joyce8/EMBER2024-capa huggingface dataset:
Function at 0x648ed5
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
add edx, edx
xchg byte [esp + eax - 0xad147d], dl
adc esi, ecx
lea edx, [edx*4 - 0x6ecff35d]
and word [esp + eax - 0xad1482], 0x44ad
shl al, 0xa1
mov dx, word [edi + eax*2 - 0x15a280c]
lea edi, [edi + eax*4 - 0x2b45016]
jp 0x60a59a
dec cx
mov dword [edi], eax
lea eax, [ecx + 0xe024011]
movzx edx, ax
inc byte [esp + eax - 0x9b2d8c1]
lea ebp, [ebp + eax*8 - 0x4d96c60c]
push ecx
lea ecx, [edx*4 + 0x1c20da11]
sal ax, 0xd
mov ecx, dword [ebp + ecx - 0x1c243d15]
jae 0x705214
add dword [esp + eax - 0xad1402], 0x46a8a6aa
lea eax, [eax + eax*8 + 0x7b1c32bd]
sbb ebp, 1
and eax, 0x3729d921
setb al
rol dword [esp + eax*4 - 0x486fffc], 0xa4
movzx eax, byte [ebp + eax*4 - 0x4870000]
shr word [esp + 2], 0x2a
xor al, bl
jmp 0x669809
mov dword [esp + eax*2 - 0x15a2906], eax
xor ebx, ecx
jmp 0x5ae133
neg al
add al, 0x9a
rol al, 1
neg al
dec al
rol al, 1
jmp 0x65ada4
jns 0x65b563
add edx, 0x752d5a8d
fldz
movsx eax, dl
lea ecx, [edx*8 - 0x3b6c6146]
lea esi, [esi + eax - 0x48]
mov ecx, dword [esi + eax - 0x44]
add edx, eax
xor ecx, ebx
call fcn.005e5d1d
mov edx, 0xc7adcc9c
movzx eax, dl
dec ax
mov ecx, dword [eax + edi - 0x9b]
cdq
rol edx, 0x4e
shl edx, 0xef
lea edi, [edx + edi + 4]
lea ebp, [ebp + edx - 1]
xor dl, byte [edx + ebp]
rol ax, 0xc5
div al
or eax, eax
xor dl, bl
xchg ah, al
call fcn.0061597b

Function at 0x64d011
Capabilities:
Check os version
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + ecx - 0x7c000000], edx
ror eax, 3
inc eax
sal ecx, 0xa1
js 0x6cd93f
not eax
ror eax, 2
ror dl, 0x81
sal ecx, 0x38
dec eax
sub edx, edx
pop edx
xor ebx, eax
add esi, eax
dec cl
or edx, ecx
ja fcn.0074b007

Function at 0x653c71
Capabilities:
Read file on windows

Disassembly:
mov ebp, dword [esp + ebp - 0x613cc1b4]
mov dword [esp + 8], 0xf2ec2f00
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00749782

Function at 0x654017
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc cl, 0xb4
bswap eax
shl ax, 0xa5
xor bl, cl
call fcn.0069ebad
neg cl
sal eax, 0x44
xor cl, 0x3f
mov dword [esp + eax - 0x57840b60], eax
sub eax, eax
inc cl
xor eax, eax
push eax
not cl
jae 0x73c565
and ax, ax
jge 0x5ac93a
pop ss
jp 0x73c593
add eax, 0xc1993
add byte [eax], al
sbb al, 0x47
jne 0x73c57c
add al, 0
add byte [eax], al
mov esp, 0x7547
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebp - 0x7c6bd754], cl
les esi, [edx - 0x743741f1]
xchg esp, eax
lea esp, [eax - 2]
invalid

Function at 0x65ae00
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx - 0x99], 0x16b3a0
jne 0x71c855
movzx ecx, dl
mov ecx, dword [esi + ecx - 0x1a]
jmp 0x681ddc
lea eax, [edx*4 + 0xeba5a9f]
call fcn.00638bbe
mov dword [esp + edx - 0x91], eax
movsx eax, byte [esp + edx - 0x99]
cdq
push dword [esp + 8]
popfd
call fcn.005c9147
mov esp, esi
pop ebp
mov esi, 0x5b2c8599
pop esi
mov ecx, 0x7128122a
pop ecx
jmp 0x74d888
mov ebx, 0x86975998
mov edi, ebx
pop edx
call fcn.006b78a6
invalid
Function at 0x65b13d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + ecx*8 - 0x3f190]
xor eax, ebx
bswap eax
mov dword [esp + ecx - 0x7e32], ecx
rol eax, 1
not eax
imul ecx, ecx
rol byte [esp + ecx - 0x3e3541c4], cl
dec eax
mov edx, 0x97945d86
xor ebx, eax
jmp 0x727b5f
imul edx, ecx
xchg cx, dx
add ebp, eax
lea eax, [ecx*8 - 0x48cb1f43]
btc edx, eax
pop eax
pop eax
pop ecx
jae fcn.0074f54d

Function at 0x65ef88
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ebx, ecx
push edx
sal ax, 0x41
add ebp, ecx
push edx
and dword [esp + edx - 0x22862eb8], edx
movzx dx, byte [edx + edi - 0x22862eba]
mov cl, byte [eax + edi - 0x4065044e]
lea edi, [edi + eax - 0x4065044e]
mov dword [esp + eax - 0x40650448], eax
add ax, 0x298f
shr dl, cl
call fcn.006b1eb8

Function at 0x65ff32
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0xd029e5b7
xor ebx, edx
add ebp, edx
neg eax
pop ecx
jb fcn.006d5934
mov eax, ecx
call fcn.0068512a

Function at 0x663648
Capabilities:
Check for time delay via gettickcount

Disassembly:
mul ecx
pop ecx
mov ecx, 0xb534f4a7
or ecx, 0xd20080bf
mov dword [edi], edx
xadd cl, ch
call fcn.005fe221

Function at 0x664436
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ebp, edx
mov dword [esp], eax
mov edx, dword [esp + 3]
ror ecx, cl
movzx edx, byte [edx + esi - 0x1c8]
rol al, 0xa7
adc esi, 0
xor dl, bl
xor cx, 0xb895
ror dl, 1
sar ecx, cl
or eax, 0x323a218f
sbb dl, 0x8b
sal ax, 0x62
xor dl, 0x26
add byte [esp + 1], al
setg al
xadd byte [esp + 6], al
sbb dl, 0xa
xor dl, 0x33
ror word [esp + 6], 0x8e
or cx, 0xbc05
xor bl, dl
lea edx, [esp + edx + 8]
lea ecx, [eax + eax*8 + 0x5a90608e]
movzx cx, byte [edx + ecx - 0x2d607e8e]
cdq
sal word [esp], 0x2f
sbb edi, 1
mov word [edi], cx
lea ecx, [edx + eax*8 + 0x6fb2db25]
pop eax
pop ecx
jmp fcn.006d5934

Function at 0x6644cf
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
btc eax, 0xbc
xor eax, eax
neg ecx
or ax, ax
not eax
xor ebx, ecx
movsx edx, byte [esp + 8]
sal dl, 0xc5
adc esi, ecx
shr eax, 4
shr dword [esp + eax - 0xffffff7], 0x21
pop edx
pop eax
pop eax
jg fcn.005ff9ea

Function at 0x668534
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ebp, edx
pop eax
pop edx
pop eax
jmp fcn.006d5934

Function at 0x668946
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edx
rol eax, 1
sar cx, cl
movzx edx, cl
sar edx, 0x1a
xor eax, 0x80ac8ea6
btc ecx, 0xbe
inc cl
inc cx
xor ebx, eax
ror edx, cl
adc esi, eax
mov ax, word [ecx + edi - 0xbb614d2]
btr edx, edx
bswap edx
jae 0x69ea1d
mov cl, byte [edi + ecx*2 - 0x176c29a2]
sub dl, dh
bt dx, 0x1e
rol dx, 0xe1
lea edi, [edi + edx*2 + 2]
rol edx, 0xba
shr dl, 0x67
sal ax, cl
push edx
sub dx, dx
mov word [edi + edx*8], ax
call fcn.00614817
push 0x54ac3390
mov ecx, dword [edi]
neg dword [esp]
call fcn.006d1721
Function at 0x66bb26
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
bswap ecx
add ecx, 0xaa18cbc
ror ecx, 1
bswap ecx
btc dx, 0x91
imul ax
bts eax, edx
dec ecx
sar edx, 0x61
mov dword [esp], eax
mov dword [esp + 4], 0x363d221f
xor ebx, ecx
add edi, ecx
call fcn.00416d36

Function at 0x66e473
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor bl, cl
div al
dec word [esp + 6]
lea ecx, [esp + ecx + 8]
not dx
mov al, byte [ecx]
bt dx, dx
sbb ebp, 1
shr dl, 0xe1
sub edx, edx
adc dx, 0x6bbb
mov word [ebp + edx*2 - 0xd776], ax
pop edx
pop edx
jne fcn.005fcb00

Function at 0x66f0f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, 0xb8b8d09d
pop edi
sub edi, 5
sub esi, 4
mov ecx, dword [esi]
jmp 0x62a7b5

Function at 0x6746bf
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
dec ecx
lea eax, [eax + eax*4 - 0x2f5812f9]
neg ecx
pop eax
sal dl, 0x26
call fcn.0068409f
mov ecx, 0xd7110a1a
sar cx, 0xc8
movzx edx, cx
lea esi, [edx + esi - 0xe]
movsx eax, dx
mov ecx, dword [edx + esi - 0xa]
sbb ax, dx
cbw
je 0x73f6d2

Function at 0x676e44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub ebp, 4
mov edx, dword [ebp]
mov eax, 0x190c573b
mov dword [esp + eax*4 - 0x64315cec], eax
sar byte [esp + eax - 0x190c573a], 0xe1
xor edx, ebx
lea ecx, [eax + eax*8 + 0x1230c09]
not ecx
btr ax, ax
bswap edx
call fcn.0075184f

Function at 0x679508
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
adc ebp, 4
shld dx, ax, cl
mov word [ebp], dx
mov ecx, 0xa5b7cc1b
add ecx, 0x5700ec31
mov eax, ecx
sbb esi, 4
sub ecx, eax
mov eax, dword [esi + ecx*2]
xor eax, ebx
dec eax
push ecx
call fcn.00622bb4
mov eax, 0xe2b63784
mov ecx, dword [ebp]
add ebp, 4
sal eax, 0xe6
call fcn.00733c3c
mov ecx, dword [ebp + edx - 0x4fb68a20]
sub word [esp + edx - 0x4fb68a16], 0x993
xor ecx, ebx
call fcn.005a3cb9
mov edx, 0xa1853508
or edx, 0xf011f936
mov dx, word [ebp]
mov ecx, 0x82b83c98
jg 0x5eec9d
sbb cx, cx
mov ax, word [ebp + 2]
or ecx, ecx
dec ecx
mov cl, byte [ebp + 4]
jp 0x5ff612

Function at 0x67b99d
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
not eax
sbb ecx, 0xe52f9409
sar edx, 0x9e
bswap eax
imul edx, edx
mov dword [esp + ecx - 0x1ac0ebf5], 0x763d9c99
xadd dword [esp + ecx*4 - 0x6b03afd4], ecx
dec eax
xor edx, 0xa4be31ab
neg eax
bswap eax
imul ecx, edx
adc cx, dx
jp 0x62e3c2

Function at 0x67ba1c
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
call fcn.006e4397
xor ecx, ebx
call fcn.0060429d
Function at 0x67c4f7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi]
xor cx, 0x428b
movzx edx, cl
lea esi, [edx + esi - 0x86]
xor eax, ebx
ror cl, 0xc5
xor eax, 0xd10c8517
lea eax, [ecx + eax - 0x4e85b09d]
rol eax, 1
xor dl, dh
or word [esp + edx*4 - 0x223], cx
mov dword [esp + edx - 0x8a], 0x3d91918c
lea eax, [eax + edx*2 - 0x3caacc9d]
pop edx
not eax
sar edx, cl
xor ebx, eax
add byte [esp + edx*8 - 0x1ec8], dl
adc ebp, eax
bts ecx, 0x8b
pop ecx
jb fcn.006d5934
cmp dword [edx - 0x3c85bb69], ebx
test dword [0x332917da], 0xf40ec376
pop ebx
pop esp
cmp al, 0x2c
inc edi
mov eax, 0x5eceb92
adc byte [ebp - 0x6d], 0x44
mov ebp, 0xf8d20293
enter 0x676e, 0xffffffffffffff80
and bl, cl
fstp qword [esi - 0x73]
ror ebp, 1
cmp byte [edi + 0x45], bl
or ch, byte [ebp - 0x77]
movups xmm1, xmm0
mov eax, 0x3b62a058
push ss
and dh, byte [eax + 0x22]
xor esi, dword [esi - 0x3d]
push cs
hlt
jo 0x67c5b5
or al, 0x5f
int1
enter 0xfffffffffffffb11, 9
pop es
cmp dword [esi], edi
outsb dx, byte [esi]
and dl, byte [ecx - 0x61d01cac]
inc edx
pop esp
stosb byte es:[edi], al
in al, 0xc6
std
adc bl, ch
push esi
sbb al, 0x9a
fld qword [ebp - 0x78]
out 0xc4, al
cmc
or eax, dword [edi - 0x59]
mov dl, 0x83
fstp qword [ecx - 0x5acbf119]
jg 0x67c5d0
jae 0x67c55d
inc ebx
stc
stc
rol byte [ebx + 0x76], cl
cmp byte [eax - 0x62], dl
sahf
jns 0x67c591
pop ecx
cmpsd dword [esi], dword es:[edi]
lahf
invalid

Function at 0x67dc76
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp + edx - 0x48c8448a]
xor eax, ebx
mov dword [esp + edx - 0x48c8448a], edx
not dx
inc edx
ror eax, 3
sub eax, 0x470866bb
bts edx, edx
bswap edx
neg edx
xor eax, 0x32a4f1be
shr ecx, 0x41
pop ecx
not eax
jge 0x6c1dab
setbe byte [esp + ecx - 0x48c84488]
shl dl, 0xa1
rol eax, 1
bt dx, cx
btr dx, cx
xor ebx, eax
add esi, eax
movsx eax, dl
call fcn.00746a16

Function at 0x67e8c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sal byte [esp + eax - 0x7c11bb89], 0xe4
call fcn.0065b9da
lea eax, [edx*8 + 0x561ec0be]
dec ecx
div al
sub eax, eax
rol ecx, 3
ror dx, 0xaa
lea edx, [eax + eax*8 - 0x70fa11cf]
inc ecx
xor ebx, ecx
cdq
xor dl, al
adc ebp, ecx
jmp fcn.006d5934
mov eax, ecx
mov dword [esp + eax - 0x7c11bba9], ecx
sub dl, 0x22
ror dl, 1
add dl, 0x88
ror dl, 1
inc ecx
add dl, 0x81
sub al, 0x1f
xor bl, dl
dec al
lea edx, [esp + edx + 4]
lea ecx, [ecx*2 - 0x55de58c2]
mov cx, word [eax + edx - 0x7c11bb89]
jno 0x65bdec
and cl, 0x1e
lea eax, [eax + ecx - 0x78b34b0b]
ror edx, 1
or edx, 0x87879c36
xor eax, 0x1a9ff4a0
add edx, dword [esp + ecx + 3]
inc word [esp + ecx]
xor ebx, eax
ror dword [esp + ecx*4 + 4], 0xc3
adc dx, 0x1900
adc edi, eax
call fcn.00708644
pop ecx
pop edx
jmp ebp

Function at 0x683558
Capabilities:
Create thread

Disassembly:
lea edx, [ecx + 0x1104cc80]
pop ecx
pop edx
jp fcn.006d836e
Function at 0x684b1c
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xor ebx, eax
sar ecx, 0xb1
cmovne ecx, dword [esp + ecx - 0x13b3]
adc esi, eax
mov ecx, dword [edi + ecx - 0x2500f40b]
call fcn.005d68f5
movzx eax, byte [esi]
mov edx, 0xdfa87500
sar dl, 2
lea edx, [edx*8 - 0x7cf64f53]
adc esi, 1
xor al, bl
bts edx, edx
dec al
push edx
mov ecx, 0xf50e50a2
or byte [esp + 2], 0x96
xor al, 0x8d
jmp 0x7090ba
inc edx
pop edx
pop edx
jge fcn.006d5934
lea ecx, [ecx*4 - 0x5dd013f5]
rol eax, 1
sar cl, 1
xor ecx, 0x8509ee95
jne 0x5b064d
ror al, 1
xor bl, al
lea eax, [esp + eax + 4]
xor cl, byte [esp + 3]
mov ecx, dword [eax]
sbb edi, 4
sal dword [esp], 0x5b
setnp dl
mov dword [edi], ecx
mov ecx, dword [esi]
sar word [esp + 1], 0xaf
mov eax, edx
adc esi, 4
or dl, ah
inc edx
xor ecx, ebx
sub ecx, 0x1721f803
push eax
ror ecx, 1
bswap ecx
neg edx
rol ecx, 3
xor ebx, ecx
sub edx, dword [esp + edx - 0x7fb28786]
sub dword [esp + edx - 0x7f323a0b], edx
add ebp, ecx
dec ax
jno 0x5c9e8e
inc ecx
bswap ecx
call fcn.00643f65
rol ecx, cl
sbb dl, 0x9d
xor eax, ebx
or dl, 0x92
lea edx, [edx*8 - 0x2548fc78]
xor eax, 0xb40f91bd
bts edx, 0xa6
push edx
not dword [esp + ecx - 0x100000]
not eax
xchg byte [esp + ecx*8 - 0x800000], dh
jae 0x74e9ce
dec ecx
sbb edx, ebx
retf 0x7961
rol cx, 0xab
adc al, 0x19
ror dword [esp], cl
neg word [esp + 2]
rol al, 1
or cx, dx
not al
sbb byte [esp + 3], 0x3a
xor al, 0x21
add al, 0xbc
jmp 0x65a842
sal byte [esp + ecx*8 - 0x7ffffe], 0x67
ror eax, 2
or cl, byte [esp + ecx - 0x100000]
xor eax, 0xca00159e
jmp 0x5e6db3

Function at 0x685863
Capabilities:
Execute anti-debugging instructions
Get file version info

Disassembly:
mov dword [esp + edx - 0x2894], edx
mov dword [ecx + edx - 0x2894], eax
lea eax, [edx + edx - 0x41fd976e]
lea esi, [esi + edx*2 - 0x512c]
mov edx, dword [esi + edx*8 - 0x144a0]
jb 0x6f06e5
xor edx, ebx
bts eax, eax
ror edx, 1
neg edx
mov dword [esp + 4], 0xb716a336
xor edx, 0x343d8615
lea ecx, [eax + eax*2 + 0x1fb82f99]
neg al
xchg al, cl
dec edx
call fcn.005f2540

Function at 0x68b08c
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0xd00f7eb8
sub ebp, 4
movzx edx, cl
mov edx, dword [ebp + edx*4 - 0x2e0]
jmp 0x643db4
add al, cl
dec ax
not edx
sbb edx, 0xf7b2f4ac
bswap edx
imul eax, ecx
sub eax, 0xcc069f97
xor ebx, edx
xor cl, cl
lea eax, [ecx + eax*4 + 0x7f95c118]
adc esi, edx
mov edx, edi
lea edi, [edi + eax - 0x5e4fd676]
mov word [edi + eax - 0x5e4fd674], dx
movsx edx, cl
mul dl
bt edx, edx
jae fcn.005ff9ea
sub esi, 4
mov ecx, 0xfb214da6
call fcn.0060c492
mov eax, 0x5018670d
shr cx, 0x41
xor edx, ebx
rol cx, 0x4a
inc cl
adc ax, cx
sbb edx, 0xc817a222
jmp 0x6192f4
mov dword [esp], 0xbba62a9e
inc edx
not byte [esp]
neg edx
movzx eax, cx
ror edx, 2
pop ecx
jmp 0x731b26
shr byte [esp + eax*2 - 0xcc35], 0x66
dec edx
or eax, ecx
inc al
rol edx, cl
not ecx
dec edx
mov dword [esp + ecx - 0x4459d59e], 0x2f1c1c1f
xor ebx, edx
not ecx
add al, 0x28
adc edi, edx
push eax
push eax
push ecx
sub esi, 1
shl al, 1
movzx ecx, byte [esi]
cwde
call fcn.006290eb
jmp 0x5ca047
Function at 0x690308
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0xe890a691
or dx, dx
mov ax, word [edi]
shl edx, 0xbb
lea ecx, [edx*4 + 0x4a190c8c]
mov cx, word [ecx + edi - 0x6a190c8a]
imul edx, edx
lea edi, [edi + edx*2 + 2]
or ax, cx
mov ecx, 0x910a113a
sar cl, 0xe7
not ax
sub ecx, edx
dec cx
mov word [edi + edx*2], ax
dec ecx
lea esi, [esi + edx*8 - 4]
sub edx, edx
mov eax, dword [edx + esi]
jbe 0x719fde
xor ebx, ecx
ror eax, 0xac
mul al
adc ebp, ecx
call fcn.0075545f
sub esi, 4
mov edx, dword [esi]
xor edx, ebx
rol edx, 3
sub edx, 0x6883ee02
jmp 0x75b7e0
mov edx, ecx
inc eax
mov dword [esp], ecx
bswap eax
dec eax
shr ecx, cl
ror eax, 3
mov dword [esp + ecx - 0xe], edx
jmp 0x6903a7
sal dword [esp + ecx - 0x10], cl
xor ebx, eax
xchg edx, ecx
neg cx
lea ebp, [edx + ebp - 0x16]
shr ecx, cl
call fcn.0064e31c
mov eax, 0x2e104daf
btr ax, ax
movsx edx, al
mov ecx, dword [ebp + eax*2 - 0x5c209b5e]
add eax, eax
add al, dh
adc eax, eax
mov dl, byte [ebp + 4]
lea eax, [eax*4 + 0x7c01d517]
lea ebp, [ebp + eax - 0x5d06affd]
call fcn.00706206
jmp 0x66080b
Function at 0x6943fd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rol eax, 1
neg eax
mov dword [esp + edx*4 - 0x138], edx
push ecx
dec eax
btc dx, cx
push edx
shr edx, 0x73
ror eax, 1
xor dx, cx
xor ebx, eax
xor dword [esp + edx*4 - 0x20000], ecx
adc edi, eax
shl byte [esp + edx*4 - 0x1fff6], 0x87
pop edx
pop edx
pop ecx
jp fcn.00605d25

Function at 0x694433
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0xc]
jb fcn.00694433
call fcn.00707d86

Function at 0x696a63
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 7]
neg edx
shr ecx, 0xd4
lea ecx, [ecx*8 - 0x6f7cd95e]
lea edx, [edx + ecx*2 - 0x7505781f]
mov dword [esp], 0x4294ffa1
neg edx
bswap edx
mov eax, 0x32f0633
xor ebx, edx
add esi, edx
mov di, word [eax + edi - 0x32f0633]
xadd al, ah
pop eax
pop edx
pop edx
jno fcn.005ff9ea
jmp 0x728724

Function at 0x69877d
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov eax, ecx
lea ebp, [ebp + edx*2 - 0x2a8b7544]
add dx, dx
shr word [esp + edx - 0x1545753a], 0xab
mov eax, dword [ebp + edx*4 - 0x5515d500]
xor eax, ebx
neg dl
or ecx, dword [esp + edx - 0x154575bc]
inc eax
mov dword [esp + edx*4 - 0x5515d700], 0x1822b3b5
add edx, 0xb7227407
rol eax, 1
jmp 0x72849c
bswap eax
inc edx
xor ecx, 0x739a06bb
neg eax
sar dword [esp + ecx - 0x4aae5805], cl
shr edx, 0x13
lea ecx, [ecx + edx*4 + 0x1eb45905]
xor ebx, eax
add esi, eax
or ecx, ecx
ja 0x627bbe
sub esi, 4
mov eax, dword [esi]
mov ecx, 0xca03201b
xor eax, ebx
push ecx
sar word [esp + 2], 0x6a
mov edx, ecx
inc eax
neg eax
xor word [esp + 1], cx
shr word [esp], 0x81
ror eax, 2
call fcn.00748822
lea ecx, [eax*2 + 0x67198c9e]
xor ebx, edx
add cl, 0xc
cwde
adc ebp, edx
lea esi, [esi + eax - 0x29]
cdq
mov eax, dword [esi + ecx - 0x671b8cf4]
and edx, edx
shl ecx, cl
btc cx, cx
xor eax, ebx
lea eax, [eax + ecx - 0x79c55cb]
ror edx, 0x4d
neg eax
sub eax, 0x81ab6c9c
sar edx, 0xd5
call fcn.0040dd59
call fcn.005eeff0
sbb word [esp + ecx - 0x4020809], cx
mov edx, ebp
neg dword [esp + ecx - 0x402080a]
or ecx, ecx
lea ebp, [ebp + ecx - 0x402080c]
call fcn.007102b5
Function at 0x698c40
Capabilities:
Encode data using xor
Set environment variable
Set registry value

Disassembly:
ror edx, 2
neg eax
xadd cx, ax
xor edx, 0x5809931a
add cx, 0xe38
jge 0x5e5ac5
mov word [ebp], ax
push edx
sub dword [esp], edx
sbb esi, 4
mov eax, dword [esi]
mov ecx, edx
bt cx, 0x24
xor eax, ebx
xor eax, 0x8120f387
ror eax, 2
neg eax
ror eax, 2
or cx, cx
sub dword [esp], ecx
lea eax, [edx + eax - 0x3b4b5dad]
ror eax, 2
xor ebx, eax
inc edx
setp byte [esp + 1]
imul cx, dx
add edi, eax
inc cx
call fcn.005aa7e3
not ax
mov word [edi + ecx*2 - 0x1f656c], ax
inc ecx
movsx eax, cl
lea ebp, [ebp + ecx - 0xfb2bb]
call fcn.00715f69
dec byte [0xa3c23503]
add byte [edi], 0x35
invalid
xor ebx, eax
neg dword [esp + ecx - 0x16027b]
mov dword [esp + ecx - 0x160283], ecx
mov dword [esp + ecx - 0x160287], ecx
add esi, eax
call fcn.00615e75
mov ecx, dword [ebp]
mov eax, 0xcd21a03c
movsx edx, ax
shr ax, 0x6e
mov edx, dword [ecx]
lea eax, [eax - 0x79c227eb]
mov dword [ebp + eax - 0x535ed817], edx
mov edx, 0xb3172519
sub al, dl
movsx ecx, ax
lea esi, [esi + eax - 0x535ed902]
div ecx
cdq
mov edx, dword [esi]
inc ecx
xor edx, ebx
bts ax, cx
jae 0x67fec8

Function at 0x6a107a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + edx - 0xa41d], edx
inc ecx
inc edx
neg ecx
dec ecx
xor ebx, ecx
add edi, ecx
movsx ecx, al
mov eax, dword [ebp + edx*2 - 0x1483c]
pop edx
btr dx, dx
btc cx, 0
mov ecx, dword [edx + ebp - 0x8419]
bt edx, edx
lock xadd dword [eax + edx - 0x841d], ecx
call fcn.005b1aba
div eax
neg ecx
sub dx, 0x2b1
mul al
not al
sbb ecx, 0xb3850f28
inc ax
and dl, ah
xor ebx, ecx
cwde
add esi, ecx
btr edx, 0x95
rol eax, 0x37
jb 0x703431
bt dx, dx
dec ecx
rol eax, 3
neg dl
shl cx, 2
neg eax
call fcn.00674ace
mov edx, dword [edx + edi - 0x30e5307]
movsx ecx, al
lea edi, [ecx + edi - 7]
bt ax, ax
lea ebp, [ebp + ecx*4 - 0x2d]
mov cl, byte [ebp + ecx*8 - 0x58]
push eax
setae al
xor cl, bl
cwde
neg cl
sar dword [esp + eax - 1], 0x1f
add cl, al
ror cl, 1
xor cl, 0xb3
and ax, ax
xor bl, cl
lea ecx, [esp + ecx + 4]
call fcn.006835d9

Function at 0x6a10f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bts ecx, 0x14
call fcn.00695f2b

Function at 0x6a18a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor bx, dx
rol ecx, 0x55
sal word [esp + eax + 5], 0x21
sub ecx, ecx
lea edi, [edi + eax - 2]
push ecx
mov word [edi + ecx*2], dx
pop ecx
pop eax
pop ecx
pop edx
je fcn.006d5934
mov ecx, 0x71a3f31f
mov dx, word [esi + ecx - 0x71a3f31f]
call fcn.00611739
xor edx, ebx
mov ecx, 0x199c6810
ror edx, 2
dec cl
movsx eax, cl
bswap edx
ror edx, 1
call fcn.0071129a
test byte [edi - 0x5f], bl
cmp eax, 0xf501a27d
xor al, 0xd6
push 0x9d7b74b
xchg ecx, eax
add eax, 0xc8a77874
cdq
pushal
dec esi
mov ah, 0xe2
imul edx, dword [0x16c1d5cb], 0xffffffce
invalid
Function at 0x6a39d8
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
ror al, 1
sub al, 5
shr ecx, 0xb6
imul dx, cx
xor bl, al
lea edi, [edi + edx - 0x5000e970]
imul edx, edx
xadd ecx, edx
mov word [edi + edx*8 - 0x1cc8], ax
bt cx, cx
lea eax, [edx*8 + 0x790d0c3a]
jb fcn.005ff9ea
xchg esp, eax
push ds
and dword [eax - 0x15], edx
invalid
pop ecx
pop ecx
pop eax
pop eax
pop eax
jno fcn.005ff9ea
mov edx, dword [ebp]
xor edx, ebx
inc edx
xor edx, 0x13be8326
movsx eax, cx
bt eax, eax
neg edx
ror edx, 3
bswap edx
dec edx
shr eax, cl
xor ebx, edx
neg ecx
ror ax, 0xab
sbb eax, 0x199936a5
add esi, edx
xchg ecx, eax
inc cx
lea ebp, [ebp + eax - 0x55e03b08]
movzx edx, cx
sub dx, 0x7827
movzx eax, byte [ebp + eax - 0x55e03b07]
sal edx, cl
xor al, bl
inc ecx
inc al
ror cl, 1
xchg dx, cx
xor al, 0xa
jmp 0x5f0068

Function at 0x6a6be2
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov dword [edi + 4], eax
mov dword [esp], edx
neg word [esp]
mov ecx, dword [esi]
adc esi, 3
xchg dword [esp], edx
lea edx, [edx + edx*4 - 0x7a6b8ec5]
xor ecx, ebx
lea edx, [edx*8 + 0x522b7dbb]
pop edx
sub ecx, 0x72b70928
mov eax, edx
xadd eax, edx
jg 0x68ab92
rol ecx, 3
ror dl, 0xe6
not ecx
sbb eax, edx
jle 0x750fb0
imul eax, eax
sbb ecx, 0xb9bdcbaa
xor ebx, ecx
mul ax
shl eax, 0xbf
adc ebp, ecx
shr dx, 0x8f
movzx ecx, al
add ecx, ebp
jmp ecx

Function at 0x6a7308
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esi, 4
movsx edx, cx
lea eax, [ecx*2 - 0x657026f2]
cdq
mov eax, dword [esi]
xor eax, ebx
mov dword [esp], 0x10831e34
xor eax, 0xca0fcb92
inc dword [esp]
setns cl
bswap eax
jo fcn.005db368
bts cx, 0x81
adc eax, 0xd09669d
sal edx, cl
not byte [esp]
jae 0x627fb7
neg eax
not eax
xor ebx, eax
call fcn.00702c8a
test ax, 0xc6be

Function at 0x6b03b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi]
add dl, dh
mov dword [esp], edx
xor eax, ebx
neg dword [esp]
jg 0x728b1d
movzx ecx, dx
bswap eax
seta dl
and dword [esp + ecx - 0x74a1], edx
sbb eax, 0x9a884530
not ecx
pop edx
sar edx, cl
not eax
btr ecx, ecx
bts cx, 0x20
call fcn.00681d46