joyce8/EMBER2024-capa huggingface dataset:
Function at 0x703ec4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub word [esp], ax
mov edx, dword [esi]
neg al
xchg word [esp + 2], ax
adc esi, 4
movsx ecx, byte [esp]
and ecx, dword [esp + ecx - 0x25]
xor edx, ebx
dec edx
lea ecx, [ecx + eax - 0x19e8f0c6]
ror edx, 1
mov word [esp + 2], 0x359f
sal byte [esp + 2], 0xc7
bswap edx
bt eax, eax
lea edx, [edx + eax - 0x3920efc8]
jb 0x5ca124
sbb word [esp], cx
adc al, 1
xor ebx, edx
sal ecx, 0x3d
adc al, al
add edi, edx
mov dword [esp + ecx*4], edi
ret
mov dword [esp], 0xe3815b25
adc ebp, 7
mov dword fs:[ecx], edx
and eax, eax
jl 0x63a9c3
jmp 0x7389ac
mov edx, 0xac90c40e
and dx, dx
mov eax, dword [ebp]
xor edx, 0xd9bd6711
mov ecx, edx
sal dx, 7
lea ebp, [edx + ebp - 0x752d8f7c]
js 0x430fb4

Function at 0x703f0f
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + ecx - 0x10360280], ecx
setns cl
lea edi, [ecx + edi - 0x10360203]
mov edx, 0x4bb8dc0c
and cl, byte [esp + ecx*4 - 0x40d807fa]
mov word [edi + ecx - 0x10360200], ax
jb 0x6a3bfb
inc ecx
pop eax
pop edx
pop eax
jnp fcn.006d836e

Function at 0x70cd08
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ecx + eax + 0x3296d54f]
sar cx, cl
adc edx, 0xd337fd06
call fcn.006c0e9e

Function at 0x70f1f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
pop ecx
pop edx
pop ecx
pop edx
je fcn.0074b007
movzx ax, byte ss:[ecx]
call fcn.005a532b
enter 0xfffffffffffff61b, 0xffffffffffffffa1
inc ebx
mov eax, 0xd8f1440a
pop ds
cmp byte [esi + 0xaffac26], bh
mov ebx, 0x32e57c94
in eax, dx
inc eax
outsd dx, dword [esi]
lodsb al, byte [esi]
inc esp
inc esi
pop eax
les edi, [edx]
xchg ecx, eax
cmp eax, 0x301a6fbc
cmp eax, 0xc736c3b2
inc ecx
ljmp 0x4832

Function at 0x711d84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ecx + esi - 0x45e0000]
xor edx, ebx
sub edx, 0x7d1c9b9b
add cl, cl
mov dword [esp + ecx*4 - 0x11780000], ecx
ror edx, 2
mov eax, dword [esp + ecx*2 - 0x8bc0000]
push eax
neg edx
push eax
ror edx, 3
neg cl
inc al
not al
xor edx, 0xab3d7c9c
call fcn.0064aded
rol edx, 3
btr cx, 0x90
call fcn.006424ba
jmp 0x6f3381
Function at 0x7192fe
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, edx
mul al
bswap ecx
xchg ah, al
sar ax, 5
xor ecx, edx
and eax, edx
ror ax, 0x84
lea ecx, [ecx + eax - 0x3db6ed37]
shr edx, 0xcf
not ecx
btc dx, 0x1f
inc ecx
xor ebx, ecx
dec edx
add esi, ecx
cwde
mov eax, dword [edi + edx - 0x17ffe]
mov edx, dword [edx + edi - 0x17ffa]
mov ecx, 0x711ea2ac
inc cx
lock xadd dword [eax + ecx - 0x711ea2ad], edx
xchg ch, cl
push ecx
call fcn.005e3fd0
and ecx, 0xa124af27
ja 0x615477
call fcn.006c3a5b
adc edi, edx
jmp 0x752e6d
not ecx
xor ecx, 0x308c92aa
sub eax, eax
dec ecx
ror ecx, 3
sub word [esp + eax*4 + 4], ax
call fcn.00611e8e
mov eax, 0x230f9819
xor eax, eax
lea ebp, [eax + ebp - 4]
xchg ah, al
lea eax, [eax + eax - 0x2bedc07e]
mov ecx, dword [ebp]
cdq
inc eax
xor al, dh
xor ecx, ebx
rol eax, 0x78
jb 0x41a16d
inc ecx
mul ax
sbb dx, dx
rol ecx, 1
btc dx, ax
neg ecx
inc ecx
btc ax, 0xa9
lea edx, [edx + eax*8 - 0x71636e61]
inc al
xor ebx, ecx
add edi, ecx
mov eax, dword [ebp + eax - 0x6e06b911]
mov ecx, dword [ebp + 4]
neg edx
lea ebp, [ebp + edx - 0x7993a5db]
inc edx
ror dx, 0x86
mov dword fs:[edx + eax - 0x79939297], ecx
call fcn.005a9c43
movzx edx, cl
mov ecx, dword [ebp + edx*2 - 0xc]
and dl, dl
mov dx, word [ebp + edx*2 - 8]
mov eax, dword [esp]
adc ebp, 6
mov word ss:[ecx], dx
pop edx
jmp edi

Function at 0x719707
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mul dx
mov eax, dword [edx + ebp - 0x24ccb3ce]
xadd ecx, edx
xor eax, ebx
inc eax
mov dword [esp + edx - 0x8428], 0xda2eda99
xor eax, 0x13be8326
btc dx, 0x37
lea ecx, [ecx + ecx - 0x11f8a85b]
not dword [esp + edx*4 - 0x21298]
neg eax
btr ecx, ecx
ror eax, 3
sal dword [esp + ecx*2 - 0x6f438f20], cl
bswap eax
inc dword [esp + edx - 0x84a0]
sub dx, 0x533b
add word [esp + edx - 0x316b], 0x5e39
dec eax
xor ebx, eax
pop edx
add esi, eax
mov eax, dword [esp + ecx*2 - 0x6f438f1e]
pop edx
pop ecx
jmp fcn.005ff9ea

Function at 0x719eeb
Capabilities:
Encode data using base64
Read file on windows
Resolve function by parsing pe exports

Disassembly:
not eax
xor eax, 0x8c37463f
and dword [esp + edx - 0x6f082050], edx
xor ebx, eax
mov word [esp + ecx - 0x7c39bc00], 0xe102
xchg dword [esp + edx - 0x6f082050], ecx
add esi, eax
mov dword [esp + edx - 0x6f082050], esi
ret
xor eax, 0xbd0f60ac
dec eax
lea edx, [edx + ecx*8 - 0x72c5d15e]
jmp 0x648c05
mov dword [esp], 0xb9901b94
add ebp, edx
mov dword [esp + 4], ecx
movzx edx, byte [esp + 5]
mov cx, word [edi + edx*2 - 0x6e]
lea eax, [edx*8 - 0x77dc3ed6]
mov ax, word [edi + edx - 0x35]
dec dl
imul edx, dword [esp + edx*8 - 0x1ac]
call fcn.0068938e
mov eax, 0xda0393a
xor eax, eax
lea esi, [esi + eax*8 - 4]
mov ecx, dword [esi + eax*8]
rol eax, 0x5f
call fcn.006db051
push eax
lea ebp, [eax + ebp - 0x2f8311a2]
mov eax, dword [ebp + edx*2 - 0x233c]
lea ecx, [edx + edx*8 - 0x37ffece8]
xor eax, ebx
inc ecx
dec eax
imul ecx, edx
and cl, byte [esp + edx - 0x119b]
jno 0x6bd998
sub ebp, 4
mov eax, 0x8687fab5
movsx ecx, ax
mov edx, dword [ebp]
xor edx, ebx
xadd al, ah
xor edx, 0xa006c503
ror ax, 0x6c
sub ecx, ecx
inc edx
jmp 0x65830b
Function at 0x72035e
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x3708f613
lea esi, [esi + edx*2 - 0x6e11ec2a]
lea ecx, [edx*8 - 0x5e40c0da]
mov eax, dword [esi + ecx - 0x5a06efbe]
inc edx
call fcn.006ecc0f
btc ecx, 0xa5
neg edx
rol edx, 3
lea edx, [edx + eax*4 - 0x6e34bc2b]
add eax, eax
cwde
jb 0x6a39a7
ror edx, 3
inc edx
neg edx
bts eax, ecx
sal cx, 0xa4
cbw
xor ebx, edx
inc cx
sub cl, 0x86
add ebp, edx
push ecx
sub word [esp + eax*8 - 0x128], 0xd42a
mov di, word [edi + eax - 0x25]
movzx edx, cl
pop edx
jne fcn.006d5934
lea esi, [esi + edx - 0x2436e903]
xor eax, ebx
xor eax, 0x43a69913
lea ecx, [edx + edx - 0x17caa771]
btc edx, edx
inc cx
not eax
bswap eax
rol eax, 1
call fcn.006de109
mov eax, dword [edi + ecx*4 - 0x203f4c]
shl cx, 0xa
jne 0x737c3a
mov edx, 0xbf168a89
mov edx, dword [esi]
mov eax, 0x2cb50a92
movzx ecx, ax
lea esi, [esi + eax*2 - 0x596a1520]
and ax, cx
sbb cx, cx
shr cl, 0xe1
xor edx, ebx
lea edx, [edx + eax*4 + 0x274829d8]
add eax, ecx
jns 0x5eafe2
jmp 0x5d25b2
mov edx, dword [edi + ecx*4 - 0x212ffc]
call fcn.0074d0df

Function at 0x720ef9
Capabilities:
Create thread

Disassembly:
sbb ebp, 4
and eax, eax
mov edx, dword [ebp]
xor ax, 0x418c
xor edx, ebx
ror al, 0x63
xor al, byte [esp + 1]
ror edx, 1
xor edx, 0xcfb30510
inc eax
inc edx
pop ecx
and ecx, ecx
xor edx, 0xf48c8328
lea edx, [edx + ecx - 0x67e00066]
ror edx, 2
btc cx, 0xb0
or eax, eax
dec edx
add al, ch
ror edx, 1
bts ax, 0x27
bts ecx, eax
call fcn.00723c12
call fcn.005d05f0
setb al
adc edi, 7
and eax, eax
dec eax
dec al
mov dword ss:[ecx], edx
mov dword [esp], eax
cdq
jle 0x6e9690
sal cl, 0x43
cwde
ror edx, 2
xor word [esp + eax - 0x544b], ax
xor edx, 0xca00159e
rol edx, 1
dec word [esp + eax*2 - 0xa89c]
sal dword [esp + eax - 0x544f], 0xeb
xor ebx, edx
pop ecx
or dword [esp + eax*8 - 0x2a280], 0x21b6768c
adc esi, edx
add eax, ecx
shl ecx, cl
mov ecx, dword [edi]
mov edx, dword [edi + 4]
adc edi, 8
btr eax, 0xaa
call fcn.006437b5
xor edx, 0x9403b8a1
lea ecx, [eax + eax*4 - 0x37ed48f1]
neg al
bts cx, ax
rol edx, 1
lea ecx, [ecx - 0x13c6095d]
call fcn.00751b32

Function at 0x721a9b
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi + edx - 0x29]
xor ecx, ebx
movzx eax, dl
inc word [esp + edx*4 - 0xa4]
dec ecx
sar dword [esp + edx*2 - 0x52], 0x3e
neg ecx
pop edx
bswap edx
ror dx, 0xc3
xor ecx, 0x370bd226
inc eax
rol ax, 0x22
inc ecx
jmp 0x6bdabe
btc eax, eax
dec edx
bswap ecx
bt eax, eax
cbw
add edi, edx
sal cl, 4
sub ax, cx
mov dword [esp], 0x2c84ae1c
mov dx, word [esi]
mov ax, word [esi + 2]
jp 0x755ff5
adc esi, 1
bt cx, cx
sar ecx, 0xb2
add dx, ax
mov word [esi], dx
pop eax
pop eax
pop ecx
jmp edi
mov ecx, 0x8320a819
sub edi, 4
mov dword [edi], eax
mov dword [esp], 0x651bea29
sub esi, 4
movzx edx, byte [esp]
jmp 0x61d9a2
Function at 0x722bd3
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor edx, ebx
cwde
mov ecx, eax
inc edx
or al, 0x1f
cmovg eax, ecx
rol edx, 1
mov dword [esp], eax
bswap edx
neg edx
xor ebx, edx
btc eax, 0x38
idiv cl
push eax
add esi, edx
bts ecx, eax
bts ecx, ecx
mov dword [esp + 0x10], 0xb235eb89
pop edx
pop edx
pop eax
pop ecx
pop ecx
jb fcn.005ff9ea
Function at 0x723a91
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub dword [ebp - 0x18], ecx
jmp 0x7235cf
jb 0x667631
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0x100
rcr bl, 0xe
shld cx, bx, 0xaf
cmc
mov ecx, dword [ebp - 0x14]
cdq
sal ebx, 0x2e
mov cl, byte [ecx]
shrd dx, sp, 0x28
xor bx, cx
neg edx
mov edx, dword [ebp + 0xc]
movzx edx, byte [esi + edx]
bsr bx, bx
sub ebx, ebx
xadd bh, bh
movzx ebx, cl
add ebx, eax
lea eax, [edx + ebx + 1]
and eax, 0xff
bsr edx, eax
btc dx, 8
movzx edx, byte [edi + eax]
sal bl, cl
mov ebx, dword [ebp - 0x14]
mov byte [ebx], dl
clc
jmp 0x669679
mov byte [edi + ecx], cl
stc
test dl, dh
cmp ebx, edi
add ecx, 1
cmc
cmp ecx, 0x100
jmp 0x644497
mov byte [edi + eax], cl
dec cx
mov ecx, 1
clc
cmp ebx, esp
lea esi, [esi + ecx]
cmc
cmp esp, eax
cmp esi, 0x14
jmp 0x6cde10
jmp 0x414fea
jb 0x6cde18
xor esi, esi
add dword [ebp - 0x14], ecx
cmc
test di, bp
jmp 0x643485
jne 0x6444b0
nop
jmp 0x6c784b
push edi
mov edi, 0xb50d2d22
push edi
mov dword [esp], ebx
call fcn.005f2490
jmp 0x667631

Function at 0x7289db
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
adc edi, 7
cwde
call fcn.00681fbd
mov edx, dword [edx + edi - 0x28dcfffc]
sub ax, 0x5a0a
jbe 0x427c96
mov dword [esp + edx*2 - 0x51ba0000], edx
mov ecx, dword [edx + edi - 0x28dd0000]
sar dword [esp + edx - 0x28dd0000], 0xee
jp 0x6c1c31
xor ebx, eax
add esi, eax
neg dl
jbe 0x6d794f

Function at 0x728aa5
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
and eax, 0xfffffffc
sub eax, ecx
mov esp, eax
call fcn.00745db4

Function at 0x7378ba
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
add eax, 0x910a4498
lea ecx, [ecx + eax + 0x6c5ad864]
xor ebx, ecx
add ebp, ecx
call fcn.004364ae
mov ecx, dword [esi + edx*4 - 0x80]
lea eax, [edx*8 - 0x47c5316f]
xor ecx, ebx
neg ecx
inc ecx
ror ecx, 1
and dl, dh
jne 0x723a97
bswap ecx
je 0x5b203a
jmp 0x5e57d5
mov word [ebp + edx*2 - 0x1d34b3b4], cx
call fcn.00673834
mov ecx, 0xe10de720
mov edx, dword [edi]
mov eax, dword [edx]
mov dword [edi], eax
sub esi, 4
movzx edx, cl
jmp 0x6dd0be

Function at 0x7386f0
Capabilities:
Read file on windows

Disassembly:
push eax
jmp 0x60ab38
call fcn.0043d19e
add esp, 0x10
jmp 0x65ba24
call fcn.006fc647
push 0xfc4
cmovns eax, ebp
not ah
setg al
lea eax, [esi + 0x18]
jmp 0x6ff6b4
jmp 0x6a05a8
cmp dword [esi + 0xc], 0
je 0x650d61
call fcn.006d6104
mov edx, esi
jmp 0x65590d
not edx
lea edx, [ecx + edx - 0x2829482b]
call fcn.0067d1eb
mov eax, 0x21b6109c
movzx ecx, al
lea esi, [ecx + esi - 0x9e]
call fcn.0068fc0c
movzx ecx, byte [ebp]
call fcn.005f3f16
push 0x20
push eax
jmp 0x63e315
neg dl
dec dl
dec cx
shl cx, 0x43
add ecx, ecx
ror dl, 1
call fcn.0065f050
mov ecx, 0x986ee92
sub cl, 0x80
mov edx, dword [ecx + esi - 0x986ee12]
lea esi, [ecx + esi - 0x986ee0e]
movsx eax, cl
rol ax, 0xa3
xor edx, ebx
dec edx
lea eax, [ecx*2 - 0x66702ed8]
bswap edx
ror cl, 0xc5
jb 0x6cb0a9
call fcn.0073b985
push 4
jmp 0x5ef34a
Function at 0x738e83
Capabilities:
Set environment variable
Set registry value

Disassembly:
mov eax, esi
xor eax, edi
jmp 0x5dfa4e
push 4
jmp 0x6f935f
push 0x45f34c
jmp 0x6158a5
push edx
call ebx
add esp, 0xc
jmp 0x70e569
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor dword [esp + 0x14], edi
and ch, 0x32
cmp esp, edi
sub esi, dword [esp + 0x14]
mov edi, dword [esp + 0xb8]
btr edx, 0x1f
cwd
jmp 0x6a439e
mov eax, 0xc22e4507
cdq
mul esi
bts cx, bp
shld cx, si, 4
cmovg si, dx
mov esi, edx
cmc
bts ecx, ebp
shr esi, 0x10
shr ch, cl
bt dx, cx
bts ecx, esi
mov ecx, edi
test di, ax
sub ecx, esi
push ecx
mov edx, esi
lea edx, [esp + 0x28]
jmp 0x5ef13a
push ebp
jmp 0x6a2ecd
push eax
jmp 0x6dcf55
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov ax, 0xd0a6
push 0
lea eax, [esp + 0x34]
jmp 0x6ee539
lea eax, [esp + 0x24]
jmp 0x409390
lea eax, [eax + ecx - 0x46bc4ce]
mov dword [esp + edx - 0x5f1], 0x5a1f7c93
xor ebx, eax
add edi, eax
movzx eax, dx
call fcn.007135c5
je 0x6a2ed3
push 4
rcr dl, cl
sub edx, ebp
bt ax, di
lea edx, [esp + 0x20]
add ax, cx
push edx
ror ah, 0x92
not ax
jmp 0x5be633

Function at 0x738fb2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ebx, eax
add ebp, eax
pop edx
jmp fcn.006d5934

Function at 0x73a729
Capabilities:
Read file on windows

Disassembly:
push edi
jmp 0x64de13
jne 0x65b298
mov ecx, dword [esi + 4]
setbe ah
push ecx
movsx eax, si
push 1
lea eax, [esi + 0xc]
jmp 0x73873b
mov eax, dword [esi + 0x12848]
rcr dx, 0xa2
bswap dx
shr edx, 0x99
mov edx, dword [esi + 0x12840]
mov ecx, dword [eax + edx]
jmp 0x73d0d5
and esp, 0xfffffff8
cmp bp, ax
stc
cmc
sub esp, 0x2c
cmc
push ebx
cmc
test dh, 0xb9
clc
push esi
test ch, bl
stc
rol esi, 0x82
mov esi, eax
cmp byte [esi + 0x12828], 0
jmp 0x609cb8
mov dword [esi + 0x12848], eax
push ebp
test esi, edx
bt bp, 0xba
mov ebp, esp
jmp 0x689274
lea eax, [eax + 4]
test esp, esp
mov dword [esi + 0xc], ecx
test eax, esi
mov dword [esi + 0x1283c], ecx
jmp 0x6a05a2
Function at 0x73c6f9
Capabilities:
Execute anti-debugging instructions
Get file version info

Disassembly:
bts ax, ax
xor ecx, 0xa1176f07
movzx edx, al
shr dword [esp + eax - 0x3c1881cf], 0x3d
ror dx, 0x22
not ecx
lea ecx, [ecx + eax*2 + 0x5f6b50fe]
not byte [esp + eax - 0x3c1881d1]
xor ebx, ecx
add al, dl
shl dword [esp + eax - 0x3c188101], 0x14
adc esi, ecx
cdq
lea ecx, [edx*8 - 0x6ef0bccc]
cdq
mov dword [esp + eax*2 - 0x7831020a], esi
ret 4
mov dword [edi + eax - 0xcf8908], edx
xor dword [esp + eax - 0xcf8904], eax
mov dword [esp + eax*8 - 0x67c4840], eax
adc eax, dword [esp + eax - 0xcf8904]
lea ebp, [ebp + eax*2 - 0x61212a24]
lea ecx, [eax + eax*2 + 0x222ebb7]
and eax, 0xb61383ae
mov ecx, dword [ebp + eax*2 - 0x60210200]
bts ax, ax
xor ecx, ebx
add eax, dword [esp + eax*2 - 0x60210200]
rol ecx, 1
inc word [esp + eax - 0x3c1881cb]
jl 0x6d75ad

Function at 0x73c74c
Capabilities:
Execute anti-debugging instructions
Get file version info

Disassembly:
mov dword [esp + ecx*4], 0x829d38b5
not edx
cwde
call fcn.007078ca
Function at 0x73cb4d
Capabilities:
Execute anti-debugging instructions
Get file version info

Disassembly:
jne 0x74c845
push ebx
jmp 0x74c82a
mov dx, word [ebp + eax]
neg al
add ax, word [ebp + eax + 2]
mov cl, byte [ebp + 4]
call fcn.0072317d
mov edx, dword ss:[ecx + edx*2 - 0x18582]
mov dword [ebp], edx
mov ecx, 0x24af3d30
mov edx, 0x413a2215
setb cl
mov dword [esp + ecx - 0x24af3d00], edi
ret
push eax
jmp 0x618814
call fcn.0043d5f0
mov ebx, eax
cmp cl, 0xbb
add ebx, 1
jmp 0x6b8a42
lea ecx, [ebp - 0x128]
test bx, di
and al, 0x1c
mov edx, dword [ebp + eax - 0x7f8bf501]
je 0x6405bf
lea ebp, [ebp + eax - 0x7f8bf4fd]
push eax
mov dword ss:[ecx + eax - 0x7f8bf505], edx
lea esi, [esi + eax - 0x7f8bf509]
mov edx, dword [eax + esi - 0x7f8bf505]
mov ecx, eax
jb 0x64ba37
mov ecx, eax
ror edx, 3
lea ecx, [eax*8 - 0x73d852cb]
neg word [esp + 2]
not edx
mov dword [esp + 4], ecx
lea edx, [edx + eax + 0x34fc19e6]
xor eax, eax
jns 0x657784
push esp
push edi
scasb al, byte es:[edi]
lodsd eax, dword [esi]
jo 0x64063d
salc
mov ecx, dword [ecx + edx*4]
inc ecx
dec edi
ret 0x5343
xor edx, ebx
dec cl
not edx
dec edx
not edx
rol edx, 1
shr al, 0xe5
dec edx
call fcn.00631589
xor ebx, edx
xor eax, eax
imul ax, ax
adc edi, edx
add cl, 0x2c
jp 0x5f0d40
jne 0x6cc36f
mov eax, dword [ebp - 0x24]
cmp esi, esi
stc
test eax, eax
je 0x436b73
push eax
jmp 0x70448f
call fcn.0044da5b
lea esp, [esp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
cmp dh, al
lea eax, [eax + 1]
test cl, cl
jne 0x6adbda
sub eax, edx
adc ecx, eax
add eax, 0xfffffff6
mov dword [ebp + 0x484], eax
or cl, 0x10
neg ecx
mov dword [ebp - 0x5c], 0
sal cl, cl
nop
movzx ecx, dx
mov ecx, dword [ebp + 0x484]
test esp, edx
clc
cmp dword [ebp - 0x5c], ecx
jge 0x62e36e
cmp byte [ebx], 0x75
jmp 0x70cd1d
mov dword [ebp - 0x84], ebx
push ebx
jmp 0x6adbcc
push edx
jmp 0x6f070d
lea ebx, [ebx + 1]
test esi, edi
mov dword [ebp - 0x84], ebx
cmp ah, bl
add dword [ebp - 0x5c], 1
jmp 0x744c2a
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jmp 0x5bce67
jmp 0x436b6b
jne 0x6cc36f
push 8
movzx cx, cl
cmovno cx, bp
push 0
mov ecx, ebx
call fcn.00438e80
add esp, 8
test edi, edi
cmp eax, dword [ebp - 0x60]
jmp 0x697909
call fcn.00439fe3
add esp, 4
xchg edx, ebx
mov ebx, eax
cwd
mov dword [ebp - 0x24], ebx
cmova cx, sp
push ebx
movsx ecx, di
cdq
mov ecx, dword [ebp + 0x484]
setnp dl
push ecx
xchg dx, dx
movsx edx, ax
mov dh, 0x37
push 0
bswap dx
mov dh, 0x86
cmovae edx, esi
lea edx, [ebp]
jmp 0x6bae5f
mov eax, 0x7f8bf525
mov ecx, dword [ebp + eax - 0x7f8bf525]
btr eax, eax
mov dword [esp + eax - 0x7f8bf505], eax
jb 0x640638
jbe 0x74c845
push eax
jmp 0x73c75b
jmp 0x6adc08
call fcn.0043b519
add esp, 4
mov ax, 0x360a
cwde
mov dword [ebp - 0x24], 0
setns ah
nop
bswap eax
push 0x5c
sets al
mov eax, 0x9b356104
lea eax, [ebp]
jmp 0x5feec0

Function at 0x73dd74
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pop eax
pop edx
pop edx
js fcn.005ff9ea
Function at 0x741bf3
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor ecx, 0xaaa1fc9c
neg edx
mov dword [esp + ecx - 0x6a7fb9fc], eax
mov dword [esp + ecx - 0x6a7fba00], ecx
xor ebx, edx
rol ecx, 0x49
adc esi, edx
pop edx
pop ecx
jmp fcn.005ff9ea

Function at 0x745882
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, ecx
mov ax, word [ecx + ebp - 0x1220122f]
mov dword [esp + ecx - 0x12201231], 0x2232861e
mov cl, byte [ecx + ebp - 0x1220122d]
add ebp, 4
call fcn.005e7303

Function at 0x7481b1
Capabilities:
Get file version info

Disassembly:
jbe 0x6dc8f7
inc edx
add eax, 0x80098e9a
movzx ecx, dl
pop ecx
rol edx, 0xe7
xor ebx, eax
add dx, 0x3d85
adc edi, eax
push ecx
xor cl, byte [edx + esi - 0x3e05]
inc edx
pop eax
sar edx, 0x77
lea esi, [esi + edx*4 + 1]
and eax, eax
xor cl, bl
mov dword [esp + edx + 4], 0xa1077a1d
dec cl
neg cl
dec byte [esp + edx*2]
ror cl, 1
call fcn.0068859a
mov eax, dword [ebp]
add ebp, 4
mov esi, eax
mov edi, 0xe583bb11
call fcn.00402b5a
mov edi, eax
sar ecx, 0x15
sub cl, ch
jp 0x617037
bt edx, 0x88
btr eax, 0x3e
ror ecx, 1
sal eax, 0x12
bswap ecx
mul dx
bt edx, edx
sar al, 0x65
lea ecx, [eax + ecx + 0x4ef7ec8d]
rol edx, 0xee
cdq
xor ebx, ecx
add ebp, ecx
shr dx, 0x61
call fcn.00625b75
not ecx
dec eax
sar dx, 0x2a
neg ecx
shr al, 0xa7
xadd dx, ax
ja 0x6fed04
mov eax, dword [ebp]
mov ecx, 0x3e34a91a
lea edi, [ecx*2 - 0x10f6e6d7]
lea ebp, [ebp + edi - 0x6b726b59]
movsx edx, cx
shl edi, 0x30
sar ecx, cl
xchg ebp, eax
jns 0x61bb22
sbb ecx, 0xb013bc97
bswap eax
and ax, dx
add eax, 0xd112261f
xor ebx, ecx
lea edx, [edx + edx*4 - 0x65ca95cb]
add esi, ecx
and eax, 0xc0b80b00
and ax, 0xd91c
mov edx, dword [edi]
sub eax, eax
mov cx, word [eax + edx]
call fcn.00673272
not eax
xchg byte [esp + ecx*8 - 0x58003], cl
pop edx
inc eax
sar ecx, 0xb5
neg eax
pop edx
xor ebx, eax
xadd dl, dh
adc esi, eax
xor ecx, ecx
or ecx, esi
jmp ecx
mov edx, dword [ebp + ecx - 0x470705a5]
lea ebp, [ecx + ebp - 0x470705a1]
mov dword [esp + ecx - 0x470705a5], ecx
xor edx, ebx
sub dword [esp + ecx - 0x470705a5], 0xf91a8c35
jae 0x6764b6
dec edx
call fcn.007135de
mov ecx, 0x68a5e8a4
shr cx, cl
movsx eax, cx
lea ebp, [ecx + ebp - 0x68a50e8e]
neg eax
mov ecx, dword [ecx + ebp - 0x68a50e8a]
imul al
btc ax, ax
xor ecx, ebx
cwde
neg ecx
add ecx, 0xac011d85
neg ecx
cwde
mov edx, 0xbb0c7912
bswap ecx
btr eax, eax
xor ebx, ecx
or edx, 0x36a72521
shr dl, 2
add esi, ecx
mov ecx, 0x7e324f02
shl edx, 0xbc
mov di, word [edi + eax*2 - 0x6ce8]
call fcn.0072f263
or ax, ax
adc esi, ecx
call fcn.0065aa0d

Function at 0x748822
Capabilities:
Encode data using base64
Read file on windows
Resolve function by parsing pe exports

Disassembly:
dec eax
rol eax, 1
ror cl, 0x45
dec eax
sal dl, 0xa7
call fcn.00625b55
Function at 0x7499e3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [edi]
call fcn.00612348
mov eax, 0x96befe22
sub esi, 4
mov ecx, 0xb3095794
movsx edx, al
mov ecx, dword [edx + esi - 0x22]
rol edx, 0xba
call fcn.00721001
mov ecx, 0xa9b3e296
mov eax, ecx
mov ecx, dword [esi]
add esi, 4
xor ecx, ebx
lea edx, [eax + eax + 0x3e2c7ca5]
sub edx, 0x59aa2e11
mul eax
bswap ecx
xor ecx, 0x8782491d
imul dx
rol edx, 1
shr eax, 0x9f
lea ecx, [ecx + eax*4 + 0x333f3837]
call fcn.007343e8
rol edx, 1
push eax
xor ebx, edx
bt ax, 0xc
jb 0x7076dc

Function at 0x74bc54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0063460a
jae 0x71a696

Function at 0x74bc5a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call eax
lea esi, [esp + 0x2c]
mov dword [esp + 0x24], eax
jmp 0x5f6986
push eax
call edx
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x88]
bswap edx
mov ecx, esi
xchg ch, cl
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x18]
movzx cx, al
not cx
cmovns cx, si
mov ecx, dword [edx + eax + 4]
jmp 0x6104b3
call fcn.00419820
test eax, eax
jmp 0x68e68b
lea eax, [edx + eax + 4]
lea edx, [esp + 0x4e]
push edx
jmp 0x6f89bc
jl 0x6924af
mov ecx, dword [ebx + 0x64]
rcr dx, cl
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4], edx
sar cx, cl
jmp 0x692482
mov ecx, dword [ebx + 0x68]
cwd
inc dh
cmovns dx, di
mov edx, dword [esp + 0x10]
mov dword [ecx + eax*4], edx
sub ecx, esp
mov ecx, dword [ebx + 0x6c]
mov edx, dword [esp + 0x24]
test di, 0x9a
cmp si, ax
mov dword [ecx + eax*4], edx
bts ax, dx
movsx eax, cx
mov eax, dword [esp + 0x38]
xor ecx, eax
neg cx
rol cl, 0x8a
mov ecx, dword [esp + 0x34]
cmp cx, sp
test bh, 0x89
cmc
lea edi, [edi + 1]
cmp cl, ch
lea ecx, [ecx + eax]
cmp esp, 0x3e00e994
cmp edi, ecx
jl 0x5f7198
mov esi, dword [esp + 0x14]
xchg dh, dl
mov dh, 0x85
push esi
jmp 0x751adb
xor edx, 0x1e097c26
pop ecx
jg fcn.006d5934
mov edx, dword [edx + 4]
stc
lea eax, [ecx + eax + 4]
bt cx, bx
neg cx
lea ecx, [esp + 0x10]
push ecx
xchg cx, cx
stc
lea ecx, [esp + 0x52]
cmc
stc
clc
push ecx
stc
add esi, 0x4c
push esi
jmp 0x5f5028
push eax
mov eax, dword [ecx + 8]
jmp 0x5d1e5a