joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40102a
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ebx, ebx
pop ecx
test eax, eax
je 0x401078
push str.Windows_original_main_args:_n
call fcn.004010f9
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov esi, ebx
pop ecx
call edi
cmp dword [eax], ebx
jle 0x401078
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.004010f9
add esp, 0xc
inc esi
call edi
cmp esi, dword [eax]
jl 0x401058
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov edi, eax
lea ecx, [edi*4 + 4]
push ecx
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
mov edx, ebx
test edi, edi
jle 0x4010b2
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x4010a7
mov ecx, dword [str.java]
mov dword [esi + edx*4], ebx
test ecx, ecx
jne 0x4010c1
mov ecx, dword [esi]
mov eax, dword [section..data]
test eax, eax
jne 0x4010cc
mov eax, dword [esi]
push ebx
push ebx
push ebx
push 1
push ecx
push eax
push 0x4021a8
push 0x4021ac
push 0x40300c
push 2
push 0x403004
push 2
push esi
push edi
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..pdata
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x543510f2
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..pdata_1
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4ff0604
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x6042f949
Capabilities:
Encode data using xor

Disassembly:
add dword [ebx + 0x3858781c], ecx
mov dl, 0xdd
xchg ebx, eax
dec edx
pop ebx
sahf
sbb eax, 0x2dc69cd7
add bh, byte [esi + 0xa]
dec esi
je 0x6042f87d
inc esi
invalid
add byte [eax], al
add dword [eax], eax
add byte [eax], al
cmp byte [ecx + edi*8 - 0x71], bh
cmp byte [ecx + edi*8 - 0x71], bh
inc eax
jl 0x6042f83c
pop dword [eax + 0x7c]
stc
pop dword [eax]
add byte [eax], al
add byte [eax - 0x2f7bd9da], al
adc al, bh
test byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx - 0x1908d03], ah
and edx, edx
add dword [eax], eax
dec byte [eax - 0x32976401]
add dword [edx], esi
jne 0x6042f800
jno 0x6042f86f
and edx, edx
add dword [edx], eax
mov edi, 0xd221fe6f
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
mov edi, 0xd221fe6f
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ch
add eax, 0
add byte [eax], al
inc eax
aaa
sbb eax, dword fs:[eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx + eax + 0x10020040], bl
or al, 0x5f
xchg esp, eax
test dword [eax], eax
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, ch
pop esi
xchg esp, eax
test dword [edi*2 + 0x7d348ff9], esi
stc
pop dword [eax]
add byte [eax], al
add byte [edi*2 + 0x8ff9], al
add byte [eax], al
sbb byte [esi - 7], bh
jle 0x6042f944
pop dword [eax]
add byte [eax], al
add byte [0xdbaadf0], cl
invalid
Function at 0x60439af5
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea edx, [eax + 0x38]
push 0x68
pop ecx
mov esi, ebx
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x178]
and dword [edx], 0
and dword [eax + 0x3c], 0
mov edi, dword [0x75b21100]
mov dword [eax + 0x14], ecx
mov eax, dword [ebx]
test eax, eax
jne 0x60431374
mov eax, dword [ebx + 4]
test eax, eax
je 0x60439b7d
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x60439b3e
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 2]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 8
push dword [eax + 0x18]
call edi
mov edi, eax
test edi, edi
je 0x60431379
push dword [ebx + 4]
shr esi, 1
push esi
push edi
call fcn.6043d9ac
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x604d4a88
Capabilities:
Encode data using xor

Disassembly:
or al, byte [ebx]
jb 0x604d4a64
add byte gs:[ecx], ah
add byte fs:[ebp], ch
add byte gs:[esi], ch
add byte [eax + eax + 0x78], dh
add byte [eax + eax], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], dl
adc byte [esi], al
das
add byte [esi + 0x4d], al
outsb dx, byte [esi]
pushal
sti
mov fs, word [ebx - 0x7bed0990]
sbb al, 0x8f
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov al, byte [0xc73c6e]
add byte [eax], al
add byte [eax], al
Function at 0x6050e1f6
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ecx]
mov ecx, dword [edx + 0x248]
push esi
xor eax, eax
push edi
mov dword [ecx + 0x80], ebx
mov dword [ebp - 4], eax
movzx ecx, word [ebx]
test ecx, 0xff00
movzx ecx, cx
jne 0x60521dc2
movzx ecx, byte [ecx + 0x753b9ca0]
and ecx, 4
test ecx, ecx
je 0x6051a4e2
add ebx, 2
movzx ecx, word [ebx]
test ecx, 0xff00
movzx ecx, cx
jne 0x60521ddd
movzx ecx, byte [ecx + 0x753b9ca0]
and ecx, 8
test ecx, ecx
jne 0x6050e23c
movzx ecx, word [ebx]
cmp cx, 0x3a
je 0x6051434a
test cx, cx
je 0x6051513e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
pop edi
mov dword [ecx], ebx
mov ecx, dword [ebp - 4]
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
dec ebx
jmp dword [ecx]
add byte fs:[ecx], ch
outsd dx, dword [esi]
add byte [0x75004100], ch
Function at 0x605632e9
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 2]
push esi
movzx esi, word [ecx]
shl edx, 0x10
mov eax, esi
or esi, edx
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x6056331c
add ecx, 4
nop
nop
nop
nop
mov edx, dword [ecx]
xor edx, esi
add esi, edx
add ecx, 4
dec eax
jne 0x60563310
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x60584d59
Capabilities:
Encode data using xor

Disassembly:
add byte [esi], dh
add byte [ecx], ah
add byte fs:[ebx], dh
add byte [esi], dh
add byte [eax + eax], dh
add byte gs:[ebx], dh
add byte [0x20002200], dh
add byte [edx], ah
jne 0x60584d74
imul eax, dword [eax], 0x64006c
push esp
add byte [ecx], bh
jo 0x60584d80
add byte gs:[0x72002200], bh
add byte [ebp], ah
insb byte es:[edi], dx
add byte [ebp], ah
popal
add byte [ebx], dh
add byte gs:[edx], ah
add byte [edi], ch
add byte [esi], bh
add byte [eax + eax], bh
das
add byte [eax], dh
popal
add byte [edx], dh
add byte gs:[esi], ch
je 0x60584daa
add byte ds:[eax + eax], bh

Function at 0x605e853c
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
Function at 0x6061243f
Capabilities:
Encode data using xor

Disassembly:
add byte [eax - 0x2b], dl
in al, 3
sbb dword [esi + 0x1c], 0x3000303
add byte [ecx], al
add byte [ecx], al
add byte [edx + 0x51], dl
cmp al, byte [ebx + 0x18900]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add dword [eax], eax
push edx
sub byte [edx], cl
add dword [eax], 0xffffffb7
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add dword [eax], eax
xchg ecx, eax
or al, 0xb0
add dword [ecx + 0x3002bbe], eax
add byte [ebx], al
add byte [ecx], al
add byte [ecx], al
add byte [eax], ah
add al, 0x21
add eax, dword [eax + 0x5002198]
add byte [0x1000100], al
add byte [edx + 0x837b36], dl
and al, byte [ecx]
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ecx], al
add byte [edx + 0x830a28], dl
mov esp, 6
add byte [eax], al
add dword [eax], eax
add dword [eax], eax
mov byte [0x830a28], al
add al, 0
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add dword [eax], eax
mov byte [0x837b36], al
add byte [ecx], al
add byte [edx + 0x837b36], ah
lodsb al, byte [esi]
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add dword [eax], eax
push eax
inc edi
mov byte [ebx], 0x81
xor eax, dword [ebx]
add eax, dword [eax]
add eax, dword [eax]
add dword [eax], eax
add dword [eax], eax
xor byte [eax + 0x22800329], dl
add byte [eax], al
add al, 0
add al, 0
add dword [eax], eax
add dword [eax], eax
loop 0x606124bd
cmp eax, 0x255c8083
add byte [ebx], al
add byte [ebx], al
add byte [ecx], al
add byte [ecx], al
add byte [eax + 0x12], dl
int3

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x40d248
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f9b
mov dword [ebp - 0x14], eax
cmp dword [0x4ae478], esi
jne 0x40d33b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d2c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d41b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d41b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d41b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ae478], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ae47c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ae480], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ae488], eax
test eax, eax
je 0x40d338
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ae484], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d360
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d353
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d375
push 4
pop eax
jmp 0x40d41d
cmp dword [ebp - 0x14], esi
je 0x40d375
push dword [0x4ae478]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d35a
mov eax, dword [0x4ae484]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d3d3
cmp dword [0x4ae488], edi
je 0x40d3d3
push eax
call ebx
push dword [0x4ae488]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d3d3
test eax, eax
je 0x40d3d3
call ecx
test eax, eax
je 0x40d3c8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d3c8
test byte [ebp - 8], 1
jne 0x40d3d3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d403
mov eax, dword [0x4ae47c]
cmp eax, edi
je 0x40d400
push eax
call ebx
test eax, eax
je 0x40d400
call eax
mov esi, eax
test esi, esi
je 0x40d400
mov eax, dword [0x4ae480]
cmp eax, edi
je 0x40d400
push eax
call ebx
test eax, eax
je 0x40d400
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ae478]
call ebx
test eax, eax
je 0x40d41b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d41d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040433c
mov esp, ebp
pop ebp
ret
Function at 0x10001000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x20
mov eax, dword [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.10001e70
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10004643
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10004682
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10004682
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10004682
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10004682
cmp dword [ecx + 0x74], 0xe
jbe 0x10004682
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100072ff
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000739c
push ebx
push esi
call fcn.100072c8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000725c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10007349
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000739b
push edi
push eax
call fcn.100082ba
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10007369
call fcn.10005da4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000739a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000725c
add esp, 0x20
test eax, eax
jne 0x10007388
push edi
call fcn.10005da4
jmp 0x10007390
push ebx
call fcn.10005da4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10007609
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f508
push 0x1000f500
push str.FlsAlloc
push 0x1f
call fcn.10007525
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000763d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e10c]
call esi
jmp 0x10007643
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10007687
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f518
push 0x1000f510
push str.FlsGetValue
push 0x21
call fcn.10007525
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100076be
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e10c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100076c6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f520
push 0x1000f518
push str.FlsSetValue
push 0x22
call fcn.10007525
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007700
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000e10c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x410c99
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestJSONWriter.exe_gMozillaPoisonSize], eax
call fcn.0040d0c0
pop ecx
mov ecx, dword [sym.TestJSONWriter.exe_gMozillaPoisonSize]
mov dword [sym.TestJSONWriter.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x410cd1
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestJSONWriter.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4015e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
test ecx, ecx
push edi
je 0x4016f1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4016f1
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4016f1
mov edi, dword [esp + 0x24]
test edi, edi
je 0x4016f1
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
push eax
push ecx
call esi
test eax, eax
jne 0x4016f1
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4016b1
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4016ea
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push edi
push 0
push 0
push ebx
push ecx
mov dword [esp + 0x38], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40169a
mov edx, dword [esp + 0x18]
mov esi, ebp
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [esp + 0x18]
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
call ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push edi
push 0
push 0
push ebx
push eax
mov dword [esp + 0x30], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4016ea
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov edx, dword [esp + 0x14]
push edx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x14

Function at 0x401cc0
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi]
call dword [eax + 0xc]
test eax, eax
je 0x401d33
mov edi, dword [esp + 0x10]
test edi, edi
je 0x401d33
lea ecx, [esp + 0x10]
lea edx, [esi + 0x117]
push ecx
push 0x20006
push ebx
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401d33
mov ecx, dword [esp + 0x10]
push 0x104
push edi
push 1
push eax
lea eax, [esi + 0x14]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x401d28
add esi, 0x317
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
ret 4

Function at 0x4023d0
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x160
test eax, eax
je 0x40241c
mov ecx, dword [esp + 0x168]
lea edx, [esp]
push ecx
push 0x160
push edx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x40241c
mov ecx, dword [esp + 0x16c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
add esp, 0x160
ret
xor eax, eax
add esp, 0x160
ret