joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ad50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x41ad72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ad79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ad68
mov eax, 1
add ebx, ebx
jne 0x41ad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ad80
jne 0x41ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ad80
xor ecx, ecx
sub eax, 3
jb 0x41adb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ae22
mov ebp, eax
add ebx, ebx
jne 0x41adbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41adc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41adec
inc ecx
add ebx, ebx
jne 0x41add8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41adcd
jne 0x41ade9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41adcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ae0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41adfd
jmp 0x41ad6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ae0c
add edi, ecx
jmp 0x41ad6e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ae2a
cmp byte [edi], 5
jne 0x41ae2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ae2f
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41aea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ae5c
mov ecx, edi
jns 0x41ae8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a09c]
or eax, eax
je 0x41aea1
mov dword [ebx], eax
add ebx, 4
jmp 0x41ae79
call dword [esi + 0x1a098]
mov ebp, dword [esi + 0x1a0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41aedb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x40229a
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push edi
push dword [0x403716]
call dword [sym.imp.pdh.dll_PdhCloseLog]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x4022c9
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x40164f], eax
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40229a
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push edi
push dword [0x403716]
call dword [sym.imp.pdh.dll_PdhCloseLog]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x4022c9
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x40164f], eax
ret
Function at 0x5799ed
Capabilities:
Encode data using base64

Disassembly:
inc eax
xor ecx, 0xd9b3d1f
dec ebp
jmp 0x668ef4
lea esp, [esp + 0x10]
jne 0x691c1d
not ecx
jmp 0x6c6ddc
mov edx, 0x9ba449b
or dl, dl
movzx edx, byte [eax + edx*8 - 0x4dd224d8]
call fcn.0068954c
jmp fcn.00758de8
mov dword [edi], ecx
jmp 0x6a7e3d

Function at 0x57a842
Capabilities:
Encode data using base64

Disassembly:
adc edi, 4
shld dx, bp, cl
push 0x46280cae
mov word [edi], dx
jmp 0x74733e
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x5836a0
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], ax
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x585cbd
Capabilities:
Encode data using base64

Disassembly:
xor dl, 0x25
pop eax
mov eax, 0x3c9f8918
add eax, eax
not dl
push eax
xor bl, dl
add al, 0x25
lea edx, [esp + edx + 4]
movzx ax, byte [eax + edx - 0x793f1255]
jge 0x73d732
push 0x35071e85
adc edi, 2
mov word [edi], cx
call fcn.00672e78
call fcn.006d46d8
push cs
push 0x5835b2
ljmp 0x33
inc ebp
pop edx
mov es, word [edi + 0x78a87745]
cdq
adc dl, bh
aas
fimul word [eax]
invalid
mov ebx, 0xa08dfc93
cmp dword [edx - 0x5d], esi
xor ah, byte [edx]
in eax, dx
pop esp
push ecx
mov bh, cl
push es
pop edi
call [eax]
fld1
imul ebp, dword [0xa0fce6fb], 0x12fc6026
xchg dword fs:[edi - 0x7a], edi
sub eax, esi
inc esp
xchg ecx, eax
sbb esp, ecx
les eax, [esi]
loope 0x6c387a
push es
aas
in eax, dx
xchg ecx, eax
je 0x6c388c
sbb eax, 0xa7ef5b9a
invalid
sbb edi, 2
push 0x2f147225
mov word [edi], ax
lea esp, [esp + 8]
jmp fcn.0077dcde

Function at 0x586dcf
Capabilities:
Encode data using base64

Disassembly:
sub edi, 8
mov dword [edi + 4], eax
push 0x3f016e99
mov dword [edi], edx
lea esp, [esp + 8]
jmp fcn.0077dcde

Function at 0x587355
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.007b57f6

Function at 0x58924b
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x589e17
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.007b57f6

Function at 0x58a558
Capabilities:
Encode data using base64

Disassembly:
or ax, cx
not ax
push 0x703250a6
mov word [edi], ax
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x58abca
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], ecx
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x58b04d
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [esp + esi - 0x73201fa6]
lea esp, [esp + 8]

Function at 0x66668e
Capabilities:
Encode data using base64

Disassembly:
add edi, 2
shr ax, cl
mov word [edi], ax
jmp 0x736921
lea esp, [esp + 4]
jmp fcn.007b57f6

Function at 0x669b88
Capabilities:
Encode data using base64

Disassembly:
add edi, 2
shr ax, cl
mov word [edi], ax

Function at 0x66a3ca
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.007b57f6

Function at 0x66d229
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.007b57f6

Function at 0x67060a
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.007b57f6
Function at 0x671d57
Capabilities:
Encode data using base64

Disassembly:
jno 0x672694
xor dword [edi], 0x72000009
push ebx
jb 0x671db2
inc ecx
ja 0x671da5
pop eax
ja 0x671da4
inc ebx
pop ecx
inc esi
movhps xmm6, qword [edi + esi*2 + 0x36]
xor ebp, dword [ecx]
jbe 0x671db1
xor bh, al
popal
sbb ebp, ebx
mov dword [0x1ed366ef], eax
int 0x3a
je 0x671d7d
cmp dh, byte [ebp + edi*8 + 0x55]
push ebp
push ebx
add byte [eax + 0xe], cl
sub edx, dword [eax + 0x11]
xor al, 0xa5
push edx
in al, dx
movsd dword es:[edi], dword [esi]
loopne 0x671d58
invalid
adc byte [ebx - 0x7b49f09a], ah
mov dword [0x84b60f66], eax
dec edi
out dx, eax
pop esp
cdq
lea esi, [esi + ebp - 0x66a310b0]
push eax
push eax
out dx, eax
pop esp
cdq
xor al, bl
lea ebp, [ebp + ebp*8 + 0x659d2a8d]
shl bp, 0x4a
ror al, 1
add al, 0xb4
neg al
add al, 0x85
ror ebp, 0x37
sbb bp, 0xee99
ror al, 1
sal ebp, 0x18
sub al, 0x82
shr ebp, 0xa6
ror al, 1
rol ebp, 0x66
xor bl, al
and ebp, ebp
js 0x6daf23
adc eax, esp
sal ebp, 0x2c
sar bp, 0xc8
add ebp, dword [eax + ebp]
sub edi, 4
mov dword [edi], ebp
call fcn.0066b122
push 0x37af8cac
add esi, 2
xor cx, bx
sub cx, 0x9e39
ror cx, 1
dec dword [esp]
inc cx
xor cx, 0x7397
rol cx, 1
call fcn.006c5a99
xor al, bl
add al, 0xab
mov dword [esp], 0xe12c10ad
not al
push 0xb820a425
dec al
dec dword [esp + 3]
xor al, 0xa
neg al
inc al
push 0x63a06501
ror dword [esp + 4], 0x27
xor bl, al
sub edi, 2
mov word [edi], ax
lea esp, [esp + 0xc]
jmp fcn.0077dcde

Function at 0x671ef3
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], dx
jmp 0x72c0c9
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x672318
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x69d9ba
out dx, eax
jmp 0x794785
and edi, 0xff
mov edi, dword [edi*4 + 0x6d80dc]
shr eax, 8
xor eax, edi
inc edx
call fcn.006d8eb0
cmpsb byte [esi], byte es:[edi]
fstp qword [ecx + eax*4 - 0x73024b65]
sahf
mov eax, edx
mov ebp, 0xac85c4a7
add byte [esi - 0x647e6323], ah
mov ah, 0xfd
mov word [esi - 0x58422f77], ds
les eax, [ebp - 0x3b7a5154]
scasb al, byte es:[edi]
test esp, eax
loope 0x69d9e2
fcom dword [edx]
or edx, dword [ecx + 0x6c]
jo 0x69d9ac
aaa
mov esi, 0x81a080e7
sbb byte [esi], ch
jns 0x69da4a
rcr byte [edi - 0x6c354a84], 0x59
dec edx
loop 0x69da4f
push ss
pop eax
jge 0x69d9d1
bound edx, qword [esi - 0x53821cc7]
and dword [ecx - 0x7ea4e7c0], esp
cmp byte [ebp - 0x2d3b553d], ch
test dword [eax - 0x38815a9f], ebp
or dh, byte [eax - 0xe]
in al, dx
mov edx, 0xb96eaadd
pop esi
cmp eax, 0xef179b7
stosb byte es:[edi], al
outsb dx, byte [esi]
mov ecx, 0x79b73d5e
int1
push cs
xchg dword [edi], ebp
movsd dword es:[edi], dword [esi]
jle 0x69d9d9
add edi, dword [esi]
sub eax, 0x796b7a14
adc dl, byte [ebx + 0x4a]
adc ebx, ecx
imul esp, dword [esi + 0x55c49772], 0x10791002
jnp 0x69da24
ror byte [edx - 0x5efd40d9], 0x63
cmp ebx, dword [ebx - 0x7f]
mov eax, dword [0x815b3b63]
cmp byte [edx], dh
and al, 0x2b
jl 0x69d9ee
ret
dec ecx
add esi, 4
jmp 0x69092e
Function at 0x673203
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
je 0x69e036
push edi
push 0x468d0ba8
call fcn.00589e00
push 0x30bb9c92
not eax
jmp 0x78e460
mov dword [edi], eax
push 0x5837abaf
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x67c15b
Capabilities:
Encode data using base64

Disassembly:
not al
dec dword [esp + 8]
dec al
xor al, 0xa
neg al
mov dword [esp], 0xdebb2a13
ror byte [esp + 0xb], 0x43
inc al
xor bl, al
push 0x1e18df33
sub edi, 2
mov word [edi], ax
not dword [esp + 1]
lea esp, [esp + 0x10]
jmp fcn.0077dcde

Function at 0x67defe
Capabilities:
Encode data using base64

Disassembly:
lea eax, [esp + eax + 0xc]
mov dword [eax], ecx
lea esp, [esp + 0xc]
jmp fcn.007b57f6

Function at 0x681a3b
Capabilities:
Encode data using base64

Disassembly:
xor dl, bl
add dl, 0xab
not dl
dec dl
xor dl, 0xa
neg dl
inc dl
xor bl, dl
jmp 0x786cb3
sub edi, 2
mov word [edi], dx
lea esp, [esp + 4]
jmp fcn.0077dcde

Function at 0x686db7
Capabilities:
Encode data using base64

Disassembly:
mov bp, word [edi + 4]
push 0x70a5d4a6
add edi, 6
mov word [eax], bp
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x68ad5d
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.0077dcde

Function at 0x68c6af
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x1c]
jae fcn.007b57f6
mov eax, dword [edi]
mov ebp, 0xafbb57a0
add bp, 0xb410
mov ebp, dword [edi + 4]
jb 0x74bee9

Function at 0x68d9ea
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edi + ebp - 0x5a285c00]
lea ebp, [ebp*2 - 0x73f9174f]
mov ebp, dword [ebp + edi - 0x4057a0ad]
mov cl, byte [edi + 8]
add edi, 6
shrd edx, ebp, cl
mov dword [edi], edx
lea esp, [esp + 4]
jmp fcn.007b57f6

Function at 0x68dd1c
Capabilities:
Encode data using base64

Disassembly:
adc edi, 6
shld ebp, eax, cl
mov dword [edi], ebp
lea esp, [esp + 4]
jmp fcn.007b57f6

Function at 0x68fd15
Capabilities:
Encode data using base64

Disassembly:
adc edi, 6
mov byte ss:[ecx], al
lea esp, [esp + 4]
jmp fcn.007b57f6

Function at 0x691c31
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x693b78
Capabilities:
Encode data using base64

Disassembly:
add edi, 2
call 0x693b83
shr dl, cl
push 0x7a28b11b
mov word [edi], dx
jmp 0x71f872
lea esp, [esp + 0xc]
jmp fcn.007b57f6

Function at 0x694ba6
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], ecx
lea esp, [esp + 4]
jmp fcn.007b57f6

Function at 0x696039
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.007b57f6
mov word [edi], ax
jmp 0x576c10

Function at 0x6960b6
Capabilities:
Encode data using base64

Disassembly:
mov byte [ecx], dl
lea esp, [esp + 8]
jmp fcn.007b57f6
lea ecx, [esp + ecx + 8]
jmp 0x582cce

Function at 0x696344
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x69774f
Capabilities:
Encode data using base64

Disassembly:
push 0x3420f431
mov byte [edx], al
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x699f9d
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.007b57f6
Function at 0x69b801
Capabilities:
Encode data using base64

Disassembly:
mov byte [ebp], cl
lea esp, [esp + 4]
jmp fcn.007b57f6

Function at 0x6a004f
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], dx
push 0xd0a83820
lea esp, [esp + 0x14]
jmp fcn.007b57f6

Function at 0x6a2e8c
Capabilities:
Encode data using base64

Disassembly:
sub edi, 4
jmp 0x7a410b
mov dword [edi], ebp
lea esp, [esp + 8]
jmp fcn.0077dcde
jmp 0x763619

Function at 0x6a39a0
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], edx
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x6a6c46
Capabilities:
Encode data using base64

Disassembly:
add edi, 6
mov dword [esp], 0x3c892113
push 0x42949830
mov byte es:[ebp], cl
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x6a9820
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x6a9c23
Capabilities:
Encode data using base64

Disassembly:
mov dword [edx], ecx
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x6aa1e5
Capabilities:
Encode data using base64

Disassembly:
dec dl
xor bl, dl
mov dword [esp], 0x32a705a7
lea edx, [esp + edx + 4]
mov word [edx], cx
lea esp, [esp + 4]
jmp fcn.007b57f6
sbb esi, 1
or dx, 0xaa98
movzx edx, byte [esi]
xor dl, bl
not dl
xor dl, 0x18
not dl
jmp 0x692618

Function at 0x6ac646
Capabilities:
Encode data using base64

Disassembly:
mov byte es:[ecx], dl
not byte [esp + 6]
jmp 0x78490c

Function at 0x6adc95
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [edi + 4]
add edi, 2
sal eax, cl
mov dword [edi], eax
lea esp, [esp + 4]
jmp fcn.007b57f6

Function at 0x6add19
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], ecx
push 0x441b6735
lea esp, [esp + 0xc]
jmp fcn.0077dcde

Function at 0x6aecd4
Capabilities:
Encode data using base64

Disassembly:
and eax, edx
not eax
mov dword [edi], eax
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x6af96b
Capabilities:
Encode data using base64

Disassembly:
add edi, 8
mov dword ss:[ecx], eax
lea esp, [esp + 4]
jmp fcn.007b57f6

Function at 0x6afef0
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [esp + 0x14]
lea esp, [esp + 0x18]
jmp fcn.007b57f6

Function at 0x6b1cc2
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], ax
push 0xb5182daa
lea esp, [esp + 0xc]
jmp fcn.007b57f6

Function at 0x6b3d31
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], eax
push 0xfc931326
lea esp, [esp + 0x14]
jmp fcn.007b57f6

Function at 0x6b6395
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], dx
jmp 0x7d389e
push 0xd9b95b0
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x6b65fe
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [ecx]
push 0xf036628f
sub edi, 4
mov dword [edi], edx
lea esp, [esp + 0xc]
jmp fcn.0077dcde

Function at 0x6b6fcf
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi + 4], eax
lea esp, [esp + 0x10]
jmp fcn.007b57f6
Function at 0x6b7a40
Capabilities:
Encode data using xor

Disassembly:
call fcn.00678c72
ror dword [edi], 1
xor dword [edx + 0xf00080b], 0xedd98987
inc ebp
or al, 0xfb
ja 0x576800
lds ecx, [ebx + edi*8]
xchg ebp, eax
salc
aas
loopne 0x698e6c
aad 0x7d
xor edi, dword [esi - 0x2a]
sbb eax, 0x8c050768
sub eax, dword [esi - 0x6a07c2ca]
adc eax, 0x3ed79b1f
mov dh, 0xd0
std
in eax, dx
les ebp, [ebx - 0x274a215b]
loopne 0x698ee3
jno 0x698e6a
call 0x46a12841
ret
add edi, 4
mov dword [esp], 0xc406a224
jmp 0x72b46e
mov dword [esp], 0x2cb05f9f
jnp 0x7c0d15
mov cl, byte [edi + 4]
add edi, 4
shrd ax, dx, cl
call fcn.00766abe
mov eax, 0x283f849e
mov eax, dword [ebp + eax*2 - 0x507f0938]
push 0x4b13f5a0
add ebp, 4
xor ecx, ecx
test eax, eax
lea esp, [esp + 4]
je 0x773120
jmp 0x7730cb
and eax, ecx
not eax
jmp 0x7a310a
lea esp, [esp + 4]
jmp fcn.0079cdef
push 0x72be9bba
xor byte [esp + 3], 0x1d
mov dword [esp], ebx
mov ebx, 0xb04f892
sub bl, bl
movzx ebx, byte [edi + ebx*2 - 0x1609f000]
push 0xe73e32bd
ja 0x792411
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x6d7070]
shr ecx, 8
xor ecx, ebx
inc edi
xor ecx, 0x533a3224
dec eax
lea esp, [esp + 4]
jne 0x7730d8
mov ebx, 0x6ea61539
not ebx
pop ebx
jmp 0x77bcda
push 0x35154181
not ecx
mov dword [ebp], ecx
jmp 0x73dcc5
jmp 0x6adcc0
mov dword [edi], eax
lea esp, [esp + 4]
jmp fcn.007b57f6
mov eax, 0x2daad135
shl ax, 0x89
mov eax, dword [edi + eax*2 - 0x5b54d400]
jne 0x698e71

Function at 0x6bd5e3
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], dx
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x6bfe08
Capabilities:
Encode data using base64

Disassembly:
mov dl, byte [edi + 4]
add edi, 6
mov byte [ebp], dl
jmp 0x790c0c
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x6c1517
Capabilities:
Encode data using base64

Disassembly:
add edi, 2
rol word [esp + 1], 0x8b
shl bp, cl
push 0x96a02ebb
mov word [edi], bp
lea esp, [esp + 8]
jmp fcn.007b57f6
mov bp, word [edi + ecx*4 - 0x6a62eaa4]
mov dword [esp + ecx - 0x1a98baa9], ecx
mov cl, byte [edi + ecx*2 - 0x35317550]
jmp 0x6a083e

Function at 0x6c2d9e
Capabilities:
Encode data using base64

Disassembly:
adc edi, 4
jmp 0x68b0fc

Function at 0x6c66eb
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jmp fcn.007b57f6

Function at 0x6c87bd
Capabilities:
Encode data using base64

Disassembly:
add edi, 2
sal edx, cl
mov dword [edi], edx
push 0xa221cf39
push 0x8e102133
lea esp, [esp + 0xc]
jmp fcn.007b57f6

Function at 0x6c8b90
Capabilities:
Encode data using base64

Disassembly:
ror bp, 0x28
ror cl, 1
dec ebp
sub cl, 0x82
mov dword [esp + ebp - 0x4308fffe], ebp
sar word [esp + ebp - 0x4308fffa], 0x8a
ror cl, 1
sal bp, 0x69
xor dword [esp + ebp - 0x4308fbff], ebp
push ebp
xor bl, cl
lea ecx, [esp + ecx + 0xc]
mov ebp, dword [ecx + ebp - 0x4308fc00]
sub edi, 4
not word [esp + 9]
call fcn.0077d402
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x6cc417
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.0077dcde
mov dword [edi], edx
jmp 0x68af79
Function at 0x6d2c7e
Capabilities:
Encode data using base64

Disassembly:
add edi, 2
push 0xecbf00b9
mov word [edi], ax
jmp 0x72652a
lea esp, [esp + 8]
jmp fcn.007b57f6

Function at 0x6d9c71
Capabilities:
Encode data using base64

Disassembly:
not cl
dec cl
call fcn.00782282
mov eax, 0xf698cbb8
movzx ecx, al
not al
mov ecx, dword [ecx + edi - 0xb8]
not eax
push eax
mov al, byte [edi + eax*2 - 0x12ce696c]
add edi, 6
mov byte es:[ecx], al
lea esp, [esp + 4]
jmp fcn.007b57f6
xor cl, bl
mov dword [esp + 4], 0xb380c492
not cl
shl dword [esp + 4], 0x5a
xor cl, 0x18
jmp 0x5786a3

Function at 0x6db773
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jmp fcn.007b57f6
jmp 0x7bdb1a
xor bl, dl
add dword [esp + ecx*4 - 0x658ea864], 0x6e3cd0a4
jnp 0x669b95
lea edx, [esp + edx + 4]
not ecx
jbe 0x66c233
not bp
mov word [esi], bp
push 0xca39a038
call fcn.00678d35
xor cl, ch
sar ecx, cl
ror dl, 1
inc ecx
add dl, 0x2b
xor ecx, 0xe69c3f9f
mov dword [esp + ecx*4 - 0x658ea864], 0x953fb683
jne 0x6824e3
jmp 0x5858ff

Function at 0x6dc267
Capabilities:
Encode data using xor

Disassembly:
push edi
jmp 0x720211
jb fcn.0068e692
mov edi, 0xaf248dba
push ebp
push esi
lea ebp, [edi + edi*2 + 0x780160b6]
movzx esi, bp
push ecx
xchg esi, ebp
call fcn.0067fe00
add eax, 0x413a20
inc dword [0x413a20]
add eax, 0x2835741f
xor cl, byte [ebp + 4]
sub dword [ebx], esi
sbb byte [ecx + 0x50], bl
push edx
dec ebp
add al, 0x75
mov bh, 0x2e
add dword [ebx], 0x82ea63c4
jno 0x720229
dec ecx
loopne 0x72020b
lodsb al, byte [esi]
mov eax, dword [esi]
and eax, 0x29c163b4
jnp 0x72028d
fnsave dword [edi + ebp*2 + 0x56]
or eax, 0xd8e854fc
ret
invalid

Function at 0x6dceca
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0xc]
jmp fcn.007b57f6

Function at 0x6dd4f9
Capabilities:
Encode data using base64

Disassembly:
sbb edi, 8
mov dword [esp], 0x2f2d261c
mov dword [edi + 4], eax
mov dword [edi], edx
not word [esp + 1]
lea esp, [esp + 4]
jmp fcn.0077dcde

Function at 0x6dde9b
Capabilities:
Encode data using base64

Disassembly:
xor dl, 0x99
push 0xa1aa2830
inc dl
xor bl, dl
lea edx, [esp + edx + 0x10]
mov dword [edx], ebp
lea esp, [esp + 0x10]
jmp fcn.007b57f6

Function at 0x6df33b
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [edi + 4]
add edi, 8
mov dword ss:[ecx], edx
lea esp, [esp + 4]
jmp fcn.007b57f6