joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f210
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56f9b8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x51f249
inc eax
mov dword [esi + 0x10], eax
jmp 0x51f35c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x51f25d
mov eax, 0xffffffc7
jmp 0x51f35e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x51f26e
cmp dword [esi + 8], eax
jne 0x51f25d
cmp dword [esi + 8], eax
jne 0x51f287
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x51f287
mov eax, 0xffffffc7
jmp 0x51f35e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x51f29b
push eax
mov ecx, ebx
call fcn.0051ea40
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.004f40b0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x51f2cc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004f40d0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0051e1b0
test eax, eax
mov dword [esp + 0x38], eax
je 0x51f2ff
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5b6fb0
call fcn.004f42b0
mov eax, dword [esp + 0x38]
jmp 0x51f35e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0051f070
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x51f343
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0051f090
mov esi, eax
test esi, esi
jne 0x51f373
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0051f070
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x51f315
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5b6fb0
call fcn.004f42b0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x5b6fb0
call fcn.004f42b0
mov eax, esi
jmp 0x51f35e

Function at 0x523d30
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x523d90
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x523d90
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x523d90
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x523d90
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x523dd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x52f910
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5702a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0056903e
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0052f270
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00568f6c
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00565861
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00565861
push 1
push 0
push 0
mov ecx, esi
call fcn.00565809
push 1
push 0
push 1
mov ecx, esi
call fcn.00565809
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.005690b0
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x52fa90
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5702c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0056903e
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0052f270
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00568f6c
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x52fb54
cmp dword [esp + 0x40], 1
jne 0x52fb52
cmp ecx, eax
jge 0x52fb54
mov eax, ecx
cmp eax, 0xc8
jge 0x52fb60
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0052f910
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.005690b0
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x530350
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x570373
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00563c98
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.005692e6
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0056a802
test eax, eax
je 0x53046c
mov ecx, dword [esp + 0x3c]
call fcn.00569313
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x530430
push edi
mov ecx, esi
call fcn.0056697b
mov ecx, esi
call fcn.00530620
cmp dword [esp + 0x38], 1
jne 0x530465
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00566ab6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x532660
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x532693
push esi
call fcn.00540a20
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x53268c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x532719
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x532702
mov eax, dword [esi + 8]
test eax, eax
je 0x5326b7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x5326fe
cmp eax, 2
je 0x532702
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5326aa
cmp eax, 3
je 0x5326dd
cmp eax, 1
jne 0x5326aa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x5326aa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x5326aa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00532740
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x532728
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00532740
add esp, 4
pop esi
ret

Function at 0x532fc0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x532fe1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x532fe1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x532fe1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x564a74
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x564aac
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00562b1b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00562af3
jmp 0x564ab8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x566169
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5661ab
call fcn.0056bae2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5661ab
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5661a2
xor eax, eax
jmp 0x5661b3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005661b9
pop edi
pop esi
pop ebx
ret 4
Function at 0x56c012
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x56c040
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x56c05e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0056bf78
jmp 0x56c05e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x56c05e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0056bf78
test edi, edi
mov eax, edi
jne 0x56c048
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1b2965b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dx
lea esp, [esp + 1]
lea esi, [esi - 0x2b]
mov ebx, dword [esp]
jmp 0x1b29683
lea esp, [esp + 3]
xchg dword [esp + 0x1c], esi
sub esp, 0x15
or eax, 0xab252a31
push word [esp + 0xc]
sbb dx, 0x4e7f
jmp 0x1b29618
sub esp, 0x1f
bsf edx, edi
mov ax, 0x7c1b
rdtsc
mov dword [esp + 0xb], ebx
jmp 0x1b2962e
lea eax, [eax + ebx]
mov bx, word [esp]
rcl edx, 0x12
cpuid
push dword [esp + 0x40]
ret 0x44
lea edx, reloc.WINMM.dll_midiStreamOut
sub esp, 0x10
neg eax
rdtsc
xchg dword [esp + 0x40], esi
bswap edx
jmp 0x1b2966d
Function at 0x1b2dc9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebp
mov eax, dword [esp]
cpuid
sub dl, bl
mov al, byte [esp]
rdtsc
xchg dx, bx
lea eax, reloc.WINMM.dll_midiStreamOut
add esp, 1
lea esp, [esp + 3]
jmp 0x1b2dc88
Function at 0x1b325d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x8ecc9f0d
jmp 0x1b316fb
add edx, 0x52cabf87
jmp 0x1b3175d
jmp 0x1b316b1
setb al
jmp 0x1b313cc
shl edx, 2
call fcn.01b31675
jl 0x1b31681
setb al
jmp 0x1b313cc
lea eax, reloc.WINMM.dll_midiStreamOut
clc
jmp 0x1b31724
neg eax
jle 0x1b316e5
jg 0x1b3173a
mov dword [esp + 0x28], eax
jmp 0x1b324b3
call 0x1b3170f
jmp 0x1b32596
mov edx, dword [edx + reloc.WINMM.dll_midiStreamOut]
btc eax, ecx
jl 0x1b317b9
jge 0x1b31789
popal
mov al, byte [0x8d751ae3]
or byte [eax - 0x33], 0
add al, bh
lea eax, reloc.WINMM.dll_midiStreamOut
clc
jmp 0x1b31724
mov ah, byte [esp]
setne ah
bsr eax, edx
je 0x1b31768
jne 0x1b31768
call 0x1b31755
jmp 0x1b3260f
bswap eax
mov al, bl
mov esp, edi
mov al, byte [esp]
jmp 0x1b31743
push edx
ret
or eax, 0xe41d664e
jmp 0x1b31455
mov dword [esp + 0x28], eax
jmp 0x1b32664
or eax, 0xe41d664e
jmp 0x1b31455
popal
pushfd
pop word [esp]
pushfd
push dword [esp + 3]
jmp 0x1b32acd
mov esi, dword [esp]
lea edi, [esi + edi]
mov edi, ecx
call fcn.01b32503
push 0
jmp 0x1b3254b
pushfd
jmp 0x1b3258d
inc dword [esp + 8]
jmp 0x1b32660
pushal
jmp 0x1b3170a
cmp dword [esp + 4], 0
jne 0x1b32561
jmp 0x1b32577
pop eax
sub eax, 0x9e8d93f8
jmp 0x1b325c4
call 0x1b325d4
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
lea eax, cs:[ecx]
xchg ecx, eax
invalid
pop ecx
jmp 0x1b3262f
sub ecx, 0x10016e6d
jmp 0x1b3268c
popfd
ret 4
popal
popfd
jmp 0x1b326cc
cmp ebx, 0xf6e8fe5c
je 0x1b326cc
jne 0x1b317a9
mov dword [ecx + reloc.WINMM.dll_midiStreamOut], eax
movzx ebx, byte [eax]
add ebx, 0xf6e8fd90
jmp 0x1b32668
lea esp, [esp + 4]
ret
mov si, bp
mov esi, dword [esp]
lea esi, reloc.WINMM.dll_midiStreamOut
push edi
bswap edi
lea edi, [eax*4]
jmp 0x1b3251c
mov dword [esp + 5], eax
lea esp, [esp + 2]
mov dword [esp + 2], esi
bswap esi
mov esi, ebp
bswap esi
jmp 0x1b32a92

Function at 0x1b378be
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1b37b54
jmp 0x1b1dc0e
Function at 0x1b538e4
Capabilities:
Encode data using xor

Disassembly:
sub edi, dword [ebp + 0xc]
sub esp, 0x15
jmp 0x1b539d3
inc edx
jmp 0x1b533b0
jmp 0x1b53942
test ecx, ecx
jmp 0x1b538a2
ja 0x1b53362
jne 0x1b5339a
cmp edi, dword [ebp + 0xc]
call fcn.01b538e4
xor byte [esi + 0xc64b2c], bh
add dl, byte [ebx + 0x2c956603]
xchg esi, eax
add eax, eax
cmp dword [edx], 0x2b
enter 0xffffffffffffe2e9, 0xfffffffffffffffa
invalid
mov dword [esp], ebx
mov byte [esp + 2], bl
jmp 0x1b538e6
jmp 0x1b538ce
lea esp, [esp + 4]
and al, 4
jb 0x1b5339a
jae 0x1b53362
push cs
pushfd
xor dl, byte [ebp - 0x5c]
pushal
js 0x1b538e7
jns 0x1b53918
jmp 0x1b5392a
sub eax, 0xddba24b4
sub al, 0x98
rcl dword [eax - 0x73]
and al, 4
lea esp, [esp + 4]
jbe 0x1b53384
call fcn.01b5391d
movzx eax, word [ebp - 4]
xchg cl, bl
mov ecx, 0xf67ddf0b
mov ebx, dword [esp]
jmp 0x1b53962
movzx ecx, dx
shl eax, 0x10
mov bh, 0x49
mov esi, dword [esp]
jmp 0x1b539a3
lea esp, [esp + 4]
sub eax, dword [ebp + 0xc]
push ebp
mov dword [esp], edi
cmp edi, eax
jmp 0x1b53933
mov esi, dword [esp]
not bh
jmp 0x1b539b4
setp bl
bt ebx, ebp
pop edi
lea esi, [eax - 0x88]
dec bh
jmp 0x1b5398d
add eax, ecx
mov ch, 0x66
not ch
xchg esi, ecx
jmp 0x1b53a0a
lea esp, [esp + 1]
lea esp, [esp + 0x14]
or eax, reloc.WINMM.dll_midiStreamOut
pushfd
jmp 0x1b5397e
mov ebp, ecx
mov dword [ebp], eax
pop ebp
push ebp
jmp 0x1b53a3a
mov ecx, dword [ebp + 8]
mov bx, cx
mov esi, dword [esp]
push ebp
jmp 0x1b539e3
lea esp, [esp + 8]
pop ebx
call fcn.01b539ec

Function at 0x1bca1c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], cx
lea esp, [esp + 3]
jmp 0x1bca1f7
mov ecx, dword [esp]
lea ecx, reloc.WINMM.dll_midiStreamOut
rdtsc
std
setge bl
mov edx, esp
jmp 0x1bca24b
lea esp, [esp + 1]
pushal
not ax
mov ch, 0xa9
xchg bx, ax
dec bh
jmp 0x1bca1cf
not ch
lea ecx, [eax*4]
mov dx, cx
mov bx, 0x81ae
not dh
mov dh, 0x22
jmp 0x1bca27b
lea eax, [ebp*4]
not di
or di, 0x2874
lea ebp, [esp + ebx]
dec bl
mov bx, word [esp]
jmp 0x1bca227
shr al, cl
neg bp
not cl
mov esi, 0x6c3ea764
clc
sub esp, 0x12
jmp 0x1bca2a8
lea edx, [ebx*4]
pushal
push dword [esp + 0x10]
mov dword [esp + 0x1a], ebp
pop dword [esp + 0x1a]
popal
jmp 0x1bca265
rcr si, cl
pop word [esp + 0x11]
pop word [esp + 0x1a]
xchg edi, esi
jmp 0x1bca2d8
neg cx
lea edx, [ecx*4]
bswap edi
pop word [esp + 0xc]
sub esp, 0x1f
xchg byte [esp + 0x2a], dh
jmp 0x1bca292
rdtsc
std
std
rdtsc
push word [esp + 0xe]
mov word [esp + 0x26], dx
jmp 0x1bca342
mov byte [esp + 0x1b], al
xchg word [esp + 0x13], cx
xchg dword [esp + 0x1b], ebx
mov esi, 0x263ba829
push word [esp + 0xb]
jmp 0x1bca2c2
lea esp, [esp + 0x22]
call fcn.01bca31d
Function at 0x1bca327
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 8]
call 0x1bca327
dec edi
push word [esp + 6]
mov word [esp], si
push dword [esp + 9]
bts edx, edi
jmp 0x1bca361
ror ecx, 0x10
bsr si, dx
adc ecx, esp
add esp, 2
lea esp, [esp + 0xd]
jmp 0x1bca41e
pop cx
xchg dword [esp], eax
push word [esp + 0xe]
pop bp
and ax, 0xde13
jmp 0x1bca34b
not dx
push word [esp]
btr ax, si
xor ecx, ecx
inc si
jmp 0x1bca3f3
xchg dword [esp], ecx
pop word [esp + 1]
pop di
bswap edi
xor bp, 0xf208
shl ebp, cl
jmp 0x1bca38a
rdtsc
xchg si, cx
lea ebx, [ebx*4]
ror bh, cl
neg al
bswap ecx
jmp 0x1bca3a0
lea esp, [esp]
sub esp, 0x18
lea edx, reloc.WINMM.dll_midiStreamOut
xchg dword [esp + 4], eax
jmp 0x1bca5f2
ror cx, 1
sub esp, 0x1c
add esp, 0x1a
push word [esp + 3]
add esp, 7
mov ax, 0x712f
jmp 0x1bca3dd
neg cx
xchg byte [esp], dh
xchg dword [esp], ecx
rdtsc
xchg cx, bx
mov dx, 0xd805
jmp 0x1bca3c9
xchg bl, bh
sub esp, 0
cpuid
pop esi
adc bh, dh
jmp 0x1bca48d
not ah
cld
mov al, dh
mov dl, 0xa0
mov bl, byte [esp + 4]
bsf bx, sp
jmp 0x1bca432
pushal
bsf edi, ecx
add esp, 0x27
xchg ebp, eax
mov bl, cl
xchg dword [esp], ebp
jmp 0x1bca448
bswap ecx
sub esp, 0
setle bh
mov ch, 2
add esp, 0
lea esi, [ebx + esi]
jmp 0x1bca4a5
lea esi, [ecx*4]
bts bp, di
rcl dh, cl
mov ax, sp
lea esp, [esp]
xchg byte [esp], ah
jmp 0x1bca477
stc
or di, si
xchg bp, ax
bsr bx, sp
cld
rdtsc
jmp 0x1bca565
neg ecx
push edx
mov byte [esp + 5], bh
bswap edx
bswap eax
cpuid
jmp 0x1bca468
bswap ecx
not dx
neg edx
push word [esp]
push word [esp + 2]
bsf bx, si
jmp 0x1bca51f
mov edx, ebp
rdtsc
xchg dword [esp], esi
mov dl, ch
add esp, 5
rdtsc
jmp 0x1bca4ce
xchg dword [esp], ecx
neg eax
xchg dword [esp], esi
stc
call fcn.01bca509
lea eax, [edi*4]
xchg edx, edi
bswap esi
mov al, byte [esp]
jmp 0x1bca57f
mov byte [esp], al
sub esp, 6
mov dl, 0x85
mov word [esp + 4], di
mov byte [esp + 3], dh
bsf si, dx
jmp 0x1bca4f9
lea esp, [esp]
adc ebp, 0x1f3f586c
sub esp, 0x1e
pop word [esp + 0xe]
mov edx, ebp
xchg dword [esp + 0x12], edi
jmp 0x1bca5d3
mov si, 0x5bbc
neg eax
not dx
xchg byte [esp + 2], cl
mov di, word [esp + 9]
lea esp, [esp + 0xf]
jmp 0x1bca4bf
not dx
bswap edx
push eax
cmc
cld
xchg dh, dl
jmp 0x1bca603
mov si, word [esp + 1]
add esp, 1
mov dword [esp + 3], ebp
sub esp, 4
push word [esp + 0x14]
cld
jmp 0x1bca5bd
mov byte [esp + 0x11], dl
rdtsc
not edx
xchg dx, di
add cl, al
pop bx
jmp 0x1bca5a2
mov edx, dword [esp + 0x24]
pop bx
pop di
pop dword [esp + 0xf]
not bp
xchg al, ch
jmp 0x1bca6ab
pop word [esp + 0xb]
call fcn.01bca64a
mov word [esp + 3], dx
mov dx, word [esp]
push word [esp + 2]
jmp 0x1bcaac2
mov bx, word [esp + 0xd]
cld
mov bx, sp
mov ax, word [esp + 6]
seto bl
bswap edx
jmp 0x1bca666
mov di, 0xc81a
mov ch, byte [esp + 4]
btc ebp, edi
not dl
xchg dh, bl
call fcn.01bca6ef
rdtsc
call fcn.01bca85e
inc esi
les ebx, [edx + 0x3d]
int3
pop word [esp + 3]
pop edi
std
not ebp
std
xchg ecx, ebp
jmp 0x1bca736
pop word [esp]
setbe ch
push dword [esp + 3]
bswap esi
stc
bswap ecx
jmp 0x1bca779
Function at 0x1bcabc2
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap esi
push word [esp + 5]
mov bl, byte [esp + 0xc]
not dh
pop ax
jmp 0x1bcabfa
sub esp, 0xe
mov cx, ax
mov byte [esp + 0x13], bh
xchg edx, ebp
rdtsc
xchg edi, eax
jmp 0x1bcabe4

Function at 0x1bcae69
Capabilities:
Execute anti-debugging instructions

Disassembly:
setl ch
bsf esi, eax
pop bp
jmp 0x1bcaea6
mov word [esp + 0xb], bx
xchg ah, al
xchg byte [esp + 0x1b], dl
mov byte [esp + 0xa], dl
rdtsc
add esp, 0x11
jmp 0x1bcae90
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x3210a99
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x200525bc
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40b1a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40b1ed
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40b1bc
jmp 0x40b1ed
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40b1dd
pop esi
pop ebp
ret

Function at 0x40bf45
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40bf7a
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40bfa4
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40bfa4
test edi, edi
je 0x40bf71
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40bf71
test edi, edi
je 0x40bfac
mov eax, edi
jmp 0x40bf73
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40bf73
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040eac2
add esp, 0xc
int3
Function at 0x40eaf6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonSize], eax
call fcn.0040bf45
pop ecx
mov ecx, dword [sym.TestCeilingFloor.exe_gMozillaPoisonSize]
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40eb2e
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx