joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ceb2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x43ceef
cmp dword [ebp + 0x14], edi
je 0x43ceef
cmp ecx, edi
jne 0x43cef6
call fcn.0043e5a0
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0043b657
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x43cf0a
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x43cf2b
cmp ebx, 0xffffffff
je 0x43cf1a
push ebx
push edi
push ecx
call fcn.0043e0d0
add esp, 0xc
cmp esi, edi
je 0x43ced7
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x43ced7
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x43cf47
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x43cf4e
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x43d03f
test word [esi + 0xc], 0x10c
je 0x43cfa2
mov eax, dword [esi + 4]
test eax, eax
je 0x43cfa2
jl 0x43d0a0
cmp ebx, eax
mov edi, ebx
jb 0x43cf73
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x43d047
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0043aa45
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x43d037
cmp ebx, dword [ebp - 0xc]
jb 0x43d00f
cmp dword [ebp - 0xc], 0
je 0x43cfcc
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x43cfc1
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x43cfc8
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x43cfd7
mov eax, SysReAllocString
cmp ebx, eax
ja 0x43cfd7
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x43d073
push eax
push dword [ebp - 8]
push esi
call fcn.004444f6
pop ecx
push eax
call fcn.0044542d
add esp, 0xc
test eax, eax
je 0x43d0b2
cmp eax, 0xffffffff
je 0x43d0a0
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x43d037
push esi
call fcn.00444523
cmp eax, 0xffffffff
pop ecx
je 0x43d0a4
cmp dword [ebp - 4], 0
je 0x43d073
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x43cf56
mov eax, dword [ebp + 0x14]
jmp 0x43cef1
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43d05e
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0043e0d0
add esp, 0xc
call fcn.0043e5a0
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x43cee7
cmp dword [ebp + 0xc], 0xffffffff
je 0x43d089
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0043e0d0
add esp, 0xc
call fcn.0043e5a0
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x43cee7
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x43cef1
or dword [esi + 0xc], 0x10
jmp 0x43d0a4
Function at 0x43f473
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x46b338]
je 0x43f48e
inc edi
cmp edi, 0x17
jb 0x43f47f
cmp edi, 0x17
jae 0x43f60e
push ebp
push 3
call fcn.00447ade
cmp eax, 1
pop ecx
je 0x43f5da
push 3
call fcn.00447ade
test eax, eax
pop ecx
jne 0x43f4c2
cmp dword [0x46b060], 1
je 0x43f5da
cmp ebx, 0xfc
je 0x43f60d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x5a0118
push ebp
call fcn.0043b236
add esp, 0xc
test eax, eax
je 0x43f4f8
push esi
push esi
push esi
push esi
push esi
call fcn.0043b55b
add esp, 0x14
push 0x104
mov esi, 0x5a0131
push esi
push 0
mov byte [0x5a0235], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43f53c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0043b236
add esp, 0xc
test eax, eax
je 0x43f53c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0043b55b
add esp, 0x14
push esi
call fcn.0043d9c0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x43f581
push esi
call fcn.0043d9c0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x5a042c
push 0x452bdc
sub ecx, eax
push ecx
push eax
call fcn.00447a2b
add esp, 0x14
test eax, eax
je 0x43f581
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0043b55b
add esp, 0x14
jmp 0x43f583
xor esi, esi
push 0x452bd8
push ebx
push ebp
call fcn.0043d6bb
add esp, 0xc
test eax, eax
je 0x43f5a3
push esi
push esi
push esi
push esi
push esi
call fcn.0043b55b
add esp, 0x14
push dword [edi*8 + 0x46b33c]
push ebx
push ebp
call fcn.0043d6bb
add esp, 0xc
test eax, eax
je 0x43f5c5
push esi
push esi
push esi
push esi
push esi
call fcn.0043b55b
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0044786e
add esp, 0xc
jmp 0x43f60d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x43f60d
cmp ebp, 0xffffffff
je 0x43f60d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x46b33c]
push dword [esi]
call fcn.0043d9c0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44786e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043f752
xor ebx, ebx
cmp dword [0x5a0af8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x447944
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x447a24
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4536d4
push edi
call esi
cmp eax, ebx
je 0x447a24
push eax
call fcn.0043f6e4
mov dword [esp], 0x4536c4
push edi
mov dword [0x5a0af8], eax
call esi
push eax
call fcn.0043f6e4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5a0afc], eax
call esi
push eax
call fcn.0043f6e4
mov dword [0x5a0b00], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043c397
test eax, eax
pop ecx
pop ecx
je 0x447912
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043b55b
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x447944
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043f6e4
cmp eax, ebx
pop ecx
mov dword [0x5a0b08], eax
je 0x447944
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043f6e4
pop ecx
mov dword [0x5a0b04], eax
mov eax, dword [0x5a0b04]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4479c9
cmp dword [0x5a0b08], ecx
je 0x4479c9
push eax
call fcn.0043f75b
push dword [0x5a0b08]
mov esi, eax
call fcn.0043f75b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4479c9
cmp edi, ebx
je 0x4479c9
call esi
cmp eax, ebx
je 0x447996
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x447996
test byte [ebp - 0x18], 1
jne 0x4479c9
lea eax, [ebp - 0x10]
push eax
call fcn.0043c3ce
test eax, eax
pop ecx
je 0x4479b1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043b55b
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4479c0
or dword [ebp + 0x10], 0x200000
jmp 0x447a04
or dword [ebp + 0x10], 0x40000
jmp 0x447a04
mov eax, dword [0x5a0afc]
cmp eax, dword [ebp - 8]
je 0x447a04
push eax
call fcn.0043f75b
cmp eax, ebx
pop ecx
je 0x447a04
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x447a04
mov eax, dword [0x5a0b00]
cmp eax, dword [ebp - 8]
je 0x447a04
push eax
call fcn.0043f75b
cmp eax, ebx
pop ecx
je 0x447a04
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5a0af8]
call fcn.0043f75b
cmp eax, ebx
pop ecx
je 0x447a24
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x447a26
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5a71f0
Capabilities:
Read file on windows

Disassembly:
jnp 0x40927b
mov edx, 0x1e996984
movsx ecx, dx
fild dword [edx + ebp - 0x1e996984]
rol edx, 0x21
lea edi, [edi + edx - 0x3d32d30c]
mov edx, dword [edi + ecx*8 - 0x34c20]
jae 0x657089
and ecx, ecx
call fcn.0067c7d4
xor edx, ebx
jmp 0x63b444
Function at 0x5b1de8
Capabilities:
Get file version info

Disassembly:
mov ax, word ss:[edx + ecx - 0x4d0cb2bf]
ror cx, 0x26
jae 0x6c48bf
lea edi, [edi + ecx - 0x4d0cfec8]
call fcn.006d9725
lea edi, [edi + ecx - 0x64189fc]
ror dword [esp + ecx*4 - 0x190627fc], 0x7f
lea edx, [ecx + ecx*4 - 0x36c832d3]
mov dword [esp + ecx*4 - 0x190627fc], eax
sar dword [esp + ecx*4 - 0x19062800], 0x61
inc edx
push dword [esp + 4]
popfd
or byte [esp + ecx - 0x6418a00], cl
jb 0x61a105
call fcn.005c09c2

Function at 0x5bf1eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [edi], dx
mov edx, ecx
call fcn.005c430f

Function at 0x5c4260
Capabilities:
Encode data using base64

Disassembly:
xor edx, 0xc43447b0
sal al, 0x63
neg edx
shl eax, 0xc3
sbb edx, 0x2d3f493d
cwde
xor ebx, edx
add edi, edx
mov ecx, dword [ebp]
mov dword [esp], eax
movsx edx, byte [esp]
mov dl, byte [ebp + edx - 0x3c]
shl byte [esp], 0x21
ror dword [esp], 0xba
adc ebp, 5
not al
xor eax, eax
call fcn.00614cd7
jge 0x612802
or eax, 0xffffffff
jmp 0x61280b
mov eax, dword [esp + 0x10]
shl dl, cl
movsx edx, si
mov edx, dword [ebp + 8]
lea esi, [esi + eax]
rcl al, 8
shr al, 0xbb
xor ax, di
mov eax, dword [esp + 0x28]
stc
cmc
mov dword [esp + 0x10], esi

Function at 0x5c6287
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov ax, word [ebp + edx - 0x140be601]
mov dx, word [ebp + edx - 0x140be5ff]
add ebp, 2
call fcn.0073e1d2
call fcn.006c633c
sub ebp, 4
mov edx, 0xe2355fbb
mov edx, dword [ebp]
xor edx, ebx
not edx
mov eax, 0x413166bc
ror edx, 2
lea ecx, [eax + eax*8 - 0x3f573e73]
add al, cl
lea eax, [ecx + ecx - 0x7f4a18f3]
lea edx, [edx + ecx*4 - 0x4ca815aa]
seta al
btr eax, eax
cwde
ror edx, 2
inc ecx
call fcn.00721074

Function at 0x5cee7e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap ecx
sbb dl, 0xb8
mov dword [esp + eax*4 - 0x1e8], edx
dec ecx
call fcn.007527c6

Function at 0x5d8877
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + ecx*8 - 0x70888], 0xa4b6c028
ror edx, 1
inc edx
shr cx, 0xaf
call fcn.006e722a
mov ecx, 0xb921998b
movzx eax, cl
bswap ecx
movzx dx, byte [ebp + eax*8 - 0x458]
mov cl, byte [ebp + eax*2 - 0x114]
lea ebp, [ebp + eax*2 - 0x114]
btc eax, 0x29
jae 0x74f226

Function at 0x5e1e12
Capabilities:
Encode data using xor

Disassembly:
mov word [ebp + edx - 0x80000000], ax
pop edx
pop edx
pop edx
pop edx
jns fcn.0068a744

Function at 0x5ea4cb
Capabilities:
Get file version info

Disassembly:
neg edx
inc edx
mov dword [esp + ecx - 0x22], eax
neg edx
jmp 0x658dc6

Function at 0x5fe21a
Capabilities:
Read file on windows

Disassembly:
mov dword [esp + eax], 0x98b4a31e
or ecx, dword [edi + eax*4]
cdq
pop eax
lea edi, [edi + edx*8 + 4]
lea edx, [eax + eax*4 - 0x2fc299f9]
imul dx
jo 0x730225
xor ecx, ebx
neg dx
adc eax, 0xd512ce28
xor ecx, 0x10a5102d
shl edx, 0x14
sal edx, 0x46
or dx, ax
inc ecx
shl dl, 0xa2
rol ecx, 1
rol eax, 5
div eax
or al, ah
dec ecx
ror ax, 0xa8
xor ebx, ecx
add esi, ecx
not ax
jmp esi
Function at 0x6169b8
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
dec ecx
imul dx, dx
xor ebx, ecx
bswap eax
call fcn.0063cee2
call fcn.00685c3f
Function at 0x61dd09
Capabilities:
Check for time delay via gettickcount
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add eax, edi
pop edx
lea edi, [edi + edx - 4]
mov dword [edi + edx*8], eax
xchg edx, ecx
add dx, 0xa027
jle fcn.006f02e6
bts edx, edx
lea ebp, [ebp + edx - 0x7b9ea98f]
not eax
bt dx, dx
mov dword [esp + edx - 0x7b9ea993], edx
not ecx
xadd byte [esp + edx - 0x7b9ea992], dl
and eax, ecx
movzx ecx, byte [esp + edx - 0x7b9ea9a9]
mov dword [ecx + ebp - 0x93], eax
lea ecx, [edx*2 - 0x4feaa5db]
jmp 0x730772
inc edx
not ecx
inc eax
dec al
neg edx
neg al
sal eax, cl
lea edx, [eax + edx + 0x6e83de8c]
inc dword [esp + eax - 0x4dacf400]
ror dword [esp + eax - 0x4dacf400], cl
xor ebx, edx
add ax, 0x3e89
add ebp, edx
rol eax, 0x50
jae 0x7503fa
xor ecx, ebx
lea ecx, [ecx + edx*2 - 0x7be65a42]
lea edx, [edx + edx*8 + 0x300c2ca3]
bswap ecx
inc ecx
ror ecx, 2
rol ax, 0xa6
neg ecx
inc eax
mul dx
xor ebx, ecx
shl edx, 0xba
add esi, ecx
call fcn.006d0b6c
call fcn.006522ab
mov dword [eax], edx
pop ecx
pop ecx
pop edx
pop eax
pop edx
jmp esi
lea edi, [edi + edx - 0x7b9ea9ad]
not edx
call fcn.0061755b
mov ecx, 0x143e3a86
movsx eax, cl
mov ecx, dword [esi + ecx*2 - 0x287c750c]
mov edx, eax
add edx, 0x92939f93
adc esi, 3
xor ecx, ebx
push eax
bt eax, edx
push eax
bswap ecx
mov word [esp + 4], ax
xor ecx, 0xfcbbfeb9
add byte [esp + 3], dh
adc dl, dl
jns 0x69cd27
sub edi, 4
mov edx, dword [edi]
mov eax, dword [esp]
xor edx, ebx
not edx
movsx ecx, byte [esp]
or dword [esp + ecx*8 - 0xc0], ecx
jae 0x61f48c
mov ecx, 0xab35c7a2
sub ebp, 4
mov edx, dword [ebp]
xor edx, ebx
rol edx, cl
dec cl
lea eax, [ecx + 0x2135d1a8]
bswap edx
sal eax, 0xf6
sbb edx, 0xd832d9ab
not ecx
ror edx, 1
dec edx
cwde
xor ebx, edx
push eax
add esi, edx
mul eax
jae 0x5b149c
mov ecx, 0xd11c6a8c
or cx, cx
mov dword [ebp], eax
movzx eax, cl
shr cx, cl
call fcn.005aaa78
shr al, cl
mov edx, dword [esi + eax - 0x32894d01]
sal ecx, cl
movzx cx, byte [edx + eax*2 - 0x65129a02]
lea edx, [eax + eax*2 - 0x31ccfec5]
lea esi, [edx + esi - 0x65cee83c]
call fcn.0070e9fb
call fcn.0067b51e
mov eax, 0x7e9e7490
mov ecx, dword [ebp + eax - 0x7e9e7490]
mov edx, eax
lea ebp, [ebp + edx - 0x7e9e748c]
cdq
lea edx, [eax - 0x59fede77]
jmp 0x700a06
Function at 0x61f4be
Capabilities:
Check for time delay via gettickcount

Disassembly:
lea edi, [edi + ecx*2 - 0x4800c044]
btr dx, dx
xchg ecx, edx
mov dword [edi + edx*2 - 0x4800c040], eax
jb fcn.006f02e6
lea esp, [esp + 0x18]
call fcn.0072a157
rol ecx, 3
push eax
lea edx, [edx*8 - 0x1b576056]
xor ecx, 0xf1ab088a
jmp 0x737e44
mov eax, dword [esi + ecx*4 - 0x6e9dac3c]
mov cl, byte [ecx + esi - 0x1ba76b08]
push 0x8a94e51f
adc esi, 6
shld edx, eax, cl
mov dword [esi], edx
mov edx, dword [esp + 1]
and edx, 0x26a15d3a
push edx
mov dword [esp + edx*8 - 0x2400a100], ebp
ret 0xc
adc ebp, ecx
jmp 0x6da2be
cdq
mov ecx, 0x1ba76b10
mov edx, dword [ecx + esi - 0x1ba76b10]
ror byte [esp + ecx*4 - 0x6e9dac3a], 0x44
jae 0x6953ed
mov eax, dword [esi]
add esi, 4
mov ecx, 0xaf9e1399
xor eax, ebx
lea edx, [ecx + ecx + 0x79227429]
rol cl, 0x83
bswap eax
ror eax, 2
xchg cx, dx
inc eax
bswap eax
inc eax
sub cx, 0x2b1c
call fcn.0066c539
mov edx, 0x9aad2292
lea ecx, [edx*8 + 0x6aa4bebf]
mov ecx, dword [edi + ecx - 0x400dd34f]
call fcn.0061c0f9
mov eax, dword [ebp + ecx - 0x7166ad62]
xor edx, ecx
movzx cx, byte [eax + ecx - 0x7166ad62]
imul edx, edx
lea eax, [edx + edx + 0x2a181e39]
adc ebp, 1
call fcn.006d64e6
not ecx
ror ecx, 3
sal dword [esp], 0x88
sbb ecx, 0x49bad118
and dx, 0x3b0a
neg ecx
cwde
push eax
xor ebx, ecx
shl dl, 0xe3
jae 0x6d0ce4
inc eax
shl cl, 4
xor ebx, eax
and ecx, 0x3e85e126
jns 0x415c32

Function at 0x61fb16
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ebx, ecx
add esi, ecx
cwde
inc dx
mov eax, dword [edi + eax*2 - 0x69c8]
mov cx, word [edi + 4]
call fcn.005dcad4

Function at 0x6262d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.006b37df
mov ecx, 0x2b91ff96
sub ecx, ecx
adc ecx, dword [esi + ecx]
add esi, 4
jmp 0x6bf430
mov eax, 0xa8920926
bt eax, 0x8b
xor ecx, ebx
cwde
neg ecx
btc eax, eax
ror ecx, 2
mov edx, eax
dec ecx
bt ax, ax
jb 0x731e93

Function at 0x63329d
Capabilities:
Read file on windows

Disassembly:
in al, 0x30
jmp 0x8e250416
cwde
je 0x63326d
ret
mov dword [esp + ecx - 0x43cb5fa5], edx
rol eax, 1
xor ebx, eax
add ebp, eax
call fcn.00702844
test dword [edx + 0x19], ebp
jae 0x633299
invalid

Function at 0x633aed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub ecx, 0x8898c098
mov dword [esp], edx
neg ecx
rol ecx, 1
xor ebx, ecx
ror dx, 0x61
sal dx, 0x67
adc esi, ecx
sub eax, eax
call fcn.0063ec66
Function at 0x636698
Capabilities:
Check for time delay via gettickcount

Disassembly:
xor edx, ebx
shl eax, 0x9e
xor ecx, ecx
btc eax, 0x38
xor edx, 0x3a9f2509
shr al, 0xa1
sar eax, 0x6f
bswap edx
call fcn.005da7d3
sub ebp, 4
mov eax, 0xc38b7216
mov ecx, eax
mov edx, eax
mov edx, dword [ebp]
call fcn.0066b83f
lea eax, [eax + edx + 0x57feb00a]
mov dword [esp + edx*4 - 0x767c5294], edx
call fcn.006037a8
mov ecx, 0x6b845b1
lea eax, [ecx + ecx*8 + 0x2073c8a]
ror ecx, cl
mov edx, dword [ecx + esi - 0x22d8835c]
xor cl, ch
bswap ecx
lea esi, [esi + eax*2 - 0x7d035f82]
bswap ecx
xor al, ch
jne 0x5f354d
add edi, ecx
or al, dl
jmp edi

Function at 0x638024
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xor ebx, eax
add esi, eax
xadd ecx, edx
push edx
pop eax
pop eax
pop ecx
pop eax
jne fcn.0068a744

Function at 0x63fa2e
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov bh, 0xb8
jno 0x66f372
xor eax, ebx
sub cx, 0x13a0
shl cx, 0xe
lea eax, [eax + ecx - 0x4e1170c9]
btr ecx, 0x18
jae 0x6e43bf
movsx eax, dl
pop ecx
jne 0x6963dc
dec esi
jno 0x5c70b6
add byte [esi - 0x2aa1ec63], 0x7c
test ebx, edx
nop
mov eax, dword [0xa196db12]
fadd qword [ebx]
mov byte [ebx + 0x5e], 0x44
adc eax, 0x7a5e61ea
out 0xb9, al
jb 0x5c7074
mov eax, dword [0xa197214d]
sbb edi, dword [ecx + edi*2 - 0x74]
mov eax, dword [0x5fe0013e]
pop esi
outsb dx, byte [esi]
neg byte [eax]
sbb al, ah
shl dword [eax], 0xae
test dword [esi + 0x2f], 0xb7443e84
insd dword es:[edi], dx
int3
neg edx
mov dword [esp + eax - 0x7900], eax
sar cl, 3
imul cx, word [esp + eax*2 - 0xf200]
xor edx, 0xc22f1a1a
not ecx
xor ax, word [esp + eax*8 - 0x3c7fe]
pop eax
lea edx, [edx + ecx - 0x42467ed1]
jge 0x5c70a5
inc eax
add esi, ecx
btc edx, edx
fild dword [edi + eax*4 - 0x40000004]
neg eax
jmp esi
sal edx, 0xc3
rol eax, 3
shl ecx, 0xd
ror edx, 0x2f
sar ecx, 2
lea eax, [eax + edx*4 + 0x7b7a878e]
ror ecx, 0x44
xor eax, 0x460dfe3b
bts dx, cx
bt ecx, 0xb3
xor ebx, eax
call fcn.00751be8

Function at 0x653879
Capabilities:
Check for time delay via gettickcount

Disassembly:
lea edi, [edi + edx*2 - 0x75e0675c]
dec eax
mov word [edx + edi - 0x3af033ad], cx
or edx, 0xaab5e71e
movzx ecx, dl
mov eax, dword [ebp + ecx*8 - 0x5f8]
lea ebp, [ecx + ebp - 0xbb]
xor eax, ebx
or dx, dx
xor eax, 0x508d7918
imul edx, edx
sbb eax, 0x91b5c608
neg eax
call fcn.00631d01
mov eax, 0xd339df37
mov edx, dword [edi]
call fcn.00720d28
not ecx
rol edx, 1
xor edx, 0xd13d2e97
sal dword [esp + ecx - 0x58c3f3db], cl
inc edx
or dword [esp + ecx - 0x58c3f3db], ecx
rol edx, 1
movsx eax, cx
xor ebx, edx
and al, cl
adc ebp, edx
add word [esp + ecx - 0x58c3f3da], cx
call fcn.0064d57c
cwd
add ebp, 1
xor cl, bl
inc al
xor cl, dl
ror edx, 0x99
xadd eax, edx
rol cl, 1
lea eax, [edx + eax*8 + 0x3f04d28f]
inc cl
mul ax
rol dx, 0xe9
xadd edx, eax
ror cl, 1
rol edx, 0xfc
inc eax
xor bl, cl
jmp 0x5f1755
jae 0x61be17
mov dword [esp], eax
adc ebp, 1
bt ax, ax
jae 0x6f1a3c
bt eax, 0xa4
add cx, dx
mov word [ebp], cx
and byte [esp + 1], al
pop ecx
jmp esi
Function at 0x658db1
Capabilities:
Get file version info

Disassembly:
shr eax, 0xa
rol edx, 3
pop ecx
call fcn.00722c2b

Function at 0x6641ed
Capabilities:
Read file on windows

Disassembly:
xor edx, 0xb51d0992
mov dword [esp], ecx
sub ecx, 0x46048683
inc edx
lea eax, [ecx*4 - 0x11c1a8ef]
call fcn.00403b3b

Function at 0x6735f5
Capabilities:
Read file on windows

Disassembly:
add ebp, 4
div ecx
call fcn.005cf055
neg eax
and word [esp], 0xd636
lea eax, [eax + ecx - 0x4d843441]
not eax
push ecx
jg 0x6b3a8a

Function at 0x673627
Capabilities:
Read file on windows

Disassembly:
xor byte [esp + eax - 0x11cc30fc], 0xa9
xor edx, ebx
movzx ecx, byte [esp + eax*2 - 0x239861fb]
shr dword [esp + eax - 0x11cc30fb], 0x73
lea edx, [edx + eax + 0x5cdd1f31]
not edx
setnp cl
sbb byte [esp + eax - 0x11cc30fa], ch
dec byte [esp + eax - 0x11cc30ff]
xor edx, 0x928e8423
rol ax, 0x21
lea edx, [edx + eax*8 + 0x453f8692]
neg al
sbb eax, eax
xor ebx, edx
add edi, edx
mov dword [esp + ecx], edi
ret 4
and edx, ecx
mov dword [esp + eax - 0x11cc30ff], eax
mov dword [ebp + eax - 0x11cc30ff], edx
shl dword [esp + eax - 0x11cc30ff], 0xf
mov edx, dword [esi + eax*4 - 0x4730c3fc]
lea esi, [esi + eax*2 - 0x239861fa]
jae 0x640fb9

Function at 0x673696
Capabilities:
Read file on windows

Disassembly:
mov ebx, 0xc7018e1f
call fcn.006f6582
mov ecx, 0xe1230d31
lea edx, [ecx*4 - 0x27d6014c]
call fcn.006fe913
call fcn.00666190
mov ecx, 0x5d040308
mov edx, dword [ebp + ecx - 0x5d040308]
lea ebp, [ebp + ecx - 0x5d040304]
lea ecx, [ecx + ecx*4 - 0x22634ad4]
movsx eax, cx
mov esi, edx
bts cx, cx
lea edx, [eax + eax*2 - 0x7b7dc4e8]
mov edi, ebp
shr edx, 0x27
jne 0x6441a3

Function at 0x6751c6
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
sub ecx, edx
mov dword [esp + ebx - 0x59873b1a], ecx
mov ebp, dword [esp + ebx - 0x59873afe]
movsx esi, bl
mov dword [esp + esi - 0x32], ebx
dec ebp
sal bl, 0x21
shl dword [esp + ebx - 0x59873b61], 0xc5
mov dword [esp + esi*2 - 0x5c], ebx
neg ebp
sal si, 0xa1
ror ebp, 1
shl ebx, 0x25
lea ebp, [ebp + ebx*4 - 0x5698f64d]
ror ebp, 2
bt esi, ebx
jae 0x74ef8a
push 0x330c4e9a
adc ebp, 4
call fcn.006baa43
mov eax, dword [esi]
mov ecx, 0xb9a538b3
jmp 0x5e6a04
neg ebp
sal esi, 0xb2
btc esi, esi
ror ebp, 2
call fcn.005fea31
jae 0x69d3c6
Function at 0x675239
Capabilities:
Encrypt data using speck

Disassembly:
adc ecx, edx
imul eax, eax
ror ecx, 1
inc eax
not ecx
rol eax, 0x33
shl edx, 0x30
and edx, edx
dec ecx
and al, 0x86
sal eax, 0xbb
add edx, eax
xor ebx, ecx
add ebp, ecx
bts eax, edx
jb 0x64a2e9
lea edi, [eax + edi - 0x30000002]
sub eax, edx
cmovp eax, edx
sal eax, 0x17
movzx ecx, byte [edi + edx*2 - 0x60000000]
xor cl, bl
dec al
sub cl, 0x28
ror cl, 1
sub cl, 0x29
neg cl
call fcn.006df9e3
sub ebp, 4
xchg word [esp + 6], cx
call fcn.006b47b7
mov edx, 0x71310030
movzx eax, dl
lea edi, [edi + eax*4 - 0xc4]
not ax
mov ecx, eax
mov ecx, dword [edi + eax*2 - 0x1ff9e]
imul eax
xor ecx, ebx
neg eax
jbe 0x609b83
test eax, 0xc1049daa
pop es
aam 0x5b
leave
adc edi, esi
ror al, 1
xchg ebx, eax
mov ebx, 0x37533509
jle 0x675279
salc
pop edx
enter 0xffffffffffff9dee, 0xffffffffffffffb4
jb 0x675296
popfd
mov ah, 0x36
jb 0x675296
mov edx, dword [esi]
aaa
ret
enter 0x7e3c, 0x1f
adc dword ss:[ecx], esp
push eax
aas
inc ebx
aaa
push ecx
clc
pushfd
adc ecx, esi
scasd eax, dword es:[edi]
clc
inc esp
cmc
mov cl, 0xd2
mov esi, 0x50c4a553
out dx, eax
in eax, 0x51
push edi
js 0x675311
loopne 0x675311
xor al, 0x2d
scasd eax, dword es:[edi]
int1
cmp byte [edi - 0x17686aa3], ch
mov esp, 0x1f8c35bd
sbb esi, 0x29dfbe0b
add al, 0x72
push esi
not ah
insb byte es:[edi], dx
sbb dword [ebx - 0xce5129b], eax
or byte [ebp + 0x52], ch
pop es
sub dword [ebp + 0x53bea9e6], ebx
push ebx
bound ebp, qword [esi + edx*4 - 0x5c]
lahf
out dx, al
das
sub bh, byte [esi + 0x66]
lcall 0xaaa4, 0x7b155b2
dec edx
push 0xffffffffffffffc3
loop 0x675289
mov dword [0x1cf93751], eax
jle 0x675313
push ds
mov al, byte [0x4a7e024d]
cmc
mov dword [0x458271df], eax
mov esi, 0xfd71fb34
sti
jno 0x675311
std
xor esi, dword [esi]
xchg ecx, eax
and al, 0xa9
mov eax, 0x7d69f305
leave
pop ebx
ficom word [esi + 0x7ec2d3bf]
jle 0x6752e5
add edx, edi
invalid

Function at 0x681704
Capabilities:
Read file on windows

Disassembly:
xor bl, al
lea eax, [esp + eax + 0x1c]
shl cx, 0x62
sar edx, 0x51
mov edx, dword [eax + edx*2 - 0x71f2]
lea ebp, [ebp + ecx - 0x78151704]
mov dword [ecx + ebp - 0x78151700], edx
pop eax
pop edx
pop edx
pop eax
pop ecx
pop eax
pop edx
ja fcn.006467aa