joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5286ab
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
dec esp
test dl, ch
or byte [ecx + edx - 0x3046c03c], ch
sbb al, byte [esi - 0x6d]
cmp al, 0x36
cmp al, byte [ebx - 0x2daf79e1]
fld dword [ecx - 0x49]
push ecx
rcr cl, cl
inc ecx
mov bh, 0x51
sub dl, dl
cmp ebx, dword [ecx - 0x5af7f625]
add dword [ecx + 0x2bda5548], 0xffffff90
dec eax
push ebp
fisubr dword [ebx]
nop
dec eax
push ebp
fisubr dword [ebx]
nop
mov ebx, 0xc6a794b
fisubr dword [esi + eax*2 - 0x6e]
xor eax, 0x23d81909
popal
push ds
pop es
das
pop esi
cmp dword [ebx + 0xd98d63e], eax
mov dword [0x1b05d79], eax
enter 0x6484, 0xffffffffffffff97
xor dword [esi], edi
jle 0x52869c
and eax, edi
inc ebx
mov al, byte [0x252298db]
das
inc esp
outsd dx, dword [esi]
scasd eax, dword es:[edi]
mov ecx, 0xbad0ce51
arpl word [eax], di
scasb al, byte es:[edi]
pop es
out dx, al
dec edx
adc byte [eax + 0x73a25101], ah
xor eax, dword [esi + ebx*8]
or al, 0x70
mov bh, 0xdb
jge 0x528688
sbb byte ss:[esp + edi*4 + 0x3c664034], al
sti
push ecx
pop edx
in eax, 0xc9
xchg ecx, eax
scasd eax, dword es:[edi]
sbb cl, byte [ebp - 0x21]
invalid

Function at 0x569cb7
Capabilities:
Encode data using xor

Disassembly:
fmulp st(6)
and al, byte [eax - 0x5af23016]
test al, 0xa1
xchg ecx, eax
push ebx
cdq
stosb byte es:[edi], al
cmpsd dword [esi], dword es:[edi]
sub al, 0x3a
cmp esp, ebx
call dword [edx + 0x30641fae]
test eax, 0xd4e3e74
xchg edx, eax
scasb al, byte es:[edi]
pop ds
xor byte fs:[ecx + 0xd4e3e74], ch
inc esi
dec ebx
jae 0x569ccb
push esp
xlatb
lea esi, [esi]
xor edx, dword [ecx - 0x2d]
mov bl, 0xa6
jns 0x569ce6
adc dword [edx + 0x46e040aa], edi
stosb byte es:[edi], al
inc eax
loopne 0x569d30
lea eax, [ebx]
lahf
pop edi
xor al, 0x2c
mov dh, 0xe7
shr byte [eax + 0x182c51a2], 0x26
mov ds, esp
inc esi
and dword [eax], ecx
sub esi, dword [ebx]
inc ebp
hlt
idiv dh
cdq
invalid
Function at 0x570aac
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xchg esp, eax
mov al, byte [0xdf344821]
pop edi
dec eax
push cx
or cl, byte [esi]
jmp dword [eax - 0xa65e88a]
adc eax, 0x72f035e9
test byte [esi - 0x4c], 0x5f
cmp byte [esi - 0x1c], dh
jbe 0x570ab6
pop ds
push es
mov ebx, 0xcc526881
add bh, ch
sub ebp, ecx
push ebx
inc ebp
loop 0x570a92
je 0x570a7c
stosb byte es:[edi], al
sub bh, dh
cdq
push ecx
jns 0x570a00
fsub dword [edx + 0x74043b05]
fbld tbyte [ebx + eax*4]
lea esi, [0x15d22764]
mov ebp, ebp
pop ss
xchg ecx, eax
salc
and eax, 0x40029d09
enter 0xffffffffffffcefa, 0x64
out 0x5b, eax
stc
or byte ss:[ecx], cl
sti
lahf
jbe 0x570aa2
push cs
jecxz 0x570aef
xchg esp, eax
fadd dword [ebx + edi*4 + 0x6b]
sbb al, 0x4e
invalid
mov cl, 0xbd
push edi
mov eax, 0x47aaeac2
lds ebp, [esi - 0x70886819]
test dword [edi], edx
sbb dword cs:[edi - 0x4b], edx
adc dword [0x1294ede1], esp
jne 0x570a31
push es
mov esi, 0xbb0f345d
add byte [ebx - 0x62], al
inc ebx
sahf
mov eax, 0x1d0de86b
wait
xor eax, 0x4a4a98f1
cwde
mov eax, dword [0x6bb2f7dd]
pop esi
adc eax, 0x87e99a3e
add ecx, dword [ecx]
xchg edx, eax
arpl word [0x89e4a67a], dx
lcall 0xd052, 0x12e5f239
jp 0x570a68
mov dl, 0xde
stc
xchg byte [esp + eax*8 + 0x71319e91], dh
xor al, 0x37
test dword [esi], 0x72725e26
pop esi
Function at 0x570b8b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jb 0x570b65
jne 0x570b45
dec esp
cmp eax, 0x949bd359
push ebp
mov ecx, 0x9a670d97
and al, 0x69
mov al, byte [0xa878f02a]
dec ebp
push esi
jae 0x570b56
pop ds
and al, 0x82
lds edi, [esi]
jle 0x570b35
mov dword [edi + 0x5ab3aed5], esi
mov cl, 0x7e
enter 0xffffffffffffac7d, 2
sal byte [ecx + 0xe382e4a], 0x7c
xor bh, byte [ecx - 0x38]
jl 0x570b59
jns 0x570af1
mov esp, edi
pop ecx
mov word [edi - 0x33], cs
pop ebx
dec ebp
sub ebp, ebx
call 0x34a38821
mul dword [edx - 0x9cf113d]
call 0xf78b57b6
mov byte [0xf630eec3], al
cmp al, 0xb0
lodsd eax, dword [esi]
ret
popal
push ds
aaa
je 0x570bb7
inc ecx
inc edi
pop esi
dec eax
cmp eax, 0x2aeac7f3
test dl, cl
pop es
cmpsb byte [esi], byte es:[edi]
rcl ecx, 0xd1
test al, 0x8b
invalid
shr dword [eax + 0x5d38d8b], 1
loop 0x570b6d
or al, 0x59
pop ecx
salc
ret
push ecx
lahf
std
mov bh, 0x46
push eax
add ah, byte [ebp - 0x1e]
jne 0x570b08
loop 0x570be5
xchg edi, eax
push es
cmp dword [ebp + 0x5cf828d5], edi
xor eax, dword [ecx + 4]
out 0x48, al
mov esi, 0x16b395e1
stosd dword es:[edi], eax
out dx, al
jmp 0x570b60
pop ds
sbb al, 0x58
pop eax
pop eax
jns 0x570b89
jbe 0x570bf7
add al, byte [ecx]
mov cl, byte [edx - 0x159ddca3]
mov ecx, 0xd0d37075
inc edi
xchg esi, eax
jnp 0x570be0
jecxz 0x570b25
lodsd eax, dword [esi]
in eax, dx
pop es
mov byte [edx - 0x12c68845], ah
cmp ebp, ebp
jnp 0x570b91
dec ecx
mov dword [edx + 0x67], eax
invalid
cmpsb byte [esi], byte es:[edi]
outsb dx, byte [esi]
jns 0x570be3
pushfd
and al, 0x53
sub al, 0x76
out 0x9a, eax
shl dword [ecx], cl
scasb al, byte es:[edi]
insb byte es:[edi], dx
sub ah, bh
jle 0x570bc5
bound esp, qword [edx]
jecxz 0x570bab
mov bl, 0xc8
ljmp 0x377c
sub byte [ecx - 0x59], al
push esi
cmp dword [ecx], ecx
inc eax
cmp byte [ebx], 0xc4
or dword [eax - 0x80], eax
cmp eax, esp
sub al, byte [ecx - 0x4a2b535a]
jbe 0x570bbc
pushal
je 0x570c5a
mov edi, 0xb1ef740d
invalid
je 0x570be8
mov cl, 0xf0
hlt
fsubr dword [edi + 0x71]
dec ecx
jl 0x570cae
outsd dx, dword [esi]
sar byte [ecx - 0x78975392], cl
adc byte [esi - 0x592b72e1], al
int3
adc ecx, dword [eax + 0x2c]
sub edi, eax
invalid

Function at 0x570cb7
Capabilities:
Encode data using xor

Disassembly:
dec ebp
pop ds
and dword [ebp + eax - 0x2b], ebx
pop ecx
sal byte gs:[0xfbc86ba3], 1
dec edx
adc eax, 0x8a5ad99a
and al, 0xac
adc al, 0xf6
and esp, dword [edi]
in eax, dx
adc byte [eax - 0x5596f175], 0x42
stosb byte es:[edi], al
inc edx
loop 0x570cd7
mov byte [0x227af457], al
push cs
mov ah, 0x83
clc
adc eax, dword [eax + 0x6a]
mov ecx, 0x7861eac0
dec ebx
dec edx
push ebp
adc byte [esi + 0x4acf116a], 0x64
pop ebp
not dword [esi + 0x64]
lea edx, [esi + esi*4 - 0x5c]
test al, 0x26
dec esp
xchg ebp, eax
outsb dx, byte [esi]
cmp dword [eax + 0xd], 0xffffffd5
sal byte [edx - 0x239c66e0], cl
xor ecx, dword [ecx]
fcomp st(7)
mov byte [eax + 0x5731048d], bh
sbb eax, 0xd1ae872
xchg eax, ebp
mov dword [0xe8b86eb7], eax
popfd
loopne 0x570cd7
invalid
Function at 0x57f3c1
Capabilities:
Encode data using xor

Disassembly:
inc ebx
mov ah, 0xc5
imul edi, dword [ebp + esi - 0x3d], 0x27d95f85
xor ah, byte [edi - 0xc]
pop ds
call dword [edx + ecx*8 + 0x42]
sub dword [edx - 0x4d679604], ebp
leave
push ebp
mov eax, dword [0x1f8c5a1b]
mov dl, 0xa9
xor al, 0x79
sub ebx, dword [ebp + 0x3126f67f]
outsd dx, dword [esi]
add esp, dword [eax + 0x75]
movsd dword es:[edi], dword [esi]
aad 0xc1
les esi, [ebp*8 + 0x3eed5b1a]
dec ebp
dec ecx
dec eax
xchg esp, eax
lahf
test dword [ebx], edi
jmp 0x57f418
invalid
push eax
pop esp
sbb edx, ebp
adc al, 0xf1
cld
dec eax
clc
xchg esi, eax
pop ss
clc
xor byte cs:[edx], dh
xor dl, byte [ecx + 0x7091eae2]
pop ds
xchg ecx, eax
loop 0x57f406
xchg ecx, eax
jo 0x57f43e
dec esi
and dword [edx + 0x16f710a4], ebp
daa
cmp eax, 0xf007beb4
mov eax, dword [0xceb224dd]
sub byte [edi + 0x6afb5f73], ah
cmp byte [edx], 0xb0
cdq
mov dl, 0x9d
loope 0x57f4b2
jae 0x57f40a
retf 0x79e3
jecxz 0x57f4bb
popfd
push ecx
imul byte [esi + 0x20c181a7]
mov dh, 0x24
add eax, 0x9cfedbcd
sti
loop 0x57f44a
invalid
pop eax
test dword [edi - 0x39], ecx
jle 0x57f419
dec esi
dec ecx
wait
invalid
out dx, al
pop ebp
push ss
jp 0x57f46d
push edx
jl 0x57f52e
loopne 0x57f4b1
stc
pop edx
enter 0xffffffffffffc489, 0x2d
cmp bh, dl
pop esp
adc al, 0x50
mov ecx, 0x982cf441
sbb eax, 0x4ccaf58d
scasb al, byte es:[edi]
push esi
mov esi, 0xe58ccfaa
or dl, byte [edx - 0x6c]
fisub word [esi + ebx*4 + 0x20]
bound esi, qword [edx - 0xbc10f33]
xchg ebx, eax
jmp 0x57f549
cld
sub dword [esi], ebx
invalid
inc esp
test al, 0x3e
mov ecx, 0x7fcf65d8
popal
sbb al, 0xc0
ror dword [ebx - 0xe], cl
push ecx
xchg edi, eax
cld
sub cl, bl
leave
fldenv [esi]
leave
mov dh, 0xf1
std
aas
jp 0x57f540
idiv byte [eax - 0x23]
js 0x57f529
lahf
nop
dec ebx
adc dword [esi], eax
jmp 0x57f5a7
mov eax, 0xfb2238c0
sar byte [ecx], cl
into
mov ecx, 0x94a0d9e9
sbb edi, dword [ebx - 0x21386af4]
out 0x4e, eax
xchg dword [ecx], esp
jl 0x57f607
femms
inc ebp
jnp 0x57f63f
and al, al
inc ebx
xchg esp, eax
into
movsb byte es:[edi], byte [esi]
add ah, byte [edx + 0x2a]
test byte [ebp - 0x32], dh
rol byte [0x4fecbf62], 1
fimul dword [ebp + 0x1156fbdc]
test eax, 0xc6df5de8
mov dword [0xb2cc3fca], eax
pop ds
call [esi]
stosd dword es:[edi], eax
jns 0x57f651
pop ebp
out 0xf2, eax
rcl bl, cl
cli
xor byte [esi - 0x68d32102], cl
add eax, 0x3d15da34
aas
out dx, al
les edx, [eax]
in eax, 3
aas
push es
int1
ja 0x57f632
invalid
cld
jbe 0x57f677
rol esi, cl
jno 0x57f651
mov bl, 0x5e
inc eax
in al, dx
sti
push esp
out dx, eax
test dword [esi], esp
inc ecx
or al, bh
pop ebx
and edx, dword [eax - 0x15]
xchg byte [edi + 0x2e], cl
mov eax, 0xd092c07f
pop edi
in eax, 0x43
scasb al, byte es:[edi]
xchg bx, ax
mov cl, 0x85
ret
iretd
Function at 0x5b2430
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [bp + 0x1efa]
mov dh, 0x82
lodsd eax, dword [esi]
rcr dword [edx - 0x80], 1
or eax, 0x70ee49fb
push ds
cdq
test bh, 0xe0
mov dword [eax + 0x2d394225], ecx
mov dword [0xbe8e8636], eax
in eax, dx
mov al, byte [0x5b0cc725]
push edi
popal
scasd eax, dword es:[edi]
or eax, 0xcb408f21
lcall 0xee9d, 0x37adf30e
sub ebx, edi
insb byte es:[edi], dx
arpl word [edx - 0x33], bp
sub eax, 0xd9124199
xlatb
fdiv dword [edi + edx*4 - 0x3288894c]
invalid

Function at 0x5c06c7
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
lea ebp, [eax]
jno 0x5c06fe
push cs
sub byte [ebx - 0x6f955486], dh
and esi, dword [ecx - 0x3e]
add eax, 0xcdaa5412
sbb dword [ebx], esp
dec eax
add cl, byte [ebx + 0x535ce1b5]
or byte [edx], bh
out 7, eax
ror byte [eax - 0x52], 0x8b
scasb al, byte es:[edi]
mov esi, dword [ecx + 0x4a]
scasb al, byte es:[edi]
mov esi, dword [ecx + 0x4a]
push 0xffffffffffffff86
jb 0x5c06a4
stc
sub eax, 0x5eed84f2
pop es
ret 0xd277
sbb byte [edi + 0x61], 0xda
mov edi, 0xcbcb8bc4
xor byte [ebx], 0x7c
loopne 0x5c0707
insd dword es:[edi], dx
mov ecx, 0x30831f0e
scasd eax, dword es:[edi]
mov edx, esi
cmc
jmp 0xb11e41c3

Function at 0x600ffe
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x60100e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x60101b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, esi
pop esi
jmp fcn.0042ae41
Function at 0x6ac9b2
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
ficom dword [edx - 0x14cc4f78]
sub byte [edi - 0x43], ah
sbb edi, edi
sal dword [edi + esi*8], 1
inc dword [ecx + 0xe]
adc dword [esi + ecx*2 - 0x45], esi
mov ah, 0x11
cmp dword [edi - 0x6b], edi
push cs
xor eax, 0x53b80c1
mov ecx, 0x345307f7
push ecx
xchg dword [eax - 0x3d], ecx
adc dh, byte [ebx - 0x1670ca2f]
and al, 0x1e
mov bl, 0xd1
xor eax, 0x1e24e98f
add al, 0xeb
xor ecx, dword [ecx - 0x4d]
std
sub eax, 0x304f5ada
xor eax, 0xc06d2a88
salc
mov al, 0x9c
xor eax, 0xb6c7971
bound esi, qword [ecx - 0x41c20051]
jnp 0x6ac9dc
jae 0x6aca64
cmp edx, dword ds:[esp + ecx*2 + 0x369a7820]
lds esp, [ebx + ecx*2 - 0x9fdc537]
add byte [edi + 0x76aa5fd1], bl
xor edx, ebx
inc ebp
xor ch, byte [ebp + 0x40]
imul edx
mov ah, 0xa1
dec byte [edi + 0x37]
mov eax, dword [0xdbfa3135]
std
pop ss
xchg ebx, eax
pop ecx
mov esp, 0xab20d2df
sbb byte [edx], 0xe6
test byte [edx + 0x3e3446e], ah
cwde
stosd dword es:[edi], eax
inc esi
popal
push 0xbe553479
mov ecx, 0x2271e79f
insd dword es:[edi], dx
imul edx, edx, 0xb29b7eec
out 0x84, al
std
cli
mov eax, dword [0x1d1030e4]
mov byte [0x732d486f], al
mov dword [ebp - 0x6307c7f], edi
mov al, byte [ebx]
sal dword [edi + 0x1c], 0xbc
add dword [ebx + 0x38af9cf], 0xbc1c77c1
outsb dx, byte [esi]
popal
or dword [edx - 0xf], ecx
invalid
Function at 0x100410f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x10050b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp dword [ebp + 0x10], 1
mov eax, 0x80004005
mov dword [ebp - 0x288], esi
mov dword [ebp - 0x290], eax
jb 0x100429b
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x288]
push eax
push 0x108
push esi
push dword [0x10050d0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004266
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x284]
push eax
mov dword [ebp - 0x298], esi
push esi
jmp 0x1004239
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
push 8
push 0x100187c
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x288]
mov dword [ebp - 0x28c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100421b
cmp dword [ebp - 0x28c], esi
jbe 0x100421b
shr dword [ebp - 0x28c], 1
mov eax, esi
je 0x100421b
mov cx, word [ebp + eax*2 - 0x84]
cmp cx, word [ebp + 8]
jne 0x1004212
mov dword [ebp - 0x290], esi
cmp eax, esi
je 0x1004255
cmp word [ebx], si
jne 0x100420c
lea eax, [ebp - 0x284]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.01001ea4
mov eax, dword [ebp - 0x28c]
inc eax
cmp eax, dword [ebp - 0x28c]
jb 0x10041df
inc dword [ebp - 0x298]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x298]
push dword [ebp - 0x288]
mov dword [ebp - 0x294], 0xff
call edi
test eax, eax
je 0x1004196
jmp 0x1004265
lea eax, [ebp - 0x284]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.01001ea4
pop edi
cmp dword [ebp - 0x288], esi
je 0x100427a
push dword [ebp - 0x288]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x290], esi
jne 0x1004295
push ebx
call fcn.01004083
xor ecx, ecx
test al, al
sete cl
mov dword [ebp - 0x290], ecx
mov eax, dword [ebp - 0x290]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100377d
leave
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x408e10
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [esp + 4]
mov cx, ax
push esi
mov esi, eax
shr eax, 0x10
push edi
and eax, 0xf
mov edi, 0x3ff
and esi, edi
mov word [0x4ec2e4], ax
movzx eax, si
shr cx, 0xa
cmp eax, 0x2d
movzx ecx, cx
jg 0x408f01
je case.0x408e51.3
dec eax
cmp eax, 0x23
ja case.0x408e51.2
jmp dword [eax*4 + 0x408f4c]
or esi, 0x400
mov word [0x4ec2e0], si
jmp 0x408f33
movzx eax, cx
dec eax
je case.0x408e51.1
dec eax
je 0x408ef0
dec eax
je case.0x408e51.1
dec eax
je 0x408ef0
dec eax
jmp case.0x408e51.1
movzx eax, cx
dec eax
dec eax
je 0x408ef0
sub eax, 4
je 0x408ef0
call dword [0x4b746c]
movzx eax, ax
mov ecx, eax
and ecx, edi
cmp cx, 9
jne case.0x408e51.2
mov ecx, 0x800
and eax, 0xfc00
mov edx, ecx
cmp ax, dx
jne case.0x408e51.2
or esi, ecx
jmp 0x408e5e
movzx eax, cx
cmp eax, 1
je 0x408ecf
cmp eax, 2
je 0x408ef0
cmp eax, 3
je 0x408ecf
jle case.0x408e51.1
cmp eax, 0x14
jle 0x408ef0
jmp case.0x408e51.1
call dword [0x4b746c]
shr ax, 0xa
movzx eax, ax
cmp ax, 3
je case.0x408e51.1
cmp ax, 1
je case.0x408e51.1
or esi, 0x800
jmp 0x408e5e
movzx eax, cx
dec eax
jmp 0x408eea
cmp eax, 0x3f
jl case.0x408e51.2
cmp eax, 0x40
jle case.0x408e51.25
cmp eax, 0x42
jle case.0x408e51.2
cmp eax, 0x44
jle case.0x408e51.25
cmp eax, 0x56
jne case.0x408e51.2
mov eax, 0x40a
jmp 0x408f2d
mov eax, 0x419
jmp 0x408f2d
mov eax, 0x400
mov word [0x4ec2e0], ax
movzx eax, word [0x4ec2e4]
movzx ecx, word [0x4ec2e0]
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret

Function at 0x469537
Capabilities:
Encode data using xor

Disassembly:
ja 0x469540
add al, 0xdd
mov eax, 0x97e65a64
xlatb
sbb bh, byte [0x252a7eaf]
test dword [edx - 0x7f], ebx
out 0xa0, eax
leave
sbb eax, 0x84a3b610
lea ebx, [ebp + 0x5ccf6a50]
shufps xmm3, xmmword [ecx], 0x45
jp 0x469540
test dword [ebx + 0x1e], esi
adc dword [edi + 0x66b813f4], 0x1d
ja 0x469524
and eax, 0x5606a4b4
Function at 0x40c965
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40ca19
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040c8f5
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40c9f2
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ca25
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40ca40
test ebp, ebp
je 0x40ca40
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40ca48
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40ca88
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40cae4
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40cadf
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40caca
test dl, dl
je 0x40cac6
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40caca
add ecx, 2
add eax, 2
test dl, dl
jne 0x40caaa
xor eax, eax
jmp 0x40cacf
sbb eax, eax
or eax, 1
test eax, eax
je 0x40caee
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40ca97
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40cb05
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040c965
test eax, eax
jne 0x40cb1d
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040ca25
mov esi, eax
test esi, esi
jne 0x40cb53
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40cb6d
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40cc65
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0040c965
mov esi, eax
test esi, esi
jne 0x40cc83
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0040ca25
mov dword [esp + 0x18], eax
test eax, eax
je 0x40cc7b
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0040ca25
mov dword [esp + 0x34], eax
test eax, eax
je 0x40cc7b
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0040ca25
mov dword [esp + 0x28], eax
test eax, eax
je 0x40cc7b
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0040ca25
mov dword [esp + 0x30], eax
test eax, eax
je 0x40cc7b
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x40ce4a
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x40ce4a
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40cdad
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x40ce2e
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x40cdd0
movzx esi, ax
jmp 0x40cdd5
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40cdf4
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x40ce03
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40ce57
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x40cdc5
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x40cd8a
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x40ce80
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x40ce80
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x40ce65
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret