joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
lea esi, [ebp - 0x50]
call fcn.0040e6e0
mov eax, dword [ebp + 8]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 0xc], ebx
call fcn.00402560
push 0x104
push 0x4a7f6c
push ebx
call dword [0x482320]
mov eax, 0x4a7f6c
call fcn.00410100
lea esi, [ebp - 0x4c]
lea edi, [ebp - 0x2c]
mov byte [ebp + 0xb], al
mov dword [0x4a7f50], 0x4a7f6c
call fcn.00410960
mov edi, 0x484d68
lea esi, [ebp - 0x1c]
call fcn.00401b10
xor eax, eax
lea ecx, [ebx + 1]
lea edx, [ebp - 0x2c]
call fcn.00401980
mov ecx, esi
call fcn.00402250
lea esi, [ebp - 0x2c]
call fcn.00408f40
mov edi, 0x484d80
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x2c], ebx
call fcn.00401b10
xor eax, eax
mov ecx, 0x100
lea edx, [ebp - 0x2c]
call fcn.00401980
mov ecx, esi
call fcn.00402250
lea esi, [ebp - 0x1c]
call fcn.00401b10
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
xor ecx, ecx
call fcn.0040c2c0
mov ecx, esi
call fcn.00402250
mov ebx, dword [ebp - 0x34]
lea ecx, [ebp - 0x1c]
call fcn.0040bc70
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x50]
call fcn.00401a10
mov esi, dword [ebp - 0x1c]
push esi
push 0x484d90
call fcn.004114ab
add esp, 8
test eax, eax
je 0x428b05
push esi
push 0x484dac
call fcn.004114ab
add esp, 8
test eax, eax
je 0x428b20
push esi
push 0x484dd4
call fcn.004114ab
add esp, 8
test eax, eax
je 0x428b3b
push esi
push 0x484dfc
call fcn.004114ab
add esp, 8
test eax, eax
jne 0x402095
cmp byte [ebp + 0xb], al
jne 0x428b90
mov dword [0x4a7f54], 3
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x50]
call fcn.00401a10
mov edx, dword [ebp - 0x1c]
push edx
push 0x4a7f6c
call fcn.00411567
add esp, 8
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x50]
sub ebx, 2
call fcn.00401a10
mov esi, dword [ebp - 0x1c]
cmp word [0x4a7f6c], 0
je 0x428b9f
test ebx, ebx
js 0x428bc6
mov edi, dword [ebp - 8]
lea eax, [ebx + 1]
push eax
push 1
mov eax, edi
call fcn.0040e830
push 0
push 1
push 0
call fcn.0040cf00
add esp, 0x14
mov esi, eax
call fcn.00408f40
mov dword [esi + 8], 1
mov dword [esi], ebx
test ebx, ebx
jle 0x402110
xor eax, eax
mov edi, dword [ebp - 8]
inc eax
push eax
push 1
push 0
mov dword [ebp + 8], eax
call fcn.0040cf00
add esp, 0xc
lea edi, [ebp - 0x1c]
mov esi, eax
call fcn.0040e6a0
mov ecx, edi
lea eax, [ebp - 0x50]
call fcn.00401a10
cmp dword [ebp + 8], ebx
jl 0x428bbe
lea ecx, [ebp - 0x1c]
call fcn.00402250
lea esi, [ebp - 0x2c]
call fcn.00408f40
lea edi, [ebp - 0x3c]
call fcn.004019d0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x3c], 0x484eac
call fcn.004019d0
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004111dc
add esp, 4
lea ecx, [ebp - 0x4c]
call fcn.00402250
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add byte [edx - 0x75], dh
dec ebp
clc
or al, 0x68
dec eax
ror byte [eax], 1
or al, 0x56
Function at 0x402400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x4a912c], ebx
jne 0x402554
mov edi, dword [0x4a90f8]
cmp edi, ebx
je 0x428afe
mov esi, dword [0x4a90f0]
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004115d7
mov edx, dword [0x4a90f8]
add esp, 4
mov dword [0x4a90fc], eax
cmp edx, ebx
jle 0x402478
xor ecx, ecx
jmp 0x402468
mov esi, dword [esi + 0xc]
mov eax, dword [0x4a90fc]
mov edx, dword [esi]
mov dword [eax + ecx*4], edx
mov edx, dword [0x4a90f8]
inc ecx
cmp ecx, edx
jl 0x402460
lea edi, [edx + 1]
xor ecx, ecx
mov eax, edi
mov edx, 0x10
mul edx
seto cl
mov esi, 1
mov dword [ebp - 0x10], 0x485a84
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.004115d7
add esp, 4
cmp eax, ebx
je 0x428aef
lea ecx, [edi - 1]
mov dword [eax], edi
lea edx, [eax + 4]
cmp ecx, ebx
jl 0x4024e5
mov eax, edx
lea ecx, [ecx]
mov dword [eax], 0x485a84
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 0x10
dec ecx
jns 0x4024d0
mov eax, edx
mov dword [0x4a912c], eax
mov edi, 0x10
mov eax, dword [0x4a90fc]
cmp esi, dword [0x4a90f8]
jg 0x402539
cmp eax, ebx
je 0x402539
cmp esi, ebx
jle 0x402539
mov eax, dword [eax + esi*4 - 4]
cmp eax, ebx
je 0x402539
lea ecx, [ebp - 0x10]
push ecx
push eax
push esi
call fcn.00402880
test eax, eax
jne 0x428af6
mov eax, dword [0x4a912c]
lea edx, [ebp - 0x10]
push edx
lea ecx, [edi + eax]
push ecx
call fcn.004022d0
inc esi
add edi, 0x10
jmp 0x4024f1
lea ebx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x485a84
call fcn.0040d530
mov edx, dword [ebp - 0xc]
push edx
call fcn.004111dc
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
invalid
Function at 0x402880
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or eax, 0xffffffff
mov word [ebp - 0xc], ax
push ebx
xor ecx, ecx
mov eax, 0x65
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov edx, 2
mul edx
seto cl
push esi
push edi
mov dword [ebp - 0x20], ebx
neg ecx
or ecx, eax
push ecx
call fcn.004115d7
add esp, 4
xor ecx, ecx
push 4
mov dword [ebp - 0x24], eax
mov word [eax], cx
call fcn.004115d7
add esp, 4
test eax, eax
je 0x427d2c
mov dword [eax], 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx + 8], ebx
jbe 0x40290f
xor edi, edi
mov eax, edx
mov ecx, dword [eax + 4]
mov esi, dword [ecx + edi*4]
test esi, esi
je 0x402909
movzx eax, word [esi + 8]
cmp ax, 0x3f
jle 0x4029d2
push esi
call fcn.004111dc
mov eax, dword [ebp + 0x10]
add esp, 4
inc edi
cmp edi, dword [eax + 8]
jb 0x4028e5
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], ebx
cmp word [eax], bx
je 0x402aff
cmp ax, 0x30
jl 0x4028fd
mov ecx, dword [esi]
test ecx, ecx
je 0x4028fd
mov eax, dword [ecx + 0xc]
dec dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], ecx
cmp dword [edx], ebx
je 0x427d34
mov ecx, dword [ebp - 8]
push ecx
call fcn.004111dc
add esp, 4
jmp 0x4028fd
mov ebx, eax
push esi
call fcn.00427670
pop ecx
test ebx, ebx
je 0x427d40
push ebx
call fcn.0042bec5
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408d90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
inc dword [eax]
mov ecx, dword [eax]
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [esi + 4]
mov ebx, dword [edx + ecx*4]
cmp word [ebx + 8], 0x47
lea edx, [edx + ecx*4]
jne 0x4289d2
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push edx
lea edx, [ebp - 8]
call fcn.0040bec0
test eax, eax
jne 0x4289e5
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp dword [ebp - 8], ebx
jae 0x408e6c
jmp 0x408de6
xor eax, eax
lea edx, [ebp - 0x1c]
push edx
mov esi, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], eax
call fcn.0040ba10
mov ecx, dword [edi + 4]
mov eax, dword [edi + 8]
mov eax, dword [ecx + eax*4 - 4]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push eax
lea edx, [ebp - 8]
push edx
push esi
call fcn.0040a780
test eax, eax
jne 0x428a05
mov eax, dword [ebp + 0x10]
inc dword [eax]
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x408e64
mov ecx, dword [esi + 4]
mov edx, dword [ecx + eax*4]
cmp word [edx + 8], 0x40
jne 0x4289ef
lea ecx, [eax + 1]
cmp ecx, ebx
je 0x4289ef
lea esi, [ebp - 0x1c]
mov dword [ebp - 8], ecx
call fcn.00408f40
cmp dword [ebp - 8], ebx
jb 0x408de4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea esi, [ebp - 0x1c]
call fcn.00408f40
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
add byte [eax], al
add bl, ch
aam 0x8b
jne fcn.004289e2
pop ebp
or al, 0x56
adc al, 0x85
leave
Function at 0x40cf00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 8], 5
jne 0x428ac6
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
je 0x40cf43
test ebx, ebx
jne 0x40cf4c
mov eax, edi
call fcn.0040cff0
test eax, eax
js 0x428ad8
mov ecx, dword [edi]
mov edx, dword [ecx]
mov esi, eax
cmp dword [edx + esi*4], 0
je 0x40cf81
mov ecx, dword [ecx]
mov eax, dword [ecx + esi*4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, edi
call fcn.0040e810
jmp 0x40cf19
cmp dword [edi + 8], 5
jne 0x428acc
mov eax, dword [edi]
mov dword [eax + 0x210], 0
test ebx, ebx
jle 0x40cf1d
lea eax, [ebp + 0xc]
mov esi, dword [eax + 4]
add eax, 4
mov edx, edi
mov dword [ebp - 4], eax
call fcn.0040cfc0
dec ebx
je 0x40cf1d
jmp 0x428adf
push 0x10
call fcn.004115d7
add esp, 4
test eax, eax
je 0x40cfaa
mov ebx, eax
call fcn.0040d290
mov ecx, dword [edi]
mov edx, dword [ecx]
mov dword [edx + esi*4], eax
mov eax, dword [edi]
mov ecx, dword [eax]
mov eax, dword [ecx + esi*4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
mov edx, dword [ecx]
xor eax, eax
mov dword [edx + esi*4], eax
mov eax, dword [edi]
mov ecx, dword [eax]
mov eax, dword [ecx + esi*4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop ebp
hlt
invalid

Function at 0x40e810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 8], 5
jne 0x40e82c
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
test eax, eax
je 0x40e82c
cmp dword [eax], 1
jg 0x428a29
mov esp, ebp
pop ebp
ret
enter 0x33ff, 0xffffffffffffffd2

Function at 0x40f820
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00412f40
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret
Function at 0x4167a8
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or eax, 0xffffffff
mov word [ebp - 0xc], ax
push ebx
xor ecx, ecx
mov eax, 0x65
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov edx, 2
mul edx
seto cl
push esi
push edi
mov dword [ebp - 0x20], ebx
neg ecx
or ecx, eax
push ecx
call fcn.004254ff
add esp, 4
xor ecx, ecx
push 4
mov dword [ebp - 0x24], eax
mov word [eax], cx
call fcn.004254ff
add esp, 4
test eax, eax
je 0x43bc54
mov dword [eax], 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx + 8], ebx
jbe 0x416837
xor edi, edi
mov eax, edx
mov ecx, dword [eax + 4]
mov esi, dword [ecx + edi*4]
test esi, esi
je 0x416831
movzx eax, word [esi + 8]
cmp ax, 0x3f
jle 0x4168fa
push esi
call fcn.00425104
mov eax, dword [ebp + 0x10]
add esp, 4
inc edi
cmp edi, dword [eax + 8]
jb 0x41680d
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], ebx
cmp word [eax], bx
je 0x416a27
cmp ax, 0x30
jl 0x416825
mov ecx, dword [esi]
test ecx, ecx
je 0x416825
mov eax, dword [ecx + 0xc]
dec dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], ecx
cmp dword [edx], ebx
je 0x43bc5c
mov ecx, dword [ebp - 8]
push ecx
call fcn.00425104
add esp, 4
jmp 0x416825
mov dword [ebp - 0x18], ebx
jmp 0x416801
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call fcn.00425104
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
add esp, 4
push eax
call fcn.00425104
add esp, 4
jmp 0x416921

Function at 0x416c35
Capabilities:
Parse credit card information

Disassembly:
mov edi, 0x4b
lea esi, [ebp - 0x14]
call fcn.00416638
mov edx, dword [ebp + 0xc]
inc ebx
cmp word [edx + ebx*2], 0x3d
jne 0x4169fa
jmp 0x43bd3b
mov edi, 0x54
lea esi, [ebp - 0x14]
inc ebx
call fcn.00416638
jmp 0x4169fa

Function at 0x41d108
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xec]
cmp eax, 0xf3c
jge 0x4416d5
inc eax
mov dword [esp + 0x24], edi
mov dword [edi + 0xec], eax
cmp eax, 1
je 0x41d4a8
cmp byte [edi + 0xfc], 0
mov byte [edi + 0x144], 0
jne 0x41d2ae
lea ebx, [ebx]
mov esi, edi
call fcn.00424868
jmp 0x41d13e
push 0xffffffffffffffff
push 0x9a
push edi
mov byte [0x4974e2], 0
call fcn.0047265f
mov eax, 1
jmp 0x41d2cd
Function at 0x41d5c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx + 4]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
mov esi, dword [eax]
push esi
call fcn.004250e9
add esp, 4
mov dword [esp + 0x34], eax
inc eax
je 0x43d6b2
add eax, 7
shr eax, 3
add eax, eax
add eax, eax
add eax, eax
xor ecx, ecx
mov dword [esp + 0x38], eax
mov edx, 2
add byte [eax], al
add bh, dh
loop 0x41d625
nop
sal edi, 0xd9
mov eax, 8
jmp 0x41d608
Function at 0x423748
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00426e68
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret
Function at 0x445f96
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x460]
test eax, eax
je 0x445fc7
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x458]
push ecx
push eax
push 1
push edx
call fcn.004281de
add esp, 0x10
mov dword [esi + 0x460], 0
pop esi
pop ebp
ret 4

Function at 0x445fcc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x460]
mov eax, dword [esi + 0x458]
mov byte [eax + ecx], dl
inc dword [esi + 0x460]
cmp dword [esi + 0x460], 0x10000
jne 0x44601b
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x458]
push eax
push 0x10000
push 1
push ecx
call fcn.004281de
add esp, 0x10
mov dword [esi + 0x460], 0
pop esi
pop ebp
ret 8

Function at 0x4461a9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x4a7540], eax
mov edx, 1
mov eax, 0x4a7540
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4a7efc
jl 0x4461bf
mov dword [0x49205c], 1
mov dword [0x4a7f10], 1
pop edi
pop ebp
ret

Function at 0x456d34
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a7f10], 0
push esi
push edi
mov esi, 0x4a7540
jne 0x456d54
push 0
call fcn.004287db
push eax
call fcn.004461a9
add esp, 8
mov dword [0x49205c], 0x270
mov dword [0x4a753c], esi
mov edx, 0xe3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
dec edx
mov dword [esi - 4], edi
jne 0x456d69
mov edx, 0x18c
lea esp, [esp]
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
dec edx
mov dword [esi - 4], edi
jne 0x456da4
mov ecx, dword [0x4a7540]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret
Function at 0x457baf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 0x18]
xor esi, esi
mov byte [0x4974ee], 0
test edi, edi
je 0x457bf4
mov byte [0x4974ef], 1
call dword [0x482160]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
push eax
push esi
lea ecx, [ebp - 8]
push ecx
push 0x443b61
push esi
push esi
mov dword [ebp - 4], edi
call fcn.00427ca7
add esp, 0x18
mov esi, eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call dword [0x482684]
mov edi, eax
test esi, esi
je 0x457c27
push 0xffffffffffffffff
push esi
mov byte [0x4974ef], 0
call dword [0x4822fc]
push esi
call dword [0x48230c]
cmp byte [0x4974ee], 1
jne 0x457c39
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x458a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
lea ecx, [eax + 4]
push edi
mov edi, dword [eax + edx]
mov dword [esi], ecx
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004254ff
mov ebx, eax
lea eax, [edi + edi]
push eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
push eax
push ebx
call fcn.00424d88
lea eax, [edi + edi]
add dword [esi], eax
xor ecx, ecx
mov word [eax + ebx], cx
add esp, 0x10
xor eax, eax
test edi, edi
jle 0x458a7e
xor word [ebx + eax*2], di
inc eax
cmp eax, edi
jl 0x458a75
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x45ef17
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xdc]
push eax
call fcn.00456b82
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xdc]
push edx
call fcn.00456adc
xor esi, esi
test edi, edi
je 0x45ef5f
lea eax, [ebp - 0xdc]
push eax
call fcn.00456b51
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x45ef4b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45f22c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
dec dword [0x49205c]
jne 0x45f23d
call fcn.00456d34
mov ecx, dword [0x4a753c]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a753c], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
jns 0x45f284
fadd qword [0x48cd18]
fmul qword [0x48cd20]
mov esp, ebp
pop ebp
ret

Function at 0x47c7b3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov al, byte [0x4974e7]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x8000
push edi
mov byte [ebp - 4], al
call fcn.00428061
add esp, 4
push eax
call fcn.00427f76
add esp, 8
mov esi, eax
push ebx
mov dword [ebp - 8], esi
call fcn.00457c89
test al, al
je 0x47c810
push edi
push ebx
call fcn.0045702e
push eax
push 1
push ebx
call fcn.0047c015
push eax
call fcn.004281de
add esp, 0x10
mov ebx, eax
jmp 0x47c85b
push esi
jmp 0x47c86e
lea esi, [ebp - 0x1c]
call fcn.00421298
push ebx
call fcn.00467313
push esi
push eax
call fcn.0047356d
mov edx, dword [ebp - 0x1c]
push edx
push 0x487e30
push edi
call fcn.00428258
add esp, 0xc
cmp byte [ebp - 4], 0
mov dword [ebp - 0xc], eax
je 0x47c84d
push ebx
call fcn.00467334
push eax
call dword [0x482214]
lea esi, [ebp - 0x1c]
call fcn.00415278
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push edi
call fcn.004284ee
add esp, 4
cmp esi, 0xffffffff
jne 0x47c80d
push 0x4000
push edi
call fcn.00428061
add esp, 4
push eax
call fcn.00427f76
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a5d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40a61f
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40a5ee
jmp 0x40a61f
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40a60f
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40b542
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40b577
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40b5a1
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40b5a1
test edi, edi
je 0x40b56e
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40b56e
test edi, edi
je 0x40b5a9
mov eax, edi
jmp 0x40b570
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40b570
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040f0e7
add esp, 0xc
int3
Function at 0x40f11b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestRefPtr.exe_gMozillaPoisonSize], eax
call fcn.0040b542
pop ecx
mov ecx, dword [sym.TestRefPtr.exe_gMozillaPoisonSize]
mov dword [sym.TestRefPtr.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40f153
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestRefPtr.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret