joyce8/EMBER2024-capa huggingface dataset:
Function at 0x685bbe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + eax*2 - 0x3f104f0], 0x4eb69db0
dec ecx
div byte [esp + eax*2 - 0x3f104ea]
not ecx
bswap ecx
add eax, dword [esp + eax - 0x1f8a883]
bswap edx
adc eax, dword [esp + edx - 0x7882f7fd]
not ecx
cwde
and ax, ax
sbb ecx, 0x1790742f
dec dx
inc eax
div eax
rol ecx, 1
sal eax, 0x4a
dec ecx
lea eax, [eax + edx*2 + 0x65149d14]
btc dx, 0x28
neg ecx
neg dx
call fcn.006cd42c
movzx ax, byte [esi]
mov edx, 0xa9a8318
rol dx, 0x83
jae 0x69f185
mov word [edi], dx
sub esi, 4
mov edx, dword [esp]
pop edx
mov edx, dword [esi]
mov ecx, 0x9e225126
call fcn.00650011
movsx ecx, dl
mov word [esi + ecx], ax
lea ebp, [ebp + ecx*2 - 4]
movzx eax, cx
add dl, dl
mov edx, dword [ebp + ecx*4]
call fcn.005afde8
mov ecx, dword [ebp]
mov eax, 0x460dcebe
mov edx, dword [ebp + eax - 0x460dceba]
or al, ah
lea ebp, [eax + ebp - 0x460dcef6]
mov dword [ecx + eax - 0x460dcefe], edx
cdq
mul ax
lea edi, [edi + edx - 0xa761]
mov eax, dword [eax + edi - 0x460dc404]
jb 0x7165db
jmp 0x6c76c4
mov cl, byte [esi + edx*2 - 0x15343186]
lea edx, [edx*8 - 0x1ffdc84f]
lea esi, [esi + edx*2 - 0x69a5fba0]
inc edx
dec dl
sal edx, 0x10
adc al, cl
jmp 0x691aed
ror eax, 1
xor eax, 0x61b5af08
dec dx
imul edx, dword [esp + edx - 0xffff]
ror eax, 1
ror dl, 0x87
xor ebx, eax
add edi, eax
pop edx
jmp edi
xor eax, ebx
call fcn.0064c976

Function at 0x685c3f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
or dword [esp + 8], ecx
js 0x713e12
sub ebp, 4
mov edx, 0x68a049ad
mov eax, dword [ebp + edx - 0x68a049ad]
xor eax, ebx
rol eax, 2
lea ecx, [edx*2 + 0x232001b7]
dec eax
neg ecx
adc cx, 0xbd10
xor eax, 0xeb0ebd0e
ror eax, 2
call fcn.005bd7a2
rol eax, 1
not eax
movzx edx, word [esp + 8]
lea eax, [edx + eax + 0x1c86210f]
ror cl, 0xe3
call fcn.006175ff

Function at 0x691ace
Capabilities:
Read file on windows

Disassembly:
mov dword [esp + edx*2 - 0x1ffd4], edx
push ecx
inc eax
jmp 0x70180b

Function at 0x6a01f1
Capabilities:
Read file on windows

Disassembly:
push ebp
sar ebp, 0x1a
mov ebp, esp
cmp esi, esp
cmp cx, 0xaf89
and esp, 0xfffffff8
cmp eax, 0x4b2abbb2
test esi, 0xb68db202
sub esp, 0x2c
cmp dh, dh
push ebx
cmc
test edi, ecx
push esi
bts si, sp
mov esi, eax
cmp byte [esi + 0x12828], 0
jmp 0x735f4b
Function at 0x6aba68
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
push eax
jmp 0x75d10e
lodsb al, byte [esi]
iretd
sbb eax, 0x9590832c
neg edx
rol eax, 2
inc eax
shl cx, 0x4c
jne 0x67a8b8
out 7, al
xor dh, byte [0xf16c36ea]
sbb eax, 0xb81f3935
sbb esi, dword [0xcad1830c]
mov dl, 0x5e
sahf
loope 0x622764
out dx, al
mov al, 0xe1
and eax, 0x5fd3bb35
out dx, al
ror dl, 0x85
add ch, ah
retf 0xc17d
jmp loc.00439187
mov eax, ecx
mov eax, dword [eax + edi - 0x7e2e0d84]
movzx edx, cl
push edx
lea edi, [edi + edx - 0x80]
sar ecx, 0xe6
sal dl, 0xa1
xor eax, ebx
shl edx, cl
ja 0x62276d
jne 0x6f1fb8
mov dword [esp + 0xb0], 0xffffffff
cmp edx, esp
xor al, al
jmp 0x624f17
call fcn.0068159b
mov dword [esp + 0x2c], ebp
jmp loc.00422d38
rol cx, 0x61
rol edx, 2
mov dword [esp + ecx + 4], 0x7495e0a9
bswap edx
or cl, byte [esp + ecx + 5]
not eax
sbb dword [esp + ecx*4 - 0x37c], eax
add edx, eax
add al, 2
btc cx, cx
rol edx, 2
mov dword [esp + ecx - 0xe1], 0xe3bd1c12
dec edx
shr word [esp + ecx*2 - 0x1be], 0x66
call fcn.0063c487
mov ecx, 0x7e2e0d84
jmp 0x65d6e7
mov eax, ebx
xor eax, 0x434b5443
push eax
movsx eax, si
lea eax, [esp + 0x28]
push 0x45f320
jmp 0x5c2cd6
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x20]
sub ah, 0x38
cmp cx, 0x3992
push ecx
inc ah
shr eax, cl
lea edx, [esp + 0x18]
shl eax, 0x95
add eax, ebp
xor ax, di
push edx
lea eax, [esp + 0x24]
push eax
push ebp
sal cl, cl
lea ecx, [esp + 0x34]
push ecx
test ecx, eax
push edi
stc
clc
sub esi, esi
jmp 0x69b5b7

Function at 0x6ad3c4
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
sub ebx, 0x9ca5732a
push edi
push dword [esp + ebx + 0x118ed7f8]
popfd
mov dword [esp + 0x10], 0x8f2c8548
mov ebx, dword [esp + ebx*2 + 0x231dafdc]
mov edi, 0x3f80ed3d
call fcn.006f9574
mov cx, word [ebp]
mov edx, 0x12816636
mov dx, word [edx + ebp - 0x12816634]
add ebp, 2
mov eax, 0x9c825f1d
cbw
call fcn.005b8262

Function at 0x6b7618
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
lea edx, [ecx + ecx*2 - 0x21d88a75]
lea esi, [ecx + esi - 0x762e1239]
mov ecx, dword [esi + ecx - 0x762e1235]
call 0x5e84b6
Function at 0x6c486c
Capabilities:
Get file version info

Disassembly:
neg eax
xadd ecx, edx
lea eax, [eax + edx*4 + 0x1ea22df5]
neg edx
sbb dl, ch
add edx, edx
neg eax
ror edx, 0x30
jae 0x6b40a7
call fcn.0043e0d0
add esp, 0xc
mov cx, 0xdd82
movsx cx, ch
push 0x3ff
lea ecx, [ebp]
push ecx
push 0
jmp 0x5c09dc
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x2c]
mov eax, esp
push edx
mov ax, sp
lea eax, [ebp]
jmp 0x5e2075
push eax
jmp 0x743ab7
jbe 0x67ea99
push eax
call fcn.00439f93
add esp, 4
mov ebx, eax
movsx cx, al
mov edx, esp
movsx ecx, ax
mov dword [ebp - 0x24], ebx
push ebx
cwd
xchg edx, edx
mov ecx, dword [ebp + 0x484]
push ecx
cdq
jmp 0x721b50
ror edx, 2
sal ecx, cl
rol al, 0xc2
dec edx
xor ebx, edx
add edi, edx
call fcn.005dbd01
mov eax, 0x73270390
mov eax, dword [eax + ebp - 0x73270390]
mov edx, 0x5419f8ae
ror edx, 0x86
adc ebp, 3
movsx ecx, dx
btr cx, dx
xor eax, ebx
bswap eax
shl cl, cl
btr dx, dx
inc eax
jmp 0x5b9fa8
xor ecx, edx
sbb eax, 0x7c32c496
inc dx
xor ecx, 0x895c219
not eax
xor ebx, eax
neg edx
shr ecx, 0x67
adc esi, eax
sub edx, 0x5b5c303
call fcn.00676951
inc edx
or cl, cl
dec ecx
not edx
lea ecx, [ecx*2 - 0x58eca070]
jae 0x65e40e
xor ebx, ecx
add ebp, ecx
lea ecx, [edx + eax*8 - 0x7c7230e6]
lea edi, [edi + eax - 0x5e404262]
sal ax, 0xa1
movzx eax, byte [edi + eax - 0x5e4084c2]
seta cl
xor al, bl
bswap ecx
inc dx
dec al
rol ecx, 0xe3
lea ecx, [edx + ecx - 0x3a6318e5]
rol ecx, cl
xor al, 0xe
mov dword [esp + ecx*2 - 0x656ce982], edx
not al
sub ecx, ecx
sbb al, 0x84
sar ecx, 0xa9
adc dl, 0xb4
ror al, 1
push ecx
sar dword [esp + ecx + 4], 0xb4
xor bl, al
imul edx, dword [esp + ecx + 4]
lea eax, [esp + eax + 8]
add cl, byte [edx + eax - 0x8df03e0]
lea esi, [edx + esi - 0x8df03e2]
sub dl, dh
sbb dword [esp + edx*4 - 0x237c0f70], 0xbf132e10
movzx eax, dx
mov word [esi + edx*8 - 0x46f81ee8], cx
lea edx, [edx*2 - 0x2f7ae1e8]
jne 0x72e405
push 0
setno dh
bswap edx
lea edx, [ebp]
jmp 0x686929
pop ecx
pop ecx
jge fcn.005f50b3
mov dword [ecx], edx
sub ebp, 4
mov edx, 0x52359586
mov ecx, edx
mov edx, dword [edx + ebp - 0x52359586]
xor edx, ebx
mov eax, ecx
rol edx, 2
jmp 0x6b4aa5
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp + 0x484], eax
stc
test eax, eax
jmp 0x620d53

Function at 0x6cbbf6
Capabilities:
Encode data using base64

Disassembly:
movsx ecx, dx
inc ecx
lea ebp, [ebp + edx - 0x770263a5]
call fcn.0060bfa3

Function at 0x6d0c64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr cx, 0xe3
lea edx, [esp + edx + 0xc]
call fcn.005f2108
Function at 0x6d247e
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.0074c446
mov ecx, 0x5f8f3a0b
mov eax, 0xfd8a2908
push ecx
mov eax, dword [ecx + ebp - 0x5f8f3a0b]
btr ecx, ecx
add cl, 0xe
mov dl, byte [ebp + ecx - 0x5f8f3215]
lea ebp, [ebp + ecx - 0x5f8f3213]
xor dword [esp + ecx - 0x5f8f3219], ecx
jge 0x63debe
ror eax, 1
xor ebx, eax
add esi, eax
mov eax, dword [edi + ecx*4 - 0x248]
or dx, word [eax + ecx - 0x92]
lea eax, [ecx*4 + 0x410be633]
xchg dword [esp + ecx - 0x92], ecx
sal cx, 0xee
lea edi, [edi + ecx - 0xbffe]
sal cl, 0x86
and al, 0xa
mov word [ecx + edi - 0xc000], dx
mov dword [esp + eax - 0x410be80a], esi
ret
xor ebx, edx
xor ecx, dword [esp + ecx - 0x37000812]
jg 0x74020e
mov byte [ecx + eax - 0x5f8f3219], dl
lea edx, [ecx + ecx*4 + 0x4c84ef36]
xadd byte [esp + edx - 0x2a50e9b0], dh
lea edi, [edi + edx - 0x2a5000b7]
movzx eax, dl
mov edx, dword [eax + edi - 0xb3]
neg word [esp + eax*2 - 0x164]
neg ax
xor edx, ebx
not edx
shl ecx, cl
rol edx, 3
or ecx, dword [esp + eax*2 - 0x1fe9a]
neg edx
lea edx, [edx + ecx + 0x62891175]
neg edx
jmp 0x628be3
mov dword [esp + edx - 0x7336fe3d], edx
dec edx
xor eax, 0x6182221c
rol edx, cl
shl dword [esp + ecx*2 - 0x78716e60], cl
lea eax, [edx + eax - 0x6fb98aa5]
mov dword [esp + ecx - 0x3c38b72c], ecx
adc ecx, edx
shr word [esp + ecx*2 - 0x74ea54c6], cl
not eax
shr dl, cl
neg word [esp + ecx - 0x3a752a61]
inc eax
sar cl, 0x21
shl word [esp + ecx - 0x3a752a33], 0xe
adc ecx, 0x400b98b3
xor ebx, eax
inc ecx
add cl, 0x3e
xadd byte [esp + ecx - 0x7a80c222], ch
add esi, eax
inc dword [esp + ecx - 0x7a80fe22]
mov edx, dword [ebp + ecx - 0x7a80fe25]
lea ebp, [ecx + ebp - 0x7a80fe21]
inc word [esp + ecx - 0x7a80fe21]
lea eax, [ecx + ecx - 0x4c4f6262]
js 0x5b4708
mov dword [esp + ecx - 0x7a80fe21], edx
movsx edx, word [esp + ecx - 0x7a80fe25]
push dword [esp + 4]
popfd
mov dword [esp + ecx - 0x7a80fe25], esi
ret 4
js 0x5f893d
adc esi, edx
mov dword [esp + ecx*2 - 0x40000000], esi
ret
Function at 0x6d5ed1
Capabilities:
Encode data using xor

Disassembly:
sub cx, cx
lea ebp, [ecx + ebp - 0x1000004]
mov eax, ecx
adc dl, ah
mov edx, dword [ecx + ebp - 0x1000000]
dec ecx
and ax, 0xf02f
xor edx, ebx
div cl
sal ecx, 0x8c
xor edx, 0x2b1c8c2f
dec edx
sub ax, 0x9d94
adc eax, 0xb9aea09e
ror edx, 3
lea edx, [edx + eax - 0x3e705284]
xor ebx, edx
sal eax, 0x78
setnp al
add esi, edx
jmp esi
xor bl, al
lea eax, [esp + eax + 8]
mov byte [eax], dl
lea edx, [ecx + ecx*4 - 0x247a96ed]
mov byte [esp + 4], dh
sub esi, 4
movsx eax, dl
mov edx, dword [esi + eax - 0xe]
xor edx, ebx
mov dword [esp + eax*8 - 0x70], 0x43a16007
ror edx, 1
add cx, 0xf30f
lea edx, [edx + eax*8 - 0x453516a1]
call fcn.005bd6cd
mov ecx, 0x1291373e
movzx edx, cl
bt ecx, 0x89
lea esi, [esi + ecx - 0x12913742]
setae cl
lea eax, [ecx*4 + 0x7b811e11]
call fcn.0073bfe8
mov eax, 0xac9dd339
sub ax, ax
lea eax, [eax + eax + 0x6791c738]
mov edx, dword [edi]
movzx ecx, al
bts ecx, ecx
sbb ax, 0x700c
movzx ax, byte [ecx + edx - 0x1000038]
lea edx, [ecx + 0x122e6d0c]
shr dx, 0x85
sub cx, 0x8ab4
lea edi, [edi + ecx - 0x1007582]
sub cl, cl
ja 0x741081
mov word [ecx + edi - 0x1007500], ax
jns 0x5afbfe
xadd eax, ecx
mov ax, word [ebp + eax*2 - 0x3c371196]
adc ebp, 1
rol cl, 0xa3
and dx, ax
not dx
bts ecx, 0x3e
mov word [ebp], dx
push ecx
movsx eax, word [esp]
mov dword [esp + eax*8 - 0x4210], edi
ret
sal edx, 0x5d
shl dx, 0xea
ror al, 1
not edx
rol cx, 0x67
sub cx, dx
xor bl, al
imul cx, cx
sbb edi, 1
mov word [edi], ax
mov ecx, dword [ebp]
movsx eax, dl
add ebp, 4
sub ax, 0xfe26
neg ax
lea eax, [edx*4 - 0x535c90d1]
xor ecx, ebx
idiv ax
neg dl
xor ecx, 0x508d7918
or edx, edx
sbb ecx, 0x91b5c609
and eax, 0xb814931b
neg ecx
btc eax, 0xbd
sal dl, 0xe5
inc ecx
push edx
lea eax, [eax*8 + 0x538dd085]
ror ecx, 1
neg eax
xor ecx, 0xf92ce69b
lea edx, [eax*4 + 0x5225d484]
sar word [esp + edx - 0x3dc2f0e], 0x49
call fcn.00618d65
adc dl, ch
invalid

Function at 0x6d6906
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [eax + esi - 0x6baab412]
mov dword [esp + edx - 0x6baab412], edx
xor ecx, ebx
lea ecx, [ecx + edx*2 - 0xaa7fa84]
bswap ecx
lea ecx, [eax + ecx - 0x197c0c8b]
dec edx
bswap ecx
neg ecx
jmp 0x6fe053
xor dl, 0x3b
lea ecx, [ecx + edx + 0x2c7af380]
imul dword [esp + eax - 0x6baab412]
xor ecx, 0x9f82a9b1
xchg dword [esp + edx - 0x2d48245a], eax
div dword [esp + eax - 0x6baab412]
push eax
xor ebx, ecx
mul dl
sub edx, dword [esp + edx - 0x6a8c7976]
rol edx, 0xd9
adc ebp, ecx
sal dx, 0x2d
or dx, word [eax + edi - 0x40ea5e5c]
pop eax
mov cx, word [edi + eax - 0x40ead8c4]
call fcn.005c82b4
Function at 0x6d9a04
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
add esi, ecx
mov dword [esp + edx - 0x6d1], eax
cwde
mov ecx, 0x4d0cb2bf
mov edx, dword [edi + edx - 0x6d5]
call fcn.005b1de8
bswap edx
and al, 6
or ecx, eax
xor edx, 0x51ac502f
btr ax, ax
bswap edx
adc edx, 0x3e1c0f1b
shr cl, 5
shr eax, cl
add cl, ch
not edx
sbb edx, 0x8108281b
not ax
rol ecx, 0x15
lea ecx, [ecx*8 - 0x5e53ee7c]
xor edx, 0x41321d98
neg eax
rol eax, cl
sbb edx, 0x712e0a30
jmp 0x617e61

Function at 0x6de123
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
mov eax, 0xa22a749c
xor cx, bx
neg cx
sar edx, 0x59
bt eax, edx
dec cx
cwde
neg cx
pop edx
lea edx, [eax*4 - 0x314b4fe5]
btc edx, eax
rol cx, 1
and ax, dx
sbb dx, ax
cwde
neg cx
bswap eax
xor bx, cx
cwd
idiv eax
lea ebp, [ebp + eax - 0x47044445]
ror al, 0x21
jo 0x75d0f3
mov eax, 0x72b63ba7
sal ax, 0xc1
xor eax, 0x1fa869bc
mov ecx, dword [eax + ebp - 0x6d1e1ef2]
dec eax
dec al
push eax
mov eax, dword [ebp + eax - 0x6d1e1eec]
shl word [esp + 1], 0x6c
mul ecx
mov dword [ebp], edx
pop ecx
mov dword [ebp + ecx - 0x6de000ec], eax
mov eax, 0xfdb65027
mov edx, dword [edi + ecx - 0x6de000f0]
inc cl
bswap eax
lea edi, [edi + ecx - 0x6de000ed]
xor edx, ebx
ror edx, 1
call fcn.0060935f
mov word [ebp + eax - 0x470444a1], cx
xor edx, edx
mov eax, dword [edi + edx*4]
lea edi, [edi + edx*4 + 4]
movsx ecx, dl
xor eax, ebx
call fcn.006b279d

Function at 0x6e413d
Capabilities:
Encode data using base64

Disassembly:
mov byte [esp + 4], 0xb2
pushfd
shl dword [esp + 8], 0xef
call fcn.006b6e03
Function at 0x6e9b0f
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports
Set environment variable
Set registry value

Disassembly:
adc esi, edx
neg eax
cdq
js 0x5ed8ed
call fcn.005f71ad
mov edx, dword [ebp]
mov ecx, 0xde0d8a0c
not ecx
mov eax, dword [ebp + ecx*2 - 0x43e4ebe2]
mov ecx, dword [ebp + ecx*2 - 0x43e4ebde]
jmp 0x6fc4d9
not eax
push edx
or ecx, ecx
rol eax, 1
sal edx, 0x9b
sbb eax, ecx
rol eax, 2
xor ebx, eax
add esi, eax
mov word [esp + ecx + 5], cx
or dx, dx
adc dl, byte [edi + edx - 0x50000000]
neg byte [esp + ecx]
movsx eax, cx
btc cx, 0xd
add cl, byte [edi + eax + 2]
and dword [esp + eax*8 + 1], eax
sal eax, 0x7a
lea edi, [edi + eax + 2]
xchg byte [esp + eax*8 + 4], ah
je 0x6ebe0c
mov edx, dword [ebp]
mov al, byte [ebp + 4]
adc ebp, 5
mov byte ss:[edx], al
mov eax, 0xbb385082
cdq
jmp esi
xor eax, ebx
pop edx
dec ecx
lea eax, [edx + eax - 0x2cac1265]
neg eax
lea eax, [ecx + eax + 0x118f0d3e]
btc dx, 0x88
sal dl, 0x41
sar edx, 0xd6
not eax
inc eax
inc edx
call fcn.007612e9
mov edx, 0xf13c74b7
mov eax, ebp
mov ecx, edx
sub ebp, 4
bswap edx
mov dword [ebp], eax
movsx eax, dl
cwd
mov edx, dword [esi]
add esi, 4
xor edx, ebx
jmp 0x6da4fc
shr dword [esp + ecx*2 - 0x4312b602], cl
jne 0x61dc50
lea esi, [esi + eax - 1]
dec ax
movzx edx, cl
movzx ecx, byte [eax + esi - 0xffff]
add eax, 0x6430e684
call fcn.00707fcb
not ecx
ror edx, 3
call fcn.006ecb45
lea eax, [eax + eax*4 - 0x47410746]
xor ax, cx
dec edx
jmp 0x6a4350
dec cl
xchg dword [esp + edx - 0xa00ffb2], edx
pop eax
pop edx
js fcn.006d8c75
inc eax
xor edx, 0x4d174e87
sub eax, ecx
inc edx
jmp 0x72d038
adc dl, cl
mov word [edi + eax], dx
dec byte [esp + eax]
push eax
mov ecx, eax
add dword [esp + eax], esi
ret 8
push 0xba27448c
add ebp, 4
div ecx
mov dword [ebp], edx
mov ecx, 0x21896f9d
mov dword [ebp + ecx - 0x21896f99], eax
mov eax, dword [esi + ecx*2 - 0x4312df3a]
ror cx, 0x82
or cx, cx
shr cl, cl
lea esi, [esi + ecx*2 - 0x4312b5fe]
jne 0x64e1bb
mov edx, 0x4506180a
lea eax, [edx + edx*4 - 0x4071b2ca]
ror eax, 2
lea esi, [edx + esi - 0x4506180e]
cbw
and ax, ax
mov ecx, dword [esi + eax - 0x62b005a]
xor ecx, ebx
inc ecx
call fcn.006835ab
mov eax, 0xe998428e
mov ecx, 0x21b4815
not cx
mov eax, dword [ebp + ecx - 0x21bb7ea]
dec ecx
xor ecx, ecx
lea edx, [ecx + ecx - 0x7171f255]
lea ebp, [ebp + ecx*2 + 4]
dec dl
push edx
xor eax, ebx
jmp 0x5dd293
sar al, 0xa2
rol edx, 3
bswap edx
rol al, 0x61
neg eax
xadd cx, ax
neg edx
xor ebx, edx
xor eax, 0xd6004a09
jge 0x5bcd3d

Function at 0x6f0342
Capabilities:
Read file on windows

Disassembly:
mov dword [esp], ecx
inc dl
rol eax, cl
add cx, 0x2001
sbb dl, byte [esp]
lea eax, [edx + eax - 0x1f575e2]
shl dl, 0xc5
lea ecx, [edx*4 - 0x1ddcb146]
neg eax
sar word [esp + 2], 0x2c
xadd byte [esp], ch
dec eax
neg ecx
call fcn.0063f2ae
Function at 0x6f52b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor al, bl
add al, 0x91
sub edx, 0xd0a24335
not al
sar edx, 0x92
btr cx, 0xa9
adc al, 0xa3
mov dword [esp + edx*2 - 0x1838], ecx
add word [esp + edx - 0xc0e], 0xd73b
not al
jbe 0x6fde70
bts ecx, edx
dec al
jmp 0x742e25
imul edx, dword [esp + edx*4 - 0x306e]
neg al
ror al, 1
push edx
xchg byte [esp + ecx - 0x7815854c], dh
xadd byte [esp + edx - 0x71f27949], dl
adc al, 0xb7
xchg word [esp + ecx - 0x78158550], dx
not al
call fcn.005eaa5c

Function at 0x702844
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc edi, 2
dec word [esp + 4]
pop eax
shl dl, cl
mov word [edi], dx
movzx edx, byte [esp]
mov dword [esp + edx - 0xff], ebp
ret
mov dword [esp + ecx - 0x43cb5fa5], 0xd30adfbf
movzx dx, byte [edi + ecx - 0x43cb5fa5]
mov cl, byte [edi + ecx - 0x43cb5fa3]
shl dword [esp + 4], 0x2d
jae 0x5c3038
sub esi, 4
mov edx, 0xac179735
mov ecx, dword [esi]
add edx, 0xc198ee82
mov eax, 0xd94cfba
xor ecx, ebx
and dx, ax
and ax, ax
neg ecx
btr eax, edx
cdq
rol ecx, 3
not ax
dec dx
shl dx, 0xec
not ecx
lea ecx, [ecx + eax*8 + 0x532f2086]
sbb eax, eax
add eax, edx
sbb edx, edx
ror ecx, 2
mul al
sal eax, 0x98
xor ebx, ecx
add al, ah
div dl
add ebp, ecx
jmp 0x70a91c
bt edx, eax
lea esi, [esi + eax - 0x1000004]
cbw
btc eax, eax
mul edx
mov ecx, dword [edx + esi - 0x1000000]
bswap eax
sar eax, 0x66
xor ecx, ebx
rol ecx, 1
xor ecx, eax
ror eax, 0xd4
jae 0x709978
neg ecx
bts eax, edx
ror ecx, 2
push edx
xor ebx, ecx
lea edi, [edx + edi - 0x1000004]
dec eax
mov dword [edi + edx*2 - 0x2000000], ecx
pop edx
jno 0x716ede
call fcn.0064a086
mov edx, 0x2f1211bc
lea ecx, [edx + 0x48b891b3]
movsx eax, dl
fldz
lea ebp, [ecx + ebp - 0x77caa373]
imul dl
mov eax, dword [ebp + ecx - 0x77caa36f]
shr dl, 0x45
xor eax, ebx
rol eax, 3
sar edx, 0x66
sbb edx, 0xa1af1b04
bswap ecx
sbb eax, 0x2485c804
dec dx
ror eax, 2
bswap eax
bt ecx, edx
xor ebx, eax
inc ecx
not ecx
lea ecx, [edx*2 - 0x76f59044]
add esi, eax
imul cx, dx
mov eax, ecx
jmp esi

Function at 0x708196
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
shl al, cl
sbb edx, 0x95a90198
xor cl, 0x1b
mov dword [esp + eax - 0x2b5a2700], 0x2aded0a
not edx
xor ebx, edx
add edi, edx
mov dx, word [ebp + eax*2 - 0x56b44e00]
shl ecx, 0xf9
adc cl, byte [ebp + eax - 0x2b5a26fe]
call fcn.005ad60a
mov edx, 0xc10b6492
lea ecx, [edx + edx - 0x5d36c52]
movsx eax, dl
mov edx, dword [ebp + ecx - 0x7c435cd2]
and eax, eax
mov eax, dword ss:[edx + ecx - 0x7c435cd2]
mov dword [ebp + ecx - 0x7c435cd2], eax
sbb ecx, ecx
mov eax, ecx
lea edi, [edi + ecx*2 - 4]
neg al
mov edx, eax
xor ecx, dword [edi + ecx*2]
xor ecx, ebx
neg dx
shl edx, 0x1c
ror ecx, 1
add eax, 0x3413f5a3
not ecx
neg ecx
xor eax, eax
ror ecx, 1
dec eax
xor ebx, ecx
call fcn.0063aae1
not ecx
add ebp, eax
inc ecx
jmp ebp
not edx
jns 0x646aa1
not ecx
xor ebx, eax
jmp 0x65d7b1
Function at 0x7099b5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push eax
jmp 0x6dafa3
push ecx
jmp 0x5d282d
call dword [sym.imp.KERNEL32.dll_SetEvent]
nop
jmp 0x5ea1ab
call edi
mov ebx, dword [esp + 0x2c]
cbw
bswap eax
mov ecx, ebp
mov edx, dword [ebx + 4]
setge cl
mov dword [esi], edx
lahf
mov ecx, dword [esp + 0x20]
cwde
xchg dh, ah
mov edx, dword [esp + 0x18]
cwde
not eax
lea eax, [esp + 0x14]
push eax
mov ah, ch
mov eax, dword [esp + 0x10]
jmp 0x5dd45a
push ecx
jmp 0x5ba148
mov cl, byte [ebp + ecx*2 - 0x72cd79f0]
push 0x2294ab4
sar word [esp], 0x44
adc ebp, 4
dec dword [esp]
shld dx, ax, cl
not byte [esp + 2]
mov word [ebp], dx
and byte [esp + 3], 0x18
pop eax
jmp edi
jmp 0x4231c4
test eax, eax
jmp 0x72adaa
push 0x40
jmp 0x6903de
push eax
neg edx
ror edx, 3
sar al, 0x44
neg eax
shr ecx, cl
dec edx
shl cl, cl
rol edx, 1
xor dword [esp + ecx - 8], 0x4e13872a
sbb edx, 0xe9ab8016
jmp 0x67b8ff
push ecx
jmp 0x5c96c3
call fcn.006c75c2
mov eax, 0xb988f8b1
sub ecx, 0x6fb3f08a
movsx edx, al
ror dx, 0xad
xor ecx, 0xba9fef1c
sub al, dh
adc ax, 0x5210
sub eax, 0x87963781
dec ecx
rol dl, 0x63
bswap ecx
xor ebx, ecx
call fcn.006decb9
and ecx, 0x970e5004
inc edx
not edx
xadd byte [esp], al
cbw
or ecx, eax
xor ebx, edx
call fcn.0066dd42
push edx
jmp 0x64512d
push eax
jmp 0x5c05dd
sal eax, 0x9d
xor bl, cl
call fcn.005de21f
call fcn.00745afa
mov ecx, 0x16026cac
and ecx, ecx
mov edx, dword [esi + ecx - 0x16026cac]
lea esi, [esi + ecx*2 - 0x2c04d954]
rol cx, 0xc6
movzx eax, cx
xor edx, ebx
jmp 0x75d389
mov dword [ecx + 0x3c], eax
mov ecx, dword [ebx]
jmp 0x66f580
call edi
mov ecx, dword [0x5a1c28]
mov eax, dword [ecx + 0x3c]
jmp 0x63eedc
mov dword [esp + eax - 0x6bc49476], 0x1c003b86
ror dword [esp + eax - 0x6bc49474], 0x91
xor ebx, ecx
btr eax, 0x1e
jb 0x74efb6
jge 0x5e9902
jge 0x6cb906
neg eax
jmp 0x6cb903
neg edx
push ecx
ror edx, 1
neg byte [esp + ecx*2 + 0xa]
xor ebx, edx
add ebp, edx
mov eax, ecx
inc cl
mov edx, esi
rol al, cl
lea esi, [esi + ecx*4 - 8]
mov dword [ecx + esi - 1], edx
je fcn.005b747a
pop ecx
pop edx
pop eax
jno fcn.005f50b3
xor edx, ebx
rol edx, 2
neg ax
xor ecx, eax
setbe al
not edx
inc eax
inc edx
div al
or cx, 0xd31c
ror edx, 1
cwde
xor ebx, edx
ror ax, 0x6d
sbb ax, 0xaa24
jb 0x75a6f5
mov ecx, 0x9abb20ae
sub ebp, 1
movzx eax, cl
movzx ecx, byte [eax + ebp - 0xae]
xor cl, bl
sub cl, 0x1c
ror cl, 1
movsx edx, al
idiv al
btr edx, eax
sbb cl, 0x91
div al
dec edx
rol cl, 1
jmp 0x6b195c
add edi, ecx
movsx edx, byte [esp + eax*2 - 0x578928e8]
lea ebp, [edx + ebp - 4]
call fcn.00704e15
sub edi, 4
mov edx, 0xa3030599
push edx
mov edx, dword [edi]
mov ecx, 0x903b981c
xor edx, ebx
neg edx
sar dword [esp + 1], 0x53
sbb ecx, ecx
inc edx
jmp 0x734eaf
add edi, edx
lea eax, [ecx + ecx*8 - 0x5c5e76eb]
sub ecx, eax
mov dx, word [ebp + ecx - 0x3966bcfb]
bts ecx, 1
mov ax, word [ecx + ebp - 0x3966bcf9]
dec ecx
jno 0x72120e
movsx eax, word [esp + ecx - 0x380a]
pop eax
pop eax
pop edx
pop eax
jmp fcn.006f02e6
jmp 0x6541e2