joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439d3c
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2d4
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea ecx, [ebp - 0x22c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov ebx, 0x80
lea eax, [ebx + ebx]
lea ecx, [ebp - 0x22c]
push eax
call fcn.00422528
mov dword [ebp - 0x2d4], 0xffffffff
shl ebx, 3
push 3
lea eax, [ebp - 0x2d4]
push eax
push ebx
push dword [ebp - 0x22c]
push dword [ebp + 8]
call sub.KERNEL32.dll_K32EnumProcessModulesEx
test eax, eax
je 0x439df5
mov esi, dword [ebp - 0x2d4]
mov ebx, esi
shr ebx, 2
mov edi, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x228]
sub ecx, edi
sar ecx, 2
cmp ebx, ecx
ja 0x439d67
mov dword [ebp - 0x2dc], eax
lea eax, [ebp - 0x218]
push 0x208
push 0xff
push eax
call fcn.005dfe70
add esp, 0xc
cmp esi, 4
lea esi, [ebp - 0x2d4]
jae 0x439e73
mov esi, dword [ebp - 0x2dc]
jmp 0x439e3e
mov esi, eax
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x439e3e
call fcn.004b7210
lea edi, [ebp - 0x218]
mov ecx, edi
push eax
push 2
push 0x1f
push str.....chromechrome_cleanerosprocess.cc
call fcn.004b73b0
lea eax, [ebp - 0x210]
push 0x1b
push str.Failed_to_enumerate_modules
push eax
call fcn.0041482a
add esp, 0xc
mov ecx, edi
call fcn.004b7460
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x439e57
mov dword [ebp - 0x228], eax
push eax
call fcn.005dc756
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0x2d4
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
inc eax
cmp ebx, 2
cmovae eax, ebx
dec eax
mov dword [ebp - 0x2e0], eax
xor ebx, ebx
push 0x104
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2d8], ebx
push dword [edi + ebx*4]
push dword [ebp + 8]
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x439ec2
mov ebx, eax
cmp eax, 0x7ffffff0
jae 0x439fa2
cmp ebx, 5
jae 0x439f0f
mov byte [ebp - 0x2c9], bl
mov edi, esi
jmp 0x439f41
push 2
call fcn.004b68d0
add esp, 4
test al, al
mov ebx, dword [ebp - 0x2d8]
je 0x439f8a
call fcn.004b7210
mov ecx, esi
push eax
push 2
push 0x2c
push str.....chromechrome_cleanerosprocess.cc
call fcn.004b73b0
push 0x1d
push str.Failed_to_get_module_filename
lea eax, [ebp - 0x2cc]
push eax
call fcn.0041482a
add esp, 0xc
mov ecx, esi
call fcn.004b7460
jmp 0x439f8a
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.005dc726
add esp, 4
mov edi, eax
mov dword [ebp - 0x2d4], eax
or esi, 0x80000000
mov dword [ebp - 0x2cc], esi
lea esi, [ebp - 0x2d4]
mov dword [ebp - 0x2d0], ebx
mov eax, ebx
add eax, ebx
push eax
lea eax, [ebp - 0x218]
push eax
push edi
call fcn.005df8f0
add esp, 0xc
mov word [edi + ebx*2], 0
mov ecx, dword [ebp + 0xc]
push esi
push esi
lea eax, [ebp - 0x220]
push eax
call fcn.0043a2c6
cmp byte [ebp - 0x2c9], 0
jns 0x439f84
push dword [ebp - 0x2d4]
call fcn.005dc756
add esp, 4
mov ebx, dword [ebp - 0x2d8]
cmp dword [ebp - 0x2e0], ebx
je 0x439ded
mov edi, dword [ebp - 0x22c]
inc ebx
jmp 0x439e85
call fcn.005f1440
Function at 0x441de8
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x441e36
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x441e10
cmp edx, 1
je 0x441e57
cmp edx, 2
je 0x441e4e
cmp edx, 3
jne 0x441e62
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4

Function at 0x4427c0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, ecx
xor eax, eax
xor ecx, ecx
cpuid
test eax, eax
jle 0x4428b9
mov esi, eax
mov dword [ebp - 0x14], edi
mov eax, 1
xor ecx, ecx
cpuid
mov dword [ebp - 0x10], ecx
mov edi, eax
cmp esi, 7
mov ebx, 0
jb 0x442806
mov eax, 7
xor ecx, ecx
mov esi, edx
cpuid
mov edx, esi
and ebx, 0x20
mov ecx, dword [ebp - 0x14]
mov dword [ecx], edi
mov eax, edi
and eax, 0xf
mov dword [ecx + 8], eax
shr edi, 0xc
and edi, 3
mov dword [ecx + 4], edi
mov edi, ecx
mov eax, edx
shr eax, 0x17
and al, 1
mov byte [ecx + 0xc], al
mov eax, edx
shr eax, 0x19
and al, 1
mov byte [ecx + 0xd], al
shr edx, 0x1a
and dl, 1
mov byte [ecx + 0xe], dl
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and al, 1
mov byte [edi + 0xf], al
mov eax, ecx
shr eax, 9
and al, 1
mov byte [edi + 0x10], al
mov eax, ecx
shr eax, 0x13
and al, 1
mov byte [edi + 0x11], al
mov eax, ecx
shr eax, 0x14
and al, 1
mov byte [edi + 0x12], al
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [edi + 0x13], al
mov eax, ecx
shr eax, 0x1f
mov byte [edi + 0x19], al
mov eax, ecx
not eax
test eax, 0x1c000000
jne 0x44288e
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
jmp 0x442890
xor eax, eax
mov byte [edi + 0x14], al
mov edx, dword [ebp - 0x10]
mov ecx, edx
shr ecx, 0x19
and cl, 1
mov byte [edi + 0x17], cl
shr edx, 0xc
and dl, 1
mov byte [edi + 0x15], dl
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [edi + 0x16], cl
mov eax, SysReAllocString
xor ecx, ecx
cpuid
cmp eax, reloc.OLEAUT32.dll_SysStringLen
jle 0x4428de
mov eax, VariantCopy
xor ecx, ecx
cpuid
and dh, 1
mov byte [edi + 0x18], dh
test dh, dh
jne 0x442910
jmp 0x4428e5
mov dh, byte [edi + 0x18]
test dh, dh
jne 0x442910
cmp byte [edi + 0x19], 0
je 0x442910
mov eax, 0x40000000
xor ecx, ecx
cpuid
cmp ebx, 0x7263694d
jne 0x442910
cmp ecx, 0x666f736f
jne 0x442910
cmp edx, 0x76482074
jne 0x442910
mov byte [edi + 0x18], 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [ecx + 0x8f4]
mov ebx, dword [ecx + 0x8f8]
add ebx, eax
mov eax, dword [ecx + 0x8ec]
mov ecx, ebx
sub ecx, eax
cmp ecx, 0x40000001
jb 0x444436
push dword [ebp + 8]
call fcn.004441b0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [esp + 0xc]
test eax, eax
mov ecx, 0x40000000
mov edi, 0xaf000000
cmove edi, ecx
mov dword [esp + 0x54], 0x365f776f
mov dword [esp + 0x50], 0x775f7369
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x50]
push eax
call fcn.00410cd0
add esp, 4
cmp ebx, edi
jbe 0x444496
push ebx
call fcn.004441e0
mov dword [esp + 0x44], 0x657a69
mov dword [esp + 0x40], 0x735f6176
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x40]
push eax
call fcn.00410cd0
add esp, 4
mov eax, dword [esi + 0x8fc]
mov dword [esp + 0x34], 0x20200063
mov dword [esp + 0x30], 0x6f6c6c61
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
lea eax, [esp + 0x30]
push eax
call fcn.00410cd0
add esp, 4
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov eax, dword [esi + 0x8ec]
mov dword [esp + 0x14], 0x20007469
mov dword [esp + 0x10], 0x6d6d6f63
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x10]
push eax
call fcn.00410cd0
add esp, 4
mov dword [esp + 0x24], 0x20202000
mov dword [esp + 0x20], 0x657a6973
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x20]
push eax
call fcn.00410cd0
add esp, 4
mov ecx, dword [0x683864]
test ecx, ecx
je 0x444569
call dword [section..00cfg]
push esi
call ecx
add esp, 4
push esi
call fcn.00442200
int3
Function at 0x44f5e0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ebx, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x28], eax
test ebx, ebx
je 0x44f81c
cmp dword [0x675ce8], 0xe69e32f3
jne 0x44f81f
mov ecx, dword [ebx + 8]
lea esi, [ecx + 0x1c8]
mov byte [esp + 0xf], 0xff
lea edx, [ecx - 0x7fe38]
mov eax, esi
cmp edx, 0xfff80101
jb 0x44f665
cmp byte [ebx + 3], 0
mov eax, esi
jne 0x44f665
add ecx, 0x1c7
je 0x44f648
bsr ecx, ecx
xor ecx, 0x1f
jmp 0x44f64d
mov ecx, 0x20
neg cl
mov edx, 1
shl edx, cl
mov eax, edx
shr eax, 1
lea eax, [eax + eax*4]
shr eax, 2
cmp eax, esi
cmovb eax, edx
mov dword [esp + 4], esi
mov edx, 0x20
mov esi, 0x20
test eax, eax
je 0x44f67d
bsr esi, eax
xor esi, 0x1f
mov ecx, 0x61fe68
sub ecx, esi
mov cl, byte [ecx]
mov edi, eax
shr edi, cl
sub edx, esi
and edi, 3
and eax, dword [edx*4 + 0x61fe6c]
lea ecx, [edi + edx*4]
cmp eax, 1
sbb ecx, 0xffffffff
movzx esi, word [ecx + ecx + 0x61fd3c]
shl esi, 5
mov eax, ebx
add ebx, esi
add ebx, 0x48
lea edi, [eax + 0x40]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x44f6c6
mov ecx, edi
call fcn.00446380
mov dword [esp + 8], edi
mov eax, dword [ebx]
mov edi, dword [eax]
test edi, edi
je 0x44f799
mov byte [esp + 0xf], 0
mov edx, dword [edi]
test edx, edx
je 0x44f70f
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx + esi + 0x54]
mov ecx, edx
bswap ecx
mov esi, ecx
xor esi, edi
cmp esi, 0x1fffff
ja 0x44f7ea
mov esi, ecx
and esi, 0x1fc000
je 0x44f7ea
prefetcht0 byte [ecx]
jmp 0x44f711
xor ecx, ecx
mov esi, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov eax, dword [eax + 8]
mov ecx, dword [esi + 0x8fc]
add ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x900]
mov dword [esi + 0x8fc], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [esi + 0x900], ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, edi
push esi
call fcn.0044f840
push edi
push dword [0x6844cc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x678164]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x90], edi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.005dd6f3
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 0xf]
mov ecx, ebx
push eax
push 0x4000
push dword [esp + 0xc]
push 2
mov esi, dword [ebp + 8]
push esi
call fcn.004432b0
test eax, eax
je 0x44f815
mov edi, eax
mov ecx, eax
and ecx, 0xffe00000
mov edx, eax
shr edx, 9
and edx, 0xfe0
lea eax, [edx + ecx]
movzx ecx, byte [edx + ecx + 0x101e]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
add eax, 0x1000
jmp 0x44f72d
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
lea esi, [esp + 0x10]
mov ecx, esi
push edx
push str.first
call fcn.00443ed0
push esi
call fcn.00410cd0
add esp, 4
mov ecx, ebx
call fcn.00444150
xor edi, edi
jmp 0x44f750
int3
int3
Function at 0x4503d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x4503e1
test eax, eax
jne 0x450431
test eax, eax
jne 0x4503f7
mov ecx, dword [0x684518]
test ecx, ecx
je 0x4503f7
call dword [section..00cfg]
call ecx
cmp dword [0x684510], 0
je 0x450431
mov esi, dword [0x684514]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x450437
test esi, esi
je 0x450431
mov ecx, dword [0x684510]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x45041f
jmp 0x450431
Function at 0x463fa0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movzx eax, cx
shr ecx, 0x10
mov edx, ebx
and edx, 0x1f
mov dword [ebp - 0x10], edx
cmp ebx, 0x20
jae 0x463fcc
mov esi, eax
jmp 0x4640de
shr ebx, 5
movdqa xmm0, xmmword [0x620e40]
pxor xmm2, xmm2
movdqa xmm3, xmmword [0x620e30]
nop word cs:[eax + eax]
cmp ebx, 0xad
mov esi, 0xad
mov dword [ebp - 0x18], ebx
cmovb esi, ebx
mov edx, eax
imul edx, esi
movd xmm5, edx
movd xmm4, ecx
mov ecx, esi
shl ecx, 5
mov dword [ebp - 0x14], esi
mov edx, esi
pxor xmm6, xmm6
mov esi, edi
nop
movdqu xmm7, xmmword [esi]
movdqa xmm1, xmm7
pmaddubsw xmm7, xmmword [0x620e20]
pmaddwd xmm7, xmm3
paddd xmm7, xmm4
movdqu xmm4, xmmword [esi + 0x10]
paddd xmm5, xmm6
psadbw xmm1, xmm2
paddd xmm1, xmm6
movdqa xmm6, xmm4
psadbw xmm6, xmm2
paddd xmm6, xmm1
pmaddubsw xmm4, xmm0
pmaddwd xmm4, xmm3
paddd xmm4, xmm7
add esi, 0x20
dec edx
jne 0x464020
add edi, ecx
pslld xmm5, 5
paddd xmm4, xmm5
pshufd xmm1, xmm6, 0xb1
paddd xmm1, xmm6
pshufd xmm5, xmm1, 0xee
paddd xmm5, xmm1
movd esi, xmm5
add esi, eax
pshufd xmm1, xmm4, 0xb1
paddd xmm1, xmm4
pshufd xmm4, xmm1, 0xee
mov eax, esi
mov ecx, 0x80078071
mul ecx
mov ebx, edi
mov edi, edx
paddd xmm4, xmm1
movd ecx, xmm4
shr edi, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, edi, 0xfff1
mov edi, ebx
sub esi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov eax, esi
mov ebx, dword [ebp - 0x18]
sub ebx, dword [ebp - 0x14]
jne 0x463ff0
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4641b0
cmp ebx, 0x10
jb 0x464179
movzx eax, byte [edi]
add esi, eax
add ecx, esi
movzx eax, byte [edi + 1]
add eax, esi
add ecx, eax
movzx edx, byte [edi + 2]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 3]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 4]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 5]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 6]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 7]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 8]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 9]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 0xa]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 0xb]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 0xc]
add edx, eax
add ecx, edx
movzx eax, byte [edi + 0xd]
add eax, edx
add ecx, eax
movzx edx, byte [edi + 0xe]
add edx, eax
add ecx, edx
movzx esi, byte [edi + 0xf]
add esi, edx
add ecx, esi
add ebx, 0xfffffff0
je 0x46418d
add edi, 0x10
xor eax, eax
nop dword [eax + eax]
movzx edx, byte [edi + eax]
add esi, edx
add ecx, esi
inc eax
cmp ebx, eax
jne 0x464180
lea eax, [esi - 0xfff1]
cmp esi, 0xfff1
cmovae esi, eax
mov edx, 0x80078071
mov eax, ecx
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
shl ecx, 0x10
or ecx, esi
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4641c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x4642ae
nop word cs:[eax + eax]
movdqa xmm6, xmm0
movdqa xmm5, xmmword [0x620e50]
pclmulqdq xmm6, xmm5, 0
movdqa xmm5, xmmword [0x620e60]
pclmulqdq xmm0, xmm5, 0x11
movdqa xmm7, xmm0
pxor xmm7, xmm6
movdqa xmm0, xmm3
movdqa xmm4, xmmword [0x620e50]
pclmulqdq xmm0, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
movdqa xmm6, xmm3
pxor xmm6, xmm0
movdqa xmm0, xmm2
pclmulqdq xmm0, xmm4, 0
movdqa xmm3, xmm4
pclmulqdq xmm2, xmm5, 0x11
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm0, xmm1
pclmulqdq xmm0, xmm3, 0
pclmulqdq xmm1, xmm5, 0x11
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqu xmm0, xmmword [ecx]
pxor xmm0, xmm7
movdqu xmm3, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm2, xmmword [ecx + 0x20]
pxor xmm2, xmm4
movdqu xmm1, xmmword [ecx + 0x30]
pxor xmm1, xmm5
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x464200
movdqa xmm4, xmmword [0x620e70]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x620e80]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x464337
nop dword [eax + eax]
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x464310
movdqa xmm1, xmmword [0x620e80]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x620e90], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x620ea0], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x620eb0], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x478b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ecx + 0x18]
push 0
push dword [ebp + 8]
call fcn.004fa080
mov ecx, dword [esi + 0x18]
pop esi
pop ebp
jmp fcn.004fa1f0

Function at 0x4794b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov ebx, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esi + 0x78], eax
mov ecx, dword [ecx]
lea eax, [ebx + 8]
mov dword [esi + 0x10], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0xffffffff
mov dword [esi + 8], ecx
call fcn.004669a0
push 0x18
call fcn.005dc726
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], esp
sub esp, 0x20
mov edi, esp
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x14], eax
mov ecx, edi
add ecx, 8
push dword [esi + 0x10]
call fcn.00466a20
mov ecx, dword [ebx + 4]
call fcn.004cd550
test al, al
je 0x47952b
mov ecx, dword [ebx + 4]
push edi
call fcn.004cd590
jmp 0x479534
mov ecx, edi
push 0
call fcn.004cd380
mov eax, dword [esi + 0x14]
mov dword [edi + 0x1c], eax
mov ecx, dword [esi + 0xc]
call fcn.00487460
mov esp, dword [esi + 0x18]
mov ecx, dword [ebx + 4]
call fcn.004cd550
test al, al
je 0x4795c7
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
lea ecx, [esi + 0x30]
mov ebx, ecx
call fcn.004f152c
mov edi, esp
sub esp, 8
mov ecx, esp
push ebx
call fcn.004f1a8a
lea ebx, [esi + 0x50]
mov ecx, ebx
call fcn.004669c0
mov esp, edi
mov ecx, dword [esi + 8]
push ebx
call fcn.00466a70
mov ecx, ebx
call fcn.00466a50
mov dword [esi + 8], esp
sub esp, 8
mov edi, esp
lea eax, [esi + 0x38]
mov ecx, ebx
push eax
call fcn.004f1a8a
mov ecx, edi
push ebx
call fcn.004f1ae0
mov ecx, dword [esi + 0xc]
call fcn.004876e0
mov esp, dword [esi + 8]
mov ecx, ebx
call fcn.004f1ab4
lea ecx, [esi + 0x30]
call fcn.004f17d0
jmp 0x47966a
mov eax, dword [ebx + 0x20]
mov dword [eax], 1
mov dword [esi + 0x68], 0xffffffff
pxor xmm0, xmm0
movdqa xmmword [esi + 0x50], xmm0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov byte [esi + 0x68], 1
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0xffffffff
lea eax, [esi + 0x50]
lea ecx, [esi + 0x30]
push eax
call fcn.004f1ca4
mov ebx, esp
sub esp, 8
mov ecx, esp
lea eax, [esi + 0x3c]
push eax
call fcn.004f1a8a
lea edi, [esi + 0x1c]
mov ecx, edi
call fcn.004669f0
mov esp, ebx
mov ecx, dword [esi + 8]
push edi
call fcn.00466a70
mov ecx, edi
lea edi, [esi + 0x30]
call fcn.00466a50
movzx eax, byte [esi + 0x3b]
mov edx, edi
test al, al
jns 0x47964d
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0xc]
push eax
push edx
call fcn.00487860
mov ecx, edi
call fcn.004f1d02
cmp byte [esi + 0x67], 0
js 0x479684
cmp byte [esi + 0x5b], 0
js 0x479695
mov ecx, dword [esi + 0x10]
call fcn.00466a50
mov ecx, dword [esi + 0x78]
xor ecx, ebp
call fcn.005dd6f3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [esi + 0x5c]
call fcn.005dc756
add esp, 4
cmp byte [esi + 0x5b], 0
jns 0x47966a
push dword [esi + 0x50]
call fcn.005dc756
add esp, 4
jmp 0x47966a
Function at 0x481df0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x6845a0]
cmp esi, 1
ja 0x481e56
push 0x6845a0
call fcn.004b5ef0
add esp, 4
test al, al
je 0x481e50
mov dword [0x6845a8], 0
mov dword [0x6845a4], 0
mov esi, 0x6845a4
mov ecx, 0x6845a4
push 0
call fcn.004c3ff0
push 0x6845a0
push 0
push 0x6845a4
push 0x6845a0
call fcn.004b5fd0
add esp, 0x10
jmp 0x481e56
mov esi, dword [0x6845a0]
mov ecx, esi
pop esi
pop ebp
jmp fcn.004c3f80

Function at 0x484120
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
push 0x6216af
call fcn.00502320
mov dword [esi], fcn.00484810
mov dword [esi + 8], edi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], eax
mov word [esi + 0x1c], 0x100
mov byte [esi + 0x1e], 1
movups xmm0, xmmword [ebp + 0x10]
movups xmmword [esi + 0x20], xmm0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
movups xmm0, xmmword [0x629fc8]
movups xmmword [esi + 0x40], xmm0
mov eax, dword [0x6845c4]
mov ecx, dword [0x678164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4841b6
lock inc dword [0x6845bc]
mov eax, esi
pop esi
pop edi
pop ebp
ret 0x18
push 0x6845c4
call fcn.005dc7c7
add esp, 4
cmp dword [0x6845c4], 0xffffffff
jne 0x4841a7
mov dword [0x6845c0], 0x617b50
call fcn.004d49d0
mov ecx, eax
push 0
push str.MojoMessages
push 0x6845c0
call fcn.004d4b50
push 0x6845c4
call fcn.005dc83d
add esp, 4
jmp 0x4841a7
Function at 0x487f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1c0
mov esi, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x1b8], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x1a0], xmm0
movdqa xmmword [esp + 0x190], xmm0
movdqa xmmword [esp + 0x180], xmm0
movdqa xmmword [esp + 0x170], xmm0
movdqa xmmword [esp + 0x160], xmm0
movdqa xmmword [esp + 0x150], xmm0
movdqa xmmword [esp + 0x140], xmm0
movdqa xmmword [esp + 0x130], xmm0
movdqa xmmword [esp + 0x120], xmm0
movdqa xmmword [esp + 0x110], xmm0
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
movdqa xmmword [esp + 0xe0], xmm0
movdqa xmmword [esp + 0xd0], xmm0
movdqa xmmword [esp + 0xc0], xmm0
movdqa xmmword [esp + 0xb0], xmm0
mov dword [esp + 0xac], 0
lea eax, [esp + 0xac]
lea ebx, [esp + 0xb0]
push 0
push eax
push 0x100
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48803d
mov dword [esp], 0xffffffff
mov eax, esp
push 0
push 0
push dword [esp + 0xb4]
push ebx
push eax
call fcn.00464d10
add esp, 0x14
mov ecx, dword [esp]
test ecx, ecx
je 0x48809e
call fcn.00465380
cmp eax, 7
jbe 0x48809e
mov edi, dword [ebp + 8]
mov ecx, dword [esp]
call fcn.00465310
cmp dword [eax], edi
jne 0x4880f7
mov eax, dword [esp]
mov dword [esi], eax
jmp 0x488086
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x488080
call fcn.004b7210
lea edi, [esp + 4]
mov ecx, edi
push eax
push 2
push 0x38
push str.....mojocore_broker_win.cc
call fcn.004b73b0
lea eax, [esp + 0xc]
push 0x19
push str.Error_reading_broker_pipe
push eax
call fcn.0041482a
add esp, 0xc
mov ecx, edi
call fcn.004b7460
mov dword [esi], 0
mov ecx, dword [esp + 0x1b8]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x4880db
lea esi, [esp + 4]
mov ecx, esi
push 2
push 0x40
push str.....mojocore_broker_win.cc
call fcn.004b6940
lea eax, [esp + 0xc]
push 0x16
push str.Invalid_broker_message
push eax
call fcn.0041482a
add esp, 0xc
mov ecx, esi
call fcn.004b6d50
push ebx
call fcn.00410cd0
add esp, 4
lea eax, [esp + 0xac]
push eax
call fcn.00410cd0
add esp, 4
int3
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x488134
lea esi, [esp + 4]
mov ecx, esi
push 2
push 0x4b
push str.....mojocore_broker_win.cc
call fcn.004b6940
lea eax, [esp + 0xc]
push 0x1e
push str.Unexpected_broker_message_type
push eax
call fcn.0041482a
add esp, 0xc
mov ecx, esi
call fcn.004b6d50
push ebx
call fcn.00410cd0
add esp, 4
lea eax, [esp + 0xac]
push eax
call fcn.00410cd0
add esp, 4
int3