joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491b9c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x491ba5
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Classes_TStream_GetPosition_qqrv
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x491c52
cmp dword [ebp - 0xc], 0x2800
jl 0x491c00
mov dword [ebp - 8], 0x2800
jmp 0x491c06
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x491c4a
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x4c33a0]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x491c21
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x491be8
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1008e2d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1002cc8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008e85
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1002d04
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1008e78
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1008e87
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x431383
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x72aa2a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esi + 0x168]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov byte [esp + 0x14], bl
call fcn.0040d4f7
mov dword [esp + 0x30], ebx
cmp byte [esi + 0x184], bl
je 0x431403
mov dword [esp + 0x14], ebx
call fcn.006598d0
mov dword [esp + 0x18], eax
lea eax, [esi + 0xb0]
mov edx, dword [eax]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [eax + 8]
lea eax, [esp + 0x20]
push eax
mov eax, dword [edx + 0x14]
call fcn.0043352b
mov byte [esi + 0x184], bl
or dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
call fcn.0040d1d9
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44900d
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x820ac4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, dword [ebp + 0x10]
push edi
push 0x10
pop ecx
mov esi, 0x7b7f88
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
xor ecx, ecx
cmp dword [ebp + 0xc], esi
jle 0x4490d3
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
movzx edi, al
mov edx, edi
shr edx, 2
mov dl, byte [ebp + edx - 0x48]
mov byte [ebx + ecx], dl
inc ecx
inc esi
cmp esi, dword [ebp + 0xc]
jge 0x4490f1
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
mov byte [ebp - 0x49], al
movzx eax, al
and edi, 3
shl edi, 4
mov edx, eax
shr edx, 4
or edx, edi
mov dl, byte [ebp + edx - 0x48]
mov byte [ebx + ecx], dl
inc ecx
inc esi
cmp esi, dword [ebp + 0xc]
jge 0x449110
mov edx, dword [ebp + 8]
mov dl, byte [esi + edx]
movzx edi, dl
and eax, 0xf
shl eax, 2
mov edx, edi
shr edx, 6
or edx, eax
mov al, byte [ebp + edx - 0x48]
mov byte [ebx + ecx], al
and edi, 0x3f
mov al, byte [ebp + edi - 0x48]
inc esi
inc ecx
mov byte [ebx + ecx], al
inc ecx
push 0x48
xor edx, edx
mov eax, ecx
pop edi
div edi
test edx, edx
jne 0x4490ca
mov byte [ebx + ecx], 0xd
inc ecx
mov byte [ebx + ecx], 0xa
inc ecx
cmp esi, dword [ebp + 0xc]
jl 0x44903e
lea eax, [ebx + ecx]
mov byte [eax], 0x3d
mov byte [eax + 1], 0
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0054ae61
leave
ret 0xc
and eax, 3
shl eax, 4
mov al, byte [ebp + eax - 0x48]
mov byte [ebx + ecx], al
inc ecx
mov byte [ebx + ecx], 0x3d
lea ecx, [ebx + ecx + 1]
mov byte [ecx], 0x3d
mov byte [ecx + 1], 0
jmp 0x4490dd
movzx eax, byte [ebp - 0x49]
and eax, 0xf
mov al, byte [ebp + eax*4 - 0x48]
mov byte [ebx + ecx], al
jmp 0x449103
Function at 0x4798c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x3bc]
sub esp, 0x43c
mov eax, dword [0x820ac4]
xor eax, ebp
mov dword [ebp + 0x3b8], eax
push esi
push edi
push 0x410
xor edi, edi
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.0054b920
add esp, 0xc
push 0x206
lea eax, [ebp - 0x74]
push eax
push edi
call dword [0x7444bc]
test eax, eax
mov esi, dword [0x744474]
ja 0x47991a
push 0x7b5f6c
lea eax, [ebp - 0x74]
push eax
call esi
lea eax, [ebp - 0x74]
push 0x7bb91c
push eax
call fcn.0047981b
pop ecx
push eax
call esi
push edi
push 0x80000080
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x74]
push eax
call dword [0x7443a0]
cmp eax, 0xffffffff
mov dword [ebp - 0x78], eax
jne 0x47995a
push 0x7bb938
call dword [str.BXh6]
jmp 0x4799cb
push ebx
mov ebx, 0x8b5440
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x479965
sub eax, edx
mov dword [ebp - 0x7c], eax
je 0x4799c1
push 6
pop ecx
mov esi, 0x7b9390
lea edi, [ebp + 0x39c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edx, edx
xor ecx, ecx
test eax, eax
movsb byte es:[edi], byte [esi]
jbe 0x4799aa
mov al, byte [ebp + edx + 0x39c]
xor byte [ecx + 0x8b5440], al
lea eax, [edx + 1]
push 0x1b
cdq
pop esi
idiv esi
inc ecx
cmp ecx, dword [ebp - 0x7c]
jb 0x47998e
and dword [ebp - 0x80], 0
push 0
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x7c]
push ebx
push dword [ebp - 0x78]
call dword [0x7443c8]
push dword [ebp - 0x78]
call dword [0x744214]
pop ebx
mov ecx, dword [ebp + 0x3b8]
pop edi
xor ecx, ebp
pop esi
call fcn.0054ae61
add ebp, 0x3bc
leave
ret

Function at 0x47eab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x71f068
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.0044b650
mov dword [esi + 4], eax
mov byte [eax + 0x45], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [eax + 8], eax
mov dword [esi + 8], ebx
mov dword [esp + 0x14], ebx
call fcn.00413a72
mov dword [esi + 0x10], eax
mov byte [eax + 0x45], 1
mov eax, dword [esi + 0x10]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x10]
mov dword [eax], eax
mov eax, dword [esi + 0x10]
mov dword [eax + 8], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov eax, 0xf
mov dword [esi + 0x30], eax
mov byte [esi + 0x1c], bl
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], ebx
mov byte [esi + 0x38], bl
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], ebx
mov byte [esi + 0x54], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x47eb60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x71f038
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
cmp dword [edi + 0x68], 0x10
jb 0x47eba0
mov eax, dword [edi + 0x54]
push eax
call fcn.005416e5
add esp, 4
mov esi, 0xf
mov dword [edi + 0x68], esi
mov dword [edi + 0x64], ebx
mov byte [edi + 0x54], bl
cmp dword [edi + 0x4c], 0x10
jb 0x47ebc0
mov eax, dword [edi + 0x38]
push eax
call fcn.005416e5
add esp, 4
mov dword [edi + 0x4c], esi
mov dword [edi + 0x48], ebx
mov byte [edi + 0x38], bl
cmp dword [edi + 0x30], 0x10
jb 0x47ebdb
mov eax, dword [edi + 0x1c]
push eax
call fcn.005416e5
add esp, 4
mov dword [edi + 0x30], esi
mov dword [edi + 0x2c], ebx
lea esi, [edi + 0xc]
mov byte [edi + 0x1c], bl
call fcn.00413528
mov ecx, edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.0044ad97
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4e2570
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x4e259e
inc ebp
invalid
xchg byte [edi - 0x45845bd6], bl
in eax, 0x69
arpl word [ebx], ax
loopne 0x4e25db
mov eax, dword [0x3108a6e]
dec edx
xor dword [ecx], eax
and al, 0
stosb byte es:[edi], al
sub eax, 0x2b5739f6
push ds
add eax, 0x5ec8eec9
jo 0x4e25d4
push cs
dec eax
mov dl, 0xa
sub eax, 0x45d21227
loop 0x4e25a9
or ch, byte [edx - 0x42]
push 0xffffffffffffffbe
pop ss
ljmp 0xb866
jne 0x4e260e
mov eax, 0xa6002604
stosd dword es:[edi], eax
and byte [ecx], cl
xor byte [0x2af36280], bh
add al, 0x26
add byte [esi + 0x300920ab], ah
cmp eax, 0x2af36280
adc dword [esi + 0x36d580ed], edx
mov bh, 0xc1
retf
stosb byte es:[edi], al
imul eax, dword [esi], 0xffffffd8
aad 0x3f
jle 0x4e2650
je 0x4e255d
adc byte [edx + eax*2 + 0x5b], 0xc4
push ds
push esp
inc edx
pop ebx
les ebx, [esi]
insd dword es:[edi], dx
cmpsd dword [esi], dword es:[edi]
std
pop esp
cmc
pop edi
out 0x1f, al
sahf
and ah, byte [edx - 0x1f76523e]
inc eax
xchg edx, eax
pushfd
jb 0x4e260c
add byte [edi], ah
add byte [esi - 0x53b7ff15], ch
lodsb al, byte [esi]
push ds
pushal
pop ebx
je 0x4e25a6
mov dword [ebx + 0x65], edi
sub byte [ebp - 0x22], 0x3f
lahf
jmp 0x9d8badb8
xchg dword [0x30e9019d], edi
push cs
mov edx, 0x36351ebf
sbb eax, 0xd4f58572
cmp byte [eax], al
and byte [eax], al
stosb byte es:[edi], al
stosd dword es:[edi], eax
sub byte [ebx + 0x1c9bfd6c], cl
and dh, ch
add al, 0x84
cli
xor eax, 0x6e4eb631
mov ebx, dword [ecx - 0x72]
push esi
cld
push esp
mov edi, 0x1c496da8
inc esp
cmpsb byte [esi], byte es:[edi]
pop es
add byte ss:[edx + 0x7919276d], ch
cmc
inc ecx
psrlq mm7, qword [edi + ecx*8 + 0x45b175ff]
push dword [ebp - 0x4f]
inc ebp
fst st(1)
sbb eax, 0xb139d8b5
cmp eax, 0x1b6dbd61
mov dl, 0x1d
jle 0x4e2623
les ebp, [eax + 0x7d]
popfd
jo 0x4e25fe
invalid
Function at 0x52fe01
Capabilities:
Encode data using xor

Disassembly:
add ch, byte [ebx]
add byte [esi + 0x64], ch
pop ebx
invalid
outsd dx, dword [esi]
aaa
or edx, ebp
invalid
and al, 0x5c
and eax, edx
push cs
and byte [esi], bh
dec esi
pushal
jl 0x52fe1d
lea ebp, [ebx + 0x559cd26c]
jmp 0x52fe35
wait
pop ebx
jnp 0x52fe4c
rcr byte [edx + 0x221226], 1
jbe 0x52fdcf
xchg edx, eax
iretd
dec edx
adc bl, cl
imul ecx, dword [eax + 0x2fb7afb1], 0x6b5d955a
sub ch, byte [esi - 0xd]
xor esp, dword [edx + 0x20077f]
jb 0x52fdf4
cmpsd dword [esi], dword es:[edi]
dec edi
jp 0x52fe03
sbb eax, dword [eax - 0x17ed2500]
fcomp qword [esi + ebx + 0x62]
pop es
test eax, 0x3e8abc05
pop eax
inc edx
out dx, eax
out 0xef, eax
xchg esi, eax
invalid

Function at 0x54e056
Capabilities:
Encode data using xor

Disassembly:
ljmp 0xa7de:0x88baebfb
fisub word [edi - 0x5377f6a2]
invalid
xor byte [eax + eax - 0x47], 0
ja 0x54e012
jle 0x54e0c3
mov byte [0xaa99903f], al
in eax, dx
out dx, al
jb 0x54e00d
and al, 0x72
xchg ecx, eax
out 7, eax
hlt
xor ebp, dword [edx + edi]
sub al, 0x3a
mul bl
adc al, 0xef
and ecx, dword [ebx - 0x7fe5d243]
mov eax, dword [0x7230d386]
call 0x276b47c9
cmpsd dword [si], dword es:[di]
dec ebp
scasd eax, dword es:[edi]
popfd
xchg ebp, eax
out 0x1c, eax
fild qword [ebp - 0x31f9c116]
movsb byte es:[edi], byte [esi]
jbe 0x54e0c2
mov ah, 0x86
xor eax, 0xec47f3b4

Function at 0x561bf0
Capabilities:
Encode data using xor

Disassembly:
repne lodsd eax, dword [esi]
xchg edi, eax
arpl cx, bp
cmp byte [eax + 4], ah
dec eax
pop es
ror byte [edi + 0x38], 0xb7
sbb ebp, dword [ecx + 0x63014d17]
wait
cwde
mov bh, dh
inc esp
inc ecx
dec edx
invalid

Function at 0x565f2b
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
jmp dword [ecx + 0x6e13469c]
add dword [ecx], ebx
jo 0x565f30
adc byte [eax + 0x36], dl
jge 0x565f56
push eax
jge 0x565f56
xor ah, byte [edx - 3]
retf
jp 0x565f08
push 0x24
mov ch, 0xb4
adc byte [eax + 0x7c], bl
nop
mov edi, 0x3bd49b75
daa
mov edi, ecx
popfd
invalid
Function at 0x5a1a40
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4250e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
mov dword [ebp - 0xa0], ecx
mov eax, dword [ebp - 0xa0]
mov dword [eax], 0x428728
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0xa0]
mov dword [ecx + 0x7c], 1
mov edx, dword [ebp - 0xa0]
mov dword [edx + 0x44], 0
mov eax, dword [ebp - 0xa0]
add eax, 0x64
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [fcn.00426310]
cmp dword [ebp - 0x10], 0
je 0x5a1aca
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [fcn.004262f8]
mov edx, dword [ebp - 0xa0]
add edx, 0x64
push edx
call dword [fcn.00426314]
mov ecx, dword [ebp - 0xa0]
add ecx, 0x48
call fcn.005a0bd0
mov eax, dword [ebp - 0xa0]
add eax, 0x30
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
call fcn.005850c0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0xa0]
add ecx, 0x24
mov dword [ebp - 0x9c], ecx
mov ecx, dword [ebp - 0x9c]
call fcn.00585b70
mov edx, dword [ebp - 0x9c]
mov eax, dword [edx + 4]
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x98]
push eax
call fcn.0059fdb2
add esp, 4
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + 4], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xa0]
mov dword [edx], 0x428730
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5e2aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70fb78
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00402168
mov ecx, esi
mov dword [esp + 0x14], 0
mov dword [esi], 0x75fe84
call fcn.005c07e0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
mov ecx, esi
call fcn.005c1d10
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c
Function at 0x6cd970
Capabilities:
Encode data using xor

Disassembly:
or byte [edi + 0x75], 0x7a
int1
cmp eax, 0x168b9be3
dec edx
push ebp
cmp eax, 0xcb7d0e9e
xor edx, dword [ebp + 0x18]
sahf
dec ecx
and eax, 0x3500f989
add byte [edx + 0x24], ch
sbb ebp, dword ss:[ebp + 0x2f789d1f]
xor eax, 0x36246a00
sbb ebp, dword [ebp + 0x2f789d1f]
jb 0x6cd91c
out 0xbb, eax
push edi
push 0x2a
jne 0x6cd94d
idiv byte [ecx - 0x6a]
or ebp, dword [edx + 0x38eb999]
mov ecx, 0xaafb490b
mov ecx, 0xbb9038e
dec ecx
sti
stosb byte es:[edi], al
xchg dword [0x7b6597e5], esp
js 0x6cd941
xchg edi, eax
jnp 0x6cd9bd
sti
lodsb al, byte [esi]
push ebx
retf
invalid
sub eax, 0x2fe4abfc
mov ch, 0xab
jle 0x6cd902
pop ebx
sti
imul edx, dword [ebx + 0x3d], 0x395bec7b
outsd dx, dword [esi]
je 0x6cd936
cmpsb byte [esi], byte es:[edi]
mov dh, 0xfa
out 0x91, eax
invalid
xchg edx, eax
stosb byte es:[edi], al
invalid

Function at 0x6ce235
Capabilities:
Encode data using xor

Disassembly:
invalid
jno 0x6ce205
dec ecx
add byte [ebx + 0x3b6f3b9b], cl
jae 0x6ce25e
outsb dx, byte [esi]
sahf
xor al, 0x4c
dec esp
add al, 0x66
cmp al, 0x35
sti
jmp 0x6ce276
enter 0x1d2c, 0x12
mov edx, 0x35728ee4
mov ch, 0x4d
pop ecx
add ch, byte [edx + 0x19a20f7f]
pop es
cmp ebp, 0x2908ee15
invalid
sub esi, edi
adc eax, dword [eax]
out 0x16, eax
out dx, eax
mov bl, 0
ja 0x6ce244
test edx, edi
les edx, [eax - 0x78]
ret
Function at 0x40a130
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x495bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.00409950
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a190
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00409b50
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], di
call fcn.00409950
cmp dword [esp + 0x28], 8
jb 0x40a1db
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004629d9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x40a780
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
push eax
call ebp
mov ecx, dword [esi + 4]
push ecx
mov edi, eax
call ebp
mov esi, eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x14]
xor ebx, ebx
sub eax, edx
mov dword [esp + 0x10], eax
jmp 0x40a7b4
mov eax, dword [esp + 0x10]
lea eax, [eax + ebx*4]
mov ecx, dword [esp + eax + 0x14]
push ecx
call ebp
mov dword [esp + ebx*4 + 0x14], eax
add ebx, 1
cmp ebx, 4
jl 0x40a7b0
mov ecx, dword [esp + 0x20]
mov eax, 0xe3779b90
mov dword [esp + 0x10], 0x10
jmp 0x40a7e0
mov ebx, edi
shl ebx, 4
add ebx, dword [esp + 0x1c]
mov edx, edi
shr edx, 5
add edx, ecx
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
sub esi, edx
mov edx, esi
shr edx, 5
add edx, dword [esp + 0x18]
mov ebx, esi
shl ebx, 4
add ebx, dword [esp + 0x14]
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
sub edi, edx
add eax, 0x61c88647
sub dword [esp + 0x10], 1
jne 0x40a7e0
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
call edi
mov ebx, dword [esp + 0x2c]
push esi
mov dword [ebx], eax
call edi
pop edi
pop esi
pop ebp
mov dword [ebx + 4], eax
pop ebx
add esp, 0x14
ret
Function at 0x40ca10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4953e3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], 0x4a0a28
xor ebx, ebx
mov dword [esi + 4], 0x65
mov dword [esi + 8], 0x12dd668
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], 0x34
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov dword [esi + 0x58], eax
call fcn.0040c740
mov ecx, dword [eax]
mov dword [esi + 0x48], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x4c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x50], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x54], edx
call fcn.0043bac0
lea edi, [eax + 4]
push edi
mov dword [esp + 0x18], 0x4a0a24
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x58]
push esi
mov byte [esp + 0x28], 1
call fcn.0043bd20
push edi
mov dword [esi + 0x5c], eax
mov byte [esp + 0x28], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esi + 0x58]
push esi
call fcn.0043dc90
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x40ccf0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x40cd10
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x40cd26
push 0x80004005
call fcn.004089c0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [edi]
push esi
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc

Function at 0x40cd50
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x40cd68
push 0x80004005
call fcn.004089c0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40cd75
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8