2], ebp
ret 4
ror al, 1
jmp 0x6f60f6
call fcn.00686ac5
sub al, 5
xor bl, al
imul ecx, dword [esp + edx - 0x6ca159d5]
lea edi, [edi + edx - 0x6ca159db]
mov word [edi + edx - 0x6ca159d9], ax
pop edx
pop edx
jb fcn.005ff9ea
cmovae edx, eax
xor ebx, ecx
or edx, eax
jbe 0x604566
sub dl, 0x8f
adc ebp, ecx
sal eax, 0x2d
jae 0x6a0e6a
inc al
and byte [esp + edx - 0x6ca159d2], 0x84
sub byte [esp + edx - 0x6ca159d5], cl
xor al, 0xa
jmp 0x6a0734
jmp 0x6b9363
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x18]
call fcn.006954fd
mov eax, 0xf30b1b0c
mov edx, eax
sub esi, 4
dec dl
mul edx
mov edx, dword [esi + eax*2 - 0x55b0db08]
movsx ecx, ax
ror ax, cl
bt ecx, eax
xor edx, ebx
div al
ror edx, 1
btr eax, eax
jb 0x5cf50d
xor ebx, edx
cwde
xchg dword [esp + eax*4 - 0x134c0], ecx
add ebp, edx
mov dword [esp + eax - 0x4d31], ebp
ret 4

Function at 0x6fd175
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add edx, 0xda1c5420
pop ecx
neg edx
rol edx, 3
add edx, 0x449f6e1d
mov dword [esp], 0x131a91b9
ror edx, 3
shr dword [esp], 0x2e
inc edx
mov ecx, 0x21b8dabc
neg edx
pop ecx
btc ecx, ecx
or cl, cl
xor ebx, edx
lea eax, [ecx*4 + 0xa15a7a3]
add ebp, edx
push ecx
mov di, word [edi + ecx*2 - 0x90d4]
xor al, al
xor al, ah
sub word [esp + ecx - 0x4868], ax
pop eax
jns fcn.006d5934
mov eax, 0x99ae3b3c
lea edx, [eax*8 + 0x3bbc4816]
mov dx, word [ebp + edx - 0x92e21f6]
movzx ecx, ax
not cl
mov cl, byte [ebp + ecx*8 - 0x1de16]
add ebp, 2
sal al, 0x27
bt eax, eax
call fcn.0063b694
Function at 0x6fe5c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor bl, dl
add byte [esp + 6], cl
setb cl
add ecx, ecx
lea edx, [esp + edx + 0xc]
sal cx, 0x65
call fcn.0073c997
lea edx, [ecx + edx - 0x372b2a1]
lea eax, [ecx*4 - 0x61469c48]
bts ax, 3
xor edx, 0xef8df80c
imul ecx, ecx
rol edx, 2
btc ecx, 0x81
call int.0069f042
xor ecx, 0x343d8615
and dword [esp + edx - 0x5d7673e9], edx
dec ecx
not edx
mul al
not ecx
xor ebx, ecx
btc dx, dx
sbb dx, 0xa7a7
add edi, ecx
mov eax, dword [ebp]
or byte [esp + 3], dl
adc ebp, 4
push edx
shr dword [esp], 0x3b
seta dl
sbb esi, 1
not dword [esp + 1]
jmp 0x6345ba
mov eax, 0x98279f8f
lea esi, [esi + edx - 0x7db3709c]
inc edx
call fcn.005b8def
movzx edx, byte [esi]
push 0x663b6a16
xor dl, bl
xor dl, 0x39
sub dl, 0x28
mov ecx, dword [esp + 2]
not dl
ror dl, 1
dec dl
and byte [esp + 8], 0x2c
ja 0x5de0cc
mov edx, 0x7db370a0
movsx ecx, dl
mov ecx, dword [esi + edx - 0x7db370a0]
jmp 0x6640b2
shr ax, cl
call fcn.00741461
jmp 0x60a635
sbb cl, 0xa1
ror eax, 1
jmp 0x728f91
add edi, eax
jmp edi
mov eax, dword [ebp + edx*2 - 0xb2]
lea ebp, [ebp + edx*4 - 0x160]
lea edx, [edx*4 + 0x6fbc6d29]
xor eax, ebx
dec eax
shr edx, 0x53
movsx ecx, dx
xor eax, 0x2983edae
bts dx, dx
ror eax, 1
sub eax, 0xe233b80b
shl ecx, 0xb
rol edx, 0xd5
bswap eax
sbb edx, ecx
neg eax
rol ecx, 0x5b
jae 0x679498
lea ecx, [esp + ecx + 4]
mov dword [ecx], eax
call fcn.005b5876
add esi, 2
or cl, dl
dec ax
not cl
movzx edx, al
mov word [esi + edx - 0x95], cx
ror dl, 0x84
jne 0x6fcdec
sal edx, 0xd4
adc cl, byte [edi + ecx*2 + 2]
inc edx
lea edi, [edi + edx*2]
jnp 0x64cabd
jmp 0x5e7591
sal dx, 0xea
xor cl, 9
xor ebx, eax
jmp 0x6e200e

Function at 0x6ff855
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [esp], 0xb0f0e277
call fcn.00723a91
push ebx
jmp 0x66ac87

Function at 0x701094
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc ebp, ecx
movzx ecx, dx
mov dword [esp + ecx - 0xffff], eax
div dl
pop edx
pop ecx
jmp fcn.006d5934

Function at 0x703715
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [eax + ecx*4 - 0x53e7d4d7]
xadd word [esp + ecx*2 - 0x7d79c7fd], cx
rol eax, cl
xor eax, 0x56279635
mov dword [esp + ecx*2 - 0x7d79ffc2], ecx
or cl, cl
not eax
not cx
and dword [esp + ecx*2 - 0x7d780038], 0x899d1396
neg cx
xor ebx, eax
lea edx, [ecx*4 + 0xbb5d132]
add esi, eax
mov dx, word [edi + ecx*2 - 0x7d79ffc4]
lea edi, [edi + ecx - 0x3ebcffe0]
sar byte [esp + ecx - 0x3ebcffdb], 0x42
lea ebp, [ebp + ecx*2 - 0x7d79ffc5]
movzx ecx, byte [ecx + ebp - 0x3ebcffe2]
call fcn.006942e8