joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406290
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push eax
mov esi, ecx
lea ebx, [esi + 0xc]
push 0x100
push ebx
call fcn.004073f9
add esp, 0xc
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4062e7
push ebx
push str.__s__Could_not_open_file_n
add esi, 0x218
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x40630a
push eax
call fcn.004074a9
add esp, 4
mov dword [esi + 4], 0
mov ecx, dword [esi + 8]
push ecx
call fcn.00406bf5
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x406343
push ebx
push str.__s__Could_not_alloc_file_buffer_n
add esi, 0x218
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
push 0
lea edx, [ebp - 4]
push edx
push ecx
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406368
push ebx
push str.__s__Could_not_read_file_n
jmp 0x406323
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
mov dword [esi + 0x214], eax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406c00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c054]
jne 0x406c0a
repz ret
jmp fcn.00407997
Function at 0x40dccb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b329
and dword [ebp - 0x14], 0
cmp dword [0x65399c], 0
mov dword [ebp - 0x18], eax
jne 0x40dd7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40de26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40de26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x65399c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x6539a0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x6539a4], eax
call edi
push eax
call esi
mov dword [0x6539ac], eax
test eax, eax
je 0x40dd7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x6539a8], eax
mov eax, dword [0x6539a8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ddd7
cmp dword [0x6539ac], ecx
je 0x40ddd7
push eax
call esi
push dword [0x6539ac]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ddd7
test ebx, ebx
je 0x40ddd7
call edi
test eax, eax
je 0x40ddce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ddce
test byte [ebp - 8], 1
jne 0x40ddd7
or dword [ebp + 0x10], 0x200000
jmp 0x40de0a
mov eax, dword [0x6539a0]
cmp eax, dword [ebp - 0x18]
je 0x40de0a
push eax
call esi
test eax, eax
je 0x40de0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40de0a
mov eax, dword [0x6539a4]
cmp eax, dword [ebp - 0x18]
je 0x40de0a
push eax
call esi
test eax, eax
je 0x40de0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x65399c]
call esi
test eax, eax
je 0x40de26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40de28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406c00
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x653919d9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x116a618d
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401c66
pop dword [ebp - 0x34]
mov eax, 0x401c66
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xa0ea68c0
add dword [ebp - 0x44], 0xad67dc8b
mov dword [ebp - 0x40], 0x217d276e
add dword [ebp - 0x40], 0x10b624d7
mov dword [ebp - 0x3c], 0x9996121b
add dword [ebp - 0x3c], 0xb2b63213
mov dword [ebp - 0x38], 0xfb6b38a9
sub dword [ebp - 0x38], 0xfb6b38a9
lea eax, [ebp - 0x44]
push eax
mov eax, 0xdb0fc6ee
sub eax, 0xdacf969a
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9c4a78e0
add dword [ebp - 0x44], 0xd827f076
mov dword [ebp - 0x40], 0x2f6f0900
add dword [ebp - 0x40], 0x11fd5875
mov dword [ebp - 0x3c], 0xecf87f9
sub dword [ebp - 0x3c], 0xab601b8d
mov dword [ebp - 0x38], 0xb9e67901
sub dword [ebp - 0x38], 0xb9e67901
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x7c46ad32
add eax, 0x83f982fa
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37ec2
push 0
call eax
mov ecx, 0x4dc4
mov edx, eax
mov esi, 0x407000
add esi, dword [ebp - 0x34]
mov ebx, 0xf6455df
add ebx, 0xa62e85c6
sub dword [ebp - 0x1c], eax
mov edi, dword [esi]
add edi, ebx
xor dword [ebp - 0x28], ebx
mov dword [edx], edi
add dword [ebp - 0x2c], 0xb585e8f0
add edx, 4
add esi, 0x47f6d6a0
sub esi, 0x47f6d69c
loop 0x401d77
add eax, 0xf51fbf8e
add eax, 0xae16a55
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x58286c74
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x388c5acd
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x410456
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x41a570
call fcn.00410c49
push 1
call fcn.004104d9
pop ecx
test al, al
jne 0x4102ff
push 7
call fcn.00410d92
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004104a4
mov byte [ebp - 0x24], al
mov eax, dword [0x41d028]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4102f8
test eax, eax
jne 0x410369
mov dword [0x41d028], ecx
push 0x4132f4
push 0x4132dc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41034c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x410450
push 0x4132d8
push 0x4132b8
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x41d028], 2
jmp 0x41036e
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00410636
pop ecx
call fcn.00410d86
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41039e
push esi
call fcn.004105a9
pop ecx
test al, al
je 0x41039e
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00410fc1
call esi
call fcn.00410d8c
mov esi, eax
cmp dword [esi], edi
je 0x4103bc
push esi
call fcn.004105a9
pop ecx
test al, al
je 0x4103bc
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00410ea7
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00410eda
test al, al
jne 0x4103f5
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4103fe
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00410653
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x410450
call fcn.00410c8f
ret
call fcn.00410165
jmp 0x4102e0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1000c3fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000c40a
pop dword [ebp - 0x4c]
mov eax, 0x5e6f68db
add eax, 0xb1915b2f
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x375c8
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xa2cc27a2
sub ecx, 0xa2cbdfee
mov esi, eax
mov edi, 0xf8cb259c
add edi, 0x1736ee64
add edi, dword [ebp - 0x4c]
mov ebx, 0x7435fd93
add ebx, 0x5f757b20
xor dword [ebp - 0x18], esi
mov edx, dword [edi]
add dword [ebp - 8], 0xa38b54df
add edx, ebx
sub dword [ebp - 0x34], esi
mov dword [esi], edx
add dword [ebp - 0x40], 0x6022990c
add esi, 0xcef27a97
sub esi, 0xcef27a93
add edi, 0x91ddaa31
add edi, 0x6e2255d3
loop 0x1000c464
add eax, 0xd0a76154
add eax, 0x2f59b04f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x64f30932
add ecx, 0xab0cf6ce
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40d08c], 1
mov dword [0x40d088], 1
mov dword [0x40d084], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40d00c], eax
mov eax, dword [0x40d098]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40d0ac]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40d094]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x409018], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401750
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
sub esp, 0x104
mov dword [0x40d054], ecx
cmp byte [0x40d068], 0
je 0x4017a4
lea eax, [esp + 4]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
movzx eax, byte [esp + 0x94]
and eax, 1
movzx ecx, byte [esp + 0x18]
and ecx, 1
lea eax, [eax + ecx*2]
movzx ecx, byte [esp + 0x95]
and ecx, 1
lea eax, [eax + ecx*4]
mov dword [0x40d064], eax
mov dword [0x40d060], eax
jmp 0x40187b
push str.DeviceKeyboardClass0
push 0x40a174
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
je 0x401837
sub esp, 0x1c
movaps xmm0, xmmword [0x40a060]
movups xmmword [esp + 4], xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], str..Kbd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x40d06c], eax
cmp eax, 0xffffffff
je 0x401837
cmp byte [0x40d068], 1
je 0x401766
mov word [esp + 4], 0
mov ecx, esp
lea edx, [esp + 4]
push 0
push ecx
push 4
push edx
push 0
push 0
push 0xb0040
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx eax, word [esp + 6]
mov ecx, eax
shr ecx, 1
and ecx, 3
and eax, 1
lea eax, [ecx + eax*4]
jmp 0x401795
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 2
call dword [0x409048]
add esp, 4
push esi
push str.Unable_to_open_the_keyboard_device.__error__d__n
push eax
call dbg.fprintf(_iobuf*, char const*, ::)
add esp, 0xc
jmp 0x40187b
mov eax, dword [esi]
mov dword [0x40d070], eax
push dword [esi + 4]
call sub.msvcrt.dll_free
add esp, 4
push esi
call sub.msvcrt.dll_free
add esp, 4
mov esi, dword [0x40d070]
test esi, esi
jne 0x401860
push 0x4d4c4544
push dword [0x40d03c]
push dword [0x40d04c]
push dword [0x40d054]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 0x40d070
nop word [eax + eax]
mov eax, dword [eax]
test eax, eax
je 0x4018c4
cmp dword [eax + 8], 0
jne 0x4018b0
add esp, 0x104
pop esi
ret
push 0
push dword [0x40d03c]
push dword [0x40d050]
push dword [0x40d054]
call dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x104
pop esi
ret
Function at 0x401c90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
push esi
sub esp, 0x124
mov ebx, ecx
mov dword [0x40d064], ecx
cmp byte [0x40d068], 1
jne 0x401cd0
lea esi, [esp + 0x24]
mov dword [esp], esi
call dword [sym.imp.USER32.dll_GetKeyboardState]
sub esp, 4
movzx eax, byte [esp + 0xb4]
test bl, 1
jne 0x401d38
test al, 1
jne 0x401d3c
jmp 0x401d62
mov eax, ebx
and eax, 3
shr ebx, 2
and ebx, 1
lea eax, [ebx + eax*2]
mov word [esp + 0x24], 0
mov word [esp + 0x26], ax
mov eax, dword [0x40d06c]
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 4], 0xb0008
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
sub esp, 0x20
jmp 0x401e2c
test al, 1
jne 0x401d62
movaps xmm0, xmmword [0x40a070]
movups xmmword [esp], xmm0
mov edi, dword [sym.imp.USER32.dll_keybd_event]
call edi
sub esp, 0x10
movaps xmm0, xmmword [0x40a080]
movups xmmword [esp], xmm0
call edi
sub esp, 0x10
movzx eax, byte [esp + 0x38]
test bl, 2
jne 0x401d72
test al, 1
jne 0x401d76
jmp 0x401d9c
test al, 1
jne 0x401d9c
movaps xmm0, xmmword [0x40a090]
movups xmmword [esp], xmm0
mov edi, dword [sym.imp.USER32.dll_keybd_event]
call edi
sub esp, 0x10
movaps xmm0, xmmword [0x40a0a0]
movups xmmword [esp], xmm0
call edi
sub esp, 0x10
movzx eax, byte [esp + 0xb5]
test bl, 4
jne 0x401daf
test al, 1
jne 0x401db3
jmp 0x401de1
test al, 1
jne 0x401de1
movaps xmm0, xmmword [0x40a0b0]
movups xmmword [esp], xmm0
mov edi, dword [sym.imp.USER32.dll_keybd_event]
call edi
sub esp, 0x10
movaps xmm0, xmmword [0x40a0c0]
movups xmmword [esp], xmm0
call edi
sub esp, 0x10
movzx eax, byte [esp + 0xb5]
movzx ecx, byte [esp + 0x38]
movzx edx, byte [esp + 0xb4]
and dl, 0xfe
mov ah, bl
and ah, 1
or ah, dl
mov byte [esp + 0xb4], ah
and cl, 0xfe
mov edx, ebx
shr dl, 1
and dl, 1
or dl, cl
mov byte [esp + 0x38], dl
and al, 0xfe
shr bl, 2
and bl, 1
or bl, al
mov byte [esp + 0xb5], bl
mov dword [esp], esi
call dword [sym.imp.USER32.dll_SetKeyboardState]
sub esp, 4
add esp, 0x124
pop esi
pop edi
pop ebx
ret

Function at 0x4020b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x402110
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d0a0]
test esi, esi
jle 0x402230
mov eax, dword [0x40d0a4]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x402144
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4021c7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402130
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x402257
mov eax, dword [0x40d0a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40d0a4]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402237
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x4021c0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x4021d0
add dword [0x40d0a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d0a4]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4021c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40214e
mov eax, dword [0x40d0a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop

Function at 0x402770
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d0bc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d0b4]
sub esp, 4
test ebx, ebx
je 0x4027c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x4027be
test eax, eax
jne 0x4027be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4027a0
mov dword [esp], 0x40d0bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402b00
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402b25
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402b30
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402b25
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402b78
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x402b6e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x402b7a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x402b60
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40ad16
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40ad5a
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40ad29
jmp 0x40ad5a
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40ad4a
pop esi
pop ebp
ret

Function at 0x40bab2
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40bae7
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40bb11
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40bb11
test edi, edi
je 0x40bade
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40bade
test edi, edi
je 0x40bb19
mov eax, edi
jmp 0x40bae0
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40bae0
mov esi, 0xc7
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040e81b
add esp, 0xc
int3