joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d908
Capabilities:
Get file attributes

Disassembly:
call fcn.0040502c
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40d91c
dec eax
and al, 0x10
sete al
ret

Function at 0x40d9f8
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.00403870
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00405c64
ret

Function at 0x40e488
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e4bc
xor eax, eax
jmp 0x40e50d
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40e4f0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40e4f0
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ffc4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x40ffee
cmp dword [ebx + 0x64], 0
jne 0x40ffee
cmp dword [ebx + 0x6c], 0
jne 0x40ffee
mov edi, esi
jmp 0x410075
cmp edi, 0xffffffff
jne 0x40fff6
dec edi
jmp 0x410075
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x410075
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0040f3a4
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x410043
mov cx, word [esp]
sub cx, si
jmp 0x410045
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x41002c
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x41006b
mov cx, word [esp]
sub cx, si
jmp 0x41006d
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x410054
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4100d2
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0040fd60
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4100bd
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4100d2
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x40ffce
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x420704
Capabilities:
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x421109
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
shl byte [eax + 0x4287ac], 0x8b
adc eax, 0x42a058

Function at 0x420774
Capabilities:
Shutdown system

Disassembly:
xor byte [edx - 0x131700ab], cl
lodsb al, byte [esi]
add byte [eax], al
cmp byte [0x4287ac], 0
seta dl
mov eax, dword [esi + 0x30]
call 0x42afcb
mov eax, dword [esi + 0xa4]
movsb byte es:[edi], byte [esi]
add byte [eax], al
add byte [edx - 0x131700ab], cl
lodsb al, byte [esi]
add byte [eax], al
mov eax, dword [esi + 0xa8]
mov dl, byte [ebp - 1]
call 0x42b497
cmp byte [ebp - 1], 0
je 0x42080c
mov eax, dword [esi + 0x18]
call 0x42b7f1
mov edi, eax
mov eax, dword [esi + 0xa8]
call 0x42b79e
sub edi, eax
mov eax, dword [esi + 0xa8]
call 0x42b80b
mov edx, edi
sub edx, eax
invalid
Function at 0x420791
Capabilities:
Shutdown system

Disassembly:
xor byte [edx - 0x131700ab], cl
lodsb al, byte [esi]
add byte [eax], al
cmp byte [0x4287ac], 0
seta dl
mov eax, dword [esi + 0x30]
call 0x42afcb
mov eax, dword [esi + 0xa4]
movsb byte es:[edi], byte [esi]
add byte [eax], al
add byte [edx - 0x131700ab], cl
lodsb al, byte [esi]
add byte [eax], al
mov eax, dword [esi + 0xa8]
mov dl, byte [ebp - 1]
call 0x42b497
cmp byte [ebp - 1], 0
je 0x42080c
mov eax, dword [esi + 0x18]
call 0x42b7f1
mov edi, eax
mov eax, dword [esi + 0xa8]
call 0x42b79e
sub edi, eax
mov eax, dword [esi + 0xa8]
call 0x42b80b
mov edx, edi
sub edx, eax
invalid
Function at 0x420ee6
Capabilities:
Hide graphical window
Set current directory
Shutdown system

Disassembly:
call fcn.00407c68
push 0
mov eax, dword [0x428840]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x27
call fcn.00422b10
test al, al
je 0x420f71
mov eax, dword [esi + 0xcc]
call fcn.0040c17c
mov dl, 0xfe
invalid
test al, al
je 0x420f71
lea ecx, [ebp - 0x10]
mov eax, dword [0x428864]
mov eax, dword [eax]
mov eax, dword [eax + 0xac]
xor edx, edx
invalid

Function at 0x420f63
Capabilities:
Create process on windows
Set current directory
Shutdown system

Disassembly:
push 0
push 0
push ebx
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x4f
call fcn.00422b10
test al, al
je 0x420fd6
push edi
mov eax, dword [esi + 0xd0]
call fcn.0040c17c
test al, al
je 0x420fd6
lea ecx, [ebp - 0x10]
mov eax, dword [0x428864]
mov eax, dword [eax]
invalid

Function at 0x420f7e
Capabilities:
Set current directory
Shutdown system

Disassembly:
push 0
push 0
push ebx
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x4f
call fcn.00422b10
test al, al
je 0x420fd6
push edi
mov eax, dword [esi + 0xd0]
call fcn.0040c17c
test al, al
je 0x420fd6
lea ecx, [ebp - 0x10]
mov eax, dword [0x428864]
mov eax, dword [eax]
invalid

Function at 0x420f99
Capabilities:
Shutdown system

Disassembly:
cmp byte [eax + eax - 0x2dcd0000], 0xe8
fcmovnb st(0), st(4)
invalid

Function at 0x420fcf
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x24
call fcn.00422b10
test al, al
je fcn.00421022
mov eax, dword [esi + 0x100]

Function at 0x420fea
Capabilities:
Create process on windows
Shutdown system

Disassembly:
call fcn.0040c17c
test al, al
je fcn.00421022
push 5
push 0
push 0
lea ecx, [ebp - 0x50]
mov eax, dword [0x428864]
mov eax, dword [eax]
invalid
invalid

Function at 0x421005
Capabilities:
Shutdown system

Disassembly:
mov dl, cl
invalid
xchg esp, eax
add byte [eax], al
add byte [ebx], dh
shr al, cl
jo 0x420fd2
invalid

Function at 0x421037
Capabilities:
Shutdown system

Disassembly:
inc ecx
mov cl, 0xfe
inc dword [eax + eax*8 + 0x2ce86b74]
test al, al
je 0x4210aa
invalid
sub al, 0xc4

Function at 0x42103b
Capabilities:
Shutdown system

Disassembly:
test al, al
je 0x4210aa
call fcn.0040d470
cmp al, 2
jbe 0x4210a1
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
invalid
pop ds

Function at 0x421071
Capabilities:
Shutdown system

Disassembly:
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
mov eax, 0x10
xor edx, edx
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0xc]
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x68]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
mov eax, dword [0x428840]
mov eax, dword [eax]
call fcn.0040bd64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421110
lea eax, [ebp - 0x50]
mov edx, 5
invalid
Function at 0x422c12
Capabilities:
Delete directory
Delete file

Disassembly:
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x422ce5
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea ecx, [ebp - 4]
xor edx, edx
mov eax, edi
call fcn.00422b48
mov eax, dword [ebp - 4]
inc ebp
cld
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
cmp edi, 0x12
jne 0x422c2b
test bl, bl
je 0x422ca2
mov eax, 0x1a
call fcn.00422b38
mov esi, eax
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 1
call fcn.00422b48
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00405c8c
mov eax, dword [ebp - 0x10]
call fcn.00403af4
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
invalid
in al, dx
sub al, 0x42

Function at 0x422c5b
Capabilities:
Delete directory
Delete file

Disassembly:
add esi, 0x14
sub esi, 0x14
jl 0x422ca2
inc esi
mov edi, 0x14
lea ecx, [ebp - 8]
xor edx, edx
mov eax, edi
call fcn.00422b48
mov eax, dword [ebp - 8]
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
lea ecx, [ebp - 0xc]
lea eax, [edi + 0x1e]
xor edx, edx
call fcn.00422b48
mov eax, dword [ebp - 0xc]
call fcn.00403af4
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec esi
jne 0x422c69

Function at 0x42307c
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
add al, 0x50
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4230c0
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x4230c0
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
push ss
invalid
invalid
mov ebx, eax
test ebx, ebx
je 0x423157
mov eax, 0x400

Function at 0x423450
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ae4
xor eax, eax
push ebp
push 0x4234c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a9b4
mov edx, dword [ebp - 8]
mov eax, 0x42a0dc
call fcn.004036e8
xor eax, eax
mov dword [0x42a0d8], eax
push 0
push 0x423364
call sub.user32.dll_EnumWindows

Function at 0x4234d0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
jns fcn.004234e1
call fcn.00402d14

Function at 0x4234e1
Capabilities:
Terminate process

Disassembly:
push esi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jns 0x4234f9
call fcn.00402d14
push esp
mov esi, edi
test esi, esi
jns 0x423505
call fcn.00402d14
push esi
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x423528
mov eax, dword [esp]
push eax
test edi, edi
jns 0x42351c
call fcn.00402d14
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
Function at 0x423840
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1f
push 0
push 0
dec ecx
jne 0x423848
push ecx
push ebx

Function at 0x423859
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push fcn.004250e7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.00405990
mov eax, dword [ebp - 0x30]
mov edx, 0x425100
call fcn.00403a40
push dword [ebp + 0x11]
push 1
push 0x425108
invalid
invalid

Function at 0x423959
Capabilities:
Accept command line arguments

Disassembly:
call fcn.00406a60
cmp byte [ebp - 0x29], 0xf1
je 0x423994

Function at 0x4239bb
Capabilities:
Accept command line arguments

Disassembly:
ror byte [edx + 0x5040d645], 0xb8
nop
mov al, byte [0x1b90042]

Function at 0x4239f7
Capabilities:
Accept command line arguments

Disassembly:
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x40]
mov eax, dword [0x42a090]
invalid
test eax, eax
je 0x423a01
add byte [ebp + 0x3b0574c0], al
jo 0x4239fb
add eax, 0x72fc703b
add eax, 0xfdf30ee8
dec dword [ebp - 0x25174ffc]
cld
std
cmp esi, dword [eax - 4]
jb 0x423a06
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc dword [esi + 0x4b]
jne 0x4239e5
mov eax, 0x62
call fcn.00422b38
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x42a0ac
mov ecx, 1
mov edx, dword [0x422820]
inc edx
add al, ch
pop edi
or dh, bh
inc dword [ebx - 0x7ab4fb3c]
invalid
jl 0x423a71
inc ebx
xor esi, esi

Function at 0x423a32
Capabilities:
Accept command line arguments

Disassembly:
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.00406ad0
mov edx, dword [ebp - 0x40]
mov eax, dword [0x42a090]
invalid
test eax, eax
je 0x423a01
add byte [ebp + 0x3b0574c0], al
jo 0x4239fb
add eax, 0x72fc703b
add eax, 0xfdf30ee8
dec dword [ebp - 0x25174ffc]
cld
std
cmp esi, dword [eax - 4]
jb 0x423a06
call fcn.00402d14
lea eax, [eax + esi*4]
call fcn.004036e8
inc dword [esi + 0x4b]
jne 0x4239e5
mov eax, 0x62
call fcn.00422b38
mov edi, eax
mov ebx, edi
shl ebx, 2
push ebx
mov eax, 0x42a0ac
mov ecx, 1
mov edx, dword [0x422820]
inc edx
add al, ch
pop edi
or dh, bh
inc dword [ebx - 0x7ab4fb3c]
invalid
jl 0x423a71
inc ebx
xor esi, esi

Function at 0x4245c4
Capabilities:
Create process on windows

Disassembly:
mov ebx, eax
test ebx, ebx
jle 0x424640
mov esi, 1
mov eax, 0x39
call fcn.00422b38
xor edx, edx
mov dl, byte [0x4287c0]
imul edx
add eax, esi
Function at 0x100140f0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], edx
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 2
lea eax, [ecx + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [0x100a43c8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [0x100a5a5c]
cmp ecx, dword [eax + 4]
jg 0x100141b7
mov ebx, dword [0x100a5a58]
mov eax, dword [ebp + 0xc]
add eax, edi
dec eax
xor edx, edx
div ebx
mov ecx, eax
mov eax, edi
xor edx, edx
div ebx
mov edi, eax
inc ecx
sub ecx, eax
je 0x100141a3
mov eax, ebx
lea edx, [esi + 4]
mov dword [ebp - 0x3c], edx
imul edi, ebx
xor ebx, ebx
inc ebx
cmp ecx, 2
cmovae ebx, ecx
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x34]
push ecx
push 0x40
push eax
push edi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x100141f5
mov edx, dword [ebp - 0x34]
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
je 0x10014205
mov ecx, dword [esi + 4]
mov dword [ecx + eax*8], edx
mov dword [ecx + eax*8 + 4], edi
inc dword [esi + 8]
mov eax, dword [ebp - 0x40]
add edi, eax
dec ebx
jne 0x10014171
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f020
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100a5a5c
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5a5c], 0xffffffff
jne 0x1001413b
lea ebx, [ebp - 0x34]
push ebx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x100a5a58], eax
push 0x100a5a5c
call fcn.1004f02e
add esp, 4
jmp 0x1001413b
mov dword [ebp - 0x34], 0
mov ecx, esi
call fcn.10081060
jmp 0x100141a3
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp - 0x3c]
call fcn.10081120
test al, al
je 0x100141fc
mov eax, dword [esi + 8]
mov edx, dword [ebp - 0x38]
jmp 0x1001418e
Function at 0x1001dfc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 0xc]
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x100a5614], esi
je 0x1001e093
mov dword [0x100a5614], esi
lea edi, [ebp - 0x28]
mov ecx, edi
call fcn.10015c60
cmp byte [edi + 4], 0
jne 0x1001e0ae
lea ebx, [ebp - 0x28]
mov eax, dword [ebx]
mov dword [ebp - 0x30], eax
mov ecx, ebx
call fcn.10015cf0
cmp byte [ebx + 4], 0
jne 0x1001e0bc
mov edi, dword [ebp - 0x28]
mov ecx, ebx
mov edx, edi
push str.Theme
call fcn.10015da0
add esp, 4
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x14], 8
jb 0x1001e035
mov ebx, dword [ebp - 0x28]
mov eax, 4
lea ecx, [ebp - 0x2c]
push eax
push ecx
push eax
push 0
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
mov esi, dword [ebp + 8]
jbe 0x1001e06e
mov eax, dword [ebp - 0x28]
inc ecx
test ecx, 0x7ffff800
jne 0x1001e0dd
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
test ebx, ebx
jne 0x1001e0f1
xor eax, eax
mov byte [esi + 4], al
test edi, edi
je 0x1001e084
push edi
call sym.mozglue.dll__aligned_free
add esp, 4
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1001e09a
jmp 0x1001e0d1
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f020
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 1
mov dword [esi], eax
jmp 0x1001e0d1
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 1
mov dword [esi], eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x100a5614], 0
jmp 0x1001e09a
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1001e0fe
mov eax, ecx
jmp 0x1001e065
mov dword [esi], 7
mov al, 1
jmp 0x1001e074
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x1001e720
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x100a5a68]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x1001e783
push 0x100a5a68
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5a68], 0xffffffff
jne 0x1001e783
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x100a5a64], eax
push 0x100a5a68
call fcn.1004f02e
add esp, 4
mov esi, dword [0x100a5a64]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1004f020
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x1004e7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, edi
and eax, 0xfffffffc
je 0x1004e88f
lea esi, [eax - 1]
mov edi, esi
shr edi, 2
inc edi
mov ecx, edi
and ecx, 3
cmp eax, 0xd
jae 0x1004e800
xor eax, eax
xor ebx, ebx
jmp 0x1004e84b
and edi, 0xfffffffc
xor eax, eax
xor ebx, ebx
nop word [eax + eax]
rol eax, 5
xor eax, dword [edx + ebx]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 4]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 8]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 0xc]
imul eax, eax, 0x9e3779b9
add ebx, 0x10
add edi, 0xfffffffc
jne 0x1004e810
test ecx, ecx
je 0x1004e869
add ebx, edx
shl ecx, 2
xor edi, edi
rol eax, 5
xor eax, dword [ebx + edi]
imul eax, eax, 0x9e3779b9
add edi, 4
cmp ecx, edi
jne 0x1004e856
and esi, 0xfffffffc
add esi, 4
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x1004e88a
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc esi
cmp edi, esi
jne 0x1004e876
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
xor eax, eax
cmp esi, edi
jb 0x1004e876
jmp 0x1004e88a
Function at 0x1005bac0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [0x100a5434]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x1005bb47
push 0x100a5434
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5434], 0xffffffff
jne 0x1005bb47
push str.MOZ_BASE_PROFILER_VERBOSE_LOGGING
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x1005bb53
push str.MOZ_BASE_PROFILER_DEBUG_LOGGING
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x1005bb5a
push str.MOZ_BASE_PROFILER_LOGGING
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
xor ecx, ecx
test eax, eax
setne cl
lea eax, [ecx + ecx*2]
mov dword [0x100a5430], eax
push 0x100a5434
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5430], esi
setge al
pop esi
pop ebp
ret
mov eax, 5
jmp 0x1005bb35
mov eax, 4
jmp 0x1005bb35
Function at 0x1007b2d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x818
mov edi, dword [ebp + 8]
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007b347
lea edi, [ebp + 0xc]
mov dword [ebp - 0x824], edi
lea esi, [ebp - 0x820]
mov ecx, esi
call sym.mozglue.dll_protected:_void___thiscall_mozilla::PrintfTarget::constructor_void_
mov dword [esi], 0x100928dc
lea ebx, [ebp - 0x810]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 0x800
mov ecx, esi
push edi
mov edi, dword [ebp + 8]
push edi
call sym.mozglue.dll_public:_bool___thiscall_mozilla::PrintfTarget::vprint_char_const___char__
mov eax, dword [esi + 4]
mov ecx, 0x7ff
cmp eax, ecx
cmovb ecx, eax
mov byte [ebp + ecx - 0x810], 0
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
add esp, 4
cmp eax, 0xfffffffe
je 0x1007b3ad
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup]
add esp, 4
push 0x100969af
push eax
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
add esp, 8
test eax, eax
je 0x1007b3ad
mov esi, eax
mov ebx, edi
lea edi, [ebp + 0xc]
mov dword [ebp - 0x810], edi
call fcn.10006380
push edi
push 0
push ebx
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
add esp, 0x18
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f020
add esp, 0x818
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1007c5c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100a5868]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1007c5e7
mov al, byte [0x100a5866]
pop ebp
ret
push 0x100a5868
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5868], 0xffffffff
jne 0x1007c5e0
push str.MOZ_DISABLE_WALKTHESTACK
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x1007c629
cmp byte [eax], 0
sete al
mov byte [0x100a5866], al
push 0x100a5868
call fcn.1004f02e
add esp, 4
jmp 0x1007c5e0
mov al, 1
jmp 0x1007c615