joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f895
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40f8df
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40f8ae
jmp 0x40f8df
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40f8cf
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x410944
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x410979
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x4109a3
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x4109a3
test edi, edi
je 0x410970
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x410970
test edi, edi
je 0x4109ab
mov eax, edi
jmp 0x410972
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x410972
mov esi, 0xc4
push esi
push str.c:_builds_moz2_slave_m_cen_w32_d_000000000000000000_build_src_mfbt_Poison.cpp
push 0x41761e
call fcn.004145cc
add esp, 0xc
int3
Function at 0x414602
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestIntegerRange.exe_gMozillaPoisonSize], eax
call fcn.00410944
pop ecx
mov ecx, dword [sym.TestIntegerRange.exe_gMozillaPoisonSize]
mov dword [sym.TestIntegerRange.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x41463a
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestIntegerRange.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x428270
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
push edi
or ebp, 0xffffffff
jmp 0x428292
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x428299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x428288
mov eax, 1
add ebx, ebx
jne 0x4282ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282a0
jne 0x4282bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282a0
xor ecx, ecx
sub eax, 3
jb 0x4282d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x428342
mov ebp, eax
add ebx, ebx
jne 0x4282db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4282e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42830c
inc ecx
add ebx, ebx
jne 0x4282f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4282ed
jne 0x428309
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42832c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42831d
jmp 0x42828e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42832c
add edi, ecx
jmp 0x42828e
pop esi
mov edi, esi
mov ecx, 0xe3b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42834a
cmp byte [edi], 7
jne 0x42834a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42834f
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283be
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x285dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x28690]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42837c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x28694]
or eax, eax
je 0x4283b8
mov dword [ebx], eax
add ebx, 4
jmp 0x428399
call dword [esi + 0x28698]
popal
jmp 0x4120b2
Function at 0x50f4b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf6000]
push edi
or ebp, 0xffffffff
jmp 0x50f4d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50f4d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50f4c8
mov eax, 1
add ebx, ebx
jne 0x50f4eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50f4fc
jne 0x50f50c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50f50c
dec eax
add ebx, ebx
jne 0x50f508
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x50f4e0
xor ecx, ecx
sub eax, 3
jb 0x50f524
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50f596
sar eax, 1
mov ebp, eax
jmp 0x50f52f
add ebx, ebx
jne 0x50f52f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50f53c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50f560
inc ecx
add ebx, ebx
jne 0x50f54c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50f541
jne 0x50f55d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50f541
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50f580
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50f571
jmp 0x50f4ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50f580
add edi, ecx
jmp 0x50f4ce
pop esi
mov edi, esi
mov ecx, 0x17d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50f59e
cmp byte [edi], 5
jne 0x50f59e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x50f5a3
lea edi, [esi + 0x10d000]
mov eax, dword [edi]
or eax, eax
je 0x50f61b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11002c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x110068]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50f5d0
mov ecx, edi
jns 0x50f5ff
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11006c]
or eax, eax
je 0x50f615
mov dword [ebx], eax
add ebx, 4
jmp 0x50f5ed
call dword [esi + 0x110070]
popal
jmp 0x401e7c
Function at 0xbcb058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bcb1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbcb07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbcb06a
add dl, dl
jne 0xbcb089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbcb0dc
xor eax, eax
add dl, dl
jne 0xbcb096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbcb17d
add dl, dl
jne 0xbcb0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcb0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcb0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcb0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbcb0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbcb075
mov eax, 1
add dl, dl
jne 0xbcb0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbcb0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbcb0e1
sub eax, ebx
mov ebx, 1
jne 0xbcb128
mov ecx, 1
add dl, dl
jne 0xbcb10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbcb119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbcb105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbcb075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbcb13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbcb14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbcb136
cmp eax, 0x7d00
jae 0xbcb16d
cmp eax, 0x500
jb 0xbcb168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbcb075
cmp eax, 0x7f
ja 0xbcb170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbcb075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbcb19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbcb075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x415150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa4
cmp byte [edx + 0x185], 0
mov edi, ecx
call fcn.00415168
Function at 0x41bdc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebx, dword [esp + 0x74]
call fcn.0041bdd0
Function at 0x42d530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x944
mov edi, dword [esp + 0x964]
mov ebp, dword [esp + 0x958]
call fcn.0042d54d
Function at 0x431900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
movzx eax, byte [0x94bfc5]
mov ebx, ecx
xor ecx, ecx
mov edx, 0xa0
call fcn.0071ee80
test eax, eax
je 0x4319ff
mov dword [eax], 2
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 4
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x30], 0
mov byte [eax + 0x38], 3
mov byte [eax + 0x3c], 3
mov byte [eax + 0x40], 3
mov word [eax + 0x44], 0
mov byte [eax + 0x46], 3
mov byte [eax + 0x4a], 3
mov byte [eax + 0x4e], 3
mov word [eax + 0x52], 0
mov byte [eax + 0x54], 3
mov byte [eax + 0x58], 3
mov byte [eax + 0x5c], 3
mov word [eax + 0x60], 0
mov byte [eax + 0x62], 3
mov byte [eax + 0x66], 3
mov byte [eax + 0x6a], 3
mov word [eax + 0x6e], 0
mov byte [eax + 0x70], 3
mov byte [eax + 0x74], 3
mov byte [eax + 0x78], 3
mov word [eax + 0x7c], 0
mov byte [eax + 0x7e], 3
mov byte [eax + 0x82], 3
mov byte [eax + 0x86], 3
mov word [eax + 0x8a], 0
mov byte [eax + 0x8c], 3
mov byte [eax + 0x90], 3
mov byte [eax + 0x94], 3
mov dword [eax + 0x98], 0x2000000
mov byte [eax + 0x9c], 2
mov byte [eax + 0x9d], bl
pop ebx
ret
mov ecx, 4
mov edx, 0xa0
call fcn.007c1490
int3
Function at 0x431f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [edx + 0x120]
mov esi, ecx
movzx ecx, byte [esp + 0x74]
mov ebp, dword [esp + 0x70]
mov edi, edx
mov dword [esp], 0
mov dword [esp + 4], 1
mov dword [esp + 8], 0
test eax, eax
je 0x431ffd
mov ecx, dword [edi + 0x124]
movsd xmm1, qword [ebp + 0x30]
movsd xmm0, qword [ebp + 0x2a]
lea ebx, [esp + 0xc]
mov dword [esp + 0x2c], eax
mov byte [esp + 0xc], 3
mov byte [esp + 0x10], 3
mov byte [esp + 0x14], 3
mov word [esp + 0x18], 0
mov edx, ebx
mov dword [esp + 0x30], ecx
lea ecx, [ebp + 0x2a]
movsd qword [esp + 0x52], xmm1
movsd qword [esp + 0x4c], xmm0
call fcn.00432310
mov ecx, 0x93d1f8
mov edx, str.e_0m
test al, al
mov dword [esp + 0x34], 0x80d394
cmovne edx, ecx
xor al, 1
lea ecx, [esp + 0x4c]
movzx eax, al
mov dword [esp + 0xc], ecx
mov dword [esp + 0x24], edx
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0x41c4a0
shl eax, 2
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0x41c480
jmp 0x432090
mov eax, dword [edi + 0x34]
cmp eax, 0x110000
je 0x4320d5
movsd xmm1, qword [ebp + 0x30]
movsd xmm0, qword [ebp + 0x2a]
lea ebx, [esp + 0xc]
lea ecx, [ebp + 0x2a]
mov byte [esp + 0xc], 3
mov byte [esp + 0x10], 3
mov byte [esp + 0x14], 3
mov dword [esp + 0x2c], eax
mov word [esp + 0x18], 0
mov edx, ebx
movsd qword [esp + 0x52], xmm1
movsd qword [esp + 0x4c], xmm0
call fcn.00432310
mov ecx, 0x93d1f8
mov edx, str.e_0m
test al, al
mov dword [esp + 0x34], 0x80d3ac
cmovne edx, ecx
xor al, 1
lea ecx, [esp + 0x4c]
movzx eax, al
mov dword [esp + 0xc], ecx
mov dword [esp + 0x24], edx
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0x41c4a0
shl eax, 2
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], fcn.0046b520
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], 0x41c480
mov dword [esp + 0x28], eax
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], 3
mov dword [esp + 0x44], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 3
mov edx, 0x80d168
push eax
call fcn.00464980
movzx ecx, byte [esp + 0x78]
add esp, 4
movzx eax, cl
lea ecx, [esp + 0xc]
mov edx, edi
push eax
push ebp
call fcn.00432430
add esp, 8
mov eax, dword [esp]
mov edi, dword [esp + 8]
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
sub eax, edi
cmp eax, ebp
jb 0x432142
mov eax, dword [esp + 4]
add eax, edi
push ebp
push ebx
push eax
call fcn.007bd9b0
add esp, 0xc
add edi, ebp
cmp dword [esp + 0xc], 0
mov dword [esp + 8], edi
je 0x43212a
push ebx
push 0
push dword [0x94bf18]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 8]
movsd xmm0, qword [esp]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esp
mov edx, edi
push ebp
call fcn.007c54d0
add esp, 4
mov edi, dword [esp + 8]
jmp 0x4320fd
Function at 0x462470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov dword [esp + 4], ecx
mov edi, edx
mov ecx, edx
xor edx, edx
xor ebx, ebx
call fcn.0043a700
mov edx, dword [edi + 0x7c]
mov eax, dword [edi + 0x78]
movdqa xmm0, xmmword [0x7d4730]
mov ecx, 0xffffffff
shl edx, 4
nop word cs:[eax + eax]
nop dword [eax]
test edx, edx
je 0x46253d
movdqa xmm1, xmmword [eax]
add eax, 0x10
inc ecx
add edx, 0xfffffff0
pcmpeqb xmm1, xmm0
pmovmskb esi, xmm1
cmp esi, 0xffff
jne 0x4624b0
mov edx, dword [edi + 0x88]
cmp ecx, edx
jae 0x46265d
mov eax, dword [edi + 0x84]
mov edx, dword [eax + ecx*8 + 4]
push dword [eax + ecx*8]
call dword [edx + 0x20]
add esp, 4
mov ebx, eax
lea eax, [esp + 0x40]
push ebx
push eax
call dword [edx + 0xc]
add esp, 8
test ebx, ebx
je 0x462667
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
xor edx, 0xbd8d9362
xor ecx, 0x548bf31
xor esi, 0x8bb8d775
xor eax, 0x5c5df57b
or ecx, edx
or eax, esi
or eax, ecx
jne 0x462667
test ebx, ebx
mov eax, 0x8a84f4
mov dword [esp + 0x34], edi
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0
lea edi, [esp + 0x14]
cmovne eax, ebx
mov edx, edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
lea ecx, [eax + 0x1c]
movsd xmm0, qword [eax + 0x1c]
movsd xmm1, qword [eax + 0x22]
mov byte [esp + 0x14], 3
mov byte [esp + 0x18], 3
mov byte [esp + 0x1c], 3
mov word [esp + 0x20], 0
movsd qword [esp + 0x66], xmm1
movsd qword [esp + 0x60], xmm0
call fcn.00432310
mov ecx, 0x93d1f8
mov edx, str.e_0m
test al, al
lea ebx, [esp + 8]
mov dword [esp + 0x14], 0x80e984
mov dword [esp + 0x18], 3
mov dword [esp + 0x24], 0
cmovne edx, ecx
xor al, 1
mov ecx, ebx
movzx eax, al
mov dword [esp + 0x2c], edx
mov edx, 0x80d168
shl eax, 2
mov dword [esp + 0x30], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x54], 0x41c4a0
mov dword [esp + 0x58], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x5c], 0x41c480
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 2
push edi
call fcn.00464980
add esp, 4
lea ecx, [esp + 0x34]
mov edx, ebx
push 0
push 0x93d1f8
call fcn.004335c0
add esp, 8
mov ecx, ebx
call fcn.00433f20
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
movsd xmm0, qword [esp + 8]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x8a8474
call fcn.007c1be0
mov ecx, 0x8a86f4
call fcn.007c1fe0
int3
Function at 0x46b440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x46b490
cmp esi, edi
ja 0x46b4f8
cmp edi, dword [esp + 0x1c]
ja 0x46b506
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x46b492
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x46b480
jmp 0x46b4ef
ja 0x46b498
cmp eax, edx
mov esi, edi
jne 0x46b453
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x46b4d0
mov ebp, esi
sub ecx, edx
jns 0x46b4e7
jmp 0x46b4f1
cmp esi, edi
je 0x46b516
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x46b4f1
xor al, 1
cmp ebp, edi
jne 0x46b4b0
jmp 0x46b4f1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x810ba4
call fcn.007c1e60
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x810ba4
call fcn.007c1c40
mov ecx, 0x810b94
call fcn.007c1fe0
Function at 0x470f30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x80
jb 0x471103
movdqu xmm4, xmmword [edx]
not ecx
movdqu xmm3, xmmword [edx + 0x10]
movdqu xmm2, xmmword [edx + 0x20]
movdqu xmm1, xmmword [edx + 0x30]
movdqa xmm5, xmmword [0x7d4950]
add edx, 0x40
add eax, 0xffffffc0
movd xmm0, ecx
pxor xmm0, xmm4
movdqa xmm4, xmmword [0x7d4940]
nop word cs:[eax + eax]
nop dword [eax]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [edx]
add eax, 0xffffffc0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm7, xmm5, 0x11
pxor xmm0, xmm6
movdqu xmm6, xmmword [edx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm3
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x20]
pxor xmm3, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x30]
add edx, 0x40
cmp eax, 0x3f
pxor xmm2, xmm7
movdqa xmm7, xmm1
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pxor xmm1, xmm7
ja 0x470f80
movdqa xmm4, xmmword [0x7d4960]
movdqa xmm5, xmmword [0x7d4970]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm1
jb 0x471097
nop word cs:[eax + eax]
nop dword [eax]
movdqu xmm1, xmmword [edx]
movdqa xmm2, xmm0
add eax, 0xfffffff0
pclmulqdq xmm0, xmm5, 0x11
add edx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm2, xmm1
pxor xmm0, xmm2
ja 0x471070
movdqa xmm1, xmmword [0x7d4970]
pxor xmm2, xmm2
test eax, eax
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x7d4980], 0
pxor xmm0, xmm2
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x7d4990], 0x10
pblendw xmm2, xmm1, 0xfc
pclmulqdq xmm2, xmmword [0x7d49a0], 0
pxor xmm2, xmm0
pextrd ecx, xmm2, 1
not ecx
je 0x47110d
push eax
call fcn.00470ba0
add esp, 4
ret
mov eax, ecx
ret
Function at 0x473200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xd0
mov esi, dword [esp + 0xe4]
call fcn.00473216
Function at 0x489780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x288
mov dword [esp + 0xb4], edx
mov dword [esp + 0x20], ecx
call fcn.0048979f
Function at 0x496390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x318
mov dword [esp + 0x260], ecx
mov ecx, dword [edx + 0x34]
imul ebx, dword [edx + 0x28], 0x34
movsd xmm0, qword [edx + 0x2c]
mov edi, dword [edx + 0x24]
mov eax, dword [edx + 0x18]
cmp dword [edx + 0x1c], 0
lea esi, [edx + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0x15c], ecx
mov ecx, dword [edx + 0x20]
call fcn.004963ee
Function at 0x4a4b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
sub esp, 0x34
mov esi, dword [esp + 0x40]
movzx ecx, byte [esi + 7]
dec cl
cmp cl, 7
jae 0x4a4ccf
mov ch, byte [esi + 6]
dec ch
cmp ch, 0xc
jae 0x4a4ce3
movsx edx, cl
mov byte [esp + 0x1c], 0x54
mov dword [esp + 0x18], 0x4d472030
mov dword [esp + 0x14], 0x303a3030
mov dword [esp + 0x10], 0x3a303020
mov dword [esp + 0xc], 0x30303030
mov dword [esp + 8], 0x20202020
mov dword [esp + 4], 0x20303020
mov dword [esp], 0x2c202020
movsx ecx, ch
mov edx, dword [edx*4 + 0x93dd08]
mov ecx, dword [ecx*4 + 0x93dd24]
movzx ebx, byte [edx]
mov byte [esp], bl
movzx ebx, byte [edx + 1]
mov byte [esp + 1], bl
movzx edx, byte [edx + 2]
mov byte [esp + 2], dl
movzx edx, byte [esi + 5]
imul ebx, edx, 0xcd
shr ebx, 0xb
mov eax, ebx
add ebx, ebx
add al, 0x30
mov byte [esp + 5], al
lea eax, [ebx + ebx*4]
sub dl, al
or dl, 0x30
mov byte [esp + 6], dl
movzx eax, byte [ecx]
mov byte [esp + 8], al
movzx eax, byte [ecx + 1]
mov byte [esp + 9], al
movzx eax, byte [ecx + 2]
movzx ecx, word [esi]
mov byte [esp + 0xa], al
mov eax, ecx
shr eax, 3
imul eax, eax, 0x20c5
shr eax, 0x14
add al, 0x30
mov byte [esp + 0xc], al
mov eax, ecx
shr eax, 2
imul edx, eax, 0x147b
shr edx, 0x11
imul eax, edx, 0x199a
shr eax, 0xf
and eax, 0xfffffffe
lea eax, [eax + eax*4]
sub edx, eax
or dl, 0x30
mov byte [esp + 0xd], dl
imul edx, ecx, 0xcccd
shr edx, 0x13
imul eax, edx, 0x199a
mov ebx, edx
add edx, edx
shr eax, 0xf
and eax, 0xfffffffe
lea eax, [eax + eax*4]
sub ebx, eax
lea eax, [edx + edx*4]
sub ecx, eax
or bl, 0x30
or cl, 0x30
mov byte [esp + 0xe], bl
mov byte [esp + 0xf], cl
movzx ecx, byte [esi + 4]
imul edx, ecx, 0xcd
shr edx, 0xb
mov eax, edx
add edx, edx
add al, 0x30
mov byte [esp + 0x11], al
lea eax, [edx + edx*4]
sub cl, al
or cl, 0x30
mov byte [esp + 0x12], cl
movzx ecx, byte [esi + 3]
imul edx, ecx, 0xcd
shr edx, 0xb
mov eax, edx
add edx, edx
add al, 0x30
mov byte [esp + 0x14], al
lea eax, [edx + edx*4]
sub cl, al
movzx eax, byte [esi + 2]
or cl, 0x30
mov byte [esp + 0x15], cl
imul ecx, eax, 0xcd
shr ecx, 0xb
mov edx, ecx
add ecx, ecx
lea ecx, [ecx + ecx*4]
add dl, 0x30
sub al, cl
mov byte [esp + 0x17], dl
lea ecx, [esp + 0x20]
mov edx, esp
or al, 0x30
mov byte [esp + 0x18], al
push 0x1d
call fcn.004670b0
add esp, 4
cmp dword [esp + 0x20], 0
jne 0x4a4cf7
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x18]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [eax + 0x14]
call dword [ecx + 0xc]
add esp, 0x40
pop esi
pop ebx
ret
mov ecx, str.internal_error:_entered_unreachable_code
mov edx, 0x28
push 0x835c90
call fcn.007c1ca0
mov ecx, str.internal_error:_entered_unreachable_code
mov edx, 0x28
push 0x835c80
call fcn.007c1ca0
movsd xmm0, qword [esp + 0x24]
lea eax, [esp + 0x2c]
mov ecx, 0x93b384
mov edx, 0x2b
movsd qword [esp + 0x2c], xmm0
push 0x835c70
push 0x835b40
push eax
call fcn.007c1f60
int3