joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033fe
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40352f
mov eax, dword [0x408040]
add eax, 8
mov dword [0x408040], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x403483
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0xc], ecx
push 0x40f320
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x408040]
add eax, 8
mov dword [0x408040], eax
push 0
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call dword [ebp - 0xc]
mov eax, dword [0x408040]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x408040], eax
push 0x40f320
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 4]
and dword [eax + 0x10], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x4034e7
mov eax, dword [0x408040]
imul eax, dword [0x408040]
sub eax, 3
mov dword [0x40803c], eax
and dword [ebp - 8], 0
jmp 0x4034ad
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0xc]
jge 0x4034db
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 8]
cmp dword [eax + ecx*4], 0xffffffff
je 0x4034d9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 8]
push dword [eax + ecx*4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4034a6
mov eax, dword [ebp - 4]
push dword [eax + 8]
call fcn.00403949
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x403503
push 0x8000
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [0x40803c]
sub eax, 4
mov dword [0x408040], eax
mov eax, dword [0x408040]
add eax, 7
mov dword [0x40803c], eax
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x408040]
shl eax, 1
mov dword [0x40803c], eax
leave
ret
Function at 0x405119
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40eb68
cmp edx, dword [eax]
je 0x40513b
add eax, 8
inc ecx
cmp eax, 0x40ebf8
jl 0x40512c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40eb68]
jne 0x405269
mov eax, dword [0x41dda0]
cmp eax, 1
je 0x405243
test eax, eax
jne 0x40516c
cmp dword [0x40eab8], 1
je 0x405243
cmp edx, 0xfc
je 0x405269
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4051a3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004059d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405ac0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4051e6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405ac0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4073a0
push edi
call fcn.00405bd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004059d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004059e0
lea eax, [ebp - 0xa0]
push 0x407380
push eax
call fcn.004059e0
push dword [esi + 0x40eb6c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004059e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405b3b
add esp, 0x2c
pop edi
jmp 0x405269
lea eax, [ebp + 8]
lea esi, [esi + 0x40eb6c]
push 0
push eax
push dword [esi]
call fcn.00405ac0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40b801
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x411a00
cmp edx, dword [eax]
je 0x40b823
add eax, 8
inc ecx
cmp eax, 0x411a90
jl 0x40b814
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x411a00]
jne 0x40b951
mov eax, dword [0x41911c]
cmp eax, 1
je 0x40b92b
test eax, eax
jne 0x40b854
cmp dword [0x411488], 1
je 0x40b92b
cmp edx, 0xfc
je 0x40b951
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b88b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408740
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408910
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b8ce
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408910
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41050c
push edi
call fcn.00408fa0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408740
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408750
lea eax, [ebp - 0xa0]
push 0x4104ec
push eax
call fcn.00408750
push dword [esi + 0x411a04]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408750
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040e2c6
add esp, 0x2c
pop edi
jmp 0x40b951
lea eax, [ebp + 8]
lea esi, [esi + 0x411a04]
push 0
push eax
push dword [esi]
call fcn.00408910
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x31de7f55
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x74e42ac9
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x421710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x421a80
mov dword [ebp - 0x50], ecx
lea eax, [ebp - 0x18]
mov esi, edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea eax, [ebp - 0x68]
push edx
push eax
call fcn.004e32d0
add esp, 8
lea eax, [esi + 0xc]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x74]
push eax
push ecx
call fcn.004e32d0
add esp, 8
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + 0x44]
movzx ecx, word [edx + 0x46]
cmp dword [edx + 0x18], 0x80000000
mov word [ebp - 0x28], ax
mov word [ebp - 0x26], cx
jne 0x42178f
mov esi, connect
jmp 0x421842
lea eax, [edx + 0x18]
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x5c]
push eax
push ecx
call fcn.004e32d0
add esp, 8
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x30], connect
mov eax, dword [edx + 0x3c]
cmp dword [edx + 0x24], 0x80000000
mov dword [ebp - 0x4c], eax
jne 0x4217d4
mov dword [ebp - 0x20], connect
cmp dword [edx + 0x30], 0x80000000
mov dword [ebp - 0x2c], ecx
jne 0x421809
jmp 0x421835
lea eax, [edx + 0x24]
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x3c]
push eax
push ecx
call fcn.004e32d0
add esp, 8
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x48], edx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
cmp dword [edx + 0x30], 0x80000000
mov dword [ebp - 0x2c], ecx
je 0x4217d2
lea eax, [edx + 0x30]
mov dword [ebp - 0x10], 3
lea ecx, [ebp - 0x3c]
push eax
push ecx
call fcn.004e32d0
add esp, 8
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x44], edx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x40], ecx
movzx edx, byte [edx + 0x40]
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x50]
movsd xmm0, qword [ebp - 0x68]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x6c]
movsd qword [ecx], xmm0
movsd xmm0, qword [ebp - 0x74]
mov dword [ecx + 0x14], eax
movzx eax, word [ebp - 0x28]
movsd qword [ecx + 0xc], xmm0
mov word [ecx + 0x44], ax
movzx eax, word [ebp - 0x26]
mov word [ecx + 0x46], ax
mov dword [ecx + 0x18], esi
mov esi, dword [ebp - 0x20]
mov dword [ecx + 0x1c], edi
mov dword [ecx + 0x20], ebx
mov edi, dword [ebp - 0x2c]
mov dword [ecx + 0x24], esi
mov esi, dword [ebp - 0x48]
mov dword [ecx + 0x28], edi
mov edi, dword [ebp - 0x30]
mov dword [ecx + 0x2c], esi
mov esi, dword [ebp - 0x40]
mov dword [ecx + 0x30], edi
mov edi, dword [ebp - 0x44]
mov dword [ecx + 0x38], esi
mov esi, dword [ebp - 0x4c]
mov dword [ecx + 0x34], edi
mov dword [ecx + 0x3c], esi
mov byte [ecx + 0x40], dl
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44f050
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4539e0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x28]
push 0x40
push 0
push eax
call fcn.004fda90
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
lea edi, [eax + 0x40]
mov dword [ebx + eax + 0x3c], 0x20202020
mov dword [ebx + eax + 0x38], 0x20202020
mov dword [ebx + eax + 0x34], 0x20202020
mov dword [ebx + eax + 0x30], 0x20202020
mov dword [ebx + eax + 0x2c], 0x20202020
mov dword [ebx + eax + 0x28], 0x20202020
mov dword [ebx + eax + 0x24], 0x20202020
mov dword [ebx + eax + 0x20], 0x20202020
mov dword [ebx + eax + 0x1c], 0x20202020
mov dword [ebx + eax + 0x18], 0x20202020
mov dword [ebx + eax + 0x14], 0x20202020
mov dword [ebx + eax + 0x10], 0x20202020
mov dword [ebx + eax + 0xc], 0x20202020
mov dword [ebx + eax + 8], 0x20202020
mov dword [ebx + eax + 4], 0x20202020
mov dword [ebx + eax], 0x20202020
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x28]
sub eax, edi
cmp eax, 0x21
ja 0x44f153
push 0x22
push edi
lea eax, [ebp - 0x28]
push eax
call fcn.004fda90
add esp, 0xc
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp + 0xc]
lea eax, [ebx + edi]
push 0x22
push str.TLS_1.3__client_CertificateVerify
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, dword [esi + 0x40]
add edi, 0x22
mov dword [ebp - 0x20], edi
cmp ecx, 0x41
jae 0x44f1d2
mov eax, dword [ebp - 0x28]
sub eax, edi
cmp eax, ecx
jae 0x44f19a
mov dword [ebp - 0x2c], ecx
push ecx
push edi
lea eax, [ebp - 0x28]
push eax
call fcn.004fda90
add esp, 0xc
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp + 8]
add ebx, edi
push ecx
push dword [ebp + 0xc]
push ebx
mov ebx, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add edi, ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
mov dword [esi + 8], edi
movsd xmm0, qword [ebp - 0x28]
movsd qword [esi], xmm0
mov dword fs:[0], eax
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x525e54
push 0x40
push ecx
call fcn.00500430
add esp, 0xc
ud2
Function at 0x44f220
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4539f0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x28]
push 0x40
push 0
push eax
call fcn.004fda90
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
lea edi, [eax + 0x40]
mov dword [ebx + eax + 0x3c], 0x20202020
mov dword [ebx + eax + 0x38], 0x20202020
mov dword [ebx + eax + 0x34], 0x20202020
mov dword [ebx + eax + 0x30], 0x20202020
mov dword [ebx + eax + 0x2c], 0x20202020
mov dword [ebx + eax + 0x28], 0x20202020
mov dword [ebx + eax + 0x24], 0x20202020
mov dword [ebx + eax + 0x20], 0x20202020
mov dword [ebx + eax + 0x1c], 0x20202020
mov dword [ebx + eax + 0x18], 0x20202020
mov dword [ebx + eax + 0x14], 0x20202020
mov dword [ebx + eax + 0x10], 0x20202020
mov dword [ebx + eax + 0xc], 0x20202020
mov dword [ebx + eax + 8], 0x20202020
mov dword [ebx + eax + 4], 0x20202020
mov dword [ebx + eax], 0x20202020
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x28]
sub eax, edi
cmp eax, 0x21
ja 0x44f323
push 0x22
push edi
lea eax, [ebp - 0x28]
push eax
call fcn.004fda90
add esp, 0xc
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp + 0xc]
lea eax, [ebx + edi]
push 0x22
push str.TLS_1.3__server_CertificateVerify
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, dword [esi + 0x40]
add edi, 0x22
mov dword [ebp - 0x20], edi
cmp ecx, 0x41
jae 0x44f3a2
mov eax, dword [ebp - 0x28]
sub eax, edi
cmp eax, ecx
jae 0x44f36a
mov dword [ebp - 0x2c], ecx
push ecx
push edi
lea eax, [ebp - 0x28]
push eax
call fcn.004fda90
add esp, 0xc
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp + 8]
add ebx, edi
push ecx
push dword [ebp + 0xc]
push ebx
mov ebx, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add edi, ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
mov dword [esi + 8], edi
movsd xmm0, qword [ebp - 0x28]
movsd qword [esi], xmm0
mov dword fs:[0], eax
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x525e54
push 0x40
push ecx
call fcn.00500430
add esp, 0xc
ud2
Function at 0x4679e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edx, dword [ecx + 0x20]
cmp edx, dword [ebp + 0x20]
jne 0x467a86
test edx, edx
je 0x467a8d
lea esi, [edx - 0x21]
cmp esi, 0xffffffe0
jb 0x467af9
xor ebx, ebx
cmp edx, 8
mov esi, 0
jb 0x467b0b
xor ebx, ebx
cmp edx, 0x10
jae 0x467a94
mov edi, esi
mov esi, edx
movzx ebx, bl
and esi, 0x38
movd xmm0, ebx
nop word cs:[eax + eax]
nop dword [eax + eax]
movq xmm1, qword [ecx + edi]
movq xmm2, qword [ebp + edi]
add edi, 8
cmp esi, edi
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x467a40
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd ebx, xmm1
jmp 0x467b07
xor eax, eax
jmp 0x467b1d
mov al, 1
jmp 0x467b1d
mov esi, edx
pxor xmm0, xmm0
xor edi, edi
and esi, 0x30
nop
movdqu xmm1, xmmword [ecx + edi]
movdqu xmm2, xmmword [ebp + edi]
add edi, 0x10
cmp esi, edi
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x467aa0
pshufd xmm1, xmm0, 0xee
cmp edx, esi
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd ebx, xmm0
je 0x467b18
test dl, 8
jne 0x467a23
jmp 0x467b0b
push 0x520c6c
push 0x20
push 0x20
call fcn.00500690
cmp edx, esi
je 0x467b18
movzx eax, byte [ebp + esi]
xor al, byte [ecx + esi]
inc esi
or bl, al
jmp 0x467b07
test bl, bl
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48acb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov ch, byte [esp + 0x78]
call 0x48acc8
pop ebx
mov ebp, dword [edx + 8]
mov esi, dword [edx + 4]
cmp ebp, esi
jae 0x48af82
mov ecx, dword [edx]
mov dword [esp], ecx
lea ecx, [ebp + 1]
mov dword [edx + 8], ecx
cmp ecx, esi
mov ch, byte [esp + 0x78]
jae 0x48af82
mov edi, dword [esp]
mov cl, byte [edi + ebp]
mov byte [esp + 0xb], cl
and cl, 0x1f
cmp cl, 0x1f
je 0x48af82
lea edi, [ebp + 2]
mov dword [esp + 4], edi
mov dword [edx + 8], edi
mov edi, dword [esp]
mov cl, byte [edi + ebp + 1]
test cl, cl
js 0x48ae00
movzx ebx, cl
cmp ebx, dword [esp + 0x7c]
jae 0x48af82
add ebx, dword [esp + 4]
jb 0x48af82
cmp esi, ebx
jb 0x48af82
mov cl, byte [esp + 0x74]
mov dword [edx + 8], ebx
cmp byte [esp + 0xb], cl
jne 0x48af82
mov esi, eax
mov ecx, dword [esp + 4]
mov eax, dword [esp]
add eax, ecx
sub ebx, ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
lea eax, [esp + 0x10]
push 0xffff
push eax
push ecx
call fcn.004888b0
add esp, 0xc
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x48af93
movsd xmm1, qword [esp + 0x4d]
mov eax, dword [esp + 0x54]
movsd xmm0, qword [esp + 0x3d]
movsd xmm2, qword [esp + 0x45]
movzx edx, byte [esp + 0x3c]
movsd qword [esp + 0x2c], xmm1
mov dword [esp + 0x33], eax
mov eax, dword [esp + 0x18]
movsd qword [esp + 0x1c], xmm0
movsd qword [esp + 0x24], xmm2
cmp eax, dword [esp + 0x14]
mov eax, esi
jne 0x48afa5
movsd xmm1, qword [esp + 0x24]
mov dword [eax], ecx
mov byte [eax + 4], dl
movsd xmm0, qword [esp + 0x1c]
mov ecx, dword [esp + 0x33]
movsd qword [eax + 0xd], xmm1
movsd xmm1, qword [esp + 0x2c]
movsd qword [eax + 5], xmm0
movsd qword [eax + 0x15], xmm1
mov dword [eax + 0x1c], ecx
jmp 0x48af8b
movzx edi, cl
add edi, 0xffffff7f
cmp edi, 3
ja 0x48af82
add ebx, dword [edi*4 + 0x48afb0]
jmp ebx
mov byte [eax + 4], ch
mov dword [eax], 0
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, byte [esp + 0x3c]
mov eax, esi
mov byte [esi + 4], cl
mov dword [esi], 0
jmp 0x48af8b
movzx ecx, byte [esp + 0x78]
mov byte [eax + 4], cl
jmp 0x48af85
Function at 0x497b10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x64
movzx eax, byte [0x5781b4]
mov edi, dword [esp + 0x78]
cmp al, 2
jne 0x497c71
mov eax, dword [edi]
xorps xmm0, xmm0
movsd qword [esp + 0x2c], xmm0
movsd qword [esp + 0x24], xmm0
movsd qword [esp + 0x1c], xmm0
movsd qword [esp + 0x14], xmm0
movsd qword [esp + 0xc], xmm0
movsd qword [esp + 4], xmm0
mov dword [esp], eax
mov ecx, dword [eax + 0x10]
cmp ecx, 0x31
jae 0x497c80
mov esi, dword [esp + 0x74]
lea ebx, [esp + 4]
push ecx
push ebx
push dword [esp + 0x88]
push dword [esp + 0x88]
call dword [eax + 4]
add esp, 0x10
test al, al
jne 0x497c62
movsd xmm1, qword [ebx + 8]
movsd xmm2, qword [ebx + 0x10]
mov eax, dword [esp]
movsd xmm0, qword [ebx]
movsd qword [esp + 0x3c], xmm1
movsd xmm1, qword [ebx + 0x18]
movsd qword [esp + 0x44], xmm2
movsd xmm2, qword [ebx + 0x20]
test eax, eax
movsd qword [esp + 0x34], xmm0
movsd qword [esp + 0x4c], xmm1
movsd xmm1, qword [ebx + 0x28]
movsd qword [esp + 0x54], xmm2
movsd qword [esp + 0x5c], xmm1
je 0x497c62
movsd xmm0, qword [esp + 0x5c]
movsd xmm1, qword [esp + 0x3c]
mov dword [esi], eax
movsd qword [esp + 0x28], xmm0
movsd xmm0, qword [esp + 0x54]
movsd qword [esp + 8], xmm1
movsd xmm1, qword [esp + 8]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [esp + 0x4c]
movsd qword [esi + 0xc], xmm1
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [esp + 0x44]
movsd xmm1, qword [esp + 0x18]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [esp + 0x34]
movsd xmm2, qword [esp + 0x10]
movsd qword [esi + 0x1c], xmm1
movsd xmm1, qword [esp + 0x28]
movsd qword [esp], xmm0
movsd xmm0, qword [esp]
movsd qword [esi + 0x14], xmm2
movsd xmm2, qword [esp + 0x20]
movsd qword [esi + 0x2c], xmm1
movsd qword [esi + 4], xmm0
movsd qword [esi + 0x24], xmm2
mov dword [esi + 0x34], edi
jmp 0x497c68
mov dword [esi], 0
mov eax, esi
add esp, 0x64
pop esi
pop edi
pop ebx
ret
mov ecx, 0x5781b4
call fcn.004fefa0
jmp 0x497b29
push 0x528374
push 0x30
push ecx
call fcn.00500430
int3
Function at 0x49ed50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov esi, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x38]
mov byte [esp + 0x40], 0
lea esi, [esp + 0x1c]
push edx
push ecx
push eax
push esi
call fcn.0049ff40
add esp, 0x10
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x49edc7
mov ebp, dword [esp + 0x68]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edi, 0x52a170
mov dword [esp], edx
cmp ebp, 5
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
jbe 0x49ede7
mov ecx, 8
jmp 0x49ee6e
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ecx
mov dword [ebx + 4], 0
mov dword [ebx], 0
jmp 0x49eeb9
mov ecx, 0xf
mov edi, str.InvalidEncodingTooSmallC:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_ring_0.17.8_srclimb.rs
test ebp, ebp
je 0x49ee6e
mov ebx, dword [esp + 0x64]
cmp byte [ebx], 0
je 0x49ee6e
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor edx, edx
xor esi, esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ecx
nop word [eax + eax]
movzx eax, byte [ebx]
shld esi, edx, 8
shl edx, 8
inc ebx
or edx, eax
dec ebp
jne 0x49ee20
mov ecx, edx
mov edi, 0x52a073
or ecx, esi
je 0x49edbd
cmp edx, dword [esp + 0x74]
mov ecx, esi
sbb ecx, dword [esp + 0x78]
jb 0x49edbd
test esi, 0xfffffffe
mov edi, 0x52a170
mov ecx, 8
jne 0x49ee6e
movzx eax, al
test al, 1
jne 0x49eec3
mov ecx, 0x10
mov edi, str.InvalidComponentTooLarge
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0x58]
test eax, eax
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], ecx
mov dword [ebx + 4], 0
mov dword [ebx], 0
je 0x49ee9f
shl eax, 2
push 4
push eax
push dword [esp + 8]
call fcn.00402cf0
add esp, 0xc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x49eeb9
shl eax, 2
push 4
push eax
push dword [esp + 0xc]
call fcn.00402cf0
add esp, 0xc
mov eax, ebx
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [esp + 0x58]
mov eax, dword [esp]
mov ecx, dword [esp + 0x14]
mov dword [ebx], edx
mov edx, dword [esp + 8]
mov dword [ebx + 4], esi
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], ecx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], ecx
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], ecx
jmp 0x49eeb9
Function at 0x49f970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
mov edi, dword [eax]
mov dword [esp + 4], esi
cmp ecx, esi
mov dword [esp], ecx
jne 0x49fa37
test esi, esi
je 0x49fa58
mov ebp, dword [esp + 0x38]
mov ebx, esi
xor ecx, ecx
shl ebx, 5
cmp esi, 8
jb 0x49f9f0
mov ecx, esi
xor edx, edx
pcmpeqd xmm0, xmm0
and ecx, 0xfffffff8
nop word cs:[eax + eax]
movdqu xmm1, xmmword [edi + edx*4]
movdqu xmm2, xmmword [edi + edx*4 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [ebp + edx*4], xmm1
movdqu xmmword [ebp + edx*4 + 0x10], xmm2
add edx, 8
cmp ecx, edx
jne 0x49f9c0
cmp ecx, esi
je 0x49f9fe
nop word [eax + eax]
mov edx, dword [edi + ecx*4]
not edx
mov dword [ebp + ecx*4], edx
inc ecx
cmp esi, ecx
jne 0x49f9f0
or byte [ebp], 1
sub ebx, dword [eax + 0x10]
je 0x49fa2f
mov eax, dword [ebp + esi*4 - 4]
mov ecx, ebx
shl eax, cl
shr eax, cl
cmp ebx, 1
adc ebx, 0
mov dword [ebp + esi*4 - 4], eax
nop dword [eax + eax]
push esi
push edi
push ebp
push ebp
call fcn.004eb600
add esp, 0x10
dec ebx
jne 0x49fa20
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
lea ecx, [esp + 4]
mov edx, esp
push 0x5299a0
push eax
push ecx
push edx
push 0
call fcn.004fef30
push 0x529788
push 0
push 0
call fcn.00500690
int3