joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442bd0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x480543
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00473ec7
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00479560
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0047aa7c
test eax, eax
je 0x442cec
mov ecx, dword [esp + 0x3c]
call fcn.0047958d
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x442cb0
push edi
mov ecx, esi
call fcn.00476bf3
mov ecx, esi
call fcn.00442e90
cmp dword [esp + 0x38], 1
jne 0x442ce5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00476d2e
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x444ee0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x444f13
push esi
call fcn.00453170
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x444f0c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x444f99
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x444f82
mov eax, dword [esi + 8]
test eax, eax
je 0x444f37
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x444f7e
cmp eax, 2
je 0x444f82
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x444f2a
cmp eax, 3
je 0x444f5d
cmp eax, 1
jne 0x444f2a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x444f2a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x444f2a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00444fc0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x444fa8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00444fc0
add esp, 4
pop esi
ret

Function at 0x445830
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x445851
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x445851
mov eax, dword [eax + 0x44]
test eax, eax
je 0x445851
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x474cbd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x474cf5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00472d74
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00472d4c
jmp 0x474d01
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4763ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4763ed
call fcn.0047be67
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4763ed
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4763e4
xor eax, eax
jmp 0x4763f5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004763fb
pop edi
pop esi
pop ebx
ret 4
Function at 0x47c397
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47c3c5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47c3e3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047c2fd
jmp 0x47c3e3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47c3e3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047c2fd
test edi, edi
mov eax, edi
jne 0x47c3cd
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x13037fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
mov byte [esp + 4], ah
lea esp, [esp + 2]
jmp 0x1303831
mov dword [esp], eax
pushal
call fcn.0130381b
mov dword [esp + 0x1b], ebx
lea esp, [esp + 2]
mov dword [esp + 0x20], ecx
pushfd

Function at 0x130381b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x1f], bh
push word [esp + 0x10]
jp 0x130383a
jnp 0x1303894
ret

Function at 0x1303863
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 7]
jne 0x130387c
pop word [esp + 5]
jmp 0x13038b8
pop word [esp + 5]
mov dword [esp + 0x28], edx
jmp 0x13038c3
lea esp, [esp + 1]
push esp
lea esp, [esp + 1]
jmp 0x13038a2

Function at 0x1305d90
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.01305db7
jecxz 0x1305dcd
cmc
pushfd
outsd dx, dword [esi]
ficom word [ebx]
xchg esi, eax
add al, 0x63
sahf
das
xchg dword [esi], ebp
cmp dword [eax], ebx
jnp 0x1305dde
push word [esp]
push dword [esp]
jns 0x1305d61
js 0x1305d61
pop edx
rol byte [esi + 0x21], 1
rcl byte [ecx]
les ecx, [ebp - 0x23]
movsb byte es:[edi], byte [esi]
push edi
xchg ebx, eax
pop esp
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x1305df7
invalid
pop word [esp + 3]
pop dword [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 8], ebp
push di
jmp 0x1305d77
fild qword [edx]
lcall 0x9449, 0xbadf4fc6
bound ecx, qword [ecx + 0x53082464]
invalid

Function at 0x1305da1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf12f0cd8
jmp 0x1305df7
jmp 0x1305e54
lea edx, reloc.kernel32.dll_GetProcAddress
xchg dh, al
jmp 0x1305de1
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
pushfd
jmp 0x1305806

Function at 0x1305db7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 8], esi
push ebx
call fcn.01305da1
movsb byte es:[edi], byte [esi]
sub bh, byte [eax - 0x3965d521]
dec edi
fistp qword [edx - 0x769d6bb7]
and al, 8
Function at 0x13075c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ecx, 0x797434fa
call fcn.01307692
imul dword [edx - 8]
lahf
push 0xffffffffffffffdb
or esp, dword [edx - reloc.kernel32.dll_GetProcAddress]
or al, 0x95
add byte [eax], al
add byte [eax], al
lea ecx, reloc.kernel32.dll_GetProcAddress
jmp 0x13057b4
rol dl, 0
xchg cl, ah
jmp 0x1307668
ror eax, 0x1c
add ah, 0x94
jmp 0x1307617
mov cx, 0xfe8e
jmp 0x13075e5
shl ecx, 2
mov eax, 0x41c3ffab
mov eax, 0xdf23e379
clc
jmp 0x130768a
mov ecx, edx
mov eax, ecx
sete al
mov ax, word [esp]
mov al, cl
jmp 0x1307601
lea esp, [esp + 0x24]
neg dl
or cx, 0x56a
js 0x13075fb
mov cx, 0xfe8e
ror eax, 0x1c
add ah, 0x94
jmp 0x1307617
jmp 0x13058df
not cl
bswap ecx
mov ecx, dword [esp]
mov ah, 0xb7
pushal
jmp 0x1307638
jne 0x1307651
je 0x13058df
Function at 0x130a94d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x130a727
mov dword [esp + 0x24], eax
jmp 0x130a943
mov dword [esp + 0x24], eax
jmp 0x130a905
call 0x1309dba
jmp 0x130a864
call 0x1309dda
jmp 0x130a8a2
pop eax
sub eax, 0xaa3a791
jmp 0x130a7b1
call 0x130a7c1
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
rcl dword [esi - reloc.kernel32.dll_GetProcAddress], cl
sub ecx, 0x10019084
jmp 0x130adcb
cmp ebx, 0x2c5dd855
jmp 0x130a81a
je 0x130a850
jne 0x1309d89
pushfd
jmp 0x130a895
jmp 0x130a8e2
fnstenv [eax]
std
pop ecx
jmp 0x130a8c2
pop eax
sub eax, 0x59ff421b
jmp 0x130a871
call 0x130a883
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
leave
push ss
wait
or ebp, dword [esi - 0x63]
sub byte [esp + edi*8 - 0x6e], bh
cmc
add al, 0xba
dec ecx
call 0x7db44aa2
and al, 4
add byte [ebp - 0x64], dh
cmp dword [esp + 4], 0
jne 0x130a838
pushal
jmp 0x1309db5
pop ecx
sub ecx, 0x10019102
mov dword [ecx + reloc.kernel32.dll_GetProcAddress], eax
jmp 0x130aa0e
call 0x130a8d7
dec ebp
popal
jo 0x130a921
imul esp, dword [ebp + 0x77], reloc.kernel32.dll_GetProcAddress
insb byte es:[edi], dx
inc ebp
js 0x130a8d7
push eax
call fcn.012f4dbc
jmp 0x1309dd5
inc dword [esp + 8]
jmp 0x130a91b
popal
jmp 0x130a91d
popfd
ret
inc dword [esp + 8]
call 0x130a927
mov dl, 0x66
pop dword [esp]
lea esp, [esp + 1]
push di
mov word [esp], ax
jmp 0x130a963
popal
inc dword [esp + 8]
call fcn.0130a8f9
mov dx, 0xf837
call fcn.0130aa2b
mov cl, 0x38
scasb al, byte es:[edi]
leave
cmp ah, bh
cdq
adc eax, 0xad1fec85
add al, 0x8d
and al, 3
lea esp, [esp + 3]
push edx
mov edx, 0xbcc48ade
call 0x130a94d
lea edx, reloc.kernel32.dll_GetProcAddress
setbe ch
setge dh
rdtsc
jmp 0x130a9b2
rdtsc
lea edx, reloc.kernel32.dll_GetProcAddress
mov ah, 8
mov eax, dword [esp + 2]
jmp 0x130a9d9
mov edx, 0x53b4fe6d
pop ecx
lea eax, [esi + edi]
bswap eax
xchg al, dh
not al
jmp 0x130a99c
lea edx, [ecx + ebp]
mov edx, dword [esp + 8]
lea esp, [esp + 0xc]
jmp 0x130aa0c
mov dx, 0xfea8
not edx
mov dh, byte [esp]
mov dl, byte [esp]
mov dx, 0x5aac
mov dh, 0x6c
jmp 0x130a9c3
popfd
ret
movzx ebx, byte [eax]
add ebx, 0xd3a53b9e
jmp 0x130ab0e
cmp ebx, 0xd3a53c6a
je 0x130ab72
jne 0x1309d92
xchg ecx, eax
popfd
ret
mov dword [ecx + reloc.kernel32.dll_GetProcAddress], eax
movzx ebx, byte [eax]
add ebx, 0x2c5dd789
jmp 0x130a7ec

Function at 0x130aa2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp]
lea eax, [ebx + edi]
mov al, byte [esp]
push ecx
mov eax, 0x34f7b2fb
bswap edx
jmp 0x130a972
mov edx, ebx
lea esp, [esp + 2]
mov dword [esp + 2], eax
lea eax, reloc.kernel32.dll_GetProcAddress
mov dh, 0x79
mov ah, ch
jmp 0x130a988
push ebx
pop word [esp + 1]
jmp 0x130a9f3
Function at 0x130e157
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
mov word [esp], sp
mov eax, dword [esp]
lea esp, [esp + 2]
jmp 0x130e172
mov dword [esp], ebx
jmp 0x130e141
not eax
mov dword [esp], ebp
xchg bp, dx
lea edx, [edi*4]
jmp 0x130e3b5
mov dword [esp + 4], edx
mov dx, sp
not dx
lea edx, [esp + ebp]
mov edx, dword [esp]
rdtsc
jmp 0x130e15c
mov ax, 0x2577
rdtsc
lea eax, [ecx*4]
pop ebp
not ax

Function at 0x1325ed1
Capabilities:
Encrypt data using speck

Disassembly:
call 0x13257f7
movsb byte es:[edi], byte [esi]
and eax, 0x9e2fdcb5
salc
push esi
les esp, [ebx - 0x11b81fa2]
stc
fdivr dword [ebx]
jmp 0x1325e52
push si
lea esp, [esp + 2]
jmp 0x1325e9d
cmp bl, 0x2f
call 0x1325eff
and edi, dword [esp + esi - reloc.kernel32.dll_GetProcAddress]
stosb byte es:[edi], al
and dword [ecx - reloc.kernel32.dll_GetProcAddress], esi
sub eax, 0x47
jmp 0x1325627
pushfd
lea esp, [esp]
jmp 0x1325f3c
push edx
push word [esp + 3]
push dword [esp + 5]
lea esp, [esp + 2]
jmp 0x1326077
call fcn.0132617e
push ebp
rol dword [ecx + 0x20], 1
shl dword [esi - 0x2b], cl
push edx
shl byte [edi - 0x35ac13ae], 0x65
xchg esp, eax
pop es
cmp dl, 0x5a
pushal
jmp 0x13260d3
cmp edi, 3
jmp 0x132612b
call fcn.013260c6
cmp eax, 0xc64b2cbe
jne 0x13257a1
xchg ebx, eax
add esp, dword [esi - 0x6b]
sub eax, 0x83c00196
cmp ch, cl
jmp 0x1326103
pushal
or dword [eax], eax
add byte [ecx], bl
lea ebx, reloc.kernel32.dll_GetProcAddress
push ds
add byte [eax], al
sbb dword [ebp + 0x2197641d], ecx
mov dword [esi], ebx
mov ebx, gs
loopne 0x132579f
mul cl
and byte [ebx + 0x56], ah
pop eax
jmp 0x1325627
push esi
call 0x1325ed1
mov cs, word [edi]
lahf
cli
or dword [ecx + reloc.kernel32.dll_GetProcAddress], ebp
mov al, byte [0xbfac5d13]
xchg byte [ebx + 0x6ce941e8], al
idiv edi
dec dword [edi]
test dword [edi + esi*8 - 1], edi
push dword [edx + edx*2 + 0x36]
mov cl, 0x21
jne 0x132563d
je 0x1325f15
mov cl, 0x21
inc eax
mov bl, 0
cmp byte [edx + 0x73b24720], dh
xor ebp, dword [edx]
lea esp, [esp + 4]
cmp bl, 0x2b
jmp 0x1325ebb
push 0x3e
jmp 0x132569f
lea esp, [esp + 4]
pop esi
jmp 0x132573e
jne 0x1325788
je 0x1326070
insb byte es:[edi], dx
pushal
pop es
xor dword [esi - 9], ebp
add dh, cl
cmp ebp, dword [edx - 0x7b]
lea esp, [esp + 4]
cmp dl, 0x2f
pushfd
lea esp, [esp + 4]
jmp 0x132604c
push 0x3f
jmp 0x132571c
lea esp, [esp + 8]
pop edx
jmp 0x132576a
lea esp, [esp + 0x20]
movzx edx, dl
call 0x13260e0
ja 0x132606a
or al, 0x24
push dword [esp + 3]
jmp 0x1326119
sub edx, 0x47
jmp 0x132576a
lea esp, [esp + 8]
ja 0x132579e
sub edx, 0x41
jmp 0x132576a
jne 0x1326ea8
call fcn.01326163
loope 0x132619c
cli
popfd
insb byte es:[edi], dx
fst qword [ecx]
nop
adc ecx, dword [edx + reloc.kernel32.dll_GetProcAddress]
add al, 0x83
ret 0xe904
pop ss
jle 0x13261ff
invalid
call fcn.013261ed

Function at 0x132601e
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
push 0x3e
jmp 0x132571c

Function at 0x13260c6
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
and al, 4
ja 0x1325754
call fcn.013260f7
jb 0x1326099
add ax, si
insd dword es:[edi], dx
cmp dl, 0x39
push esi
jmp 0x1326098
mov word [esp + 1], cx
lea esp, [esp + 4]
jmp 0x13260ae
Function at 0x13260e0
Capabilities:
Encrypt data using speck

Disassembly:
call 0x13257f7
movsb byte es:[edi], byte [esi]
and eax, 0x9e2fdcb5
salc
push esi
les esp, [ebx - 0x11b81fa2]
stc
fdivr dword [ebx]
jmp 0x1325e52
push si
lea esp, [esp + 2]
jmp 0x1325e9d
cmp bl, 0x2f
call 0x1325eff
and edi, dword [esp + esi - reloc.kernel32.dll_GetProcAddress]
stosb byte es:[edi], al
and dword [ecx - reloc.kernel32.dll_GetProcAddress], esi
sub eax, 0x47
jmp 0x1325627
pushfd
lea esp, [esp]
jmp 0x1325f3c
push edx
push word [esp + 3]
push dword [esp + 5]
lea esp, [esp + 2]
jmp 0x1326077
call fcn.0132617e
push ebp
rol dword [ecx + 0x20], 1
shl dword [esi - 0x2b], cl
push edx
shl byte [edi - 0x35ac13ae], 0x65
xchg esp, eax
pop es
cmp dl, 0x5a
pushal
jmp 0x13260d3
cmp edi, 3
jmp 0x132612b
call fcn.013260c6
cmp eax, 0xc64b2cbe
jne 0x13257a1
xchg ebx, eax
add esp, dword [esi - 0x6b]
sub eax, 0x83c00196
cmp ch, cl
jmp 0x1326103
pushal
or dword [eax], eax
add byte [ecx], bl
lea ebx, reloc.kernel32.dll_GetProcAddress
push ds
add byte [eax], al
sbb dword [ebp + 0x2197641d], ecx
mov dword [esi], ebx
mov ebx, gs
loopne 0x132579f
mul cl
and byte [ebx + 0x56], ah
pop eax
jmp 0x1325627
push esi
call 0x1325ed1
mov cs, word [edi]
lahf
cli
or dword [ecx + reloc.kernel32.dll_GetProcAddress], ebp
mov al, byte [0xbfac5d13]
xchg byte [ebx + 0x6ce941e8], al
idiv edi
dec dword [edi]
test dword [edi + esi*8 - 1], edi
push dword [edx + edx*2 + 0x36]
mov cl, 0x21
jne 0x132563d
je 0x1325f15
mov cl, 0x21
inc eax
mov bl, 0
cmp byte [edx + 0x73b24720], dh
xor ebp, dword [edx]
lea esp, [esp + 4]
cmp bl, 0x2b
jmp 0x1325ebb
push 0x3e
jmp 0x132569f
lea esp, [esp + 4]
pop esi
jmp 0x132573e
jne 0x1325788
je 0x1326070
insb byte es:[edi], dx
pushal
pop es
xor dword [esi - 9], ebp
add dh, cl
cmp ebp, dword [edx - 0x7b]
lea esp, [esp + 4]
cmp dl, 0x2f
pushfd
lea esp, [esp + 4]
jmp 0x132604c
push 0x3f
jmp 0x132571c
lea esp, [esp + 8]
pop edx
jmp 0x132576a
lea esp, [esp + 0x20]
movzx edx, dl
call 0x13260e0
ja 0x132606a
or al, 0x24
push dword [esp + 3]
jmp 0x1326119
sub edx, 0x47
jmp 0x132576a
lea esp, [esp + 8]
ja 0x132579e
sub edx, 0x41
jmp 0x132576a
jne 0x1326ea8
call fcn.01326163
loope 0x132619c
cli
popfd
insb byte es:[edi], dx
fst qword [ecx]
nop
adc ecx, dword [edx + reloc.kernel32.dll_GetProcAddress]
add al, 0x83
ret 0xe904
pop ss
jle 0x13261ff
invalid
call fcn.013261ed

Function at 0x13260f7
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
movzx edx, dl
call 0x13260d1

Function at 0x13a3dd2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0xc]
xchg dword [esp + 0xd], edx
jmp 0x13a3d22
Function at 0x13a4360
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
mov bl, byte [esp + 3]
sub esp, 0
cmp eax, 0xcd9a7ea7
rdtsc
std
jmp 0x13a43e8
mov byte [esp + 5], bh
mov word [esp + 1], ax
xchg al, bl
mov al, 0x28
bts ebx, edx
jmp 0x13a434a
rdtsc
setbe al
neg ax
xchg word [esp + 1], dx
Function at 0x13a4b1f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x13a4bfa
xchg byte [esp + 2], dh
mov eax, 0x884d9b7
std
rdtsc
mov byte [esp], dl
mov word [esp + 4], cx
jmp 0x13a4ba7
xchg bl, al
pop dword [esp + 0xa]
xchg dword [esp + 0xe], ebx
xchg bx, ax
mov bx, 0x9908
push word [esp + 0xe]
jmp 0x13a4b66
pop dword [esp]
dec bx
sub esp, 0x11
xchg dword [esp + 5], ebx
xchg dword [esp + 4], eax
lea eax, [eax + ecx]
jmp 0x13a4b7c
xchg bx, dx
bswap edx
bswap edx
pop word [esp]
mov word [esp], di
push dword [esp + 3]
jmp 0x13a4b24

Function at 0x13a6840
Capabilities:
Access peb ldr_data

Disassembly:
pop word [esp]
jmp 0x13a687e
mov word [esp], dx
pushal
lea esp, [esp + 2]
mov dword [esp + 0x1c], esi
push ebx
mov byte [esp + 1], cl
jmp 0x13a6868
Function at 0x40b6bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40b701
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40b6d0
jmp 0x40b701
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40b6f1
pop esi
pop ebp
ret

Function at 0x40c459
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c48e
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c4b8
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c4b8
test edi, edi
je 0x40c485
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c485
test edi, edi
je 0x40c4c0
mov eax, edi
jmp 0x40c487
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c487
mov esi, 0xc7
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040f1c2
add esp, 0xc
int3
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402357
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43f383
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x466034]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov eax, dword [0x466034]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.0040eb48
pop ecx
and dword [esp + 0x30], 0
cmp dword [esp + 0x1c], 0x10
lea eax, [esp + 8]
cmovae eax, dword [esp + 8]
push eax
mov ecx, esi
call fcn.0040269a
lea ecx, [esp + 8]
call fcn.00402286
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0043b9da
mov esp, ebp
pop ebp
ret

Function at 0x406557
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44046f
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x466034]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x466034]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edi, dword [ebp + 8]
and dword [esp + 0xc], 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call dword [eax + 0xb0]
and dword [esp + 0x38], 0
push eax
push edi
mov ecx, esi
call fcn.00427bb5
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.0040253d
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0043b9da
mov esp, ebp
pop ebp
ret 4

Function at 0x406666
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042a8de
Function at 0x407d85
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x466034]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
mov esi, ecx
cmp byte [esi + 0x2d0], 0
je 0x407df2
push 0x110
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x407de2
mov ecx, esi
call fcn.00407a8b
jmp 0x407df4
cmp dword [esp + 0xc], 6
jb 0x407df2
mov ecx, esi
call fcn.004072ce
jmp 0x407df4
xor eax, eax
mov ecx, dword [esp + 0x124]
pop esi
xor ecx, esp
call fcn.0043b9da
mov esp, ebp
pop ebp
ret