joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412a98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x412b33
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403c64
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x412b0d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x443dec]
call fcn.0040529c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x412384]
call fcn.00408950
call fcn.0040331c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00412568
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412b3a
lea eax, [ebp - 0x10]
call fcn.00403824
ret

Function at 0x413f5c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x413f62
ret

Function at 0x4162e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x416331
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x416318
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x416308
jmp 0x416331
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x416319
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41fd44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x310], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x420040
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x114]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
xor ecx, ecx
mov cl, byte [ebp - 0x114]
lea edx, [ebp - 0x113]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 8]
call fcn.0040e144
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x309]
push eax
push 0x1f4
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x309]
call fcn.0040791c
cmp dword [ebp - 0xc], 0
je 0x41fe06
mov eax, dword [ebp - 0xc]
call fcn.00403aa0
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
je 0x41fe06
lea eax, [ebp - 0xc]
mov edx, 0x420058
call fcn.00403aa8
cmp dword [ebp - 0x10], 0
jle 0x42000f
xor eax, eax
push ebp
push 0x41fff8
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc]
call sub.kernel32.dll_GetTickCount
lea edx, [ebp - 0x410]
call fcn.00411434
lea edx, [ebp - 0x410]
lea eax, [ebp - 0x310]
call fcn.00403a44
push dword [ebp - 0x310]
push dword [0x440a28]
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x114]
call fcn.00403a44
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
call fcn.004076ec
push dword [ebp - 0x414]
mov eax, dword [ebp - 4]
add eax, 0x49c
mov edx, 4
call fcn.00403b60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x49c]
call fcn.00407684
xor eax, eax
push ebp
push 0x41fecd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x49c]
mov dl, 1
mov eax, dword [0x40b7c4]
call fcn.0040e390
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41ff90
xor eax, eax
push ebp
push 0x41ffd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040e290
mov eax, ebx
call fcn.00402cdc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x49c]
mov eax, dword [ebp - 4]
call fcn.0042005c
mov eax, dword [ebp - 4]
mov byte [eax + 0x4ac], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41ffee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42000f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420047
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.00403848
lea eax, [ebp - 0x310]
call fcn.00403824
lea eax, [ebp - 0xc]
call fcn.00403824
ret
Function at 0x42005c
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403c54
xor eax, eax
push ebp
push 0x420226
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00420250
mov eax, dword [ebp - 4]
add eax, 0x49c
mov edx, dword [ebp - 8]
call fcn.00403878
xor eax, eax
push ebp
push 0x4201eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x49c]
mov eax, dword [ebp - 4]
call fcn.0041f920
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x4a4], ebx
test ebx, ebx
je 0x4201e1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0041fae4
mov edx, dword [ebp - 4]
mov dword [edx + 0x4a8], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x4ac], 0
mov eax, dword [ebp - 4]
add eax, 0x4b0
call fcn.00403824
mov eax, dword [ebp - 4]
cmp dword [eax + 0x440], 0
jle 0x4201e1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x4c6], 0
je 0x4201e1
lea eax, [ebp - 0x201]
push eax
push 0x1f4
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x201]
call fcn.0040791c
cmp dword [ebp - 0xc], 0
je 0x420167
mov eax, dword [ebp - 0xc]
call fcn.00403aa0
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
je 0x420167
lea eax, [ebp - 0xc]
mov edx, 0x42023c
call fcn.00403aa8
push dword [ebp - 0xc]
call sub.kernel32.dll_GetTickCount
lea edx, [ebp - 0x308]
call fcn.00411434
lea edx, [ebp - 0x308]
lea eax, [ebp - 0x208]
call fcn.00403a44
push dword [ebp - 0x208]
push dword [0x440a28]
push 0x420248
mov eax, dword [ebp - 4]
add eax, 0x4b0
mov edx, 4
call fcn.00403b60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
call fcn.00407684
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b0]
call fcn.00403c64
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x49c]
call fcn.00403c64
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x420200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42022d
lea eax, [ebp - 0x208]
call fcn.00403824
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403848
ret
Function at 0x423944
Capabilities:
Check http status code

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
xor eax, eax
mov dword [ebx + 4], eax
cmp edx, 0x3d
je 0x423964
push edx
mov ecx, 0x3d
mov eax, ebx
mov dl, 0xa
call fcn.00420914
cmp esi, 0x194
je 0x42397b
push esi
mov ecx, 0x194
mov dl, 0x13
mov eax, ebx
call fcn.00420914
mov esi, dword [ebx]
mov edx, 0x194
mov edi, ebx
mov eax, edi
call fcn.00420750
mov dword [ebx], esi
mov byte [ebx + 0xc], 1
mov eax, edi
call fcn.00421994
xor eax, eax
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
xor edx, edx
mov dword [ebx + eax*4 + 0x7c], edx
inc eax
cmp eax, 4
jne 0x4239a4
xor eax, eax
xor edx, edx
mov dword [ebx + eax*4 + 0x8c], edx
xor edx, edx
mov dword [ebx + eax*4 + 0x9c], edx
inc eax
cmp eax, 4
jne 0x4239b2
mov eax, ebx
call fcn.00423360
mov eax, ebx
call fcn.004238b8
mov dword [ebx + 0x10], 0xc8
pop edi
pop esi
pop ebx
ret

Function at 0x42c674
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x42c6a1
mov eax, ebx
call fcn.0042c604
cmp byte [ebx + 0x38], 0
je 0x42c69a
mov dword [ebx + 0x10], 0xcf
mov al, 1
pop esi
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
mov eax, dword [ebx + 0x10]
cmp eax, 0xcb
jne 0x42c70e
mov eax, dword [ebx + 0x178]
cmp byte [eax + 0x10], 0
je 0x42c706
mov eax, dword [ebx + 8]
test eax, eax
je 0x42c6c4
mov esi, eax
mov eax, ebx
call dword [esi]
mov esi, dword [ebx + 0x178]
mov eax, ebx
call dword [esi]
test eax, eax
jne 0x42c6d7
xor eax, eax
pop esi
pop ebx
ret
cmp eax, 2
je 0x42c706
cmp dword [ebx + 8], 0
je 0x42c6b7
cmp eax, 3
je 0x42c6ea
dec eax
jne 0x42c6b7
mov eax, dword [ebx + 8]
inc dword [eax + 4]
mov eax, dword [ebx + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x42c6b7
mov edx, dword [ebx + 0x104]
add dword [eax + 8], edx
jmp 0x42c6b7
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x70], eax
jmp 0x42c720
cmp eax, 0xcc
je 0x42c720
mov ecx, eax
mov dl, 0x12
mov eax, ebx
call fcn.00420900
mov eax, ebx
call fcn.0042c72c
pop esi
pop ebx
ret
Function at 0x42ffec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4302b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x11c]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
xor ecx, ecx
mov cl, byte [ebp - 0x11c]
lea edx, [ebp - 0x11b]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 4]
add eax, 0xe
lea edx, [ebp - 0x11c]
call fcn.00403a44
mov eax, dword [ebp - 4]
lea edx, [eax + 0xd]
mov ecx, 1
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 8]
call fcn.0040e144
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x311]
push eax
push 0x1f4
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x311]
call fcn.0040791c
cmp dword [ebp - 0x14], 0
je 0x4300c9
mov eax, dword [ebp - 0x14]
call fcn.00403aa0
mov edx, dword [ebp - 0x14]
cmp byte [edx + eax - 1], 0x5c
je 0x4300c9
lea eax, [ebp - 0x14]
mov edx, 0x4302c8
call fcn.00403aa8
cmp dword [ebp - 0x18], 0
jle 0x43020e
xor eax, eax
push ebp
push 0x4301f5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x318]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xe]
call fcn.004076ec
mov ecx, dword [ebp - 0x318]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.00403aec
mov eax, dword [ebp - 0xc]
call fcn.00407684
xor eax, eax
push ebp
push 0x430139
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x40b7c4]
call fcn.0040e390
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x430193
xor eax, eax
push ebp
push 0x4301bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040e290
mov eax, ebx
call fcn.00402cdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4301d6
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 1
mov eax, dword [ebp - 4]
add eax, 0xe
mov edx, dword [ebp - 0xc]
call fcn.00403878
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43021b
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x12]
call fcn.0040c9dc
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10]
xor edx, edx
push ebp
push 0x430280
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x430272
inc ebx
mov dword [ebp - 0x10], 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004302cc
mov edx, dword [ebp - 8]
call fcn.0042fda0
inc dword [ebp - 0x10]
dec ebx
jne 0x430256
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430287
ret
Function at 0x43b158
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403c54
xor eax, eax
push ebp
push 0x43b1e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x443b2c], 1
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, 0x43b1ec
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
call fcn.00403c64
mov dword [ebp - 0x30], eax
mov eax, 0x43b1f4
mov dword [ebp - 0x2c], eax
mov eax, 0x43b1f4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 5
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
mov byte [0x443b2c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b1e8
lea eax, [ebp - 4]
call fcn.00403824
ret
Function at 0x43db68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43dc6a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00403d74
push 0x104
mov eax, dword [ebp - 4]
call fcn.00403c64
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
xchg edx, eax
call fcn.00403d74
mov eax, dword [ebp - 4]
call fcn.00403aa0
test eax, eax
jle 0x43dbdd
mov eax, dword [ebp - 4]
call fcn.00403aa0
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x43dbdd
lea eax, [ebp - 4]
mov edx, 0x43dc80
call fcn.00403aa8
lea eax, [ebp - 8]
mov ecx, 0x43dc8c
mov edx, dword [ebp - 4]
call fcn.00403aec
mov eax, dword [ebp - 8]
call fcn.00403c64
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x43dc4f
push 0x43dc94
push ebx
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x43dc49
push 0
push 0
lea edx, [ebp - 8]
mov eax, 2
call fcn.00402778
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x108]
mov ecx, 0xff
call fcn.00403a7c
lea eax, [ebp - 0x108]
call fcn.00411450
push eax
push 0x43dca8
call esi
push ebx
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dc71
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403848
ret
Function at 0x43dcb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43de47
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp byte [0x443b40], 0
jne 0x43de2c
cmp byte [0x443b48], 0
je 0x43dcec
mov bl, 1
jmp 0x43de2c
xor edx, edx
push ebp
push 0x43de0a
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [0x443b40], 1
mov dl, 1
mov eax, dword [0x4123e4]
call fcn.00412590
mov esi, eax
mov edx, 0x80000001
mov eax, esi
call fcn.00412628
xor ecx, ecx
mov edx, 0x43de60
mov eax, esi
call fcn.00412784
test al, al
je 0x43ddfe
mov edx, 0x43de80
mov eax, esi
call fcn.004129c4
test eax, eax
je 0x43ddfa
push 0xffffffffffffffff
call sub.user32.dll_ShowCursor
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00403d74
push 0x104
mov eax, dword [ebp - 8]
call fcn.00403c64
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00403d74
mov eax, dword [ebp - 8]
call fcn.00403aa0
test eax, eax
jle 0x43dda0
mov eax, dword [ebp - 8]
call fcn.00403aa0
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x43dda0
lea eax, [ebp - 8]
mov edx, 0x43dea0
call fcn.00403aa8
lea eax, [ebp - 0xc]
mov ecx, 0x43deac
mov edx, dword [ebp - 8]
call fcn.00403aec
mov eax, dword [ebp - 0xc]
call fcn.00403c64
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
jne 0x43ddc8
mov bl, 1
jmp 0x43dde7
push 0x43debc
push esi
call sub.kernel32.dll_GetProcAddress
mov edi, eax
mov eax, dword [ebp - 4]
push eax
call edi
test al, al
je 0x43dde1
mov bl, 1
push esi
call sub.kernel32.dll_FreeLibrary_1
mov dword [0x443b28], 4
push 0
call sub.user32.dll_ShowCursor
jmp 0x43de00
mov bl, 1
jmp 0x43de00
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43de16
mov byte [0x443b40], 0
mov byte [0x443b48], bl
mov eax, dword [0x443b30]
mov byte [eax + 0x11], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43de4e
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403848
ret
Function at 0x41a35e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004137f7
and dword [ebp - 4], 0
cmp dword [0x42bb20], 0
mov ebx, eax
jne 0x41a40f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41a4c0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41a4c0
push eax
call fcn.00413785
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42bb20], eax
call esi
push eax
call fcn.00413785
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42bb24], eax
call esi
push eax
call fcn.00413785
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42bb28], eax
call esi
push eax
call fcn.00413785
pop ecx
mov dword [0x42bb30], eax
test eax, eax
je 0x41a40f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00413785
pop ecx
mov dword [0x42bb2c], eax
mov eax, dword [0x42bb2c]
cmp eax, ebx
je 0x41a467
cmp dword [0x42bb30], ebx
je 0x41a467
push eax
call fcn.00413800
push dword [0x42bb30]
mov esi, eax
call fcn.00413800
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41a467
test edi, edi
je 0x41a467
call esi
test eax, eax
je 0x41a45e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41a45e
test byte [ebp - 0xc], 1
jne 0x41a467
or dword [ebp + 0x10], 0x200000
jmp 0x41a4a0
mov eax, dword [0x42bb24]
cmp eax, ebx
je 0x41a4a0
push eax
call fcn.00413800
pop ecx
test eax, eax
je 0x41a4a0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41a4a0
mov eax, dword [0x42bb28]
cmp eax, ebx
je 0x41a4a0
push eax
call fcn.00413800
pop ecx
test eax, eax
je 0x41a4a0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42bb20]
call fcn.00413800
pop ecx
test eax, eax
je 0x41a4c0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41a4c2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404937
Capabilities:
Encode data using xor

Disassembly:
call 0x404849
mov ecx, 0x1e5
add dword [eax], eax
add al, ch
invalid
invalid
invalid
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
xor byte [esi + ecx + 7], cl
loop 0x40493a
mov eax, 0x50402d1
out dx, al
clc
div esi
cmc
retf 0x3d52
Function at 0x40d013
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40d05d
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40d02c
jmp 0x40d05d
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40d04d
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40df80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40dfb5
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40dfdf
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40dfdf
test edi, edi
je 0x40dfac
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40dfac
test edi, edi
je 0x40dfe7
mov eax, edi
jmp 0x40dfae
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40dfae
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_fx_team_w32_d_0000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.00411b25
add esp, 0xc
int3
Function at 0x411b59
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestMaybe.exe_gMozillaPoisonSize], eax
call fcn.0040df80
pop ecx
mov ecx, dword [sym.TestMaybe.exe_gMozillaPoisonSize]
mov dword [sym.TestMaybe.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x411b91
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestMaybe.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5b4008], 0x8088405
inc edx
mov dword [ebx + 0x5b4008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret