joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438c95
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
mov eax, 0x1f28e6ef
and eax, eax
sub ebx, ebx
call fcn.00438cd3
sub esp, 4
mov dword [esp], 0x2d55eed3
pop ebx
add ebx, eax
xor dword [edi], edx
sub eax, ebx
sub ebx, 1
add ebx, 1
inc edi
add eax, eax
cmp edi, ecx
jne fcn.00438c95
and ebx, ebx
add eax, ebx
ret

Function at 0x403fb2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00402edd
xor ebx, ebx
cmp dword [0x40e9fc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x404087
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x403ff2
xor eax, eax
jmp 0x40414b
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x403feb
push eax
call fcn.00402e7a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e9fc], eax
call esi
push eax
call fcn.00402e7a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40ea00], eax
call esi
push eax
call fcn.00402e7a
mov dword [0x40ea04], eax
lea eax, [ebp - 8]
push eax
call fcn.004022a3
test eax, eax
pop ecx
pop ecx
je 0x404055
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040389b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x404087
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00402e7a
cmp eax, ebx
pop ecx
mov dword [0x40ea0c], eax
je 0x404087
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402e7a
pop ecx
mov dword [0x40ea08], eax
mov eax, dword [0x40ea08]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x404100
cmp dword [0x40ea0c], esi
je 0x404100
push eax
call fcn.00402ee6
pop ecx
call eax
cmp eax, ebx
je 0x4040cd
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x40ea0c]
call fcn.00402ee6
pop ecx
call eax
test eax, eax
je 0x4040cd
test byte [ebp - 0x18], 1
jne 0x404100
lea eax, [ebp - 0xc]
push eax
call fcn.004022da
test eax, eax
pop ecx
je 0x4040e8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040389b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4040f7
or dword [ebp + 0x10], 0x200000
jmp 0x404131
or dword [ebp + 0x10], 0x40000
jmp 0x404131
mov eax, dword [0x40ea00]
cmp eax, esi
je 0x404131
push eax
call fcn.00402ee6
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x404131
mov eax, dword [0x40ea04]
cmp eax, esi
je 0x404131
push dword [ebp - 4]
push eax
call fcn.00402ee6
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x40e9fc]
call fcn.00402ee6
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405e1b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e078]
jne 0x405e25
repz ret
jmp fcn.00407455
Function at 0x44212d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44215b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x442179
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00442097
jmp 0x442179
mov eax, dword [esi + 0x14]
test eax, eax
je 0x442179
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00442097
test edi, edi
mov eax, edi
jne 0x442163
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56c32c]
test ecx, ecx
je 0x44222c
jmp 0x44212c
ret 8

Function at 0x4014ad
Capabilities:
Delete file
Get common file path

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x500, 0
sub ebp, 0x86
lea eax, [ebp - 0x272]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
xor eax, eax
push 0x104
mov word [ebp + 0x66], ax
lea eax, [ebp - 0x47a]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea eax, [ebp + 0x16]
push eax
push eax
mov byte [ebp + 0x16], 0
call dword [sym.imp.SHLWAPI.DLL_PathAppendA]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x272]
push eax
mov byte [ebp + 0x76], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
xor al, al
mov byte [ebp + 0x7e], al
xor ah, ah
push ebx
mov word [ebp + 0x56], ax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp + 0x7e]
push eax
lea eax, [ebp + 0x76]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
call dword [sym.imp.USER32.DLL_GetDesktopWindow]
mov ebx, eax
lea eax, [ebp - 0x47a]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebp + 0x56]
push eax
lea eax, [ebp + 0x66]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 5
push ebx
call dword [sym.imp.USER32.DLL_GetWindow]
push 0
push 0
call dword [sym.imp.USER32.DLL_LoadAcceleratorsA]
xor eax, eax
mov word [ebp - 0x6a], ax
lea eax, [ebp - 0x6a]
push eax
push eax
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
lea eax, [esi - 3]
lea esp, [ebp + 0x86]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4020af
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov cl, byte [0x403050]
mov edx, eax
mov ebx, eax
shl edx, cl
mov eax, 0x403054
add edx, dword [0x403050]
call fcn.00401fe8
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x402baf
push edx
sub edi, fcn.00402359
push edi
xor eax, eax
push fcn.00402359
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x402121
mov eax, fcn.00402359
mov ebx, esi
mov edx, edi
call fcn.00401fe8
mov edx, 0x1c000
mov eax, 0x403054
mov ebx, esi
call fcn.00401d13
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x402359
Capabilities:
Encode data using xor

Disassembly:
mov edi, eax
inc esi
popal
add byte [ebx + 0x6c], al
inc ebp
add byte [edx - 1], dh
add byte [ebp + 0x72], ah
invalid
Function at 0x40934b
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
xchg byte [ebx + 0x395d8eba], ah
pop ebp
invalid
rcl dword [edx - 0x6d], cl
pop edi
sbb dword [edx - 0x5d2202b], ebx
hlt
clc
jo 0x4092eb
aam 0xd6
idiv byte [edx - 0x6d]
out 0x95, eax
mov esi, 0xbd87c255
je 0x4092d9
shr dword [edx], 1
pop ebx
mov byte [0x62acaf69], al
out dx, eax
in al, 0xea
or al, byte [ebp + edi*2 + 0x35]
imul ebp, dword [eax + 0x552c426], 0x3e
cmc
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
xor eax, 0xc426a86b
push edx
add eax, 0xa796f53e
mov edx, 0x2a5b948b
je 0x40932d
xor dword [ebx + 0xc], ebp
inc ecx
xchg dword [eax], ecx
mov bl, 0xe6
pushal
out 0x60, al
sbb ebx, dword [edi + ebx*2 + 0x49]
dec ecx
or dh, byte [0xd7d2527a]
push edx
rcl bh, cl
dec edx
jp 0x40930e
cmc
add esp, esp
cmp byte [ecx + 0x75], 0x2b
fiadd word [ebx]
sub eax, dword [ebx + 0x3bcc356d]
das
sub ebx, esi
add ebp, dword [ebx]
sub dword [ebp + 0x35], 0xffffffcc
cmp ebp, dword [edi]
wait
loopne 0x40930c
in eax, dx
movsb byte es:[edi], byte [esi]
loope 0x40935b
out dx, eax
sbb esi, dword [edx + ebp]
jae 0x4093d5
test dword [edx + 0x40], ebx
jno 0x40936b
mov ebp, 0xc3c380b7
movsb byte es:[edi], byte [esi]
scasd eax, dword es:[edi]
rcr dword [edi], 0x21
sbb eax, 0xae8de645
sub dword [edi], edx
daa
sbb bl, ah
adc byte [ebx + 0x39], al
mov cl, 8
mov eax, 0xb9f2d0fa
mov edx, 0x6afdf268
xchg esi, eax
mov ebx, dword [edx - 0x4b5756dc]
push ebx
inc ecx
lcall 0x4153, 0xb4a8a924
sbb dl, ch
jnp 0x40939b
pushal
je 0x409346
dec esi
int 0x39
cwde
cmp al, 0xb0
test byte [edx + 0x7b934c44], dh
xor eax, 0xad9ba7fa
lodsd eax, dword [esi]
lea ecx, [eax]
mov al, 0x1d
push 0xffffffffffffff86
sub eax, edi
salc
inc ebp
je 0x40934f
jnp 0x4093a2
mov edx, 0x9a416902
mov esi, 0x736bba5a
mov ah, byte [edx + 0x38e27cf2]
invalid
jl 0x4093b9
cmp byte [edi + 0x4266e049], cl
clc
rol byte [ebp - 0x1c], 0x74
aas
enter 0xffffffffffffe5a7, 0xffffffffffffff82
in al, dx
pop ecx
clc
push cs
test dword [edx], edi
push ebp
jb 0x4093fb
xchg edx, eax
enter 0xffffffffffffbf80, 0x7c
ljmp 0x969e
sahf
xchg esi, eax
neg dword [ebx]
lea ecx, [edx]
jno 0x4093a2
mov edx, 0x746a79c8
push cs
cld
or eax, 0xd5573502
pop ecx
fisttp qword [ebp - 0x1eb806b3]
sbb ecx, dword [esi - 0x5214ada5]
mov cl, 0x2f
stosd dword es:[edi], eax
cmp dword [eax], 0x8fefc34b
loope 0x409455
cmp byte [ebx - 0x3d], cl
out dx, eax
invalid
pop ebp
sub ch, byte [esi - 0x1fba036c]
loope 0x4094af
sbb ebp, esp
dec esi
add cl, dl
stosb byte es:[edi], al
fidiv word [edi - 0x88437cd]
cli
cmp eax, 0x9fd677f5
dec ebp
insd dword es:[edi], dx
in eax, 0x6e
add edx, ecx
adc eax, 0xb5c42dcb
loop 0x4094a5
rcr dword [ebx], 1
sub al, al
sti
inc esp
invalid
xlatb
aad 0x16
jge 0x409421
lodsd eax, dword [esi]
invalid
jae 0x409472
scasd eax, dword es:[edi]
sbb eax, 0x3e3c3535
invalid
add eax, 0x244a1dd
mov edx, 0x72a1ecf7
xlatb
jp 0x409443
mov dh, 0xf1
ficom word [edx + esi + 0x6ffafb57]
push ebp
ljmp 0x3a34
Function at 0x4099db
Capabilities:
Encode data using xor

Disassembly:
dec edx
insd dword es:[edi], dx
imul dword [eax - 0x68d66a2b]
xor al, cl
dec ebp
test byte [ecx + edx*4 + 0x7a8f9c56], ch
scasb al, byte es:[edi]
push eax
das
dec esp
pop esi
pop edx
xor al, 0x3e
mov edx, 0x13f0b69c
mov esp, 0x524b95d9
out dx, al
and eax, 0x9da1c0ac
hlt
jne 0x409a34
ljmp 0x5afb:0xcd9afb8c
mov edx, 0xbfa8114a
mov edx, 0xb5a5ace3
sbb byte [edx], 0xdb
mov edi, 0xa5ace3ba
mov ch, 0x82
sbb bl, bl
imul dword [ebp + ecx*2 - 9]
pushal
stosd dword es:[edi], eax
in al, dx
xor al, 0xb0
add byte [edi], ah
mov bl, 0xc7
aad 0xeb
cmc
je 0x4099d7
lahf
lds ebx, [edx + 0x516b9a1c]
inc edx
mov dword [0x7b7586eb], eax
test al, 0x44
pop esi
mov dword [ebx + ecx + 0x12], eax
sub dh, byte [ecx - 0x26]
pop es
jp 0x4099b5
sbb al, 0x9a
imul edx, dword [ecx + 0x42], 0xffffffa3
jmp 0x409989
push ebx
and eax, 0x7a9a37a9
mov edx, edi
dec eax
retf
jnp 0x4099fb
pushal
js 0x409a45
adc dword [ebx + 0x45], esp
pop eax
push esp
test al, 0x44
rol esp, cl
fild word [eax + 5]
aaa
dec ebx
xchg bh, al
ljmp 0x2f28
Function at 0x4289fb
Capabilities:
Encode data using xor

Disassembly:
imul byte [eax]
jge 0x428a1a
bnd jmp 0xa6d19ba0
shl byte [ebx], cl
add dl, byte [edx + 0xe]
push cs
push cs
test al, 0x7c
and byte [ecx], 0x53
sub eax, 0x62f05663
mov esi, 0xcaf50df1
aad 0xe
sub dword [esi], 0xbdad789d
and dword [edi + 0x71], edi
jae 0x4289cd
mov ebp, 0x73717f21
mov ch, 0xc8
mov al, 0x82
enter 0xffffffffffff82b0, 0x58
sbb byte [eax + 0x34], 0xb6
pop eax
xor al, 0xb6
test dword [esi + eax*2], ebp
inc edi
mov al, 0x42
cmp dword [esi], ecx
insb byte es:[edi], dx
cmp eax, 0x9b954e30
stosb byte es:[edi], al
jle 0x428a1b
aaa
test eax, 0x9cb5e9f6
sahf
mov word [ebx], fs
pop es
xchg esp, eax
and esi, eax
loopne 0x428a3c
loopne 0x428a3c
pop ebx
xchg ebp, eax
pop ds
xor byte es:[ebx - 0x71], dh
fmul dword [edi - 0x74]
into
outsb dx, byte [esi]
std
adc edi, dword [esi + edi - 0x4d]
mov esp, dword [edi + 0x75]
inc esp
sal dword [edi - 0x7141296f], 1
fld xword [edi + 0x25]
and ch, bl
wait
jg 0x428a6e
mov byte ds:[0xa52159d5], al
mov dl, 0xb1
jge 0x4289f7
and dword [ebp - 0x44], 0xffffffa4
jle 0x428ab0
sbb byte [edx + 0x66cd1de9], dh
clc
in al, 0x9d
aam 0xa0
or ecx, dword [ecx - 0x7eb1db]
jp 0x428a12
test dword [ebx + 0x1b], esi
nop
adc byte [eax - 0x20bbc96b], 0xa0
push ebx
invalid
inc eax
dec ecx
ret 0x7ef0

Function at 0x42dd0b
Capabilities:
Encode data using xor

Disassembly:
cld
pop ebx
or eax, 0x60274e12
rol al, cl
pop es
movsb byte es:[edi], byte [esi]
push ebx
clc
jno 0x42dd4c
ljmp 0xa724:0xbf51ca42
sbb ebx, dword [ebp - 0x7d]
or al, 0x6a
insd dword es:[edi], dx
xor al, 0xce
into
xor al, 0xca
xor byte [edx + 0x6cb7df7c], dl
cmp eax, 0xf980a6ce
das
push cs
sub ebp, eax
loopne 0x42dd53
into
pushal
pop ebx
push edi
jo 0x42dd79
movsb byte es:[edi], byte [esi]
inc esp
cmp ebp, dword [edi + 0x38798b55]
and dword [ebp + eax*4 + 0x54bff20], eax
dec dword [ebx + 5]
add eax, 0x66d7f015
dec edx
adc eax, 0x4a66d7f0
aaa
fsub st(7), st(0)
sbb byte [edx], ch
cmc
sub ebx, esp
rcl dh, cl
out 0x11, al
test al, 0x70
mov eax, 0x35ed1eeb
mov ch, 0x7e
jp 0x42dd7b
mov ebx, 0xe261a3ac
fidivr word ss:[edi - 8]
popal
cmp edi, edi
jl 0x42ddd1
fnstenv [ebx + 0x3a5e8e02]
in al, 0x33
inc eax
adc edx, dword [ebx - 0x20]
in eax, 0xa6
div dl
and al, 0xa5
retf
mov dl, 0xf7
test eax, 0x17a13391
arpl word [edi + 0x7764f298], bp
movsb byte es:[edi], byte [esi]
fnstcw word [esi - 0x46]
xchg ebx, eax
mov ah, 0xd7
lcall 0xd35d, 0x6f897227
push es
inc ecx
xchg esp, eax
dec esp
mov word [edi + 0x6e5616b0], fs
sbb al, byte [eax + 0x42]
xchg edx, eax
push esi
mov dh, 0x63
dec edi
mov ecx, 0x691c8968
jb 0x42ddb3
push eax
add eax, 0x452d37d1
inc edi
ror dh, 1
jo 0x42de67
push 7
or dh, byte [esi - 0x17]
push esi
inc eax
sar ebx, cl
movsd dword es:[edi], dword [esi]
popal
invalid
cli
fldenv [ebp - 0x190fe371]
mov esi, 0xf8017f8d
out 0x91, al
cmp eax, 0xefb5bd83
fnstsw word [eax]
cmp eax, 0xa7a27608
neg dword [edx]
call 0xd61ca89f
neg dword [ebx]
cmp ebx, ecx
push edx
aaa
and ah, bl
and ah, byte [bp + si - 0x2cd0]
retf 0xda67
Function at 0x438a4b
Capabilities:
Encode data using xor

Disassembly:
dec edi
sbb ah, bl
nop
stc
mov al, byte [0xa02b4e18]
sub byte [esi - 0x4c], dh
sbb al, 0x3b
push edx
push ecx
mov al, 0x2f
test al, 0xbd
add al, dh
push ds
jg 0x438a31
mov ebx, esp
lock add byte [ecx], 0xbb
add byte [ecx], 0xbb
xor ebp, dword [esi + 5]
invalid
stosd dword es:[edi], eax
call 0x30816ab9
jns 0x438a14
enter 0xffffffffffff9819, 0xa
dec edi
adc eax, 0xcc83b6e9
mov eax, 0x3a851f99
out 0x20, eax
push ecx
imul esp, dword [eax + 0xaf9500f], 0x2f
pushal
je 0x438ae8
sbb dword [eax - 0x16eab0f6], ebx
mov dh, 0x83
int3
pause
movsb byte es:[edi], byte [esi]
fiadd word [edx - 0x22c5a089]
into
sub ebx, dword [ecx + 0x404588ac]
sbb eax, 0xbab922ec
shl dword [ecx - 7], 1
jb 0x438a54
inc esp
ret
stc
or eax, edi
stc
push esi
les ecx, ds:[edx]
jns 0x438af4
fcomp st(6)
pushal
mov esi, 0xd2ac89d6
aaa
invalid

Function at 0x43a05b
Capabilities:
Execute syscall

Disassembly:
and dword [eax], 0xd2924c1c
xlatb
xchg esi, eax
in eax, 0xec
cmpsd dword [esi], dword es:[edi]
sub ecx, ebx
jnp 0x43a033
iretd
not dword [ebx]
xor byte [0x54617f3c], 0x81
dec ebx
loop 0x439fa6
invalid
push es
jp 0x43a033
fsub dword [ebp + 0x65cb97c3]
sbb eax, 0x3c2e4f77
cmpsb byte [esi], byte es:[edi]
leave
push edi
inc eax
xchg dword [eax - 0x1492c2c5], ebx
cmp esi, dword [eax + 0x27]
dec ecx
in eax, 0x44
sbb ecx, ecx
invalid
xlatb
loopne 0x43a014
jg 0x43a089
mov ecx, 0xe32d4876
int3
mov ebx, 0x86f3b6df
daa
cmp al, 0xe6
add bl, ah
invalid
Function at 0x47d20b
Capabilities:
Encode data using xor

Disassembly:
dec eax
dec esi
shl byte [ebx + eax + 0x49e19cec], 0x38
sbb byte [ecx + 0x10], dl
jle 0x47d12c
push cs
imul esp, dword [ecx - 0x6a], 0x68947f96
mov gs, word [eax - 0x31]
imul esp, dword [edx], 0x4985abb0
mov ds, word [ebx + 0x2a]
or dword [eax], ebx
aad 0x81
sahf
xchg edi, eax
div dword [edx - 0x58]
and eax, 0xc413631d
outsb dx, byte [esi]
test eax, 0x17676e40
jae 0x47d12c
pushfd
dec edi
inc ebp
invalid
dec esp
inc esi
invalid
test al, 0x9d
push ecx
jl 0x47d1d7
dec esp
sub bl, byte [ecx + 0x30]
cmovbe eax, dword [ecx]
wait
add eax, ebx
mov eax, dword [ecx]
mov dl, 0x41
mov eax, dword [0xe721f7c9]
and byte [ecx + 0x65], bl
pop ss
mul dword [ecx]
out 0x20, eax
pop ecx
pop ss
sbb ecx, ebx
stosd dword es:[edi], eax
mov word [eax - 0x79f9bb71], es
push ds
dec edx
push ss
loop 0x47d1a9
mov dl, 0x31
cmp byte [ebx], bh
jne 0x47d16e
jo 0x47d1f1
call 0x23054096
inc ecx
add eax, 0x845abaf5
loope 0x47d151
stosd dword es:[edi], eax
stc
imul esi, dword [0x467b534f], 0xffffff84
push es
jnp 0x47d21f
test byte [esi], al
xor dword [eax - 0x25], 0x8f564d1f
and cl, byte [edi]
inc edx
jnp 0x47d192
dec edi
daa
mov esi, dword [edx]
push ebx
adc dh, byte [eax - 0x62a627bf]
popfd
xchg esi, eax
sbb esi, dword [esi - 0x3e71ee81]
invalid
jge 0x47d1a7
dec esp
inc eax
xor eax, edi
sub eax, 0x1a7fe10e
push 0xd25f238a
rdtsc
out dx, eax
mov ah, byte [ebx]
pop edi
ror byte [edi], cl
xor edi, ebp
inc esp
cmp eax, 0xaf5f640
sar dword [edi + 0x57d44acf], 0x8d
mov edx, 0xde4fc190
cwde
mov ecx, 0x213abebd
js 0x47d217
xor dl, byte [edi]
mov fs, word [ebx - 0x10]
inc edi
sbb bl, byte [ebp + ebx*4 + 0x77d72687]
cmp esp, dword [ecx + 0xf287906]
inc di
inc edi
jg 0x47d1e8
mov cs, word [eax - 0x54]
dec esp
inc ebp
push ebp
push es
sub eax, 0x412b178c
push ebp
xchg esi, eax
xchg edi, eax
je 0x47d2d2
xchg byte [ebx], bh
invalid
sub byte [ebx - 2], 0xde
push 0x70e3fd21
lahf
nop
push es
push eax
fnsave dword [ecx - 0x2dd4efb4]
enter 0x68d2, 0x30
invalid

Function at 0x48860b
Capabilities:
Encode data using xor

Disassembly:
jae 0x48864e
invalid
int1
push eax
pop ecx
out dx, eax
sbb bh, byte [edx + ecx*2 + 0x19]
adc edx, 0x39decb14
mov edx, esp
adc eax, 0x7a9b4ed0
leave
rcr dword [0x494b63ab], 1
nop
fild qword [bp - 0x68]
insb byte es:[edi], dx
test edx, esi
je 0x4886d3
dec ebx
pop ds
nop
dec ebx
push ebp
dec ecx
sti
push ds
ljmp 0xbf8f
adc byte [eax], al
lodsb al, byte [esi]
imul ebp, dword [edi - 0x2cfc5384], 0x8e60d2e1
dec edi
or byte [ebx - 0x7b01b503], al
lds ebp, [ecx]
adc byte [edi + 0xd], 0x98
cwde
add eax, 0xae70be8c
cmpxchg8b qword [edx - 0x3d7b2352]
in eax, 0xc
fisubr dword [esi + ebp*8 + 0x5a]
mov dh, 0x6c
js 0x4886ba
dec esp
mov ah, 0xd9
push eax
sar esp, cl
aaa
invalid
Function at 0x4b078b
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
retf 0x936f
in al, 0x4d
dec ebp
mov byte [edi - 0x14], cl
xor eax, 0x7e3c130d
jecxz 0x4b0733
stosd dword es:[edi], eax
pushal
cmpsb byte [esi], byte es:[edi]
mov ch, 0x89
fmul st(4), st(0)
add dword [edi + eax*2], ebx
clc
pop eax
sbb dword [edi + 0x110c9527], 0x3d0b321d
xchg ebp, eax
or al, 0x11
sbb eax, 0x543d0b32
xchg ebp, eax
or al, 0x11
sbb eax, 0x543d0b32
adc dword [0x543d0b32], ebx
mov cl, 0xc3
add dword ds:[edx], ebp
pop ds
aad 0x24
mov ch, 0x67
dec ebx
sar byte [ebx], 1
neg edx
cld
sub eax, 0xcdca9a36
js 0x4b078d
ja 0x4b0770
cmpsd dword [si], dword es:[di]
and ecx, dword [ecx]
mov eax, dword [0x34d177eb]
pushfd
lds eax, [esi]
in ax, dx
je 0x4b080d
fsubp st(7)
out dx, eax
insb byte es:[edi], dx
mov esp, 0x2b802022
stc
mov ebx, 0xa5136e2d
mov bh, 0xf2
cmpsd dword [esi], dword es:[edi]
call 0x3dea7b7e
idiv ebp
jae 0x4b07cf
stosd dword es:[edi], eax
jae 0x4b0771
cmp eax, 0xf873fdf7
add byte ss:[edi], cl
cdq
cmpsb byte [esi], byte es:[edi]
push ecx
jle 0x4b07be
and eax, dword [esi]
sub eax, 0xbdd79c78
mov eax, dword [0x6da0c88]
add eax, 0xbc5603f7
xlatb
cmp eax, 0x74131425
adc edi, dword [ebp + 0x6cc9b848]
popal
out dx, eax
jge 0x4b087f
int1
ret
pop ds
movsb byte es:[edi], byte [esi]
popal
test al, 0x1f
js 0x4b07f2
scasb al, byte es:[edi]
das
out dx, al
or ebp, dword [edx + edx*8 + 0x5c95f4bc]
mov cl, 0x61
sar byte [esp + esi*8 + 0x61b15c95], cl
mov edi, 0x112b2cc6
and eax, 0x869009c5
xchg edi, eax
salc
aam 0xb8
and dword [ecx - 0x9fc0a5a], esp
invalid
insb byte es:[edi], dx
cmp byte [ebp - 0x3733034d], cl
and ah, byte [edi - 0x57]
enter 0x6722, 0xffffffffffffffa9
jne 0x4b0819
jnp 0x4b0885
mov cl, 0xce
inc esi
out 0x84, eax
xlatb
idiv byte [ecx]
mov dword [0x4ec36d17], eax
jge 0x4b08e6
xor bl, bh
dec edx
jp 0x4b089e
jne 0x4b0902
pop edi
insd dword es:[edi], dx
aaa
dec esp
mov edi, 0x3fa3069a
lds eax, [eax]
push ecx
push ecx
retf 0x944a
sal ebp, 1
in al, 0xd
xor dword [ebp + edi + 0x37], ecx
test dword [edi - 0x23], esi
shr dword [edx - 9], 1
std
bound ebx, qword [eax + 0x77]
adc al, 0x3f
lodsd eax, dword [esi]
jp 0x4b08e8
out dx, eax
and ecx, dword [esp + ebp*4]
xchg ecx, esp
mov dword [edi + esi - 0xaf83b57], ecx
or eax, 0xfd714c7d
and dword [ecx - 0x92fba30], esi
and eax, 0xd37b376f
sal dword [ebx], cl
sub ebp, ebx
cmp ah, byte [0x1346e73d]
xchg ebp, eax
retf
loope 0x4b088d
invalid
Function at 0x4013bd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x14]
mov dword [esi], 0x4031f0
cmp dword [edi], ebx
je 0x401462
push str._mozilla.org_observer_service_1
mov edx, 0x4034ec
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
call fcn.0040119d
mov eax, dword [ebp - 4]
test eax, eax
je 0x401442
mov ecx, dword [eax]
push ebx
push str.profile_change_net_teardown
push ebx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_change_teardown
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_qm
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_telemetry
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor edx, edx
mov ecx, edi
call fcn.00401135
mov eax, dword [ebp - 4]
test eax, eax
je 0x401462
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x401499
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
mov dword [esi + 0xc], ebx
call dword [sym.imp.xul.dll_NS_ShutdownXPCOM]
pop ecx
mov ecx, eax
shr ecx, 0x1f
test cl, 1
je 0x401499
push eax
push str.XPCOM_shutdown_failed_with_code_0x_x
call fcn.004018a3
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 8]
push str.Finished_running__s_tests._n
call fcn.00401a8a
pop ecx
pop ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4014b5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4014c2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x4014ce
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x4014de
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esp, ebp
pop ebp
ret