joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4065c9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42d2c4], 0
jne 0x406604
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4065dd
mov dword [ecx*4 + 0x42d2c0], eax
inc ecx
cmp ecx, 0x100
jl 0x4065d8
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406631
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42d2c0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406612
not eax
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6b046035
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3dbf69f4
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10028
call fcn.0043c8b0
mov eax, dword [0x448010]
mov esi, ecx
xor eax, ebp
mov dword [esp + 0x10020], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
sub esp, 0x14
movsd xmm0, qword [esp + 0x24]
lea eax, [esp + 0x2c]
movsd qword [esp + 4], xmm0
mov dword [esp + 0xc], eax
mov dword [esp], ecx
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x401d2c
lea edi, [esp + 0xc]
lea ebx, [esp + 0x20]
push 0
push edi
push 0x10000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401cf5
cmp dword [esp + 0xc], 0x10000
je 0x401cd7
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
mov dword [esp], eax
sub esp, 0x14
movsd xmm0, qword [esp + 0x14]
movsd qword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, dword [esp + 0x10020]
xor ecx, ebp
call fcn.0043c380
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401ea0
Capabilities:
Parse pe header

Disassembly:
push esi
mov eax, ecx
mov ecx, dword [esp + 8]
test ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [eax + 0xc], 0
je 0x401f0a
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x401f0a
mov esi, dword [ecx + 0x3c]
lea edx, [ecx + esi]
mov dword [eax + 4], edx
cmp dword [ecx + esi], 0x4550
jne 0x401f0a
movzx esi, word [edx + 0x18]
cmp esi, 0x10b
jne 0x401f0a
mov esi, dword [edx + 0x50]
cmp esi, 0x138
jb 0x401f0a
lea ecx, [esi + ecx - 1]
mov dword [eax + 8], ecx
cmp dword [edx + 0x74], 2
jb 0x401f0a
cmp dword [edx + 0x80], esi
setae byte [eax + 0xc]
pop esi
ret 4
Function at 0x402bd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x160
mov eax, dword [0x448010]
lea edi, [esp + 8]
mov esi, ecx
mov ecx, edi
xor eax, ebp
mov dword [esp + 0x15c], eax
call fcn.00402d00
lea edx, [esp + 0xb8]
mov ecx, edi
call fcn.00402dd0
lea edi, [esp + 0xb8]
mov ecx, edi
call fcn.00402d00
lea edx, [esp + 0xa8]
mov ecx, edi
call fcn.00406fd0
cmp byte [esp + 0xb4], 0
jne 0x402c93
cmp byte [esp + 0xa8], 0
je 0x402c93
mov ecx, str.MOZ_DISABLE_POISON_IO_INTERPOSER1
call fcn.0040a6f0
push 0x10
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
movsd xmm0, qword [esi]
mov edi, eax
movsd qword [eax], xmm0
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [edi + 0xc], eax
mov dword [esp + 4], edi
push 0
push 0x10000
push edi
push 0x40a700
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
test eax, eax
jne 0x402cc4
lea ecx, [esp + 4]
call fcn.0040a750
lea ecx, [esp + 0xb8]
call fcn.00402ef0
mov ecx, esi
call fcn.00402e50
lea ecx, [esp + 8]
call fcn.00402ef0
mov ecx, dword [esp + 0x15c]
xor ecx, ebp
call fcn.0043c380
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
call fcn.0040a750
lea ecx, [esp + 0xb8]
call fcn.00402ef0
cmp byte [0x448754], 0
je 0x402ca6
jmp 0x402c9f

Function at 0x402e50
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
push 0x441d8a
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x402ee0
push dword [edi]
mov dword [ebp - 0x18], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
lea esi, [eax + 8]
mov dword [ebp - 0x14], eax
push esi
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov ebx, eax
push esi
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [edi + 8]
mov dword [ebx], eax
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
lea eax, [ebx + 8]
push dword [ebp - 0x14]
push dword [edi]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push ebx
push 0
push esi
push 0
push 0
push dword [ebp - 0x10]
push 0
push 1
mov esi, dword [ebp - 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.mozglue.dll_free]
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4059d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x448010]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [edx + 4]
test ebx, ebx
je 0x405bb6
mov edi, edx
add edi, 8
movzx eax, word [ebx]
or eax, 2
cmp ax, 0x2f
je 0x405a10
mov ebx, dword [edi]
add edi, 4
test ebx, ebx
jne 0x4059f5
jmp 0x405bb6
cmp word [ebx + 2], 0x2d
je 0x405ba6
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x405a01
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
add esp, 4
cmp ax, 0x73
jne 0x405a01
movzx eax, word [ebx + 2]
test ax, ax
je 0x405a01
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
add esp, 4
cmp ax, 0x61
jne 0x405a01
movzx eax, word [ebx + 4]
test ax, ax
je 0x405a01
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
add esp, 4
cmp ax, 0x66
jne 0x405a01
movzx eax, word [ebx + 6]
test ax, ax
je 0x405a01
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
add esp, 4
cmp ax, 0x65
jne 0x405a01
movzx eax, word [ebx + 8]
test ax, ax
je 0x405a01
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
add esp, 4
cmp ax, 0x2d
jne 0x405a01
movzx eax, word [ebx + 0xa]
test ax, ax
je 0x405a01
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
add esp, 4
cmp ax, 0x6d
jne 0x405a01
movzx eax, word [ebx + 0xc]
test ax, ax
je 0x405a01
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
add esp, 4
cmp ax, 0x6f
jne 0x405a01
movzx eax, word [ebx + 0xe]
test ax, ax
je 0x405a01
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
add esp, 4
cmp ax, 0x64
jne 0x405a01
movzx eax, word [ebx + 0x10]
test ax, ax
je 0x405a01
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
add esp, 4
cmp ax, 0x65
jne 0x405a01
cmp word [ebx + 0x12], 0
jne 0x405a01
lea edi, [ebp - 0x14]
lea ebx, [ebp - 0x18]
mov dword [ebp - 0x14], 4
push edi
push ebx
push 0
push 0x18
push str.DisableSafeMode
push str.SOFTWAREPoliciesMozillaFirefox
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x405bae
mov dword [ebp - 0x14], 4
push edi
push ebx
push 0
push 0x18
push str.DisableSafeMode
push str.SOFTWAREPoliciesMozillaFirefox
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x405bae
mov bl, 1
jmp 0x405bb8
add ebx, 4
jmp 0x405a1e
cmp dword [ebp - 0x18], 1
mov bl, 1
jne 0x405bb8
xor ebx, ebx
push str.MOZ_SAFE_MODE_RESTART
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x405be4
mov byte [esi], bl
mov byte [esi + 1], 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [eax], 0
movzx eax, bl
mov ebx, 1
cmove ebx, eax
jmp 0x405bca
Function at 0x406a30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov esi, ecx
mov ecx, dword [0x448010]
mov eax, dword [ebp + 8]
xor ecx, ebp
mov dword [ebp - 8], ecx
cmp dword [eax + 0x14], 7
jbe 0x406a4d
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push 4
push ecx
push 4
push 0
push eax
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x406a7b
xor eax, eax
mov byte [esi + 0xc], al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
add esp, 4
pop esi
pop ebp
ret
movzx ecx, ax
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x4e
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov al, 1
mov dword [esi + 8], ecx
jmp 0x406a66
Function at 0x407080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [0x448010]
mov eax, dword [ebp + 8]
mov esi, ecx
xor edi, ebp
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], 4
cmp dword [eax + 0x14], 7
jbe 0x4070a8
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
lea edi, [ebp - 0x14]
lea ebx, [ebp - 0x1c]
push ecx
push edi
push ebx
push 0
push eax
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4070ed
cmp dword [ebp - 0x1c], 4
jne 0x407105
mov eax, dword [ebp - 0x14]
mov byte [esi + 0xc], 0
mov dword [esi + 4], 1
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, 2
jne 0x40711f
mov byte [esi + 0xc], 0
mov dword [esi + 4], 0
mov dword [esi], 0
jmp 0x4070d9
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x3f
mov dword [esi + 8], 0x8007065d
jmp 0x4070d9
movzx ecx, ax
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x3b
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [esi + 8], ecx
jmp 0x4070d9

Function at 0x407260
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edi, dword [0x448010]
xor edi, ebp
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], ecx
cmp dword [eax + 0x14], 7
jbe 0x407291
mov eax, dword [eax]
mov ecx, esp
push 8
push ecx
push 0xb
push 0
push eax
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4072c0
xor eax, eax
mov byte [esi + 0xc], al
mov ecx, dword [esp + 0xc]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
movzx ecx, ax
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x4e
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov al, 1
mov dword [esi + 8], ecx
jmp 0x4072a9

Function at 0x4072f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
mov esi, ecx
cmp dword [eax + 0x14], 7
jbe 0x407301
mov eax, dword [eax]
push eax
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x40731b
mov byte [esi + 0xc], 0
mov byte [esi], 0
mov eax, esi
pop esi
pop ebp
ret
test eax, eax
jne 0x407328
mov byte [esi + 0xc], 0
mov byte [esi], 1
jmp 0x407316
movzx ecx, ax
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x5c
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [esi + 8], ecx
jmp 0x407316
Function at 0x407350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov edi, dword [0x448010]
mov eax, dword [ebp + 8]
mov esi, ecx
xor edi, ebp
mov dword [esp + 0x10], edi
mov dword [esp + 4], 8
cmp dword [eax + 0x14], 7
jbe 0x40737d
mov eax, dword [eax]
lea ecx, [esp + 4]
lea edi, [esp + 8]
mov ebx, esp
push ecx
push edi
push ebx
push 0
push eax
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4073b6
cmp dword [esp], 0xb
jne 0x4073ef
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x10], 0
mov dword [esi + 4], ecx
mov dword [esi], eax
mov byte [esi + 8], 1
jmp 0x4073da
cmp eax, 2
jne 0x407409
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov byte [esi + 0x10], 0
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x10], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x3f
mov dword [esi + 8], 0x8007065d
jmp 0x4073da
movzx ecx, ax
mov byte [esi + 0x10], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x3b
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [esi + 8], ecx
jmp 0x4073da

Function at 0x407430
Capabilities:
Get token membership
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x448010]
mov esi, ecx
lea edi, [ebp - 0x58]
lea ebx, [ebp - 0x54]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x58], 0x44
push edi
push ebx
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x4074cc
lea eax, [ebp - 0x5c]
push eax
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x407509
cmp dword [ebp - 0x5c], 0
je 0x407524
mov dword [ebp - 0x54], 4
push ebx
push edi
push 0
push 0x18
push str.EnableLUA
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x40752d
movzx ecx, ax
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov dword [esi + 4], 0x26
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x4074f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x14
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x19
jmp 0x4074e5
mov byte [esi + 0xc], 0
mov byte [esi], 0
jmp 0x4074f5
cmp dword [ebp - 0x58], 0
mov byte [esi + 0xc], 0
sete byte [esi]
jmp 0x4074f5
Function at 0x408320
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x448010]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [0x4481bc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x448770]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x408366
mov esi, dword [0x44876c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
push 0x448770
call fcn.0043bc97
add esp, 4
cmp dword [0x448770], 0xffffffff
jne 0x40834e
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
mov dword [0x44876c], eax
push 0x448770
call fcn.0043bce9
add esp, 4
jmp 0x40834e

Function at 0x4092a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x448010]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [0x4481bc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x448778]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x409303
push 0x448778
call fcn.0043bc97
add esp, 4
cmp dword [0x448778], 0xffffffff
jne 0x409303
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov dword [0x448774], eax
push 0x448778
call fcn.0043bce9
add esp, 4
mov esi, dword [0x448774]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret

Function at 0x409cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x448010]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ecx + 0x10]
mov dword [ecx], edx
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 2
mov dword [ebp - 0x24], edx
mov dword [ecx + 4], eax
mov ecx, edx
call fcn.00408320
mov ecx, eax
lea eax, [ebx + edi - 1]
xor edx, edx
mov dword [ebp - 0x18], 0
div ecx
mov edi, eax
mov eax, ebx
xor edx, edx
div ecx
sub edi, eax
inc edi
je 0x409d65
mov ebx, eax
mov dword [ebp - 0x20], ecx
imul ebx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
test eax, eax
je 0x409d80
lea edx, [ebp - 0x14]
push edx
push 0x40
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x409d79
mov eax, dword [esi + 8]
mov edx, dword [ebp - 0x14]
cmp eax, dword [esi + 0xc]
je 0x409d89
mov ecx, dword [esi + 4]
mov dword [ecx + eax*8], edx
mov dword [ecx + eax*8 + 4], ebx
inc dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
inc eax
add ebx, ecx
cmp eax, edi
mov dword [ebp - 0x18], eax
jb 0x409d21
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x14], 0
mov ecx, esi
call fcn.00409db0
jmp 0x409d65
mov dword [ebp - 0x1c], edx
lea ecx, [esi + 4]
push 1
call fcn.00409e70
test al, al
je 0x409d80
mov eax, dword [esi + 8]
mov edx, dword [ebp - 0x1c]
jmp 0x409d48
Function at 0x40e250
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x448010]
xor eax, ebp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x40e2a1
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup]
add esp, 4
push 0x441296
push eax
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
add esp, 8
test eax, eax
jne 0x40e2e2
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043c380
add esp, 0x808
pop esi
pop edi
pop ebp
ret
lea esi, [ebp + 0xc]
mov dword [ebp - 0x810], esi
call fcn.004018b0
mov ecx, dword [eax]
lea edi, [ebp - 0x80c]
or ecx, 2
push esi
push 0
push str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
push 0x800
push edi
push dword [eax + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
add esp, 0x1c
mov byte [ebp - 0xd], 0
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x40e26f
lea edi, [ebp + 0xc]
mov esi, eax
mov dword [ebp - 0x80c], edi
call fcn.004018b0
push edi
push 0
push str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
add esp, 0x18
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
jmp 0x40e28d
Function at 0x40e730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x138
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4471fc
mov dword [ebp - 0x18], 0x43d420
mov esi, ecx
lea eax, [ebp - 0x1c]
mov ecx, dword fs:[0]
mov dword [ebp - 0x1c], ecx
lea ecx, [esi + 4]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ecx, dword [esi]
test ecx, ecx
jne 0x40e7c2
jmp 0x40e902
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x28]
push eax
push 1
push 0x441469
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx + 0x10]
test ecx, ecx
je 0x40e902
movzx eax, word [ecx]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x10], 0
shr eax, 1
push 0
push 0
push 0x104
lea edx, [ebp - 0x144]
push edx
push eax
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x40e7b4
push 0
lea ecx, [ebp - 0x28]
push ecx
push eax
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40e7b4
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 8]
and eax, dword [ecx + 0xc]
cmp eax, 0xffffffff
je 0x40e797
push 0
lea eax, [ebp - 0x28]
push eax
push 1
push 0x441a86
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x30], 0
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
shr edx, 0x10
mov word [ebp - 0x38], dx
mov word [ebp - 0x36], cx
mov ecx, eax
shr ecx, 0x10
mov word [ebp - 0x34], cx
mov word [ebp - 0x32], ax
call fcn.0040e960
jmp 0x40e888
inc dword [ebp - 0x30]
call fcn.0040e960
mov eax, dword [ebp - 0x30]
cmp eax, 4
jae 0x40e790
movzx eax, word [ebp + eax*2 - 0x38]
mov dword [ebp - 0x10], 0
push 0xa
lea ecx, [ebp - 0x144]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push 0
lea ecx, [ebp - 0x28]
push ecx
push eax
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.0040e960
cmp dword [ebp - 0x30], 3
je 0x40e880
push 0
lea eax, [ebp - 0x28]
push eax
push 1
push 0x441a84
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40e880
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x1c]
mov dword fs:[0], eax
add esp, 0x138
pop esi
pop edi
pop ebx
pop ebp
ret 4