joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10056d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a0f9e
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x100cd4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x10056f94
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 1
call fcn.1004df50
add esp, 4
lea ecx, [ebp - 0x224]
mov eax, dword [eax + 0xc]
push eax
call fcn.10002180
mov dword [ebp - 4], 1
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x10056f9e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push 0x100ab9e4
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.100020c0
test al, al
jne 0x10056e3b
push 3
push 0x100ab9e4
lea ecx, [ebp - 0x21c]
call fcn.10001950
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
push 0x20219
push dword [ebp - 0x224]
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10004f20
mov esi, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x238]
test eax, eax
jne 0x10056f2e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1006c590
add esp, 0xc
mov dword [ebp - 0x220], 0x208
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10056f2e
mov eax, dword [ebp - 0x22c]
cmp eax, 1
je 0x10056edf
cmp eax, 2
jne 0x10056f2e
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x10056efc
test al, 1
jne 0x10056f2e
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x10056f05
jmp 0x10056f2e
xor eax, eax
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10056f10
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10001950
test edi, edi
je 0x10056f39
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10056f57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 0
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x10056f76
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100015b0
push 0x80004005
call fcn.100015b0
int3
Function at 0x1005d610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1a08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100cd4bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1006129e
mov edi, eax
add esp, 4
test edi, edi
je 0x1005d6ad
push 1
mov dword [ebp - 4], 0
call fcn.1004fc44
add esp, 4
mov dword [edi + 4], eax
jmp 0x1005d6af
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.10050613
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov dword [ebp - 4], 3
test edi, edi
je 0x1005d711
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x1005d711
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x1005d734
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1005d757
cmp byte [ebp + 0xc], 0
je 0x1005d743
push esi
call fcn.1005001b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1005d763
mov esi, str.ios_base::badbit_set
jmp 0x1005d773
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.10007720
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.100036e0
push 0x100c3d54
lea eax, [ebp - 0x30]
push eax
call fcn.1006b236
int3
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401c66
pop dword [ebp - 0x40]
mov eax, 0xa8691706
add eax, 0x57d70560
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x43e5ddb
sub dword [ebp - 0x50], 0xb5ec1890
mov dword [ebp - 0x4c], 0xf7209977
sub dword [ebp - 0x4c], 0xc4ed4d32
mov dword [ebp - 0x48], 0x8b72a2ce
sub dword [ebp - 0x48], 0x3f265ea0
mov dword [ebp - 0x44], 0xe84da696
sub dword [ebp - 0x44], 0xe84da696
lea eax, [ebp - 0x50]
push eax
mov eax, 0xf4f54052
add eax, 0xb4af002
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xb35f570c
add dword [ebp - 0x50], 0xc113124a
mov dword [ebp - 0x4c], 0xdaa246ff
sub dword [ebp - 0x4c], 0x9935e58a
mov dword [ebp - 0x48], 0xadab4e58
add dword [ebp - 0x48], 0xb5c41e14
mov dword [ebp - 0x44], 0x700e4a8e
sub dword [ebp - 0x44], 0x700e4a8e
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x384ea
push 0
call eax
mov ecx, 0x4f4e
xor edx, edx
add edx, eax
mov ebx, 0x2afd8812
add ebx, 0xd542e7ee
add ebx, dword [ebp - 0x40]
mov edi, 0xebaa5c7d
sub edi, 0xdfd864a4
xor dword [ebp - 0x18], edi
mov esi, dword [ebx]
add dword [ebp - 0x38], edx
add esi, edi
mov dword [edx], esi
add edx, 0xf105251e
add edx, 0xefadae6
add ebx, 0xd3ef2d55
add ebx, 0x2c10d2af
loop 0x401d7f
add eax, 0x24097849
sub eax, 0x2408483e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x20542d74
sub ecx, 0x20142d74
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x29a010c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x29a010d6
pop dword [ebp - 0x20]
mov eax, 0x4e62fddc
add eax, 0xdb3d12fa
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xcfa08ef3
add dword [ebp - 0x30], 0x7eb1b658
mov dword [ebp - 0x2c], 0xfd538630
add dword [ebp - 0x2c], 0x34dfc615
mov dword [ebp - 0x28], 0xe1fd2ed
sub dword [ebp - 0x28], 0xc1d38ebf
mov dword [ebp - 0x24], 0x542d4302
add dword [ebp - 0x24], 0xabd2bcfe
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xe1d5530d
sub dword [ebp - 0x30], 0x6d62e9b7
mov dword [ebp - 0x2c], 0xabf0865b
sub dword [ebp - 0x2c], 0x6a8424e6
mov dword [ebp - 0x28], 0x1467708c
sub dword [ebp - 0x28], 0xb0f80420
mov dword [ebp - 0x24], 0x9d0be707
add dword [ebp - 0x24], 0x62f418f9
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x2937fcf5
add eax, 0x69434f
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3f1ef
push 0
call eax
mov ecx, 0xfd4bbc1d
add ecx, 0x2b49f38
xor edi, edi
add edi, eax
mov ebx, 0x29a22000
add ebx, dword [ebp - 0x20]
mov edx, 0x4df09ebb
add edx, 0x7206147c
xor dword [ebp - 8], 0x51645930
mov esi, dword [ebx]
mov dword [ebp - 0x14], 0x9b211a55
sub esi, edx
mov dword [ebp - 4], 0x3ca74f56
mov dword [edi], esi
xor dword [ebp - 0x10], edi
add edi, 4
add ebx, 0xc2785ae5
add ebx, 0x3d87a51f
loop 0x29a011ef
add eax, 0x16027
xor ebx, ebx
add ebx, eax
add eax, 0x54ca1c78
sub eax, 0x54ca1c73
mov ecx, 0x5f4ea4f7
add ecx, 0xca515b09
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0xc654d8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub eax, dword [edx + ecx + 0x10]
jmp 0xbd6afd
je 0xd27633
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x837261
je 0xd27633
mov eax, dword [eax + ecx + 0x7c]
cmp cl, 0xc7
clc
cmc
push ebx
push edi
cmc
clc
mov dword [ebp - 0x10], eax
stc
mov dword [ebp - 8], 0xffffffff
clc
cmc
cmp esi, 0xffff
jmp 0x891b09
mov edi, dword [edx + ecx + 0x18]
jmp 0xc9647b
je 0xd27633
mov eax, 0x5a4d
cmp al, 0xa1
jmp 0xc13037
ja 0x81fcac
mov eax, esi
test ecx, ecx
jmp 0x7a22c7
cmp dword [eax + ecx], 0x4550
jmp 0xbe98bc
mov dword [ebp - 8], eax
jmp 0xd08ac7
jne 0xd27633
mov edx, dword [eax + ecx + 0x78]
cmp ax, di
jmp 0xca3894
add eax, ecx
cmp ah, 0xb
cmp bp, si
xor ebx, ebx
jmp 0xd01ca8
cmp word [ecx], ax
jmp 0xd2762d
push ebp
mov ebp, esp
xor cl, 0xf2
ror cl, cl
mov ecx, dword [ebp + 8]
lea esp, [esp - 0x114]
push esi
clc
test ecx, ecx
jmp 0x7ca930
js 0x8302a4
jmp 0xd16cda
je 0x8302a4
mov eax, dword [edx + ecx + 0x20]
test bx, 0x78ab
cmp ah, dl
jmp 0xbefab2
mov eax, dword [ecx + 0x3c]
jmp 0xbd537c
test edi, edi
jmp 0xc74b18
mov dword [ebp - 4], edx
test edx, edx
jmp 0x81bf06
ret
dec edi
jmp 0xd1b746
jmp 0x8302a4
mov dword [ebp - 0xc], eax
jmp 0xc66898
je 0xc85398
xor eax, eax
pop esi
mov esp, ebp
pop ebp
jmp 0xcd1877
Function at 0x10004830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004839
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004859
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055a9
pop esi
pop ebp
ret 8

Function at 0x100055c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055c9
pop esi
pop ebp
ret 4

Function at 0x100055e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055e9
pop esi
pop ebp
ret 8

Function at 0x100186b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1018092c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101837c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018788
push esi
push 0x55
pop esi
push esi
push 0x101837d0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018772
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a9420
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x101837d0], 0x5f
mov cl, 0x2d
je 0x10018712
mov cl, byte [eax*2 + 0x101837d0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001871f
inc eax
cmp eax, esi
jl 0x100186fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call fcn.100c4dcd
mov esi, eax
pop ecx
test esi, esi
je 0x10018772
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.100c4dcd
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001876b
push 0x10017f70
push 0x17
mov byte [eax + esi], bl
mov dword [0x101837c8], esi
mov byte [0x101837cc], 1
call fcn.100c4dcd
pop ecx
jmp 0x10018771
push esi
call fcn.100c4dcd
pop ecx
mov ecx, dword [0x101837c8]
mov eax, 0x100fef10
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x101837c8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10084499
leave
ret
Function at 0x100c4dcd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100c4ddc
pop dword [ebp - 0x40]
mov eax, 0x100c4ddc
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x70fae
push 0
mov eax, 0x73306843
sub eax, 0x632136ff
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x44ab
xor ebx, ebx
add ebx, eax
mov esi, 0x10191000
add esi, dword [ebp - 0x40]
mov edi, 0xec1629b5
sub edi, 0x2d696892
mov edx, dword [esi]
add edx, edi
xor dword [ebp - 0x18], edi
mov dword [ebx], edx
add dword [ebp - 8], 0xf08f20c9
add ebx, 0xa66f449
sub ebx, 0xa66f445
add esi, 4
loop 0x100c4e2c
add eax, 0x1057f
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4089ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f050]
jne 0x4089d4
repz ret
jmp fcn.0040a363

Function at 0x410d73
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040aee3
and dword [ebp - 4], 0
cmp dword [0x4d5dc0], 0
mov ebx, eax
jne 0x410e24
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410ed5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x410ed5
push eax
call fcn.0040ae71
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4d5dc0], eax
call esi
push eax
call fcn.0040ae71
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d5dc4], eax
call esi
push eax
call fcn.0040ae71
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4d5dc8], eax
call esi
push eax
call fcn.0040ae71
pop ecx
mov dword [0x4d5dd0], eax
test eax, eax
je 0x410e24
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ae71
pop ecx
mov dword [0x4d5dcc], eax
mov eax, dword [0x4d5dcc]
cmp eax, ebx
je 0x410e7c
cmp dword [0x4d5dd0], ebx
je 0x410e7c
push eax
call fcn.0040aeec
push dword [0x4d5dd0]
mov esi, eax
call fcn.0040aeec
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410e7c
test edi, edi
je 0x410e7c
call esi
test eax, eax
je 0x410e73
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410e73
test byte [ebp - 0xc], 1
jne 0x410e7c
or dword [ebp + 0x10], 0x200000
jmp 0x410eb5
mov eax, dword [0x4d5dc4]
cmp eax, ebx
je 0x410eb5
push eax
call fcn.0040aeec
pop ecx
test eax, eax
je 0x410eb5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410eb5
mov eax, dword [0x4d5dc8]
cmp eax, ebx
je 0x410eb5
push eax
call fcn.0040aeec
pop ecx
test eax, eax
je 0x410eb5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d5dc0]
call fcn.0040aeec
pop ecx
test eax, eax
je 0x410ed5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410ed7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x571d0f05
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x2ca06955
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40b2b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40b2fe
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40b2cd
jmp 0x40b2fe
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40b2ee
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40c394
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c3c9
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c3f3
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c3f3
test edi, edi
je 0x40c3c0
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c3c0
test edi, edi
je 0x40c3fb
mov eax, edi
jmp 0x40c3c2
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c3c2
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_fx_team_w32_d_0000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.00410107
add esp, 0xc
int3
Function at 0x10020ff5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10021004
pop dword [ebp - 0x34]
mov eax, 0x683977bd
add eax, 0xa7c89847
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x6308e2f8
sub dword [ebp - 0x44], 0x14b69dad
mov dword [ebp - 0x40], 0x89d30aad
add dword [ebp - 0x40], 0xa8604198
mov dword [ebp - 0x3c], 0xdabf76ee
sub dword [ebp - 0x3c], 0x8e7332c0
mov dword [ebp - 0x38], 0xf33cccc7
add dword [ebp - 0x38], 0xcc33339
lea eax, [ebp - 0x44]
push eax
mov eax, 0x32e42611
sub eax, 0x22e205cd
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xd075e891
sub dword [ebp - 0x44], 0x5c037f3b
mov dword [ebp - 0x40], 0xc7d32377
add dword [ebp - 0x40], 0x79993dfe
mov dword [ebp - 0x3c], 0x249a644
add dword [ebp - 0x3c], 0x6125c628
mov dword [ebp - 0x38], 0xc15d4624
sub dword [ebp - 0x38], 0xc15d4624
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x790dcd4b
add eax, 0x96f452f5
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39c56
push 0
call eax
mov ecx, 0x9ea9a367
add ecx, 0x6156ab40
xor edx, edx
add edx, eax
mov ebx, 0xc3e97cdb
add ebx, 0x4c199f25
add ebx, dword [ebp - 0x34]
mov esi, 0x8332a337
sub dword [ebp - 4], eax
mov edi, dword [ebx]
xor dword [ebp - 0x14], ebx
xor edi, esi
add dword [ebp - 8], ecx
mov dword [edx], edi
add edx, 0x6417e7f5
add edx, 0x9be8180f
add ebx, 0xdebbcba2
sub ebx, 0xdebbcb9e
loop 0x10021122
add eax, 0xbf7166ae
sub eax, 0xbf70393f
mov ebx, eax
add eax, 5
mov ecx, 0xae16f709
add ecx, 0x61e908f7
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x441c80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x27000]
push edi
or ebp, 0xffffffff
jmp 0x441ca2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x441ca9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x441c98
mov eax, 1
add ebx, ebx
jne 0x441cbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x441cb0
jne 0x441ccc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x441cb0
xor ecx, ecx
sub eax, 3
jb 0x441ce0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x441d52
mov ebp, eax
add ebx, ebx
jne 0x441ceb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x441cf8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x441d1c
inc ecx
add ebx, ebx
jne 0x441d08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x441cfd
jne 0x441d19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x441cfd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x441d3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x441d2d
jmp 0x441c9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x441d3c
add edi, ecx
jmp 0x441c9e
pop esi
mov edi, esi
mov ecx, 0xcd8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x441d5a
cmp byte [edi], 9
jne 0x441d5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x441d5f
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x441dd7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41f74]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x42074]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x441d8c
mov ecx, edi
jns 0x441dbb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4207c]
or eax, eax
je 0x441dd1
mov dword [ebx], eax
add ebx, 4
jmp 0x441da9
call dword [esi + 0x42078]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x441e08
cmp al, 0xef
ja 0x441dfb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x441ddd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x441dea
mov ebp, dword [esi + 0x42080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x441e3c
sub esp, 0xffffff80
jmp 0x41f306