joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100027f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [esp + 0x20], eax
cmp byte [0x1007e5a8], 0
jne 0x100029a4
mov byte [0x1007e5a8], 1
push 0x1000
push 0x1007e570
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionAndSpinCount]
push str.MOZ_TIMESTAMP_MODE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov esi, eax
test eax, eax
jne 0x100029b7
test esi, esi
setne bl
mov eax, esp
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
setne al
mov byte [0x1007d210], al
mov al, byte [0x1007d210]
test al, 1
je 0x1000299f
test bl, bl
jne 0x100029f5
lea esi, [esp + 0x14]
xor eax, eax
xor ecx, ecx
cpuid
mov dword [esi - 4], eax
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
push 0xc
push str.GenuntelineI
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x100029fc
mov eax, 0x80000000
xor ecx, ecx
cpuid
xor ecx, ecx
cmp eax, 0x80000007
jb 0x100028be
mov eax, 0x80000007
xor ecx, ecx
cpuid
and dh, 1
mov cl, dh
mov byte [0x1007e550], cl
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x1007d20c], ecx
mov dword [0x1007d208], eax
xor ecx, ecx
lea eax, [esp + 0x10]
mov dword [eax], ecx
lea esi, [esp + 0xc]
mov dword [esi], ecx
lea ecx, [esp + 8]
push ecx
push esi
push eax
call dword [sym.imp.kernel32.dll_GetSystemTimeAdjustment]
mov ecx, dword [esi]
test ecx, ecx
mov eax, 0x26161
cmovne eax, ecx
dec eax
mov ecx, 0xd1b71759
mul ecx
shr edx, 0xd
imul ecx, edx, 0x2710
mov eax, 0x2710
add ecx, eax
mov esi, dword [0x1007d208]
mov ebx, dword [0x1007d20c]
mov edi, ebx
imul edi, ecx
mov eax, esi
mul ecx
add edx, edi
xor ecx, ecx
push ecx
mov ecx, 0x2710
push ecx
push edx
push eax
call fcn.100303d0
shld edx, eax, 2
shl eax, 2
mov dword [0x1007e55c], edx
mov dword [0x1007e558], eax
mov ecx, 0x7d0
mov eax, esi
mul ecx
imul ecx, ebx, 0x7d0
add ecx, edx
mov dword [0x1007e568], eax
mov dword [0x1007e56c], ecx
mov ecx, 0x1388
mov eax, esi
mul ecx
imul ecx, ebx, 0x1388
add ecx, edx
mov dword [0x1007e590], eax
mov dword [0x1007e594], ecx
mov ecx, 0x32
mov eax, esi
mul ecx
imul ecx, ebx, 0x32
add ecx, edx
mov dword [0x1007e560], eax
mov dword [0x1007e564], ecx
call fcn.10002a30
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.1002f5c0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100713cf
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x10002843
push 0x100713cb
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x10002a1c
mov byte [0x1007d210], 0
mov al, byte [0x1007d210]
test al, 1
jne 0x10002870
jmp 0x1000299f
mov cl, 1
jmp 0x100028be
push 0xc
push str.AuthcAMDenti
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x1000289e
xor ecx, ecx
jmp 0x100028be
xor ebx, ebx
jmp 0x10002848
Function at 0x10002a30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [esp + 0x18], eax
mov al, byte [0x1007d210]
test al, 1
je 0x10002bf4
xor esi, esi
dec esi
mov ecx, 0xfffffff7
lea ebx, [esp + 0x10]
mov edi, esi
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
push ebx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push 0x1007e570
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov esi, dword [0x1007e5bc]
mov edx, dword [0x1007e5b8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp], edx
cmp eax, edx
mov edx, ecx
sbb edx, esi
jl 0x10002aab
mov dword [0x1007e5b8], eax
mov dword [0x1007e5bc], ecx
mov dword [esp], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov esi, 0x1007e570
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push ebx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [0x1007e5bc]
mov esi, dword [0x1007e5b8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp eax, esi
mov edx, ecx
sbb edx, ebx
jl 0x10002af4
mov dword [0x1007e5b8], eax
mov dword [0x1007e5bc], ecx
mov esi, eax
mov ebx, ecx
push 0x1007e570
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esi, dword [esp]
sbb ebx, dword [esp + 0xc]
mov eax, esi
mov ecx, 0x3e8
mul ecx
imul ecx, ebx, 0x3e8
add ecx, edx
mov esi, dword [esp + 4]
cmp eax, esi
mov edx, ecx
sbb edx, edi
cmovb edi, ecx
cmovb esi, eax
mov ecx, dword [esp + 8]
test ecx, ecx
lea ebx, [esp + 0x10]
je 0x10002b3e
inc ecx
mov eax, esi
or eax, edi
jne 0x10002a62
xor eax, eax
inc eax
xor ecx, ecx
mov edx, esi
or edx, edi
cmovne ecx, edi
cmovne eax, esi
mov esi, dword [0x1007d20c]
mov edx, dword [0x1007d208]
mov dword [esp], edx
mov dword [esp + 8], esi
mov edx, 0xf4240
mul edx
mov dword [esp + 4], eax
imul ebx, ecx, 0xf4240
add ebx, edx
push esi
mov edi, dword [esp + 4]
push edi
push ebx
push eax
call fcn.100303d0
mov ecx, eax
mov esi, edx
xor edx, edx
xor eax, eax
inc eax
cmp dword [esp + 4], edi
sbb ebx, dword [esp + 8]
cmovb ecx, eax
cmovb esi, edx
mov dword [esp + 4], esi
mov dword [0x1007e59c], esi
mov dword [esp], ecx
mov dword [0x1007e598], ecx
mov esi, edx
mov ecx, eax
mov edi, eax
xor edi, dword [esp]
mov ebx, edx
xor ebx, dword [esp + 4]
mov edx, 0xa
mul edx
or ebx, edi
je 0x10002bd5
lea edi, [esi + esi*4]
lea edx, [edx + edi*2]
cmp dword [esp], eax
mov edi, dword [esp + 4]
sbb edi, edx
jae 0x10002baa
mov dword [0x1007e5a0], ecx
mov dword [0x1007e5a4], esi
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.1002f5c0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x1007d20c]
mov eax, dword [0x1007d208]
mov ecx, esi
shld ecx, eax, 4
mov dword [esp], eax
shl eax, 4
jmp 0x10002b5c

Function at 0x10005bf0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xf
jmp dword [eax*4 + 0x1006ede0]
Function at 0x1000c300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov dword [ebp - 0x30], ecx
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2c]
mov dword [esp], esi
mov dword [esp + 4], 0x1006d028
call fcn.1000d810
cmp dword [esi], 0
je 0x1000c497
cmp dword [0x1007d204], 0xffffffff
jne 0x1000c4a6
lea ebx, [ebp - 0x28]
mov ecx, ebx
call fcn.1000c020
cmp byte [ebx + 4], 0
jne 0x1000c4af
mov esi, dword [ebp - 0x28]
movzx eax, word [esi]
test ax, ax
je 0x1000c380
lea ecx, [esi + 2]
lea edx, [eax - 0x41]
cmp dx, 0x19
jbe 0x1000c377
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000c361
jmp 0x1000c380
add eax, 0x20
mov word [ecx - 2], ax
jmp 0x1000c36a
mov dword [esp], 0x12
call sym.mozglue.dll_moz_xmalloc
mov edi, eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov word [eax + 0x10], 0
xor edx, edx
mov dword [ebp - 0x34], esi
mov ecx, esi
mov eax, edx
movzx esi, word [ecx]
rol edx, 5
xor edx, esi
imul edx, edx, 0x9e3779b9
add ecx, 2
test esi, esi
jne 0x1000c3a1
mov dword [esp + 0xc], eax
mov dword [esp], edi
call fcn.10031d70
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], 0
mov esi, dword [ebp - 0x2c]
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov dword [esp], eax
mov ecx, ebx
mov edx, esi
call fcn.1000c4d0
mov dword [esp], 0x20
mov ecx, ebx
mov edx, 0x10074c20
call fcn.1000c4d0
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov dword [esp], eax
mov ecx, ebx
mov edx, edi
call fcn.1000c4d0
cmp dword [ebp - 0x14], 7
jbe 0x1000c41d
mov ebx, dword [ebp - 0x28]
mov eax, ebx
xor ebx, ebx
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x1006db40]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0x4000000
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov dword [0x1007d204], eax
cmp eax, 0xffffffff
mov esi, dword [ebp - 0x30]
je 0x1000c4bd
mov byte [esi + 4], bl
lea ecx, [ebp - 0x28]
call fcn.1000bfd0
mov dword [esp], edi
call sym.mozglue.dll__aligned_free
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym.mozglue.dll__aligned_free
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
test ecx, ecx
je 0x1000c483
call fcn.1000c6c0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f5c0
mov eax, esi
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp - 0x30]
mov byte [esi + 4], 1
mov dword [esi], 0xb
jmp 0x1000c470
mov esi, dword [ebp - 0x30]
mov byte [esi + 4], 0
jmp 0x1000c470
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x30]
mov byte [esi + 4], 1
mov dword [esi], eax
jmp 0x1000c470
mov dword [esi], 0xa
mov bl, 1
jmp 0x1000c452
Function at 0x1000cc10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov byte [eax + 0xc], 0
test ecx, ecx
je 0x1000cc75
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x1000cc75
mov esi, dword [ecx + 0x3c]
lea edx, [ecx + esi]
mov dword [eax + 4], edx
cmp dword [ecx + esi], 0x4550
jne 0x1000cc75
movzx esi, word [edx + 0x18]
cmp esi, 0x10b
jne 0x1000cc75
mov esi, dword [edx + 0x50]
cmp esi, 0x138
jb 0x1000cc75
add ecx, esi
dec ecx
mov dword [eax + 8], ecx
cmp dword [edx + 0x74], 2
jb 0x1000cc75
cmp dword [edx + 0x80], esi
setae byte [eax + 0xc]
pop esi
pop ebp
ret 4
Function at 0x1000fa80
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], edx
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 2
lea eax, [ecx + 0x10]
mov dword [ebp - 0x38], ecx
mov dword [ecx + 4], eax
mov eax, dword [0x1007d328]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [0x1007e704]
cmp ecx, dword [eax + 4]
jg 0x1000fb53
mov ecx, dword [0x1007e700]
lea eax, [ebx + edi]
dec eax
xor edi, edi
xor edx, edx
div ecx
mov esi, eax
mov eax, ebx
xor edx, edx
div ecx
sub esi, eax
inc esi
mov dword [ebp - 0x48], esi
je 0x1000fb3e
mov ebx, eax
mov eax, dword [ebp - 0x38]
add eax, 4
mov dword [ebp - 0x40], eax
imul ebx, ecx
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 0x34]
push eax
push 0x40
push ecx
push ebx
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x1000fb91
mov esi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx + 8]
cmp eax, dword [ecx + 0xc]
je 0x1000fba2
mov edx, ecx
mov ecx, dword [ecx + 4]
mov dword [ecx + eax*8], esi
mov dword [ecx + eax*8 + 4], ebx
inc dword [edx + 8]
inc edi
mov ecx, dword [ebp - 0x44]
add ebx, ecx
cmp edi, dword [ebp - 0x48]
jne 0x1000fb04
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f5c0
mov eax, dword [ebp - 0x38]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1007e704
call fcn.1002ff22
add esp, 4
cmp dword [0x1007e704], 0xffffffff
jne 0x1000fad3
lea esi, [ebp - 0x34]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x1007e700], eax
push 0x1007e704
call fcn.1002ff22
add esp, 4
jmp 0x1000fad3
mov dword [ebp - 0x34], 0
mov ecx, dword [ebp - 0x38]
call fcn.1005a660
jmp 0x1000fb3e
mov dword [ebp - 0x3c], esi
mov ecx, dword [ebp - 0x40]
call fcn.1005a720
test al, al
je 0x1000fb98
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx + 8]
mov esi, dword [ebp - 0x3c]
jmp 0x1000fb24
Function at 0x10011940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 8]
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [esp + 0x20], eax
mov dword [esi], 0
mov ebx, dword [ecx + 0x3c]
test ebx, ebx
jne 0x1001197e
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.1002f5c0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edi, ecx
mov ecx, dword [ecx + 0x4c]
mov dword [edi + 0x4c], 0
test ecx, ecx
jne 0x10011a56
mov eax, dword [ebx]
mov ecx, dword [eax + 0x20]
mov dword [esp], ecx
call dword [section..00cfg]
mov ecx, ebx
call dword [esp]
xor eax, eax
mov dword [edi + 0x3c], eax
mov ecx, dword [edi + 0x40]
mov dword [edi + 0x40], eax
mov dword [esi], ecx
mov ebx, dword [edi + 0x44]
test ebx, ebx
je 0x100119ed
lea eax, [edi + 0x44]
mov dword [esp], eax
lea eax, [esp + 8]
push 1
push eax
call sym.mozglue.dll_private:_static_class_mozilla::TimeStamp___cdecl_mozilla::TimeStamp::Now_bool_
add esp, 8
lea eax, [esp + 8]
movsd xmm0, qword [eax + 0x10]
movsd qword [ebx + 0x18], xmm0
movups xmm0, xmmword [eax]
movups xmmword [ebx + 8], xmm0
mov ecx, dword [esp]
push 0
call fcn.10011910
lea ecx, [edi + 0x48]
push 0
call fcn.10011910
mov ebx, dword [edi + 0x60]
mov ecx, dword [edi + 0x64]
mov dword [edi + 0x54], ecx
mov dword [edi + 0x50], ebx
mov eax, dword [edi + 0x58]
mov dword [esp], eax
mov edx, dword [edi + 0x5c]
mov dword [esp + 4], edx
lock cmpxchg8b qword [edi + 0x58]
xor edx, dword [esp + 4]
xor eax, dword [esp]
or eax, edx
jne 0x10011a03
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x68], eax
xor ecx, ecx
xor ebx, ebx
mov eax, dword [edi + 0x70]
mov dword [esp], eax
mov edx, dword [edi + 0x74]
mov dword [esp + 4], edx
lock cmpxchg8b qword [edi + 0x70]
xor edx, dword [esp + 4]
xor eax, dword [esp]
or eax, edx
jne 0x10011a2c
xor eax, eax
mov dword [edi + 0x7c], eax
mov dword [edi + 0x78], eax
jmp 0x10011967
call fcn.1003c820
mov ebx, dword [edi + 0x3c]
jmp 0x10011992
Function at 0x10015c70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, dword [ebp + 8]
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea ecx, [ebp - 0x18]
mov dword [ecx], esi
mov dword [ebp - 0x20], 0x10035450
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_K32EnumProcessModules
test eax, eax
je 0x10015df4
mov esi, dword [ebp - 0x14]
mov ebx, esi
and ebx, 0xfffffffc
push ebx
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov edi, eax
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push ebx
mov ebx, edi
push edi
push 0xffffffffffffffff
call sub.kernel32.dll_K32EnumProcessModules
test eax, eax
je 0x10015de8
shr esi, 2
mov eax, dword [ebp - 0x14]
shr eax, 2
cmp eax, esi
cmovae eax, esi
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10015de8
xor edi, edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], edi
mov eax, dword [ebx + edi*4]
mov dword [ebp - 0x3c], eax
mov ebx, 0x104
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], ebx
add ebx, ebx
mov edi, ebx
mov eax, 0xffffffff
cmovb edi, eax
push edi
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov esi, eax
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x10015e08
mov edi, dword [ebp - 0x38]
push edi
mov dword [ebp - 0x24], esi
push esi
push dword [ebp - 0x3c]
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x10015e16
mov esi, eax
cmp eax, edi
je 0x10015e1e
inc esi
mov edi, esi
add edi, esi
mov eax, 0xffffffff
cmovb edi, eax
push edi
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov ebx, eax
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edi, dword [ebp - 0x24]
push edi
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x10015e3a
push edi
call sym.mozglue.dll__aligned_free
add esp, 4
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov esi, dword [eax + edi*4]
mov ecx, dword [ebp - 0x20]
call dword [section..00cfg]
push esi
push ebx
lea eax, [ebp - 0x1c]
push eax
call ecx
add esp, 0xc
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
inc edi
cmp edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
jne 0x10015d08
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f5c0
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x10015d4e
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
jmp 0x10015dd2
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov esi, edi
cmp eax, 0x7a
je 0x10015d1d
jmp 0x10015d71
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
mov ebx, edi
mov edi, dword [ebp - 0x28]
jmp 0x10015dd2
Function at 0x10017b60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x1007e4ec], ebx
je 0x10017c41
mov dword [0x1007e4ec], ebx
lea edi, [ebp - 0x28]
mov ecx, edi
call fcn.1000c270
cmp byte [edi + 4], 0
jne 0x10017c59
lea edi, [ebp - 0x28]
mov eax, dword [edi]
mov dword [ebp - 0x30], eax
mov ecx, edi
call fcn.1000c020
cmp byte [edi + 4], 0
jne 0x10017c67
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], 0
mov ecx, edi
mov dword [ebp - 0x34], edx
push edx
call fcn.1000c0d0
mov ecx, edi
mov edx, str.Theme
push 6
call fcn.1000c4d0
add esp, 4
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x14], 7
mov eax, edi
jbe 0x10017bf7
mov eax, dword [ebp - 0x28]
mov ecx, 4
lea edx, [ebp - 0x2c]
push ecx
push edx
push ecx
xor ebx, ebx
push ebx
push eax
push dword [ebp - 0x30]
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov esi, eax
mov ecx, edi
call fcn.1000bfd0
test esi, esi
jne 0x10017c88
mov edi, dword [ebp + 8]
mov byte [edi + 4], bl
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x10017c32
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
push dword [ebp - 0x30]
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
je 0x10017c45
jmp 0x10017c7c
mov byte [edi + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f5c0
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp + 8]
mov byte [edi + 4], 1
mov dword [edi], eax
jmp 0x10017c7c
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp + 8]
mov byte [edi + 4], 1
mov dword [edi], eax
push dword [ebp - 0x30]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [0x1007e4ec], 0
jmp 0x10017c45
mov eax, dword [ebp + 8]
mov dword [eax], 8
mov bl, 1
jmp 0x10017c1c

Function at 0x10018290
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x1007e704]
mov ecx, dword [0x1007d328]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x100182d6
mov esi, dword [0x1007e700]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002f5c0
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
push 0x1007e704
call fcn.1002ff22
add esp, 4
cmp dword [0x1007e704], 0xffffffff
jne 0x100182be
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x1007e700], eax
push 0x1007e704
call fcn.1002ff22
add esp, 4
jmp 0x100182be
Function at 0x10018410
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x1007e710]
mov ecx, dword [0x1007d328]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x10018473
push 0x1007e710
call fcn.1002ff22
add esp, 4
cmp dword [0x1007e710], 0xffffffff
jne 0x10018473
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x1007e70c], eax
push 0x1007e710
call fcn.1002ff22
add esp, 4
mov esi, dword [0x1007e70c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002f5c0
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret

Function at 0x10018730
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [esp + 0xc], eax
xor eax, eax
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx], eax
push 8
push ecx
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x10018778
mov esi, dword [esp]
mov edi, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor ecx, ebp
call fcn.1002f5c0
mov eax, esi
mov edx, edi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
int3
Function at 0x1002ed10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
and esi, 0xfffffffc
je 0x1002edcb
lea eax, [esi - 1]
mov edi, eax
shr edi, 2
add edi, 1
mov ecx, edi
and ecx, 3
cmp eax, 0xc
jae 0x1002ed40
xor eax, eax
xor ebx, ebx
jmp 0x1002ed8b
and edi, 0xfffffffc
neg edi
xor eax, eax
xor ebx, ebx
nop dword [eax]
rol eax, 5
xor eax, dword [edx + ebx]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 4]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 8]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 0xc]
imul eax, eax, 0x9e3779b9
add ebx, 0x10
add edi, 4
jne 0x1002ed50
test ecx, ecx
je 0x1002eda9
add ebx, edx
shl ecx, 2
xor edi, edi
rol eax, 5
xor eax, dword [ebx + edi]
imul eax, eax, 0x9e3779b9
add edi, 4
cmp ecx, edi
jne 0x1002ed96
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x1002edc6
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
add esi, 1
cmp edi, esi
jne 0x1002edb0
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x1002eda9
Function at 0x10031c20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x1007e4fc], 0
je 0x10031c50
mov eax, dword [0x1007e4f8]
add eax, 0xfffffffb
cmp eax, 1
jbe 0x10031d58
lea edi, [ebp - 0x28]
mov ecx, edi
call fcn.1000c270
cmp byte [edi + 4], 0
jne 0x10031d30
lea edi, [ebp - 0x28]
mov eax, dword [edi]
mov dword [ebp - 0x30], eax
mov ecx, edi
call fcn.1000c020
cmp byte [edi + 4], 0
jne 0x10031d3b
mov esi, dword [ebp - 0x28]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], 0
mov ecx, edi
push esi
call fcn.1000c0d0
mov ecx, edi
mov edx, str.Enabled
push 8
call fcn.1000c4d0
add esp, 4
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x14], 7
mov eax, edi
jbe 0x10031cbd
mov eax, dword [ebp - 0x28]
mov ecx, 4
lea edx, [ebp - 0x2c]
push ecx
push edx
push ecx
push ebx
push eax
push dword [ebp - 0x30]
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov ebx, eax
mov ecx, edi
call fcn.1000bfd0
test ebx, ebx
jne 0x10031d49
cmp byte [0x1007e4e8], 0
mov ebx, dword [ebp + 8]
jne 0x10031cfa
cmp byte [ebp + 0xc], 0
je 0x10031cfa
lea ecx, [ebp - 0x28]
call fcn.1000c300
mov al, byte [ebp + 0xc]
mov byte [0x1007e4e8], al
mov byte [ebx + 4], 0
test esi, esi
je 0x10031d13
push esi
call sym.mozglue.dll__aligned_free
add esp, 4
push dword [ebp - 0x30]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f5c0
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov byte [ebx + 4], 1
mov dword [ebx], eax
jmp 0x10031d1c
mov eax, dword [ebp - 0x28]
mov ebx, dword [ebp + 8]
mov byte [ebx + 4], 1
mov dword [ebx], eax
jmp 0x10031d13
mov ebx, dword [ebp + 8]
mov byte [ebx + 4], 1
mov dword [ebx], 8
jmp 0x10031d06
mov byte [ebx + 4], 1
mov dword [ebx], 2
jmp 0x10031d1c
Function at 0x10035260
Capabilities:
Get system information on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.mozglue.dll_malloc