joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e860
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x54a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x54dce8]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x44e90d
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x44e956
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.004a3810
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.00457700
add esp, 8
push edi
call fcn.0049f973
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.004a3290
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.00457700
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a0403
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.004576e0
add esp, 4
test al, al
je 0x44e959
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x44e95c
xor eax, eax
dec eax
lock cmpxchg dword [0x54dce8], ecx
je 0x44e891
push ecx
call fcn.0051cae0
add esp, 4
mov ecx, dword [0x54dce8]
mov dword [ebp - 0x814], ecx
jmp 0x44e891
int3
int3
push esi
call fcn.004576e0
add esp, 4
test al, al
je 0x44e984
cmp dword [ebp - 0x814], 0xffffffff
je 0x44e984
push 0xffffffffffffffff
call fcn.0051cae0
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x44e92b
int3
Function at 0x457a90
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 8]
test edx, edx
jne 0x457aa8
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [edx]
test ebx, ebx
je 0x457b3f
cmp dword [edx + 0x10], 0
mov dword [ebp - 0x10], edx
jne 0x457ac1
cmp dword [edx + 0x14], 0
je 0x457b2d
xor edi, edi
dec edi
mov eax, dword [edx + 0x1c]
lea ecx, [edi*4]
lea ecx, [ecx + ecx*2]
inc edi
mov ebx, dword [edx]
cmp edi, eax
jge 0x457b2d
lea esi, [ecx + 0xc]
cmp dword [ebx + ecx + 0xc], 0
mov ecx, esi
js 0x457ad1
mov eax, ebx
add eax, esi
je 0x457b2d
mov ecx, dword [edx + 0x10]
test ecx, ecx
je 0x457b0d
mov eax, dword [ebx + esi + 8]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x457b0d
call dword [section..00cfg]
push dword [ebp - 0x14]
call ecx
mov edx, dword [ebp - 0x10]
add esp, 4
mov ecx, dword [edx + 0x14]
test ecx, ecx
je 0x457ac4
mov esi, dword [ebx + esi + 4]
test esi, esi
je 0x457ac4
call dword [section..00cfg]
push esi
call ecx
mov edx, dword [ebp - 0x10]
add esp, 4
jmp 0x457ac4
push ebx
call fcn.0049d940
mov edx, dword [ebp - 0x10]
add esp, 4
mov dword [edx], 0
cmp byte [edx + 0x31], 0
je 0x457aa0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0049d940

Function at 0x459450
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x459486
push esi
call fcn.0045a920
add esp, 4
cmp byte [esi + 0xc], 0
je 0x459471
pop esi
pop ebp
jmp fcn.0049d940
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x18], 0xffffffff
pop esi
pop ebp
ret

Function at 0x45a5c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jg 0x45a633
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x45a65b
mov edx, dword [ecx + 4]
test edx, edx
je 0x45a65b
cmp byte [edx + 2], 0xda
jne 0x45a65b
cmp byte [edx + 3], 0x27
jne 0x45a65b
cmp byte [edx + 8], 0
jne 0x45a65b
cmp byte [edx + 9], 0
jne 0x45a65b
movzx esi, byte [edx + 0xc]
cmp esi, 0x43
jne 0x45a636
cmp byte [edx + 0xd], 0x6d
jne 0x45a65b
cmp byte [edx + 0xe], 0x6e
jne 0x45a65b
cmp byte [edx + 0xf], 0x44
jne 0x45a65b
cmp byte [edx + 0x10], 1
jne 0x45a65b
mov dword [ecx], 0x5434d8
cmp byte [edx + 8], 0
movzx esi, word [edx]
jne 0x45a668
movzx esi, si
add edx, esi
mov dword [ecx + 8], edx
cmp dword [eax], 0
jg 0x45a661
pop esi
pop ebp
ret
cmp esi, 0x54
jne 0x45a65b
cmp byte [edx + 0xd], 0x6f
jne 0x45a65b
cmp byte [edx + 0xe], 0x43
jne 0x45a65b
cmp byte [edx + 0xf], 0x50
jne 0x45a65b
cmp byte [edx + 0x10], 1
jne 0x45a65b
mov dword [ecx], 0x5434e0
jmp 0x45a61d
mov dword [eax], 3
pop esi
pop ebp
jmp fcn.00459450
rol si, 8
jmp 0x45a626
Function at 0x45bbd0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, edx
cmp edx, 4
jb 0x45bc16
nop word cs:[eax + eax]
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x45bbf0
cmp edx, 2
je 0x45bc48
cmp edx, 1
je 0x45bc51
cmp edx, 3
je 0x45bc3f
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 8
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
jmp 0x45bc25
Function at 0x461200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x4612ce
movdqa xmm4, xmmword [0x532370]
movdqa xmm5, xmmword [0x532380]
nop word cs:[eax + eax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm1, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x461250
movdqa xmm4, xmmword [0x532390]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x5323a0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x461352
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x46132b
movdqa xmm1, xmmword [0x5323a0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x5323b0], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x5323c0], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x5323d0], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret

Function at 0x463fd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x46404e
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x464037
lea eax, [edi + 1]
cmp eax, 2
jb 0x46401b
mov dword [esi], edi
call fcn.004674a0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
invalid
Function at 0x464300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
clc
clc
jae 0x464306
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x4642f7
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004640b2
push ebx
mov edx, 0x458d7602
test al, 0x50
call fcn.004640c2
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00464077
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4643a0
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004640b2
das
lcall 0x50c0, 0x458d2bd5
call fcn.004640c2
push eax
push esi
push dword [ebp + 8]
jne 0x46440a
Function at 0x464430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
in eax, dx
salc
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004640c2
push eax
push esi
push dword [ebp + 8]
call fcn.00464077
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004640c2
push eax
push esi
push dword [ebp + 8]
call fcn.00464077
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
inc ebp
loopne 0x46454d

Function at 0x464500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
loopne 0x46454d
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004640c2
push eax
push esi
push dword [ebp + 8]
call fcn.00464077
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004640b2
scasd eax, dword es:[edi]
mov edx, 0x9d88a53d
jl 0x464537
invalid
invalid
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], pe_nt_image_headers32
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004640b2
int 0xe4
cmpxchg dword [ebp - 0x837b], ecx
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x464730
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x464766
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x464761
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x46474b
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x464753
cmp edx, ebx
jne 0x4648a1
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x464722
add eax, dword [eax + 4]
jmp 0x46470f
mov dword [ebp + 0xc], ebx
jmp 0x464771

Function at 0x464780
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x464789
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4647a7
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
invalid
mov ch, 0x54

Function at 0x464950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.004640c2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00464077
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004640c2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00464077
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
invalid
test dword [edi], esp
cld
invalid
Function at 0x464cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.004640c2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00464077
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.004640b2
Function at 0x4659c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x6f4], 0
and byte [ebp - 0x6f3], 0
mov byte [ebp - 0x6f2], 0x43
and byte [ebp - 0x6f1], 0
mov byte [ebp - 0x6f0], 0xeb
mov byte [ebp - 0x6ef], 0xce
mov byte [ebp - 0x6ee], 0xd5
mov byte [ebp - 0x6ed], 0xc8
mov byte [ebp - 0x6ec], 0xd9
mov byte [ebp - 0x6eb], 0xfa
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.004640b2
jecxz 0x465a61
push esi
xchg ebp, eax
lea eax, [ebp - 0x6f4]
push eax
call fcn.004640c2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00464077
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x466158
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x465c2d
sar ch, 1
invalid
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
invalid
invalid
mov dl, 0xf8
invalid
invalid
Function at 0x469060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x30], ecx
mov eax, dword [0x54a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [0x54f874]
and eax, 1
neg eax
cmp eax, 0xfffffffd
je 0x469174
mov esi, edx
xor ecx, ecx
xor edx, edx
dec edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov eax, dword [ecx*8 + 0x534bd0]
test eax, eax
je 0x469178
mov dword [ebp - 0x2c], ecx
mov ebx, dword [ecx*8 + 0x534bd4]
mov byte [ebp - 0x11], bl
lea ecx, [ebp - 0x1c]
cmp ecx, eax
ja 0x4690d2
lea ecx, [ebx*2 - 0x1c]
add ecx, ebp
cmp ecx, eax
ja 0x4691aa
lea ecx, [ebx + ebx]
push ecx
push eax
lea edi, [ebp - 0x1c]
push edi
call fcn.004a3290
add esp, 0xc
mov word [ebp + ebx*2 - 0x1c], 0
movzx ebx, byte [ebp - 0x11]
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov ecx, ebx
test bl, bl
jns 0x4690fe
mov ecx, dword [ebp - 0x18]
mov eax, edx
mov dword [ebp - 0x24], edx
cmp esi, ecx
mov edx, ecx
cmovb edx, esi
test edx, edx
js 0x469196
cmp ecx, esi
ja 0x469159
test edx, edx
je 0x46912c
xor esi, esi
mov edi, dword [ebp - 0x30]
movzx edi, word [edi + esi*2]
cmp di, word [eax + esi*2]
jne 0x469159
inc esi
cmp edx, esi
jne 0x46911a
mov dword [ebp - 0x20], ecx
mov al, 1
test bl, bl
mov esi, dword [ebp - 0x28]
js 0x469199
test al, al
mov ecx, dword [ebp - 0x2c]
mov edx, 0xffffffff
jne 0x46915d
inc ecx
movzx eax, byte [0x54f874]
xor eax, 3
cmp ecx, eax
jb 0x469095
jmp 0x469174
xor eax, eax
jmp 0x469131
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a0403
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x469160
push str.string_view::string_view__CharT___size_t_:_received_nullptr
push str.__len__0____s___nullptr
push 0x136
push str....._buildtools_third_partylibc_trunkinclude_string_view
push str._s:_d:_assertion__s_failed:__s
call fcn.004cb230
int3
push dword [ebp - 0x24]
mov edi, eax
call fcn.0049f94a
mov eax, edi
add esp, 4
jmp 0x469138
push str.char_traits::copy_overlapped_range
push str.__s2_____s1____s2_____s1__n
push 0x138
push str....._buildtools_third_partylibc_trunkinclude__stringchar_traits.h
jmp 0x46918c
Function at 0x46dfb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x54a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x55a154]
mov ecx, dword [0x54ddb0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46e000
mov esi, dword [0x55a150]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a0403
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x55a154
call fcn.0049f9b7
add esp, 4
cmp dword [0x55a154], 0xffffffff
jne 0x46dfe3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.004a3810
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.0049f91a
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x55a184]
mov ecx, dword [0x54ddb0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x46e0a9
mov ecx, esi
push ebx
push 0x55a160
push edi
call fcn.0042d660
mov dword [0x55a150], esi
push 0x55a154
call fcn.0049fa2d
add esp, 4
jmp 0x46dfe3
push 0x55a184
call fcn.0049f9b7
add esp, 4
cmp dword [0x55a184], 0xffffffff
jne 0x46e083
xorps xmm0, xmm0
movups xmmword [0x55a170], xmm0
movups xmmword [0x55a160], xmm0
mov dword [0x55a180], 0
push 0x55a160
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x55a184
call fcn.0049fa2d
add esp, 4
jmp 0x46e083
Function at 0x475eb0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [0x55d3c8]
test dl, 1
je 0x475ecf
call fcn.004788a0
pop ebp
jmp fcn.00478f80
test ecx, ecx
je 0x475ede
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x475ee0
pop ebp
ret
int3

Function at 0x4789e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp edx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
cmovb eax, edx
test eax, eax
je 0x478a85
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebx + esi*4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + esi*4]
mov ebx, ecx
xor ebx, eax
mov edx, ecx
sub edx, eax
lea eax, [ebx - 1]
xor edx, ecx
or edx, ebx
not ebx
and eax, ebx
mov ebx, dword [ebp + 8]
sar eax, 0x1f
xor edx, ecx
sar edx, 0x1f
mov ecx, edx
not edx
and edx, 1
or edx, ecx
mov ecx, eax
and ecx, edi
not eax
and eax, edx
or eax, ecx
mov ecx, dword [ebp - 0x18]
inc esi
mov edi, eax
cmp dword [ebp - 0x1c], esi
jne 0x478a0c
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
cmp edx, esi
jb 0x478a65
ja 0x478a89
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
or ecx, dword [ebx + edx*4]
inc edx
cmp esi, edx
jne 0x478a67
mov edx, ecx
not edx
dec ecx
and ecx, edx
sar ecx, 0x1f
mov edx, ecx
and edx, eax
not ecx
or ecx, edx
mov eax, ecx
jmp 0x478a5d
xor eax, eax
jmp 0x478a51
mov esi, ecx
xor edx, edx
mov ecx, dword [ebp - 0x10]
or edx, dword [esi + ecx*4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], ecx
jne 0x478a8d
mov ecx, edx
not ecx
dec edx
and edx, ecx
sar edx, 0x1f
mov ecx, edx
and ecx, eax
not edx
and edx, 1
or edx, ecx
mov eax, edx
jmp 0x478a5d