joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4204c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4205dc
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x420550
cmp cl, 2
jne 0x4205c4
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00421130
lea eax, [0x711c54]
mov dword [esp], eax
call fcn.0040c0c0
lea eax, [0x711c30]
test byte [eax], al
mov eax, dword [0x711c48]
mov ecx, dword [0x711c30]
sub eax, ecx
mov dword [0x711c48], eax
mov eax, dword [0x711c3c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x711c3c], ecx
lea eax, [0x711c54]
mov dword [esp], eax
call fcn.0040c290
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.00411ec0
lea eax, [0x711c54]
mov dword [esp], eax
call fcn.0040c0c0
lea eax, [0x711c0c]
test byte [eax], al
mov eax, dword [0x711c24]
mov ecx, dword [0x711c0c]
sub eax, ecx
mov dword [0x711c24], eax
mov eax, dword [0x711c18]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x711c18], ecx
lea eax, [0x711c54]
mov dword [esp], eax
call fcn.0040c290
jmp 0x42054c
lea eax, [0x5f1296]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00426d70
ud2
call fcn.0044a3c0
jmp fcn.004204c0
Function at 0x43eb80
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x10
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0x1d0]
inc ecx
mov dword [eax + 0x1d0], ecx
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
lea edx, [ecx + 0xc4]
test byte [edx], al
mov edx, eax
mov dword [ecx + 0xc4], eax
lea eax, [edx + 0x88]
test byte [eax], al
mov eax, dword [edx + 0x18]
mov dword [edx + 0x88], eax
mov dword [esp], 0
lea eax, [0x6019cc]
mov dword [esp + 4], eax
call fcn.00425a90
test eax, eax
jne 0x43ec7b
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x21c]
test byte [ecx], al
mov edx, dword [esp + 0x14]
mov dword [eax + 0x21c], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x220], edx
lea edx, [esp + 0x1c]
mov dword [eax + 0x224], edx
mov edx, dword [0x70bd58]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004024a0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x228]
mov edx, dword [eax + 0x22c]
mov eax, dword [eax + 0x230]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
nop
call fcn.004262b0
add esp, 0x10
ret
nop
call fcn.004262b0
add esp, 0x10
ret
Function at 0x443f20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x443fbf
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0044be27
lea ecx, [0x449cb0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0044a2a0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0044a3c0
jmp fcn.00443f20
Function at 0x44b750
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x44b790
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x71df00]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x44b7cb
je 0x44b81a
cmp ebx, 0x20
jbe 0x44b820
cmp ebx, 0x40
jbe 0x44b85e
jmp 0x44b8ef
test ebx, ebx
je 0x44b810
add eax, 0x10
test ax, 0xff0
je 0x44b7fc
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x620700]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x620800]
jmp 0x44b7e8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x44b7e8
pxor xmm1, xmmword [0x71df10]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x71df10]
pxor xmm2, xmmword [0x71df20]
pxor xmm3, xmmword [0x71df30]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x71df10]
pxor xmm2, xmmword [0x71df20]
pxor xmm3, xmmword [0x71df30]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x44b94e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
Function at 0x44c870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x238
mov dword [esp], esp
mov dword [esp + 4], 0x238
call fcn.0044c350
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.0044c350
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44c910
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xb70
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.0044b6b0
call fcn.0042ab10
ret
Function at 0x47c4e0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47c588
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x47c54f
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x47c539
call fcn.0044a3c0
jmp fcn.0047c4e0
Function at 0x48b9c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48bae2
sub esp, 0x4c
mov eax, dword [esp + 0x64]
test eax, eax
jle 0x48badb
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x40], ecx
mov eax, dword [0x70be74]
mov dword [esp], eax
call fcn.0048a050
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov dword [esp], eax
mov dword [esp + 4], 7
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.0043eda0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x48bad5
test ecx, ecx
je 0x48bac7
cmp ecx, 0x3e5
jne 0x48ba9b
mov ecx, dword [0x707674]
mov edx, dword [0x707670]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
lea eax, [0x61ebc0]
mov dword [esp], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
call fcn.0040b780
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x38]
jmp 0x48ba8b
lea ecx, [0x61d330]
lea edx, [0x61ebc0]
jmp 0x48ba8b
xor edx, edx
mov ecx, edx
jmp 0x48ba8b
xor ecx, ecx
jmp 0x48b9e9
call fcn.0044a3c0
jmp fcn.0048b9c0
Function at 0x48d1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48d2af
sub esp, 0x54
mov eax, dword [0x70bf54]
mov dword [esp], eax
call fcn.0048a050
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 8
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call fcn.0043eda0
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x48d28b
xor eax, eax
mov ecx, eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], eax
add esp, 0x54
ret
mov dword [esp + 0x38], eax
lea eax, [0x61ebc0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040b780
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
jmp 0x48d27f
call fcn.0044a3c0
jmp fcn.0048d1c0

Function at 0x48d720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48d82c
sub esp, 0x4c
mov eax, dword [0x70bfac]
mov dword [esp], eax
call fcn.0048a050
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 9
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], eax
call fcn.0043eda0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
cmp eax, 0xffffffff
jne 0x48d826
test ecx, ecx
je 0x48d818
cmp ecx, 0x3e5
jne 0x48d7f4
mov eax, dword [0x707670]
mov ecx, dword [0x707674]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], ecx
lea eax, [0x61ebc0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040b780
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
jmp 0x48d7e8
lea ecx, [0x61d2d0]
lea eax, [0x61ebc0]
jmp 0x48d7e8
xor ecx, ecx
mov eax, ecx
jmp 0x48d7e8
call fcn.0044a3c0
jmp fcn.0048d720
Function at 0x4d78d0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d7aed
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x4d7987
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x4d7a00
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x4d7968
cmp ecx, 0xf
jne 0x4d7a79
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x4d7968
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x4d7968
call fcn.0044a3c0
jmp fcn.004d78d0
Function at 0x4f53e0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4f559c
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x4f5409
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x4f5403
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x4f5403
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x4f558e
cmp al, 0x2c
ja 0x4f556b
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x4f543d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x4f5437
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x4f5437
cmp al, 0x2f
ja 0x4f5531
cmp al, 0x26
ja 0x4f5509
cmp al, 0x24
jne 0x4f54fe
cmp ecx, 2
jg 0x4f54b4
cmp ecx, 1
je 0x4f54a9
cmp ecx, 2
jne 0x4f54a3
cmp al, 0x2f
jne 0x4f5483
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
jne 0x4f548f
mov eax, 1
jmp 0x4f547e
cmp al, 0x2c
jne 0x4f549b
mov eax, 1
jmp 0x4f547e
cmp al, 0x3f
sete al
jmp 0x4f547e
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x4f54e8
cmp al, 0x40
jne 0x4f54c8
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
jne 0x4f54d4
mov eax, 1
jmp 0x4f54c3
cmp al, 0x3f
jne 0x4f54e0
mov eax, 1
jmp 0x4f54c3
cmp al, 0x3a
sete al
jmp 0x4f54c3
cmp ecx, 6
je 0x4f54f8
cmp ecx, 7
jne 0x4f54a3
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x4f5465
jmp 0x4f54a3
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x4f5465
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x4f5523
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x4f5465
jmp 0x4f54a3
cmp al, 0x3d
ja 0x4f5550
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x4f5465
cmp al, 0x3d
je 0x4f5465
jmp 0x4f54a3
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x4f5465
cmp al, 0x5f
je 0x4f551d
cmp al, 0x7e
je 0x4f551d
jmp 0x4f54a3
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x4f5437
cmp al, 0x5b
je 0x4f5437
cmp al, 0x5d
je 0x4f5437
jmp 0x4f544a
cmp ecx, 4
je 0x4f5426
jmp 0x4f544a
call fcn.0044a3c0
jmp fcn.004f53e0
Function at 0x56a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56a186
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x56a17f
mov ecx, dword [eax]
lea eax, [0x5dfe20]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
call fcn.00405d90
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044be24
lea eax, [0x5dfe20]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call fcn.00406ca0
jmp 0x56a080
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.00406f80
mov eax, dword [esp + 0x44]
test eax, eax
je 0x56a173
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + 8]
mov dword [esp + 0x2c], edx
mov ebx, dword [ecx + 4]
mov dword [esp + 0x28], ebx
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
mov ebp, dword [eax + 4]
mov dword [esp + 0x30], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
lea esi, [0x5b5d40]
mov dword [esp], esi
mov dword [esp + 4], ebx
mov dword [esp + 8], ebx
call fcn.004387d0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
lea ebx, [0x5b5d40]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call fcn.0040e8c0
lea eax, [0x5dfe20]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call fcn.00409180
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x71de50]
test ecx, ecx
jne 0x56a15e
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x56a074
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0040e560
jmp 0x56a074
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x56a027
call fcn.0044a3c0
jmp fcn.0056a000
Function at 0x56abb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56ad36
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x56ad2f
mov ecx, dword [eax]
lea eax, [0x5dfe20]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
call fcn.00405d90
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044be24
lea eax, [0x5dfe20]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call fcn.00406ca0
jmp 0x56ac30
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.00406f80
mov eax, dword [esp + 0x44]
test eax, eax
je 0x56ad23
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + 8]
mov dword [esp + 0x2c], edx
mov ebx, dword [ecx + 4]
mov dword [esp + 0x28], ebx
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
mov ebp, dword [eax + 4]
mov dword [esp + 0x30], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
lea esi, [0x5b5d40]
mov dword [esp], esi
mov dword [esp + 4], ebx
mov dword [esp + 8], ebx
call fcn.004387d0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
lea ebx, [0x5b5d40]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call fcn.0040e8c0
lea eax, [0x5dfe20]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call fcn.00409180
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x71de50]
test ecx, ecx
jne 0x56ad0e
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x56ac24
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0040e560
jmp 0x56ac24
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x56abd7
call fcn.0044a3c0
jmp fcn.0056abb0
Function at 0x40d3c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40d411
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40d3e0
jmp 0x40d411
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40d401
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40e476
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40e4ab
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40e4d5
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40e4d5
test edi, edi
je 0x40e4a2
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40e4a2
test edi, edi
je 0x40e4dd
mov eax, edi
jmp 0x40e4a4
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40e4a4
mov esi, 0xc4
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push 0x415656
call fcn.004120f6
add esp, 0xc
int3