joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004f7b0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1004f8aa
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1004f8a3
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x1004f889
call ebx
cmp dword [ebp - 0x14], eax
jne 0x1004f889
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1004f889
mov edx, dword [esi]
test edx, edx
jne 0x1004f852
push 0x200
push edx
push dword [0x101492a4]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1004f8a3
jmp 0x1004f87d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1004f87d
shl eax, 3
push eax
push edx
push 0
push dword [0x101492a4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1004f8a3
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1004f811
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1004f8ef
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1004f8ef
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1004f8e9
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.1004f640
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1004f8b6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10065296
mov esp, ebp
pop ebp
ret
Function at 0x1004f900
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x1014a990]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1004f961
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065296
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x1004f982
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1004f9a3
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1004f9a3
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1004f99d
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1004f9a3
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.10065296
mov esp, ebp
pop ebp
ret
Function at 0x1004fa00
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x1014a998]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x1004faf1
mov eax, dword [0x1014a990]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x1004fa45
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x1004fa28
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x1004faf1
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.1004f7b0
mov ecx, dword [0x1014a998]
add esp, 4
cmp esi, ecx
jae 0x1004faa5
imul edi, esi, 0x2c
mov eax, dword [0x1014a990]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x1004fa9a
mov edx, ebx
mov ecx, esi
call fcn.1004f900
mov dword [ebp - 4], eax
test eax, eax
jne 0x1004faa2
mov ecx, dword [0x1014a998]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x1004fa71
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1004faf1
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1004fae2
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1004fad6
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x1004fab5
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x101492a4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100515b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x1007c040]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0x20
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x18], 0xefcdab89
add ecx, eax
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
sub edx, eax
mov dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x10051652
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.10050f30
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x10051661
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.10050f30
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xe]
pop esi
xor ecx, esp
call fcn.10065296
mov esp, ebp
pop ebp
ret

Function at 0x10054880
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [0x1014a61c]
add ecx, 4
push esi
mov esi, dword [eax + 0x34]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
call eax
mov edx, dword [esi]
mov ecx, esi
push eax
mov edx, dword [edx + 0xc]
call edx
pop esi
mov cl, byte [eax]
test cl, cl
je 0x100548d9
movsx ecx, cl
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
lea ecx, [eax + 1]
call fcn.10013970
cmp eax, 0x7c4a5426
ja 0x100548dc
je 0x1005491a
cmp eax, 0x19acc50e
je 0x1005491a
cmp eax, 0x43d6266e
je 0x1005491a
cmp eax, 0x4d7aa8c1
je 0x1005491a
xor al, al
ret
cmp eax, 0xc941ff64
ja 0x10054903
je 0x1005491a
cmp eax, 0x9d08c4c8
ja 0x100548fc
je 0x1005491a
cmp eax, 0x7f11af2d
je 0x1005491a
cmp eax, 0x84ea2fe5
jmp 0x100548d7
cmp eax, 0xa7eab73f
jmp 0x100548d7
cmp eax, 0xe80bc214
ja 0x1005491d
je 0x1005491a
cmp eax, 0xd614ea2e
je 0x1005491a
cmp eax, 0xe1525a25
jne 0x100548d9
mov al, 1
ret
cmp eax, 0xf8573d98
sete al
ret

Function at 0x10054930
Capabilities:
Hash data using fnv

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
mov eax, dword [eax + 8]
call eax
cmp dword [eax + 0x14], 0xb5
je 0x100549b5
mov eax, dword [0x1014a61c]
lea ecx, [edi + 4]
push esi
mov esi, dword [eax + 0x34]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
call eax
mov edx, dword [esi]
mov ecx, esi
push eax
mov edx, dword [edx + 0xc]
call edx
pop esi
mov cl, byte [eax]
test cl, cl
je 0x100549a0
movsx ecx, cl
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
lea ecx, [eax + 1]
call fcn.10013970
cmp eax, 0x5978b32e
ja 0x100549a4
je 0x100549b5
cmp eax, 0x1b20e275
je 0x100549b5
cmp eax, 0x3cb8abb3
je 0x100549b5
cmp eax, 0x4c849f3c
je 0x100549b5
xor al, al
pop edi
ret
cmp eax, 0x97113ea7
je 0x100549b5
cmp eax, 0xa8d619ea
pop edi
sete al
ret
mov al, 1
pop edi
ret
Function at 0x10063100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [ebp + 0xc], 1
jne 0x10063133
push 0
push 0
push dword [ebp + 8]
push 0x10063090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10063133
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x402ec0
Capabilities:
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
cmp word [eax], 0x5a4d
push edi
je 0x402ed8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [esp + 0x10], edi
cmp dword [edi], 0x4550
je 0x402ef1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov esi, dword [0x408160]
push 4
push 0x2000
push eax
push ecx
call esi
mov ebp, eax
test ebp, ebp
jne 0x402f28
mov edx, dword [edi + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov ebp, eax
test ebp, ebp
jne 0x402f28
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x14
push 0
call dword [0x4080ac]
push eax
call dword [0x4080a8]
mov ebx, eax
xor eax, eax
push 4
push 0x1000
mov dword [ebx + 4], ebp
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x50]
push eax
push ebp
call esi
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push ebp
call esi
mov esi, dword [esp + 0x18]
mov ecx, dword [edi + 0x54]
push ebx
mov edi, dword [esi + 0x3c]
add ecx, edi
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push esi
push ecx
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov dword [eax + 0x34], ebp
call fcn.00403010
mov ecx, dword [esi + 0x34]
mov eax, ebp
add esp, 0xc
sub eax, ecx
je 0x402fb1
push eax
push ebx
call fcn.004031a0
add esp, 8
push ebx
call fcn.00403220
add esp, 4
test eax, eax
je 0x402fe1
push ebx
call fcn.004030e0
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x402ff9
add eax, ebp
test eax, eax
je 0x402fe1
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x402ff2
push ebx
call fcn.00403400
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [ebx + 0x10], 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x403010
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x4030d0
push esi
push edi
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x40307c
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x4030ae
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [0x408160]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4030ae
push 4
push 0x1000
push eax
mov eax, dword [ebx - 4]
add eax, ebp
push eax
call dword [0x408160]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x40303e
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4030e0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x403194
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x403137
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [0x408138]
jmp 0x40317a
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov edx, dword [edx*4 + 0x45d164]
je 0x40314e
or dh, 2
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x403167
test al, 0x40
je 0x40315e
mov ecx, dword [ebx + 0x20]
jmp 0x403165
test al, al
jns 0x40317a
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x40317a
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [0x4080b0]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x403104
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x404ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x120
mov al, 0x6c
mov cl, 0x50
mov byte [esp + 9], al
mov byte [esp + 0xa], al
mov byte [esp + 0x12], al
mov byte [esp + 5], cl
mov byte [esp + 0xc], cl
mov al, 0x73
push ebx
mov cl, 0x69
push ebp
mov byte [esp + 0x1f], al
mov byte [esp + 0x21], al
push esi
mov byte [esp + 0x1d], cl
mov byte [esp + 0x22], cl
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0x10]
mov bl, 0x41
mov dl, 0x74
push eax
push ecx
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x19], 0x48
mov byte [esp + 0x1a], 0x4c
mov byte [esp + 0x1b], 0x57
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1e], 0x49
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x23], 0
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], dl
mov byte [esp + 0x27], 0x68
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2c], 0x45
mov byte [esp + 0x2d], 0x78
mov byte [esp + 0x30], dl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0
call fcn.00403eb0
mov ebx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
mov ebp, dword [esp + 0x13c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, eax
mov edi, ecx
je 0x404fd9
cmp byte [esi + ebp], 0x5c
jne 0x404fd4
push esi
lea edx, [esp + 0x30]
push ebp
push edx
call dword [0x4081c4]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call ebx
test eax, eax
jne 0x404fd4
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [0x4080e8]
inc esi
cmp esi, edi
jb 0x404fa7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
Function at 0x405c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x12c
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
mov dl, 0x53
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, 0x65
mov cl, 0x72
mov bl, 0x74
mov byte [esp + 0x17], al
mov byte [esp + 0x22], al
mov byte [esp + 0x26], al
mov byte [esp + 0x2b], al
mov byte [esp + 0xc], dl
mov byte [esp + 0xd], 0x59
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], 0x54
mov byte [esp + 0x10], 0x45
mov byte [esp + 0x11], 0x4d
mov byte [esp + 0x12], 0x5c
mov byte [esp + 0x13], 0x43
mov byte [esp + 0x14], 0x75
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], cl
mov byte [esp + 0x18], 0x6e
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0x43
mov byte [esp + 0x1b], 0x6f
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], 0x6f
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0x5c
mov byte [esp + 0x25], dl
mov byte [esp + 0x27], cl
mov byte [esp + 0x28], 0x76
mov byte [esp + 0x29], 0x69
mov byte [esp + 0x2a], 0x63
mov byte [esp + 0x2c], 0x73
mov byte [esp + 0x2d], 0x5c
mov byte [esp + 0x2e], 0
xor eax, eax
mov cl, byte [esp + eax + 0xc]
mov byte [esp + eax + 0x34], cl
inc eax
test cl, cl
jne 0x405d08
mov edi, str.svchost
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x30]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0xf003f
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0x80000002
call dword [0x408020]
pop edi
pop esi
test eax, eax
pop ebx
jne 0x405d7d
mov edx, dword [esp + 0x24]
push edx
call dword [0x408004]
mov eax, 1
add esp, 0x12c
ret
xor eax, eax
add esp, 0x12c
ret

Function at 0x4063e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x406400
mov dl, byte [ecx + eax]
sub dl, 0x46
xor dl, 0x33
mov byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x4063ef
pop esi
ret
Function at 0x40d061d3
Capabilities:
Encode data using xor

Disassembly:
call 0x40d0614c
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x40d0617c
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x40d06198
xor edx, 0
jmp 0x40d061a3
xor edx, edx
jmp 0x40d061ba
jmp 0x40d061c6
xor eax, eax
push 0x8427d7c0
call 0x40d061d3
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x40d0620f
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x40d061e8
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x40d06226
add eax, 0
jno 0x40d0622b
add esi, 0
ret 0x10

Function at 0x40d06f94
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x40d06fb6
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x40d07158
cmp edi, dword [ebp + 0x10]
jb 0x40d07158
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.40d06a80
inc edi
jmp 0x40d0703f
jmp 0x40d0704c
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.40d06a80
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.40d06a80
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x40d070a0
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x40d07084
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.40d070ce
add dword [eax], 0x39
jle 0x40d070aa
sub al, 0xf5
mov ch, al
call fcn.40d070e3
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10
Function at 0x40d08dbb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x40d08dd1
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x40d08de2
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.40d08e23
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx

Function at 0x40d0b18f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x40d0b0d8
add ebx, 0
push ecx
call 0x40d0b0ed
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x71d3938c
sub ebx, dword [0x71d58bcb]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x71d58bbb
call fcn.40d06bb7
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.40d060c5
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x40d0b24b
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x40d0b24b
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x40d0b202
mov eax, 1
lock xchg dword [0x71d58bc7], eax
push 0x3dd1fc71
call 0x40d0b18f
push esi
add esp, 8
cmp eax, 0
jne 0x40d0b178
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x40d0b19e
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x40d0b1b3
cmp ecx, edx
cmp eax, 0
je 0x40d0b1d8
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x40d0b1c2
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.40d0b1f1
dec eax
loope 0x40d0b1f4
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x71d58bc7], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x40d0b228
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x40d0b23d
jmp 0x40d0b248
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x40d0b136