joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004090
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, eax
mov dword [ebp - 4], 0
cmp ebx, 0x40000
jl 0x100040ed
jmp 0x100040b0
xor edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x7c]
push 0
push 0x40000
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x100040d1
inc edi
cmp edi, 0xf
jl 0x100040b2
cmp edi, 0xf
je 0x1000411e
add dword [ebp - 4], eax
sub ebx, 0x40000
add esi, 0x40000
cmp ebx, 0x40000
jge 0x100040b0
test ebx, ebx
jle 0x10004116
xor edi, edi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x7c]
push 0
push ebx
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1000410e
inc edi
cmp edi, 0xf
jl 0x100040f3
cmp edi, 0xf
je 0x1000411e
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x10004121
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10004440
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
lea ecx, [esi + 0x9c4]
mov edi, 0xe3
lea esp, [esp]
mov eax, dword [ecx + 4]
xor eax, dword [ecx]
and eax, 0x7fffffff
xor eax, dword [ecx]
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [ecx + 0x634]
shr eax, 1
xor edx, eax
mov dword [ecx - 0x9c0], edx
add ecx, 4
dec edi
jne 0x10004450
lea ecx, [esi + 0xd50]
mov edi, 0x18c
nop
mov eax, dword [ecx]
xor eax, dword [ecx + 4]
and eax, 0x7fffffff
xor eax, dword [ecx]
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [ecx - 0xd4c]
shr eax, 1
xor edx, eax
mov dword [ecx - 0x9c0], edx
add ecx, 4
dec edi
jne 0x10004490
mov eax, dword [esi + 0x1380]
xor eax, dword [esi + 4]
and eax, 0x7fffffff
xor eax, dword [esi + 0x1380]
mov ecx, eax
and cl, 1
movzx edx, cl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [esi + 0x634]
shr eax, 1
xor edx, eax
mov dword [esi + 0x9c0], edx
mov dword [esi], edi
pop edi
ret
Function at 0x10004500
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
add eax, 0x638
mov edx, 0x68
push edi
lea ecx, [ecx]
mov esi, dword [eax - 0x630]
mov ecx, dword [eax - 0x634]
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, dword [eax - 0x634]
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
shr ecx, 1
and edi, 0x9908b0df
xor edi, ecx
xor edi, dword [eax]
mov dword [eax + 0x38c], edi
mov edi, dword [eax - 0x62c]
mov ecx, edi
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
shr ecx, 1
and esi, 0x9908b0df
xor esi, dword [eax + 4]
xor esi, ecx
mov dword [eax + 0x390], esi
mov esi, dword [eax - 0x628]
mov ecx, esi
xor ecx, edi
and ecx, 0x7fffffff
xor ecx, edi
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
shr ecx, 1
and edi, 0x9908b0df
xor edi, dword [eax + 8]
xor edi, ecx
mov dword [eax + 0x394], edi
mov edi, dword [eax - 0x624]
mov ecx, edi
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
shr ecx, 1
and esi, 0x9908b0df
xor esi, dword [eax + 0xc]
xor esi, ecx
mov dword [eax + 0x398], esi
mov esi, dword [eax - 0x620]
mov ecx, esi
xor ecx, edi
and ecx, 0x7fffffff
xor ecx, edi
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
and edi, 0x9908b0df
xor edi, dword [eax + 0x10]
shr ecx, 1
xor edi, ecx
mov ecx, dword [eax - 0x61c]
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
mov dword [eax + 0x39c], edi
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x14]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x3a0], esi
add eax, 0x18
dec edx
jne 0x10004510
pop edi
pop esi
pop ebx
ret
Function at 0x10004650
Capabilities:
Create thread
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x1b0]
xor ebx, ebx
push edi
cmp eax, ebx
jne 0x10004673
mov dword [esi + 0x1d0], 0x598
jmp 0x1000468b
cmp eax, 0x598
jbe 0x10004685
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x1d0], eax
mov dword [esi + 0x7c], ebx
call fcn.100047b0
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, 1
push 0x1001e0e4
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 5
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], eax
mov dword [ebp - 8], ebx
call edi
mov dword [esi + 0x60], eax
cmp eax, ebx
jne 0x100046c9
push 0x1001e0e4
call edi
mov dword [esi + 0x60], eax
mov ecx, dword [esi + 0x58]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
mov ebx, 0x40000
push ecx
mov dword [ebp - 4], ebx
call edi
mov eax, dword [esi + 0x58]
push 4
lea edx, [ebp - 4]
push edx
push 0x1002
push 0xffff
push eax
mov dword [ebp - 4], ebx
call edi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.10004840
test eax, eax
je 0x1000475e
lea eax, [esi + 0x70]
push eax
push 0
push esi
push 0x100049c0
push 0
push 0
call fcn.10008f3f
add esp, 0x18
mov dword [esi + 0x6c], eax
test eax, eax
je 0x10004750
mov ecx, dword [esi + 0x44]
push ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x74], 8
push 0x65f
jmp 0x1000476c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x74], 0xb
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
xor eax, eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 5
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
call fcn.100050b0
push edi
call ebx
mov edi, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10004840
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1001b230]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x11
push 2
xor edi, edi
push 2
mov dword [ebp - 0x18], edi
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x58], eax
cmp eax, 0xffffffff
jne 0x10004882
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100082f7
mov esp, ebp
pop ebp
ret 8
push edi
push edi
lea ecx, [ebp - 0x24]
push ecx
push edi
push edi
push 4
lea edx, [ebp - 0x1c]
push edx
push 0x9800000c
push eax
mov dword [ebp - 0x1c], edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov ecx, dword [esi + 0x58]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 0x1c]
push eax
push 0xfffffffffffffffb
push 0xffff
push ecx
call edi
mov eax, dword [esi + 0x58]
push 4
lea edx, [ebp - 0x1c]
push edx
push 4
push 0xffff
push eax
call edi
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
push 0
push 0
push 0
push 0
push ebx
mov dword [esi + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x20], eax
inc eax
push eax
call fcn.10008150
mov ecx, dword [ebp - 0x20]
add esp, 4
push 0
push 0
push ecx
mov edi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x20]
push edi
mov byte [edi + edx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
push edi
mov ebx, eax
call fcn.100087b1
add esp, 4
test ebx, ebx
je 0x1000486e
mov ecx, dword [ebp + 0xc]
mov eax, 2
push ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov edx, dword [ebx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [esi + 0x5c]
mov eax, dword [esi + 0x58]
push 0x30
push edx
push eax
mov dword [ebp - 0x10], ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x100049a7
mov edx, dword [esi + 0x58]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x100049a0
cmp eax, 0xffffffff
jne 0x10004997
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x100049a0
mov dword [ebp - 0x18], 0
jmp 0x100049a7
mov dword [ebp - 0x18], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
pop edi
xor ecx, ebp
pop ebx
call fcn.100082f7
mov esp, ebp
pop ebp
ret 8
Function at 0x10004d40
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov eax, dword [eax + 0x14]
push ebx
push edi
test eax, eax
jne 0x10004d65
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10004d80
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, 1
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 2
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ebx
xor eax, eax
pop edi
pop ebx
pop ecx
ret
lea eax, [esi + 0x1b4]
push eax
lea ecx, [esi + 0x1f0]
mov ebx, 1
push ecx
mov dword [esi + 0x78], ebx
mov ecx, esi
mov eax, esi
mov dword [esi + 0x7c], ebx
call fcn.10005e80
mov edx, dword [esi + 0x58]
xor edi, edi
push edi
push edi
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10004dc8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x10004dc8
xor edi, edi
mov eax, dword [esi + 0x60]
push eax
call fcn.10003910
add esp, 4
test edi, edi
je 0x10004de2
mov eax, 0x80004005
call fcn.10001fa0
pop edi
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x10004df0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esp, [esp]
mov eax, dword [ebx + 0x88]
mov ecx, dword [ebx + 0x58]
push 0
push 0x598
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x10004ecb
cmp edi, 0x10
jne 0x10004e4e
mov edx, dword [ebx + 0x88]
mov ecx, eax
mov eax, 0x1001853c
sub edx, eax
cmp ecx, 4
jb 0x10004f03
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x10004e4e
sub ecx, 4
add eax, 4
jmp 0x10004e36
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebx + 0x1d8]
mov edx, dword [ebx + 0x1e0]
mov eax, dword [ebx + 0x88]
lea esi, [ebx + 0x1f0]
cmp edi, 0x18
jl 0x10004e7f
push ecx
push edi
push eax
mov edi, edx
call fcn.10006410
jmp 0x10004e89
cmp edi, 0xc
jne 0x10004ef9
call fcn.100062c0
cmp eax, 2
jne 0x10004e00
mov edx, dword [ebx + 0x60]
push edx
call fcn.10003910
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10004ead
mov eax, 0x4c7
mov ecx, 1
mov dword [ebx + 0x54], ecx
mov dword [ebx + 0x4c], 4
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x50], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp edi, 0xffffffff
jne 0x10004e00
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10004f20
cmp eax, 0x2744
je 0x10004e00
cmp eax, 0x2746
je 0x10004e00
jmp 0x10004ead
push 0xd
call dword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x10004e92
xor eax, eax
mov dword [ebx + 0x48], 1
mov dword [ebx + 0x4c], 5
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x50], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x10004f30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push edi
jmp 0x10004f40
mov eax, dword [esi + 0x1ac]
test eax, eax
jle 0x1000506a
lea edi, [esi + 0x178]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esi + 0x194]
cmp ebx, dword [esi + 0x198]
je 0x10004f7b
mov eax, dword [ebx + 4]
mov dword [esi + 0x194], eax
mov dword [eax + 8], 0
jmp 0x10004f8d
test ebx, ebx
je 0x10004f8d
xor eax, eax
mov dword [esi + 0x194], eax
mov dword [esi + 0x198], eax
xor eax, eax
cmp ebx, eax
je 0x10004f9f
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
dec dword [esi + 0x190]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1000506a
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x18]
push 0
sub eax, ecx
push eax
push ecx
mov ecx, dword [esi + 0x58]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x10004fec
lea eax, [esi + 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x1ac], edi
lea eax, [esi + 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x10004ff1
cmp edi, 0xffffffff
je 0x10005017
push ebx
lea edi, [esi + 0xb0]
call fcn.10002160
test eax, eax
jne 0x10004f40
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10004f40
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10005075
lea edi, [esi + 0x178]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x194]
xor ecx, ecx
cmp eax, ecx
je 0x1000504b
mov dword [eax + 8], ebx
mov ecx, dword [esi + 0x194]
mov dword [ebx + 4], ecx
jmp 0x10005057
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [esi + 0x198], ebx
inc dword [esi + 0x190]
push edi
mov dword [esi + 0x194], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 1
push ebx
lea edi, [esi + 0xb0]
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 3
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ecx
call fcn.10002160
test eax, eax
jne 0x100050a7
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100050b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov eax, dword [esi + 0x7c]
cmp eax, 3
je 0x10005198
lea edi, [esi + 0x174]
push edi
call fcn.10003840
mov ecx, dword [esi + 0x7c]
cmp ecx, 1
je 0x100050e8
mov edx, dword [esi + 0x7c]
test edx, edx
jne 0x10005192
mov dword [esi + 0x7c], 2
mov dword [edi], 0
mov eax, ebx
call fcn.100052d0
mov eax, dword [esi + 0x78]
test eax, eax
je 0x10005123
cmp dword [esi + 0x54], 0
je 0x1000511c
mov ecx, dword [esi + 0x58]
push 0
push 0x10
push 0x1001853c
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [esi + 0x78], 0
cmp dword [esi + 0x48], 0
je 0x1000514b
mov edx, dword [esi + 0x60]
push edx
call fcn.10003910
mov eax, dword [esi + 4]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
lea ecx, [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x10005160
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 0x5c], 0
mov eax, dword [esi + 0x58]
cmp eax, 0xffffffff
je 0x10005182
push 1
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0x58]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x58], 0xffffffff
mov edi, esi
call fcn.100051b0
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [edi], 0
push 0x139f
mov dword [esi + 0x74], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x100073d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1001e0e8], 0
jne 0x100074e1
push esi
push 0x178
push 0
push 0x1001df60
mov byte [0x1001e0e8], 1
call fcn.1000d7e0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.Console
push closesocket
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10007449
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp - 8]
push edx
push 0
push str.LoginInfo
push eax
call esi
cmp dword [ebp - 4], 0x400
jne 0x10007494
push 0x400
push 0
push str.tluafeDtluafeDtluafeD188081.0.0.721
call fcn.1000d7e0
mov eax, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push str.tluafeDtluafeDtluafeD188081.0.0.721
lea edx, [ebp - 8]
push edx
push 0
push str.LoginInfo
push eax
call esi
push 0x100184f8
push str.tluafeDtluafeDtluafeD188081.0.0.721
call fcn.100087bc
add esp, 8
jmp 0x100074b0
push str.tluafeDtluafeDtluafeD188081.0.0.721
call fcn.10009124
push 0x100184f8
push str.tluafeDtluafeDtluafeD188081.0.0.721
call fcn.100087bc
add esp, 0xc
test eax, eax
je 0x100074db
push eax
push 0x1001e072
push 0x1001dfc8
push 0x1001dfc4
push 0x1001df82
mov edx, 0x1001e030
mov ecx, 0x1001dfcc
call fcn.10001210
add esp, 0x14
call fcn.10006ea0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10007650
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10007689
cmp dword [0x1001e0d8], eax
jne 0x10007689
call fcn.100073d0
push 0
push 0
push 0
push 0x100074f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x1001e0d8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100082f7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001b230]
jne 0x10008301
repz ret
jmp fcn.1000981e
Function at 0x1000edac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001b230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10009b2e
and dword [ebp - 0x14], 0
cmp dword [0x1001d4fc], 0
mov dword [ebp - 0x18], eax
jne 0x1000ee5f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000ef07
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000ef07
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001d4fc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001d500], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001d504], eax
call edi
push eax
call esi
mov dword [0x1001d50c], eax
test eax, eax
je 0x1000ee5f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001d508], eax
mov eax, dword [0x1001d508]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000eeb8
cmp dword [0x1001d50c], ecx
je 0x1000eeb8
push eax
call esi
push dword [0x1001d50c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000eeb8
test ebx, ebx
je 0x1000eeb8
call edi
test eax, eax
je 0x1000eeaf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000eeaf
test byte [ebp - 8], 1
jne 0x1000eeb8
or dword [ebp + 0x10], 0x200000
jmp 0x1000eeeb
mov eax, dword [0x1001d500]
cmp eax, dword [ebp - 0x18]
je 0x1000eeeb
push eax
call esi
test eax, eax
je 0x1000eeeb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000eeeb
mov eax, dword [0x1001d504]
cmp eax, dword [ebp - 0x18]
je 0x1000eeeb
push eax
call esi
test eax, eax
je 0x1000eeeb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001d4fc]
call esi
test eax, eax
je 0x1000ef07
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000ef09
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100082f7
leave
ret
Function at 0x40aa5f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40aaa3
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40aa72
jmp 0x40aaa3
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40aa93
pop esi
pop ebp
ret

Function at 0x40b7a5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40b7da
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40b804
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40b804
test edi, edi
je 0x40b7d1
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40b7d1
test edi, edi
je 0x40b80c
mov eax, edi
jmp 0x40b7d3
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40b7d3
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040eb1b
add esp, 0xc
int3
Function at 0x40eb4f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestArrayUtils.exe_gMozillaPoisonSize], eax
call fcn.0040b7a5
pop ecx
mov ecx, dword [sym.TestArrayUtils.exe_gMozillaPoisonSize]
mov dword [sym.TestArrayUtils.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40eb87
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestArrayUtils.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40673a
pop dword [ebp - 0x3c]
mov eax, 0x40673a
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x270921e4
add dword [ebp - 0x4c], 0x27492367
mov dword [ebp - 0x48], 0x13c5a0b
sub dword [ebp - 0x48], 0xcf090dc6
mov dword [ebp - 0x44], 0x12c0b294
sub dword [ebp - 0x44], 0xc6746e66
mov dword [ebp - 0x40], 0x3a39b444
sub dword [ebp - 0x40], 0x3a39b444
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xb72fe709
add eax, 0x491099fb
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x93870e52
add dword [ebp - 0x4c], 0xe0eb5b04
mov dword [ebp - 0x48], 0x5c71c084
sub dword [ebp - 0x48], 0x1b055f0f
mov dword [ebp - 0x44], 0x8ebb33a8
add dword [ebp - 0x44], 0xd4b438c4
mov dword [ebp - 0x40], 0xe4ba00fb
add dword [ebp - 0x40], 0x1b45ff05
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ae8d
push 0
call eax
mov ecx, 0x5593
xor ebx, ebx
add ebx, eax
mov edi, 0xfbc4189a
add edi, 0x482cb66
add edi, dword [ebp - 0x3c]
mov edx, 0xbdda7bc2
add edx, 0xeb0b44d9
xor dword [ebp - 0x2c], ebx
mov esi, dword [edi]
mov dword [ebp - 0xc], 0x13402d65
xor esi, edx
mov dword [ebx], esi
sub dword [ebp - 0x20], ecx
add ebx, 0x3e65663b
sub ebx, 0x3e656637
add edi, 0x1d1c6f43
add edi, 0xe2e390c1
loop 0x40684e
add eax, 0x1491f
mov ebx, eax
add eax, 5
mov ecx, 0x59604505
sub ecx, 0x59204505
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret