joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
test eax, eax
jns 0x44159f
mov edx, dword [edi + 0xc]
xor eax, eax
test edx, edx
jle 0x441461
mov ecx, dword [edi + 0x10]
nop
cmp dword [ecx], 0
je 0x441597
inc eax
add ecx, 0x6c
cmp eax, edx
jl 0x441450
or eax, 0xffffffff
xor edx, edx
imul ebx, eax, 0x6c
test edx, edx
je 0x4415dc
mov dword [edx], 0x100
mov dword [edx + 0x20], 1
mov dword [edx + 0xc], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov ecx, dword [edi + 0x98]
mov dword [edx + 0x24], ecx
mov ecx, dword [edi + 0x9c]
mov dword [edx + 0x28], ecx
mov ecx, dword [edi + 0xa0]
mov dword [edx + 0x2c], ecx
mov ecx, dword [edi + 0xa4]
mov dword [edx + 0x30], ecx
mov dword [edx + 0x34], 0
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x40], 0
mov ecx, dword [edi + 0x78]
mov dword [edx + 0x44], ecx
mov ecx, dword [edi + 0x78]
mov dword [edx + 0x48], ecx
mov ecx, dword [ebp + 0x18]
mov dword [edx + 0x34], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [edx + 0x4c], 0
mov dword [edx + 0x50], 0
mov dword [edx + 0x54], 0
mov dword [edx + 0x58], 0
mov dword [edx + 0x68], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov dword [edx + 0x1c], 0xffffffff
mov dword [edx + 0x18], 0
mov dword [edx + 0x5c], 0
mov dword [edx + 0x60], 0
mov dword [edx + 0x64], 0
mov dword [edx + 0x38], ecx
test eax, eax
js 0x4415df
mov ecx, dword [edi + 0xc]
push esi
cmp eax, ecx
jge 0x4415d5
mov edx, dword [edi + 0x10]
add edx, ebx
mov dword [ebp + 8], edx
je 0x441576
mov ecx, dword [edi + 0x74]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
shl esi, cl
shl edx, cl
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], esi
mov dword [ecx + 8], edx
mov ecx, dword [edi + 0xc]
cmp eax, ecx
jge 0x4415d5
mov edx, dword [edi + 0x10]
add edx, ebx
je 0x4415d5
mov esi, dword [ebp + 0x14]
test esi, esi
js 0x4415b5
cmp esi, dword [edi + 0x14]
jge 0x4415b5
mov ecx, esi
shl ecx, 5
add ecx, dword [edi + 0x18]
jmp 0x4415b7
test eax, eax
js 0x441464
cmp eax, dword [edi + 0xc]
jge 0x441464
mov edx, dword [edi + 0x10]
imul ebx, eax, 0x6c
add edx, ebx
jmp 0x441469
xor ecx, ecx
mov dword [edi + 0x1c], ecx
test ecx, ecx
je 0x4415d5
mov dword [edx + 0x1c], esi
mov ecx, dword [edi + 0x1c]
movsx ecx, word [ecx + 4]
mov dword [edx + 0x18], ecx
mov ecx, dword [edi + 0x1c]
movsx ecx, word [ecx + 2]
mov dword [edx + 0x3c], ecx
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
or eax, 0xffffffff
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x451a30
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push dword [0x4aeba0]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x451a8f
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x451a8f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
call fcn.00433290
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, edi
sub edx, eax
nop dword [eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x451a70
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4531f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x45320b
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [0x4aeba0]
je 0x45320b
xor eax, eax
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
push 0x25
call ebx
movzx esi, ax
push 0x26
shr esi, 0xf
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 2
and ax, cx
push 0x27
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 4
and ax, cx
push 0x28
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 8
and ax, cx
push 0x20
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x10
and ax, cx
push 0xd
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 0x20
and ax, cx
push 0x11
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x40
and ax, cx
push 0x1b
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 0x80
and ax, cx
push 1
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x100
and ax, cx
push 2
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 0x200
and ax, cx
push 9
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x400
and ax, cx
push 0x5a
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 0x800
and ax, cx
push 0x58
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x1000
and ax, cx
push 0x43
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, 0x2000
and ax, cx
push 0x41
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x4000
and ax, cx
push 0x57
cmove esi, edi
call ebx
mov ecx, 0x8000
mov edi, esi
or edi, ecx
and ax, cx
push 0x44
cmove edi, esi
call ebx
mov ecx, 0x8000
mov esi, edi
or esi, 0x10000
and ax, cx
push 0x53
cmove esi, edi
call ebx
mov cx, ax
mov eax, 0x8000
and cx, ax
mov eax, esi
or eax, 0x20000
test cx, cx
pop edi
cmove eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x453c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x4aef08
nop dword [eax + eax]
xor ecx, ecx
mov word [eax], cx
add eax, 0x24
cmp eax, 0x4b3708
jl 0x453c20
mov eax, dword [0x4b3728]
push esi
push edi
push 0
mov ecx, dword [eax]
push 0
push eax
mov dword [0x4b3710], 0xffffffff
call dword [ecx + 0xf4]
push 0x10000
mov dword [0x4b372c], 0
mov dword [0x4b3730], 0
mov dword [0x4b3738], 0
call fcn.0045d581
add esp, 4
mov dword [0x4b3734], eax
xor esi, esi
mov dword [0x4d3740], 0
mov dword [0x4b373c], 1
xor edi, edi
mov eax, esi
mov edx, esi
and eax, 0x1fe01
not edx
cmp eax, 0x1fe00
mov eax, edx
setne cl
shl edx, 0xc
dec cl
shr eax, 3
xor edx, esi
and cl, 0x80
and al, 0x3f
shr esi, 1
or cl, al
and edx, 0x1000
shl edx, 4
mov byte [edi + 0x4b3740], cl
or esi, edx
inc edi
cmp edi, 0x1ffff
jl 0x453c95
mov dword [ebp - 0x10], 0
xor edi, edi
mov dword [ebp - 0xc], 0xc2
mov dword [ebp - 8], 0xd6
mov dword [ebp - 4], 0xff
mov edx, edi
mov eax, edi
sar edx, 2
and eax, 0x10
mov ecx, edx
and edx, 2
and ecx, 8
or ecx, eax
mov eax, edi
shr ecx, 3
and eax, 4
or edx, eax
mov eax, edi
shr edx, 1
and eax, 1
add eax, eax
mov esi, dword [ebp + ecx*4 - 0x10]
mov ecx, edi
add esi, 0xff00
sar ecx, 1
shl esi, 8
and ecx, 1
add esi, dword [ebp + edx*4 - 0x10]
or ecx, eax
shl esi, 8
add esi, dword [ebp + ecx*4 - 0x10]
mov dword [edi*4 + 0x4d3748], esi
inc edi
cmp edi, 0x40
jl 0x453cf5
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4548f0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4794d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], esp
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [0x4d384c]
test byte [eax + 0x30c], 2
je 0x454970
mov eax, dword [esi + 4]
cmp eax, 0x200
jne 0x4549be
cmp dword [0x4d387c], 0
movzx ecx, word [esi + 0xc]
movzx eax, word [esi + 0xe]
jne 0x454965
cmp dword [0x4d3880], ecx
jne 0x4549e1
cmp dword [0x4d3884], eax
jne 0x4549e1
jmp 0x454970
mov dword [0x4d3880], ecx
mov dword [0x4d3884], eax
cmp dword [esi + 4], 0x100
jne 0x4549ad
push 2
push dword [esi + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, dword [esi + 8]
mov edi, eax
push 2
call fcn.00432f40
add esp, 4
test eax, eax
je 0x4549ad
push dword [esi + 0xc]
push ebx
push edi
push 2
call fcn.00433120
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x100
jne 0x454970
cmp dword [0x4d387c], 0
je 0x4549f6
jmp 0x454970
push 0x495c90
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call fcn.0045915a
push 0x495c90
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
call fcn.0045915a
int3
Function at 0x455f00
Capabilities:
Check internet connectivity via wininet

Disassembly:
push esi
mov esi, ecx
push 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0
mov dword [esi + 0xc18], 0
mov byte [esi + 0x818], 0
mov dword [esi + 0xc1c], 0
mov dword [esi + 0xf28], 0
mov dword [esi + 0xf24], 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x455f76
mov ecx, 0x4829d4
mov dword [esi + 0x10], 0xffffffff
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx + 0xc1f], al
test al, al
jne 0x455f62
mov eax, esi
pop esi
ret
mov ecx, esi
call fcn.00456390
mov eax, esi
pop esi
ret
Function at 0x456390
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
call fcn.00456550
mov eax, dword [esi + 0xc]
lea edx, [esi + 0x818]
test eax, eax
mov ecx, str.HSP3Dish_Windows_
cmovne ecx, eax
cmp byte [edx], 0
je 0x4563d1
push edi
xor edi, edi
mov eax, str._local_
cmp dword [esi + 0xc18], edi
push 0
cmove eax, edi
push eax
push edx
push 3
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
pop edi
jmp 0x4563e0
push 0
push 0
push 0
push 1
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
test eax, eax
jne 0x456406
mov ecx, 0x4829bc
mov dword [esi + 0x10], 0xffffffff
sub esi, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx + 0xc1f], al
test al, al
jne 0x4563f4
pop esi
ret
mov dword [esi + 0x10], 1
pop esi
ret

Function at 0x467cfc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00467b7b
Function at 0x40eb6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40ebb1
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40eb80
jmp 0x40ebb1
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40eba1
pop esi
pop ebp
ret

Function at 0x40f94b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40f980
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40f9aa
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40f9aa
test edi, edi
je 0x40f977
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40f977
test edi, edi
je 0x40f9b2
mov eax, edi
jmp 0x40f979
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40f979
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.00412dd6
add esp, 0xc
int3
Function at 0x412e0a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestVector.exe_gMozillaPoisonSize], eax
call fcn.0040f94b
pop ecx
mov ecx, dword [sym.TestVector.exe_gMozillaPoisonSize]
mov dword [sym.TestVector.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x412e42
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestVector.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx