joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d01a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x625168]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d0311
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4d0237
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x4d01d6
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4d0243
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4d0201
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4d0243
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4d0243
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call sym.net.favoriteAddrFamily
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call sym.net.socket
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call sym.runtime.morestack_noctxt
jmp sym.net.internetSocket
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x800058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8001a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x80007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x80006a
add dl, dl
jne 0x800089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8000dc
xor eax, eax
add dl, dl
jne 0x800096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x80017d
add dl, dl
jne 0x8000a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8000b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8000bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8000c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8000d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x800075
mov eax, 1
add dl, dl
jne 0x8000ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8000f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8000e1
sub eax, ebx
mov ebx, 1
jne 0x800128
mov ecx, 1
add dl, dl
jne 0x80010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x800119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x800105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x800075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x80013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x80014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x800136
cmp eax, 0x7d00
jae 0x80016d
cmp eax, 0x500
jb 0x800168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x800075
cmp eax, 0x7f
ja 0x800170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x800075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x80019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x800075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404e88
Capabilities:
Access peb ldr_data

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x10010990
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
movzx ebx, byte [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
dec ebx
push edi
mov edi, dword [ebp + 0xc]
or ebx, 0xdfdfdfdf
shr edi, 2
lea edx, [eax + edi*4]
mov dword [ebp + 0x10], edx
test edi, edi
je 0x10010a24
mov ecx, edx
lea eax, [edi*4]
and ecx, 3
sub edx, eax
mov dword [ebp + 0x14], ecx
add edx, 2
jmp 0x100109d0
test ecx, ecx
jne 0x100109d9
mov eax, dword [edx - 2]
jmp 0x100109fa
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx - 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx - 2]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 0x14]
and eax, ebx
add edx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
sub edi, 1
jne 0x100109d0
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, edi
and eax, 3
sub eax, 1
je 0x10010a4d
sub eax, 1
je 0x10010a44
sub eax, 1
jne 0x10010a65
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor eax, ecx
and eax, ebx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
xor esi, edi
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret
Function at 0x419610
Capabilities:
Accept command line arguments
Read .ini file

Disassembly:
sub esp, 0x414
lea eax, [esp + 0x20c]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [esp + 0x21c]
push ecx
mov edi, eax
call ebx
push str.system.ini
lea edx, [esp + 0x18]
mov esi, eax
push 0x104
push edx
push esi
push str.shell
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea edx, [esp + 0x14]
mov edi, eax
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [esp + 0x14]
push eax
call ebx
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test edi, edi
mov ebp, eax
je 0x4196b5
mov ecx, dword [0x4d28dc]
push 0x4d25e0
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push ebp
push esi
push ebx
call dword [sym.imp.SHELL32.dll_StrCmpNIW]
test eax, eax
je 0x4196df
push str.install.exe
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4196df
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x414
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x414
ret

Function at 0x4c7666
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4cf488
cmp edx, dword [eax]
je 0x4c7688
add eax, 8
inc ecx
cmp eax, 0x4cf518
jl 0x4c7679
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4cf488]
jne 0x4c77b6
mov eax, dword [0x4d3b6c]
cmp eax, 1
je 0x4c7790
test eax, eax
jne 0x4c76b9
cmp dword [0x4cf3cc], 1
je 0x4c7790
cmp edx, 0xfc
je 0x4c77b6
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c76f0
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c7d80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7fb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c7733
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7fb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cbb28
push edi
call fcn.004c9780
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c7d80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c7d90
lea eax, [ebp - 0xa0]
push 0x4cbb08
push eax
call fcn.004c7d90
push dword [esi + 0x4cf48c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c7d90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c96f4
add esp, 0x2c
pop edi
jmp 0x4c77b6
lea eax, [ebp + 8]
lea esi, [esi + 0x4cf48c]
push 0
push eax
push dword [esi]
call fcn.004c7fb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401029
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.0041dc58
xor ebp, ebp
pop ecx
test eax, eax
je 0x401076
push str.Windows_original_main_args:_n
call fcn.00401104
pop ecx
mov esi, ebp
call fcn.0040e687
cmp dword [eax], ebp
jle 0x401076
call fcn.0040e68d
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401104
add esp, 0xc
inc esi
call fcn.0040e687
cmp esi, dword [eax]
jl 0x401054
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040120f
call fcn.00401277
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401127
pop ecx
pop ecx
mov esi, eax
call fcn.0040127d
mov edx, ebp
test ebx, ebx
jle 0x4010b0
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x4010a5
mov edi, dword [0x431004]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010bf
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010cb
mov edx, dword [esi]
mov ecx, dword [0x431990]
test ecx, ecx
push ebp
push ebp
push 1
setne al
movzx eax, al
push eax
push edi
push edx
push 0x42526c
push 0x425270
push dword [0x431994]
push 1
push ecx
push 1
push esi
push ebx
call fcn.00401d57
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4042f7
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.0041dc58
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x40446a
jg 0x404326
test esi, esi
jb 0x40446a
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.00417558
add esp, 0xc
test eax, eax
js 0x40446a
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404388
push edi
call fcn.00404879
pop ecx
test eax, eax
je 0x40437f
push ebx
push esi
push edi
push ebp
call fcn.0041dc58
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40446f
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.0041dc58
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x40446a
jg 0x4043b1
cmp ebp, ebx
jb 0x40446a
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043c6
jl 0x4043c0
cmp ebp, ecx
jae 0x4043c6
mov esi, ebp
mov ecx, eax
jmp 0x4043ca
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.0041dc58
add esp, 0x10
cmp edx, ebx
jl 0x40446a
jg 0x4043f0
cmp eax, ebx
jb 0x40446a
push 0x10015
call fcn.0041dc58
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40446a
push esi
push ebx
push dword [esp + 0x24]
call fcn.00417558
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404463
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40445f
cmp byte [esi], 0x50
jne 0x40445e
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40445e
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404476
dec esi
cmp esi, ebx
jae 0x40441f
push ebx
call fcn.0041dc58
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a130
push ebx
call fcn.0041dc58
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404879
add esp, 0x14
test eax, eax
je 0x4044b6
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.0041dc58
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40446f
Function at 0x41dc58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x41dc67
pop dword [ebp - 0x40]
mov eax, 0x41dc67
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x75db8976
add dword [ebp - 0x50], 0xd876bbd5
mov dword [ebp - 0x4c], 0x916d93e6
add dword [ebp - 0x4c], 0xa0c5b85f
mov dword [ebp - 0x48], 0x1d04cd5f
add dword [ebp - 0x48], 0x2f4776cf
mov dword [ebp - 0x44], 0x2da77ff7
sub dword [ebp - 0x44], 0x2da77ff7
lea eax, [ebp - 0x50]
push eax
mov eax, 0x8fd5918e
add eax, 0x706cbec6
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf64f075b
sub dword [ebp - 0x50], 0x81dc9e05
mov dword [ebp - 0x4c], 0xf48b12a6
sub dword [ebp - 0x4c], 0xb31eb131
mov dword [ebp - 0x48], 0x4b7208d2
add dword [ebp - 0x48], 0x17fd639a
mov dword [ebp - 0x44], 0x35dfbb34
add dword [ebp - 0x44], 0xca2044cc
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x30b47e21
add eax, 0xcf8dd237
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x41936
push 0
call eax
mov ecx, 0x575e
mov ebx, eax
mov esi, 0x3fb831ef
sub esi, 0x3f7457ef
add esi, dword [ebp - 0x40]
mov edi, 0x9ad768e0
xor dword [ebp - 0x30], ecx
mov edx, dword [esi]
sub dword [ebp - 0x2c], 0xe1d636f6
add edx, edi
sub dword [ebp - 8], 0x37dfa9d4
mov dword [ebx], edx
sub dword [ebp - 0x20], edx
add ebx, 0xb1770f5e
add ebx, 0x4e88f0a6
add esi, 4
loop 0x41dd78
add eax, 0x1504b
mov ebx, eax
add eax, 5
mov ecx, 0x82c9e4aa
sub ecx, 0x8289e4aa
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x8de3a4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de3aa
pop ebp
sub ebp, 6
sub ebp, 0x4de3a4
jmp 0x8de408
jmp 0x8de411
mov eax, 0x4de3a4
add eax, ebp
add eax, 0x93
mov ecx, 0x626
mov edx, 0x7e27b39d
popfd
mov bl, 0x27
jle 0x8de459
xor byte [eax], dl
inc eax
dec ecx
adc byte [eax + 0x49], al
jne 0x8de428
jmp 0x8de43b
neg ebp
cmc
popfd
lea ebx, [ebp + 0x519df59d]
mov cl, 0x9d
popfd
scasb al, byte es:[edi]
pop ebp
int 0x62
or byte [ecx - 0x32622644], ah
push ss
push eax
push ss
adc al, 0xa1
popfd
popfd
popfd
sbb al, 0x5c
popfd
popfd
popfd
sahf
push eax
and eax, 0x9d9d9d9b
daa
mov ch, 0x9d
popfd
popfd
push 0x7f
sahf
push ebp
push ss
sbb al, 0x91
popfd
popfd
popfd
sahf
pop eax
int 0xf5
les esp, [ebp - 0x2a0a626c]
fstp dword ss:[ebp - 0xa464e64]
movsd dword es:[edi], dword [esi]
xchg esp, eax
popfd
cmc
aad 0x36
fstp dword [ebp - 0xa464e64]
popfd
popfd
popfd
popfd
jne 0x8de424
popfd
popfd
popfd
je 0x8de446
popfd
popfd
popfd
enter 0xffffffffffffc0c9, 0x16
sbb byte [ebp + 0x169d9d9d], dl
or byte [ecx + 0x169d9d9d], dl
adc byte [ebp + 0x5c9d9d9d], cl
je 0x8de44b
lodsb al, byte [esi]
lahf
push ds
pop edi
cdq
aam 0x92
sbb byte [ecx + 0x62], ch
bound esp, qword [edx - 0x40]
pop edi
xchg ecx, eax
popfd
push ss
adc dword [ecx - 0x62626267], edi
cmc
les esp, [ebp - 0x2a0a626c]
fstp dword ss:[ebp - 0x33464e64]
jne 0x8de46b
popfd
popfd
popfd
je 0x8de47a
lahf
popfd
popfd
enter 0x7116, 0x62
call 0x96764775
jne 0x8de4d5
popfd
popfd
popfd
push ss
and byte [ebp - 0x51626263], dl
push esp
sbb al, 0x6f
lahf
stosd dword es:[edi], eax
sti
mov word [edi + ebp*2], ds
lahf
stosd dword es:[edi], eax
sti
mov word [esi - 0x678ae1b1], gs
aad 0x92
sbb ebx, edx
popfd
popfd
popfd
xchg edx, eax
adc eax, 0x9d9d9dd5
sti
push ss
and dword [ebp + ebx + 0x19927566], 0x9d9d9d87
sbb eax, 0x19927466
mov word [ebp + 0x1cfb9d9d], ds
bound di, dword [eax - 0x6277e66e]
popfd
popfd
fdiv qword [ecx + edx*2 + 0x62]
bound esp, qword [edx - 0x4c]
shl dword [esp + ebx*4 + 0x1e985c1e], 1
jne 0x8de4d9
je 0x8de562
bound esp, qword [edx + 0x62]
mov ah, 0xc9
movsb byte es:[edi], byte [esi]
lahf
push ds
pop esp
wait
push ds
ja 0x8de4e8
push ds
jne 0x8de4ea
je 0x8de58a
bound esp, qword [edx + 0x62]
rcr byte [edi - 0x6f], 0x9d
enter 0x7116, 0xffffffffffffffcb
retf 0x16c8
call 0x966dfbf8
popal
das
sbb eax, 0x5b1c9b17
pushfd
popfd
popfd
popfd
adc eax, 0x9c5a1c9a
popfd
popfd
popfd
lahf
popfd
popfd
popfd
lahf
dec edi
xchg edx, eax
sbb byte [eax + 0x179d9d9d], bl
mov ebx, ebx
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40b9ab
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonSize], eax
call fcn.00409420
pop ecx
mov ecx, dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonSize]
mov dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40b9e3
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x401060
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x21c
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov eax, ebx
test ebx, ebx
jne 0x4010a7
push 0
push 9
push 0x110a
push edi
call dword [sym.imp.user32.dll_SendMessageW]
lea ecx, [ebp - 0x10]
push ecx
push eax
push edi
call sym._GetItemPath
add esp, 0xc
push eax
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
mov eax, dword [ebp - 0x10]
mov edi, esi
test esi, esi
jne 0x4010ce
xor esi, esi
test eax, eax
je 0x401125
test eax, eax
mov esi, edi
je 0x4010fc
lea edx, [eax - 0x80000000]
mov ecx, 0x40d1a0
cmp edx, 6
ja 0x4010f9
mov esi, 0x6f
bt esi, eax
mov esi, edi
jae 0x4010f9
mov eax, dword [edx*4 + 0x40d184]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
test esi, esi
je 0x40111b
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x20]
lea esi, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetComputerNameW]
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x18]
call sym._CombinePaths
mov esi, eax
mov dword [ebp - 0x228], esi
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp + 8]
call sym._GetItemPath
add esp, 0xc
mov edi, eax
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x228]
call sym._CombinePaths
mov ebx, eax
push esi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
push edi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
mov eax, ebx
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret