joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3980
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ecx, dword [edx + 4]
mov ebp, edx
push esi
cmp ecx, dword [ebx + 4]
mov esi, dword [esp + 0x10]
cmovge ebp, ebx
cmovge ebx, edx
push edi
mov eax, dword [ebx + 4]
cmp eax, dword [esi + 8]
jle 0x4b39b0
push eax
push esi
call fcn.004981d0
add esp, 8
xor edi, edi
cmp dword [ebp + 4], edi
jle 0x4b39cd
mov eax, dword [ebx]
mov ecx, dword [ebp]
mov edx, dword [eax + edi*4]
mov eax, dword [esi]
xor edx, dword [ecx + edi*4]
mov dword [eax + edi*4], edx
inc edi
cmp edi, dword [ebp + 4]
jl 0x4b39b7
cmp edi, dword [ebx + 4]
jge 0x4b39e2
mov eax, dword [ebx]
mov ecx, dword [esi]
mov eax, dword [eax + edi*4]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, dword [ebx + 4]
jl 0x4b39d2
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
test ecx, ecx
jle 0x4b3a05
mov eax, dword [esi]
sub eax, 4
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
lea ecx, [ecx - 4]
test eax, eax
jne 0x4b3a05
dec dword [esi + 4]
cmp dword [esi + 4], eax
jg 0x4b39f4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x4b8922
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x566c70
call fcn.004b8d90
push 1
call fcn.004b7c8d
pop ecx
test al, al
jne 0x4b87d9
push 7
call fcn.004b8a35
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004b7c58
mov byte [ebp - 0x24], al
mov eax, dword [0x59a85c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4b87d2
test eax, eax
jne 0x4b8843
mov dword [0x59a85c], ecx
push 0x504798
push 0x504770
call fcn.004e909e
pop ecx
pop ecx
test eax, eax
je 0x4b8826
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4b891c
push 0x50476c
push 0x504484
call fcn.004e9042
pop ecx
pop ecx
mov dword [0x59a85c], 2
jmp 0x4b8848
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004b7dfa
pop ecx
call fcn.004b8ee9
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4b8878
push esi
call fcn.004b7d70
pop ecx
test al, al
je 0x4b8878
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004b89af
call esi
call fcn.004b8eef
mov esi, eax
cmp dword [esi], edi
je 0x4b8896
push esi
call fcn.004b7d70
pop ecx
test al, al
je 0x4b8896
push dword [esi]
call fcn.004d5c2e
pop ecx
call fcn.004b8b51
movzx eax, ax
push eax
call fcn.004e8fef
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.004d5b3d
test al, al
jne 0x4b88c1
push esi
call fcn.004d5c66
test bl, bl
jne 0x4b88ca
call fcn.004d5c09
push edi
push 1
call fcn.004b7e17
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4b891c
call fcn.004b8dd6
ret
call fcn.004b8e3a
jmp 0x4b87ba
Function at 0x4bc680
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
sub edi, ecx
xor esi, esi
cmp ecx, dword [esp + 0x14]
cmova edi, ebx
test edi, edi
je 0x4bc6c8
nop
movsx eax, byte [ecx]
lea ecx, [ecx + 1]
imul eax, eax, 0xcc9e2d51
inc edx
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
cmp edx, edi
jne 0x4bc6a0
mov eax, 0x4e25
mov ecx, esi
mul esi
pop edi
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1e
imul ecx, ecx, 0x7fffd8ee
sub esi, ecx
lea eax, [esi + 0x2710]
pop esi
pop ebx
ret
Function at 0x4c4f90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5005b8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x591430]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
lea esi, [edi + 0x70]
mov dword [ebp - 0x1c], esi
lea ebx, [edi + 0x6c]
mov dword [ebp - 0x1c], ebx
call fcn.004cd190
mov dword [ebx], eax
add eax, 0xffc
mov dword [esi], eax
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [edi + 0x74], 0x400
mov dword [edi + 0x14], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x34], 0
or dword [edi + 0x30], 0x8000
test dword [edi + 0x30], 0x40000
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
jne 0x4c5020
mov eax, dword [edi + 0x24]
mov edx, dword [eax]
test edx, edx
je 0x4c5020
mov edx, dword [edx + 0x24]
jmp 0x4c5025
mov edx, 1
push dword [edi + 0x10]
mov ecx, dword [edi + 8]
push dword [edi + 0x1c]
call fcn.004cb230
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [edi + 0x24]
mov esi, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x4c505a
lea ecx, [esi + 4]
mov eax, 1
lock xadd dword [ecx], eax
mov ecx, dword [edi + 8]
lea eax, [ebp - 0x24]
push eax
add ecx, 0x1c
call fcn.004be860
mov byte [ebp - 4], 2
test esi, esi
je 0x4c509d
lea ecx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [ecx], eax
cmp eax, 1
jne 0x4c509d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x4c509d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test dword [edi + 0x30], 0x20000
mov byte [ebp - 4], 1
je 0x4c50b4
push dword [edi + 8]
mov ecx, dword [edi]
call fcn.004be770
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x4c50c2
mov ecx, dword [ecx + 0x14]
jmp 0x4c50c4
xor ecx, ecx
mov edx, dword [edi + 0x30]
call fcn.004cd290
mov ecx, edi
call fcn.004c5470
test al, al
jne 0x4c50ff
mov ecx, dword [ebx]
mov dword [ebp - 4], 3
call fcn.004cd1f0
mov dword [ebx], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
push 0
call fcn.0042c5f0
mov eax, dword [eax + 4]
cmp eax, dword [edi + 0x10]
jne 0x4c5124
mov ecx, dword [edi]
push 0
call fcn.0042c5f0
mov byte [ebp - 0x11], 1
mov eax, dword [eax]
cmp eax, dword [edi + 0xc]
je 0x4c5128
mov byte [ebp - 0x11], 0
mov ecx, dword [ebx]
mov dword [ebp - 4], 4
call fcn.004cd1f0
mov al, byte [ebp - 0x11]
mov dword [ebx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cd310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x591430]
xor eax, esp
mov dword [esp + 0xf0], eax
mov dword [esp], 0x504834
mov dword [esp + 4], str._____
mov dword [esp + 8], 0x54e1c0
mov dword [esp + 0xc], 0x54e1c4
mov dword [esp + 0x10], 0x54e1c8
mov dword [esp + 0x14], 0x531348
mov dword [esp + 0x18], 0x504bf0
mov dword [esp + 0x1c], 0x54e1cc
mov dword [esp + 0x20], 0x54e1d0
mov dword [esp + 0x24], 0x509830
mov dword [esp + 0x28], 0x54e1d4
mov dword [esp + 0x2c], 0x54e1d8
mov dword [esp + 0x30], 0x508178
mov dword [esp + 0x34], 0x54e1dc
mov dword [esp + 0x38], 0x549910
mov dword [esp + 0x3c], 0x54e1e0
mov dword [esp + 0x40], 0x54e1e4
mov dword [esp + 0x44], 0x54e1e8
mov dword [esp + 0x48], 0x537a50
mov dword [esp + 0x4c], 0x54dde8
mov dword [esp + 0x50], 0x54e1f4
mov dword [esp + 0x54], 0x54e1f8
mov dword [esp + 0x58], 0x504834
mov dword [esp + 0x5c], 0x504834
mov dword [esp + 0x60], 0x54e1fc
mov dword [esp + 0x64], 0x54e200
mov dword [esp + 0x68], 0x506574
mov dword [esp + 0x6c], 0x54e204
mov dword [esp + 0x70], 0x537a44
mov dword [esp + 0x74], 0x54ddec
mov dword [esp + 0x78], 0x54ddf0
mov dword [esp + 0x7c], 0x537a4c
mov dword [esp + 0x80], 0x537a54
mov dword [esp + 0x84], 0x54ddf4
mov dword [esp + 0x88], 0x54ddf8
mov dword [esp + 0x8c], 0x54ddfc
mov dword [esp + 0x90], 0x5066c0
mov dword [esp + 0x94], 0x54e208
mov dword [esp + 0x98], 0x54de00
mov dword [esp + 0x9c], 0x504834
mov dword [esp + 0xa0], 0x504834
mov dword [esp + 0xa4], 0x504834
mov dword [esp + 0xa8], 0x504834
mov dword [esp + 0xac], 0x504834
mov dword [esp + 0xb0], 0x504834
mov dword [esp + 0xb4], 0x504834
mov dword [esp + 0xb8], 0x504834
mov dword [esp + 0xbc], 0x54de04
mov dword [esp + 0xc0], 0x54de08
mov dword [esp + 0xc4], 0x54de0c
mov dword [esp + 0xc8], 0x549e54
mov dword [esp + 0xcc], 0x54de10
mov dword [esp + 0xd0], 0x54de14
mov dword [esp + 0xd4], 0x54e20c
mov dword [esp + 0xd8], 0x54de18
mov dword [esp + 0xdc], 0x54de1c
mov dword [esp + 0xe0], 0x54de20
mov dword [esp + 0xe4], 0x54e210
mov dword [esp + 0xe8], 0x54de24
mov dword [esp + 0xec], 0x54de28
cmp cl, 0x3c
jb 0x4cd576
mov eax, 0x504834
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.004b7be0
add esp, 0xf4
ret
movzx eax, cl
mov ecx, dword [esp + 0xf0]
xor ecx, esp
mov eax, dword [esp + eax*4]
call fcn.004b7be0
add esp, 0xf4
ret
Function at 0x4d0710
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500f98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x591430]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x591718]
cmp eax, 0xffffffff
jne 0x4d0746
xor ebx, ebx
jmp 0x4d074f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x4d0791
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x4d07d0
test esi, esi
jne 0x4d07d4
push 0x4cf640
push 0x59ac50
call fcn.004cf260
mov eax, dword [0x591718]
add esp, 8
cmp eax, 0xffffffff
je 0x4d0791
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x4d07be
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x4d07be
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4d0816
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x4d07ff
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x4d07d4
cmp dword [ebx + 0x18], 0
je 0x4d0760
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4d0839
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x4d0839
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.00417e00
cmp dword [ebx + 0x18], 0
jne 0x4d0820
jmp 0x4d0760

Function at 0x4d0860
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x4d08c0
push 0
push 0
call fcn.004d9d04
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4d0889
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x4d08a7
cmp eax, 0xffffffff
je 0x4d08a7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x4d435c
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x54ea8c
push 0x54ea84
push 0x54aa14
push 0
call fcn.004d42dc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4d438e
push dword [ebp + 8]
mov ecx, esi
call fcn.004b89af
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x4d43d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x54ea9c
push 0x54ea94
push 0x54aa28
push 2
call fcn.004d42dc
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x4d4401
mov ecx, esi
call fcn.004b89af
call esi
jmp 0x4d4407
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x4d440a
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x54eaa4
push 0x54ea9c
push 0x54aa34
push 3
call fcn.004d42dc
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x4d443e
mov ecx, esi
call fcn.004b89af
call esi
jmp 0x4d4444
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x4edbc2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eda3f

Function at 0x4f2a32
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f26d4
Function at 0x40aad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40ab1a
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40aae9
jmp 0x40ab1a
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40ab0a
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40ba3d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40ba72
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40ba9c
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40ba9c
test edi, edi
je 0x40ba69
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40ba69
test edi, edi
je 0x40baa4
mov eax, edi
jmp 0x40ba6b
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40ba6b
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040f5e2
add esp, 0xc
int3
Function at 0x40f616
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestSplayTree.exe_gMozillaPoisonSize], eax
call fcn.0040ba3d
pop ecx
mov ecx, dword [sym.TestSplayTree.exe_gMozillaPoisonSize]
mov dword [sym.TestSplayTree.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40f64e
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestSplayTree.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x401d70
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ebx
push esi
bswap eax
bswap ecx
xor edx, edx
mov dword [ebp - 4], 0x20
push edi
lea esp, [esp]
mov edi, dword [ebp + 0xc]
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0xc]
add eax, esi
sub edx, 0x61c88647
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
add ecx, esi
dec dword [ebp - 4]
jne 0x401d90
mov edx, dword [ebp + 8]
pop edi
bswap eax
bswap ecx
pop esi
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401e00
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add edx, 7
shr edx, 3
dec edx
mov dword [ebp - 0xc], edx
js 0x401ec5
push ebx
push esi
push edi
jmp 0x401e23
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*8 - 8]
test edx, edx
jne 0x401e2e
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
mov ecx, dword [eax + edx*8]
mov eax, dword [eax + edx*8 + 4]
bswap ecx
bswap eax
mov edx, 0xc6ef3720
mov dword [ebp - 4], 0x20
mov edi, dword [ebp + 0x10]
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0x10]
sub eax, esi
add edx, 0x61c88647
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
sub ecx, esi
dec dword [ebp - 4]
jne 0x401e48
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
bswap ecx
mov dword [esi + edx*8], ecx
lea ecx, [esi + edx*8 + 4]
bswap eax
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov edi, dword [eax]
xor dword [esi + edx*8], edi
mov eax, dword [eax + 4]
xor dword [ecx], eax
dec edx
mov dword [ebp - 0xc], edx
jns 0x401e20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401537
Capabilities:
Encode data using xor

Disassembly:
call 0x4013f0
xor ecx, ecx
sub cx, 0xff7b
call 0x401537
rcr byte [esi - 0x7f], 0x76
push cs
fidiv dword [ecx]
mov eax, 0xfcee83bf
xor dword [esi + 0xe], 0xbfb831da
sub esi, 0xfffffffc
loop 0x40153a
pop es
test dword [eax], 0x3685f1e8
scasb al, byte es:[edi]
adc eax, 0xf8f3e54c
or eax, eax
jmp 0x4015cb
invalid

Function at 0x40b590
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push esi
push ebx
cwde
push dword [ebp + 0x44]
inc esp
and al, 0x14
or eax, eax
jge 0x40b5b1
inc edi
mov edx, dword [esp + 0x10]
neg dword [edi + esi*8 + 0xd8837a]
mov dword [ebx], ecx
and al, 0x14
mov dword [esp + 0x3c], edx
mov eax, dword [esp + 0x1c]
push esp
sar byte [ebp + 0x14], 0x47
mov edx, dword [esp + 0x18]
neg eax
mov ch, 0xda
pop ebx
fadd dword [eax]
mov dword [eax - 0x5e31aadc], ecx
and al, 0x18
or eax, eax
jne 0x40b5e9
mov ecx, dword [ebp + eax*2 + 0x18]
mov eax, eax
push edx
adc al, 0x3d
sal bh, cl
int1
mov ebx, eax
mov eax, dword [esp + 0x50]
imul edi
mov edx, ebx
jmp 0x40b62a
mov eax, dword [esi]
mov ecx, dword [ecx + ebx*8 + 0x18]
mov edx, dword [eax + edi*2 + 0x14]
mov eax, dword [esp + 0x10]
shr ebx, 1
rcr dword [ebx], 1
shr edx, 1
shl dword [ebp - 0xb8a24f5], 1
div ecx
pop esp
invalid
dec edi
jne 0x40b634
neg edx
invalid

Function at 0x40b596
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push esi
push ebx
cwde
push dword [ebp + 0x44]
inc esp
and al, 0x14
or eax, eax
jge 0x40b5b1
inc edi
mov edx, dword [esp + 0x10]
neg dword [edi + esi*8 + 0xd8837a]
mov dword [ebx], ecx
and al, 0x14
mov dword [esp + 0x3c], edx
mov eax, dword [esp + 0x1c]
push esp
sar byte [ebp + 0x14], 0x47
mov edx, dword [esp + 0x18]
neg eax
mov ch, 0xda
pop ebx
fadd dword [eax]
mov dword [eax - 0x5e31aadc], ecx
and al, 0x18
or eax, eax
jne 0x40b5e9
mov ecx, dword [ebp + eax*2 + 0x18]
mov eax, eax
push edx
adc al, 0x3d
sal bh, cl
int1
mov ebx, eax
mov eax, dword [esp + 0x50]
imul edi
mov edx, ebx
jmp 0x40b62a
mov eax, dword [esi]
mov ecx, dword [ecx + ebx*8 + 0x18]
mov edx, dword [eax + edi*2 + 0x14]
mov eax, dword [esp + 0x10]
shr ebx, 1
rcr dword [ebx], 1
shr edx, 1
shl dword [ebp - 0xb8a24f5], 1
div ecx
pop esp
invalid
dec edi
jne 0x40b634
neg edx
invalid
Function at 0x402476
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7c0
mov ebx, eax
mov al, byte [0x412518]
test al, al
mov byte [esp], dl
lea esi, [esp + 4]
je 0x4024b2
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x4024a6
mov edx, 0x411116
mov eax, ebx
call fcn.0040bf20
mov edx, 0x412518
mov eax, ebx
call fcn.0040bf20
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.0040bd4c
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x4024db
lea edx, [ebx + 1]
jmp 0x4024dd
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x40252e
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x402506
jmp 0x4024ff
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x4024ff
mov byte [ebx + eax], 0x20
jmp 0x402506
inc eax
cmp byte [ebx + eax], 0
jne 0x4024ef
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x40251b
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x40252d
cmp edx, 0x20
jne 0x402524
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x402535
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x4024e4
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.00405d78
mov edi, eax
test edi, edi
je 0x402561
mov edx, str..inf
mov eax, edi
call fcn.0040bed4
test eax, eax
jne 0x402561
mov dword [esi + 0xc], 0x4111eb
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.00406624
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x402589
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.004066f0
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x4025cc
cmp byte [esp + 1], 0
jne 0x4025cc
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.0040be4c
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.0040bf20
lea eax, [esp + 0x440]
xor edx, edx
call fcn.00406624
test al, al
je 0x4026a2
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x4025f6
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x4026a2
cmp byte [0x41103d], 0
jne 0x40260d
cmp byte [esp], 0
je 0x402653
push dword [0x411864]
call sub.USER32.DLL_IsWindowVisible
mov ebx, eax
test ebx, ebx
je 0x40262b
push 0
push dword [0x411864]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
push 0xffffffffffffffff
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
test ebx, ebx
je 0x402653
push 1
push dword [0x411864]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x40266f
mov edx, str..exe
mov eax, edi
call fcn.0040bed4
test eax, eax
je 0x4026a2
cmp byte [0x41103d], 0
je 0x40268a
cmp byte [esp], 0
jne 0x40268a
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x4026a2
cmp byte [esp], 0
je 0x402697
mov ecx, 0xc8
jmp 0x40269c
mov ecx, 0x3e8
push ecx
call sub.KERNEL32.DLL_Sleep
add esp, 0x840
pop edi
pop esi
pop ebx
ret
Function at 0x8ddef8
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8ddefe
pop ebp
sub ebp, 6
sub ebp, 0x4ddef8
jmp 0x8ddf5c
jmp 0x8ddf65
mov eax, 0x4ddef8
add eax, ebp
add eax, 0x93
mov ecx, 0x62a
mov edx, 0x939aae1c
xor byte [eax], dl
inc eax
dec ecx
jne 0x8ddf7c
jmp 0x8ddf8f
jbe 0x8ddfed
je 0x8ddfaf
or al, 0x1c
sbb al, 0x74
sbb al, 0xd0
xor byte [edi + ebp], bl
fmul qword [ebx - 0x77]
and byte [0x974c1c58], bh
rcl dword [edi + 0x1c1c2095]
sbb al, 0x9d
fucom st(4)
sbb al, 0x1c
sbb al, 0x1f
in al, 0x1c
sbb al, 0x1c
pop ds
shl dword [edx + ebx - 0x59e3e3e4], 1
xor al, 0x1c
sbb al, 0x1c
jmp 0x8ddfbf
xchg edi, eax
cdq
adc al, 0x1c
sbb al, 0x1c
xchg edi, eax
mov dword [eax], edx
sbb al, 0x1c
sbb al, 0x97
xchg ecx, eax
or al, 0x1c
sbb al, 0x1c
invalid