joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419882
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4294c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040dfd2
mov dword [ebp - 0x14], eax
cmp dword [0x42b998], esi
jne 0x419975
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x419902
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x419a55
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x419a55
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419a55
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42b998], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42b99c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x42b9a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42b9a8], eax
test eax, eax
je 0x419972
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42b9a4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41999a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41998d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4199af
push 4
pop eax
jmp 0x419a57
cmp dword [ebp - 0x14], esi
je 0x4199af
push dword [0x42b998]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x419994
mov eax, dword [0x42b9a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x419a0d
cmp dword [0x42b9a8], edi
je 0x419a0d
push eax
call ebx
push dword [0x42b9a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x419a0d
test eax, eax
je 0x419a0d
call ecx
test eax, eax
je 0x419a02
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x419a02
test byte [ebp - 8], 1
jne 0x419a0d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x419a3d
mov eax, dword [0x42b99c]
cmp eax, edi
je 0x419a3a
push eax
call ebx
test eax, eax
je 0x419a3a
call eax
mov esi, eax
test esi, esi
je 0x419a3a
mov eax, dword [0x42b9a0]
cmp eax, edi
je 0x419a3a
push eax
call ebx
test eax, eax
je 0x419a3a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42b998]
call ebx
test eax, eax
je 0x419a55
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x419a57
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a011
mov esp, ebp
pop ebp
ret
Function at 0x401491
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x446cf0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x401526
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014e3
cmp dword [ebp + 0x10], ebx
jne 0x40151a
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401491
test eax, eax
jne 0x4014f5
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014ca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.00405b0e
cmp eax, ebx
je 0x40152d
push ebx
push dword [0x446cf0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401526
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x446cf0], ebx
jne 0x401523
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x401523
jmp 0x401526
Function at 0x402e7e
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402e9b
mov dword [ebp - 8], ExpandEnvironmentStringsA
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402eaa
mov ebx, 0x417928
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402ebf
mov ecx, dword [0x446c58]
add ecx, eax
push ecx
call fcn.00402e67
push 4
lea eax, [ebp + 0x14]
push eax
call fcn.00402e35
test eax, eax
jne 0x402ed6
push 0xfffffffffffffffd
jmp 0x516898
test dword [ebp + 0x14], 0x80000000
je 0x40300e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x427930
mov dword [ebp - 0xc], eax
call fcn.00406395
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x40302c
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f16
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x413928
push edi
call fcn.00402e35
test eax, eax
je 0x402ece
sub dword [ebp + 0x14], esi
mov dword [0x427948], edi
mov dword [0x42794c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x427930
mov dword [0x427950], ebx
mov dword [0x427954], eax
call fcn.004063b5
mov dword [ebp - 0x14], eax
test eax, eax
jl 0x403000
mov esi, dword [0x427950]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x446cf4], 1
mov edi, eax
je 0x402fb4
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402f81
cmp dword [ebp + 0x14], 0
jne 0x402fb4
push dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.0040490d
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x402ff5
cmp dword [ebp + 0x10], eax
jne 0x402fdd
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403007
cmp dword [ebp - 0x10], esi
jne 0x403007
add dword [ebp - 4], esi
jmp 0x402fe9
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x427950]
cmp dword [ebp - 0x14], 1
jne 0x402f35
jmp 0x40302c
cmp dword [ebp + 0x14], eax
jg 0x402f09
jmp 0x40302c
push 0xfffffffffffffffc
jmp 0x402ed0
push 0xfffffffffffffffe
jmp 0x402ed0
test edi, edi
je 0x403075
cmp dword [ebp + 0x14], esi
jge 0x40301a
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00402e35
test eax, eax
je 0x402ece
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403041
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x413928
push edi
call fcn.00402e35
test eax, eax
je 0x402ece
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403007
cmp esi, dword [ebp + 0x10]
jne 0x403007
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403036
jmp 0x40302c
Function at 0x40331d
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Shutdown system
Terminate process

Disassembly:
sub esp, 0x184
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ExpandEnvironmentStringsA
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x18], 0x20
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x403366
push ebx
call fcn.00405b0e
cmp eax, ebx
je 0x403366
push 0xc00
call eax
mov esi, str.uxtheme
push esi
call fcn.00405aa0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp loc.00517e78

Function at 0x405263
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [0x446c0c]
push edi
push 3
call fcn.00405b0e
xor ebx, ebx
cmp eax, ebx
je 0x405294
push 1
push ebx
call eax
movzx eax, ax
cdq
push edx
push eax
push 0x477000
call fcn.00405860
jmp 0x4052de
push ebx
mov edi, 0x4319e8
push edi
push ebx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov dword [0x477000], 0x7830
call fcn.004057e9
cmp byte [0x4319e8], bl
jne 0x4052d3
push ebx
push edi
push 0x40750e
push str..DEFAULTControl_PanelInternational
push 0x80000003
call fcn.004057e9
push edi
push 0x477000
call sub.KERNEL32.dll_lstrcatA
call fcn.0040393e
mov eax, dword [0x446c68]
and eax, 0x20
mov ebp, 0x471000
push ebp
mov dword [0x446cc0], eax
mov dword [0x446cdc], 0x10000
call fcn.00405be7
test eax, eax
jne 0x40538e
mov ecx, dword [esi + 0x48]
cmp ecx, ebx
je 0x40538e
mov eax, dword [0x446c38]
mov edx, dword [esi + 0x4c]
push ebx
mov edi, 0x43eba0
push edi
add edx, eax
push edx
add ecx, eax
push ecx
push dword [esi + 0x44]
call fcn.004057e9
mov al, byte [0x43eba0]
cmp al, bl
je 0x40538e
cmp al, 0x22
jne 0x40534d
push 0x22
mov edi, 0x43eba1
push edi
call fcn.00405697
mov byte [eax], bl
push edi
call sub.KERNEL32.dll_lstrlenA
lea eax, [eax + edi - 4]
cmp eax, edi
jbe 0x405381
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x405381
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40537b
test al, 0x10
jne 0x405381
push edi
call fcn.00405bc0
push edi
call fcn.00405b93
push eax
push ebp
call fcn.004059bd
push ebp
jmp 0x516190

Function at 0x405531
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x407684
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov byte [ebp - 0x20], 1
mov byte [ebp - 0x1f], 0
mov dword [ebp - 0x10], 0x407674
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x405582
xor eax, eax
jmp 0x4055af
push esi
jmp loc.00517518
leave
ret 4
Function at 0x4055d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x439a00
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x439a00], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40560b
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405752
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40576f
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405772
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
jmp loc.00516a28

Function at 0x4057a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4057e5
test edi, edi
jne 0x4057ac
mov byte [esi], 0
jmp loc.00516258
mov eax, esi
jmp 0x4057df

Function at 0x4057e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40585a
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
jmp loc.00517db0
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x405be7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x439a48
push esi
call fcn.004059bd
push esi
call fcn.004056db
mov edi, eax
test edi, edi
jne 0x405c08
xor eax, eax
jmp 0x405c60
push edi
call fcn.004059df
test byte [0x446c68], 0x80
je 0x405c21
mov al, byte [edi]
test al, al
je 0x405c04
cmp al, 0x5c
je 0x405c04
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x405c41
push esi
call fcn.00405a79
test eax, eax
je 0x405c3b
test byte [eax], 0x10
je 0x405c65
push esi
call fcn.00405bc0
push esi
call ebx
cmp eax, edi
jg 0x405c2c
push esi
call fcn.00405b93
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405c5f
Function at 0x405f1d
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 2
call fcn.00405b0e
mov esi, dword [esp + 0x18]
test eax, eax
je 0x405f41
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40607a
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x43ba48], 0x4c554e
mov edi, 0x400
mov ebp, 0x43ba48
test esi, esi
je 0x405f85
push 1
push 0
push esi
call fcn.00405772
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406080
cmp eax, edi
jg 0x406080
push edi
mov esi, 0x43c388
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406080
cmp eax, edi
jg 0x406080
push esi
push ebp
push str._s_s_r_n
push 0x43be48
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x446c0c]
push dword [eax + 0x128]
push esi
call fcn.00405cbf
push 4
push 0xc0000000
push esi
call fcn.00405772
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, 0xffffffff
je 0x40607a
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x406073
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406073
cmp edi, dword [esp + 0x18]
jne 0x406073
push str._Rename__r_n
push esi
call fcn.00405c69
test eax, eax
jne 0x406087
push str._Rename__r_n
lea eax, [esi + edi]
jmp 0x516d48
mov eax, edi
push ebx
push 0x43be48
add eax, esi
push eax
call fcn.0040572e
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x446cd0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x407724
add eax, 0xa
push eax
call fcn.00405c69
test eax, eax
je 0x40603e
inc eax
lea ecx, [esi + edi]
mov ebp, eax
cmp eax, ecx
jae 0x4060ae
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x4060a3
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x406040
Function at 0x4060b6
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405be7
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x4060eb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x446cc8], eax
jmp 0x40627d
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x406106
test eax, eax
je 0x406228
test cl, 2
je 0x406228
push edi
push ebx
mov esi, 0x43c788
push esi
call fcn.004059bd
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x406129
push str..
push esi
call edi
jmp 0x40612f
push ebx
call fcn.00405bc0
cmp byte [ebx], 0
jne 0x40613d
cmp byte [0x43c788], 0x5c
jne 0x406145
push 0x407298
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40621d
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.00405697
cmp byte [eax], 0
je 0x406188
cmp byte [ebp - 0x18], 0
je 0x406188
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40619e
mov al, byte [esi + 1]
test al, al
je 0x4061fc
cmp al, 0x2e
jne 0x40619e
cmp byte [esi + 2], 0
je 0x4061fc
push esi
push edi
call fcn.004059bd
test byte [ebp - 0x148], 0x10
je 0x4061c3
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4061fc
push dword [ebp + 0xc]
push ebx
call fcn.004060b6
jmp 0x4061fc
push ebx
call fcn.00405752
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4061f4
test byte [ebp + 0xc], 4
je 0x4061ec
push ebx
push 0xfffffffffffffff1
call fcn.0040490d
push 0
push ebx
call fcn.00405f1d
jmp 0x4061fc
inc dword [0x446cc8]
jmp 0x4061fc
push ebx
push 0xfffffffffffffff2
call fcn.0040490d
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40616a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x406227
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40627c
cmp dword [ebp - 8], esi
je 0x40626c
push ebx
call fcn.00405a79
test eax, eax
je 0x40627c
push ebx
call fcn.00405b93
push ebx
call fcn.00405752
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x406274
test byte [ebp + 0xc], 4
je 0x40626c
jmp 0x516960
inc dword [0x446cc8]
jmp 0x40627c
push ebx
push 0xffffffffffffffe5
call fcn.0040490d
pop esi
pop ebx
leave
ret 8
Function at 0x406282
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43e78c], 0
jne 0x4062c0
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406296
mov dword [ecx*4 + 0x43e788], eax
inc ecx
cmp ecx, 0x100
jl 0x406291
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4062ed
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x43e788]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4062ce
not eax
pop ebp
ret 0xc
Function at 0x4082aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x4082ee
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x4082bd
jmp 0x4082ee
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x4082de
pop esi
pop ebp
ret

Function at 0x408d7c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x408db1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x408ddb
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x408ddb
test edi, edi
je 0x408da8
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x408da8
test edi, edi
je 0x408de3
mov eax, edi
jmp 0x408daa
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x408daa
int3
Function at 0x40b329
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestVector.exe_gMozillaPoisonSize], eax
call fcn.00408d7c
pop ecx
mov ecx, dword [sym.TestVector.exe_gMozillaPoisonSize]
mov dword [sym.TestVector.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40b361
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestVector.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x8de1a8
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de1ae
pop ebp
sub ebp, 6
sub ebp, 0x4de1a8
jmp 0x8de20c
inc edi
dec ebp
inc ecx
add ah, byte [ecx]
call 0x1d8de2d4
add byte [eax], al
add byte [eax + eax], ah
adc eax, 0x10674f00
cmp al, 0x2e
adc byte [esi + ebp], bh
pop edi
mov al, byte [0x5f8109a]
and eax, 0x8c5b57d2
mov esi, 0x1eaf093
add byte [eax], al
add byte [edx + 0x6b], dh
sub ah, byte [edx + 0x200f4e81]
fist dword [ebp + 0x6a56d85a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
jecxz 0x8de1c3
jmp 0x8de215
invalid
mov eax, 0x4de1a8
add eax, ebp
add eax, 0x93
mov ecx, 0x62e
mov edx, 0x832d6a49
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de22c
jmp 0x8de23f
and ecx, dword [ecx]
and dword [ecx + 0x59], ecx
dec ecx
dec ecx
and dword [ecx - 0x7b], ecx
dec ecx
jp 0x8de1d6
sbb dword [esi + 0xd6875dc], esi
dec ecx
sbb edx, eax
test dl, al
sal byte [ebp + 0x49], 0x49
dec ecx
enter 0xffffffffffffb188, 0x49
dec ecx
dec ecx
dec edx
test cl, dh
dec edi
dec ecx
dec ecx
dec ecx
popal
dec ecx
dec ecx
dec ecx
mov esi, 0xc2814aab
enter 0x4945, 0x49
dec ecx
dec edx
mov word [ecx], ds
and edx, edi
jle 0x8de2c0
dec ecx
and dword [edx + 0x48490de0], edi
insd dword es:[edi], dx
and dword [ecx + 0x49], ecx
dec ecx
dec ecx
mov eax, dword [0x4949494c]
mov al, byte [0x49494961]
sbb al, 0xc2
movsd dword es:[edi], dword [esi]
ret 0x41cc
ret 0x6dc5