joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005793
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1007024]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x14]
push 0x7e
mov dword [ebp - 0x40c], eax
pop ecx
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x404], ebx
lea edi, [ebp - 0x400]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7e
pop ecx
mov dword [ebp - 0x204], ebx
xor eax, eax
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.01005451
cmp eax, 1
jne 0x1005840
cmp dword [ebp - 0x408], ebx
je 0x1005839
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1005839
mov esi, 0xa0010001
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x157e
call fcn.01003d7f
push eax
call fcn.01002f34
mov eax, esi
jmp 0x1005988
xor eax, eax
jmp 0x1005988
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x204]
push eax
call edi
push esi
call fcn.0100542d
cmp eax, 1
jne 0x1005868
add esi, 4
push esi
lea eax, [ebp - 0x204]
push eax
call edi
lea eax, [ebp - 0x204]
push eax
call fcn.010051e5
test eax, eax
jne 0x1005883
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1005988
mov esi, 0x10012f8
push esi
lea eax, [ebp - 0x404]
push eax
call edi
cmp dword [ebp - 0x40c], ebx
je 0x10058ce
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10058ce
push dword [ebp - 0x40c]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push 0x1001500
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x10058ea
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push 0x1001378
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 8
pop ecx
xor eax, eax
push ebx
push dword [ebp - 0x408]
lea edi, [ebp - 0x430]
push dword [ebp - 0x410]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x420], ebx
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp edi, ebx
je 0x100594a
cmp edi, 0x4b8
je 0x1005943
call fcn.01003127
jmp 0x1005986
call fcn.0100317e
jmp 0x1005986
push esi
xor edi, edi
call fcn.01002f34
lea eax, [ebp - 0x204]
push eax
call fcn.01005557
cmp eax, 0x1388
jae 0x1005986
lea eax, [ebp - 0x204]
push eax
call fcn.01005776
push 0x157f
call fcn.01003d7f
push eax
call fcn.01002f34
mov edi, 0x4b8
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01002b06
leave
ret 0x10
Function at 0x10059bd
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1007024]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp + 0x14]
xor edx, edx
push 0x7e
mov dword [ebp - 0x208], eax
pop ecx
mov dword [ebp - 0x204], edx
xor eax, eax
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
push edx
mov dword [ebp - 0x214], edx
stosw word es:[edi], ax
call esi
xor edi, edi
inc edi
cmp dword [ebp + 0x1c], edi
jne 0x1005a38
cmp dword [ebp - 0x208], 0
je 0x1005a38
push 0x10012fc
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1005b0f
and dword [ebp - 0x210], 0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1005a61
push eax
push eax
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], edi
call fcn.0100599c
mov edi, eax
jmp 0x1005a8f
mov eax, dword [ebp + 0x1c]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x208]
push eax
push ebx
push dword [ebp - 0x20c]
call fcn.0100599c
cmp dword [ebp + 0x1c], 0
mov edi, eax
jne 0x1005a8f
mov dword [ebp - 0x210], 1
test edi, edi
jne 0x1005aac
cmp dword [ebp - 0x210], 1
jne 0x1005bf3
push 0x50010001
call esi
jmp 0x1005bf3
mov eax, 0x4c3
cmp edi, eax
ja 0x1005aed
je 0x1005bfb
cmp edi, 0x34
je 0x1005acd
cmp edi, 0x56
je 0x1005b09
cmp edi, 0x4be
jne 0x1005adc
push 0x4c6
call esi
call fcn.01003127
push edi
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01002b06
leave
ret 0x18
cmp edi, 0x4cf
jb 0x1005adc
cmp edi, 0x4d1
jbe 0x1005acd
cmp edi, 0x52e
jne 0x1005bd3
cmp dword [ebp + 0x1c], 0
je 0x1005adc
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call edi
test eax, eax
jne 0x1005b33
lea eax, [ebp + 0x10]
push eax
push ebx
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x1005b33
call fcn.01003127
jmp 0x1005adc
push ebx
push 0x157d
call fcn.01003d7f
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
call edi
push eax
lea eax, [ebp - 0x204]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x40
push dword [ebp - 0x208]
call fcn.01003678
push dword [ebp - 0x208]
push ebx
push dword [ebp - 0x20c]
call fcn.0100599c
mov edi, eax
test edi, edi
je 0x1005bf3
cmp edi, 0x34
je 0x1005acd
cmp edi, 0x4be
je 0x1005acd
mov eax, 0x4c3
cmp edi, eax
je 0x1005bfb
cmp edi, 0x4ce
jbe 0x1005adc
cmp edi, 0x4d1
jbe 0x1005acd
mov eax, 0xa0010001
cmp edi, eax
jne 0x1005adc
push eax
call esi
push 0x157e
call fcn.01003d7f
push eax
call fcn.01002f34
xor eax, eax
inc eax
jmp 0x1005ade
push eax
jmp 0x1005aa5
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00404502
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00404502
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00404502
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00404502
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00404502
mov dword [0x41203c], eax
call fcn.00404502
test eax, eax
jge 0x402550
push 8
call fcn.00404502
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00404502
pop ecx
push 1
call fcn.00404502
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00404502
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00404502
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00404502
jmp 0x402495

Function at 0x404502
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x404511
pop dword [ebp - 0x20]
mov eax, 0xd79e0218
add eax, 0x28a242f9
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x36542
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x3c83
mov edx, eax
mov ebx, 0xff61221a
add ebx, 0xe019aa
add ebx, dword [ebp - 0x20]
mov edi, 0xaf72c070
sub edi, 0x973b2584
sub dword [ebp - 0x10], 0x82e81a1d
mov esi, dword [ebx]
sub dword [ebp - 0x10], edi
xor esi, edi
sub dword [ebp - 0xc], 0x50e1b5b6
mov dword [edx], esi
xor dword [ebp - 0x18], 0xfce16fad
add edx, 0x289f5a11
sub edx, 0x289f5a0d
add ebx, 0x2d3f2909
sub ebx, 0x2d3f2905
loop 0x404565
add eax, 0x7a0c240f
sub eax, 0x7a0b3f30
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x31baa9c2
sub ecx, 0x317aa9c2
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4290f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
push edi
jmp 0x42910a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x429111
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x429100
mov eax, 1
add ebx, ebx
jne 0x429123
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x429118
jne 0x429134
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429118
xor ecx, ecx
sub eax, 3
jb 0x429148
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4291ba
mov ebp, eax
add ebx, ebx
jne 0x429153
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x429160
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x429184
inc ecx
add ebx, ebx
jne 0x429170
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x429165
jne 0x429181
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429165
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4291a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x429195
jmp 0x429106
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4291a4
add edi, ecx
jmp 0x429106
pop esi
mov edi, esi
mov ecx, 0xe6a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4291c2
cmp byte [edi], 5
jne 0x4291c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4291c7
lea edi, [esi + 0x27000]
mov eax, dword [edi]
or eax, eax
je 0x42923f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2acd8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2ad8c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4291f4
mov ecx, edi
jns 0x429223
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2ad90]
or eax, eax
je 0x429239
mov dword [ebx], eax
add ebx, 4
jmp 0x429211
call dword [esi + 0x2ada0]
mov ebp, dword [esi + 0x2ad94]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x429273
sub esp, 0xffffff80
jmp 0x40116a

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x58cb5d
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
mov ecx, edi
dec edi
test ecx, ecx
je 0x58cb8b
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov ecx, esi
mov esi, dword [edx]
add eax, esi
xor ecx, esi
mov dword [edx], ecx
add edx, 4
mov ecx, edi
dec edi
test ecx, ecx
jne 0x58cb77
pop edi
pop esi
ret

Function at 0x58cc23
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
imul ecx, ecx, 0x28
mov ecx, dword [ecx + eax + 0x24]
test ecx, 0x20000000
je 0x58cc5c
test ecx, 0x40000000
je 0x58cc55
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xe0
add eax, 0x40
jmp 0x58cc6d
mov eax, 0x10
jmp 0x58cc6d
mov eax, ecx
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
and al, 0xfe
add eax, 4
test ecx, 0x4000000
je 0x58cc7a
add eax, 0x200
ret
Function at 0x58e738
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, dword [esp + 0xc]
mov ebp, esp
sub esp, 0x104
test edx, edx
push esi
push edi
je 0x58e794
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp + edx - 0x105], 0x5c
je 0x58e79b
mov esi, 0x589534
lea edi, [ebp - 0x104]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
movsw word es:[edi], word [esi]
jmp 0x58e79b
mov byte [ebp - 0x104], 0
push dword [ebp + 8]
push 0
push 0x589538
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
mov eax, 0
je 0x58e7cd
push 0x10
push 0x58953c
push dword [ebp + 8]
call fcn.0058caa9
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x58e7d3
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x4220
mov ebp, esp
call fcn.0058ee30
push esi
push edi
push 0
call fcn.0058e6c3
add esp, 4
mov dword [0x589524], eax
cmp eax, 0xffffffff
jne 0x58e911
mov edi, 0x104
lea eax, [ebp - 0x11c]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0058e738
add esp, 8
mov esi, eax
test esi, esi
jne 0x58e899
push edi
lea eax, [ebp - 0x220]
push eax
lea edi, [ebp - 0x220]
push str.PATH
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov al, byte [edi]
test al, al
je 0x58e886
xor ecx, ecx
inc edi
mov byte [ebp - 0x11c], al
cmp al, cl
je 0x58e868
cmp byte [ebp + ecx - 0x11c], 0x3b
je 0x58e868
inc ecx
mov al, byte [edi]
inc edi
mov byte [ebp + ecx - 0x11c], al
test al, al
jne 0x58e84f
push ecx
lea eax, [ebp - 0x11c]
mov byte [ebp + ecx - 0x11c], 0
push eax
call fcn.0058e738
add esp, 8
mov esi, eax
test esi, esi
je 0x58e83c
test esi, esi
jne 0x58e899
push 0xc
push 0x589548
call fcn.0058d2f6
add esp, 8
push 0x1050
lea eax, [ebp - 0x4220]
push eax
push 0x5884d4
call fcn.0058ca89
add esp, 0xc
test eax, eax
jne 0x58e8c2
push 2
push 0
call fcn.0058d2f6
add esp, 8
lea edi, [ebp - 0x41e0]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
push esi
mov eax, dword [0x5884d0]
push eax
lea ecx, [ebp - 0x4220]
push ecx
call fcn.0058cafc
add esp, 0xc
push esi
call fcn.0058ca9c
add esp, 4
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0058e6c3
add esp, 4
mov dword [0x589524], eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [0x589524], 0xffffffff
jne 0x58e926
push 0xc
push 0x58954c
jmp 0x58e9d3
xor esi, esi
lea eax, [ebp - 8]
push esi
lea ecx, [ebp - 0x18]
push eax
push 0x10
push ecx
push esi
push esi
push 1
push dword [0x589524]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x58e9cc
cmp dword [ebp - 0x18], 0x328
jne 0x58e9c3
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 0x10], edx
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 2
push dword [0x589524]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x58e999
mov eax, dword [ebp - 4]
mov dword [0x589528], eax
jmp 0x58e9db
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x76
je 0x58e9b2
cmp eax, 0x77
je 0x58e9b2
push 0xc
push 0x589578
jmp 0x58e9d3
push 0
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 1
push str.___please_restart_your_system_and_retry
jmp 0x58e9d3
push 0xc
push 0x58957c
jmp 0x58e9d3
push 0xc
push 0x589580
call fcn.0058d2f6
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b074
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40b0b8
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40b087
jmp 0x40b0b8
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40b0a8
pop esi
pop ebp
ret

Function at 0x40be10
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40be45
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40be6f
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40be6f
test edi, edi
je 0x40be3c
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40be3c
test edi, edi
je 0x40be77
mov eax, edi
jmp 0x40be3e
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40be3e
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040eb79
add esp, 0xc
int3
Function at 0x40ebad
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestMathAlgorithms.exe_gMozillaPoisonSize], eax
call fcn.0040be10
pop ecx
mov ecx, dword [sym.TestMathAlgorithms.exe_gMozillaPoisonSize]
mov dword [sym.TestMathAlgorithms.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40ebe5
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestMathAlgorithms.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0xd9bfd4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xd9bfde
pushal
call 0xd9bfe4
pop ebp
sub ebp, 0x10
sub ebp, 0x99bfd4
jmp 0xd9bffa
mov eax, 0x99bfd4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d1
mov edx, 0x6961ed03
xor byte [eax], dl
inc eax
dec ecx
jne 0xd9c011
jmp 0xd9c024
mov dh, cl
mov byte [edx + 0x303033f], cl
add dl, 0xfb
add eax, dword [ebx]
add eax, dword [eax]
into
mov ebx, 0x3030307
mov ecx, 0x303032b
hlt
Function at 0x4809d2
Capabilities:
Encode data using xor

Disassembly:
push ds
jae 0x480a17
pop dword [edi + 0x37]
leave
sbb ah, byte [ebx]
invalid
push edx
daa
jb 0x4809d9
jecxz 0x480a40
xor ebp, dword [ebx + 0x77]
pop edx
aaa
imul esi, dword [edi + 0x5a], 0x37
inc ebx
in al, 0xa6
adc bl, 0x61
pop ecx
jecxz 0x4809d8
add ebx, 0x13
xchg ecx, eax
mul dword [edx - 0x757b3dad]
stc
mov edi, 0x214c9b32
adc dh, byte [ebx]
jb 0x4809b8
salc
ret
insb byte es:[edi], dx
mov bl, 0x2d
sbb al, byte [ebp + 0x58]
adc eax, 0xd0336e4c
mov dword [0x5a1bc983], eax
inc ebp
sar dword [ebp - 0x4f], 1
pop esi
mov dl, 0xe3
mov dword [0x465a16f7], eax
adc bh, byte [edi]
ret
sahf
in al, 0x9b
ret 0x2241

Function at 0x481152
Capabilities:
Encode data using xor

Disassembly:
add ah, dl
jb 0x48118d
and esp, dword [edi]
push ebx
dec edx
cmpsb byte [esi], byte es:[edi]
shl dword [edi], cl
and esi, dword [edi]
xor eax, dword [ebx]
salc
inc eax
cmpsd dword [esi], dword es:[edi]
jecxz 0x4811dd
mov dword [0x9782c79f], eax
push esi
adc al, 0x80
and bh, 0x52
pop ss
inc ebx
pop esi
adc eax, 0x9fa77782
dec eax
add cl, 7
push edx
and ebp, dword [eax*2 + 0x32eeb37c]
into
movsd dword es:[edi], dword [esi]
test dword [ecx + 0x73], edx
in al, dx
add byte [edx - 0x4212d35e], dh
movsd dword es:[edi], dword [esi]
leave
mov bh, 0x17
mov dl, 0xa2
sub al, 0xed
mov ebp, 0x17b7c9a5
nop
and ah, bl
xchg edx, eax
into
invalid
push es
sub eax, 0xb563aabc
out dx, eax
jl 0x481179
arpl word [ebp - 0x42688311], si
add byte [ebx], 0x30
loope 0x481262
mov ebp, 0xe1300380
jp 0x481217
xor bl, byte cs:[edi - 0x3e]
xor bl, byte [edi - 0x3e]
mov word [edx], ss
pop ds
mov ebx, 0xf3007da0
mov edx, 0x111c91a3
inc eax
push es
push edi
push cs
jb 0x4811d9
popal
mov dh, 0x23
sub byte [ebp - 0x7bec5231], dl
mov esp, 0x4caae43c
push ebx
mov ah, al
out dx, eax
adc byte [ebx - 0x2b], al
cmpsb byte [esi], byte es:[edi]
outsb dx, byte [esi]
jb 0x481295
jge 0x481238
pop ds
scasb al, byte es:[edi]
pop ds
adc eax, 0x6c313e07
mov esp, 0xf3edf885
inc edx
mov ebx, 0x47779162
adc byte [edx], al
scasd eax, dword es:[edi]
imul edi, ebp, 0xb3f7a422
popal
xchg ebx, eax
scasd eax, dword es:[edi]
mov eax, 0x2b3dbf0d
test ecx, edx
movsb byte es:[edi], byte [esi]
shl ch, 0xa1
dec eax
and cl, byte [esi - 0x17]
invalid
Function at 0x496fe2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca4d2
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497105
push ecx
lea ecx, [esi + 0x18]
call fcn.004b6802
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x49711c
push ecx
lea ecx, [esi + 0x24]
call fcn.004b6712
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ca202
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov fs, word [eax]
xchg edi, eax
ror dword [ebx + 0x4f4f1330], cl
popfd
bound ebp, qword [edi + 0x25fe4e77]
and eax, 0xae98009b
mov cl, byte [ebx]
lodsb al, byte [esi]
and eax, 0xae98009b
mov cl, byte [ebx]
lodsb al, byte [esi]
salc
mov edi, 0xb2c12fce
mov dword [0xd9329eb6], eax
sahf
xor bl, cl
outsd dx, dword [esi]
pop edi
xchg edi, eax
sub dl, 0x52
clc
cmp byte [esi - 0x13], dl
rol dword [ebp + 0x6a], 1
xor dword [esi - 0x87fa1c], eax
xor byte [edi - 0x46], ch
jle 0x4ca1f2
push 0x134e49c0
sahf
int1
sbb esp, dword [esi + esi + 0x239aaf30]
inc byte [edx]
sti
dec esp
fdiv qword [ecx - 0x37]
inc esi
cmp ch, bh
sahf
xchg edi, eax
shld edx, esp, 0x85
outsb dx, byte [esi]
popfd
push cs
sub al, 0xf6
mov esi, 0x1c26c8db
cli
bswap esi
sub edx, dword [edi + ebp*2 + 0x4e2bb9a5]
pop edx
stosb byte es:[edi], al
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, 0xaa5a4e2b
dec edi
sti
sub dword [edi + 0x6682f37d], ebx
pop ss
cmp ebx, dword [edi - 0x75]
sub al, byte [ebp + 0x7b9e068e]
dec eax
jge 0x4ca25b
and byte [esi + 0x17], 0x3b
pop edi
mov ebp, dword [edx]
test dword [esi + 0x487b9e06], ecx
pop ds
in eax, 0x92
jg 0x4ca266
call es:[esi]
dec esp
mov byte [edx + 0x3f], bl
syscall
jp 0x4ca212
cmp al, 0xfe
btc dword [esi], edi
mov esi, 0xcff532c3
int 0x3f
sbb edi, dword [ebx + 0x4f]
push esi
inc ebp
setp byte [edi]
and ch, byte [edi - 2]
sbb esi, edi
salc
jp 0x4ca301
pop edi
sti
retf
invalid