joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d3a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40d3b7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40d3e8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x40d3e4
cmp esi, eax
jae 0x40d3e8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x40d3d4
cmp esi, eax
jb 0x40d3ee
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x40d660
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x104
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [0x5a1328]
push ebx
mov ebx, dword [0x5a1b74]
push 0xa
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x40d6a7
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0043afd6
add esp, 0x104
ret
mov ecx, dword [0x5a1328]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40d68f
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0xff
push 0
push 0x5a1228
mov esi, eax
call fcn.0043e120
mov edx, dword [0x5a1328]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
add esp, 0xc
push 0xfe
push 0x5a1228
push 0x90
push edx
call edi
mov dword [0x59ddf8], 0x5a1228
cmp word [esi + 6], 0
je 0x40d70c
call fcn.00401d80
test ebx, ebx
jne 0x40d76e
movzx ecx, word [esi + 2]
mov ax, word [esi]
mov word [0x59c2ac], cx
movsx ecx, cx
mov word [0x59c2aa], ax
movsx eax, ax
lea edx, [ecx - 0x28]
add ecx, 0xffffffe2
mov dword [0x59dce8], eax
mov dword [0x59dd00], eax
mov dword [0x59dd14], eax
mov dword [0x59dcec], edx
mov dword [0x59dd9c], ecx
movzx eax, word [esi + 4]
imul eax, eax, 0x3e8
push eax
push ebx
push 0x401ef0
mov dword [0x5a1b64], 1
call fcn.0043ae91
add esp, 0xc
push 0xff
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.0043e120
mov eax, dword [0x5a1328]
add esp, 0xc
push 0xfe
lea edx, [esp + 0x10]
push edx
push 0x70
push eax
call edi
test ebx, ebx
pop edi
pop esi
je 0x40d7ab
lea ecx, [esp + 4]
push ecx
call fcn.0043b454
add esp, 4
jmp 0x40d7b4
lea ebx, [esp + 4]
call fcn.00401ff0
mov ecx, dword [esp + 0x104]
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0043afd6
add esp, 0x104
ret

Function at 0x40dd59
Capabilities:
Encode data using base64
Read file on windows
Resolve function by parsing pe exports

Disassembly:
ror eax, cl
lea eax, [eax + edx - 0x23388d22]
push edx
xadd word [esp + edx*4 + 1], dx
dec dx
rol eax, 2
dec ecx
dec eax
xor word [esp + edx*2 - 0x1fffd], cx
mov dword [esp + edx*8 - 0x7fff4], ecx
xor ebx, eax
jmp fcn.007535ed
Function at 0x415410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45040f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebp
push esi
push edi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x3c]
xor ebp, ebp
mov dword [edi], vtable.CHVMEEHlpr.0
mov dword [edi + 0x58], ebp
mov dword [edi + 0x5c], ebp
mov dword [edi + 0x60], ebp
mov dword [esp + 0x34], ebp
mov dword [edi + 0x84], ebp
mov dword [edi + 0x88], ebp
mov dword [edi + 0x8c], ebp
mov byte [esp + 0x34], 1
lea eax, [edi + 0x9c]
push eax
call fcn.00402dd0
mov byte [esp + 0x34], 2
lea ecx, [edi + 0xa0]
push ecx
call fcn.00417d00
mov byte [esp + 0x34], 3
lea edx, [edi + 0xac]
push edx
call fcn.004350b0
mov byte [esp + 0x34], 4
lea eax, [edi + 0x1bc]
push eax
call fcn.00417d00
mov byte [esp + 0x34], 5
mov eax, 5
mov esi, 1
push 0x88
mov dword [edi + 0x48], ebp
mov dword [edi + 0x4c], ebp
mov dword [edi + 0x20], ebp
mov dword [edi + 4], ebp
mov dword [edi + 0x50], ebp
mov dword [edi + 0x44], ebp
mov dword [edi + 0x1b8], ebp
mov dword [edi + 0x1b4], ebp
mov dword [edi + 0x1cc], ebp
mov dword [edi + 0x1d0], ebp
mov dword [edi + 0x10], ebp
mov dword [edi + 0x18], ebp
mov dword [edi + 0x1c8], ebp
mov dword [edi + 0x40], ebp
mov dword [edi + 0x1d4], ebx
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x28], 0x13
mov dword [esp + 0x2c], 0x16
mov dword [edi + 0x134], 0x3000000
mov dword [edi + 0x138], 0x5000000
mov dword [edi + 0x13c], 0x7000000
mov dword [edi + 0x140], 0x13000000
mov dword [edi + 0x144], 0x16000000
mov dword [edi + 0x148], eax
mov dword [edi + 0x14c], esi
mov dword [edi + 0x150], esi
mov dword [edi + 0x160], ebp
mov dword [edi + 0x1a8], ebp
mov dword [edi + 0x164], ebp
mov dword [edi + 0x154], ebp
mov dword [edi + 0x1a0], ebp
mov dword [edi + 0x6c], ebp
mov dword [edi + 0x78], ebp
mov dword [edi + 0x70], ebp
mov dword [edi + 0x68], ebp
mov dword [edi + 0x24], ebp
mov dword [edi + 0x28], ebp
call fcn.0043b537
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x34], 6
cmp eax, ebp
je 0x4155b3
mov esi, eax
call fcn.004150b0
mov edx, eax
lea esi, [ebp + 1]
jmp 0x4155b5
xor edx, edx
mov byte [esp + 0x34], 5
mov eax, ebx
mov dword [edi + 0xc], edx
call fcn.00415150
mov ecx, dword [edi + 0xc]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x7c], esi
mov dword [edi + 0x64], ebp
mov dword [edi + 0x1ac], ebp
mov dword [edi + 0x1b0], ebp
mov dword [edi + 0x98], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x18]
xor eax, edx
mov ecx, eax
shl ecx, 6
mov dword [edi + 0x30], eax
sub ecx, eax
mov eax, dword [0x5a1b94]
mov dword [edi + 0x38], ecx
mov edx, dword [eax + 0x24]
xor edx, ecx
mov dword [edi + 0x38], edx
mov dword [esp + 0x34], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4

Function at 0x416d92
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp + eax - 0x7c28b898]
mov edx, 0xcc28759c
mov dword [esp], 0x631eeb9b
lea ecx, [edx*8 - 0x10ecc0d6]
xor eax, ebx
xor eax, 0x9b247a95
call fcn.007241ce
Function at 0x419500
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push str.5la
jmp loc.006a2e7d

Function at 0x419990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44e1c6
mov eax, dword fs:[0]
push eax
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax], vtable.IJitCallBack.0
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [esp + 0xc], ecx
mov dword [eax + 0x7c], ecx
mov dword [eax + 0x80], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x74], ecx
mov dword [eax + 0x78], ecx
mov byte [esp + 0xc], 1
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4

Function at 0x423180
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
push edi
push 0x45a4b4
jmp fcn.00706e9d

Function at 0x42a67d
Capabilities:
Read file on windows

Disassembly:
mov dword [esp], eax
xor edx, ebx
lea ecx, [eax*8 - 0x1b6ba455]
sub edx, 0xadb213a4
call fcn.0069cdd4

Function at 0x42b3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450ffd
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
push edi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, ecx
push 0x45a974
mov dword [esp + 0x1c], edi
mov dword [esp + 0x30], eax
jmp fcn.006ea082
Function at 0x42b850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4505d5
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00419990
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x30]
mov dword [esi], vtable.NetFX45::CNetFX4xCallBack.0
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], ebx
mov dword [esi + 0x94], edi
mov byte [esp + 0x14], 1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
mov eax, dword [0x5a1c64]
mov dword [esi + 0xa8], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x98], ecx
mov ecx, dword [eax + 0x3c]
add ecx, dword [eax + 0x34]
mov eax, dword [0x5a132c]
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 8], ebx
mov ecx, dword [esi + 0x94]
cmp ecx, edi
mov dword [esi + 0x8c], edx
mov dword [esi + 0x90], eax
je 0x42b904
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x94], edi
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xac], ecx
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x18

Function at 0x433170
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebp
lea ebp, [esp - 0x104]
sub esp, 0x104
push 0xffffffffffffffff
push 0x450fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp + 0x100], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x10c]
mov dword [ebp - 0x2c], ebx
mov esi, dword [ebp + 0x110]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 0x114]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
push 0x45ee68
jmp loc.006cd3dc

Function at 0x434656
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
sbb edx, 0x3067934
neg edx
ror edx, 1
xor ebx, edx
add edi, edx
rol al, 0xc5
jb 0x6abd93
mov edx, 0x21218321
pop eax
pop edx
pop eax
jae fcn.00698520
bswap ecx
jb 0x6050cd
cbw
xor ebx, ecx
rol dword [esp + edx*2 - 0x4a678000], 0xbe
and eax, 0x551e511e
adc esi, ecx
mov di, word [edi + eax*4 - 0x44300000]
pop eax
jmp fcn.005ff9ea
Function at 0x4350b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44ffac
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
push esi
call fcn.00417d00
mov dword [esp + 0x10], 0
lea eax, [esi + 0xc]
push eax
call fcn.00417d00
mov byte [esp + 0x10], 1
lea ecx, [esi + 0x18]
push ecx
call fcn.00417d00
mov byte [esp + 0x10], 2
lea edx, [esi + 0x24]
push edx
call fcn.00417d00
mov byte [esp + 0x10], 3
lea eax, [esi + 0x30]
push eax
call fcn.00417d00
mov byte [esp + 0x10], 4
lea ecx, [esi + 0x3c]
push ecx
call fcn.00417d00
mov byte [esp + 0x10], 5
lea edx, [esi + 0x48]
push edx
call fcn.00417d00
mov byte [esp + 0x10], 6
lea eax, [esi + 0x54]
push eax
call fcn.00417d00
mov byte [esp + 0x10], 7
lea ecx, [esi + 0x60]
push ecx
call fcn.00417d00
mov byte [esp + 0x10], 8
lea edx, [esi + 0x6c]
push edx
call fcn.00417d00
mov byte [esp + 0x10], 9
lea eax, [esi + 0x7c]
push eax
call fcn.00417d00
mov byte [esp + 0x10], 0xa
mov dword [esi + 0x78], 1
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x4351a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44ff04
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov ecx, 9
mov dword [esp + 0x14], ecx
lea eax, [esi + 0x7c]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 8
mov byte [esp + 0x14], cl
lea eax, [esi + 0x6c]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 7
mov byte [esp + 0x14], cl
lea eax, [esi + 0x60]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 6
mov byte [esp + 0x14], cl
lea eax, [esi + 0x54]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 5
mov byte [esp + 0x14], cl
lea eax, [esi + 0x48]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 4
mov byte [esp + 0x14], cl
lea eax, [esi + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 3
mov byte [esp + 0x14], cl
lea eax, [esi + 0x30]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 2
mov byte [esp + 0x14], cl
lea eax, [esi + 0x24]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov cl, 1
mov byte [esp + 0x14], cl
lea eax, [esi + 0x18]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
xor cl, cl
mov byte [esp + 0x14], cl
lea eax, [esi + 0xc]
mov dword [esp + 8], eax
mov byte [esp + 0x14], cl
call fcn.004181f0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
call fcn.004181f0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x436980
Capabilities:
Execute anti-debugging instructions
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x49c]
sub esp, 0x49c
push 0xffffffffffffffff
push 0x4507a3
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp + 0x498], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x4a4]
mov dword [ebp - 0x58], eax
mov eax, dword [0x5a1b94]
add eax, 0xa0
mov dword [ebp - 0x3c], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x38], 1
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x4a8]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x28], eax
mov esi, dword [0x5a1b94]
add esi, 0x68
lea ebx, [ebp - 0x4c]
lea eax, [ebp + 0x480]
call fcn.00437fb0
mov ebx, dword [esi + 4]
mov edi, dword [ebp + 0x480]
test edi, edi
je 0x436a1c
cmp edi, esi
je 0x436a21
call fcn.0043b6cb
mov esi, dword [ebp + 0x484]
cmp esi, ebx
je 0x436a3e
test edi, edi
jne 0x436a34
call fcn.0043b6cb
cmp esi, dword [edi + 4]
jne 0x436a3e
call fcn.0043b6cb
mov byte [ebp - 4], 1
push 0x45f0c8
jmp 0x6cd5f9

Function at 0x439070
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x44e50b
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
mov ebx, ecx
push 0x45f33c
jmp fcn.0061e7a6

Function at 0x439200
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x44e50b
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x46b070]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46b070]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
mov edi, ecx
push 0x45f364
jmp loc.00711880
Function at 0x5a8ae5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ja 0x62176f
mov ecx, 0x58905188
lea esi, [esi + ecx - 0x5890518c]
push ecx
mov edx, dword [esi + ecx - 0x58905188]
lea eax, [ecx + ecx*2 - 0xe7b07d4]
btc eax, 7
add eax, ecx
xor edx, ebx
inc edx
bswap edx
bt ecx, eax
dec byte [esp + ecx - 0x58905188]
lea edx, [edx + ecx + 0x57937f12]
setae byte [esp + eax - 0x53c63dcb]
ror edx, 3
bts eax, ecx
xor ebx, edx
add ebp, edx
mov edx, edi
ror eax, 0x61
and al, 0x9e
lea edi, [edi + ecx - 0x5890518a]
jl 0x607525
sub edx, 0x3caacb89
shr dword [esp], 0x10
mov ecx, 0xdc316f09
not edx
lea eax, [ecx*4 + 0x58052e2d]
sub ax, 0x3f1b
xor ebx, edx
call fcn.00664436
shl ax, 0x6d
xchg cx, ax
mov word [ecx + edi - 0x5890c000], dx
and dword [esp + eax*2 - 0x53c6a310], ecx
sbb cl, 0xbc
pop ecx
jg fcn.006d836e
sbb ebp, 4
btc eax, 0x94
pop ecx
add ecx, 0xfffbbf77
jmp ecx

Function at 0x5a97fc
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov eax, ebp
push ecx
not dword [esp + ecx*2 - 0x7f3f9512]
call fcn.006fb3d2

Function at 0x5a9e7d
Capabilities:
Get file version info

Disassembly:
dec edx
lea edi, [edx + edi - 0xe7fd]
shl eax, cl
movsx ecx, dx
ror dx, 0x46
mov dword [esp + edx - 0xff9f], 0x3e23cebb
mov dword [edx + edi - 0xff9f], eax
shr dl, 1
xchg ecx, edx
jne 0x67a497
mov eax, 0xc6020b3a
movzx edx, ax
movsx ecx, dx
lea esi, [edx + esi - 0xb3e]
mov ecx, dword [esi + edx*4 - 0x2ce8]
ror dl, 0xa3
shr ax, 0x6a
cdq
xor ecx, ebx
imul dl
jae 0x663ce8
mov dword [esp + ecx - 0xff4f], ebp
ret

Function at 0x5a9ee0
Capabilities:
Get file version info

Disassembly:
add dword [esp + 0xc], 0xffbd3b8a
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.00723a91

Function at 0x5ae402
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor eax, ebx
inc ecx
neg eax
mov dword [esp + ecx - 0x99501bb], 0x6ca556bd
inc byte [esp + edx*2 - 0x12a10]
not eax
xor ecx, 0x4b0d7d8e
imul edx, edx
dec eax
imul edx, ecx
not dx
xor eax, 0xea1d7a0c
call fcn.006346b4
Function at 0x5ae435
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
imul ax
lea ecx, [esp + ecx + 8]
mov dx, word [ecx + edx - 0x46600f15]
mov ecx, 0x2794781b
sub ax, cx
lea edi, [eax + edi - 0x66d5fcf7]
mov word [edi + ecx*2 - 0x4f28f036], dx
pop eax
pop ecx
jb fcn.005ff9ea
mov ecx, 0xf0e0cb7
mov eax, ecx
mov edx, eax
lea esi, [ecx + esi - 0xf0e0cbb]
sar ax, 0x6a
dec al
not edx
mov ecx, dword [esi + eax*4 - 0x3c380008]
lea eax, [edx + edx + 0x5fa4baab]
jae 0x6780f9
xor ecx, ebx
xadd ax, dx
not edx
xchg edx, eax
ror ecx, 1
neg ecx
xor ecx, 0x343d8615
sar ax, 0xe1
dec ecx
not ecx
inc ax
call fcn.006efbef
adc eax, dword [edx + 4]
xor ebp, dword [edx + esi*8]
mov ecx, 0x46fe8cfe
mov ebx, 0x7bb3010b
jecxz 0x678131
jae 0x678131
loopne 0x678171
aas
xor ebx, dword [edx]
pop ebx
call 0x738cb46c
invalid
add edx, 0x4d
sbb edx, dword [edx + eax]
or eax, 0x6616030c
int1
adc ah, cl
inc ebp
add al, 0x49
xor byte [eax - 0x12], al
sti
int 0xc6
sbb dh, ch
sti
or al, 0xac
bnd jnp 0x6781f3
ret 0xf6d6
mov cl, 0x8b
sal dh, 1
ror byte [edx - 0x50f0fbbb], cl
shl byte [esi + 0xf], cl
mov edx, 0xd58120f2
push es
add byte [eax], al
add byte [eax + 0x550c8d01], cl
lodsd eax, dword [esi]
ja 0x678216
hlt
out 0xf7, eax
ror dword [edi], 1
test byte [ebx + 0x70], ch
add al, 0
sub al, ah
xor ebx, ecx
call fcn.006acaa3
Function at 0x5ae78d
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ebp, 4
mov ecx, dword [ebp]
pop edx
mov edx, 0x46a34c33
push edx
xor ecx, ebx
mov eax, 0x5f2968b3
imul dl
bswap eax
ror ecx, 2
xor ecx, 0x380eec2c
dec ecx
not ecx
ror ax, 0x4a
cwde
xor ebx, ecx
add esi, ecx
movsx ecx, word [esp + eax - 0x57ca]
lea ebp, [edx + ebp - 0x46a34c34]
sal dx, 0x8e
movzx eax, byte [edx + ebp - 0x46a3c000]
xor cx, 0x66ab
inc cl
dec cl
xor al, bl
sar ecx, 0x37
inc al
or dword [esp + ecx], ecx
jns 0x66ede0
mov esi, eax
movzx eax, cx
ja fcn.006e56c3
mov eax, dword [esi]
lea edx, [ecx + ecx*8 + 0x56296d21]
jmp 0x693ba8
or dl, dh
movzx cx, byte [eax + ecx - 0x51a61980]
bswap edx
call fcn.006df779
push ecx
bswap edx
sar ecx, cl
rol edx, 1
movzx eax, cl
neg dword [esp + eax - 0x10]
call fcn.005f3be3
mov word [eax + ebp - 0x55a7ffba], dx
movzx edx, ax
neg ax
dec eax
lea esi, [edx + esi - 0xffbe]
mov ecx, edx
mov eax, dword [eax + esi - 0x55a70045]
sbb edx, edx
sar ecx, cl
sal ecx, 0xb8
xor eax, ebx
jmp 0x6ec30e
seto cl
xor al, 0xab
pop ecx
sub al, 0xb2
inc edx
rol al, 1
xor bl, al
sal ecx, 0xe7
ror edx, 0xf0
btr dx, dx
adc eax, esp
jmp 0x63ac04
xor edx, ebx
push ecx
bswap edx
lea eax, [ecx - 0x75520549]
xor edx, 0xceaf11a4
inc eax
ror edx, 2
dec eax
ror eax, 0xc6
neg edx
xchg dword [esp + ecx - 0x7a9767bf], ecx
rol edx, 1
sal ecx, 0xd1
xor ebx, edx
ror ecx, 0xec
jb 0x74a5a4
adc esi, edx
mov dword [esp + ecx - 0xcf7e0], esi
ret
or ecx, ecx
adc esi, 4
dec cx
sal cl, 0x41
xor eax, ebx
not eax
dec eax
bts cx, dx
xor eax, 0x872d6315
imul edx, ecx
neg eax
inc eax
xor ebx, eax
neg edx
call fcn.00669506
sar ax, 0x88
add dl, cl
shl ax, 0x61
jne 0x63b34c
call fcn.00601bbe
bswap eax
sal ecx, 0x2a
xor eax, 0x273ba335
btc dx, 0x99
sbb eax, ecx
add cx, cx
call fcn.005e7834
or cx, 0x239f
jno 0x691460
jmp 0x708981
sub esi, 4
mov edx, 0x4e9ef602
mov eax, 0x7f3daf39
mov ecx, dword [eax + esi - 0x7f3daf39]
mul al
sub al, dl
xor ecx, ebx
xadd ax, dx
inc ecx
call fcn.00615844

Function at 0x5b06b3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + eax - 0x268ebba4], 0xb0055826
sub ecx, 0xd8114015
mul al
or al, 0x18
xor ebx, ecx
shl eax, 0xd5
shr eax, 0x1a
cbw
lea edi, [edi + edx - 4]
bt ax, dx
mov dword [edi + eax - 8], ecx
lea ecx, [eax + 0x42a0568c]
sub byte [esp + eax - 8], 0x20
pop eax
jne fcn.006d5934
mov eax, 0xb1baba2b
sub eax, 0x858aee1c
call fcn.005ae81b
Function at 0x5b5cc6
Capabilities:
Encode data using base64
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0xc483283c
mov cl, byte [edi + 4]
push 0x7aae2581
adc edi, 4
shrd dx, ax, cl
mov word [edi], dx
mov eax, dword [esi]
mov edx, dword [esp]
lea ecx, [edx + edx*8 - 0x52ce4fca]
lea edx, [edx + ecx*8 - 0x1ac945e0]
lea esi, [esi + edx - 0x4a6ced95]
pop ecx
neg cx
xor eax, ebx
or dx, 0xf48e
dec eax
jmp 0x5b99a5
mov dword [eax + esi - 0x2ab9402f], ecx
call fcn.00679efb
xor edx, ebx
cbw
or ecx, eax
dec edx
shr ecx, cl
sar eax, 0x27
rol eax, cl
bswap edx
rol cx, 0x83
not edx
je 0x61f2f7
sal eax, cl
lea edx, [edx + eax*2 - 0x1ea2599b]
xor ebx, edx
add edi, edx
call fcn.00751f52
mov edx, dword [edi]
mov ecx, 0x77bc3a89
mov eax, 0x5181a88c
shl al, 7
mov cl, byte [edi + eax - 0x5181a7fc]
btc eax, eax
bts eax, eax
lea edi, [edi + eax - 0x5181a7fd]
call fcn.006b3c89
movzx edx, ax
add esi, ecx
movzx ecx, word [esp + edx*4 - 0xe4ec]
mov edx, dword [edi + edx*2 - 0x7276]
jmp 0x701fa3
not eax
sub dl, 5
setnp cl
inc edx
lea eax, [eax + edx*4 + 0x6f81b7b4]
neg edx
call fcn.0062671d
mov eax, dword [esi]
mov ecx, 0x629e7bb1
lea esi, [esi + ecx - 0x629e7bad]
mov edx, ecx
not dx
bt ecx, 0x12
xor eax, ebx
xor eax, 0xd2bfc28b
lea ecx, [ecx + edx - 0x11e40dc4]
not eax
xor eax, 0x1b86fa11
imul edx, edx
neg eax
jmp 0x6dad1f
xchg edx, ecx
xor ebx, eax
add edi, eax
call fcn.0068f695
mov eax, 0x562385a1
mov dx, word [edi + eax - 0x562385a1]
cbw
xor al, al
mov ax, word [eax + edi - 0x5623fefe]
jno 0x5a62ac
mov eax, dword [edi + ecx*2 + 4]
call fcn.005c062a

Function at 0x5b76e8
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
jae 0x6f662c
js 0x6f6637
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.006cf8d5
mov edx, 0xcea6871b
add dl, dh
call fcn.00740a30
inc ecx
sbb edi, 3
shr dl, 0xa2
jne 0x71622d

Function at 0x5b85c2
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor ebx, eax
xor dl, cl
adc esi, eax
movzx eax, dx
cwde
sar dword [esp + edx*2 - 0x7d100f34], 0x4b
mov edi, dword [edi + edx - 0x3e8807a0]
pop ecx
pop ecx
pop eax
pop edx
js fcn.005ff9ea

Function at 0x5ba393
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
call fcn.0063b318
fldz
call fcn.0063b2ce
sub esi, 4
mov eax, dword [esi]
mov ecx, 0xcc8ffb8a
lea edx, [ecx + ecx*8 + 0x8922c88]
xor eax, ebx
jmp 0x5cdb99
jmp 0x5b813b

Function at 0x5ba7f9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
add dword [esp + 4], 0xff9759a0
mov dword [esp + 8], 0x61a81b00
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.006b8afb
sub esi, 4
push 0x28bd68ae
call fcn.0072336b