joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d39
Capabilities:
Encode data using xor

Disassembly:
inc ebp
sbb byte [ebx + 0x453928c7], al
sbb byte [eax + esi*4 + 0x5f], bh
pop esi
pop ebx
pop ebp
ret
push esp
ficom dword [ebx]
jle 0x401d7d
test cl, bh
mov eax, eax
add bl, byte [edx]
jecxz 0x401d0e
inc esp
sub eax, 0xbf5dae93
xchg ebp, eax
salc
cmpsd dword [esi], dword es:[edi]
sbb dword [ecx - 0x86a165], edx
mov edi, 0x5a92e2d7
push ds
ret 0xb283
adc eax, 0x1a82ca05
mov al, byte [0xa87f21c5]
lea eax, [esi + ebx*4]
and dword [ebx - 0x1a], 0x90fcc203
jo 0x401dbb
fiadd word [esi + ebx*4 + 0x11150f9b]
fiadd word [esi + ebx*4 + 0x11150f9b]
outsd dx, dword [esi]
jno 0x401dd5
lcall 0x45a9, 0x79f2e28a
loop 0x401d94
jns 0x401d4d
inc ebp
in eax, dx
fisttp word [eax + 0x28d0e7aa]
xchg edi, eax
mov ah, 0xf0
jbe 0x401e07
pop esp
das
call 0x530c3878
and eax, 0xb8b387e
enter 0xfffffffffffff4d4, 0x5e
cmp byte [ebx - 0xb2b37f5], cl
pop esi
repne outsd dx, dword [esi]
fld qword [edi + edi*4 + 0x5c0a65f5]
fstp qword [ebx]
retf
out 0x5a, eax
adc ebx, edi
dec ecx
lodsb al, byte [esi]
inc esi
rol esi, cl
cmpsb byte [esi], byte es:[edi]
adc byte [ebp - 0x19], ch
cmp eax, 0x9d6a8b6
or al, bl
test bh, al
xchg ecx, eax
and eax, dword [ecx + edi*2]
push ss
add eax, 0x3c3c5a11
jecxz 0x401e51
das
retf 0x48c7
push edx
push cs
push es
pop ebp
dec edx
jns 0x401e44
cmp al, 0xd4
lds eax, [ecx]
xor al, 0xbb
aam 0xc5
add dword [ebx + edi*4], esi
imul esi
sub cl, ch
ja 0x401e0a
mov al, 0x6e
test ebp, edi
je 0x401da0
invalid
xor eax, 0xe46d7bbc
insb byte es:[edi], dx
daa
xchg esp, eax
invalid
push eax
mov byte [ebx], dh
pop ebp
sahf
leave
movsb byte es:[edi], byte [esi]
jb 0x401e79
ja 0x401e02
jb 0x401e77
out dx, eax
rcl dword [esi + 0x38e60ed6], 0x13
mov word [esi - 0x80], ds
movsd dword es:[edi], dword [esi]
adc dword [ecx + 0x706ce895], ebp
insd dword es:[edi], dx
pop esp
and al, 0x8d
adc al, 0x93
dec eax
pop edx
mov ebp, 0xed73290a
les edi, [ecx - 0x37]
xor eax, 0xe64eba7a
dec edx
out 0x4a, al
stosb byte es:[edi], al
popal
test eax, 0xb5a6b57e
idiv dword [edx - 0x4c8e9e9c]
push ecx
cmc
pop eax
xor ah, ah
mov al, 0xa3
xchg ecx, eax
dec esi
les edi, [esi + ebp*4 - 0x78]
mov cl, 0x91
mov ebp, 0x31446350
push esp
xchg esi, eax
out dx, eax
xor al, 0xc
jle 0x401e85
pushal
mov ebx, 0xee6554e4
xchg ebp, eax
mov ch, 0x93
outsd dx, dword [esi]
mov eax, dword [edi + 0x52]
adc eax, 0x887d9ae1
dec ecx
adc eax, 0xa4ea1c62
or byte [ecx + ebp*8], cl
fld xword [ebx + edx*2]
aaa
pop ecx
push esp
adc ecx, ebx
mov dh, 0x24
wait
xor eax, 0x626d4b89
pop eax
invalid
Function at 0x406b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x406be9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406bd3
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406b8c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406bd3
cmp dword [ebp - 0xc], 2
jge 0x406b9e
mov eax, dword [ebp - 4]
call fcn.00403198
mov bl, 1
jmp 0x406bd3
mov edx, dword [ebp - 0xc]
dec edx
lea eax, [ebp - 0x10]
call fcn.00403514
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00403444
push eax
push 0
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406bd3
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406bf0
lea eax, [ebp - 0x10]
call fcn.00403198
ret

Function at 0x40730c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407328
shr eax, 1
xor eax, 0xedb88320
jmp 0x40732a
shr eax, 1
dec edx
jne 0x40731b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407314
pop esi
ret

Function at 0x4087a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
cmp edi, 0x50
jle 0x4087c1
mov eax, esi
mov edx, 0x40a1c4
mov ecx, 0x40
call fcn.0040270c
je 0x4087c6
call fcn.00408738
mov eax, esi
add eax, 0x40
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
not edx
cmp eax, edx
jne 0x4087e5
cmp edi, eax
jne 0x4087e5
cmp dword [ebx], 0xcc
je 0x4087ea
call fcn.00408738
mov eax, ebx
add eax, 0x10
mov ebp, eax
add esi, dword [ebx + 4]
mov dword [esp], esi
mov edx, dword [esp]
sub edx, ebp
mov eax, ebp
call fcn.00407390
cmp eax, dword [ebx + 0xc]
jne 0x408811
mov eax, dword [esp]
cmp byte [eax - 1], 0
je 0x408816
call fcn.00408738
mov bl, 0xcc
mov esi, 0x40b95c
cmp ebp, dword [esp]
jb 0x408827
call fcn.00408738
mov eax, ebp
call fcn.00404cd4
mov edi, eax
mov eax, esi
mov ecx, edi
mov edx, ebp
call fcn.00403278
inc edi
add ebp, edi
add esi, 4
dec bl
jne 0x40881d
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x4f7f2a61
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x17785406
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0xc960b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c96200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc960d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc960c2
add dl, dl
jne 0xc960e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc96134
xor eax, eax
add dl, dl
jne 0xc960ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc961d5
add dl, dl
jne 0xc960fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc96108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc96113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc9611e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc9612a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc960cd
mov eax, 1
add dl, dl
jne 0xc96142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc9614d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc96139
sub eax, ebx
mov ebx, 1
jne 0xc96180
mov ecx, 1
add dl, dl
jne 0xc96166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc96171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc9615d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc960cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc96197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc961a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc9618e
cmp eax, 0x7d00
jae 0xc961c5
cmp eax, 0x500
jb 0xc961c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc960cd
cmp eax, 0x7f
ja 0xc961c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc960cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc961f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc960cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x5ab898
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x24]
jge 0x5ab8b2
mov dword [esp + 0x2c], esi
pushfd
mov word [esp], di
jmp 0x5ab91b
push ecx
pushal
jmp 0x5ab882
mov word [esp], di
mov dword [esp + 0x2c], esi
pushfd
jmp 0x5ab89c

Function at 0x5ab9ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edx
jp 0x5ab9c6
rol ax, cl
push bp
sete bh
setle dh
jmp 0x5ab9cd
jmp 0x5ab998
sete bh
setle dh
bswap eax
mov eax, 0xb1d0d4a
mov byte [esp], al
jmp 0x5ab9d1
rol ax, cl
push bp
jmp 0x5ab9b0
bswap eax
jmp 0x5ab9b8
pop ax
inc ebp
ror eax, cl
jns 0x5aba15
js 0x5ab9ff
movsb byte es:[edi], byte [esi]
aas
scasd eax, dword es:[edi]
retf 0xf739
neg dl
mov edx, dword [esp]
mov dh, al
pushfd
rdtsc

Function at 0x5b053f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x2a8dafe4
xchg word [esp + 1], dx
rol cl, 0
call fcn.005b0506
Function at 0x5b755e
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x59e57a
pushfd
or dword [esp], reloc.ADVAPI32.DLL_RegCloseKey
popfd
cpuid
nop
jmp 0x59e591
pop ebx
ret
mov dword [esp], ebp
lea esp, [esp + 4]
jmp 0x59e56e

Function at 0x5b8190
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
jmp 0x5ea419
push ax
lea esp, [esp + 2]
jmp 0x5ea3f4
mov dword [eax + 8], reloc.ADVAPI32.DLL_RegCloseKey
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
jmp 0x5ea3c7
mov dword [eax + 0x14], reloc.ADVAPI32.DLL_RegCloseKey
ret
and dword [eax + 4], 0
sub esp, 0x10
lea esp, [esp + 0x10]
and dword [eax], 0
jmp 0x5ea3dd

Function at 0x5da423
Capabilities:
Encode data using xor

Disassembly:
cli
pop edx
call fcn.005da44f
pushfd
call 0x5da42f
jb 0x5d9d2a
cmpsd dword cs:[esi], dword es:[edi]
inc ebx
pop ecx
fistp qword [edi]
invalid
push 0x3e
jmp 0x5d9d41
lea esp, [esp + 8]
jne 0x5d9d6a
je 0x5da40d
push dword [esp + 3]
lea esp, [esp + 0xc]

Function at 0x5da4ba
Capabilities:
Encode data using base64

Disassembly:
jmp 0x5da4d8
cmp cl, 0x39
jmp 0x5da558
jmp 0x5d9daf
sub ecx, 0x47
jmp 0x5d9ddc
cmp cl, 0x5a
movzx ecx, cl
jmp 0x5da540
jmp 0x5da4ee
cmp cl, 0x2f
jmp 0x5da4ff
lea esp, [esp + 4]
jne 0x5d9d80
push 0x3e
jmp 0x5d9dac
jne 0x5d9df2
push 0x3f
jmp 0x5d9dac
ja 0x5d9e08
sub esp, 0xf
pop word [esp + 6]
lea esp, [esp + 1]
jmp 0x5da59f
ja 0x5d9e1e
movzx ecx, cl
call fcn.005da52e
shl eax, 6
jmp 0x5da57e
or eax, esi
shl eax, 6
lea ebx, [edx*4]
btr si, ax
jmp 0x5da5c1
lea esp, [esp + 0xc]
sub ecx, 0x41
jmp 0x5d9ddc
or eax, ecx
btc si, sp
not ecx
jmp 0x5da5fe
or eax, edx
xchg dl, bl
shl eax, 6
lea edx, reloc.ADVAPI32.DLL_RegCloseKey
jmp 0x5da5ab
pushal
mov bx, word [esp]
xchg edi, ebx
mov dword [esp + 0x14], eax
cmc
jmp 0x5dac28
lea esp, [esp + 4]
mov ecx, dword [esp + 0xc]
mov esi, eax
lea ebx, [esi*4]
jmp 0x5da5e8
bswap ebx
mov bl, al
mov bl, byte [esp]
jmp 0x5da6cb
mov byte [ecx + 2], al
mov byte [ecx + 1], dl
mov bl, 0xe7
xor eax, eax
jmp 0x5da635
pop ebx
ret
pop esi
sub esp, 0x12
push word [esp + 3]
lea esp, [esp + 0x14]
jmp 0x5da64b
mov edx, eax
not esi
clc
shr edx, 8
rcr bh, cl
jmp 0x5da717
mov byte [ecx], dl
inc ebx
mov bl, byte [esp]
btc ebx, ebp
jmp 0x5da9a4
popal
setle bl
shr edx, 0x10
mov ebx, 0xb145c115
bswap esi
jmp 0x5dab1b

Function at 0x6b7a68
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
jmp 0x6b2006
call fcn.006b200b
call 0x6b685f
jmp 0x6b7a9f
jmp 0x6b7b3d
pop eax
jmp 0x6b7ad4
mov eax, dword [eax + 8]
push eax
jmp 0x6b685a
sub eax, 0x2b685f
push eax
jmp 0x6affa0
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x6b7ab5
lea esp, [esp + 2]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
lea esp, [esp + 8]
mov eax, dword fs:[0x30]
jmp 0x6b7b05
Function at 0x429bce
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00429d7e
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x429ccc
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x429c6f
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x429cb2
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x429c86
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x429ca1
test al, 0x40
je 0x429c98
mov ecx, dword [edi + 0x20]
jmp 0x429c9f
test al, 0x80
je 0x429cb2
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x429cb2
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x429c3e
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x408a52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x408a96
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x408a65
jmp 0x408a96
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x408a86
pop esi
pop ebp
ret

Function at 0x4094ce
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x409503
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40952d
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40952d
test edi, edi
je 0x4094fa
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4094fa
test edi, edi
je 0x409535
mov eax, edi
jmp 0x4094fc
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x4094fc
int3
Function at 0x40c08d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestEndian.exe_gMozillaPoisonSize], eax
call fcn.004094ce
pop ecx
mov ecx, dword [sym.TestEndian.exe_gMozillaPoisonSize]
mov dword [sym.TestEndian.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40c0c5
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestEndian.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x404aa3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov dword [ebp - 4], 0x7f83677c
sub dword [ebp - 4], 0x1715
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mul dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov word [ebp - 0x10], 0
jmp 0x404bc4
mov eax, ebx
add eax, esi
push eax
call fcn.0040423c
pop ecx
mov edx, eax
mov byte [ebp - 5], dl
mov eax, dword [ebp - 4]
mov edx, eax
add edx, eax
mov dword [ebp - 4], edx
cmp byte [ebp - 5], 0
jne 0x404b09
mov byte [ebp - 6], 0
jmp 0x404b33
call 0x409b00
mov dword [ebp - 0x20], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 5]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x20]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 6], dl
mov al, byte [esi + ebx]
cmp al, 0x70
jb 0x404b4e
cmp al, 0x7f
ja 0x404b4e
mov eax, ebx
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 6]
sub edx, ecx
mov byte [eax], dl
movzx eax, byte [esi + ebx]
cmp eax, 0xe2
jne 0x404b69
mov eax, ebx
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 6]
sub edx, ecx
mov byte [eax], dl
mov eax, 0x3e96
mul dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
push 8
push 0x90
lea eax, [ebp - 0xe]
push eax
call 0x409adc
movzx eax, byte [ebp - 5]
push eax
mov eax, ebx
add eax, esi
push eax
lea eax, [ebp - 0xe]
movzx edx, byte [ebp - 6]
add eax, edx
push eax
call 0x409ad0
push 6
lea eax, [ebp - 0xe]
push eax
mov eax, ebx
add eax, esi
push eax
call 0x409ad0
add esp, 0x24
mov eax, dword [ebp - 4]
mov edx, eax
xor edx, eax
mov dword [ebp - 4], edx
add esi, 6
inc word [ebp - 0x10]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x404ae3
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x718d783f
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x61413c0d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219